Development November 2022

development@lists.ipfire.org

17 participants
120 discussions

Vulnerabilities flagged in clamav-0.105.1
by Adolf Belka 08 Nov '22

08 Nov '22

Hi all, I have just checked the change logs for the latest versions of zlib and libxml2 that I am building and they include fixes to the vulnerabilities flagged up in the clamav-0.105.1 announcement. The vulnerability for zlib was already fixed in CU171 with the two patch files that Peter added. This patch set has now been integrated into the latest zlib. The vulnerabilities for libxml2 have fixes for both CVE's in the latest version of libxml2 that was released on October 14th. Both of the CVE's are listed in the CVE website as reserved but with no details but clearly the info has been circulated to the zlib and libxml2 developers and fixes were made a while ago. Not sure how to find out if CVE's have been raised on packages that IPFire is using so we can use any fixes developed as soon as possible. I knew about the issues with zlib and libxml2 because I saw the announcement of the clamav-0.105.1 release. Anyway good news, the patches I will submit soon will contain the fixes to the CVE's mentioned in the clamav announcement. Regards, Adolf.

2 1

[PATCH] expat: Update to version 2.5.0
by Adolf Belka 08 Nov '22

08 Nov '22

- Update from version 2.4.9 to 2.5.0 - Update of rootfile. - Changelog Release 2.5.0 Tue October 25 2022 Security fixes: #616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager destruction of a shared DTD in function XML_ExternalEntityParserCreate in out-of-memory situations. Expected impact is denial of service or potentially arbitrary code execution. Bug fixes: #612 #645 Fix curruption from undefined entities #613 #654 Fix case when parsing was suspended while processing nested entities #616 #652 #653 Stop leaking opening tag bindings after a closing tag mismatch error where a parser is reset through XML_ParserReset and then reused to parse #656 CMake: Fix generation of pkg-config file #658 MinGW|CMake: Fix static library name Other changes: #663 Protect header expat_config.h from multiple inclusion #666 examples: Make use of XML_GetBuffer and be more consistent across examples #648 Address compiler warnings #667 #668 Version info bumped from 9:9:8 to 9:10:8; see https://verbump.de/ for what these numbers do Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/expat | 20 ++++++++++---------- lfs/expat | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat index 8feb895b3..5b25d63b8 100644 --- a/config/rootfiles/common/expat +++ b/config/rootfiles/common/expat @@ -2,20 +2,20 @@ #usr/include/expat.h #usr/include/expat_config.h #usr/include/expat_external.h -#usr/lib/cmake/expat-2.4.9 -#usr/lib/cmake/expat-2.4.9/expat-config-version.cmake -#usr/lib/cmake/expat-2.4.9/expat-config.cmake -#usr/lib/cmake/expat-2.4.9/expat-noconfig.cmake -#usr/lib/cmake/expat-2.4.9/expat.cmake +#usr/lib/cmake/expat-2.5.0 +#usr/lib/cmake/expat-2.5.0/expat-config-version.cmake +#usr/lib/cmake/expat-2.5.0/expat-config.cmake +#usr/lib/cmake/expat-2.5.0/expat-noconfig.cmake +#usr/lib/cmake/expat-2.5.0/expat.cmake #usr/lib/libexpat.la #usr/lib/libexpat.so usr/lib/libexpat.so.1 -usr/lib/libexpat.so.1.8.9 +usr/lib/libexpat.so.1.8.10 #usr/lib/pkgconfig/expat.pc #usr/share/doc/expat -#usr/share/doc/expat-2.4.9 -#usr/share/doc/expat-2.4.9/ok.min.css -#usr/share/doc/expat-2.4.9/reference.html -#usr/share/doc/expat-2.4.9/style.css +#usr/share/doc/expat-2.5.0 +#usr/share/doc/expat-2.5.0/ok.min.css +#usr/share/doc/expat-2.5.0/reference.html +#usr/share/doc/expat-2.5.0/style.css #usr/share/doc/expat/AUTHORS #usr/share/doc/expat/changelog diff --git a/lfs/expat b/lfs/expat index a1a1326d0..a89b6d114 100644 --- a/lfs/expat +++ b/lfs/expat @@ -24,7 +24,7 @@ include Config -VER = 2.4.9 +VER = 2.5.0 THISAPP = expat-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d60183f96f3359acc069af638cc8d16ba19f51fbd8a61eddd80c2babddde357dcf0561e87af901f53617bfd9452e146c9dd9f317729cd3648b65832a38388640 +$(DL_FILE)_BLAKE2 = 15a5dcd3af17995fb4299301710b38d609c1fe7a8d6a6284581fedd96e89e0c16526d0342fb55773ac9d678cd65dc5cdb1532c764eeb3a20ccdf1e168b96e337 install : $(TARGET) -- 2.38.1

