Development April 2021

development@lists.ipfire.org

15 participants
161 discussions

[PATCH] BUG12301: Iptables “host/network ‘none’ not found”
by Alexander Marx 12 Apr '21

12 Apr '21

Fixes: #12301 When using hosts with MAC-addresses in a hostgroup, the rule won't be generated if those hosts are selected as target. There is a hint but due to a wrong hashparameter the hint was not shown. With this patch the hint is shown again. Additionally the rule is skipped when rules.pl creates rules. There are no bootmessages with failed target "none" anymore. --- config/firewall/firewall-lib.pl | 4 ++-- html/cgi-bin/firewall.cgi | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl index bc0b30ca5..e7ec30ae0 100644 --- a/config/firewall/firewall-lib.pl +++ b/config/firewall/firewall-lib.pl @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2013 Alexander Marx <amarx(a)ipfire.org> # +# Copyright (C) 2021 Alexander Marx <amarx(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -315,7 +315,7 @@ sub get_addresses foreach my $grp (sort {$a <=> $b} keys %customgrp) { if ($customgrp{$grp}[0] eq $value) { my @address = &get_address($customgrp{$grp}[3], $customgrp{$grp}[2], $type); - + next if ($address[0][0] eq 'none'); if (@address) { push(@addresses, @address); } diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 1483e779f..b0851dd3e 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -592,7 +592,7 @@ sub checktarget &General::readhasharray("$confighost", \%customhost); foreach my $grpkey (sort keys %customgrp){ foreach my $hostkey (sort keys %customhost){ - if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customgrp{$grpkey}[2] eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $customhost{$hostkey}[1] eq 'mac'){ + if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customgrp{$grpkey}[0] eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $customhost{$hostkey}[1] eq 'mac'){ $hint=$Lang::tr{'fwdfw hint mac'}; return $hint; } -- 2.25.1

2 1

[PATCH] rrdimage: Improve CGI & cosmetic changes
by Leo-Andres Hofmann 11 Apr '21

11 Apr '21

Write graph error messages to the system log, to simplify further inspection by the user. Add additional parameter check to prevent a possible redirect loop if the URL format is changed in the future. Cosmetic: Use underlining instead of background color for highlighting Fixes #10643 Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- html/cgi-bin/getrrdimage.cgi | 6 +++++- html/html/themes/ipfire/include/css/style.css | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/getrrdimage.cgi b/html/cgi-bin/getrrdimage.cgi index 0caefe0ac..34ee4bf7a 100644 --- a/html/cgi-bin/getrrdimage.cgi +++ b/html/cgi-bin/getrrdimage.cgi @@ -60,7 +60,7 @@ unless(($origin =~ /^\w+?\.cgi$/) && ($graph =~ /^[\w-]+?$/) && ($range ~~ @Grap # Unsupported graph origin: Redirect request to the CGI specified in the "origin" parameter # This enables backwards compatibility with addons that use Graphs::makegraphbox to ouput their own graphs -unless($origin ~~ @supported_origins) { +unless(($origin ~~ @supported_origins) || ($origin eq "getrrdimage.cgi")) { # Rewrite to old URL format: /[graph origin cgi]?[graph name]?[time range] my $location = "https://$ENV{'SERVER_NAME'}:$ENV{'SERVER_PORT'}/cgi-bin/${origin}?${graph}?${range}"; @@ -195,6 +195,10 @@ if($origin eq "entropy.cgi") { ## entropy.cgi # Add request parameters for debugging if($graphstatus) { $graphstatus = "$graphstatus\n($origin, $graph, $range)"; + + # Save message in system log for further inspection + General::log($graphstatus); + _print_error($graphstatus); } diff --git a/html/html/themes/ipfire/include/css/style.css b/html/html/themes/ipfire/include/css/style.css index 10644a9f8..2c727a770 100644 --- a/html/html/themes/ipfire/include/css/style.css +++ b/html/html/themes/ipfire/include/css/style.css @@ -348,14 +348,14 @@ div.rrdimage > ul { border: none; background: none; cursor: pointer; - text-decoration: underline; + text-decoration: none; } .rrdimage button:focus { outline: none; box-shadow: none; } .rrdimage button.selected { - background-color: rgba(135, 203, 0, 0.2); + text-decoration: underline; } div.rrdimage > img { -- 2.27.0.windows.1

