Development April 2022

development@lists.ipfire.org

18 participants
154 discussions

[PATCH] firewall/sysctl: Make Reverse Path Forwarding mode configurable
by Peter Müller 19 Apr '22

19 Apr '22

For the vast majority of IPFire installations (i. e. those who do not make use of asymmetric routing), it is safe to run the Linux kernel's Reverse Path Forwarding in 'strict' mode, as specified in RFC 3704, section 2.2, significantly hampering spoofing attacks. However, we cannot switch to this operating mode globally, since (a) some IPFire installations cannot use it and (b) we need to avoid a breaking change on this end. Therefore, this patch adds a switch to the firewall options CGI, permitting users to choose between 'loose' and 'strict' RPF mode, whereas 'loose' is the current default. On existing installations, this should be left untouched - although users are urged to check whether they can switch to the 'strict' mode -; similar to the 'drop hostile' feature, this should be set to 'strict' by default on new installations. Since only a sysctl is changed under the hood, changes do not require a reboot, but an execution of the /etc/rc.d/init.d/sysctl initscript. The corresponding misc-prog has been adjusted to reflect this. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- html/cgi-bin/optionsfw.cgi | 18 ++++++++++++++++++ langs/de/cgi-bin/de.pl | 3 +++ langs/en/cgi-bin/en.pl | 5 ++++- src/initscripts/system/sysctl | 11 ++++++++++- src/misc-progs/firewallctrl.c | 1 + 5 files changed, 36 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/optionsfw.cgi b/html/cgi-bin/optionsfw.cgi index fbff67b2f..72a4cddc8 100644 --- a/html/cgi-bin/optionsfw.cgi +++ b/html/cgi-bin/optionsfw.cgi @@ -158,6 +158,9 @@ $selected{'MASQUERADE_ORANGE'}{$settings{'MASQUERADE_ORANGE'}} = 'selected="sele $selected{'MASQUERADE_BLUE'}{'off'} = ''; $selected{'MASQUERADE_BLUE'}{'on'} = ''; $selected{'MASQUERADE_BLUE'}{$settings{'MASQUERADE_BLUE'}} = 'selected="selected"'; +$checked{'RPFORWARDINGMODE'}{'loose'} = ''; +$checked{'RPFORWARDINGMODE'}{'strict'} = ''; +$checked{'RPFORWARDINGMODE'}{$settings{'RPFORWARDINGMODE'}} = "checked='checked'"; &Header::openbox('100%', 'center',); print "<form method='post' action='$ENV{'SCRIPT_NAME'}'>"; @@ -334,6 +337,21 @@ END </table> <br /> + +<table width='95%' cellspacing='0'> + <tr bgcolor='$color{'color20'}'> + <td colspan='2' align='left'><b>$Lang::tr{'reverse path forwarding'}</b></td> + </tr> + <tr> + <td align='left' width='60%'>$Lang::tr{'reverse path forwarding mode'}</td> + <td align='left'> + $Lang::tr{'strict'} <input type='radio' name='RPFORWARDINGMODE' value='strict' $checked{'RPFORWARDINGMODE'}{'strict'} />/ + <input type='radio' name='RPFORWARDINGMODE' value='loose' $checked{'RPFORWARDINGMODE'}{'loose'} /> $Lang::tr{'loose'} + </td> + </tr> +</table> +<br> + <table width='100%' cellspacing='0'> <tr><td align='right'><form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='submit' name='ACTION' value='$Lang::tr{'save'}' /> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 6094c191a..047d47fe0 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1623,6 +1623,7 @@ 'logging server' => 'Protokollierungsserver', 'loginlogout' => 'Login/Logout', 'logs' => 'Protokolldateien', +'loose' => 'locker', 'loosedirectorychecking' => 'Loose directorychecking', 'low' => 'Niedrig', 'ls_dhcpd' => 'DHCP-Server:', @@ -2159,6 +2160,8 @@ 'restore defaults' => 'Voreinstellungen wiederherstellen', 'restore hardware settings' => 'Hardwareeinstellungen wiederherstellen', 'restore settings' => 'Einstellungen wiederherstellen', +'reverse path forwarding' => 'Reverse Path Forwarding', +'reverse path forwarding mode' => 'Betriebsmodus des Reverse Path Forwarding (siehe <a href="https://datatracker.ietf.org/doc/html/rfc3704#section-2" target="_blank">RFC 3704, Abschnitt 2</a>)', 'reverse sort' => 'In umgekehrter chronologischer Reihenfolge sortieren', 'root' => 'Root', 'root certificate' => 'Root-Zertifikat', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 510ed095b..80d8f7f1a 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1671,6 +1671,7 @@ 'logging server' => 'Logging Server', 'loginlogout' => 'Login/Logout', 'logs' => 'logs', +'loose' => 'loose', 'loosedirectorychecking' => 'Loosedirectorychecking', 'low' => 'Low', 'ls_dhcpd' => 'DHCP Server:', @@ -2211,6 +2212,8 @@ 'restore defaults' => 'Restore defaults', 'restore hardware settings' => 'Restore hardware settings', 'restore settings' => 'Reset Settings', +'reverse path forwarding' => 'Reverse Path Forwarding', +'reverse path forwarding mode' => 'Operating mode of Reverse Path Forwarding (see <a href="https://datatracker.ietf.org/doc/html/rfc3704#section-2" target="_blank">RFC 3704, section 2</a>)', 'reverse sort' => 'Sort in reverse chronological order', 'root' => 'Root', 'root certificate' => 'Root Certificate', @@ -2394,7 +2397,7 @@ 'stop' => 'Stop', 'stop ovpn server' => 'Stop OpenVPN Server', 'stopped' => 'STOPPED', -'strict' => 'Strict', +'strict' => 'strict', 'subject' => 'Subject', 'subject test' => 'Teste-mail', 'subject warn' => 'Warning - warnlevel reached', diff --git a/src/initscripts/system/sysctl b/src/initscripts/system/sysctl index 8897c1faa..c7aebbc8d 100644 --- a/src/initscripts/system/sysctl +++ b/src/initscripts/system/sysctl @@ -22,6 +22,8 @@ . /etc/sysconfig/rc . ${rc_functions} +eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) + case "${1}" in start) if [ -f "/etc/sysctl.conf" ]; then @@ -29,7 +31,7 @@ case "${1}" in sysctl -q -p evaluate_retval fi - arch=`uname -m` + arch=$(uname -m) case "${arch}" in armv*) arch="armv6l": @@ -40,6 +42,13 @@ case "${1}" in sysctl -q -p /etc/sysctl-${arch}.conf evaluate_retval fi + + if [ "$RPFORWARDINGMODE" == "strict" ]; then + boot_mesg "Setting Reverse Path Forwarding mode to 'strict'..." + sysctl -q -w net.ipv4.conf.all.rp_filter=1 + evaluate_retval + fi + ;; status) diff --git a/src/misc-progs/firewallctrl.c b/src/misc-progs/firewallctrl.c index 0f176597d..b6756b0b1 100644 --- a/src/misc-progs/firewallctrl.c +++ b/src/misc-progs/firewallctrl.c @@ -13,6 +13,7 @@ int main(int argc, char *argv[]) { if (!(initsetuid())) exit(1); + safe_system("/etc/rc.d/init.d/sysctl start"); int retval = safe_system("/usr/lib/firewall/rules.pl"); /* If rules.pl has been successfully executed, the indicator -- 2.34.1

