Development September 2021

development@lists.ipfire.org

9 participants
91 discussions

[PATCH] libseccomp: Update to version 2.5.2
by Adolf Belka 09 Sep '21

09 Sep '21

- Update from 2.5.1 to 2.5.2 - Update rootfile - Changelog * Version 2.5.2 - August 31, 2021 - Update the syscall table for Linux v5.14-rc7 - Add a function, get_notify_fd(), to the Python bindings to get the nofication file descriptor - Consolidate multiplexed syscall handling for all architectures into one location - Add multiplexed syscall support to PPC - Add multiplexed syscall support to MIPS - The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within the kernel. Modify the libseccomp file descriptor notification logic to support the kernel's previous and new usage of SECCOMP_IOCTL_NOTIF_ID_VALID Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/libseccomp | 2 +- lfs/libseccomp | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/libseccomp b/config/rootfiles/packages/libseccomp index fb0b35d31..90bee123e 100644 --- a/config/rootfiles/packages/libseccomp +++ b/config/rootfiles/packages/libseccomp @@ -4,7 +4,7 @@ usr/bin/scmp_sys_resolver #usr/lib/libseccomp.la #usr/lib/libseccomp.so usr/lib/libseccomp.so.2 -usr/lib/libseccomp.so.2.5.1 +usr/lib/libseccomp.so.2.5.2 #usr/lib/pkgconfig/libseccomp.pc #usr/share/man/man1/scmp_sys_resolver.1 #usr/share/man/man3/seccomp_api_get.3 diff --git a/lfs/libseccomp b/lfs/libseccomp index 38d7a7dde..aaa9f0b1d 100644 --- a/lfs/libseccomp +++ b/lfs/libseccomp @@ -24,7 +24,7 @@ include Config -VER = 2.5.1 +VER = 2.5.2 THISAPP = libseccomp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = libseccomp -PAK_VER = 5 +PAK_VER = 6 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 59f5563c532d3fa1df9db0516b36b1cd +$(DL_FILE)_MD5 = bdee14f3453d118fc29456c6c4cb178e install : $(TARGET) -- 2.33.0

2 1

[PATCH] udev: Enable ntuple offloading feature in supported NICs
by Michael Tremer 09 Sep '21

09 Sep '21

We are using CPU-affinity and packet steering functions in various places in IPFire, but packets might still be received on a random CPU core. This feature enables that packets that belong to the same connection (i.e. have the save tuple) will be steered to the same queue. This will increase cache locality and decrease locking which results in higher throughput. https://www.kernel.org/doc/Documentation/networking/scaling.txt Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/common/udev | 2 ++ config/udev/99-offloading.rules | 2 ++ config/udev/network-offloading | 44 +++++++++++++++++++++++++++++++++ lfs/udev | 6 +++++ 4 files changed, 54 insertions(+) create mode 100644 config/udev/99-offloading.rules create mode 100644 config/udev/network-offloading diff --git a/config/rootfiles/common/udev b/config/rootfiles/common/udev index 877a832a3..4a01f3eef 100644 --- a/config/rootfiles/common/udev +++ b/config/rootfiles/common/udev @@ -37,6 +37,7 @@ lib/udev/mtd_probe lib/udev/network-hotplug-bridges lib/udev/network-hotplug-rename lib/udev/network-hotplug-vlan +lib/udev/network-offloading lib/udev/rule_generator.functions #lib/udev/rules.d lib/udev/rules.d/25-alsa.rules @@ -64,6 +65,7 @@ lib/udev/rules.d/78-sound-card.rules lib/udev/rules.d/80-drivers.rules lib/udev/rules.d/90-hwrng.rules lib/udev/rules.d/99-codel.rules +lib/udev/rules.d/99-offloading.rules lib/udev/scsi_id lib/udev/v4l_id lib/udev/write_cd_rules diff --git a/config/udev/99-offloading.rules b/config/udev/99-offloading.rules new file mode 100644 index 000000000..5387971ac --- /dev/null +++ b/config/udev/99-offloading.rules @@ -0,0 +1,2 @@ +# Call the offloading script +SUBSYSTEM=="net", RUN+="/lib/udev/network-offloading" diff --git a/config/udev/network-offloading b/config/udev/network-offloading new file mode 100644 index 000000000..dfdf51ee9 --- /dev/null +++ b/config/udev/network-offloading @@ -0,0 +1,44 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2021 IPFire Team <info(a)ipfire.org>. # +# # +############################################################################ + +if [ -z "${INTERFACE}" ]; then + echo "INTERFACE variable was not set" >&2 + exit 1 +fi + +case "${ACTION}" in + add|register) + # Try to enable ntuple (and ignore if not supported) + ethtool --features "${INTERFACE}" ntuple on &>/dev/null + ;; + + remove|unregister) + # Nothing to do here. + ;; + + *) + echo "No or unkown ACTION set" >&2 + exit 1 +esac + +exit 0 diff --git a/lfs/udev b/lfs/udev index b578ab54c..cfad0398b 100644 --- a/lfs/udev +++ b/lfs/udev @@ -132,5 +132,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) install -m 755 $(DIR_SRC)/config/udev/enable_codel \ /lib/udev/enable_codel + # Install offloading rules + install -v -m 644 $(DIR_SRC)/config/udev/99-offloading.rules \ + /lib/udev/rules.d + install -m 755 $(DIR_SRC)/config/udev/network-offloading \ + /lib/udev/network-offloading + @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.20.1