1 0

[PATCH v2] ppp: update to 2.4.9
by Peter Müller 10 Apr '21

10 Apr '21

This is the first ppp release for years, and the project appears to have a different maintainer (team?) by now. As a result, some of our patches are no longer necessary as they made it into upstream, while others need to be adjusted slightly. In addition, their configure script does not handle commas in CFLAGS properly, which is why the delimiter for the 'sed' call in it has to be changed to something neither appearing in a path nor in our CLFAGS set. The full changelog of this release can be retrieved from https://ppp.samba.org/README.html and says: * Support for new EAP (Extensible Authentication Protocol) methods: - Support for EAP-TLS, from Jan Just Keijser and others - Support for EAP-MSCHAPv2, from Eivind NÃ¦ss, Thomas Omerzu, Tijs Van Buggenhout and others * New pppd options: - chap-timeout - chapms-strip-domain - replacedefaultroute - noreplacedefaultroute - ipv6cp-accept-remote - lcp-echo-adaptive - ip-up-script - ip-down-script - ca - capath - cert - key - crl-dir - crl - max-tls-version - need-peer-eap * Fixes for CVE-2020-8597 and CVE-2015-3310. * libpcap is now required when compiling on Linux (previously, if libpcap was not present, pppd would be compiled without packet filtering support). * The rp-pppoe plugin has been renamed to pppoe, to distinguish it from the upstream rp-pppoe code. Its options have changed names, but the old names are kept as aliases. * The configure script now supports cross-compilation. * Many bug fixes and cleanups. Thanks to Michael for his hint on the ./configure CFLAGS issue. The second version of this patch correctly updates the src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch patch for the second hunk in pppd/main.c, where socket permissions have been changed meanwhile. Further, it has been successfully tested against a VDSL 100 line in Germany, using PAP to Easybell via 1&1 L2 BSA. No connectivity issues or other anomalies have been observed so far. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/ppp | 29 +++-- lfs/ppp | 15 +-- ...e-compiler-flags-handed-to-us-by-rpm.patch | 121 ------------------ .../0013-everywhere-O_CLOEXEC-harder.patch | 10 +- ...se-SOCK_CLOEXEC-when-creating-socket.patch | 33 ++--- ...ppp-2.4.6-increase-max-padi-attempts.patch | 6 +- src/patches/ppp/ppp-2.4.7-headers_4.9.patch | 6 +- ....8-pppd-fix-bounds-check-in-eap-code.patch | 35 ----- ...-configure-to-handle-cflags-properly.patch | 15 +++ 9 files changed, 62 insertions(+), 208 deletions(-) delete mode 100644 src/patches/ppp/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch delete mode 100644 src/patches/ppp/ppp-2.4.8-pppd-fix-bounds-check-in-eap-code.patch create mode 100644 src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch diff --git a/config/rootfiles/common/ppp b/config/rootfiles/common/ppp index f1f4f88f2..8d0af69c4 100644 --- a/config/rootfiles/common/ppp +++ b/config/rootfiles/common/ppp @@ -2,6 +2,8 @@ etc/ppp/chap-secrets etc/ppp/demonloginscript etc/ppp/dialer +#etc/ppp/eaptls-client +#etc/ppp/eaptls-server etc/ppp/ioptions etc/ppp/ip-down etc/ppp/ip-up @@ -12,6 +14,7 @@ etc/ppp/standardloginscript #usr/include/pppd/ccp.h #usr/include/pppd/chap-new.h #usr/include/pppd/chap_ms.h +#usr/include/pppd/eap-tls.h #usr/include/pppd/eap.h #usr/include/pppd/ecp.h #usr/include/pppd/eui64.h @@ -23,6 +26,7 @@ etc/ppp/standardloginscript #usr/include/pppd/magic.h #usr/include/pppd/md4.h #usr/include/pppd/md5.h +#usr/include/pppd/mppe.h #usr/include/pppd/patchlevel.h #usr/include/pppd/pathnames.h #usr/include/pppd/pppcrypt.h @@ -33,18 +37,19 @@ etc/ppp/standardloginscript #usr/include/pppd/tdb.h #usr/include/pppd/upap.h usr/lib/pppd -usr/lib/pppd/2.4.8 -#usr/lib/pppd/2.4.8/minconn.so -#usr/lib/pppd/2.4.8/openl2tp.so -#usr/lib/pppd/2.4.8/passprompt.so -#usr/lib/pppd/2.4.8/passwordfd.so -#usr/lib/pppd/2.4.8/pppoatm.so -#usr/lib/pppd/2.4.8/pppol2tp.so -#usr/lib/pppd/2.4.8/radattr.so -#usr/lib/pppd/2.4.8/radius.so -#usr/lib/pppd/2.4.8/radrealms.so -#usr/lib/pppd/2.4.8/rp-pppoe.so -#usr/lib/pppd/2.4.8/winbind.so +usr/lib/pppd/2.4.9 +#usr/lib/pppd/2.4.9/minconn.so +#usr/lib/pppd/2.4.9/openl2tp.so +#usr/lib/pppd/2.4.9/passprompt.so +#usr/lib/pppd/2.4.9/passwordfd.so +#usr/lib/pppd/2.4.9/pppoatm.so +#usr/lib/pppd/2.4.9/pppoe.so +#usr/lib/pppd/2.4.9/pppol2tp.so +#usr/lib/pppd/2.4.9/radattr.so +#usr/lib/pppd/2.4.9/radius.so +#usr/lib/pppd/2.4.9/radrealms.so +#usr/lib/pppd/2.4.9/rp-pppoe.so +#usr/lib/pppd/2.4.9/winbind.so usr/sbin/chat usr/sbin/pppd usr/sbin/pppdump diff --git a/lfs/ppp b/lfs/ppp index cbac95067..73356b8c4 100644 --- a/lfs/ppp +++ b/lfs/ppp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,12 +24,12 @@ include Config -VER = 2.4.8 +VER = 2.4.9 THISAPP = ppp-$(VER) DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) -DIR_APP = $(DIR_SRC)/ppp-$(THISAPP) +DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) CFLAGS += -fno-strict-aliasing @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = fa325e90e43975a1bd7e1012c8676123 +$(DL_FILE)_MD5 = f605d021b586fc26e35c6a54fd84b65f install : $(TARGET) @@ -73,16 +73,15 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && rm -f include/pcap-int.h include/linux/if_pppol2tp.h - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.4.7-headers_4.9.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.4.8-pppd-fix-bounds-check-in-eap-code.