Development April 2022

development@lists.ipfire.org

18 participants
154 discussions

Feedback on CU167 Testing
by Adolf Belka 12 Apr '22

12 Apr '22

Hi all, In the update.sh script for CU167 the following line is in the remove files section (line 275) /usr/lib/perl5/site_perl/5.32.1/Net/IP.pm \ This should not be removed. It is present for anyone who has installed Guardian. Flagged up in forum https://community.ipfire.org/t/core-update-167-failed-to-start-starting-gua… Regards, Adolf

2 1

[PATCH] stunnel: Update to version 5.63
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from version 5.62 to 5.63 - Update of rootfile not required - Changelog Version 5.63, 2022.03.15 * Security bugfixes - OpenSSL DLLs updated to version 3.0.2. * New features - Updated stunnel.spec to support bash completion * Bugfixes - Fixed possible PRNG initialization crash (thx to Gleydson Soares). Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/stunnel | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/stunnel b/lfs/stunnel index 70755f7db..cddfa947b 100644 --- a/lfs/stunnel +++ b/lfs/stunnel @@ -24,7 +24,7 @@ include Config -VER = 5.62 +VER = 5.63 SUMMARY = Universal TLS Tunnel THISAPP = stunnel-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = stunnel -PAK_VER = 8 +PAK_VER = 9 DEPS = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ba551fa8455314bdf5088fccbbb4b7740f00be6d15362a0d219242c3b1a8197327549ccf85dddfa76b4a8f06f9ece6313f122e1c1be992797cda97381f5b40d1 +$(DL_FILE)_BLAKE2 = 4558f233bae0972853239b4ad8638cbf8402baf221c8b65f0b8857c624735430ed026fa4cfac8212e60737f1f522e38898da5056a66e3374509886b02068e1db install : $(TARGET) -- 2.35.1

1 0

[PATCH] stress: Update to version 1.0.5
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from version 1.0.4 to 1.0.5 - Update of rootfile not required - Changelog Version 1.0.5 * Added CI test for GitHub. * Migrated manpage system to txt2man. * Modernized system install. * Set right permissions to source code. * Updated README and added a CONTRIBUTING file. * Other minor changes and improvements. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/stress | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lfs/stress b/lfs/stress index 808575af5..52860f078 100644 --- a/lfs/stress +++ b/lfs/stress @@ -11,7 +11,7 @@ include Config SUMMARY = Tool to load and stress a computer -VER = 1.0.4 +VER = 1.0.5 THISAPP = stress-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -19,7 +19,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = stress -PAK_VER = 1 +PAK_VER = 2 DEPS = @@ -33,7 +33,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = dcda33bec9b2228e93b6e9e33fc6238554b04036bd7478df6580f54557d639ab4a28fb820766f386e7d3d6338452dae7ee4b649554df2313bea80dfbb23653cf +$(DL_FILE)_BLAKE2 = 7bc4a1d7739828ccd4b58c814e8ded42cddbd0b226bb29e916fe220835bcfa9dcdb86191bb321247aa98bd0e58791556713770bdeda5dad399aa61f2703a766c install : $(TARGET) @@ -66,6 +66,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./autogen.sh cd $(DIR_APP) && ./configure --prefix=/usr cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install -- 2.35.1