2 1

[PATCH] libxml2: Update to version 2.10.3
by Adolf Belka 08 Nov '22

08 Nov '22

- Update from version 2.9.14 to 2.10.3 - Update of rootfile - Changelog v2.10.3: Oct 14 2022 ### Security - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c ### Portability - win32: Fix build with VS2013 ### Build system - cmake: Set SOVERSION v2.10.2: Aug 29 2022 ### Improvements - Remove set-but-unused variable in xmlXPathScanName - Silence -Warray-bounds warning ### Build system - build: require automake-1.16.3 or later (Xi Ruoyao) - Remove generated files from distribution ### Test suite - Don't create missing.xml when running testapi v2.10.1: Aug 25 2022 ### Regressions - Fix xmlCtxtReadDoc with encoding ### Bug fixes - Fix HTML parser with threads and --without-legacy ### Build system - Fix build with Python 3.10 - cmake: Disable version script on macOS - Remove Makefile rule to build testapi.c ### Documentation - Switch back to HTML output for API documentation - Port doc/examples/index.py to Python 3 - Fix order of exports in libxml2-api.xml - Remove libxml2-refs.xml v2.10.0: Aug 17 2022 ### Security - [CVE-2022-2309] Reset nsNr in xmlCtxtReset - Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer (David Kilzer) - Fix missing NUL terminators in xmlBuf and xmlBuffer functions (David Kilzer) - Fix integer overflow in xmlBufferDump() (David Kilzer) - xmlBufAvail() should return length without including a byte for NUL terminator (David Kilzer) - Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() (David Kilzer) - Use xmlNewDocText in xmlXIncludeCopyRange - Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser (David Kilzer) - Use UPDATE_COMPAT() consistently in buf.c (David Kilzer) - fix: xmlXPathParserContext could be double-delete in OOM case. (jinsub ahn) ### Removals and deprecations - Disable XPointer location support by default - Remove outdated xml2Conf.sh - Deprecate module init and cleanup functions - Remove obsolete XML Software Autoupdate (XSA) file - Remove DOCBparser - Remove obsolete Python test framework - Remove broken VxWorks support - Remove broken Mac OS 9 support - Remove broken bakefile support - Remove broken Visual Studio 2010 support - Remove broken Windows CE support - Deprecate IDREF-related functions in valid.h - Deprecate legacy functions - Disable legacy support by default - Deprecate all functions in nanoftp.h - Disable FTP support by default - Add XML_DEPRECATED macro - Remove elfgcchack.h ### Regressions - Skip incorrectly opened HTML comments - Restore behavior of htmlDocContentDumpFormatOutput() (David Kilzer) ### Bug fixes - Fix memory leak with invalid XSD - Make XPath depth check work with recursive invocations - Fix memory leak in xmlLoadEntityContent error path - Avoid double-free if malloc fails in inputPush - Properly fold whitespace around the QName value when validating an XSD schema. (Damjan Jovanovic) - Add whitespace folding for some atomic data types that it's missing on. (Damjan Jovanovic) - Don't add IDs containing unexpanded entity references ### Improvements - Avoid calling xmlSetTreeDoc - Simplify xmlFreeNode - Don't reset nsDef when changing node content - Fix unintended fall-through in xmlNodeAddContentLen - Remove unused xmlBuf functions (David Kilzer) - Implement xpath1() XPointer scheme - Add configuration flag for XPointer locations support - Fix compiler warnings in Python code - Mark more static data as `const` (David Kilzer) - Make xmlStaticCopyNode non-recursive - Clean up encoding switching code - Simplify recursive pthread mutex - Use non-recursive mutex in dict.c - Fix parser progress checks - Avoid arithmetic on freed pointers - Improve buffer allocation scheme - Remove unneeded #includes - Add support for some non-standard escapes in regular expressions. (Damjan Jovanovic) - htmlParseComment: handle abruptly-closed comments (Mike Dalessio) - Add let variable tag support (Oliver Diehl) - Add value-of tag support (Oliver Diehl) - Remove useless call to xmlRelaxNGCleanupTypes - Don't include ICU headers in public headers - Update `xmlStrlen()` to use POSIX / ISO C `strlen()` (Mike Dalessio) - Fix unused variable warnings with disabled features - Only warn on invalid redeclarations of predefined entities - Remove unneeded code in xmlreader.c - Rework validation context flags ### Portability - Use NAN/INFINITY if available to init XPath NaN/Inf (Sergey Kosukhin) - Fix Python tests on macOS - Fix xmlCleanupThreads on Windows - Fix reinitialization of library on Windows - Don't mix declarations and code in runtest.c - Use portable python shebangs (David Seifert) - Use critical sections as mutex on Windows - Don't set HAVE_WIN32_THREADS in win32config.h - Use stdint.h with newer MSVC - Remove cruft from win32config.h - Remove isinf/isnan emulation in win32config.h - Always fopen files with "rb" - Remove __DJGPP__ checks - Remove useless __CYGWIN__ checks ### Build system - Don't autogenerate doc/examples/Makefile.am - cmake: Install libxml.m4 on UNIX-like platforms (Daniel E) - cmake: Use symbol versioning on UNIX-like platforms (Daniel E) - Port genUnicode.py to Python 3 - Port gentest.py to Python 3 - cmake: Fix build without thread support - cmake: Install documentation in CMAKE_INSTALL_DOCDIR - cmake: Remove non needed files in docs dir (Daniel E) - configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set (Christopher Degawa) - Move local Autoconf macros into m4 directory - Use XML_PRIVATE_LIBS in libxml2_la_LIBADD - Update libxml-2.0-uninstalled.pc.in - Remove LIBS from XML_PRIVATE_LIBS - Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS - Don't overlink executables - cmake: Adjust paths for UNIX or UNIX-like target systems (Daniel Engberg) - build: Make use of variables in libxml's pkg-config file (Daniel Engberg) - Avoid obsolescent `test -a` constructs (David Seifert) - Move AM_MAINTAINER_MODE to AM section - configure.ac: make AM_SILENT_RULES([yes]) unconditional (David Seifert) - Streamline documentation installation - Don't try to recreate COPYING symlink - Detect libm using libtool's macros (David Seifert) - configure.ac: disable static libraries by default (David Seifert) - python/Makefile.am: nest python docs in $(docdir) (David Seifert) - python/Makefile.am: rely on global AM_INIT_AUTOMAKE (David Seifert) - Makefile.am: install examples more idiomatically (David Seifert) - configure.ac: remove useless AC_SUBST (David Seifert) - Respect `--sysconfdir` in source files (David Seifert) - Ignore configure backup file created by recent autoreconf too (Vadim Zeitlin) - Only install *.html and *.c example files - Remove --with-html-dir option - Rework documentation build system - Remove old website - Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings (David Seifert) - Update genChRanges.py - Update build_glob.py - Remove ICONV_CONST test - Remove obsolete AC_HEADER checks - Don't check for standard C89 library functions - Don't check for standard C89 headers - Remove special configuration for certain maintainers ### Test suite, CI - Disable network in API tests - testapi: remove leading slash from "/missing.xml" (Mike Gilbert) - Build Autotools CI tests out of source tree (VPATH) - Add --with-minimum build to CI tests - Fix warnings when testing --with-minimum build - cmake: Run all tests when threads are disabled - Also build CI tests with -Werror - Move doc/examples tests to new test suite - Simplify 'make check' targets - Fix schemas and relaxng tests - Remove unused result files - Allow missing result files in runtest - Move regexp tests to runtest - Move SVG tests to runtest.c - Move testModule to new test suite - Move testThreads to new test suite - Remove major parts of old test suite - Make testchar return an error on failure (Tony Tascioglu) - Add CI job for static build - python/tests: open() relative to test scripts (David Seifert) - Port some test scripts to Python 3 ### Documentation - Improve documentation of tree manipulation API - Update xml2-config man page - Consolidate man pages - Rename xmlcatalog_man.xml - Make examples a standalone HTML page - Fix documentation in entities.c - Add note about optimization flags Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libxml2 | 233 ++++++++++---------------------- lfs/libxml2 | 4 +- 2 files changed, 73 insertions(+), 164 deletions(-) diff --git a/config/rootfiles/common/libxml2 b/config/rootfiles/common/libxml2 index 2906418ec..e9ecb599b 100644 --- a/config/rootfiles/common/libxml2 +++ b/config/rootfiles/common/libxml2 @@ -3,7 +3,6 @@ #usr/bin/xmllint #usr/include/libxml2 #usr/include/libxml2/libxml -#usr/include/libxml2/libxml/DOCBparser.h #usr/include/libxml2/libxml/HTMLparser.h #usr/include/libxml2/libxml/HTMLtree.h #usr/include/libxml2/libxml/SAX.h @@ -55,176 +54,87 @@ #usr/lib/libxml2.la #usr/lib/libxml2.so usr/lib/libxml2.so.2 -usr/lib/libxml2.so.2.9.14 +usr/lib/libxml2.so.2.10.3 #usr/lib/pkgconfig/libxml-2.0.pc -#usr/lib/xml2Conf.sh #usr/share/aclocal/libxml.m4 #usr/share/doc/libxml2 -#usr/share/doc/libxml2/Copyright #usr/share/doc/libxml2/examples -#usr/share/doc/libxml2/examples/README -#usr/share/doc/libxml2/examples/testHTML.c -#usr/share/doc/libxml2/examples/testSAX.c -#usr/share/doc/libxml2/examples/testXPath.c +#usr/share/doc/libxml2/examples/index.html +#usr/share/doc/libxml2/examples/io1.c +#usr/share/doc/libxml2/examples/io2.c +#usr/share/doc/libxml2/examples/parse1.c +#usr/share/doc/libxml2/examples/parse2.c +#usr/share/doc/libxml2/examples/parse3.c +#usr/share/doc/libxml2/examples/parse4.c +#usr/share/doc/libxml2/examples/reader1.c +#usr/share/doc/libxml2/examples/reader2.c +#usr/share/doc/libxml2/examples/reader3.c +#usr/share/doc/libxml2/examples/reader4.c +#usr/share/doc/libxml2/examples/testWriter.c +#usr/share/doc/libxml2/examples/tree1.c +#usr/share/doc/libxml2/examples/tree2.c #usr/share/doc/libxml2/examples/xmllint.c -#usr/share/doc/libxml2/html -#usr/share/doc/libxml2/html/DOM.gif -#usr/share/doc/libxml2/html/FAQ.html -#usr/share/doc/libxml2/html/Libxml2-Logo-180x168.gif -#usr/share/doc/libxml2/html/Libxml2-Logo-90x34.gif -#usr/share/doc/libxml2/html/encoding.html -#usr/share/doc/libxml2/html/examples -#usr/share/doc/libxml2/html/examples/examples.xml -#usr/share/doc/libxml2/html/examples/examples.xsl -#usr/share/doc/libxml2/html/examples/index.html -#usr/share/doc/libxml2/html/examples/io1.c -#usr/share/doc/libxml2/html/examples/io1.res -#usr/share/doc/libxml2/html/examples/io2.c -#usr/share/doc/libxml2/html/examples/io2.res -#usr/share/doc/libxml2/html/examples/parse1.c -#usr/share/doc/libxml2/html/examples/parse2.c -#usr/share/doc/libxml2/html/examples/parse3.c -#usr/share/doc/libxml2/html/examples/parse4.c -#usr/share/doc/libxml2/html/examples/reader1.c -#usr/share/doc/libxml2/html/examples/reader1.res -#usr/share/doc/libxml2/html/examples/reader2.c -#usr/share/doc/libxml2/html/examples/reader3.c -#usr/share/doc/libxml2/html/examples/reader3.res -#usr/share/doc/libxml2/html/examples/reader4.c -#usr/share/doc/libxml2/html/examples/reader4.res -#usr/share/doc/libxml2/html/examples/test1.xml -#usr/share/doc/libxml2/html/examples/test2.xml -#usr/share/doc/libxml2/html/examples/test3.xml -#usr/share/doc/libxml2/html/examples/testWriter.c -#usr/share/doc/libxml2/html/examples/tree1.c -#usr/share/doc/libxml2/html/examples/tree1.res -#usr/share/doc/libxml2/html/examples/tree2.c -#usr/share/doc/libxml2/html/examples/tree2.res -#usr/share/doc/libxml2/html/examples/tst.xml -#usr/share/doc/libxml2/html/examples/writer.xml -#usr/share/doc/libxml2/html/examples/xpath1.c -#usr/share/doc/libxml2/html/examples/xpath1.res -#usr/share/doc/libxml2/html/examples/xpath2.c -#usr/share/doc/libxml2/html/examples/xpath2.res -#usr/share/doc/libxml2/html/html -#usr/share/doc/libxml2/html/html/book1.html -#usr/share/doc/libxml2/html/html/home.png -#usr/share/doc/libxml2/html/html/index.html -#usr/share/doc/libxml2/html/html/left.png -#usr/share/doc/libxml2/html/html/libxml-DOCBparser.html -#usr/share/doc/libxml2/html/html/libxml-HTMLparser.html -#usr/share/doc/libxml2/html/html/libxml-HTMLtree.html -#usr/share/doc/libxml2/html/html/libxml-SAX.html -#usr/share/doc/libxml2/html/html/libxml-SAX2.html -#usr/share/doc/libxml2/html/html/libxml-c14n.html -#usr/share/doc/libxml2/html/html/libxml-catalog.html -#usr/share/doc/libxml2/html/html/libxml-chvalid.html -#usr/share/doc/libxml2/html/html/libxml-debugXML.html -#usr/share/doc/libxml2/html/html/libxml-dict.html -#usr/share/doc/libxml2/html/html/libxml-encoding.html -#usr/share/doc/libxml2/html/html/libxml-entities.html -#usr/share/doc/libxml2/html/html/libxml-globals.html -#usr/share/doc/libxml2/html/html/libxml-hash.html -#usr/share/doc/libxml2/html/html/libxml-lib.html -#usr/share/doc/libxml2/html/html/libxml-list.html -#usr/share/doc/libxml2/html/html/libxml-nanoftp.html -#usr/share/doc/libxml2/html/html/libxml-nanohttp.html -#usr/share/doc/libxml2/html/html/libxml-parser.html -#usr/share/doc/libxml2/html/html/libxml-parserInternals.html -#usr/share/doc/libxml2/html/html/libxml-pattern.html -#usr/share/doc/libxml2/html/html/libxml-relaxng.html -#usr/share/doc/libxml2/html/html/libxml-schemasInternals.html -#usr/share/doc/libxml2/html/html/libxml-schematron.html -#usr/share/doc/libxml2/html/html/libxml-threads.html -#usr/share/doc/libxml2/html/html/libxml-tree.html -#usr/share/doc/libxml2/html/html/libxml-uri.html -#usr/share/doc/libxml2/html/html/libxml-valid.html -#usr/share/doc/libxml2/html/html/libxml-xinclude.html -#usr/share/doc/libxml2/html/html/libxml-xlink.html -#usr/share/doc/libxml2/html/html/libxml-xmlIO.html -#usr/share/doc/libxml2/html/html/libxml-xmlautomata.html -#usr/share/doc/libxml2/html/html/libxml-xmlerror.html -#usr/share/doc/libxml2/html/html/libxml-xmlexports.html -#usr/share/doc/libxml2/html/html/libxml-xmlmemory.html -#usr/share/doc/libxml2/html/html/libxml-xmlmodule.html -#usr/share/doc/libxml2/html/html/libxml-xmlreader.html -#usr/share/doc/libxml2/html/html/libxml-xmlregexp.html -#usr/share/doc/libxml2/html/html/libxml-xmlsave.html -#usr/share/doc/libxml2/html/html/libxml-xmlschemas.html -#usr/share/doc/libxml2/html/html/libxml-xmlschemastypes.html -#usr/share/doc/libxml2/html/html/libxml-xmlstring.html -#usr/share/doc/libxml2/html/html/libxml-xmlunicode.html -#usr/share/doc/libxml2/html/html/libxml-xmlversion.html -#usr/share/doc/libxml2/html/html/libxml-xmlwriter.html -#usr/share/doc/libxml2/html/html/libxml-xpath.html -#usr/share/doc/libxml2/html/html/libxml-xpathInternals.html -#usr/share/doc/libxml2/html/html/libxml-xpointer.html -#usr/share/doc/libxml2/html/html/right.png -#usr/share/doc/libxml2/html/html/up.png -#usr/share/doc/libxml2/html/libxml.gif -#usr/share/doc/libxml2/html/redhat.gif -#usr/share/doc/libxml2/html/smallfootonly.gif -#usr/share/doc/libxml2/html/structure.gif -#usr/share/doc/libxml2/html/tutorial -#usr/share/doc/libxml2/html/tutorial/apa.html -#usr/share/doc/libxml2/html/tutorial/apb.html -#usr/share/doc/libxml2/html/tutorial/apc.html -#usr/share/doc/libxml2/html/tutorial/apd.html -#usr/share/doc/libxml2/html/tutorial/ape.html -#usr/share/doc/libxml2/html/tutorial/apf.html -#usr/share/doc/libxml2/html/tutorial/apg.html -#usr/share/doc/libxml2/html/tutorial/aph.html -#usr/share/doc/libxml2/html/tutorial/api.html -#usr/share/doc/libxml2/html/tutorial/ar01s02.html -#usr/share/doc/libxml2/html/tutorial/ar01s03.html -#usr/share/doc/libxml2/html/tutorial/ar01s04.html -#usr/share/doc/libxml2/html/tutorial/ar01s05.html -#usr/share/doc/libxml2/html/tutorial/ar01s06.html -#usr/share/doc/libxml2/html/tutorial/ar01s07.html -#usr/share/doc/libxml2/html/tutorial/ar01s08.html -#usr/share/doc/libxml2/html/tutorial/ar01s09.html -#usr/share/doc/libxml2/html/tutorial/images -#usr/share/doc/libxml2/html/tutorial/images/blank.png -#usr/share/doc/libxml2/html/tutorial/images/callouts -#usr/share/doc/libxml2/html/tutorial/images/callouts/1.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/10.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/2.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/3.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/4.