Development June 2022

development@lists.ipfire.org

15 participants
66 discussions

[PATCH] Postfix: Update to 3.7.2
by Peter Müller 19 Jun '22

19 Jun '22

Please refer to https://www.postfix.org/announcements/postfix-3.7.2.html for this versions' release announcement. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/postfix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/postfix b/lfs/postfix index 6fe12c9c8..d5fdadbbe 100644 --- a/lfs/postfix +++ b/lfs/postfix @@ -26,7 +26,7 @@ include Config SUMMARY = A fast, secure, and flexible mailer -VER = 3.7.1 +VER = 3.7.2 THISAPP = postfix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = postfix -PAK_VER = 35 +PAK_VER = 36 DEPS = @@ -70,7 +70,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d0bfdbc5105407e5143823e8e14b49e60d5c248eac435279a5fe803b370b46a56de9aff39fdf94398758863f753e43e889e2dffbb393ab63cf486d4fd3f5cf99 +$(DL_FILE)_BLAKE2 = 3f7aaba222b64274f756ea37b8ac06c29469d9183879deb4942a709d75783f4a8ca81204971b6658aba4b5bea46ed9c21b14e1f8fc6b613f257acd3aad16c170 install : $(TARGET) -- 2.35.3

2 1

[PATCH] Tor: Update to 0.4.7.8
by Peter Müller 19 Jun '22

19 Jun '22

Changes in version 0.4.7.8 - 2022-06-17 This version fixes several bugfixes including a High severity security issue categorized as a Denial of Service. Everyone running an earlier version should upgrade to this version. o Major bugfixes (congestion control, TROVE-2022-001): - Fix a scenario where RTT estimation can become wedged, seriously degrading congestion control performance on all circuits. This impacts clients, onion services, and relays, and can be triggered remotely by a malicious endpoint. Tracked as CVE-2022-33903. Fixes bug 40626; bugfix on 0.4.7.5-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on June 17, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/06/17. o Minor bugfixes (linux seccomp2 sandbox): - Allow the rseq system call in the sandbox. This solves a crash issue with glibc 2.35 on Linux. Patch from pmu-ipf. Fixes bug 40601; bugfix on 0.3.5.11. o Minor bugfixes (logging): - Demote a harmless warn log message about finding a second hop to from warn level to info level, if we do not have enough descriptors yet. Leave it at notice level for other cases. Fixes bug 40603; bugfix on 0.4.7.1-alpha. - Demote a notice log message about "Unexpected path length" to info level. These cases seem to happen arbitrarily, and we likely will never find all of them before the switch to arti. Fixes bug 40612; bugfix on 0.4.7.5-alpha. o Minor bugfixes (relay, logging): - Demote a harmless XOFF log message to from notice level to info level. Fixes bug 40620; bugfix on 0.4.7.5-alpha. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 9 +++------ ...Tor-Sandbox-permit-the-clone3-system-call.patch | 14 -------------- 2 files changed, 3 insertions(+), 20 deletions(-) delete mode 100644 src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch diff --git a/lfs/tor b/lfs/tor index e6751fb84..628ed63a2 100644 --- a/lfs/tor +++ b/lfs/tor @@ -26,7 +26,7 @@ include Config SUMMARY = Anonymizing overlay network for TCP (The onion router) -VER = 0.4.7.7 +VER = 0.4.7.8 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 69 +PAK_VER = 70 DEPS = libseccomp @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 18acfbe017b2ad456184f6031881149717f6fecad0d3e6daf90241a5a8ef296c32a36ace266d38b703f34b66d71e282c803f03f2059502c6ff6f4fdfb6641a97 +$(DL_FILE)_BLAKE2 = 40f6eab453d95a09e4531ce7cdb59715a21b84e1d0b1045d107add6a443fb7563a5747734b23e0e1dfda6490a5a7659f912e38c11cdb5fa635535dcff6169eeb install : $(TARGET) @@ -89,9 +89,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-tor-user=tor \ --with-tor-group=tor - # https://bugzilla.ipfire.org/show_bug.cgi?id=12807 - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch - cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch b/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch deleted file mode 100644 index 7e819ce73..000000000 --- a/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff -Naur tor-0.4.6.10.orig/src/lib/sandbox/sandbox.c tor-0.4.6.10/src/lib/sandbox/sandbox.c ---- tor-0.4.6.10.orig/src/lib/sandbox/sandbox.c 2022-04-09 07:58:00.281189564 +0000 -+++ tor-0.4.6.10/src/lib/sandbox/sandbox.c 2022-04-09 08:00:55.861698856 +0000 -@@ -151,6 +151,10 @@ - SCMP_SYS(clock_gettime), - SCMP_SYS(close), - SCMP_SYS(clone), -+#ifdef __NR_clone3 -+ SCMP_SYS(clone3), -+#endif -+ SCMP_SYS(rseq), - SCMP_SYS(dup), - SCMP_SYS(epoll_create), - SCMP_SYS(epoll_wait), -- 2.35.3