1 0

[PATCH] strace: Update to version 5.17
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from 5.14 to 5.17 - Update of rootfile not required - Changelog Noteworthy changes in release 5.17 (2022-03-26) * Improvements * Added 64-bit LoongArch architecture support. * Extended personality designation syntax of syscall specification expressions to support all@pers and %class@pers. * Enhanced rejection of invalid syscall numbers in syscall specification expressions. * Implemented decoding of set_mempolicy_home_node syscall, introduced in Linux 5.17. * Implemented decoding of IFLA_GRO_MAX_SIZE and TCA_ACT_IN_HW_COUNT netlink attributes. * Implemented decoding of PR_SET_VMA operation of prctl syscall. * Implemented decoding of siginfo_t.si_pkey field. * Implemented decoding of LIRC ioctl commands. * Updated lists of FAN_*, IORING_*, IOSQE_*, KEY_*, KVM_*, MODULE_INIT_*, TCA_ACT_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.17. Noteworthy changes in release 5.16 (2022-01-10) * Improvements * Implemented --secontext=mismatch option to find mismatches in SELinux contexts. * Implemented decoding of futex_waitv syscall introduced in Linux 5.16. * Implemented decoding of BPF_LINK_GET_NEXT_ID and BPF_LINK_GET_FD_BY_ID bpf syscall commands. * Enhanced decoding of BPF_MAP_CREATE, BPF_PROG_TEST_RUN, and BPF_PROG_LOAD bpf syscall commands. * Enhanced decoding of BTRFS_IOC_FS_INFO ioctl command. * Updated lists of AUDIT_*, BPF_*, BTRFS_*, DEVCONF_*, FAN_*, ETH_P_*, IPV4_DEVCONF_*, KVM_*, NDA_*, SO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.16. * Bug fixes * Fixed build for older Android. Noteworthy changes in release 5.15 (2021-12-01) * Improvements * Implemented --strings-in-hex=non-ascii-chars option for using hexadecimal numbers instead of octal ones in escape sequences in the output strings. * Implemented --decode-pids=comm option (and its alias -Y) for printing command names for PIDs. * Implemented --decode-pids=pidns as an alias to --pidns-translation option. * Implemented printing of current working directory when AT_FDCWD constant is used with --decode-fds=path option enabled. * Improved printing of syscall names in places where the associated AUDIT_ARCH_* value is present (ptrace PTRACE_GET_SYSCALL_INFO request, SIGSYS siginfo_t). * Implemented decoding of process_mrelease syscall, introduced in Linux 5.15. * Implemented decoding of SECCOMP_GET_NOTIF_SIZES operation of seccomp syscall. * Implemented decoding of HDIO_*, KD*, and SECCOMP_* ioctl commands. * Implemented decoding of RTM_NEWCACHEREPORT, RTM_{NEW,DEL,GET}NEXTHOP, and RTM_{NEW,GET}STATS NETLINK_ROUTE netlink messages. * Implemented decoding of AF_ALG, AF_IEEE802154, AF_MCTP, AF_NFC, AF_QIPCRTR, AF_RRPC, AF_VSOCK, and AF_XDP socket addresses. * Implemented decoding of AF_BRIDGE and AF_MCTP protocols for IFLA_AF_SPEC netlink attribute. * Implemented decoding of IFLA_BR_MCAST_QUERIER_STATE, IFLA_BR_MULTI_BOOLOPT, IFLA_INET6_RA_MTU, IFLA_INFO_SLAVE_DATA, and IFLA_VFINFO_LIST netlink attributes. * Enhanced decoding of io_uring_register and times syscalls. * Enhanced IFLA_BR_FORWARD_DELAY, IFLA_BR_MAX_AGE, IFLA_EXT_MASK, IFLA_PROTINFO, *_INTVL, and *_TIMER netlink attribute decoding. * Enhanced decoding of AF_IPX and AF_NETLINK socket addresses. * Updated lists o AF_*, ARPHRD_*, BTRFS_*, DEVCONF_*, DM_*, ETH_P_*, FAN_REPORT_*, IORING_*, MOVE_MOUNT_*, MPOL_*, PACKET_*, RTM_*, SO_*, and XFRM_MSG_* constants. * Updated lists of ioctl commands from Linux 5.15. * Bug fixes * Fixed printing of struct bpf_prog_info.map_ids array. * Fixed behaviour of "dev", "pidfd", and "socket" arguments of the --print-fds option to no longer imply the "path" argument. * Fixed insufficient buffer size used for network interface name printing, that previously led to assertions on attempts of printing interface names that require quoting, for example, names longer than 4 characters in -xx mode (addresses RHBZ bug #2028146). Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/strace | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/strace b/lfs/strace index 6202d78c1..4c6c12a14 100644 --- a/lfs/strace +++ b/lfs/strace @@ -26,7 +26,7 @@ include Config SUMMARY = A utility to trace the system calls of a program -VER = 5.14 +VER = 5.17 SUP_ARCHES = x86_64 armv6l aarch64 THISAPP = strace-$(VER) @@ -35,7 +35,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = strace -PAK_VER = 6 +PAK_VER = 7 DEPS = elfutils @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 479ecf5e66e26e722d108c905130f482c411857db234ac013bf3568905c0f7b896f001ba6da2cabccd0a987c7802aebec9c6298decb691de125e8154c28e1c6f +$(DL_FILE)_BLAKE2 = 27e7dc19302c58144b0a7d8de41f717760b8e3cde4ab56892045727597bbfc894bf8f137aee476548c2d16d1e9c8005f931f31a5d2f8bfc4ce5565c2aa01f1ec install : $(TARGET) -- 2.35.1