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/5.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/6.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/7.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/8.png -#usr/share/doc/libxml2/html/tutorial/images/callouts/9.png -#usr/share/doc/libxml2/html/tutorial/images/caution.png -#usr/share/doc/libxml2/html/tutorial/images/draft.png -#usr/share/doc/libxml2/html/tutorial/images/home.png -#usr/share/doc/libxml2/html/tutorial/images/important.png -#usr/share/doc/libxml2/html/tutorial/images/next.png -#usr/share/doc/libxml2/html/tutorial/images/note.png -#usr/share/doc/libxml2/html/tutorial/images/prev.png -#usr/share/doc/libxml2/html/tutorial/images/tip.png -#usr/share/doc/libxml2/html/tutorial/images/toc-blank.png -#usr/share/doc/libxml2/html/tutorial/images/toc-minus.png -#usr/share/doc/libxml2/html/tutorial/images/toc-plus.png -#usr/share/doc/libxml2/html/tutorial/images/up.png -#usr/share/doc/libxml2/html/tutorial/images/warning.png -#usr/share/doc/libxml2/html/tutorial/includeaddattribute.c -#usr/share/doc/libxml2/html/tutorial/includeaddkeyword.c -#usr/share/doc/libxml2/html/tutorial/includeconvert.c -#usr/share/doc/libxml2/html/tutorial/includegetattribute.c -#usr/share/doc/libxml2/html/tutorial/includekeyword.c -#usr/share/doc/libxml2/html/tutorial/includexpath.c -#usr/share/doc/libxml2/html/tutorial/index.html -#usr/share/doc/libxml2/html/tutorial/ix01.html -#usr/share/doc/libxml2/html/w3c.png -#usr/share/doc/libxml2/html/xml.html +#usr/share/doc/libxml2/examples/xpath1.c +#usr/share/doc/libxml2/examples/xpath2.c +#usr/share/doc/libxml2/tutorial +#usr/share/doc/libxml2/tutorial/apa.html +#usr/share/doc/libxml2/tutorial/apb.html +#usr/share/doc/libxml2/tutorial/apc.html +#usr/share/doc/libxml2/tutorial/apd.html +#usr/share/doc/libxml2/tutorial/ape.html +#usr/share/doc/libxml2/tutorial/apf.html +#usr/share/doc/libxml2/tutorial/apg.html +#usr/share/doc/libxml2/tutorial/aph.html +#usr/share/doc/libxml2/tutorial/api.html +#usr/share/doc/libxml2/tutorial/ar01s02.html +#usr/share/doc/libxml2/tutorial/ar01s03.html +#usr/share/doc/libxml2/tutorial/ar01s04.html +#usr/share/doc/libxml2/tutorial/ar01s05.html +#usr/share/doc/libxml2/tutorial/ar01s06.html +#usr/share/doc/libxml2/tutorial/ar01s07.html +#usr/share/doc/libxml2/tutorial/ar01s08.html +#usr/share/doc/libxml2/tutorial/ar01s09.html +#usr/share/doc/libxml2/tutorial/images +#usr/share/doc/libxml2/tutorial/images/blank.png +#usr/share/doc/libxml2/tutorial/images/callouts +#usr/share/doc/libxml2/tutorial/images/callouts/1.png +#usr/share/doc/libxml2/tutorial/images/callouts/10.png +#usr/share/doc/libxml2/tutorial/images/callouts/2.png +#usr/share/doc/libxml2/tutorial/images/callouts/3.png +#usr/share/doc/libxml2/tutorial/images/callouts/4.png +#usr/share/doc/libxml2/tutorial/images/callouts/5.png +#usr/share/doc/libxml2/tutorial/images/callouts/6.png +#usr/share/doc/libxml2/tutorial/images/callouts/7.png +#usr/share/doc/libxml2/tutorial/images/callouts/8.png +#usr/share/doc/libxml2/tutorial/images/callouts/9.png +#usr/share/doc/libxml2/tutorial/images/caution.png +#usr/share/doc/libxml2/tutorial/images/draft.png +#usr/share/doc/libxml2/tutorial/images/home.png +#usr/share/doc/libxml2/tutorial/images/important.png +#usr/share/doc/libxml2/tutorial/images/next.png +#usr/share/doc/libxml2/tutorial/images/note.png +#usr/share/doc/libxml2/tutorial/images/prev.png +#usr/share/doc/libxml2/tutorial/images/tip.png +#usr/share/doc/libxml2/tutorial/images/toc-blank.png +#usr/share/doc/libxml2/tutorial/images/toc-minus.png +#usr/share/doc/libxml2/tutorial/images/toc-plus.png +#usr/share/doc/libxml2/tutorial/images/up.png +#usr/share/doc/libxml2/tutorial/images/warning.png +#usr/share/doc/libxml2/tutorial/includeaddattribute.c +#usr/share/doc/libxml2/tutorial/includeaddkeyword.c +#usr/share/doc/libxml2/tutorial/includeconvert.c +#usr/share/doc/libxml2/tutorial/includegetattribute.c +#usr/share/doc/libxml2/tutorial/includekeyword.c +#usr/share/doc/libxml2/tutorial/includexpath.c +#usr/share/doc/libxml2/tutorial/index.html +#usr/share/doc/libxml2/tutorial/ix01.html +#usr/share/doc/libxml2/xmlcatalog.html +#usr/share/doc/libxml2/xmllint.html #usr/share/gtk-doc/html/libxml2 #usr/share/gtk-doc/html/libxml2/general.html #usr/share/gtk-doc/html/libxml2/home.png #usr/share/gtk-doc/html/libxml2/index.html #usr/share/gtk-doc/html/libxml2/left.png -#usr/share/gtk-doc/html/libxml2/libxml2-DOCBparser.html #usr/share/gtk-doc/html/libxml2/libxml2-HTMLparser.html #usr/share/gtk-doc/html/libxml2/libxml2-HTMLtree.html #usr/share/gtk-doc/html/libxml2/libxml2-SAX.html @@ -278,4 +188,3 @@ usr/lib/libxml2.so.2.9.14 #usr/share/man/man1/xml2-config.1 #usr/share/man/man1/xmlcatalog.1 #usr/share/man/man1/xmllint.1 -#usr/share/man/man3/libxml.3 diff --git a/lfs/libxml2 b/lfs/libxml2 index a4702c4d6..ddcfdbff7 100644 --- a/lfs/libxml2 +++ b/lfs/libxml2 @@ -24,7 +24,7 @@ include Config -VER = 2.9.14 +VER = 2.10.3 THISAPP = libxml2-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ab584503d5209e4aaf41ae6f44aed5e94c0ae29e28cfba39a9012568aa97515af861b47891b84d2a352a07357626ba50ddb1e344e911fa14ff2ce93c5beff1f1 +$(DL_FILE)_BLAKE2 = aef2cc87e4632ddc478ff719155fdcb17601a8af37ecc1145ca05e01340935b57f07722e016ca2b27e4b269d47bd2fe97db09119a47849e8745e077e42b8bb66 install : $(TARGET) -- 2.38.1