2 1

Source for perl-URI-Encode is missing
by Peter Müller 18 Jun '22

18 Jun '22

Hello Timo, I am sorry to inform you that the source tarball for perl-URI-Encode, a new package included with the OpenVPN 2FA conglomerate, is missing. As I was unable to find any source tarball online with the same checksum, please (a) upload the source tarball to source.ipfire.org and (b) drop me a line on where you got that tarball from - I will then include the URL in the LFS file, so this is somewhat documented. Kindly do so soon, as we are about to close Core Update 169 and the missing source currently breaks the build on all architectures. Thanks, and best regards, Peter Müller

2 2

Missing perl module Locale.pm
by Rob Brewer 17 Jun '22

17 Jun '22

Hi All, Core-upgrade-165 introduced a new version of /usr/lib/perl5/site_perl/5.32.1/LWP/UserAgent.pm This version UserAgent.pm has a dependency on Encode/Locale.pm which isn't included in Core Update 167. Can this module be included in the next upgrade? Regards Rob

2 2

[PATCH 1/2] krb5: Move package into core system.
by Stefan Schantl 17 Jun '22

17 Jun '22

On one hand, the key.dns_resolver binary is linked against libkrb5, so this library at least is required by the base system. On the other hand this easily allows different services on the firewall to use kerberos for authentication (ssh etc). Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/{packages => common}/krb5 | 0 lfs/cups | 4 ++-- lfs/krb5 | 4 ---- lfs/netatalk | 4 ++-- lfs/samba | 4 ++-- lfs/tshark | 4 ++-- 6 files changed, 8 insertions(+), 12 deletions(-) rename config/rootfiles/{packages => common}/krb5 (100%) diff --git a/config/rootfiles/packages/krb5 b/config/rootfiles/common/krb5 similarity index 100% rename from config/rootfiles/packages/krb5 rename to config/rootfiles/common/krb5 diff --git a/lfs/cups b/lfs/cups index cd4519b63..7d4dc20c2 100644 --- a/lfs/cups +++ b/lfs/cups @@ -33,9 +33,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/cups-$(VER) TARGET = $(DIR_INFO)/$(THISAPP) PROG = cups -PAK_VER = 25 +PAK_VER = 26 -DEPS = avahi cups-filters dbus ghostscript krb5 libtiff +DEPS = avahi cups-filters dbus ghostscript libtiff SERVICES = cups diff --git a/lfs/krb5 b/lfs/krb5 index 399f9338e..e08948005 100644 --- a/lfs/krb5 +++ b/lfs/krb5 @@ -33,10 +33,6 @@ DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP)/src TARGET = $(DIR_INFO)/$(THISAPP) -PROG = krb5 -PAK_VER = 7 - -DEPS = SERVICES = diff --git a/lfs/netatalk b/lfs/netatalk index 61ba193a5..ef75c89fe 100644 --- a/lfs/netatalk +++ b/lfs/netatalk @@ -34,9 +34,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = netatalk -PAK_VER = 2 +PAK_VER = 3 -DEPS = avahi dbus krb5 +DEPS = avahi dbus SERVICES = netatalk diff --git a/lfs/samba b/lfs/samba index 97fe96918..a48a0ecb1 100644 --- a/lfs/samba +++ b/lfs/samba @@ -33,9 +33,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 84 +PAK_VER = 85 -DEPS = avahi cups libtirpc krb5 perl-Parse-Yapp perl-JSON +DEPS = avahi cups libtirpc perl-Parse-Yapp perl-JSON SERVICES = samba diff --git a/lfs/tshark b/lfs/tshark index eb89f7474..ee9c06dc4 100644 --- a/lfs/tshark +++ b/lfs/tshark @@ -34,8 +34,8 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tshark -DEPS = krb5 c-ares -PAK_VER = 12 +DEPS = c-ares +PAK_VER = 13 SERVICES = -- 2.30.2