1 0

[PATCH] lcdproc: Update to version 0.5.9
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from version 0.5.7 (2016) to 0.5.9 (2017) - Update of rootfile - This patch brings lcdproc up to date with the most recent release. - Although there are no new releases there are continuing ongoing commits and issue fixes being done in the repository with the last commit being in Dec 2021. Not sure why no new releases are being done. It looks like any of the commits that fix issuse people have raised have to be patched by the interested people. - Changelog 0.5.9 This is mostly a code cleanup, bugfix and maintainance release. Drivers supporting new hardware or additional functionality HD44780 connection type "serial" supports Portwell EZIO-100 and EZIO-300 HD44780 connection type "gpio" supports dual controller displays. This connection type is now a full replacement for the obsolete "rpi" connection type. Removed configure flags enable-permissive-menu-goto is replaced by a setting in LCDd.conf enable-seamless-hbars is now selected by drivers that need it automatically Other important changes The build system now specifies the language as C99. API: drivers need to include "shared/report.h" instead of "report.h" libftdi1 is used if it is available instead of obsolete libftdi display update interval is selectable from LCDd.conf 0.5.8 New drivers futaba: for Futaba TOSD-5711BB VFDisplay commonly used on Elonex Artisan, Fujitsu Scaleo E and FIC Spectra Media Centre PCs linux_input: supporting event devices from the linux input subsystem Olimex_MOD_LCD1x9: for Olimex MOD-LCD1x9 yard2LCD: for yard2 New connection types for hd44780 driver lcm162 is a differently wired 8 bit connection type used on Nextgate NSA network appliances gpio is using the linux sysfs gpio interface to control a display in 4-bit mode. To build this sub-driver you need libugpio, which is a new dependency for lcdproc. Obsolete connection types for hd44780 driver The following connection types are obsolete and probably won't get bug and security fixes: raspberrypi: use the gpio connection type instead piplate: use the gpio connection type together with the gpio-mcp23s08 kernel module. pifacecad: use the gpio connection type together with the gpio-mcp23s08 kernel module. i2c: support for this sub-driver might continue for the users of non-linux operating systems. On linux systems it is recommended to use the gpio connection type together with the gpio-pcf857x kernel module. Drivers supporting new hardware or additional functionality icp_a106 now also supports A125 displays NoritakeVFD added some non-essential features Other important changes Development of lcdproc moved to github. Some internal data structures have changed. If you have custom LCDd drivers, you will need to recompile them against the new version. Of course submitting such drivers in pull requests is appreciated. For a detailed list of bug fixes, see the ChangeLog.md included in the distribution archive. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/lcdproc | 12 ++++++++---- lfs/lcdproc | 6 +++--- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/packages/lcdproc b/config/rootfiles/packages/lcdproc index d2a59e059..ba5894dc4 100644 --- a/config/rootfiles/packages/lcdproc +++ b/config/rootfiles/packages/lcdproc @@ -1,12 +1,12 @@ -etc/rc.d/init.d/lcdproc -etc/rc.d/rc0.d/K40lcdproc -etc/rc.d/rc3.d/S60lcdproc -etc/rc.d/rc6.d/K40lcdproc #etc/lcdproc etc/lcdproc/LCDd.conf etc/lcdproc/lcdexec.conf etc/lcdproc/lcdproc.conf etc/lcdproc/lcdvc.conf +etc/rc.d/init.d/lcdproc +etc/rc.d/rc0.d/K40lcdproc +etc/rc.d/rc3.d/S60lcdproc +etc/rc.d/rc6.d/K40lcdproc usr/bin/fortune.pl usr/bin/iosock.pl usr/bin/lcdexec @@ -25,10 +25,12 @@ usr/lib/lcdproc #usr/lib/lcdproc/MD8800.so #usr/lib/lcdproc/MtxOrb.so #usr/lib/lcdproc/NoritakeVFD.so +#usr/lib/lcdproc/Olimex_MOD_LCD1x9.so #usr/lib/lcdproc/SureElec.so #usr/lib/lcdproc/bayrad.so #usr/lib/lcdproc/curses.so #usr/lib/lcdproc/ea65.so +#usr/lib/lcdproc/futaba.so #usr/lib/lcdproc/glcd.so #usr/lib/lcdproc/glk.so #usr/lib/lcdproc/hd44780.so @@ -40,6 +42,7 @@ usr/lib/lcdproc #usr/lib/lcdproc/lb216.so #usr/lib/lcdproc/lcdm001.so #usr/lib/lcdproc/lcterm.so +#usr/lib/lcdproc/linux_input.so #usr/lib/lcdproc/ms6931.so #usr/lib/lcdproc/mtc_s16209x.so #usr/lib/lcdproc/picolcd.so @@ -57,6 +60,7 @@ usr/lib/lcdproc #usr/lib/lcdproc/text.so #usr/lib/lcdproc/tyan.so #usr/lib/lcdproc/vlsys_m428.so +#usr/lib/lcdproc/yard2LCD.so usr/sbin/LCDd #usr/share/man/man1/lcdexec.1 #usr/share/man/man1/lcdproc.1 diff --git a/lfs/lcdproc b/lfs/lcdproc index bc416386f..2b47e40f3 100644 --- a/lfs/lcdproc +++ b/lfs/lcdproc @@ -26,7 +26,7 @@ include Config SUMMARY = Daemon capable of showing info on LCD displays -VER = 0.5.7 +VER = 0.5.9 THISAPP = lcdproc-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = lcdproc -PAK_VER = 2 +PAK_VER = 3 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 499d46585633ee6968adc1b5eb916f9737610606b0a8497f72f09cfa75fbd41c880d81ea2be44c50b1d124adf2c70ed49a9ae9a1c70a89899ad932cef7f10b89 +$(DL_FILE)_BLAKE2 = 10b26fc803cf14bf301177336bd14497131440f129d16fa75cbb4782da839eb3a3835091d7c211cfc75d35f07823a1c301cf7ebfae25f2a344d0dfcaf894ca17 install : $(TARGET) -- 2.35.1

