Development July 2021

development@lists.ipfire.org

12 participants
102 discussions

[PATCH] ddns.cgi: Fix sanity check logic.
by Stefan Schantl 07 Jul '21

07 Jul '21

The input validation did not work in the proper way. It allways reported "No password" when using a provider which supports token and the token has been given. This of course is wrong and leaded to unuseable providers. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/ddns.cgi | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/html/cgi-bin/ddns.cgi b/html/cgi-bin/ddns.cgi index e30aa3d4f..0e3ccbe45 100644 --- a/html/cgi-bin/ddns.cgi +++ b/html/cgi-bin/ddns.cgi @@ -171,20 +171,28 @@ if (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang:: $errormessage = $Lang::tr{'invalid domain name'}; } - # Check if a username has been sent. - if ($settings{'LOGIN'} eq '') { - $errormessage = $Lang::tr{'username not set'}; - } + # Check if the choosen provider supports token based authentication. + if ($settings{'SERVICE'} ~~ @token_provider) { + # Check if a token has been given. + unless ($settings{'TOKEN'}) { + $errormessage = $Lang::tr{'token not set'}; + } - # Check if a password has been typed in. - # freedns.afraid.org does not require this field. - if (($settings{'PASSWORD'} eq '') && ($settings{'SERVICE'} ne 'freedns.afraid.org') && ($settings{'SERVICE'} ne 'regfish.com')) { - $errormessage = $Lang::tr{'password not set'}; - } + # Automatically set the username to token. + $settings{'LOGIN'} = "token"; - # Check if a token has been given for provider which support tokens. - if (($settings{'SERVICE'} ~~ @token_provider) && ($settings{'TOKEN'} eq '')) { - $errormessage = $Lang::tr{'token not set'}; + # A provider without token support has been choosen. + } else { + # Check if a username has been sent. + if ($settings{'LOGIN'} eq '') { + $errormessage = $Lang::tr{'username not set'}; + } + + # Check if a password has been typed in. + # freedns.afraid.org does not require this field. + if (($settings{'PASSWORD'} eq '') && ($settings{'SERVICE'} ne 'freedns.afraid.org') && ($settings{'SERVICE'} ne 'regfish.com')) { + $errormessage = $Lang::tr{'password not set'}; + } } # Go furter if there was no error. -- 2.30.2

2 1

[PATCH] Pakfire: call "sync" in function.sh after having extracted archives
by Peter Müller 07 Jul '21

07 Jul '21

After upgrading to Core Update 157, a few number of users reported their systems to be unworkable after a reboot. Most of them (the systems, not the users) were apparently missing the new Linux kernel in their Grub configuration, causing a non-functional bootloader written to disk. While we seem to be able to rule out issues related to poor storage (SDDs, flash cards, etc.) or very high I/O load, it occurred to me we are not calling "sync" after having extracted a Core Update's .tar.gz file. This patch therefore proposes to do so. It is a somewhat homeopathic approach, though, but might ensure all parts of the system to have properly processed the contents of an extracted archive. While we cannot even reasonably guess it will solve the problem(s) mentioned initially, doing so cannot hurt either. See also: https://community.ipfire.org/t/after-update-ipfire-to-157-no-boot/5641/45 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/pakfire/lib/functions.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pakfire/lib/functions.sh b/src/pakfire/lib/functions.sh index 5918649db..d45572ce6 100644 --- a/src/pakfire/lib/functions.sh +++ b/src/pakfire/lib/functions.sh @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2012 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,6 +26,7 @@ extract_files() { echo "Extracting files..." tar --acls --xattrs --xattrs-include='*' \ -xavf /opt/pakfire/tmp/files* --no-overwrite-dir -p --numeric-owner -C / + sync echo "...Finished." } @@ -33,6 +34,7 @@ extract_backup_includes() { echo "Extracting backup includes..." tar xavf /opt/pakfire/tmp/files* --no-overwrite-dir -p --numeric-owner -C / \ var/ipfire/backup/addons/includes + sync echo "...Finished." } -- 2.26.2