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch cd $(DIR_APP) && sed -i -e "s+/etc/ppp/connect-errors+/var/log/connect-errors+" pppd/pathnames.h - cd $(DIR_APP) && ./configure --prefix=/usr --disable-nls - cd $(DIR_APP) && make $(MAKETUNING) CC="gcc" RPM_OPT_FLAGS="$(CFLAGS)" + cd $(DIR_APP) && ./configure --prefix=/usr --cc="gcc" --cflags="$(CFLAGS)" --disable-nls + cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install cd $(DIR_APP) && make install-etcppp touch /var/log/connect-errors diff --git a/src/patches/ppp/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch b/src/patches/ppp/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch deleted file mode 100644 index 4a43d444a..000000000 --- a/src/patches/ppp/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +++ /dev/null @@ -1,121 +0,0 @@ -From d729b06f0ac7a5ebd3648ef60bef0499b59bf82d Mon Sep 17 00:00:00 2001 -From: Michal Sekletar <msekleta(a)redhat.com> -Date: Fri, 4 Apr 2014 11:29:39 +0200 -Subject: [PATCH 03/25] build-sys: utilize compiler flags handed to us by - rpmbuild - ---- - chat/Makefile.linux | 2 +- - pppd/Makefile.linux | 3 +-- - pppd/plugins/Makefile.linux | 2 +- - pppd/plugins/pppoatm/Makefile.linux | 2 +- - pppd/plugins/radius/Makefile.linux | 2 +- - pppd/plugins/rp-pppoe/Makefile.linux | 2 +- - pppdump/Makefile.linux | 2 +- - pppstats/Makefile.linux | 2 +- - 8 files changed, 8 insertions(+), 9 deletions(-) - -diff --git a/chat/Makefile.linux b/chat/Makefile.linux -index 1065ac5..848cd8d 100644 ---- a/chat/Makefile.linux -+++ b/chat/Makefile.linux -@@ -10,7 +10,7 @@ CDEF3= -UNO_SLEEP # Use the usleep function - CDEF4= -DFNDELAY=O_NDELAY # Old name value - CDEFS= $(CDEF1) $(CDEF2) $(CDEF3) $(CDEF4) - --COPTS= -O2 -g -pipe -+COPTS= $(RPM_OPT_FLAGS) - CFLAGS= $(COPTS) $(CDEFS) - - INSTALL= install -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 5a44d30..63872eb 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -32,8 +32,7 @@ endif - - CC = gcc - # --COPTS = -O2 -pipe -Wall -g --LIBS = -+COPTS = -Wall $(RPM_OPT_FLAGS) - - # Uncomment the next 2 lines to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 0a7ec7b..e09a369 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS = -shared - INSTALL = install -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 20f62e6..5a81447 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC - LDFLAGS = -shared - INSTALL = install -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 24ed3e5..45b3b8d 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -12,7 +12,7 @@ VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - INSTALL = install - - PLUGIN=radius.so radattr.so radrealms.so --CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON -+CFLAGS=-I. -I../.. -I../../../include $(RPM_OPT_FLAGS) -DRC_LOG_FACILITY=LOG_DAEMON - - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 5d7a271..352991a 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -25,7 +25,7 @@ INSTALL = install - # Version is set ONLY IN THE MAKEFILE! Don't delete this! - RP_VERSION=3.8p - --COPTS=-O2 -g -+COPTS=$(RPM_OPT_FLAGS) - CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - -diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux -index ac028f6..d0a5032 100644 ---- a/pppdump/Makefile.linux -+++ b/pppdump/Makefile.linux -@@ -2,7 +2,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 - --CFLAGS= -O -I../include/net -+CFLAGS= $(RPM_OPT_FLAGS) -I../include/net - OBJS = pppdump.o bsd-comp.o deflate.o zlib.o - - INSTALL= install -diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux -index cca6f0f..42aba73 100644 ---- a/pppstats/Makefile.linux -+++ b/pppstats/Makefile.linux -@@ -10,7 +10,7 @@ PPPSTATSRCS = pppstats.c - PPPSTATOBJS = pppstats.o - - #CC = gcc --COPTS = -O -+COPTS = $(RPM_OPT_FLAGS) - COMPILE_FLAGS = -I../include - LIBS = - --- -1.8.3.1 - diff --git a/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch b/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch index 2513021b2..0fb028779 100644 --- a/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch +++ b/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch @@ -27,10 +27,10 @@ index 6ea6c1f..faced53 100644 free(path); errno = err; diff --git a/pppd/main.c b/pppd/main.c -index 6d50d1b..4880377 100644 +index 87a5d29..152e4a2 100644 --- a/pppd/main.c +++ b/pppd/main.c -@@ -420,7 +420,7 @@ main(argc, argv) +@@ -400,7 +400,7 @@ main(int argc, char *argv[]) die(0); /* Make sure fds 0, 1, 2 are open to somewhere. */ @@ -39,12 +39,12 @@ index 6d50d1b..4880377 100644 if (fd_devnull < 0) fatal("Couldn't open %s: %m", _PATH_DEVNULL); while (fd_devnull <= 2) { -@@ -1679,7 +1679,7 @@ device_script(program, in, out, dont_wait) +@@ -1642,7 +1642,7 @@ device_script(char *program, int in, int out, int dont_wait) if (log_to_fd >= 0) errfd = log_to_fd; else -- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0600); -+ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0600); +- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0644); ++ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0644); ++conn_running; pid = safe_fork(in, out, errfd); diff --git a/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch index 3475f09a8..fffda981d 100644 --- a/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +++ b/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch @@ -7,9 +7,9 @@ Subject: [PATCH 14/25] everywhere: use SOCK_CLOEXEC when creating socket pppd/plugins/pppoatm/pppoatm.c | 2 +- pppd/plugins/pppol2tp/openl2tp.c | 2 +- pppd/plugins/pppol2tp/pppol2tp.c | 2 +- - pppd/plugins/rp-pppoe/if.c | 2 +- - pppd/plugins/rp-pppoe/plugin.c | 6 +++--- - pppd/plugins/rp-pppoe/pppoe-discovery.c | 2 +- + pppd/plugins/pppoe/if.c | 2 +- + pppd/plugins/pppoe/plugin.c | 6 +++--- + pppd/plugins/pppoe/pppoe-discovery.c | 2 +- pppd/sys-linux.c | 10 +++++----- pppd/tty.c | 2 +- 8 files changed, 14 insertions(+), 14 deletions(-) @@ -53,10 +53,10 @@ index a7e3400..e64a778 100644 if (fd >= 0) { memset (&ifr, '\0', sizeof (ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c +diff --git a/pppd/plugins/pppoe/if.c b/pppd/plugins/pppoe/if.c index 91e9a57..72aba41 100644 ---- a/pppd/plugins/rp-pppoe/if.c -+++ b/pppd/plugins/rp-pppoe/if.c +--- a/pppd/plugins/pppoe/if.c ++++ b/pppd/plugins/pppoe/if.c @@ -116,7 +116,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) stype = SOCK_PACKET; #endif @@ -66,10 +66,10 @@ index 91e9a57..72aba41 100644 /* Give a more helpful message for the common error case */ if (errno == EPERM) { fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c +diff --git a/pppd/plugins/pppoe/plugin.c b/pppd/plugins/pppoe/plugin.c index a8c2bb4..24bdf8f 100644 ---- a/pppd/plugins/rp-pppoe/plugin.c -+++ b/pppd/plugins/rp-pppoe/plugin.c +--- a/pppd/plugins/pppoe/plugin.c ++++ b/pppd/plugins/pppoe/plugin.c @@ -137,7 +137,7 @@ PPPOEConnectDevice(void) /* server equipment). */ /* Opening this socket just before waitForPADS in the discovery() */ @@ -97,10 +97,10 @@ index a8c2bb4..24bdf8f 100644 r = 0; } -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c +diff --git a/pppd/plugins/pppoe/pppoe-discovery.c b/pppd/plugins/pppoe/pppoe-discovery.c index 3d3bf4e..c0d927d 100644 ---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c +--- a/pppd/plugins/pppoe/pppoe-discovery.c ++++ b/pppd/plugins/pppoe/pppoe-discovery.c @@ -121,7 +121,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) stype = SOCK_PACKET; #endif @@ -147,15 +147,6 @@ index 00a2cf5..0690019 100644 if (s < 0) return 0; -@@ -2860,7 +2860,7 @@ ether_to_eui64(eui64_t *p_eui64) - int skfd; - const unsigned char *ptr; - -- skfd = socket(PF_INET6, SOCK_DGRAM, 0); -+ skfd = socket(PF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if(skfd == -1) - { - warn("could not open IPv6 socket"); diff --git a/pppd/tty.c b/pppd/tty.c index bc96695..8e76a5d 100644 --- a/pppd/tty.c diff --git a/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch b/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch index 5127c1f10..1b36e8369 100644 --- a/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch +++ b/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch @@ -1,7 +1,7 @@ -diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h +diff --git a/pppd/plugins/pppoe/pppoe.h b/pppd/plugins/pppoe/pppoe.h index 9ab2eee..86762bd 100644 ---- a/pppd/plugins/rp-pppoe/pppoe.h -+++ b/pppd/plugins/rp-pppoe/pppoe.h +--- a/pppd/plugins/pppoe/pppoe.h ++++ b/pppd/plugins/pppoe/pppoe.h @@ -148,7 +148,7 @@ extern UINT16_t Eth_PPPOE_Session; #define STATE_TERMINATED 4 diff --git a/src/patches/ppp/ppp-2.4.7-headers_4.9.patch b/src/patches/ppp/ppp-2.4.7-headers_4.9.patch index 633eb045a..686db9204 100644 --- a/src/patches/ppp/ppp-2.4.7-headers_4.9.patch +++ b/src/patches/ppp/ppp-2.4.7-headers_4.9.patch @@ -1,6 +1,6 @@ -diff -Naur ppp-2.4.7.org/pppd/plugins/rp-pppoe/plugin.c ppp-2.4.7/pppd/plugins/rp-pppoe/plugin.c ---- ppp-2.4.7.org/pppd/plugins/rp-pppoe/plugin.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7/pppd/plugins/rp-pppoe/plugin.c 2017-02-09 08:45:12.567493723 +0100 +diff -Naur ppp-2.4.7.org/pppd/plugins/pppoe/plugin.c ppp-2.4.7/pppd/plugins/pppoe/plugin.c +--- ppp-2.4.7.org/pppd/plugins/pppoe/plugin.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7/pppd/plugins/pppoe/plugin.c 2017-02-09 08:45:12.567493723 +0100 @@ -49,6 +49,8 @@ #include <net/ethernet.h> #include <net/if_arp.h> diff --git a/src/patches/ppp/ppp-2.4.8-pppd-fix-bounds-check-in-eap-code.patch b/src/patches/ppp/ppp-2.4.8-pppd-fix-bounds-check-in-eap-code.patch deleted file mode 100644 index 858769f48..000000000 --- a/src/patches/ppp/ppp-2.4.8-pppd-fix-bounds-check-in-eap-code.patch +++ /dev/null @@ -1,35 +0,0 @@ -commit 8d7970b8f3db727fe798b65f3377fe6787575426 -Author: Paul Mackerras <paulus(a)ozlabs.org> -Date: Mon Feb 3 15:53:28 2020 +1100 - - pppd: Fix bounds check in EAP code - - Given that we have just checked vallen < len, it can never be the case - that vallen >= len + sizeof(rhostname). This fixes the check so we - actually avoid overflowing the rhostname array. - - Reported-by: Ilja Van Sprundel <ivansprundel(a)ioactive.com> - Signed-off-by: Paul Mackerras <paulus(a)ozlabs.org> - -diff --git a/pppd/eap.c b/pppd/eap.c -index 94407f5..1b93db0 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -1420,7 +1420,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; -@@ -1846,7 +1846,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch b/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch new file mode 100644 index 000000000..b36ace192 --- /dev/null +++ b/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch @@ -0,0 +1,15 @@ +--- ppp-2.4.9.orig/configure 2021-03-30 21:38:27.415735914 +0200 ++++ ppp-2.4.9/configure 2021-04-01 19:10:48.632314447 +0200 +@@ -121,9 +121,9 @@ + rm -f $2 + if [ -f $1 ]; then + echo " $2 <= $1" +- sed -e "s,@DESTDIR@,$DESTDIR,g" -e "s,@SYSCONF@,$SYSCONF,g" \ +- -e "s,@CROSS_COMPILE@,$CROSS_COMPILE,g" -e "s,@CC@,$CC,g" \ +- -e "s,@CFLAGS@,$CFLAGS,g" $1 >$2 ++ sed -e "s#@DESTDIR@#$DESTDIR#g" -e "s#@SYSCONF@#$SYSCONF#g" \ ++ -e "s#@CROSS_COMPILE@#$CROSS_COMPILE#g" -e "s#@CC@#$CC#g" \ ++ -e "s#@CFLAGS@#$CFLAGS#g" $1 >$2 + fi + } + -- 2.26.2