1 0

[PATCH] keepalived: Update to version 2.2.7
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from 2.2.4 to 2.2.7 - Update of rootfile - Changelog Release 2.2.7 brings lots of improvements and fix some minor issues reported. It add some new VRRP features as well. Stability has been even more extended. New ipvs: Add support to twos scheduler. vrrp: Add vrf option for unicast without specifying an interface. vrrp: Add option unicast_fault_no_peer. Previously if unicast_src_ip (or any other unicast option) was specified, but no unicast peers were configured, then the VRRP instance would operate in multicast mode. A user has identified that, due to automatic configuration generation, they could have a configuration that should operate in unicast mode, but that no unicast peers were configured. In this case, they did not want the VRRP instance to revert to multicast mode. In order to maintain backward compatibility, keepalived can’t simply change to not allowing no unicast peers. Instead, this commit adds the configuration option “unicast_fault_no_peer”, which if specified causes the VRRP instance to go to fault state if no unicast peers are configured. vrrp: Allow specification of multicast address to be used. vrrp: Add vrf option to static and vrrp routes. vrrp: Add option to resend vrrp states on fifos after reload. Since keepalived restarts FIFOs scripts it is managing when a reload occurs, it can be helpful to send the VRRP instance and group states after a reload. This commit adds option fifo_write_vrrp_states_on_reload to do that, and it means that what is written to the FIFOs with default configuration does not change. vrrp: Allow duplication of VRIDs on an interface with unicast peers. If two VRRP instances are using unicast peers and there is no overlap of unicast peers between the vrrp instances, then the vrrp instances can use the same VRIDs. global: Don’t assume running as user root. systemd: Add keepalived-non-root.service systemd service file. keepalived-non-root.service allows keepalived to be run as a non root user, but with specific added capabilities to allow all the functionality that keepalived needs. Improvements vrrp: Stop receiving any data on garp and ndisc sockets. This is a send-only channel. vrrp: Open gratuitous ARP socket as an ARP socket rather than RARP. Now that the receiving of packets on the garp socket has been stopped, we can open the socket with the correct type of binding, and we won’t have a queue of received messages build up. vrrp: Extend cBPF filtering code to support standard definition. vrrp: Optimise nftables configuration to limit some rules to macvlans. If we are moving messages that have been generated on a macvlan, we nftables rules can be optimised to restrict them to macvlan interfaces. vrrp: Drop ICMPV6 Router Solicitation messages from vmac interfaces. When we create a vmac interface, a short time afterwards the kernel sends a router solicition message with the source MAC address of the vmac interface. The problem is that this will upset snooping switches if the VRRP instance is in backup state. Furthermore, we can’t simply move the packet onto the underlying interface since the ICMPV6 payload also contains the MAC address of the vmac interface. We can’t just change the MAC address in the ICMPV6 message, since there is also a checksum which would need to be recalculated. The only solution at the moment is to drop the packet. This shouldn’t be a problem since the underlying interface should have sent a Router solicitation message when it came up. vrrp: Add option to specify MAC address for VMACs. vrrp: Don’t lose some configuration faults. The following errors were being detected in vrrp_complete_instance() and the VRRP instance was then supposed to be put into fault state since it couldn’t operate. However, the need to go to fault state was subsequently being lost. The configuration errors that were being lost were: (a) Configuring use of a VMAC on a non Ethernet interface (b) Attempting to use multicast on an interface that doesn’t support it (c) Using an ipvlan without a source IP address (d) ipvlan address family not matching VRRP isntance’s (e) VRID conflicts on an interface which could be deleted an recreated on a different interface (f) An interface specified for a VIP is the same as the VRRP instance’s VMAC or another VRRP instance’s VMAC. This improvement ensures that the VRRP instance will be put into, and remain in, fault state, since it cannot successfully operate. As can be seen from the list of circumstances above, they were very unlikely to occur, but were possible. vrrp: Bind IPv6 socket to multicast address. Previously IPv6 sockets were being bound to the ::1 address, since trying to bind to the multicast address was failing. The reason for failing has now been discovered to be that the scope_id needed to be set (i.e. the interface index), since the multicast addresses that we use are link-local multicast addresses. This improvement now sets the scope_id, so the socket can successfully be bound to the multicast address. vrrp: Set IPV6_MULTICAST_ALL on IPv6 sockets if available. vrrp: Some SNMP extension and improvements: - Correct FastOpenNoCookie and L3Mdev variable types - Don’t write multicast address to SNMP when using unicast. - Don’t write unconfigured LVS sync daemon address to SNMP. - Define and use SNMP_TruthValue. - Define and use SNMP_InetAddressType. - Correct reporting accept mode for VRRPv3 SNMP. vrrp: Misc DBus improvements (Opening, logging, data_dir, policy, …) vrrp: Handle VMAC’s interface changing on reload properly. vrrp: If accept traffic for VIPs changes on reload, update firewall. vrrp: Stop going to backup if reload IPv6 and change vmac_xmit_base. vrrp: Add add/prepend/append options to static and virtual routes. The kernel by default prepends routes, whereas the ip (iproute2) utility be default adds routes (adding a route does not allow duplicates whereas appending or prepending does). keepalived previously has not set the flags relating to this, and so has always prepended routes. This means that duplicate routes could be created. lib: Update Red Black tree code to Linux 5.15-rc4. script: Extend sample_notify_fifo.sh. doc: Misc documentation updates. docker: Upate docker file. init: Init handling extensions. Make parent process exit with meaningful status on error. Ensure systemd is not notified of successful start if failed. fix building without systemd notify suport. bfd: handle unexpected closure of pipe to checker and vrrp processes. If the parent process abnormally terminates and then the BFD process terminates due to PDEATHSIG before the vrrp or checker processes terminate, the vrrp and checker processes can get a read error on the pipes used to communicate with the BFD process. bfd: make BFD work when IPv6 disabled on system. Fixes lib: Fix calculating CLOCK_REALTIME and CLOCK_MONOTONIC offsets. lib: scheduler: Handle cancelling timer thread on ready queue. The timer thread on the ready queue, if cancelled, was corrupting the read list_head, since it assumed it was on a red black tree. snap: Fix building snaps. ipvs: Fix building with glibc prior to v2.19 (released 2014). bfd: Handle interface down/address missing when keepalived starts. This resolves a segfault, and also makes bfd retry once per minute to create send socket if it cannot do so due to no address to bind to on an interface. vrrp: Fix unicast with interface in a VRF domain. vrrp: Fix moving excess VIPs to eVIPs, by properly handling vip_cnt. vrrp: Fix configured IPv6 multicast addresses with VMACs. Using different multicast addresses with IPv6 on the same interface without using VMACs is only supported if the kernel supports IPV6_MULTICAST_ALL (from Linux v4.20). vrrp: Fix checking for unicast with VMAC/ipvlan and no peers. vrrp: Fix checking if have unicast ppers if unicast_ttl specified. vrrp: Don’t segfault if duplicate VMAC name, but ignore second name. vrrp: Don’t delete and recreate VMAC on reload if only VRID has changed. There seems to be an issue deleting and then immediately recreating a VMAC on the same interface. This commit therefore simply changes the MAC address if the only change is the VRID. vrrp: Fix nftables config if VMAC interface changed on reload. vrrp: Don’t segfault if don’t have permission for ARP/NDISC socket. vrrp: Fix IPv6 with vmac_xmit_base. vrrp: fix disabling vmac-xmit-base with VRRPv3 IPv6 use_vmac. vrrp: Fix specifying user/group for vrrp_scripts. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/keepalived | 5 +---- lfs/keepalived | 6 +++--- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/packages/keepalived b/config/rootfiles/packages/keepalived index 4865db0b0..b0fbe7363 100644 --- a/config/rootfiles/packages/keepalived +++ b/config/rootfiles/packages/keepalived @@ -1,8 +1,6 @@ #etc/keepalived -etc/keepalived/keepalived.conf +etc/keepalived/keepalived.conf.sample etc/keepalived/samples -#etc/keepalived/samples/client.pem -#etc/keepalived/samples/dh1024.pem #etc/keepalived/samples/keepalived.conf.HTTP_GET.port #etc/keepalived/samples/keepalived.conf.IPv6 #etc/keepalived/samples/keepalived.conf.PING_CHECK @@ -28,7 +26,6 @@ etc/keepalived/samples #etc/keepalived/samples/keepalived.conf.vrrp.scripts #etc/keepalived/samples/keepalived.conf.vrrp.static_ipaddress #etc/keepalived/samples/keepalived.conf.vrrp.sync -#etc/keepalived/samples/root.pem #etc/keepalived/samples/sample.misccheck.smbcheck.sh #etc/keepalived/samples/sample_notify_fifo.sh etc/rc.d/init.d/keepalived diff --git a/lfs/keepalived b/lfs/keepalived index 0b45f24d9..d6c913f7a 100644 --- a/lfs/keepalived +++ b/lfs/keepalived @@ -26,7 +26,7 @@ include Config SUMMARY = A keepalive facility for Linux -VER = 2.2.4 +VER = 2.2.7 THISAPP = keepalived-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = keepalived -PAK_VER = 10 +PAK_VER = 11 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 835198fb23312e87894e7740427411d974c00f71029b273d8da3e787ef92848127d896b456fb40db8d802b6c7555e6524872f136f868e19c62387a9471e44b0f +$(DL_FILE)_BLAKE2 = 62c4534eb1eebeac596b628a1fa5fb4069498d532fdeff0dc51afbc71e90125bff7fcffb897da3fd34765c64f43d7b04dcf184169b1bc2cf33413e109f9f5cdc install : $(TARGET) -- 2.35.1