1 0

[PATCH 1/2] suricata: Update to 5.0.7
by Matthias Fischer 07 Jul '21

07 Jul '21

For details see: https://forum.suricata.io/t/suricata-6-0-3-and-5-0-7-released/1489 and https://redmine.openinfosecfoundation.org/versions/166 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/suricata b/lfs/suricata index 055964e29..71e0eb36f 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 5.0.6 +VER = 5.0.7 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 82d80b4b3179315bf6f5695c6437ee1f +$(DL_FILE)_MD5 = f6ff77e4dcf8035853209ceeba9b530c install : $(TARGET) -- 2.18.0

2 3

Migrating from ntp to chrony - challenge
by Jon Murphy 06 Jul '21

06 Jul '21

I’d like to challenge! (This post was recently moved from the IPFire Community to the Development Mailing List) I saw this in the agenda from last week: Screen Shot 2021-06-16 at 11.42.49 AM 1738×500 51.1 KB <https://community.ipfire.org/uploads/default/original/2X/8/80392284118cf74d…> Screen Shot 2021-06-16 at 11.42.49 AM 1738×500 51.1 KB I thought chrony was more for desktops & laptops. Devices that power down and might have a big time jump. And NTP was more for servers or devices that run full-time. The current NTP in IPFire can be easily changed from polling (one per hour / once per day) to non-polling by making a few simple changes to a config file: disable monitor restrict default nomodify notrap nopeer restrict 127.0.0.1 server $NTP_ADDR_1 prefer server $NTP_ADDR_2 server 127.127.1.0 fudge 127.127.1.0 stratum 10 driftfile /etc/ntp/drift $NTP_ADDR_1 and _2 are the Primary NTP server and Secondary NTP server from the https://ipfire:444/cgi-bin/time.cgi <https://ipfire:444/cgi-bin/time.cgi> webgui page. And by changing the https://ipfire:444/cgi-bin/time.cgi <https://ipfire:444/cgi-bin/time.cgi> Synchronization to Manually Anyway, my thought is to make some changes to the current NTP service instead of implementing something new… Jon --------------------------- TL;DR When NTP is configured differently (Manually polling enabled) it will “correct” on it own: Oct 6 21:40:01 ipfire ntpdate: Updated drift file. Drift is 0.000 PPM at Tue Oct 6 21:35:43 CDT 2020 Oct 6 23:20:01 ipfire ntpdate: Updated drift file. Drift is -18.986 PPM at Tue Oct 6 23:16:05 CDT 2020 Oct 7 00:20:01 ipfire ntpdate: Updated drift file. Drift is -140.863 PPM at Wed Oct 7 00:16:04 CDT 2020 Oct 7 01:20:01 ipfire ntpdate: Updated drift file. Drift is -210.676 PPM at Wed Oct 7 01:16:04 CDT 2020 Oct 7 02:20:01 ipfire ntpdate: Updated drift file. Drift is -347.531 PPM at Wed Oct 7 02:16:04 CDT 2020 Oct 7 03:20:01 ipfire ntpdate: Updated drift file. Drift is -407.147 PPM at Wed Oct 7 03:16:04 CDT 2020 Oct 7 04:20:01 ipfire ntpdate: Updated drift file. Drift is -414.606 PPM at Wed Oct 7 04:16:04 CDT 2020 Oct 7 05:20:01 ipfire ntpdate: Updated drift file. Drift is -414.826 PPM at Wed Oct 7 05:16:04 CDT 2020 More into: https://community.ipfire.org/t/odd-ntp-offset-issues-continued/492

6 7

Core 158 Testing feedback
by Adolf Belka 05 Jul '21

05 Jul '21

Hi Everyone, I have upgraded IPFire on my testbed vm to Core Update 158. The upgrade ran fine. After rebooting I could not access IPFire via ssh. After pressing save on the ssh menu page then my ssh connection was working fine. Have gone through all menus and everything looks to be displayed as expected. The Memory table is fixed. All charts and Pie Graphs worked without problems. At first check everything except the ssh issue seems to be working fine. I will leave it running and see how things go over the next few days. Regards, Adolf.