2 1

[PATCH] clamav: Update to 0.104.0
by Matthias Fischer 08 Sep '21

08 Sep '21

For details see: https://blog.clamav.net/2021/09/clamav-01040-released.html New requirements and major changes: "As of ClamAV 0.104, CMake is required to build ClamAV ... The built-in LLVM for the bytecode runtime has been removed." But since the current 'llvm 12.0.1' version refused to be build "...you will need to supply the development libraries for LLVM version 3.6.2" - which is ~6 years old - I gave up with 'llvm' and stayed with the bytecode "interpreter". Cited: "The bytecode interpreter is the default runtime for bytecode signatures just as it was in ClamAV 0.103. @ALL: In 'clamav 0.104.0' there is no appropriate cmake option for "CONFIGURE_FLAGS = --disable-fanotify" for ARM buildings anymore. Perhaps there is a kernel option for this? => https://docs.clamav.net/manual/OnAccess.html#requirements Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/clamav | 164 ++++++++++++++++++++++++++----- lfs/clamav | 40 +++++--- 2 files changed, 164 insertions(+), 40 deletions(-) diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index a27bb584f..5240b71c6 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -12,46 +12,162 @@ usr/bin/sigtool #usr/include/clamav-version.h #usr/include/clamav.h #usr/include/libfreshclam.h -#usr/lib/libclamav.la usr/lib/libclamav.so usr/lib/libclamav.so.9 -usr/lib/libclamav.so.9.0.5 -#usr/lib/libclammspack.la +usr/lib/libclamav.so.9.1.0 usr/lib/libclammspack.so usr/lib/libclammspack.so.0 -usr/lib/libclammspack.so.0.1.0 -#usr/lib/libclamunrar.la +usr/lib/libclammspack.so.0.8.0 usr/lib/libclamunrar.so usr/lib/libclamunrar.so.9 -usr/lib/libclamunrar.so.9.0.5 -#usr/lib/libclamunrar_iface.la +usr/lib/libclamunrar.so.9.1.0 usr/lib/libclamunrar_iface.so usr/lib/libclamunrar_iface.so.9 -usr/lib/libclamunrar_iface.so.9.0.5 -#usr/lib/libfreshclam.la +usr/lib/libclamunrar_iface.so.9.1.0 usr/lib/libfreshclam.so usr/lib/libfreshclam.so.2 -usr/lib/libfreshclam.so.2.0.1 +usr/lib/libfreshclam.so.2.0.2 #usr/lib/pkgconfig/libclamav.pc usr/sbin/clamd -#usr/share/man/man1/clambc.1 -#usr/share/man/man1/clamconf.1 -#usr/share/man/man1/clamdscan.1 -#usr/share/man/man1/clamdtop.1 -#usr/share/man/man1/clamscan.1 -#usr/share/man/man1/clamsubmit.1 -#usr/share/man/man1/freshclam.1 -#usr/share/man/man1/sigtool.1 -#usr/share/man/man5/clamav-milter.conf.5 -#usr/share/man/man5/clamd.conf.5 -#usr/share/man/man5/freshclam.conf.5 -#usr/share/man/man8/clamav-milter.8 -#usr/share/man/man8/clamd.8 +#usr/share/doc/ClamAV +#usr/share/doc/ClamAV/html +#usr/share/doc/ClamAV/html/404.html +#usr/share/doc/ClamAV/html/FontAwesome +#usr/share/doc/ClamAV/html/FontAwesome/css +#usr/share/doc/ClamAV/html/FontAwesome/css/font-awesome.css +#usr/share/doc/ClamAV/html/FontAwesome/fonts +#usr/share/doc/ClamAV/html/FontAwesome/fonts/FontAwesome.ttf +#usr/share/doc/ClamAV/html/FontAwesome/fonts/fontawesome-webfont.eot +#usr/share/doc/ClamAV/html/FontAwesome/fonts/fontawesome-webfont.svg +#usr/share/doc/ClamAV/html/FontAwesome/fonts/fontawesome-webfont.ttf +#usr/share/doc/ClamAV/html/FontAwesome/fonts/fontawesome-webfont.woff +#usr/share/doc/ClamAV/html/FontAwesome/fonts/fontawesome-webfont.woff2 +#usr/share/doc/ClamAV/html/Introduction.html +#usr/share/doc/ClamAV/html/ace.js +#usr/share/doc/ClamAV/html/appendix +#usr/share/doc/ClamAV/html/appendix/Appendix.html +#usr/share/doc/ClamAV/html/appendix/Authenticode.html +#usr/share/doc/ClamAV/html/appendix/CvdPrivateMirror.html +#usr/share/doc/ClamAV/html/appendix/FileTypes.html +#usr/share/doc/ClamAV/html/appendix/FunctionalityLevels.html +#usr/share/doc/ClamAV/html/appendix/Terminology.html +#usr/share/doc/ClamAV/html/ayu-highlight.css +#usr/share/doc/ClamAV/html/book.js +#usr/share/doc/ClamAV/html/clipboard.min.js +#usr/share/doc/ClamAV/html/css +#usr/share/doc/ClamAV/html/css/chrome.css +#usr/share/doc/ClamAV/html/css/general.css +#usr/share/doc/ClamAV/html/css/print.css +#usr/share/doc/ClamAV/html/css/variables.css +#usr/share/doc/ClamAV/html/editor.js +#usr/share/doc/ClamAV/html/elasticlunr.min.js +#usr/share/doc/ClamAV/html/faq +#usr/share/doc/ClamAV/html/faq/faq-cvd.html +#usr/share/doc/ClamAV/html/faq/faq-eol.html +#usr/share/doc/ClamAV/html/faq/faq-freshclam.html +#usr/share/doc/ClamAV/html/faq/faq-ignore.html +#usr/share/doc/ClamAV/html/faq/faq-misc.html +#usr/share/doc/ClamAV/html/faq/faq-ml.html +#usr/share/doc/ClamAV/html/faq/faq-pua.html +#usr/share/doc/ClamAV/html/faq/faq-safebrowsing.html +#usr/share/doc/ClamAV/html/faq/faq-scan-alerts.html +#usr/share/doc/ClamAV/html/faq/faq-troubleshoot.html +#usr/share/doc/ClamAV/html/faq/faq-uninstall.html +#usr/share/doc/ClamAV/html/faq/faq-upgrade.html +#usr/share/doc/ClamAV/html/faq/faq-whichversion.html +#usr/share/doc/ClamAV/html/faq/faq-win32.html +#usr/share/doc/ClamAV/html/faq/faq.html +#usr/share/doc/ClamAV/html/favicon.png +#usr/share/doc/ClamAV/html/fonts +#usr/share/doc/ClamAV/html/fonts/OPEN-SANS-LICENSE.txt +#usr/share/doc/ClamAV/html/fonts/SOURCE-CODE-PRO-LICENSE.txt +#usr/share/doc/ClamAV/html/fonts/fonts.css +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-300.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-300italic.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-600.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-600italic.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-700.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-700italic.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-800.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-800italic.