1 0

[PATCH] wireless-regdb: update to 2020.11.20
by Peter Müller 10 Apr '21

10 Apr '21

This release contains various regulatory updates for different countries, too many to list them here. While https://wireless.wiki.kernel.org/en/developers/regulatory/wireless-regdb mentiones http://drvbp1.linux-foundation.org/~mcgrof/rel-html/wireless-regdb/ as the location for release announcements, that server seems to be defunct, so there is only https://git.kernel.org/pub/scm/linux/kernel/git/sforshee/wireless-regdb.git left for further details between the 2019.03.01 and 2020.11.20 version. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/wireless-regdb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/wireless-regdb b/lfs/wireless-regdb index 182f0371f..6cffd34ba 100644 --- a/lfs/wireless-regdb +++ b/lfs/wireless-regdb @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2019.03.01 +VER = 2020.11.20 THISAPP = wireless-regdb-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b5eb2d0cc23f5e495a59405e34ce437f +$(DL_FILE)_MD5 = 6d29837f3a1ed671e37d5139de25c5b8 install : $(TARGET) -- 2.26.2

1 0

[PATCH] kernel: update to 4.14.229
by Arne Fitzenreiter 10 Apr '21

10 Apr '21

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 3 +-- config/kernel/kernel.config.armv5tel-ipfire-multi | 3 +-- config/kernel/kernel.config.i586-ipfire | 3 +-- config/kernel/kernel.config.x86_64-ipfire | 3 +-- lfs/linux | 8 ++++---- 5 files changed, 8 insertions(+), 12 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index b794cbcf2..9e8563cbd 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.14.206-ipfire Kernel Configuration +# Linux/arm64 4.14.229 Kernel Configuration # CONFIG_ARM64=y CONFIG_64BIT=y @@ -5050,7 +5050,6 @@ CONFIG_USB_LCD=m CONFIG_USB_FTDI_ELAN=m # CONFIG_USB_APPLEDISPLAY is not set CONFIG_USB_SISUSBVGA=m -CONFIG_USB_SISUSBVGA_CON=y # CONFIG_USB_LD is not set # CONFIG_USB_TRANCEVIBRATOR is not set CONFIG_USB_IOWARRIOR=m diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 3c26a3ce2..c40eb9f55 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.206-ipfire-multi Kernel Configuration +# Linux/arm 4.14.229-ipfire-multi Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -5457,7 +5457,6 @@ CONFIG_USB_LCD=m CONFIG_USB_FTDI_ELAN=m # CONFIG_USB_APPLEDISPLAY is not set CONFIG_USB_SISUSBVGA=m -CONFIG_USB_SISUSBVGA_CON=y # CONFIG_USB_LD is not set # CONFIG_USB_TRANCEVIBRATOR is not set CONFIG_USB_IOWARRIOR=m diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 8cac7cd45..448b8a84b 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.14.206-ipfire Kernel Configuration +# Linux/x86 4.14.229 Kernel Configuration # # CONFIG_64BIT is not set CONFIG_X86_32=y @@ -5179,7 +5179,6 @@ CONFIG_USB_LCD=m CONFIG_USB_FTDI_ELAN=m # CONFIG_USB_APPLEDISPLAY is not set CONFIG_USB_SISUSBVGA=m -CONFIG_USB_SISUSBVGA_CON=y # CONFIG_USB_LD is not set # CONFIG_USB_TRANCEVIBRATOR is not set CONFIG_USB_IOWARRIOR=m diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 4dec50605..65c365c1b 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.14.206-ipfire Kernel Configuration +# Linux/x86 4.14.229 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y @@ -5021,7 +5021,6 @@ CONFIG_USB_LCD=m CONFIG_USB_FTDI_ELAN=m # CONFIG_USB_APPLEDISPLAY is not set CONFIG_USB_SISUSBVGA=m -CONFIG_USB_SISUSBVGA_CON=y # CONFIG_USB_LD is not set # CONFIG_USB_TRANCEVIBRATOR is not set CONFIG_USB_IOWARRIOR=m diff --git a/lfs/linux b/lfs/linux index 5abc6f93a..86acc14f7 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,8 +24,8 @@ include Config -VER = 4.14.212 -ARM_PATCHES = 4.14.212-ipfire0 +VER = 4.14.229 +ARM_PATCHES = 4.14.229-ipfire0 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.xz @@ -79,8 +79,8 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_MD5 = 645d5256adf72569e14edcf80c3757dc -arm-multi-patches-$(ARM_PATCHES).patch.xz_MD5 = 2b0e8e3ebe9827b2bfed7397b043dbc5 +$(DL_FILE)_MD5 = 9d4cf6e9ffff893d8a2ecea6a8c5a15b +arm-multi-patches-$(ARM_PATCHES).patch.xz_MD5 = a04b842733999abb818cabb0388572b8 install : $(TARGET) -- 2.25.1