3 2

Can't push to [username]@ipfire.org
by Matthias Fischer 02 Jul '21

02 Jul '21

Hi, while trying to open a shell link with 'mc' to [username](a)ipfire.org - which worked for a long time... - suddenly I'm getting "Cannot chdir to "/sh://mfischer@git.ipfire.org"" today. I just wanted to push some 'suricata' updates from today. Besides, nothing changed on my side since the last uploads... Pulling through GIT is working. Anyone else? Best, Matthias

2 7

[PATCH] traceroute: Update to version 2.1.0
by Adolf Belka 01 Jul '21

01 Jul '21

- Update from 2.0.18 (2011) to 2.1.0 (2016 - latest version) - Update of rootfile not required - Changelog 2016-03-08 Dmitry Butskoy <Dmitry(a)Butskoy.name> - 2.1.0 * Improve the main loop for better interactivity. Instead of waiting silently for maximum expiration time of probes in progress, use timeout of the first probe (which will be printed first from now) only. * Speedup wait mechanism. Traditional traceroute implementation always waited the whole timeout for any probe. But if we already have some replies from the same hop, or even from some next hop, we can use the round trip time of such a reply as a hint to determine the actual reasonable amount of time to wait. Now the `-w' option has a form of three (in general) float values separated by a comma (or a slash): `-w MAX_SECS,HERE,NEAR' . (last two are optional). MAX_SECS specifies the maximum time (in seconds) to wait, in any case. The optional HERE specifies a factor to multiply the round trip time of an already received response from the same hop. The resulting value is used as a timeout for the probe, instead of (but no more than) MAX_SECS. The optional NEAR specifies a similar factor for a response from some next hop. The time of the first found result is used in both cases. First, we look for the same hop (of the probe which will be printed first from now). If nothing found, then look for some next hop. If nothing found, use MAX_SECS. If HERE and/or NEAR have zero values, the corresponding computation is skipped. HERE and NEAR are always set to zero if only MAX_SECS is specified (which provides compatibility with previous versions). Thus, if your scripts use `-w SECS', then nothing changed for you, since the lonely SECS implies `-w SECS,0,0' . Defaults are 5.0 seconds for MAX_SECS, 3.0 times for HERE and 10.0 times for NEAR. Certainly, the new algorithm can lead to premature expiry (especially when response times differ at times) and printing "*" instead of a time. Anyway, you can always switch this algorithm off, just by specifying `-w' with the desired timeout only (fe. `-w 5'). We continue to wait whole MAX_SECS when one probe per time must be sent (`--sport', `-P proto'), because it seems more harmful rather than helpful to try to wait less in such cases. To provide compatibility with 2.0.x versions, use: traceroute -w 5 (or any other desired `-w' value). * Hint people to use the system traceroute(8) instead of tcptraceroute wrapper (by providing a stderr header). The using of this wrapper is a little bit harmful, since it has less possibilities and a little different set of options. For those who are used to use tcptraceroute in cmdline, just create a link with that name to the system traceroute. When invoked as "tcp*", it then behaves as `traceroute -T'. (The simple manual page added for this case in the wrapper subdir). The original tcptraceroute had some options differ ("lpNSAE"), but they was rare used. Most common "dnFifmqwst" was just the same. Therefore it should be painless to use the system binary directly, instead of the limited wrapper (which is still provided indeed). 2016-02-15 Dmitry Butskoy <Dmitry(a)Butskoy.name> - 2.0.22 * Some portability fixing and improvements (Felix Janda) * Require clear numbers for options and arguments (Sergey Salnikov) * Drop compilation date from the version string (Debian #774365) * New tcp module option `reuse', which utilize SO_REUSEADDR to reuse local port numbers for the huge workloads (Richard Sheehan) * Avoid poll(2) call with spurious zero timeout in some rare cases by rounding the value properly using ceil(3) 2014-11-12 Dmitry Butskoy <Dmitry(a)Butskoy.name> - 2.0.21 * Fix `--mtu' and `-F' working on kernels >= 3.13 * Some manual page improving (Christopher Mann) 2014-06-14 Dmitry Butskoy <Dmitry(a)Butskoy.name> - 2.0.20 * Describe all complementary long options in the man page (Jan Synacek) * Use correct service name for AS lookups (Frederic Mangano) * Avoid some rare case null dereference (geogriffin(a)jsgriff.com) * Improve expiration check for simultaneous probes 2012-11-19 Dmitry Butskoy <Dmitry(a)Butskoy.name> - 2.0.19 * DCCP protocol support (rfc4340), by Samuel Jero Use "-D" option for it (the protocol-specific options are available too). * Update COPYING and COPYING.LIB license files to the latest published ones (due to FSF address changes etc.) (Jan Synacek) * Add mention of "-l" option to manual (Filip Holec) Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/traceroute | 6 +++--- ...te-2.0.18-ipfire.patch => traceroute-2.1.0-ipfire.patch} | 0 2 files changed, 3 insertions(+), 3 deletions(-) rename src/patches/{traceroute-2.0.18-ipfire.patch => traceroute-2.1.0-ipfire.patch} (100%) diff --git a/lfs/traceroute b/lfs/traceroute index 87157ff42..0ec14538e 100644 --- a/lfs/traceroute +++ b/lfs/traceroute @@ -24,7 +24,7 @@ include Config -VER = 2.0.18 +VER = 2.1.0 THISAPP = traceroute-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = traceroute -PAK_VER = 3 +PAK_VER = 4 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b7254149b7f081cce07f4b9e065ba5ef +$(DL_FILE)_MD5 = 84d329d67abc3fb83fc8cb12aeaddaba install : $(TARGET) diff --git a/src/patches/traceroute-2.0.18-ipfire.patch b/src/patches/traceroute-2.1.0-ipfire.patch similarity index 100% rename from src/patches/traceroute-2.0.18-ipfire.patch rename to src/patches/traceroute-2.1.0-ipfire.patch -- 2.32.0