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-italic.woff2 +#usr/share/doc/ClamAV/html/fonts/open-sans-v17-all-charsets-regular.woff2 +#usr/share/doc/ClamAV/html/fonts/source-code-pro-v11-all-charsets-500.woff2 +#usr/share/doc/ClamAV/html/highlight.css +#usr/share/doc/ClamAV/html/highlight.js +#usr/share/doc/ClamAV/html/images +#usr/share/doc/ClamAV/html/images/change-fork-name.png +#usr/share/doc/ClamAV/html/images/cisco.png +#usr/share/doc/ClamAV/html/images/clone-your-fork.png +#usr/share/doc/ClamAV/html/images/create-a-fork.png +#usr/share/doc/ClamAV/html/images/demon.png +#usr/share/doc/ClamAV/html/images/flamegraph.svg +#usr/share/doc/ClamAV/html/images/fork-is-behind.png +#usr/share/doc/ClamAV/html/images/logo.png +#usr/share/doc/ClamAV/html/images/new-git-workflow.png +#usr/share/doc/ClamAV/html/images/old-git-workflow.png +#usr/share/doc/ClamAV/html/index.html +#usr/share/doc/ClamAV/html/manual +#usr/share/doc/ClamAV/html/manual/Development +#usr/share/doc/ClamAV/html/manual/Development.html +#usr/share/doc/ClamAV/html/manual/Development/Contribute.html +#usr/share/doc/ClamAV/html/manual/Development/build-installer-packages.html +#usr/share/doc/ClamAV/html/manual/Development/clamav-git-work-flow.html +#usr/share/doc/ClamAV/html/manual/Development/code-coverage.html +#usr/share/doc/ClamAV/html/manual/Development/development-builds.html +#usr/share/doc/ClamAV/html/manual/Development/fuzzing-sanitizers.html +#usr/share/doc/ClamAV/html/manual/Development/github-pr-basics.html +#usr/share/doc/ClamAV/html/manual/Development/libclamav.html +#usr/share/doc/ClamAV/html/manual/Development/performance-profiling.html +#usr/share/doc/ClamAV/html/manual/Development/personal-forks.html +#usr/share/doc/ClamAV/html/manual/Development/testing-pull-requests.html +#usr/share/doc/ClamAV/html/manual/Development/tips-and-tricks.html +#usr/share/doc/ClamAV/html/manual/Installing +#usr/share/doc/ClamAV/html/manual/Installing.html +#usr/share/doc/ClamAV/html/manual/Installing/Add-clamav-user.html +#usr/share/doc/ClamAV/html/manual/Installing/Community-projects.html +#usr/share/doc/ClamAV/html/manual/Installing/Docker.html +#usr/share/doc/ClamAV/html/manual/Installing/Installing-from-source-Unix-old.html +#usr/share/doc/ClamAV/html/manual/Installing/Installing-from-source-Unix.html +#usr/share/doc/ClamAV/html/manual/Installing/Installing-from-source-Windows.html +#usr/share/doc/ClamAV/html/manual/Installing/Packages.html +#usr/share/doc/ClamAV/html/manual/OnAccess.html +#usr/share/doc/ClamAV/html/manual/Signatures +#usr/share/doc/ClamAV/html/manual/Signatures.html +#usr/share/doc/ClamAV/html/manual/Signatures/AllowLists.html +#usr/share/doc/ClamAV/html/manual/Signatures/AuthenticodeRules.html +#usr/share/doc/ClamAV/html/manual/Signatures/BodySignatureFormat.html +#usr/share/doc/ClamAV/html/manual/Signatures/BytecodeSignatures.html +#usr/share/doc/ClamAV/html/manual/Signatures/ContainerMetadata.html +#usr/share/doc/ClamAV/html/manual/Signatures/DatabaseInfo.html +#usr/share/doc/ClamAV/html/manual/Signatures/DynamicConfig.html +#usr/share/doc/ClamAV/html/manual/Signatures/EncryptedArchives.html +#usr/share/doc/ClamAV/html/manual/Signatures/ExtendedSignatures.html +#usr/share/doc/ClamAV/html/manual/Signatures/FileTypeMagic.html +#usr/share/doc/ClamAV/html/manual/Signatures/HashSignatures.html +#usr/share/doc/ClamAV/html/manual/Signatures/LogicalSignatures.html +#usr/share/doc/ClamAV/html/manual/Signatures/PhishSigs.html +#usr/share/doc/ClamAV/html/manual/Signatures/YaraRules.html +#usr/share/doc/ClamAV/html/manual/Usage +#usr/share/doc/ClamAV/html/manual/Usage.html +#usr/share/doc/ClamAV/html/manual/Usage/Configuration.html +#usr/share/doc/ClamAV/html/manual/Usage/ReportABug.html +#usr/share/doc/ClamAV/html/manual/Usage/Scanning.html +#usr/share/doc/ClamAV/html/manual/Usage/Services.html +#usr/share/doc/ClamAV/html/manual/Usage/SignatureManagement.html +#usr/share/doc/ClamAV/html/mark.min.js +#usr/share/doc/ClamAV/html/mode-rust.js +#usr/share/doc/ClamAV/html/print.html +#usr/share/doc/ClamAV/html/searcher.js +#usr/share/doc/ClamAV/html/searchindex.js +#usr/share/doc/ClamAV/html/searchindex.json +#usr/share/doc/ClamAV/html/theme-dawn.js +#usr/share/doc/ClamAV/html/theme-tomorrow_night.js +#usr/share/doc/ClamAV/html/tomorrow-night.css #var/ipfire/clamav var/ipfire/clamav/clamd.conf var/ipfire/clamav/clamd.conf.sample var/ipfire/clamav/freshclam.conf var/ipfire/clamav/freshclam.conf.sample var/lib/clamav -etc/rc.d/init.d/clamav usr/local/bin/clamavctrl diff --git a/lfs/clamav b/lfs/clamav index 4dc996ea4..9076d0f71 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.103.3 +VER = 0.104.0 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,14 +32,10 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 56 +PAK_VER = 57 DEPS = -ifeq "$(BUILD_PLATFORM)" "arm" -CONFIGURE_FLAGS = --disable-fanotify -endif - DATABASE_DIR = /var/lib/clamav ############################################################################### @@ -50,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f8dcf678953f6af056ddd5917bcc50c3 +$(DL_FILE)_MD5 = 3f4789c09f5a35e9ea580edd5c3e54b6 install : $(TARGET) @@ -83,19 +79,31 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure \ - --prefix=/usr \ - --disable-clamonacc \ - --sysconfdir=/var/ipfire/clamav \ - --with-dbdir=$(DATABASE_DIR) \ - $(CONFIGURE_FLAGS) - cd $(DIR_APP) && make $(MAKETUNING) - cd $(DIR_APP) && make install + + cd $(DIR_APP) && mkdir -pv build + cd $(DIR_APP)/build && cmake .. -G Ninja \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_INSTALL_PREFIX=/usr \ + -DCMAKE_INSTALL_LIBDIR=/usr/lib \ + -DOPTIMIZE=ON \ + -DBYTECODE_RUNTIME="interpreter" \ + -DENABLE_TESTS=OFF \ + -DENABLE_CLAMONACC=OFF \ + -DENABLE_MILTER=OFF \ + -DENABLE_MAN_PAGES=OFF \ + -DENABLE_EXTERNAL_MSPACK=OFF \ + -DENABLE_FRESHCLAM_DNS_FIX=ON \ + -DAPP_CONFIG_DIRECTORY=/var/ipfire/clamav \ + -DDATABASE_DIRECTORY=$(DATABASE_DIR) + + cd $(DIR_APP)/build && ninja $(MAKETUNING) && ninja install + mkdir -pv $(DATABASE_DIR) chown clamav.clamav -R $(DATABASE_DIR) rm -rfv $(DATABASE_DIR)/*.cvd + mkdir -pv /var/ipfire/clamav cp -rf $(DIR_SRC)/config/clamav/* /var/ipfire/clamav/ - mkdir -p /var/run/clamav + mkdir -pv /var/run/clamav chown clamav:clamav /var/run/clamav #install initscripts $(call INSTALL_INITSCRIPT,clamav) -- 2.18.0