2 2

[PATCH 1/3] OpenSSH: Update to 9.0p1
by Peter Müller 19 Apr '22

19 Apr '22

Relevant changelog part, as retrieved from https://www.openssh.com/txt/release-9.0: Changes since OpenSSH 8.9 ========================= This release is focused on bug fixing. Potentially-incompatible changes -------------------------------- This release switches scp(1) from using the legacy scp/rcp protocol to using the SFTP protocol by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. This creates one area of potential incompatibility: scp(1) when using the SFTP protocol no longer requires this finicky and brittle quoting, and attempts to use it may cause transfers to fail. We consider the removal of the need for double-quoting shell characters in file names to be a benefit and do not intend to introduce bug-compatibility for legacy scp/rcp in scp(1) when using the SFTP protocol. Another area of potential incompatibility relates to the use of remote paths relative to other user's home directories, for example - "scp host:~user/file /tmp". The SFTP protocol has no native way to expand a ~user path. However, sftp-server(8) in OpenSSH 8.7 and later support a protocol extension "expand-path(a)openssh.com" to support this. In case of incompatibility, the scp(1) client may be instructed to use the legacy scp/rcp using the -O flag. New features ------------ * ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519 key exchange method by default ("sntrup761x25519-sha512(a)openssh.com"). The NTRU algorithm is believed to resist attacks enabled by future quantum computers and is paired with the X25519 ECDH key exchange (the previous default) as a backstop against any weaknesses in NTRU Prime that may be discovered in the future. The combination ensures that the hybrid exchange offers at least as good security as the status quo. We are making this change now (i.e. ahead of cryptographically- relevant quantum computers) to prevent "capture now, decrypt later" attacks where an adversary who can record and store SSH session ciphertext would be able to decrypt it once a sufficiently advanced quantum computer is available. * sftp-server(8): support the "copy-data" extension to allow server- side copying of files/data, following the design in draft-ietf-secsh-filexfer-extensions-00. bz2948 * sftp(1): add a "cp" command to allow the sftp client to perform server-side file copies. Bugfixes -------- * ssh(1), sshd(8): upstream: fix poll(2) spin when a channel's output fd closes without data in the channel buffer. bz3405 and bz3411 * sshd(8): pack pollfd array in server listen/accept loop. Could cause the server to hang/spin when MaxStartups > RLIMIT_NOFILE * ssh-keygen(1): avoid NULL deref via the find-principals and check-novalidate operations. bz3409 and GHPR#307 respectively. * scp(1): fix a memory leak in argument processing. bz3404 * sshd(8): don't try to resolve ListenAddress directives in the sshd re-exec path. They are unused after re-exec and parsing errors (possible for example if the host's network configuration changed) could prevent connections from being accepted. * sshd(8): when refusing a public key authentication request from a client for using an unapproved or unsupported signature algorithm include the algorithm name in the log message to make debugging easier. Portability ----------- * sshd(8): refactor platform-specific locked account check, fixing an incorrect free() on platforms with both libiaf and shadow passwords (probably only Unixware) GHPR#284, * ssh(1), sshd(8): Fix possible integer underflow in scan_scaled(3) parsing of K/M/G/etc quantities. bz#3401. * sshd(8): provide killpg implementation (mostly for Tandem NonStop) GHPR#301. * Check for missing ftruncate prototype. GHPR#301 * sshd(8): default to not using sandbox when cross compiling. On most systems poll(2) does not work when the number of FDs is reduced with setrlimit, so assume it doesn't when cross compiling and we can't run the test. bz#3398. * sshd(8): allow ppoll_time64 in seccomp sandbox. Should fix sandbox violations on some (at least i386 and armhf) 32bit Linux platforms. bz#3396. * Improve detection of -fzero-call-used-regs=all support in configure script. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/openssh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index 8c958e9fe..302ae6041 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 8.9p1 +VER = 9.0p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 02934da7f7a2954141888e63e81e38fad4fb8558ddd1032de44f69684802c62771fdd7e9e470e0715059635999c8f9d2ab95f6351217e236573ead83a867f59b +$(DL_FILE)_BLAKE2 = 49724a400951964d659d136908657940f79e150056728cc4dadf8ff8652a832f7fd46eebb47b15085e57fca4b00c77d1ec4dd1b056ea2bbcee89f54a121ed5e2 install : $(TARGET) -- 2.34.1

2 5

Samba update rootfile
by Adolf Belka 19 Apr '22

19 Apr '22

Hi All, I have done an update build of samba-4.16.0 which built fine after the installation of a new dependency perl-JSON. My question is regarding the rootfile changes shown in the samba file in the log directory. Many of the libraries now have no version number and are replaced by just a .so file As an example libasn1-samba4 has the following removed -usr/lib/samba/libasn1-samba4.so.8 -usr/lib/samba/libasn1-samba4.so.8.0.0 and replaced by +usr/lib/samba/libasn1-samba4.so There is no mention of any changes to the lib files in the Whats New file in the source tarball or on the samba website that I have been able to find. I want to be sure that this is not occurring because of some error I have made somewhere. Attached below is the whole of the samba logfile showing the new files and the files being removed. Regards, Adolf. -- Sent from my laptop

2 1

[PATCH] squid: Update to 5.5
by Matthias Fischer 18 Apr '22

18 Apr '22

For details see: http://lists.squid-cache.org/pipermail/squid-users/2022-April/024725.html Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/squid b/lfs/squid index ceaddac86..7b77e568f 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 5.4.1 +VER = 5.5 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 3281f592c342b59a1017f4c0829543c857d61c4d1e191461f6e69bda2dc61ff59d5b92a04744dcebb75bd1b5d85c214c1f0bea78a791033a50f29891b6995fb8 +$(DL_FILE)_BLAKE2 = aef52ba0b47098f823d3f2bbe55e015c12b853bcc0a414bc94a4103009a05fee2c33263b8ade9b31cd22068e964d7f37fc0a497877d26ff836bc2193a6d0e8fc install : $(TARGET) -- 2.25.1