1 0

[PATCH] ipvsadm: Update to version 1.31
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from 1.29 to 1.31 - Update of rootfile not required - Changelog Version 1.31 In ipvsadm(8) add using nft or an eBPF program to set a packet mark Add --pe sip option in ipvsadm(8) man page ipvsadm: allow tunneling with gre encapsulation Merge branch 'GUE-encap' ipvsadm: allow tunneling with gue encapsulation ipvsadm: convert options to unsigned long long Version 1.30 Merge: ipvsadm: Document/add support for fo/ovf/mh schedulers Add support for mh scheduler Document support of ovf scheduler Document support of fo scheduler libipvs: fix some buffer sizes libipvs: discrepancy with libnl genlmsg_put ipvsadm: catch the original errno from netlink answer Version 1.29 ipvsadm: new attributes for sync daemon ipvsadm: support 64-bit stats and rates Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/ipvsadm | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/ipvsadm b/lfs/ipvsadm index a1e9cb5a1..3108c2e2f 100644 --- a/lfs/ipvsadm +++ b/lfs/ipvsadm @@ -26,7 +26,7 @@ include Config SUMMARY = A Utility for Administering the Linux Virtual Server -VER = 1.29 +VER = 1.31 THISAPP = ipvsadm-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = ipvsadm -PAK_VER = 2 +PAK_VER = 3 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 29f8c353f5c7a6a461b17b0ef7fa4c7803fe52cae5f8f719b25370f502d8724e0847bb3b4e25312b95a49a4bfcd0b6562f61118506c477eafbd1a99fc7c3914c +$(DL_FILE)_BLAKE2 = a42ceea834fb16e25ea34417227f6b632fe3b94c8a7ce5d3daff4375884fd47f14999551eab3bf7226d5eb02f25aef4c77a8287592b642946683bc5ddc6783da install : $(TARGET) -- 2.35.1