1 0

[PATCH] Text-Tabs+Wrap: Update to 2013.0523
by Adolf Belka 01 Jul '21

01 Jul '21

- Update from 2005.0824 to 2013.0523 - latest version - Update of rootfile required - Changelog = 2013/05/23 Change module 'NAME' = 2013/05/22 Typos = 2013/04/26 Minor test suite fixes - bug 81698. Fixed bug 79766 -- an extraneous "=" in a regex. Changed the license to qualify as an "open source" license. = 2012/08/18 Packaging fix. Minor documentation fixes. = 2012/08/15 Minor fixes to test suites. Added back versions to support old versions of perl. = 2009/04/17 Added support for Unicode combining characters to both Text::Tabs and Text::Wrap, plus a new test suite for each of these new functionalities. --tchrist = 2009/03/05 Test improvements from Dave Mitchel sent back in 2005... Added code to increase $columns if it's not big enough to accommodate the subsequent tab. Minor documentation fixes from David Landgren <david at landgren.net>. Use warnings::warnif instead of just warn for columns < 2. Appled per request of Rafael Garcia-Suarez <rgarciasuarez at gmail.com>. = 2006/11/17 Text::Tabs can handle newlines now so the BUGS section has been removed per request from Aristotle Pagaltzis. = 2006/07/11 Further bomb-proofing to pass more tests: Dan Jacobson <jidanni at jidanni dot org> found another way to generate a "this shouldn't happen". = 2006/07/05 Made documentation and code changes to address perlbug: https://rt.perl.org/rt3/Ticket/Display.html?id=30229 Added in changes from the distributed-with-perl version. This took care of perlbug: https://rt.perl.org/rt3/Ticket/Display.html?id=34902 It also took care of suggestion from Matthijs Bomhoff <matthijs at bomhoff dot nl>. Made documentation changes (added EXAMPLES) as per a suggestion from Gabor Blasko <gblasko at cs dot columbia dot edu> belg4mit at MIT dot EDU reported that $columns==1 die'd. No longer. Added tests for each bug report. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/Text-Tabs+Wrap | 6 ++++-- lfs/Text-Tabs+Wrap | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/Text-Tabs+Wrap b/config/rootfiles/common/Text-Tabs+Wrap index 00e0a3812..9c6449ec3 100644 --- a/config/rootfiles/common/Text-Tabs+Wrap +++ b/config/rootfiles/common/Text-Tabs+Wrap @@ -1,2 +1,4 @@ -#usr/lib/perl5/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Text -#usr/lib/perl5/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Text/.packlist +#usr/lib/perl5/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Text-Wrap +#usr/lib/perl5/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Text-Wrap/.packlist +#usr/share/man/man3/modern::Text::Tabs.3 +#usr/share/man/man3/modern::Text::Wrap.3 diff --git a/lfs/Text-Tabs+Wrap b/lfs/Text-Tabs+Wrap index 68f8662b0..9cdbe0412 100644 --- a/lfs/Text-Tabs+Wrap +++ b/lfs/Text-Tabs+Wrap @@ -24,7 +24,7 @@ include Config -VER = 2005.0824 +VER = 2013.0523 THISAPP = Text-Tabs+Wrap-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 99c061630027de809beca99d0b71f689 +$(DL_FILE)_MD5 = 3e421ed3810803512af8d13bad548993 install : $(TARGET) -- 2.32.0