3 5

[PULL] OpenVPN Two-Factor Authentication
by Michael Tremer 17 Jun '22

17 Jun '22

The following changes since commit 7e4af6eb54bcbd1fa651610d8f0a99d86270042c: oath-toolkit: New package (2022-06-17 10:20:14 +0000) are available in the Git repository at: https://git.ipfire.org/pub/git/people/ms/ipfire-2.x.git openvpn-2fa for you to fetch changes up to 3740b7ad3ade3ff9d645bc3dca709791d012bbc2: ovpnmain.cgi: URI encode OTPAuth String in QRCode (2022-06-17 10:22:31 +0000) ---------------------------------------------------------------- Michael Tremer (19): qrencode: Rename package and update checksum oauth-toolkit: Update checksum and drop unnecessary fields perl-File-Remove: Update checksum and drop unnecessary fields perl-Imager: Update checksum and remove unnecessary fields perl-Imager-QRCode: Update checksum and remove unnecessary fields perl-MIME-Base32: Update checksum and remove unnecessary fields perl-Module-Build: Update checksum and remove unnecessary fields perl-Module-Install: Update checksum and remove unnecessary fields perl-Module-ScanDeps: Update checksum and remove unnecessary fields perl-YAML-Tiny: Update checksum and remove unnecessary fields openpvn-2fa: Fix rootfiles ovpnmain.cgi: Disable sending any error messages to the browser again ovpnmain.cgi: Load all modules at the beginning openvpn-2fa: Import a prototype of an authenticator openvpn-2fa: Drop the previous authentication handler openvpn-2fa: Enable management socket for RW server openvpn-2fa: Configure fake authentication credentials openvpn-authenticator: Don't process configuration when row is too short openvpn-authenticator: Always return general connection data Timo Eissler (19): libqrcode: New package perl-File-Remove: New package perl-Module-Build: New package perl-Module-ScanDeps: New package perl-YAML-Tiny: New package perl-Module-Install: New package perl-Imager: New package perl-Imager-QRCode: New package perl-MIME-Base32: New package OpenVPN: Add support for 2FA / One-Time Password ovpnmain.cgi: Fix comparison operators ovpnmain.cgi: Fix OTP secret handling openvpn-authenticator: Generate TOTP instead of HOTP codes openvpn-authenticator: Return only available data openvpn-authenticator: Fix call of _client_auth_successful openvpn-authenticator: Change event and environment handling ovpnmain.cgi: Remove trailing newline from OTP secret perl-URI-Encode: New package ovpnmain.cgi: URI encode OTPAuth String in QRCode config/httpd/vhosts.d/ipfire-interface-ssl.conf | 2 +- config/httpd/vhosts.d/ipfire-interface.conf | 2 +- config/ovpn/openvpn-authenticator | 381 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ config/rootfiles/{packages => common}/oath-toolkit | 4 +- config/rootfiles/common/openvpn | 1 + config/rootfiles/common/perl-File-Remove | 4 ++ config/rootfiles/common/perl-Imager | 165 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ config/rootfiles/common/perl-Imager-QRCode | 5 ++ config/rootfiles/common/perl-MIME-Base32 | 4 ++ config/rootfiles/common/perl-Module-Build | 51 +++++++++++++++++++ config/rootfiles/common/perl-Module-Install | 66 +++++++++++++++++++++++++ config/rootfiles/common/perl-Module-ScanDeps | 8 +++ config/rootfiles/common/perl-URI-Encode | 4 ++ config/rootfiles/common/perl-YAML-Tiny | 6 +++ config/rootfiles/common/qrencode | 8 +++ html/cgi-bin/ovpnmain.cgi | 93 +++++++++++++++++++++++++++++++++- html/html/images/qr-code.png | Bin 0 -> 760 bytes html/html/images/qr-code.svg | 49 ++++++++++++++++++ langs/de/cgi-bin/de.pl | 4 ++ langs/en/cgi-bin/en.pl | 4 ++ lfs/oath-toolkit | 15 +----- lfs/openvpn | 4 ++ lfs/perl-File-Remove | 80 ++++++++++++++++++++++++++++++ lfs/perl-Imager | 80 ++++++++++++++++++++++++++++++ lfs/perl-Imager-QRCode | 80 ++++++++++++++++++++++++++++++ lfs/perl-MIME-Base32 | 80 ++++++++++++++++++++++++++++++ lfs/perl-Module-Build | 80 ++++++++++++++++++++++++++++++ lfs/perl-Module-Install | 80 ++++++++++++++++++++++++++++++ lfs/perl-Module-ScanDeps | 79 +++++++++++++++++++++++++++++ lfs/perl-URI-Encode | 80 ++++++++++++++++++++++++++++++ lfs/perl-YAML-Tiny | 80 ++++++++++++++++++++++++++++++ lfs/qrencode | 80 ++++++++++++++++++++++++++++++ make.sh | 10 ++++ src/misc-progs/openvpnctrl.c | 21 ++++++++ 34 files changed, 1692 insertions(+), 18 deletions(-) create mode 100644 config/ovpn/openvpn-authenticator rename config/rootfiles/{packages => common}/oath-toolkit (99%) create mode 100644 config/rootfiles/common/perl-File-Remove create mode 100644 config/rootfiles/common/perl-Imager create mode 100644 config/rootfiles/common/perl-Imager-QRCode create mode 100644 config/rootfiles/common/perl-MIME-Base32 create mode 100644 config/rootfiles/common/perl-Module-Build create mode 100644 config/rootfiles/common/perl-Module-Install create mode 100644 config/rootfiles/common/perl-Module-ScanDeps create mode 100644 config/rootfiles/common/perl-URI-Encode create mode 100644 config/rootfiles/common/perl-YAML-Tiny create mode 100644 config/rootfiles/common/qrencode create mode 100644 html/html/images/qr-code.png create mode 100644 html/html/images/qr-code.svg create mode 100644 lfs/perl-File-Remove create mode 100644 lfs/perl-Imager create mode 100644 lfs/perl-Imager-QRCode create mode 100644 lfs/perl-MIME-Base32 create mode 100644 lfs/perl-Module-Build create mode 100644 lfs/perl-Module-Install create mode 100644 lfs/perl-Module-ScanDeps create mode 100644 lfs/perl-URI-Encode create mode 100644 lfs/perl-YAML-Tiny create mode 100644 lfs/qrencode