1 0

[PATCH] ipset: Update to version 7.15
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from 7.11 to 7.15 - Update of rootfile - Changelog 7.15 Kernel part changes netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() 7.14 Userspace changes Add missing function to libipset.map and bump library version Kernel part changes 64bit division isn't allowed on 32bit, replace it with shift 7.13 Userspace changes When parsing protocols by number, do not check it in /etc/protocols. Add missing hunk to patch "Allow specifying protocols by number" Kernel part changes Limit the maximal range of consecutive elements to add/delete fix 7.12 Userspace changes Allow specifying protocols by number Fix example in ipset.8 manpage tests: add tests ipset to nftables add ipset to nftables translation infrastructur lib: Detach restore routine from parser lib: split parser from command execution Fix patch "Parse port before trying by service name" Kernel part changes Limit the maximal range of consecutive elements to add/delete Backport "netfilter: use nfnetlink_unicast()" Backport "netfilter: nfnetlink: consolidate callback type" Backport "netfilter: nfnetlink: add struct nfnl_info and pass it to callbacks" Backport "netfilter: add helper function to set up the nfnetlink header and use it" Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/ipset | 5 ++++- lfs/ipset | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/ipset b/config/rootfiles/common/ipset index 84703391f..5cea7ad22 100644 --- a/config/rootfiles/common/ipset +++ b/config/rootfiles/common/ipset @@ -18,11 +18,14 @@ etc/ipset #usr/include/libipset/transport.h #usr/include/libipset/types.h #usr/include/libipset/utils.h +#usr/include/libipset/xlate.h #usr/lib/libipset.la #usr/lib/libipset.so usr/lib/libipset.so.13 -usr/lib/libipset.so.13.2.0 +usr/lib/libipset.so.13.3.0 #usr/lib/pkgconfig/libipset.pc usr/sbin/ipset +#usr/sbin/ipset-translate #usr/share/man/man3/libipset.3 +#usr/share/man/man8/ipset-translate.8 #usr/share/man/man8/ipset.8 diff --git a/lfs/ipset b/lfs/ipset index 7b7612875..1dae6f936 100644 --- a/lfs/ipset +++ b/lfs/ipset @@ -24,7 +24,7 @@ include Config -VER = 7.11 +VER = 7.15 THISAPP = ipset-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 97f2e3372e963654ece511960e8c22d0dd9e29376d087a3767d89544dfbd85f9f9e75e0cc6c4eb9e1d813d1a472a410033a76feef3319b1d87fd51b0c3fd97cd +$(DL_FILE)_BLAKE2 = 10acff9741370ad80a2845605be1be4f691e987b271f4dcf1fab3abfe158c63c7d39e6b3453ba7cd361dee3df92f85419cfb70806a71b6806555f6571c70b1ed install : $(TARGET) -- 2.35.1