1 0

[PATCH] sqlite: Update to version 3360000
by Adolf Belka 01 Jul '21

01 Jul '21

- Update from 3350500 to 3360000 - Update of rootfile not required - Changelog Improvement to the EXPLAIN QUERY PLAN output to make it easier to understand. Byte-order marks at the start of a token are skipped as if they were whitespace. An error is raised on any attempt to access the rowid of a VIEW or subquery. Formerly, the rowid of a VIEW would be indeterminate and often would be NULL. The -DSQLITE_ALLOW_ROWID_IN_VIEW compile-time option is available to restore the legacy behavior for applications that need it. The sqlite3_deserialize() and sqlite3_serialize() interfaces are now enabled by default. The -DSQLITE_ENABLE_DESERIALIZE compile-time option is no longer required. Instead, there is is a new -DSQLITE_OMIT_DESERIALIZE compile-time option to omit those interfaces. The "memdb" VFS now allows the same in-memory database to be shared among multiple database connections in the same process as long as the database name begins with "/". Back out the EXISTS-to-IN optimization (item 8b in the SQLite 3.35.0 change log) as it was found to slow down queries more often than speed them up. Improve the constant-propagation optimization so that it works on non-join queries. The REGEXP extension is now included in CLI builds. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sqlite | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/sqlite b/lfs/sqlite index a68bf462b..04eada9d8 100644 --- a/lfs/sqlite +++ b/lfs/sqlite @@ -24,7 +24,7 @@ include Config -VER = 3350500 +VER = 3360000 THISAPP = sqlite-autoconf-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = d1d1aba394c8e0443077dc9f1a681bb8 +$(DL_FILE)_MD5 = f5752052fc5b8e1b539af86a3671eac7 install : $(TARGET) -- 2.32.0

1 0

[PATCH] libxcrypt: Update to version 4.4.23
by Adolf Belka 01 Jul '21

01 Jul '21

- Update from 4.4.22 to 4.4.23 - Update of rootfile not required - Changelog * Fix output calculation for gensalt_yescrypt_rn(). * Fix -Werror=conversion in lib/crypt-des-obsolete.c, test/des-obsolete.c, and test/des-obsolete_r.c. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/libxcrypt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/libxcrypt b/lfs/libxcrypt index 79edc5fb6..e7604dd06 100644 --- a/lfs/libxcrypt +++ b/lfs/libxcrypt @@ -24,7 +24,7 @@ include Config -VER = 4.4.22 +VER = 4.4.23 THISAPP = libxcrypt-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 6e4f363d86f99562d012c47e7f024618 +$(DL_FILE)_MD5 = 405116b5cc90b72216afccc54025afbc install : $(TARGET) -- 2.32.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2021