2 1

[PATCH 01/13] kernel: Change timer tick to 1000Hz
by Michael Tremer 07 Sep '21

07 Sep '21

This change is required to make the system respond faster to any realtime events (sending or receiving data packets). It will wake up at least one core 1000 times a second which will result in finer timer granularity and make scheduling smoother. HTB for example sends large packet bursts on each timer even to keep up data rates which is not helpful for most applications. The change might increase resource consumption and overhead slightly on some systems, but since we are running in an idle-dyntick configuration, we should not keep awake any cores that have not been awake before. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 6 +++--- config/kernel/kernel.config.armv6l-ipfire | 6 +++--- config/kernel/kernel.config.i586-ipfire | 6 +++--- config/kernel/kernel.config.x86_64-ipfire | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 450835d8b..54cd7c084 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -370,11 +370,11 @@ CONFIG_NR_CPUS=8 CONFIG_HOTPLUG_CPU=y # CONFIG_NUMA is not set CONFIG_HOLES_IN_ZONE=y -CONFIG_HZ_100=y +# CONFIG_HZ_100 is not set # CONFIG_HZ_250 is not set # CONFIG_HZ_300 is not set -# CONFIG_HZ_1000 is not set -CONFIG_HZ=100 +CONFIG_HZ_1000=y +CONFIG_HZ=1000 CONFIG_SCHED_HRTICK=y CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y CONFIG_ARCH_SPARSEMEM_ENABLE=y diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index b1af6555c..6fe17954d 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -588,13 +588,13 @@ CONFIG_HOTPLUG_CPU=y CONFIG_ARM_PSCI=y CONFIG_ARCH_NR_GPIO=512 CONFIG_HZ_FIXED=0 -CONFIG_HZ_100=y +# CONFIG_HZ_100 is not set # CONFIG_HZ_200 is not set # CONFIG_HZ_250 is not set # CONFIG_HZ_300 is not set # CONFIG_HZ_500 is not set -# CONFIG_HZ_1000 is not set -CONFIG_HZ=100 +CONFIG_HZ_1000=y +CONFIG_HZ=1000 CONFIG_SCHED_HRTICK=y CONFIG_ARM_PATCH_IDIV=y CONFIG_AEABI=y diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 5f5a496a8..a915682e4 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -438,11 +438,11 @@ CONFIG_X86_INTEL_TSX_MODE_OFF=y # CONFIG_X86_INTEL_TSX_MODE_AUTO is not set CONFIG_EFI=y CONFIG_EFI_STUB=y -CONFIG_HZ_100=y +# CONFIG_HZ_100 is not set # CONFIG_HZ_250 is not set # CONFIG_HZ_300 is not set -# CONFIG_HZ_1000 is not set -CONFIG_HZ=100 +CONFIG_HZ_1000=y +CONFIG_HZ=1000 CONFIG_SCHED_HRTICK=y # CONFIG_KEXEC is not set CONFIG_CRASH_DUMP=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index f8289aeb8..730e0791e 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -430,11 +430,11 @@ CONFIG_X86_INTEL_TSX_MODE_OFF=y CONFIG_EFI=y CONFIG_EFI_STUB=y CONFIG_EFI_MIXED=y -CONFIG_HZ_100=y +# CONFIG_HZ_100 is not set # CONFIG_HZ_250 is not set # CONFIG_HZ_300 is not set -# CONFIG_HZ_1000 is not set -CONFIG_HZ=100 +CONFIG_HZ_1000=y +CONFIG_HZ=1000 CONFIG_SCHED_HRTICK=y # CONFIG_KEXEC is not set # CONFIG_KEXEC_FILE is not set -- 2.20.1

1 5

[PATCH] ovpnmain.cgi: Remove unnecessary check/error message
by Leo-Andres Hofmann 07 Sep '21

07 Sep '21

This parameter can either be "host" or "net", but the existing check only allows "net" entries. Since other entries are also valid but don't require further action, this patch removes the error message. Fixes: #12686 Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- html/cgi-bin/ovpnmain.cgi | 3 --- 1 file changed, 3 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 3cd2f9381..2ebf384ed 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2183,9 +2183,6 @@ END &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]"); &writecollectdconf(); } - - } else { - $errormessage = $Lang::tr{'invalid key'}; } } } -- 2.27.0.windows.1

2 1

[PATCH 0/3] Add ASN-based anomaly detections to IPFire's web proxy: Proactive Fast Flux detection and detection for selectively announced networks
by Peter Müller 07 Sep '21

07 Sep '21

This patchset adds two new features to IPFire's web proxy, taking advantage of the Autonomous System information we have at hand by using libloc. The proactive Fast Flux detection is especially worth noticing, as even most expensive (= advanced?) security suites do not provide similar protection, especially not in a proactive manner. By simply enumerating the distinct amount of Autonomous System Numbers a FQDN ultimately resolves to, we are able to deny access to malware distribution sites, phishing sites, C&C servers, and other cybercrime stuff hosted on Fast Flux setups abusing cracked machines around the world - even before the FQDN or any IP address involved is flagged as malicious by any security vendor. Peter Müller (3): squid-asnbl: New package proxy.cgi: Implement proactive Fast Flux detection and detection for selectively announced destinations langs: Add English and German translations for newly added web proxy features config/rootfiles/common/squid-asnbl | 1 + html/cgi-bin/proxy.cgi | 89 +++++++++++++++++++++++++++++ langs/de/cgi-bin/de.pl | 7 +++ langs/en/cgi-bin/en.pl | 7 +++ lfs/squid-asnbl | 83 +++++++++++++++++++++++++++ make.sh | 1 + 6 files changed, 188 insertions(+) create mode 100644 config/rootfiles/common/squid-asnbl create mode 100644 lfs/squid-asnbl -- 2.26.2

2 9

Log for Sept 6th Conf Call
by Adolf Belka 07 Sep '21

07 Sep '21

A couple of updates for the log of the Sept 6th conf call. - Arne was also in the call. He joined later. - I was asked to look at getting exfat capability working on IPFire. Regards, Adolf.