1 0

[PATCH] haproxy: Update to version 2.5.5
by Adolf Belka 12 Apr '22

12 Apr '22

- Update from 2.4.15 to 2.5.5 - Update of rootfile not required - Changelog 2.5.5 - CI: github actions: add the output of $CC -dM -E- - CI: github actions: use cache for OpenTracing - CI: refactor OpenTracing build script - CI: github actions: use cache for SSL libs - CI: Consistently use actions/checkout@v2 - BUILD: atomic: make the old HA_ATOMIC_LOAD() support const pointers - BUILD: tree-wide: mark a few numeric constants as explicitly long long - BUG/MEDIUM: mux-fcgi: Don't rely on SI src/dst addresses for FCGI health-checks - BUG/MEDIUM: htx: Fix a possible null derefs in htx_xfer_blks() - REGTESTS: fix the race conditions in normalize_uri.vtc - REGTESTS: fix the race conditions in secure_memcmp.vtc - BUG/MEDIUM: httpclient/lua: infinite appctx loop with POST - BUG/MINOR: pool: always align pool_heads to 64 bytes - BUG/MEDIUM: pools: fix ha_free() on area in the process of being freed - BUILD: fix kFreeBSD build. - MINOR: pools: add a new global option "no-memory-trimming" - MINOR: stats: Add dark mode support for socket rows - BUILD: pools: fix backport of no-memory-trimming on non-linux OS - BUILD: fix recent build breakage of freebsd caused by kFreeBSD build fix - BUG/MINOR: add missing modes in proxy_mode_str() - BUG/MINOR: cli: shows correct mode in "show sess" - BUG/MINOR: httpclient: Set conn-stream/channel EOI flags at the end of request - BUG/MINOR: hlua: Set conn-stream/channel EOI flags at the end of request - BUG/MINOR: stats: Set conn-stream/channel EOI flags at the end of request - BUG/MINOR: cache: Set conn-stream/channel EOI flags at the end of request - BUG/MINOR: promex: Set conn-stream/channel EOI flags at the end of request - BUG/MEDIUM: stream: Use the front analyzers for new listener-less streams - DEBUG: cache: Update underlying buffer when loading HTX message in cache applet - BUG/MEDIUM: mcli: Properly handle errors and timeouts during reponse processing - DEBUG: stream: Add the missing descriptions for stream trace events - DEBUG: stream: Fix stream trace message to print response buffer state - BUG/MAJOR: mux-pt: Always destroy the backend connection on detach - BUG/MINOR: session: fix theoretical risk of memleak in session_accept_fd() - BUG/MEDIUM: httpclient: don't consume data before it was analyzed - CLEANUP: htx: remove unused co_htx_remove_blk() - BUG/MINOR: httpclient: consume partly the blocks when necessary - BUG/MINOR: httpclient: remove the UNUSED block when parsing headers - BUG/MEDIUM: httpclient: must manipulate head, not first - REGTESTS: fix the race conditions in be2hex.vtc 2.5.4 - BUG/MEDIUM: htx: Be sure to have a buffer to perform a raw copy of a message - BUG/MEDIUM: mux-h1: Don't wake h1s if mux is blocked on lack of output buffer - BUG/MAJOR: mux-h2: Be sure to always report HTX parsing error to the app layer - DOC: Fix usage/examples of deprecated ACLs - BUG/MINOR: proxy: preset the error message pointer to NULL in parse_new_proxy() - REGTESTS: fix the race conditions in 40be_2srv_odd_health_checks - CI: github: enable pool debugging by default - BUG/MEDIUM: stream: Abort processing if response buffer allocation fails 2.5.3 - MINOR: sock: move the unused socket cleaning code into its own function - BUG/MEDIUM: mworker: close unused transferred FDs on load failure - BUG/MINOR: mworker: fix a FD leak of a sockpair upon a failed reload - BUG/MINOR: sink: Use the right field in appctx context in release callback - BUG/MEDIUM: resolvers: Really ignore trailing dot in domain names - BUG/MEDIUM: fd: always align fdtab[] to 64 bytes - BUG/MAJOR: compiler: relax alignment constraints on certain structures - MINOR: httpclient: Don't limit data transfer to 1024 bytes - BUG/MINOR: httpclient: reinit flags in httpclient_start() - BUG/MINOR: mailers: negotiate SMTP, not ESMTP - BUG/MINOR: ssl: Add missing return value check in ssl_ocsp_response_print - BUG/MINOR: ssl: Fix leak in "show ssl ocsp-response" CLI command - BUG/MINOR: ssl: Missing return value check in ssl_ocsp_response_print - CLEANUP: httpclient/cli: fix indentation alignment of the help message - BUG/MINOR: tools: url2sa reads ipv4 too far - BUG/MEDIUM: httpclient: limit transfers to the maximum available room - DEBUG: buffer: check in __b_put_blk() whether the buffer room is respected 2.5.2 - BUG/MEDIUM: connection: properly leave stopping list on error - BUG/MEDIUM: htx: Adjust length to add DATA block in an empty HTX buffer - BUG/MINOR: httpclient: don't send an empty body - BUG/MINOR: httpclient: set default Accept and User-Agent headers - BUG/MINOR: httpclient/lua: don't pop the lua stack when getting headers - BUILD/MINOR: fix solaris build with clang. - BUG/MEDIUM: server: avoid changing healthcheck ctx with set server ssl - DOC: management: mark "set server ssl" as deprecated - MEDIUM: cli: yield between each pipelined command - MINOR: channel: add new function co_getdelim() to support multiple delimiters - BUG/MINOR: cli: avoid O(bufsize) parsing cost on pipelined commands - MEDIUM: h2/hpack: emit a Dynamic Table Size Update after settings change - BUG/MEDIUM: cli: Never wait for more data on client shutdown - BUG/MEDIUM: mcli: do not try to parse empty buffers - BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them - BUG/MINOR: stream: make the call_rate only count the no-progress calls - DEBUG: cli: add a new "debug dev fd" expert command - BUILD: debug/cli: condition test of O_ASYNC to its existence - DEBUG: pools: add new build option DEBUG_POOL_INTEGRITY - REGTESTS: ssl: Fix ssl_errors regtest with OpenSSL 1.0.2 - BUG/MEDIUM: mworker: don't lose the stats socket on failed reload - BUG/MINOR: mworker: does not add the -sf in wait mode - BUG/MINOR: pools: always flush pools about to be destroyed - DEBUG: pools: add extra sanity checks when picking objects from a local cache - DEBUG: pools: let's add reverse mapping from cache heads to thread and pool - DEBUG: pools: replace the link pointer with the caller's address on pool_free() - BUG/MAJOR: sched: prevent rare concurrent wakeup of multi-threaded tasks - BUG/MINOR: mworker: does not erase the pidfile upon reload - DEBUG: fd: make sure we never try to insert/delete an impossible FD number - MINOR: listener: replace the listener's spinlock with an rwlock - BUG/MEDIUM: listener: read-lock the listener during accept() - BUG/MINOR: httpclient: Revisit HC request and response buffers allocation - BUG/MEDIUM: httpclient: Xfer the request when the stream is created - BUG/MINOR: ssl: Remove empty lines from "show ssl ocsp-response <id>" output - BUG/MINOR: jwt: Double free in deinit function - BUG/MINOR: jwt: Missing pkey free during cleanup - BUG/MINOR: jwt: Memory leak if same key is used in multiple jwt_verify calls - BUG/MINOR: httpclient/cli: display junk characters in vsn - BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies - BUG/MAJOR: spoe: properly detach all agents when releasing the applet - REGTESTS: server: close an occasional race on dynamic_server_ssl.vtc - REGTESTS: peers: leave a bit more time to peers to synchronize - BUG/MEDIUM: h2/hpack: fix emission of HPACK DTSU after settings change - BUG/MINOR: mux-h2: update the session's idle delay before creating the stream 2.5.1 - BUG/MINOR: cache: Fix loop on cache entries in "show cache" - BUG/MINOR: httpclient: allow to replace the host header - BUG/MINOR: lua: don't expose internal proxies - BUG/MINOR: lua: remove loop initial declarations - BUG/MEDIUM: cli: Properly set stream analyzers to process one command at a time - BUILD: evports: remove a leftover from the dead_fd cleanup - BUG/MINOR: vars: Fix the set-var and unset-var converters - BUG/MINOR: server: Don't rely on last default-server to init server SSL context - BUG/MEDIUM: resolvers: Detach query item on response error - BUG/MAJOR: segfault using multiple log forward sections. - BUG/MEDIUM: h1: Properly reset h1m flags when headers parsing is restarted - BUG/MEDIUM: mworker: FD leak of the eventpoll in wait mode - BUG/MINOR: mworker: deinit of thread poller was called when not initialized - MINOR: mux-h1: Improve H1 traces by adding info about http parsers - BUILD: bug: Fix error when compiling with -DDEBUG_STRICT_NOCRASH - BUG/MEDIUM: sample: Fix memory leak in sample_conv_jwt_member_query - MINOR: cli: "show version" displays the current process version - BUILD: tree-wide: avoid warnings caused by redundant checks of obj_types - IMPORT: slz: use the correct CRC32 instruction when running in 32-bit mode - MINOR: http-rules: Add capture action to http-after-response ruleset - BUG/MINOR: cli/server: Don't crash when a server is added with a custom id - DOC: spoe: Clarify use of the event directive in spoe-message section - DOC: config: Specify %Ta is only available in HTTP mode - DOC: config: retry-on list is space-delimited - DOC: config: fix error-log-format example - BUG/MEDIUM: mworker/cli: crash when trying to access an old PID in prompt mode - MINOR: ssl: Remove empty lines from "show ssl ocsp-response" output - MINOR: pools: work around possibly slow malloc_trim() during gc - BUG/MEDIUM: backend: fix possible sockaddr leak on redispatch - BUG/MEDIUM: peers: properly skip conn_cur from incoming messages - BUG/MEDIUM: mux-h1: Fix splicing by properly detecting end of message - BUG/MINOR: mux-h1: Fix splicing for messages with unknown length - BUILD: ssl: unbreak the build with newer libressl - DOC: fix misspelled keyword "resolve_retries" in resolvers - DEBUG: ssl: make sure we never change a servername on established connections - BUILD: opentracing: display warning in case of using OT_USE_VARS at compile time - BUG/MEDIUM: ssl: initialize correctly ssl w/ default-server - REGTESTS: ssl: fix ssl_default_server.vtc - MINOR: compat: detect support for dl_iterate_phdr() - MINOR: debug: add ability to dump loaded shared libraries - MINOR: debug: add support for -dL to dump library names at boot - MINOR: proxy: add option idle-close-on-response - MINOR: cpuset: switch to sched_setaffinity for FreeBSD 14 and above. - BUILD: makefile: add -Wno-atomic-alignment to work around clang abusive warning - CI: Github Actions: do not show VTest failures if build failed - BUG/MINOR: ssl: free the fields in srv->ssl_ctx - BUG/MEDIUM: ssl: free the ckch instance linked to a server - REGTESTS: ssl: update of a crt with server deletion - BUILD/MINOR: cpuset FreeBSD 14 build fix. - CI: github actions: update OpenSSL to 3.0.1 - BUILD/MINOR: tools: solaris build fix on dladdr. - BUG/MINOR: cli: fix _getsocks with musl libc - BUG/MEDIUM: http-ana: Preserve response's FLT_END analyser on L7 retry - BUG/MEDIUM: mworker: don't use _getsocks in wait mode - BUG/MINOR: ssl: Store client SNI in SSL context in case of ClientHello error - BUG/MAJOR: mux-h1: Don't decrement .curr_len for unsent data - BUILD: cpuset: fix build issue on macos introduced by previous change - CI: github actions: clean default step conditions 2.5.0 - BUILD: SSL: add quictls build to scripts/build-ssl.sh - BUILD: SSL: add QUICTLS to build matrix - CLEANUP: sock: Wrap `accept4_broken = 1` into additional parenthesis - BUILD: cli: clear a maybe-unused warning on some older compilers - BUG/MEDIUM: cli: make sure we can report a warning from a bind keyword - BUG/MINOR: ssl: make SSL counters atomic - CLEANUP: assorted typo fixes in the code and comments - BUG/MINOR: ssl: free correctly the sni in the backend SSL cache - MINOR: version: mention that it's stable now Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/haproxy | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/haproxy b/lfs/haproxy index 96911574d..7fa3b024e 100644 --- a/lfs/haproxy +++ b/lfs/haproxy @@ -26,7 +26,7 @@ include Config SUMMARY = The Reliable, High Performance TCP/HTTP Load Balancer -VER = 2.4.15 +VER = 2.5.5 # From: https://www.haproxy.org/download/2.4/src/haproxy-2.4.15.tar.gz @@ -36,7 +36,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = haproxy -PAK_VER = 20 +PAK_VER = 21 DEPS = @@ -54,7 +54,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 425444a54e22cca8d15cb808283be3baefcd2ce56447d91bce3b4f4b7f6606e03d2eb8a242891c619cfd0fad9aba5bb84026c68d41f07cd55f083481df234899 +$(DL_FILE)_BLAKE2 = 0680925026edf56f4369c71092c39f4ff3956a8cf04320326623b3031f719d62077acdca457a6cfd82f6bcbf510920113a0328a2d8cd4a208c3d9e49e1d431b5 install : $(TARGET) -- 2.35.1

