Development June 2022

development@lists.ipfire.org

15 participants
67 discussions

[PATCH] linux: Update to 5.15.46
by Peter Müller 13 Jun '22

13 Jun '22

Please refer to https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.46 for the changelog of this version. Due to operational constraints, ARM rootfile changes are simulated. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/aarch64/linux | 5 +- config/rootfiles/common/armv6l/linux | 4 +- config/rootfiles/common/x86_64/linux | 6 +- lfs/linux | 6 +- ...ayer7.patch => linux-5.15.46-layer7.patch} | 82 +++++++++---------- 5 files changed, 48 insertions(+), 55 deletions(-) rename src/patches/linux/{linux-5.15.17-layer7.patch => linux-5.15.46-layer7.patch} (94%) diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index a88af0a37..73177bd71 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -6878,6 +6878,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/CC_CAN_LINK #lib/modules/KVER-ipfire/build/include/config/CC_CAN_LINK_STATIC #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO +#lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO_TIED_OUTPUT #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO_OUTPUT #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_INLINE #lib/modules/KVER-ipfire/build/include/config/CC_HAS_BRANCH_PROT_PAC_RET @@ -7107,7 +7108,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/CRYPTO_KPP2 #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_AES #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_ARC4 -#lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_BLAKE2S #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_BLAKE2S_GENERIC #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_CHACHA #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_CHACHA20POLY1305 @@ -15293,7 +15293,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/trace/events/qdisc.h #lib/modules/KVER-ipfire/build/include/trace/events/qla.h #lib/modules/KVER-ipfire/build/include/trace/events/qrtr.h -#lib/modules/KVER-ipfire/build/include/trace/events/random.h #lib/modules/KVER-ipfire/build/include/trace/events/rcu.h #lib/modules/KVER-ipfire/build/include/trace/events/rdma.h #lib/modules/KVER-ipfire/build/include/trace/events/rdma_core.h @@ -20520,8 +20519,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/lib/crc8.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto #lib/modules/KVER-ipfire/kernel/lib/crypto/libarc4.ko.xz -#lib/modules/KVER-ipfire/kernel/lib/crypto/libblake2s-generic.ko.xz -#lib/modules/KVER-ipfire/kernel/lib/crypto/libblake2s.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libchacha.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libchacha20poly1305.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libcurve25519-generic.ko.xz diff --git a/config/rootfiles/common/armv6l/linux b/config/rootfiles/common/armv6l/linux index 11da0fb3c..e8e10463c 100644 --- a/config/rootfiles/common/armv6l/linux +++ b/config/rootfiles/common/armv6l/linux @@ -7317,6 +7317,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/CC_CAN_LINK #lib/modules/KVER-ipfire/build/include/config/CC_CAN_LINK_STATIC #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO +#lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO_TIED_OUTPUT #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO_OUTPUT #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_INLINE #lib/modules/KVER-ipfire/build/include/config/CC_HAS_KASAN_GENERIC @@ -7569,7 +7570,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/CRYPTO_KPP2 #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_AES #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_ARC4 -#lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_BLAKE2S #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_CHACHA #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_CHACHA20POLY1305 #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_CHACHA_GENERIC @@ -15743,7 +15743,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/trace/events/qdisc.h #lib/modules/KVER-ipfire/build/include/trace/events/qla.h #lib/modules/KVER-ipfire/build/include/trace/events/qrtr.h -#lib/modules/KVER-ipfire/build/include/trace/events/random.h #lib/modules/KVER-ipfire/build/include/trace/events/rcu.h #lib/modules/KVER-ipfire/build/include/trace/events/rdma.h #lib/modules/KVER-ipfire/build/include/trace/events/rdma_core.h @@ -20739,7 +20738,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/lib/crc8.