2 1

[PATCH] poppler: Update to version 21.09.0
by Adolf Belka 07 Sep '21

07 Sep '21

- Update from 21.07.0 to 21.09.0 - Update rootfile - No additional packages flagged due to lib so bump by find-dependencies - Changelog is too long and detailed to include here. Full details for 21.08.0 and 21.09.0 versions can be found in the ChangeLog file in the source tarball 4 bug fixes listed in version 21.09.0 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/poppler | 4 ++-- lfs/poppler | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/poppler b/config/rootfiles/common/poppler index 9746d9412..5cf528e54 100644 --- a/config/rootfiles/common/poppler +++ b/config/rootfiles/common/poppler @@ -172,8 +172,8 @@ usr/lib/libpoppler-cpp.so.0.9.0 usr/lib/libpoppler-glib.so.8 usr/lib/libpoppler-glib.so.8.21.0 #usr/lib/libpoppler.so -usr/lib/libpoppler.so.111 -usr/lib/libpoppler.so.111.0.0 +usr/lib/libpoppler.so.113 +usr/lib/libpoppler.so.113.0.0 #usr/lib/pkgconfig/poppler-cpp.pc #usr/lib/pkgconfig/poppler-glib.pc #usr/lib/pkgconfig/poppler.pc diff --git a/lfs/poppler b/lfs/poppler index 3589e86b4..f0b08cdd5 100644 --- a/lfs/poppler +++ b/lfs/poppler @@ -24,7 +24,7 @@ include Config -VER = 21.07.0 +VER = 21.09.0 THISAPP = poppler-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3c4b500a0af4cf1dc4a1c66fa48b7551 +$(DL_FILE)_MD5 = f807ea7955d728d1838077fd9df32fac install : $(TARGET) -- 2.33.0

1 0

[PATCH] gzip: Update to version 1.11
by Adolf Belka 07 Sep '21

07 Sep '21

- Update from 1.10 to 1.11 - Update of rootfile not required - Changelog is too long to include here. Full details can be found in the ChangeLog file in the source tarball There 8 bug fixes listed in the changelog Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/gzip | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/gzip b/lfs/gzip index ae8bee05f..4f8925cd2 100644 --- a/lfs/gzip +++ b/lfs/gzip @@ -24,7 +24,7 @@ include Config -VER = 1.10 +VER = 1.11 THISAPP = gzip-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -54,7 +54,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 691b1221694c3394f1c537df4eee39d3 +$(DL_FILE)_MD5 = d1e93996dba00cab0caa7903cd01d454 install : $(TARGET) -- 2.33.0