1 0

Core Updates 166 and 167
by Peter Müller 11 Apr '22

11 Apr '22

Hello Michael, hello *, back at my desk, I saw your commits to the IPFire 2.x repository, and would like to confer the procedure of Core Updates 166 and 167 with you. Given the current circumstances, I think it would make sense to treat Core Update 166 as a more pressing, security-relevant update, having the following issues covered: - zlib: memory corruption (CVE-2018-25032 et al.) [I am working on a patch, as the current one is not sufficient anymore.] - Linux kernel: CVE-2022-1015, CVE-2022-1016 [I volounteer to work on this.] - apache: See https://patchwork.ipfire.org/project/ipfire/patch/20220316160912.1569-1-mat… - bind: See https://patchwork.ipfire.org/project/ipfire/patch/20220322173203.1633-1-mat… Aside from that, I would like to ship as many bugfixes that are currently staged in Core Update 167 with Core 166, to avoid unnecessary delays for the users. Also, I will hand in a patch fixing #12807, which fell through the cracks due to high workload on my end. It is currently a show-stopper for IPFire Tor users. :-/ *** Does this sound fine to you? If so, since I cannot commit into the master branch, how should we coordinate this so you won't have the entire load of cherry-picking on your shoulders? *** Regarding Core Update 167, I would see what's left in there after Core 166 is near- finished. Thanks for the linux-firmware patchset, but I am afraid this still leaves us with an update of an estimated size of 150 MBytes, which is too much. At the moment, the only possibility I see is not to ship linux-firmware, but rather compress the files on the installations during the update. Thanks, and best regards, Peter Müller

5 13

← Newer
1
...
7
8
9
10
11
12
13
...
16
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2022