2 1

[PATCH] openvpn: Update to version 2.5.6
by Adolf Belka 18 Apr '22

18 Apr '22

- Update from version 2.5.4 to 2.5.6 - Update of rootfile not required - No changes related to ciphers or options - Source tarball changed from .xz to .gz as for version 2.5.6 the xz options was not available. Raised on Openvpn forum but response was that they also didn't know why xz option was not available but they thought it was not a big deal as the gz version is only slightly larger. - Changelog Overview of changes in 2.5.6 User-visible Changes update copyright year to 2022 New features new plugin (sample-plugin/defer/multi-auth.c) to help testing with multiple parallel plugins that succeed/fail in direct/deferred mode various build improvements (github actions etc) upgrade pkcs11-helper to release 1.28.4 Bugfixes CVE-2022-0547 see https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements If openvpn is configured with multiple authentication plugins and more than one plugin tries to do deferred authentication, the result is not well-defined - creating a possible authentication bypass. In this situation the server process will now abort itself with a clear log message. Only one plugin is allowed to do deferred authentication. Fix "--mtu-disc maybe|yes" on Linux Due to configure/syshead.h/#ifdef confusion, the code in question was not compiled-in since a long time. Fixed. Trac: #1452 Fix $common_name variable passed to scripts when username-as-common-name is in effect. This was not consistently set - sometimes, OpenVPN exported the username, sometimes the common name from the client cert. Fixed. Trac: #1434 Fix potential memory leaks in add_route() and add_route_ipv6(). Apply connect-retry backoff only to one side of the connection in p2p mode. Without that fix/enhancement, two sides could end up only sending packets when the other end is not ready. Trac: #1010, #1384 remove unused sitnl.h file clean up msvc build files, remove unused MSVC build .bat files repair "--inactive" handling with a 'bytes' parameter larger than 2 Gbytes due to integer overflow, this ended up being "0" on Linux, but on Windows with MSVC it ends up being "always 2 Gbyte", both not doing what is requested. Trac: #1448 repair handling of EC certificates on Windows with pkcs11-helper (wrong compile-time defines for OpenSSL 1.1.1) Documentation documentation improvements related to DynDNS. Trac: #1417 clean up documentation for --proto and related options rebuild rst docs if input files change (proper dependency handling) Overview of changes in 2.5.5 User-visible Changes SWEET32/64bit cipher deprecation change was postponed to 2.7 Windows: use network address for emulated DHCP server as default this enables use of a /30 subnet, which is needed when connecting to OpenVPN Cloud. require EC support in windows builds (this means it's no longer possible to build a Windows OpenVPN binary with an OpenSSL lib without EC support) New features Windows build: use CFG and Spectre mitigations on MSVC builds bring back OpenSSL config loading to Windows builds. OpenSSL config is loaded from %installdir%\ssl\openssl.cnf (typically: c:\program files\openvpn\ssl\openssl.cnf) if it exists. This is important for some hardware tokens which need special OpenSSL config for correct operation. Trac #1296 Bugfixes Windows build: enable EKM Windows build: improve various vcpkg related build issues Windows build: fix regression related to non-writeable status files (Trac #1430) Windows build: fix regression that broke OpenSSL EC support Windows build: fix "product version" display (2.5..4 -> 2.5.4) Windows build: fix regression preventing use of PKCS12 files improve "make check" to notice if "openvpn --show-cipher" crashes improve argv unit tests ensure unit tests work with mbedTLS builds without BF-CBC ciphers include "--push-remove" in the output of "openvpn --help" fix error in iptables syntax in example firewall.sh script fix "resolvconf -p" invocation in example "up" script fix "common_name" environment for script calls when "--username-as-common-name" is in effect (Trac #1434) Documentation move "push-peer-info" documentation from "server options" to "client" (where it belongs) correct "foreign_option_{n}" typo in manpage update IRC information in CONTRIBUTING.rst (libera.chat) README.down-root: fix plugin module name Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openvpn | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/openvpn b/lfs/openvpn index 9b2e7853c..27a052ae1 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,10 +24,10 @@ include Config -VER = 2.5.4 +VER = 2.5.6 THISAPP = openvpn-$(VER) -DL_FILE = $(THISAPP).tar.xz +DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ebc711981ab93da69ba033f3cf1ea1c99e86f700ec98809a3c401d59a6ecf53f977935aafd37df0233a0498762db01bed0555aeb99ab7e7903274e4d78997301 +$(DL_FILE)_BLAKE2 = d0466d2b95dae892606b6369d2c227add1de43fb708bf1c31a3ef78b28fc37382d501cc559767c8c8358ec28b88d3eb80a0eb915d7872ce30757c7080a37fde2 install : $(TARGET) @@ -69,7 +69,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar Jxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/var/ipfire/ovpn \ -- 2.35.1

2 1

[PATCH] bird: Update to version 2.0.9
by Adolf Belka 18 Apr '22

18 Apr '22

- Update from version 2.0.8 to 2.0.9 - Update of rootfile not required - Changelog Version 2.0.9 (2022-02-09) o BGP: Flowspec validation procedure o Babel: MAC authentication support o Routing table configuration blocks o Optional prefix trie in routing table for faster LPM/interval queries o CLI: New 'show route in <prefix>' command o Filter: Faster (16-way) prefix sets o Filter: MPLS label route attribute o Filter: Operators to pick community components o Filter: Operators to find minimum and maximum element of lists o BGP: New 'free bind' option o BGP: Log route updates that were changed to withdraws o BGP: Improved 'invalid next hop' error reporting o OSPF: Allow ifaces with host address as unnumbered PtP or PtMP ifaces o OSPF: All packets on PtP networks should be sent to AllSPFRouters address o Scripts for apkg-powered upstream packaging for deb and rpm o Support for Blake2s and Blake2b hash functions o Security keys / passwords can be entered in hexadecimal digits o Memory statistics split into Effective and Overhead o Linux: New option 'netlink rx buffer' to specify netlink socket buffer size o BSD: Assume onlink flag on ifaces with only host addresses o Many bugfixes Notes: - For OSPF on PtP network, BIRD now sends all packets to multicast AllSPFRouters address (as required in RFC 2328 8.1). This likely breaks setups with multiple neighbors on a network configured as PtP, which worked in previous versions. Such links should be configured as PtMP. - Since Linux 5.3, netlink socket can be flooded by route cache entries during route table scan. This version mitigates that issue by using strict netlink filtering. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/bird | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/bird b/lfs/bird index c140aa811..591ccc6a7 100644 --- a/lfs/bird +++ b/lfs/bird @@ -26,7 +26,7 @@ include Config SUMMARY = The BIRD Internet Routing Daemon -VER = 2.0.8 +VER = 2.0.9 THISAPP = bird-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = bird -PAK_VER = 8 +PAK_VER = 9 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4b36688ac85967ad8c39d9c37dc717d77b1cb5c3ec44a0cf4e84ff38b8d1710d10653a1333b50cd2ede79fd7f012ec86de0baefc9ac18435693ec5b3e43b8a3a +$(DL_FILE)_BLAKE2 = 5226058ba8989a28e8151906e194fd3065276034f1304e0e45772b17f3d8095eff6add211320a23418bfb57b2c16c96594fb85345355e3b870d7bfa2cfe119b9 install : $(TARGET) -- 2.35.1