3 3

[PATCH] SSH: do not send spoofable TCP keep alive messages
by Peter Müller 10 Apr '21

10 Apr '21

By default, both SSH server and client rely on TCP-based keep alive messages to detect broken sessions, which can be spoofed rather easily in order to keep a broken session opened (and vice versa). Since we rely on SSH-based keep alive messages, which are not vulnerable to this kind of tampering, there is no need to double-check connections via TCP keep alive as well. This patch thereof disables using TCP keep alive for both SSH client and server scenario. Further, {Client,Server}AliveCountMax default to 3, which is sufficient (3 * 10 sec. = broken SSH connections die after 30 seconds), so we can omit that option. 60 seconds won't have any advantage here. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/ssh/ssh_config | 11 +++++++---- config/ssh/sshd_config | 7 ++++--- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/config/ssh/ssh_config b/config/ssh/ssh_config index 2e2ee60c3..ab0967086 100644 --- a/config/ssh/ssh_config +++ b/config/ssh/ssh_config @@ -5,7 +5,7 @@ # Set some basic hardening options for all connections Host * - # Disable Roaming as it is known to be vulnerable + # Disable undocumented roaming feature as it is known to be vulnerable UseRoaming no # Only use secure crypto algorithms @@ -13,15 +13,18 @@ Host * Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com - # Always visualise server host keys (but helps to identify key based MITM attacks) + # Always visualise server host keys (helps to identify key based MITM attacks) VisualHostKey yes # Use SSHFP (might work on some up-to-date networks) to look up host keys VerifyHostKeyDNS yes - # send keep-alive messages to connected server to avoid broken connections + # Send SSH-based keep alive messages to connected server to avoid broken connections ServerAliveInterval 10 - ServerAliveCountMax 6 + + # Disable TCP keep alive messages since they can be spoofed and we have SSH-based + # keep alive messages enabled; there is no need to do things twice here + TCPKeepAlive no # Ensure only allowed authentication methods are used PreferredAuthentications publickey,keyboard-interactive,password diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config index bea5cee53..a9eb5ff14 100644 --- a/config/ssh/sshd_config +++ b/config/ssh/sshd_config @@ -47,11 +47,12 @@ AllowTcpForwarding no AllowAgentForwarding no PermitOpen none -# Detect broken sessions by sending keep-alive messages to clients via SSH connection +# Send SSH-based keep alive messages every 10 seconds ClientAliveInterval 10 -# Close unresponsive SSH sessions which fail to answer keep-alive -ClientAliveCountMax 6 +# Since TCP keep alive messages can be spoofed and we have the SSH-based already, +# there is no need for this to be enabled as well +TCPKeepAlive no # Add support for SFTP Subsystem sftp /usr/lib/openssh/sftp-server -- 2.26.2

2 6

Fwd: [oss-security] [CVE-2021-29154] Linux kernel incorrect computation of branch displacements in BPF JIT compiler can be abused to execute arbitrary code in Kernel mode
by Peter Müller 10 Apr '21

10 Apr '21

And *BOOM* goes the dynamite... m( > An issue has been discovered in the Linux kernel that can be abused by > unprivileged local users to escalate privileges. > > The issue is with how BPF JIT compilers for some architectures compute > branch displacements when generating machine code. This can be abused > to craft anomalous machine code and execute it in the Kernel mode, > where the control flow is hijacked to execute unsafe code. > > I developed PoCs for x86-64 and x86-32 architectures to demonstrate > shellcode execution in Kernel mode by unprivileged local users. > > One of these PoCs has been shared privately with <security(a)kernel.org> > to assist with fix development. > > Patches to mitigate the issue for x86-64 and x86-32 architectures are > available. These patches do not attempt to correct the underlying > algorithm and instead assert that all computations were performed > correctly, such that all unsafe inputs are rejected. > > The patches were published via BPF subsystem public git repository: > * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=e4d4d… > * https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=26f55… > > # Discoverer > > Piotr Krysiuk <piotras(a)gmail.com> > > # References > > CVE-2021-29154 (reserved via https://cveform.mitre.org/)