2 1

[PATCH] zlib: Update to version 1.2.13
by Adolf Belka 08 Nov '22

08 Nov '22

- Update from version 1.2.12 to 1.2.13 - Update of rootfile - Patches for CVE-2022-37434 removed as they are now integarted in the source tarball - Changelog Changes in 1.2.13 (13 Oct 2022) - Fix configure issue that discarded provided CC definition - Correct incorrect inputs provided to the CRC functions - Repair prototypes and exporting of new CRC functions - Fix inflateBack to detect invalid input with distances too far - Have infback() deliver all of the available output up to any error - Fix a bug when getting a gzip header extra field with inflate(CVE-2022-37434) - Fix bug in block type selection when Z_FIXED used - Tighten deflateBound bounds - Remove deleted assembler code references - Various portability and appearance improvements Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/zlib | 2 +- lfs/zlib | 10 +++----- src/patches/zlib-CVE-2022-37434-fix.patch | 26 -------------------- src/patches/zlib-CVE-2022-37434.patch | 29 ----------------------- 4 files changed, 4 insertions(+), 63 deletions(-) delete mode 100644 src/patches/zlib-CVE-2022-37434-fix.patch delete mode 100644 src/patches/zlib-CVE-2022-37434.patch diff --git a/config/rootfiles/common/zlib b/config/rootfiles/common/zlib index 0e01dc00e..c1f23ab8a 100644 --- a/config/rootfiles/common/zlib +++ b/config/rootfiles/common/zlib @@ -1,6 +1,6 @@ lib/libz.so lib/libz.so.1 -lib/libz.so.1.2.12 +lib/libz.so.1.2.13 #usr/include/zconf.h #usr/include/zlib.h #usr/lib/libz.a diff --git a/lfs/zlib b/lfs/zlib index f24489677..858abd0cd 100644 --- a/lfs/zlib +++ b/lfs/zlib @@ -24,10 +24,10 @@ include Config -VER = 1.2.12 +VER = 1.2.13 THISAPP = zlib-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.xz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 76e7b26f8dc761b0eae6276cc32bc36fa74a88197699c95d158c1548f97b80db5e39d21144ecd6ee3eb90c42730aa5f387f9952d9a3f0930b56e9dfcd12f1e67 +$(DL_FILE)_BLAKE2 = cefcd25989ce27e7d339af2a88455fcf64f6f5e647bedb0f05a45e4370a885fe45a60c023aa63e79b8ecf20ed3254d0052245f33f5769aca2838b42242be14a8 install : $(TARGET) @@ -78,10 +78,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - # Apply fix for CVE-2022-37434 (and a fix for the fix) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/zlib-CVE-2022-37434.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/zlib-CVE-2022-37434-fix.patch - cd $(DIR_APP) && CROSS_PREFIX=$(CROSS_PREFIX) ./configure --prefix=$(PREFIX) --shared cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/zlib-CVE-2022-37434-fix.patch b/src/patches/zlib-CVE-2022-37434-fix.patch deleted file mode 100644 index ba8e39535..000000000 --- a/src/patches/zlib-CVE-2022-37434-fix.patch +++ /dev/null @@ -1,26 +0,0 @@ -commit 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d -Author: Mark Adler <fork(a)madler.net> -Date: Mon Aug 8 10:50:09 2022 -0700 - - Fix extra field processing bug that dereferences NULL state->head. - - The recent commit to fix a gzip header extra field processing bug - introduced the new bug fixed here. - -diff --git a/inflate.c b/inflate.c -index 7a72897..2a3c4fe 100644 ---- a/inflate.c -+++ b/inflate.c -@@ -763,10 +763,10 @@ int flush; - copy = state->length; - if (copy > have) copy = have; - if (copy) { -- len = state->head->extra_len - state->length; - if (state->head != Z_NULL && - state->head->extra != Z_NULL && -- len < state->head->extra_max) { -+ (len = state->head->extra_len - state->length) < -+ state->head->extra_max) { - zmemcpy(state->head->extra + len, next, - len + copy > state->head->extra_max ? - state->head->extra_max - len : copy); diff --git a/src/patches/zlib-CVE-2022-37434.patch b/src/patches/zlib-CVE-2022-37434.patch deleted file mode 100644 index 95e9f173f..000000000 --- a/src/patches/zlib-CVE-2022-37434.patch +++ /dev/null @@ -1,29 +0,0 @@ -commit eff308af425b67093bab25f80f1ae950166bece1 -Author: Mark Adler <fork(a)madler.net> -Date: Sat Jul 30 15:51:11 2022 -0700 - - Fix a bug when getting a gzip header extra field with inflate(). - - If the extra field was larger than the space the user provided with - inflateGetHeader(), and if multiple calls of inflate() delivered - the extra header data, then there could be a buffer overflow of the - provided space. This commit assures that provided space is not - exceeded. - -diff --git a/inflate.c b/inflate.c -index 7be8c63..7a72897 100644 ---- a/inflate.c -+++ b/inflate.c -@@ -763,9 +763,10 @@ int flush; - copy = state->length; - if (copy > have) copy = have; - if (copy) { -+ len = state->head->extra_len - state->length; - if (state->head != Z_NULL && -- state->head->extra != Z_NULL) { -- len = state->head->extra_len - state->length; -+ state->head->extra != Z_NULL && -+ len < state->head->extra_max) { - zmemcpy(state->head->extra + len, next, - len + copy > state->head->extra_max ? - state->head->extra_max - len : copy); -- 2.38.1

2 1

[PATCH] clamav 0.105.1: New package to resolve several CVEs
by Matthias Fischer 07 Nov '22

07 Nov '22

For details see: https://blog.clamav.net/2022/10/new-packages-for-clamav-01037-01044.html Fixes: "CVE-2022-37434 - A critical severity vulnerability in the zlib library. CVE-2022-40303 - A high severity vulnerability in the libxml2 library. Note: As of writing, the details of this CVE are not published. However, you can find additional details on other sites. CVE-2022-40304 - A high severity vulnerability in the libxml2 library. Note: As of writing, the details of this CVE are not published. However, you can find additional details on other sites." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/clamav | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lfs/clamav b/lfs/clamav index 987c0453a..1cd15ea27 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -27,14 +27,15 @@ include Config SUMMARY = Antivirus Toolkit VER = 0.105.1 +SUBVER = -2 THISAPP = clamav-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP)$(SUBVER).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 62 +PAK_VER = 63 DEPS = @@ -50,7 +51,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = be46d9afd76fb536d7de7363a45d38fef6a5983011e3cd0dcc25c2a209c8d37a2bbe1f7f4a5694152cabf622ef83e072b892ae12ba404da1955bb5b654e5216d +$(DL_FILE)_BLAKE2 = 09e67f4ae4f9689e634aa18cd672b16d8a4cb8b3923527c7c92ffa264b415dc49b5ee82ceaa518cf701a910b49a344753c7d0de894a772b0b871e492c95d60f4 install : $(TARGET) -- 2.34.1