2 1

[PATCH] tshark: Update to version 3.6.3
by Adolf Belka 18 Apr '22

18 Apr '22

- Update from 3.4.7 to 3.6.3 - Update of rootfile - find-dependencies run due to sobump - nothing reported - Changelog - a range of changes including many bug fixes and several vulnerabilities Wireshark 3.6.3 Release Notes Bug Fixes • Fuzz job crash output: fuzz-2022-01-19-7399.pcap Issue 17894[1]. • TLS dissector incorrectly reports JA3 values Issue 17942[2]. • "Wiki Protocol page" in packet details menu is broken - wiki pages not migrated to GitLab? Issue 17944[3]. • Dissector bug, protocol PFCP display Flow Description IE value error in Additional Flow Description of PFD Management Request Message Issue 17951[4]. • Bluetooth: Fails to open Log file for SCO connection Issue 17964[5]. • Fuzz job crash output: fuzz-2022-03-07-10896.pcap Issue 17984[6]. • libwiretap: Save as ERF causes segmentation fault Issue 17989[7]. • HTTP server returning multiple early hints shows too many responses in "Follow HTTP Stream" Issue 18006[8]. New and Updated Features Updated Protocol Support CSN.1, HTTP, IEEE 802.11, NTLM SSP, PFCP, PKTLOG, SSDP, TLS, and USB HID New and Updated Capture File Support pcap and pcapng Wireshark 3.6.2 Release Notes Bug Fixes The following vulnerabilities have been fixed: • wnpa-sec-2022-01[1] RTMPT dissector infinite loop. Issue 17813[2]. • wnpa-sec-2022-02[3] Large loops in multiple dissectors. Issue 17829[4], Issue 17842[5], Issue 17847[6], Issue 17855[7], Issue 17891[8], Issue 17925[9], Issue 17926[10], Issue 17931[11], Issue 17932[12], Issue 17933[13]. • wnpa-sec-2022-03[14] PVFS dissector crash. Issue 17840[15]. • wnpa-sec-2022-04[16] CSN.1 dissector crash. Issue 17882[17]. • wnpa-sec-2022-05[18] CMS dissector crash. Issue 17935[19]. The following bugs have been fixed: • Support for GSM SMS TPDU in HTTP2 body Issue 17784[20]. • Wireshark 3.6.1 broke the ABI by removing ws_log_default_writer from libwsutil Issue 17822[21]. • Fedora RPM package build failing with RPATH of /usr/local/lib64 Issue 17830[22]. • macos-setup.sh: ftp.pcre.org no longer exists Issue 17834[23]. • nmap.org/npcap → npcap.com: domain/URL change Issue 17838[24]. • MPLS ECHO FEC stack change TLV not dissected correctly Issue 17868[25]. • Attempting to open a systemd journal export file segfaults Issue 17875[26]. • Dissector bug on 802.11ac packets Issue 17878[27]. • The Info column shows only one NGAP/S1AP packet of several packets inside an SCTP packet Issue 17886[28]. • Uninstalling Wireshark 3.6.1 on Windows 10 fails to remove the installation directory because it doesn’t remove the User’s Guide subdirectory and all its contents. Issue 17898[29]. • 3.6 doesn’t build without zlib Issue 17899[30]. • SIP Statistics no longer properly reporting method type accounting Issue 17904[31]. • Fuzz job crash output: fuzz-2022-01-26-6940.pcap Issue 17909[32]. • SCTP retransmission detection broken for the first data chunk of each association with relative TSN Issue 17917[33]. • “Show In Folder” doesn’t work correctly for filenames with spaces Issue 17927[34]. New and Updated Features Updated Protocol Support AMP, ASN.1 PER, ATN-ULCS, BGP, BP, CFLOW, CMS, CSN.1, GDSDB, GSM RP, GTP, HTTP3, IEEE 802.11 Radiotap, IPDC, ISAKMP, Kafka, MP2T, MPEG PES, MPEG SECT, MPLS ECHO, NGAP, NTLMSSP, OpenFlow 1.4, OpenFlow 1.5, P_MUL, PN-RT, PROXY, PTP, PVFS, RSL, RTMPT, rtnetlink, S1AP, SCTP, Signal PDU, SIP, TDS, USB, WAP, and ZigBee ZCL New and Updated Capture File Support BLF and libpcap Wireshark 3.6.1 Release Notes Bug Fixes The following vulnerabilities have been fixed: • wnpa-sec-2021-17[1] RTMPT dissector infinite loop. Issue 17745[2]. CVE-2021-4185[3]. • wnpa-sec-2021-18[4] BitTorrent DHT dissector infinite loop. Issue 17754[5]. CVE-2021-4184[6]. • wnpa-sec-2021-19[7] pcapng file parser crash. Issue 17755[8]. CVE-2021-4183[9]. • wnpa-sec-2021-20[10] RFC 7468 file parser infinite loop. Issue 17801[11]. CVE-2021-4182[12]. • wnpa-sec-2021-21[13] Sysdig Event dissector crash. CVE-2021-4181[14]. • wnpa-sec-2021-22[15] Kafka dissector infinite loop. Issue 17811[16]. The following bugs have been fixed: • Allow sub-second timestamps in hexdumps Issue 15562[17]. • GRPC: An unnecessary empty Protobuf tree item is displayed if the GRPC message body length is 0 Issue 17675[18]. • Can’t install "ChmodBPF.pkg" or "Add Wireshark to the system path.pkg" on M1 MacBook Air Monterey without Rosetta 2 Issue 17757[19]. • TECMP: LIN Payload is cut off by 1 byte Issue 17760[20]. • Wireshark crashes if a 64 bit field of type BASE_CUSTOM is applied as a column Issue 17762[21]. • Command line option "-o console.log.level" causes wireshark and tshark to exit on start Issue 17763[22]. • Setting WIRESHARK_LOG_LEVEL=debug breaks interface capture Issue 17764[23]. • Unable to build without tshark Issue 17766[24]. • IEEE 802.11 action frames are not getting parsed and always seen as malformed Issue 17767[25]. • IEC 60870-5-101 link address field is 1 byte, but should have configurable length of 0,1 or 2 bytes Issue 17775[26]. • dfilter: 'tcp.port not in {1}' crashes Wireshark Issue 17785[27]. New and Updated Features • The 'console.log.level' preference was removed in Wireshark 3.6.0. This release adds an '-o console.log.level:' backward-compatibilty option on the CLI that maps to the new logging sub-system. Note that this does not have bitmask semantics and does not correspond to any actual preference. It is just a transition mechanism for users that were relying on this CLI option and will be removed in the future. To see the new diagnostic output options consult the manpages or the output of '--help'. Updated Protocol Support ANSI A I/F, AT, BitTorrent DHT, FF, GRPC, IEC 101/104, IEEE 802.11, IEEE 802.11 Radiotap, IPsec, Kafka, QUIC, RTMPT, RTSP, SRVLOC, Sysdig Event, and TECMP New and Updated Capture File Support BLF and RFC 7468 Wireshark 3.6.0 Release Notes Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as … in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF) Wireshark 3.4.9 Release Notes Bug Fixes • TShark PDML output embeds "proto" elements within other "proto" elements Issue 10588[1]. • Filter expressions comparing against single-octet hex strings where the hex digit string equals a protocol name don’t work Issue 12810[2]. • AMQP 0.9: dissector fails to handle Content-Body frame split across TCP packets Issue 14217[3]. • IEEE 802.15.4: Missing check on "PAN ID Present" bit of the Multipurpose Frame Control field Issue 17496[4]. • Wireshark ignored some character in filename when exporting SMB objects. Issue 17530[5]. • tshark -z credentials: assertion failed: (allocator→in_scope) Issue 17576[6]. • IS-IS Extended IP Reachability Prefix-SID