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto #lib/modules/KVER-ipfire/kernel/lib/crypto/libarc4.ko.xz -#lib/modules/KVER-ipfire/kernel/lib/crypto/libblake2s.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libchacha.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libchacha20poly1305.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libcurve25519-generic.ko.xz diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index a578435d3..04e636046 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -6780,12 +6780,14 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/CC_CAN_LINK_STATIC #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO_OUTPUT +#lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_GOTO_TIED_OUTPUT #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ASM_INLINE #lib/modules/KVER-ipfire/build/include/config/CC_HAS_INT128 #lib/modules/KVER-ipfire/build/include/config/CC_HAS_KASAN_GENERIC #lib/modules/KVER-ipfire/build/include/config/CC_HAS_NO_PROFILE_FN_ATTR #lib/modules/KVER-ipfire/build/include/config/CC_HAS_SANCOV_TRACE_PC #lib/modules/KVER-ipfire/build/include/config/CC_HAS_SANE_STACKPROTECTOR +#lib/modules/KVER-ipfire/build/include/config/CC_HAS_SLS #lib/modules/KVER-ipfire/build/include/config/CC_HAS_WORKING_NOSANITIZE_ADDRESS #lib/modules/KVER-ipfire/build/include/config/CC_HAS_ZERO_CALL_USED_REGS #lib/modules/KVER-ipfire/build/include/config/CC_IS_GCC @@ -6999,7 +7001,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/CRYPTO_KPP2 #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_AES #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_ARC4 -#lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_BLAKE2S #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_BLAKE2S_GENERIC #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_CHACHA #lib/modules/KVER-ipfire/build/include/config/CRYPTO_LIB_CHACHA20POLY1305 @@ -15730,7 +15731,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/trace/events/qdisc.h #lib/modules/KVER-ipfire/build/include/trace/events/qla.h #lib/modules/KVER-ipfire/build/include/trace/events/qrtr.h -#lib/modules/KVER-ipfire/build/include/trace/events/random.h #lib/modules/KVER-ipfire/build/include/trace/events/rcu.h #lib/modules/KVER-ipfire/build/include/trace/events/rdma.h #lib/modules/KVER-ipfire/build/include/trace/events/rdma_core.h @@ -21621,8 +21621,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/lib/crc8.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto #lib/modules/KVER-ipfire/kernel/lib/crypto/libarc4.ko.xz -#lib/modules/KVER-ipfire/kernel/lib/crypto/libblake2s-generic.ko.xz -#lib/modules/KVER-ipfire/kernel/lib/crypto/libblake2s.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libchacha.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libchacha20poly1305.ko.xz #lib/modules/KVER-ipfire/kernel/lib/crypto/libcurve25519-generic.ko.xz diff --git a/lfs/linux b/lfs/linux index d9637ef94..df3b348d4 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 5.15.35 +VER = 5.15.46 ARM_PATCHES = 5.15-ipfire5 THISAPP = linux-$(VER) @@ -78,7 +78,7 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = 15f1af609ae4a233dc6bdae84c1231c2335be6320ddbb9a5d76c7983498a9ca72c13b55cc1408dac477f707fb84df99435994c1a7eeb91396481c2f7b11ecc2e +$(DL_FILE)_BLAKE2 = 26fdc4bbed153f7a5a511b7c1a804f794dd6e4b8b44d0317a4cad304b2c824183fd6054b7ca94f22b3e49e22a13ec9dbd24373b628b01bdcdb5392eafe6b3dbe arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 58a70e757a9121a0aac83604a37aa787ec7ac0ee4970c5a3ac3bcb2dbaca32b00089cae6c0da5cf2fe0a2e156427b5165c6a86e0371a3e896f4c7cdd699c34a0 install : $(TARGET) @@ -116,7 +116,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) ln -svf linux-$(VER) $(DIR_SRC)/linux # Layer7-patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.17-layer7.