1 0

New package for 'clamav 0.105.1(-2) necessary?
by Matthias Fischer 07 Nov '22

07 Nov '22

Hi, short question, based on https://blog.clamav.net/2022/10/new-packages-for-clamav-01037-01044.html Excerpt: "...there are several critical bugs in the JPEG and TIFF image processing libraries in the original 0.105.1 source package. The known issues were resolved in image-tiff version 0.7.4 and jpeg-decoder version 0.3.0. The clamav-0.105.1-2.tar.gz source package includes the updated libraries. Linux/Unix package maintainers are encouraged to publish new revisions of their own packages for ClamAV 0.105.1 to get these fixes. Anyone who built ClamAV from the original clamav-0.105.1.tar.gz source package is encouraged to reinstall from the newer source package." Do we want an updated package? Best, Matthias

3 2

[RFC PATCH] Drop powertop
by Peter Müller 07 Nov '22

07 Nov '22

This has been discussed briefly in the telephone conference of September: powertop is considered to be unnecessary, as IPFire is optimized for performance, thus interfering with possible power consumption reducing switches. Also, the need for powertop has been diminished, given that x86 platforms are highly likely not to run on batteries, and we are phasing out 32-bit ARM, where this could have been the case. Therefore, this patch proposes to drop powertop. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/packages/powertop | 23 -------- lfs/powertop | 90 ------------------------------ make.sh | 1 - 3 files changed, 114 deletions(-) delete mode 100644 config/rootfiles/packages/powertop delete mode 100644 lfs/powertop diff --git a/config/rootfiles/packages/powertop b/config/rootfiles/packages/powertop deleted file mode 100644 index 3ec61dd8e..000000000 --- a/config/rootfiles/packages/powertop +++ /dev/null @@ -1,23 +0,0 @@ -usr/sbin/powertop -#usr/share/bash-completion/completions/powertop -#usr/share/locale/ca/LC_MESSAGES/powertop.mo -#usr/share/locale/cs_CZ/LC_MESSAGES/powertop.mo -#usr/share/locale/de_DE -#usr/share/locale/de_DE/LC_MESSAGES -#usr/share/locale/de_DE/LC_MESSAGES/powertop.mo -#usr/share/locale/en_GB/LC_MESSAGES/powertop.mo -#usr/share/locale/en_US/LC_MESSAGES/powertop.mo -#usr/share/locale/es_ES -#usr/share/locale/es_ES/LC_MESSAGES -#usr/share/locale/es_ES/LC_MESSAGES/powertop.mo -#usr/share/locale/hu_HU -#usr/share/locale/hu_HU/LC_MESSAGES -#usr/share/locale/hu_HU/LC_MESSAGES/powertop.mo -#usr/share/locale/id_ID -#usr/share/locale/id_ID/LC_MESSAGES -#usr/share/locale/id_ID/LC_MESSAGES/powertop.mo -#usr/share/locale/nl_NL -#usr/share/locale/nl_NL/LC_MESSAGES -#usr/share/locale/nl_NL/LC_MESSAGES/powertop.mo -#usr/share/locale/zh_TW/LC_MESSAGES/powertop.mo -#usr/share/man/man8/powertop.8 diff --git a/lfs/powertop b/lfs/powertop deleted file mode 100644 index c909a73bf..000000000 --- a/lfs/powertop +++ /dev/null @@ -1,90 +0,0 @@ -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -############################################################################### -# Definitions -############################################################################### - -include Config - -SUMMARY = A Linux Tool to Find out What is Using Power on a Laptop - -VER = 2.14 - -THISAPP = powertop-$(VER) -DL_FILE = $(THISAPP).tar.gz -DL_FROM = $(URL_IPFIRE) -DIR_APP = $(DIR_SRC)/$(THISAPP) -TARGET = $(DIR_INFO)/$(THISAPP) -PROG = powertop -PAK_VER = 4 - -DEPS = - -SERVICES = - -############################################################################### -# Top-level Rules -############################################################################### - -objects = $(DL_FILE) - -$(DL_FILE) = $(DL_FROM)/$(DL_FILE) - -$(DL_FILE)_BLAKE2 = 5f53f81b01e83004f6436f497818d2a552b5e7ffda5007749aad415773adeab2a256aeffbacbf9e5fe803ff343a0c1954b5264aebdffa841bb70406b8b9611bc - -install : $(TARGET) - -check : $(patsubst %,$(DIR_CHK)/%,$(objects)) - -download :$(patsubst %,$(DIR_DL)/%,$(objects)) - -b2 : $(subst %,%_BLAKE2,$(objects)) - -dist: - $(PAK) - -############################################################################### -# Downloading, checking, b2sum -############################################################################### - -$(patsubst %,$(DIR_CHK)/%,$(objects)) : - @$(CHECK) - -$(patsubst %,$(DIR_DL)/%,$(objects)) : - @$(LOAD) - -$(subst %,%_BLAKE2,$(objects)) : - @$(B2SUM) - -############################################################################### -# Installation Details -############################################################################### - -$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) - @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - $(UPDATE_AUTOMAKE) - cd $(DIR_APP) && ./autogen.sh - cd $(DIR_APP) && ./configure --prefix=/usr - cd $(DIR_APP) && make $(MAKETUNING) - cd $(DIR_APP) && make install - @rm -rf $(DIR_APP) - @$(POSTBUILD) diff --git a/make.sh b/make.sh index 58220d046..ce88d9c19 100755 --- a/make.sh +++ b/make.sh @@ -1592,7 +1592,6 @@ buildipfire() { lfsmake2 zerofree lfsmake2 minicom lfsmake2 ddrescue - lfsmake2 powertop lfsmake2 parted lfsmake2 swig lfsmake2 dtc -- 2.35.3

2 1

[PATCH] IPsec/OpenVPN: Use 4,096-bit RSA for host certificates as well
by Peter Müller 03 Nov '22