not decoded properly Issue 17610[7]. • Error when reloading lua plugins with a capture file loaded via a custom lua file handler Issue 17615[8]. • Absolute time UTC field filters are constructed incorrectly, don’t match the packet Issue 17617[9]. • GUI freezes when clicking on large (non-capture) file in File chooser Issue 17620[10]. • Crash after selecting a different profile while capturing Issue 17622[11]. • BT-DHT reports malformed packets that are actually uTP on same connection Issue 17626[12]. Updated Protocol Support AMQP, Aruba IAP, BGP, BT-DHT, CoAP, DCERPC SPOOLSS, Diameter, EPL, GSM A-bis OML, GSM A-I/F COMMON, GSM SIM, IEEE 1905.1a, IEEE 802.15.4, IMAP, InfiniBand, ISIS LSP, ISObus VT, JPEG, MP2T, NORDIC_BLE, QUIC, RTCP, SDP, SMB, TWAMP-Control, USB HID, and VSS Monitoring New and Updated Capture File Support CAM Inspector, Ixia IxVeriWave, pcapng, and USBDump Wireshark 3.4.8 Release Notes Bug Fixes • Dissector bug reported for Bluetooth Cycling Power Measurement characteristic for extreme angles value Issue 17505[1]. • vcruntime140_1.dll deleted on Wireshark update/install Issue 17506[2]. • Raknet Addresses are incorrectly identified. Issue 17509[3]. • Editcap saving files as ethernet when specifying '-T ieee-802-11-*' Issue 17520[4]. • CoAP dissector confuses Content-Format with Accept Issue 17536[5]. Updated Protocol Support BT ATT, BT LE LL, CoAP, DLM3, GSM SIM, iLBC, and RakNet Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/tshark | 185 +++++++++++++------------------ lfs/tshark | 6 +- 2 files changed, 77 insertions(+), 114 deletions(-) diff --git a/config/rootfiles/packages/tshark b/config/rootfiles/packages/tshark index f46d7ba01..937ddd3d6 100644 --- a/config/rootfiles/packages/tshark +++ b/config/rootfiles/packages/tshark @@ -44,6 +44,7 @@ usr/bin/tshark #usr/include/wireshark/epan/crc32-tvb.h #usr/include/wireshark/epan/crc6-tvb.h #usr/include/wireshark/epan/crc8-tvb.h +#usr/include/wireshark/epan/dccpservicecodes.h #usr/include/wireshark/epan/decode_as.h #usr/include/wireshark/epan/dfilter #usr/include/wireshark/epan/dfilter/dfilter.h @@ -51,6 +52,7 @@ usr/bin/tshark #usr/include/wireshark/epan/diam_dict.h #usr/include/wireshark/epan/disabled_protos.h #usr/include/wireshark/epan/dissectors +#usr/include/wireshark/epan/dissectors/cond_ace_token_enum.h #usr/include/wireshark/epan/dissectors/file-rbm.h #usr/include/wireshark/epan/dissectors/packet-6lowpan.h #usr/include/wireshark/epan/dissectors/packet-a21.h @@ -61,10 +63,12 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-adb_service.h #usr/include/wireshark/epan/dissectors/packet-afp.h #usr/include/wireshark/epan/dissectors/packet-alcap.h +#usr/include/wireshark/epan/dissectors/packet-amp.h #usr/include/wireshark/epan/dissectors/packet-ansi_a.h #usr/include/wireshark/epan/dissectors/packet-ansi_map.h #usr/include/wireshark/epan/dissectors/packet-ansi_tcap.h #usr/include/wireshark/epan/dissectors/packet-arp.h +#usr/include/wireshark/epan/dissectors/packet-asap+enrp-common.h #usr/include/wireshark/epan/dissectors/packet-atalk.h #usr/include/wireshark/epan/dissectors/packet-atm.h #usr/include/wireshark/epan/dissectors/packet-atn-ulcs.h @@ -75,12 +79,16 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-bgp.h #usr/include/wireshark/epan/dissectors/packet-bicc_mst.h #usr/include/wireshark/epan/dissectors/packet-bluetooth.h +#usr/include/wireshark/epan/dissectors/packet-bpsec.h +#usr/include/wireshark/epan/dissectors/packet-bpv6.h +#usr/include/wireshark/epan/dissectors/packet-bpv7.h #usr/include/wireshark/epan/dissectors/packet-bssap.h #usr/include/wireshark/epan/dissectors/packet-bssgp.h #usr/include/wireshark/epan/dissectors/packet-btatt.h #usr/include/wireshark/epan/dissectors/packet-btavctp.h #usr/include/wireshark/epan/dissectors/packet-btavdtp.h #usr/include/wireshark/epan/dissectors/packet-btavrcp.h +#usr/include/wireshark/epan/dissectors/packet-btbredr_rf.h #usr/include/wireshark/epan/dissectors/packet-bthci_acl.h #usr/include/wireshark/epan/dissectors/packet-bthci_cmd.h #usr/include/wireshark/epan/dissectors/packet-bthci_evt.h @@ -102,6 +110,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-cmp.h #usr/include/wireshark/epan/dissectors/packet-cms.h #usr/include/wireshark/epan/dissectors/packet-coap.h +#usr/include/wireshark/epan/dissectors/packet-cose.h #usr/include/wireshark/epan/dissectors/packet-credssp.h #usr/include/wireshark/epan/dissectors/packet-crmf.h #usr/include/wireshark/epan/dissectors/packet-csn1.h @@ -132,10 +141,10 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-disp.h #usr/include/wireshark/epan/dissectors/packet-dns.h #usr/include/wireshark/epan/dissectors/packet-docsis-tlv.h +#usr/include/wireshark/epan/dissectors/packet-doip.h #usr/include/wireshark/epan/dissectors/packet-dop.h #usr/include/wireshark/epan/dissectors/packet-dsp.h #usr/include/wireshark/epan/dissectors/packet-dtls.h -#usr/include/wireshark/epan/dissectors/packet-dtn.h #usr/include/wireshark/epan/dissectors/packet-dvbci.h #usr/include/wireshark/epan/dissectors/packet-e164.h #usr/include/wireshark/epan/dissectors/packet-e1ap.h @@ -162,6 +171,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-fcswils.h #usr/include/wireshark/epan/dissectors/packet-ff.h #usr/include/wireshark/epan/dissectors/packet-fix.h +#usr/include/wireshark/epan/dissectors/packet-flexray.h #usr/include/wireshark/epan/dissectors/packet-fmp.h #usr/include/wireshark/epan/dissectors/packet-frame.h #usr/include/wireshark/epan/dissectors/packet-ftam.h @@ -220,6 +230,8 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-isis-clv.h #usr/include/wireshark/epan/dissectors/packet-isis.h #usr/include/wireshark/epan/dissectors/packet-isl.h +#usr/include/wireshark/epan/dissectors/packet-iso10681.h +#usr/include/wireshark/epan/dissectors/packet-iso15765.h #usr/include/wireshark/epan/dissectors/packet-isup.h #usr/include/wireshark/epan/dissectors/packet-its.h #usr/include/wireshark/epan/dissectors/packet-iwarp-ddp-rdmap.h @@ -237,6 +249,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-lcsap.h #usr/include/wireshark/epan/dissectors/packet-ldap.h #usr/include/wireshark/epan/dissectors/packet-ldp.h +#usr/include/wireshark/epan/dissectors/packet-lin.h #usr/include/wireshark/epan/dissectors/packet-link16.h #usr/include/wireshark/epan/dissectors/packet-lisp.h #usr/include/wireshark/epan/dissectors/packet-llc.h @@ -274,6 +287,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-nisplus.h #usr/include/wireshark/epan/dissectors/packet-nlm.h #usr/include/wireshark/epan/dissectors/packet-nr-rrc.h +#usr/include/wireshark/epan/dissectors/packet-nrppa.h #usr/include/wireshark/epan/dissectors/packet-nsh.h #usr/include/wireshark/epan/dissectors/packet-ntlmssp.h #usr/include/wireshark/epan/dissectors/packet-ntp.h @@ -292,6 +306,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-pcnfsd.h #usr/include/wireshark/epan/dissectors/packet-pdcp-lte.h #usr/include/wireshark/epan/dissectors/packet-pdcp-nr.h +#usr/include/wireshark/epan/dissectors/packet-pdu-transport.h #usr/include/wireshark/epan/dissectors/packet-per.h #usr/include/wireshark/epan/dissectors/packet-pkcs1.h #usr/include/wireshark/epan/dissectors/packet-pkcs12.h @@ -334,7 +349,6 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-rtcp.h #usr/include/wireshark/epan/dissectors/packet-rtp-events.h #usr/include/wireshark/epan/dissectors/packet-rtp.h -#usr/include/wireshark/epan/dissectors/packet-rtps.h #usr/include/wireshark/epan/dissectors/packet-rtse.h #usr/include/wireshark/epan/dissectors/packet-rtsp.h #usr/include/wireshark/epan/dissectors/packet-rx.h @@ -367,6 +381,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-smrse.h #usr/include/wireshark/epan/dissectors/packet-snmp.h #usr/include/wireshark/epan/dissectors/packet-socketcan.h +#usr/include/wireshark/epan/dissectors/packet-someip.h #usr/include/wireshark/epan/dissectors/packet-spice.h #usr/include/wireshark/epan/dissectors/packet-sprt.h #usr/include/wireshark/epan/dissectors/packet-sscop.h @@ -380,6 +395,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-tacacs.h #usr/include/wireshark/epan/dissectors/packet-tcap.h #usr/include/wireshark/epan/dissectors/packet-tcp.h +#usr/include/wireshark/epan/dissectors/packet-tcpclv3.h #usr/include/wireshark/epan/dissectors/packet-tetra.h #usr/include/wireshark/epan/dissectors/packet-thrift.h #usr/include/wireshark/epan/dissectors/packet-tls-utils.h @@ -391,6 +407,7 @@ usr/bin/tshark #usr/include/wireshark/epan/dissectors/packet-tte.h #usr/include/wireshark/epan/dissectors/packet-ua.h #usr/include/wireshark/epan/dissectors/packet-uaudp.h +#usr/include/wireshark/epan/dissectors/packet-uavcan-dsdl.h #usr/include/wireshark/epan/dissectors/packet-ubertooth.h #usr/include/wireshark/epan/dissectors/packet-udp.h #usr/include/wireshark/epan/dissectors/packet-umts_fp.h @@ -478,6 +495,7 @@ usr/bin/tshark #usr/include/wireshark/epan/packet.h #usr/include/wireshark/epan/packet_info.h #usr/include/wireshark/epan/params.h +#usr/include/wireshark/epan/pci-ids.h #usr/include/wireshark/epan/plugin_if.h #usr/include/wireshark/epan/ppptypes.h #usr/include/wireshark/epan/prefs-int.h @@ -522,27 +540,12 @@ usr/bin/tshark #usr/include/wireshark/epan/uat.h #usr/include/wireshark/epan/unit_strings.h #usr/include/wireshark/epan/value_string.h -#usr/include/wireshark/epan/wmem -#usr/include/wireshark/epan/wmem/wmem.h -#usr/include/wireshark/epan/wmem/wmem_array.h -#usr/include/wireshark/epan/wmem/wmem_core.h -#usr/include/wireshark/epan/wmem/wmem_interval_tree.h -#usr/include/wireshark/epan/wmem/wmem_list.h -#usr/include/wireshark/epan/wmem/wmem_map.h -#usr/include/wireshark/epan/wmem/wmem_miscutl.h -#usr/include/wireshark/epan/wmem/wmem_queue.h -#usr/include/wireshark/epan/wmem/wmem_scopes.h -#usr/include/wireshark/epan/wmem/wmem_stack.h -#usr/include/wireshark/epan/wmem/wmem_strbuf.h -#usr/include/wireshark/epan/wmem/wmem_strutl.h -#usr/include/wireshark/epan/wmem/wmem_tree.h -#usr/include/wireshark/epan/wmem/wmem_user_cb.h +#usr/include/wireshark/epan/wmem_scopes.h +#usr/include/wireshark/epan/wscbor.h #usr/include/wireshark/epan/x264_prt_id.h #usr/include/wireshark/epan/xdlc.h #usr/include/wireshark/file.h #usr/include/wireshark/globals.h -#usr/include/wireshark/log.h -#usr/include/wireshark/version_info.h #usr/include/wireshark/wiretap #usr/include/wireshark/wiretap/file_wrappers.h #usr/include/wireshark/wiretap/merge.h @@ -550,13 +553,16 @@ usr/bin/tshark #usr/include/wireshark/wiretap/pcapng_module.h #usr/include/wireshark/wiretap/secrets-types.h #usr/include/wireshark/wiretap/wtap.h +#usr/include/wireshark/wiretap/wtap_modules.h #usr/include/wireshark/wiretap/wtap_opttypes.h #usr/include/wireshark/ws_attributes.h #usr/include/wireshark/ws_compiler_tests.h #usr/include/wireshark/ws_diag_control.h +#usr/include/wireshark/ws_log_defs.h #usr/include/wireshark/ws_symbol_export.h #usr/include/wireshark/ws_version.h #usr/include/wireshark/wsutil +#usr/include/wireshark/wsutil/802_11-utils.h #usr/include/wireshark/wsutil/adler32.h #usr/include/wireshark/wsutil/base32.h #usr/include/wireshark/wsutil/bits_count_ones.h @@ -580,9 +586,10 @@ usr/bin/tshark #usr/include/wireshark/wsutil/curve25519.h #usr/include/wireshark/wsutil/eax.h #usr/include/wireshark/wsutil/epochs.h +#usr/include/wireshark/wsutil/exported_pdu_tlvs.h #usr/include/wireshark/wsutil/filesystem.h -#usr/include/wireshark/wsutil/frequency-utils.h #usr/include/wireshark/wsutil/g711.h +#usr/include/wireshark/wsutil/glib-compat.h #usr/include/wireshark/wsutil/inet_addr.h #usr/include/wireshark/wsutil/inet_ipv4.h #usr/include/wireshark/wsutil/inet_ipv6.h @@ -595,7 +602,6 @@ usr/bin/tshark #usr/include/wireshark/wsutil/os_version_info.h #usr/include/wireshark/wsutil/pint.h #usr/include/wireshark/wsutil/please_report_bug.h -#usr/include/wireshark/wsutil/plugins.h #usr/include/wireshark/wsutil/pow2.h #usr/include/wireshark/wsutil/privileges.h #usr/include/wireshark/wsutil/processes.h @@ -608,25 +614,43 @@ usr/bin/tshark #usr/include/wireshark/wsutil/strtoi.h #usr/include/wireshark/wsutil/tempfile.h #usr/include/wireshark/wsutil/time_util.h +#usr/include/wireshark/wsutil/to_str.h #usr/include/wireshark/wsutil/type_util.h #usr/include/wireshark/wsutil/unicode-utils.h #usr/include/wireshark/wsutil/utf8_entities.h +#usr/include/wireshark/wsutil/wmem +#usr/include/wireshark/wsutil/wmem/wmem.h +#usr/include/wireshark/wsutil/wmem/wmem_array.h +#usr/include/wireshark/wsutil/wmem/wmem_core.h +#usr/include/wireshark/wsutil/wmem/wmem_interval_tree.h +#usr/include/wireshark/wsutil/wmem/wmem_list.h +#usr/include/wireshark/wsutil/wmem/wmem_map.h +#usr/include/wireshark/wsutil/wmem/wmem_miscutl.h +#usr/include/wireshark/wsutil/wmem/wmem_queue.h +#usr/include/wireshark/wsutil/wmem/wmem_stack.h +#usr/include/wireshark/wsutil/wmem/wmem_strbuf.h +#usr/include/wireshark/wsutil/wmem/wmem_strutl.h +#usr/include/wireshark/wsutil/wmem/wmem_tree.h +#usr/include/wireshark/wsutil/wmem/wmem_user_cb.h +#usr/include/wireshark/wsutil/ws_assert.h #usr/include/wireshark/wsutil/ws_cpuid.h +#usr/include/wireshark/wsutil/ws_getopt.h #usr/include/wireshark/wsutil/ws_mempbrk.h #usr/include/wireshark/wsutil/ws_mempbrk_int.h #usr/include/wireshark/wsutil/ws_pipe.h -#usr/include/wireshark/wsutil/ws_printf.h +#usr/include/wireshark/wsutil/ws_roundup.h #usr/include/wireshark/wsutil/wsjson.h +#usr/include/wireshark/wsutil/wslog.h #usr/include/wireshark/wsutil/xtea.h #usr/lib/libwireshark.so -usr/lib/libwireshark.so.14 -usr/lib/libwireshark.so.14.0.7 +usr/lib/libwireshark.so.15 +usr/lib/libwireshark.so.15.0.3 #usr/lib/libwiretap.so -usr/lib/libwiretap.so.11 -usr/lib/libwiretap.so.11.0.7 +usr/lib/libwiretap.so.12 +usr/lib/libwiretap.so.12.0.3 #usr/lib/libwsutil.so -usr/lib/libwsutil.so.12 -usr/lib/libwsutil.so.12.0.0 +usr/lib/libwsutil.so.13 +usr/lib/libwsutil.so.13.1.0 #usr/lib/pkgconfig/wireshark.pc #usr/lib/wireshark #usr/lib/wireshark/cmake @@ -648,81 +672,34 @@ usr/lib/wireshark/extcap/randpktdump usr/lib/wireshark/extcap/sshdump usr/lib/wireshark/extcap/udpdump #usr/lib/wireshark/plugins -#usr/lib/wireshark/plugins/3.4 -#usr/lib/wireshark/plugins/3.4/codecs -usr/lib/wireshark/plugins/3.4/codecs/g711.so -usr/lib/wireshark/plugins/3.4/codecs/g722.so -usr/lib/wireshark/plugins/3.4/codecs/g726.so -usr/lib/wireshark/plugins/3.4/codecs/l16mono.so -usr/lib/wireshark/plugins/3.4/codecs/opus_dec.so -#usr/lib/wireshark/plugins/3.4/epan -usr/lib/wireshark/plugins/3.4/epan/ethercat.so -usr/lib/wireshark/plugins/3.4/epan/gryphon.so -usr/lib/wireshark/plugins/3.4/epan/irda.so -usr/lib/wireshark/plugins/3.4/epan/mate.so -usr/lib/wireshark/plugins/3.4/epan/opcua.so -usr/lib/wireshark/plugins/3.4/epan/profinet.so -usr/lib/wireshark/plugins/3.4/epan/stats_tree.so -usr/lib/wireshark/plugins/3.4/epan/transum.so -usr/lib/wireshark/plugins/3.4/epan/unistim.so -usr/lib/wireshark/plugins/3.4/epan/wimax.so -usr/lib/wireshark/plugins/3.4/epan/wimaxasncp.so -usr/lib/wireshark/plugins/3.4/epan/wimaxmacphy.so -#usr/lib/wireshark/plugins/3.4/wiretap -usr/lib/wireshark/plugins/3.4/wiretap/usbdump.so -#usr/share/doc/wireshark -#usr/share/doc/wireshark/androiddump.html -#usr/share/doc/wireshark/capinfos.html -#usr/share/doc/wireshark/captype.html -#usr/share/doc/wireshark/ciscodump.html -#usr/share/doc/wireshark/dftest.html -#usr/share/doc/wireshark/dpauxmon.html -#usr/share/doc/wireshark/dumpcap.html -#usr/share/doc/wireshark/editcap.html -#usr/share/doc/wireshark/extcap.html -#usr/share/doc/wireshark/mergecap.html -#usr/share/doc/wireshark/randpkt.html -#usr/share/doc/wireshark/randpktdump.html -#usr/share/doc/wireshark/rawshark.html -#usr/share/doc/wireshark/reordercap.html -#usr/share/doc/wireshark/sshdump.html -#usr/share/doc/wireshark/text2pcap.html -#usr/share/doc/wireshark/tshark.html -#usr/share/doc/wireshark/udpdump.html -#usr/share/doc/wireshark/wireshark-filter.html -#usr/share/doc/wireshark/wireshark.html -#usr/share/man/man1/androiddump.1 -#usr/share/man/man1/capinfos.1 -#usr/share/man/man1/captype.1 -#usr/share/man/man1/ciscodump.1 -#usr/share/man/man1/dftest.1 -#usr/share/man/man1/dpauxmon.1 -#usr/share/man/man1/dumpcap.1 -#usr/share/man/man1/editcap.1 -#usr/share/man/man1/mergecap.1 -#usr/share/man/man1/randpkt.1 -#usr/share/man/man1/randpktdump.1 -#usr/share/man/man1/rawshark.1 -#usr/share/man/man1/reordercap.1 -#usr/share/man/man1/sshdump.1 -#usr/share/man/man1/text2pcap.1 -#usr/share/man/man1/tshark.1 -#usr/share/man/man1/udpdump.1 -#usr/share/man/man1/wireshark.1 -#usr/share/man/man4/extcap.4 -#usr/share/man/man4/wireshark-filter.4 +#usr/lib/wireshark/plugins/3.6 +#usr/lib/wireshark/plugins/3.6/codecs +usr/lib/wireshark/plugins/3.6/codecs/g711.so +usr/lib/wireshark/plugins/3.6/codecs/g722.so +usr/lib/wireshark/plugins/3.6/codecs/g726.so +usr/lib/wireshark/plugins/3.6/codecs/l16mono.so +usr/lib/wireshark/plugins/3.6/codecs/opus_dec.so +#usr/lib/wireshark/plugins/3.6/epan +usr/lib/wireshark/plugins/3.6/epan/ethercat.so +usr/lib/wireshark/plugins/3.6/epan/gryphon.so +usr/lib/wireshark/plugins/3.6/epan/irda.so +usr/lib/wireshark/plugins/3.6/epan/mate.so +usr/lib/wireshark/plugins/3.6/epan/opcua.so +usr/lib/wireshark/plugins/3.6/epan/profinet.so +usr/lib/wireshark/plugins/3.6/epan/stats_tree.so +usr/lib/wireshark/plugins/3.6/epan/transum.so +usr/lib/wireshark/plugins/3.6/epan/unistim.so +usr/lib/wireshark/plugins/3.6/epan/wimax.so +usr/lib/wireshark/plugins/3.6/epan/wimaxasncp.so +usr/lib/wireshark/plugins/3.6/epan/wimaxmacphy.so +#usr/lib/wireshark/plugins/3.6/wiretap +usr/lib/wireshark/plugins/3.6/wiretap/usbdump.so #usr/share/wireshark -#usr/share/wireshark/AUTHORS-SHORT #usr/share/wireshark/COPYING -#usr/share/wireshark/androiddump.html -#usr/share/wireshark/capinfos.html -#usr/share/wireshark/captype.html usr/share/wireshark/cfilters -#usr/share/wireshark/ciscodump.html usr/share/wireshark/colorfilters #usr/share/wireshark/dfilter_macros usr/share/wireshark/dfilters -#usr/share/wireshark/dftest.html #usr/share/wireshark/diameter usr/share/wireshark/diameter/AlcatelLucent.xml usr/share/wireshark/diameter/Cisco.xml @@ -768,13 +745,9 @@ usr/share/wireshark/dtds/smil.dtd usr/share/wireshark/dtds/watcherinfo.dtd usr/share/wireshark/dtds/xcap-caps.dtd usr/share/wireshark/dtds/xcap-error.dtd -#usr/share/wireshark/dumpcap.html -#usr/share/wireshark/editcap.html usr/share/wireshark/enterprises.tsv -#usr/share/wireshark/extcap.html #usr/share/wireshark/ipmap.html #usr/share/wireshark/manuf -#usr/share/wireshark/mergecap.html #usr/share/wireshark/pdml2html.xsl #usr/share/wireshark/profiles #usr/share/wireshark/profiles/Bluetooth @@ -996,22 +969,12 @@ usr/share/wireshark/radius/dictionary.yubico usr/share/wireshark/radius/dictionary.zeus usr/share/wireshark/radius/dictionary.zte usr/share/wireshark/radius/dictionary.zyxel -#usr/share/wireshark/randpkt.html -#usr/share/wireshark/randpktdump.html -#usr/share/wireshark/rawshark.html -#usr/share/wireshark/reordercap.html usr/share/wireshark/services usr/share/wireshark/smi_modules -#usr/share/wireshark/sshdump.html -#usr/share/wireshark/text2pcap.html #usr/share/wireshark/tpncp usr/share/wireshark/tpncp/tpncp.dat -#usr/share/wireshark/tshark.html -#usr/share/wireshark/udpdump.html #usr/share/wireshark/wimaxasncp usr/share/wireshark/wimaxasncp/dictionary.dtd usr/share/wireshark/wimaxasncp/dictionary.xml -#usr/share/wireshark/wireshark-filter.html -#usr/share/wireshark/wireshark.html usr/share/wireshark/wka usr/share/wireshark/ws.css diff --git a/lfs/tshark b/lfs/tshark index be732c97e..eb89f7474 100644 --- a/lfs/tshark +++ b/lfs/tshark @@ -26,7 +26,7 @@ include Config SUMMARY = A Network Traffic Analyser -VER = 3.4.7 +VER = 3.6.3 THISAPP = wireshark-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tshark DEPS = krb5 c-ares -PAK_VER = 11 +PAK_VER = 12 SERVICES = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0a6112ed667739935417350660e31d64747cb81295db058e0a27c38387b2ed2b9806f8d61925c262d531fb96d87e230d1cd5d511ae0bdba973373835bf5d7bc5 +$(DL_FILE)_BLAKE2 = 3b636867d946f0cf748eb719874e815c919ee9cedd21a7e9034d54b4cb87ae4a09ec02a199e1ec8051e421fe2929983d659f340ccfd12ab35e1ecd52000964fd install : $(TARGET) -- 2.35.1