1 0

[PATCH] freetype: Update to version 2.11.0
by Adolf Belka 07 Sep '21

07 Sep '21

- Update from 2.10.4 to 2.11.0 - Update rootfile - Changelog CHANGES BETWEEN 2.10.4 and 2.11.0 I. IMPORTANT CHANGES - A new rendering module has been added to create 8-bit Signed Distance Field (SDF) bitmaps for both outline and bitmap glyphs. The new rendering mode is called `FT_RENDER_MODE_SDF`, the pixel mode is `FT_PIXEL_MODE_GRAY8`, and the corresponding raster flag is `FT_RASTER_FLAG_SDF`. This work was Anuj Verma's GSoC 2020 project. - A new, experimental API is now available for surfacing properties of 'COLR' v1 color fonts (as the name says, this is an extension to the 'COLR' table for outline color fonts using the SFNT container format). 'COLR' v1 fonts are a recently proposed addition to OFF and OpenType; specification work currently happens in https://github.com/googlefonts/colr-gradients-spec/ 'COLR' v1 is expected to be merged to OpenType; the ISO standardisation process for adding 'COLR' v1 as an amendment to OFF is underway. Functions similar to the already existing 'COLR' API have been added to access the corresponding data. FT_Get_Color_Glyph_Paint Retrieve the root paint for a given glyph ID. FT_Get_Paint_Layers Access the layers of a `PaintColrLayers` table. FT_Get_Colorline_Stops Retrieve the 'color stops' on a color line. As an input, a color stop iterator gets used, which in turn is retrieved from a paint. FT_Get_Paint Dereference an `FT_OpaquePaint` object and retrieve the corresponding `FT_COLR_Paint` object, which contains details on how to draw the respective 'COLR' v1 `Paint` table. II. MISCELLANEOUS - FreeType has moved its infrastructure to https://gitlab.freedesktop.org/freetype A side effect is that the git repositories are now called `freetype.git` and `freetype-demos.git`, which by default expand to the directories `freetype` and `freetype-demos`, respectively. The documentation has been updated accordingly. FreeType's Savannah repositories will stay; they are now mirrors of the 'freedesktop.org' repositories. - A new function `FT_Get_Transform` returns the values set by `FT_Set_Transform`. - A new configuration macro `FT_DEBUG_LOGGING` is available. It provides extended debugging capabilities for FreeType, for example showing a time stamp or displaying the component a tracing message comes from. See file `docs/DEBUG` for more information. This work was Priyesh Kumar's GSoC 2020 project. - The legacy Type 1 and CFF engines are further demoted due to lack of CFF2 charstring support. You now need to use `FT_Property_Set` to enable them besides the `T1_CONFIG_OPTION_OLD_ENGINE` and `CFF_CONFIG_OPTION_OLD_ENGINE` options, respectively. - The experimental 'warp' mode (AF_CONFIG_OPTION_USE_WARPER) for the auto-hinter has been removed. - The smooth rasterizer performance has been improved by >10%. Note that due to necessary code changes there might be very subtle differences in rendering. They are not visible by the eye, however. - PCF bitmap fonts compressed with LZW (these are usually files with the extension `.pcf.Z`) are now handled correctly. - Improved Meson build files, including support to build the FreeType demo programs. - A new demo program `ftsdf` is available to display Signed Distance Fields of glyphs. - The `ftlint` demo program has been extended to do more testing of its input. In particular, it can display horizontal and vertical acutances for quality assessment, together with computing MD5 checksums of rendered glyphs. [The acutance measures how sharply the pixel coverage changes at glyph edges. For monochrome bitmaps, it is always 2.0 in either X or Y direction. For anti-aliased bitmaps, it depends on the hinting and the shape of a glyph and might approach or even reach value 2.0 for glyphs like 'I', 'L', '+', '-', or '=', while it might be lower for glyphs like 'O', 'S', or 'W'.] - The `ttdebug` demo program didn't show changed point coordinates (bug introduced in version 2.10.3). - It is now possible to adjust the axis increment for variable fonts in the `ftmulti` demo program. - It is now possible to change the hinting engine in the `ftstring` demo program. - The graphical demo programs work better now in native color depth on win32 and x11. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/freetype | 3 ++- lfs/freetype | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/freetype b/config/rootfiles/common/freetype index 194253601..24e9682e6 100644 --- a/config/rootfiles/common/freetype +++ b/config/rootfiles/common/freetype @@ -32,6 +32,7 @@ #usr/include/freetype2/freetype/ftincrem.h #usr/include/freetype2/freetype/ftlcdfil.h #usr/include/freetype2/freetype/ftlist.h +#usr/include/freetype2/freetype/ftlogging.h #usr/include/freetype2/freetype/ftlzw.h #usr/include/freetype2/freetype/ftmac.h #usr/include/freetype2/freetype/ftmm.h @@ -58,7 +59,7 @@ #usr/lib/libfreetype.la #usr/lib/libfreetype.so usr/lib/libfreetype.so.6 -usr/lib/libfreetype.so.6.17.4 +usr/lib/libfreetype.so.6.18.0 #usr/lib/pkgconfig/freetype2.pc #usr/share/aclocal/freetype2.m4 #usr/share/man/man1/freetype-config.1 diff --git a/lfs/freetype b/lfs/freetype index 8a93ad0e9..4dbf41eb5 100644 --- a/lfs/freetype +++ b/lfs/freetype @@ -24,7 +24,7 @@ include Config -VER = 2.10.4 +VER = 2.11.0 THISAPP = freetype-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0e6c0e9b218be3ba3e26e1d23b1c80dd +$(DL_FILE)_MD5 = f931582653774e310ed3a7e49b7167a3 install : $(TARGET) -- 2.33.0

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2021