2 1

[PATCH] sqlite: Update to 3.35.4
by Adolf Belka 08 Apr '21

08 Apr '21

- Update from 3.34.1 to 3.35.4 - Update of rootfile not required - Changelog 3.35.0 Added built-in SQL math functions(). (Requires the -DSQLITE_ENABLE_MATH_FUNCTIONS compile-time option.) Added support for ALTER TABLE DROP COLUMN. Generalize UPSERT: Allow multiple ON CONFLICT clauses that are evaluated in order, The final ON CONFLICT clause may omit the conflict target and yet still use DO UPDATE. Add support for the RETURNING clause on DELETE, INSERT, and UPDATE statements. Use less memory when running VACUUM on databases containing very large TEXT or BLOB values. It is no longer necessary to hold the entire TEXT or BLOB in memory all at once. Add support for the MATERIALIZED and NOT MATERIALIZED hints when specifying common table expressions. The default behavior was formerly NOT MATERIALIZED, but is now changed to MATERIALIZED for CTEs that are used more than once. The SQLITE_DBCONFIG_ENABLE_TRIGGER and SQLITE_DBCONFIG_ENABLE_VIEW settings are modified so that they only control triggers and views in the main database schema or in attached database schemas and not in the TEMP schema. TEMP triggers and views are always allowed. Query planner/optimizer improvements: Enhancements to the min/max optimization so that it works better with the IN operator and the OP_SeekScan optimization of the previous release. Attempt to process EXISTS operators in the WHERE clause as if they were IN operators, in cases where this is a valid transformation and seems likely to improve performance. Allow UNION ALL sub-queries to be flattened even if the parent query is a join. Use an index, if appropriate, on IS NOT NULL expressions in the WHERE clause, even if STAT4 is disabled. Expressions of the form "x IS NULL" or "x IS NOT NULL" might be converted to simply FALSE or TRUE, if "x" is a column that has a "NOT NULL" constraint and is not involved in an outer join. Avoid checking foreign key constraints on an UPDATE statement if the UPDATE does not modify any columns associated with the foreign key. Allow WHERE terms to be pushed down into sub-queries that contain window functions, as long as the WHERE term is made up of entirely of constants and copies of expressions found in the PARTITION BY clauses of all window functions in the sub-query. CLI enhancements: Enhance the ".stats" command to accept new arguments "stmt" and "vmstep", causing prepare statement statistics and only the virtual-machine step count to be shown, respectively. Add the ".filectrl data_version" command. Enhance the ".once" and ".output" commands so that if the destination argument begins with "|" (indicating that output is redirected into a pipe) then the argument does not need to be quoted. Bug fixes: Fix a potential NULL pointer dereference when processing a syntactically incorrect SELECT statement with a correlated WHERE clause and a "HAVING 0" clause. (Also fixed in the 3.34.1 patch release.) Fix a bug in the IN-operator optimization of version 3.33.0 that can cause an incorrect answer. Fix incorrect answers from the LIKE operator if the pattern ends with "%" and there is an "ESCAPE '_'" clause. 3.35.1 Fix a bug in the new DROP COLUMN feature when used on columns that are indexed and that are quoted in the index definition. Improve the built-in documentation for the .dump command in the CLI. 3.35.2 Fix a problem in the appendvfs.c extension that was introduced into version 3.35.0. Ensure that date/time functions with no arguments (which generate responses that depend on the current time) are treated as non-deterministic functions. Ticket 2c6c8689fb5f3d2f Fix a problem in the sqldiff utility program having to do with unusual whitespace characters in a virtual table definition. Limit the new UNION ALL optimization described by item 8c in the 3.35.0 release so that it does not try to make too many new subqueries. See forum thread 140a67d3d2 for details. 3.35.3 Enhance the OP_OpenDup opcode of the bytecode engine so that it works even if the cursor being duplicated itself came from OP_OpenDup. Fix for ticket bb8a9fd4a9b7fce5. This problem only came to light due to the recent MATERIALIZED hint enhancement. When materializing correlated common table expressions, do so separately for each use case, as that is required for correctness. This fixes a problem that was introduced by the MATERIALIZED hint enhancement. Fix a problem in the filename normalizer of the unix VFS. Fix the "box" output mode in the CLI so that it works with statements that returns one or more rows of zero columns (such as PRAGMA incremental_vacuum). Forum post afbbcb5b72. Improvements to error messages generated by faulty common table expressions. Forum post aa5a0431c99e. Fix some incorrect assert() statements. Fix to the SELECT statement syntax diagram so that the FROM clause syntax is shown correctly. Forum post 9ed02582fe. Fix the EBCDIC character classifier so that it understands newlines as whitespace. Forum post 58540ce22dcd. Improvements the xBestIndex method in the implementation of the (unsupported) wholenumber virtual table extension so that it does a better job of convincing the query planner to avoid trying to materialize a table with an infinite number of rows. Forum post b52a020ce4. 3.35.4 Fix a defect in the query planner optimization identified by item 8b above. Ticket de7db14784a08053. Fix a defect in the new RETURNING syntax. Ticket 132994c8b1063bfb. Fix the new RETURNING feature so that it raises an error if one of the terms in the RETURNING clause references a unknown table, instead of silently ignoring that error. Fix an assertion associated with aggregate function processing that was incorrectly triggered by the push-down optimization. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sqlite | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/sqlite b/lfs/sqlite index ab7d79920..7aada7585 100644 --- a/lfs/sqlite +++ b/lfs/sqlite @@ -24,7 +24,7 @@ include Config -VER = 3340100 +VER = 3350400 THISAPP = sqlite-autoconf-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 14dca9d44fb6a57f6521c1ace4be5a68 +$(DL_FILE)_MD5 = 9cf453a9cd0e40cdbc8e6f008acfc4fb install : $(TARGET) -- 2.31.1

1 0

[PATCH] poppler-data: Update to 0.4.10
by Adolf Belka 08 Apr '21

08 Apr '21

- Update from 0.4.9 to 0.4.10 - Update rootfile - There is no Changelog file in the source tarball The poppler website has no release info on poppler-data only poppler Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/poppler-data | 16 ++++++++++++++++ lfs/poppler-data | 4 ++-- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/poppler-data b/config/rootfiles/common/poppler-data index fca2d8b1c..0108f6a0c 100644 --- a/config/rootfiles/common/poppler-data +++ b/config/rootfiles/common/poppler-data @@ -131,6 +131,7 @@ usr/share/poppler #usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-4 #usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-5 #usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-6 +#usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-7 #usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-90ms-RKSJ #usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-90pv-RKSJ #usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-H-CID @@ -195,6 +196,21 @@ usr/share/poppler #usr/share/poppler/cMap/Adobe-Japan1/WP-Symbol #usr/share/poppler/cMap/Adobe-Japan2 #usr/share/poppler/cMap/Adobe-Japan2/Adobe-Japan2-0 +#usr/share/poppler/cMap/Adobe-KR +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-0 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-1 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-2 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-3 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-4 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-5 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-6 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-7 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-8 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-9 +#usr/share/poppler/cMap/Adobe-KR/Adobe-KR-UCS2 +#usr/share/poppler/cMap/Adobe-KR/UniAKR-UTF16-H +#usr/share/poppler/cMap/Adobe-KR/UniAKR-UTF32-H +#usr/share/poppler/cMap/Adobe-KR/UniAKR-UTF8-H #usr/share/poppler/cMap/Adobe-Korea1 #usr/share/poppler/cMap/Adobe-Korea1/Adobe-Korea1-0 #usr/share/poppler/cMap/Adobe-Korea1/Adobe-Korea1-1 diff --git a/lfs/poppler-data b/lfs/poppler-data index 81bc672eb..761dd17d5 100644 --- a/lfs/poppler-data +++ b/lfs/poppler-data @@ -24,7 +24,7 @@ include Config -VER = 0.4.9 +VER = 0.4.10 THISAPP = poppler-data-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 35cc7beba00aa174631466f06732be40 +$(DL_FILE)_MD5 = a7f15fb2f26c60a7a92093cfdf2378d5 install : $(TARGET) -- 2.31.1