2 1

[PATCH] vnstat: Update to 2.9
by Matthias Fischer 18 Apr '22

18 Apr '22

Triggered by Bug #12846 - in this context I noticed that vnstat had been updated to version 2.9. For details see: https://humdi.net/vnstat/CHANGES "2.9 / 23-Jan-2022 - Fixed - RescanDatabaseOnSave configuration option wasn't being read from the configuration file resulting in the feature always being enabled - Hourly graph image output using large fonts didn't correctly fade out the x-axis line for hours not having data available - New - Add --alert for producing output and/or specific exit status when configured condition and transfer limit is exceeded, can also be used for "quota remaining" type of queries depending on used parameters - Add configuration option InterfaceMatchMethod which allows configuring the possibility of specifying an interface for database queries by using its alias instead of system provided interface name, enabled by default to support case insensitive matching of the beginning of interface aliases (vnstat and vnstati) - Image output file extension allows selecting the used image file format as long as the used LibGD supports it, PNG is no longer the only option - Add configuration option HourlyGraphMode for changing the output mode of the graph, 0 = 24 hour sliding window (default, as in previous releases), 1 = graph begins from midnight - Add mode parameter for -hg / --hoursgraph options for overriding the HourlyGraphMode configuration option setting from the command line - Add vertical line to image output hourly graph to visualize midnight - Add -t / --timestamp options to daemon for enabling timestamps to prints when the daemon is running in the foreground attached to a terminal - Accept ; as comment character in configuration file in addition to # - Comment out keywords which are using default values with ; character in provided configuration file and --showconfig output 2.8 / 4-Sep-2021 - Fixed - Using a combination of --live and --json wasn't flushing stdout after each line resulting in buffered output if the output was being piped - Image output would fail to show the last line bar graph in list outputs if EstimateStyle was 0, BarColumnShowsRate was 1 and the last line had a higher traffic rate than other lines - Image output didn't correctly horizontally align the "no data available" message in 5 minute graph depending on the width of the image - Image output related configuration warnings could get shown when image output wasn't being used - Warnings of mismatches between image output and data retention configuration didn't provide relevant details for solving the issues - BandwidthDetection was being used for tun interfaces even when the Linux kernel had the information hardcoded to 10 Mbit regardless of the used real interface, interface specific MaxBW will now be used instead or MaxBandwidth as fallback - Configured interface specific MaxBW values were getting overridden by BandwidthDetection when something could be detected - Image output horizontal rx/tx bars often had one pixel too much width in the tx section resulting in slightly wrong ratio getting shown - Top days list wasn't always sorting entries with exactly the same traffic sum using ascending date - 64bitInterfaceCounters with value -2 always assumed 32-bit on Linux systems until a 64-bit value was seen if kernel headers weren't available when binaries were built - New - Add the possibility of specifying an interface without using the -i / --iface options (vnstat and vnstati) - The daemon can discover added interfaces from the database without requiring a restart, configurable with option RescanDatabaseOnSave - Add configuration option UseUTC for using UTC as timezone for database entries instead of following the system timezone configuration - --iflist uses user configured interface specific MaxBW values in the output when available instead of showing only the kernel provided information when detected - Add configuration option AlwaysAddNewInterfaces to expose the daemon --alwaysadd command line option which gains an optional mode parameter - Image output uses LibGD filled arc bug workaround only for LibGD versions that are known to be broken - Image output example cgi (examples/vnstat.cgi) improvements - Automatically lists all monitored interfaces instead of requiring the list to be filled manually, server name in page title comes from hostname command by default - Provides links for most available images to more detailed or longer versions of each image - Allows direct interface specific page access with /interfacename suffix for the cgi if the used httpd supports PATH_INFO - Page auto refresh can be enabled with configurable interval" Please note: As mentioned above, the default values in 2.9 are commented out. I have reversed this by adding a simple 'sed' command to the lfs file. Another possibility would have been to extend the existing sed commands. If this is desired differently, please report. As - nearly - always: running here with no seen problems... Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/vnstat | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lfs/vnstat b/lfs/vnstat index e4859be0b..a7b28f3fd 100644 --- a/lfs/vnstat +++ b/lfs/vnstat @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.7 +VER = 2.9 THISAPP = vnstat-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f7b50cccfe4b62bce45751e6029650dc6d8ac7b7925cc4177fb1772c6d842b5201f6834d5e6374016b4c42374660b1c127d5b021adffe873de0a4c484171b6b3 +$(DL_FILE)_BLAKE2 = 1671fe49f3add0087431b57aaa69d4c6280066a299e6899c00cd5bf6ec21380d1457295f884f683ebfb89959eea08a9d900e898a865e3f6ff2a82ecf354d974a install : $(TARGET) @@ -80,6 +80,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make all $(MAKETUNING) LOCAL_CONFIGURE_OPTIONS="--enable-readline=yes" cd $(DIR_APP) && make install + sed -i 's|^;||g' /etc/vnstat.conf sed -i 's|SaveInterval 5|SaveInterval 1|g' /etc/vnstat.conf sed -i 's|/var/lib/vnstat|/var/log/vnstat|g' /etc/vnstat.conf sed -i 's|/var/log/vnstat/vnstat.log|/var/log/vnstat.log|g' /etc/vnstat.conf -- 2.25.1

2 1

[PATCH] rsync: Update to 3.2.4
by Matthias Fischer 18 Apr '22

18 Apr '22

For details see: https://download.samba.org/pub/rsync/NEWS#3.2.4 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/rsync | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/rsync b/lfs/rsync index 7422a5d13..f40c28ce2 100644 --- a/lfs/rsync +++ b/lfs/rsync @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Versatile tool for fast incremental file transfer -VER = 3.2.3 +VER = 3.2.4 THISAPP = rsync-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = rsync -PAK_VER = 13 +PAK_VER = 14 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 085adb55d0d7e3d063fa198912fd09df67b63800a65baff5315ccb7dfc0e9d703eef30a7f2e72e3b271162c280abd9809b3f736704752c1663eed65ad8e0ac25 +$(DL_FILE)_BLAKE2 = a67fcb9619874f1c5346a876138e59f4bf508a90736f830fb2b4eaf180ab11f15a0a7db9b3b28c3b990b77c2b0973d8e668bf509e4134f464159ed3172f53d80 install : $(TARGET) -- 2.25.1

2 1

unbound 1.15.0 - problems with certain DoT(?) configurations
by Matthias Fischer 18 Apr '22

18 Apr '22

Hi, please note - I'm working on 'unbound 1.15.0' which was published yesterday, but it seems this version has some problems with DoT(?). See: => https://lists.nlnetlabs.nl/pipermail/unbound-users/2022-February/007669.html "It looks like with certain (dot?) configuration, 53/tcp becomes defunct on this version of unbound". I'm testing - no problems so far - under MY environment (see attached screenshot). Should we still wait? => Opinions!? Best, Matthias

3 2

← Newer
1
...
5
6
7
8
9
10
11
...
16
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2022