1 0

[PATCH] misc-progs: Add path to executable to argv
by Michael Tremer 17 Jun '22

17 Jun '22

Otherwise, the first argument would always be swollowed :( Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/misc-progs/setuid.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/misc-progs/setuid.c b/src/misc-progs/setuid.c index 831fb1f90..17b0e7066 100644 --- a/src/misc-progs/setuid.c +++ b/src/misc-progs/setuid.c @@ -61,10 +61,8 @@ static int system_core(char* command, char** args, uid_t uid, gid_t gid, char *e if(!command) return 1; -#if 0 // Add command as first element to argv argv[argc++] = command; -#endif // Add all other arguments if (args) { @@ -138,7 +136,7 @@ int safe_system(char* command) { NULL, }; - return system_core(argv[0], argv, 0, 0, "safe_system"); + return system_core(argv[0], argv + 1, 0, 0, "safe_system"); } /* Much like safe_system but lets you specify a non-root uid and gid to run @@ -151,7 +149,7 @@ int unpriv_system(char* command, uid_t uid, gid_t gid) { NULL, }; - return system_core(argv[0], argv, uid, gid, "unpriv_system"); + return system_core(argv[0], argv + 1, uid, gid, "unpriv_system"); } /* General routine to initialise a setuid root program, and put the -- 2.30.2

2 1

[PATCH] samba: Ship with CU169
by Adolf Belka 17 Jun '22

17 Jun '22

- samba is linked to liblber from openldap. openldap was updated in CU168 but I missed that samba had a dependency to one of its libraries. - find-dependencies was not run on openldap liblber although looking at the openldap rootfile it is clear that an sobump occurred. - This patch increments the samba PAK_VER so that it will be shipped and therefore have the library links updated. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/samba | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/samba b/lfs/samba index 97fe96918..896e7e71e 100644 --- a/lfs/samba +++ b/lfs/samba @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 84 +PAK_VER = 85 DEPS = avahi cups libtirpc krb5 perl-Parse-Yapp perl-JSON -- 2.36.1

2 1

[PATCH] netatalk: Ship with CU169 - Fixes bug #12878
by Adolf Belka 17 Jun '22

17 Jun '22

- netatalk is linked to liblber from openldap. openldap was updated in CU168 but I missed that netatalk had a dependency to one of its libraries. - find-dependencies was not run on openldap liblber although looking at the openldap rootfile it is clear that an sobump occurred. - This patch increments the netatalk PAK_VER so that it will be shipped and therefore have the library links updated. Fixes: Bug #12878 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/netatalk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/netatalk b/lfs/netatalk index 61ba193a5..9e8ce454b 100644 --- a/lfs/netatalk +++ b/lfs/netatalk @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = netatalk -PAK_VER = 2 +PAK_VER = 3 DEPS = avahi dbus krb5 -- 2.36.1

2 1

Problem updating python3-cryptography
by Adolf Belka 16 Jun '22

16 Jun '22

Hi All, I have gone through and updated all python3 modules that I found with a new version. Everything built fine except for python3-cryptography. I have gone through the log info and it seems to me, but I might be wrong, that wants pyasnl1 but it seems to be looking for asnl1. However I have not been able to figure out where it should be changed to correct this, if my interpretation is even right. I would appreciate any guidance/suggestions of what to look for. Log feedback for the build of cryptography is attached below. Regards, Adolf.

2 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2022