1 0

[PATCH] poppler: Update to 21.04.0
by Adolf Belka 08 Apr '21

08 Apr '21

- Update from 0.89.0 to 21.04.0 From Aug 2020 file version naming changed to YY.MM.x Update issued every month since then - Update rootfile - Changelog is too large to include here Full content can be reviewed in ChangeLog file in source tarball Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/poppler | 29 +++++------------------------ lfs/poppler | 4 ++-- 2 files changed, 7 insertions(+), 26 deletions(-) diff --git a/config/rootfiles/common/poppler b/config/rootfiles/common/poppler index 17fb1b966..b15792698 100644 --- a/config/rootfiles/common/poppler +++ b/config/rootfiles/common/poppler @@ -44,6 +44,7 @@ usr/bin/pdfunite #usr/include/poppler/JArithmeticDecoder.h #usr/include/poppler/JBIG2Stream.h #usr/include/poppler/JPEG2000Stream.h +#usr/include/poppler/JSInfo.h #usr/include/poppler/Lexer.h #usr/include/poppler/Linearization.h #usr/include/poppler/Link.h @@ -103,6 +104,7 @@ usr/bin/pdfunite #usr/include/poppler/cpp/poppler-rectangle.h #usr/include/poppler/cpp/poppler-toc.h #usr/include/poppler/cpp/poppler-version.h +#usr/include/poppler/cpp/poppler_cpp_export.h #usr/include/poppler/fofi #usr/include/poppler/fofi/FoFiBase.h #usr/include/poppler/fofi/FoFiEncodings.h @@ -110,22 +112,6 @@ usr/bin/pdfunite #usr/include/poppler/fofi/FoFiTrueType.h #usr/include/poppler/fofi/FoFiType1.h #usr/include/poppler/fofi/FoFiType1C.h -#usr/include/poppler/glib -#usr/include/poppler/glib/poppler-action.h -#usr/include/poppler/glib/poppler-annot.h -#usr/include/poppler/glib/poppler-attachment.h -#usr/include/poppler/glib/poppler-date.h -#usr/include/poppler/glib/poppler-document.h -#usr/include/poppler/glib/poppler-enums.h -#usr/include/poppler/glib/poppler-features.h -#usr/include/poppler/glib/poppler-form-field.h -#usr/include/poppler/glib/poppler-layer.h -#usr/include/poppler/glib/poppler-macros.h -#usr/include/poppler/glib/poppler-media.h -#usr/include/poppler/glib/poppler-movie.h -#usr/include/poppler/glib/poppler-page.h -#usr/include/poppler/glib/poppler-structure-element.h -#usr/include/poppler/glib/poppler.h #usr/include/poppler/goo #usr/include/poppler/goo/GooCheckedOps.h #usr/include/poppler/goo/GooLikely.h @@ -141,6 +127,7 @@ usr/bin/pdfunite #usr/include/poppler/goo/grandom.h #usr/include/poppler/goo/gstrtod.h #usr/include/poppler/poppler-config.h +#usr/include/poppler/poppler_private_export.h #usr/include/poppler/splash #usr/include/poppler/splash/Splash.h #usr/include/poppler/splash/SplashBitmap.h @@ -165,16 +152,10 @@ usr/bin/pdfunite #usr/lib/libpoppler-cpp.so usr/lib/libpoppler-cpp.so.0 usr/lib/libpoppler-cpp.so.0.9.0 -#usr/lib/libpoppler-glib.so -usr/lib/libpoppler-glib.so.8 -usr/lib/libpoppler-glib.so.8.17.0 #usr/lib/libpoppler.so -usr/lib/libpoppler.so.100 -usr/lib/libpoppler.so.100.0.0 -#usr/lib/pkgconfig/poppler-cairo.pc +usr/lib/libpoppler.so.109 +usr/lib/libpoppler.so.109.0.0 #usr/lib/pkgconfig/poppler-cpp.pc -#usr/lib/pkgconfig/poppler-glib.pc -#usr/lib/pkgconfig/poppler-splash.pc #usr/lib/pkgconfig/poppler.pc #usr/share/man/man1/pdfattach.1 #usr/share/man/man1/pdfdetach.1 diff --git a/lfs/poppler b/lfs/poppler index 632d6f8ef..12cb05f41 100644 --- a/lfs/poppler +++ b/lfs/poppler @@ -24,7 +24,7 @@ include Config -VER = 0.89.0 +VER = 21.04.0 THISAPP = poppler-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 92ac57f60ae8c3a1f8bfe01c9530b7b5 +$(DL_FILE)_MD5 = c3a76a9ef4625f54718136699c74c9b1 install : $(TARGET) -- 2.31.1

1 0

← Newer
1
...
7
8
9
10
11
12
13
...
17
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2021