03 Nov '22

We already moved away from 2048-MODP in Core Update 170. Similarly, German Federal Office for Information Security (BSI) recommends shifting away from RSA keys below 3,000 bits by the end of 2022 at the latest. The only place left in IPFire 2.x where we generate such keys is for IPsec and OpenVPN host certificates. This patch increases their key sizes to 4,096 bits as well - CA certificates already have this length. Existing VPN connections cannot be migrated automatically. However, only the respective host certificate has to be regenerated - thanks to the CA certificates' key length being sufficient, there is no need to replace the entire VPN CA. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 10 ++++------ html/cgi-bin/vpnmain.cgi | 4 ++-- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 90d3710e4..f85d610d8 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -18,9 +18,7 @@ # along with this program. If not, see <http://www.gnu.org/licenses/>. # # # ############################################################################### -### -# Based on IPFireCore 77 -### + use CGI; use CGI qw/:standard/; use Imager::QRCode; @@ -1970,7 +1968,7 @@ END } } else { # child unless (exec ('/usr/bin/openssl', 'req', '-nodes', - '-newkey', 'rsa:2048', + '-newkey', 'rsa:4096', '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem", '-out', "${General::swroot}/ovpn/certs/serverreq.pem", '-extensions', 'server', @@ -4363,7 +4361,7 @@ if ($cgiparams{'TYPE'} eq 'net') { } } else { # child unless (exec ('/usr/bin/openssl', 'req', '-nodes', - '-newkey', 'rsa:2048', + '-newkey', 'rsa:4096', '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem", '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem", '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) { diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index fc250b1f5..6c1fd4cf0 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -1093,7 +1093,7 @@ END &General::log("ipsec", "Creating host cert..."); if (open(STDIN, "-|")) { my $opt = " req -sha256 -nodes"; - $opt .= " -newkey rsa:2048"; + $opt .= " -newkey rsa:4096"; $opt .= " -keyout ${General::swroot}/certs/hostkey.pem"; $opt .= " -out ${General::swroot}/certs/hostreq.pem"; $errormessage = &callssl ($opt); @@ -2139,7 +2139,7 @@ END if (open(STDIN, "-|")) { my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache"; - $opt .= " -newkey rsa:2048"; + $opt .= " -newkey rsa:4096"; $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem"; $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem"; -- 2.35.3

2 1

[PATCH] misc-progs: wirelessctrl: Fix missing whitespace for log prefix
by Michael Tremer 03 Nov '22

03 Nov '22

Fixes: #12978 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/misc-progs/wirelessctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/misc-progs/wirelessctrl.c b/src/misc-progs/wirelessctrl.c index 7cffc89df..d31901be1 100644 --- a/src/misc-progs/wirelessctrl.c +++ b/src/misc-progs/wirelessctrl.c @@ -168,13 +168,13 @@ int main(void) { /* with this rule you can disable the logging of the dropped wireless input packets*/ if (findkey(kv, "DROPWIRELESSINPUT", buffer) && strcmp(buffer, "on") == 0) { - snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev); + snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput '", blue_dev); safe_system(command); } /* with this rule you can disable the logging of the dropped wireless forward packets*/ if (findkey(kv, "DROPWIRELESSFORWARD", buffer) && strcmp(buffer, "on") == 0) { - snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev); + snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward '", blue_dev); safe_system(command); } -- 2.30.2

2 1

[PATCH 0/4] kernel: aarch64: Add support for Traverse Ten64 board
by Mathew McBride 02 Nov '22

02 Nov '22

Hi all, This patchset adds support for our (Traverse) Ten64 board, which is an ARM64 networking board using NXP's LS1088A SoC. I have been intending to do this for a very long time but was waiting for the kernel version to be upgraded to 5.10 or above given the significant amount of work that has been done upstream for this hardware in recent times. There are four components to this patch: 1: Enable the relevant kernel options for our box This follows our doc at https://ten64doc.traverse.com.au/kernel/ 2: Add patches to fully support SFP+ One of these patches came in after 5.15+, while the other fixes a deadlock issue that occurs when detaching/unloading the SFP+ ports (such as rebooting the system). Unfortunately this issue has been stalled upstream without resolution for a while now. 3: Fix our real time clock (rtc-rx8025) not being modprobed I haven't been able to figure out why our RTC driver does not get loaded, given every other relevant module (like GPIO, I2C) does get loaded. If there is a better way to do this, feel free to NAK and suggest a better method. 4: Bypass the u-boot bootscript on Ten64 The Ten64 uses u-boot which has both EFI and classic 'distroboot' support. We much prefer to boot EFI as this provides some benefits, such as not having to supply your own device tree. A quirk of the Ten64 implementation (related to how the IOMMU hardware is configured) is that a "failed" bootscript will block the boot of other types (like EFI), so detect if we are on a Ten64 and jump straight to GRUB. My intention is to prioritize EFI always in a future Ten64 firmware release so this doesn't happen, at which point this hack can be removed. (Removing boot.scr does the same thing, but I prefer that it will boot out of the box without modification) Here is the fireinfo from a Ten64: https://fireinfo.ipfire.org/profile/97f7fd96a529ca2e5488ab095b7d9effe67d0ef3 (Note to self: I should figure out how to improve the fireinfo output on ARM platforms) I have also tested this on an AWS Graviton (ARM64) instance to verify there are no regressions on other "standard" (EFI-capable) ARM64 systems. Mathew McBride (4): linux: enable options for NXP Layerscape kernel: add patches for SFP support on NXP Layerscape/DPAA2 (arm64) config: u-boot: bypass the u-boot script on Traverse Ten64 initscripts: load RTC module (RX8025) for Ten64 board:w config/kernel/kernel.config.aarch64-ipfire | 76 +++++++++++++---- config/u-boot/boot.cmd | 9 +++ lfs/linux | 3 + src/initscripts/system/setclock | 8 ++ ...rm64-dpaa2-add-support-for-10g-modes.patch | 39 +++++++++ ...inux-5.15-arm64-dpaa2-fix-lock-issue.patch | 81 +++++++++++++++++++ 6 files changed, 202 insertions(+), 14 deletions(-) create mode 100644 src/patches/linux/linux-5-15-arm64-dpaa2-add-support-for-10g-modes.patch create mode 100644 src/patches/linux/linux-5.15-arm64-dpaa2-fix-lock-issue.patch -- 2.30.1

2 12

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2022