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.46-layer7.patch # DVB Patches cd $(DIR_APP) && patch -Np2 < $(DIR_SRC)/src/patches/v4l-dvb_fix_tua6034_pll.patch diff --git a/src/patches/linux/linux-5.15.17-layer7.patch b/src/patches/linux/linux-5.15.46-layer7.patch similarity index 94% rename from src/patches/linux/linux-5.15.17-layer7.patch rename to src/patches/linux/linux-5.15.46-layer7.patch index 0dafa16c7..d6b46142c 100644 --- a/src/patches/linux/linux-5.15.17-layer7.patch +++ b/src/patches/linux/linux-5.15.46-layer7.patch @@ -1,6 +1,6 @@ -diff -Naur a/include/linux/skbuff.h b/include/linux/skbuff.h ---- a/include/linux/skbuff.h 2022-01-27 10:05:44.000000000 +0000 -+++ b/include/linux/skbuff.h 2022-01-29 08:04:32.984637671 +0000 +diff -Naur linux-5.15.46.orig/include/linux/skbuff.h linux-5.15.46/include/linux/skbuff.h +--- linux-5.15.46.orig/include/linux/skbuff.h 2022-06-11 14:51:47.639775333 +0000 ++++ linux-5.15.46/include/linux/skbuff.h 2022-06-11 14:53:07.977494189 +0000 @@ -772,6 +772,9 @@ #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) unsigned long _nfct; @@ -11,10 +11,10 @@ diff -Naur a/include/linux/skbuff.h b/include/linux/skbuff.h unsigned int len, data_len; __u16 mac_len, -diff -Naur a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h ---- a/include/net/netfilter/nf_conntrack.h 2022-01-27 10:05:44.000000000 +0000 -+++ b/include/net/netfilter/nf_conntrack.h 2022-01-29 08:04:32.984637671 +0000 -@@ -117,6 +117,23 @@ +diff -Naur linux-5.15.46.orig/include/net/netfilter/nf_conntrack.h linux-5.15.46/include/net/netfilter/nf_conntrack.h +--- linux-5.15.46.orig/include/net/netfilter/nf_conntrack.h 2022-06-11 14:51:48.471834543 +0000 ++++ linux-5.15.46/include/net/netfilter/nf_conntrack.h 2022-06-11 14:53:07.977494189 +0000 +@@ -119,6 +119,23 @@ /* Extensions */ struct nf_ct_ext *ext; @@ -38,9 +38,9 @@ diff -Naur a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_con /* Storage reserved for other modules, must be the last member */ union nf_conntrack_proto proto; }; -diff -Naur a/include/uapi/linux/netfilter/xt_layer7.h b/include/uapi/linux/netfilter/xt_layer7.h ---- a/include/uapi/linux/netfilter/xt_layer7.h 1970-01-01 00:00:00.000000000 +0000 -+++ b/include/uapi/linux/netfilter/xt_layer7.h 2022-01-29 08:04:32.984637671 +0000 +diff -Naur linux-5.15.46.orig/include/uapi/linux/netfilter/xt_layer7.h linux-5.15.46/include/uapi/linux/netfilter/xt_layer7.h +--- linux-5.15.46.orig/include/uapi/linux/netfilter/xt_layer7.h 1970-01-01 00:00:00.000000000 +0000 ++++ linux-5.15.46/include/uapi/linux/netfilter/xt_layer7.h 2022-06-11 14:53:07.977494189 +0000 @@ -0,0 +1,13 @@ +#ifndef _XT_LAYER7_H +#define _XT_LAYER7_H @@ -55,9 +55,9 @@ diff -Naur a/include/uapi/linux/netfilter/xt_layer7.h b/include/uapi/linux/netfi +}; + +#endif /* _XT_LAYER7_H */ -diff -Naur a/net/netfilter/Kconfig b/net/netfilter/Kconfig ---- a/net/netfilter/Kconfig 2022-01-27 10:05:44.000000000 +0000 -+++ b/net/netfilter/Kconfig 2022-01-29 08:04:32.988637605 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/Kconfig linux-5.15.46/net/netfilter/Kconfig +--- linux-5.15.46.orig/net/netfilter/Kconfig 2022-06-11 14:51:48.599843652 +0000 ++++ linux-5.15.46/net/netfilter/Kconfig 2022-06-11 14:53:07.977494189 +0000 @@ -1389,6 +1389,26 @@ To compile it as a module, choose M here. If unsure, say N. @@ -85,9 +85,9 @@ diff -Naur a/net/netfilter/Kconfig b/net/netfilter/Kconfig config NETFILTER_XT_MATCH_LENGTH tristate '"length" match support' depends on NETFILTER_ADVANCED -diff -Naur a/net/netfilter/Makefile b/net/netfilter/Makefile ---- a/net/netfilter/Makefile 2022-01-27 10:05:44.000000000 +0000 -+++ b/net/netfilter/Makefile 2022-01-29 08:04:32.988637605 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/Makefile linux-5.15.46/net/netfilter/Makefile +--- linux-5.15.46.orig/net/netfilter/Makefile 2022-06-11 14:51:48.599843652 +0000 ++++ linux-5.15.46/net/netfilter/Makefile 2022-06-11 14:53:07.981494474 +0000 @@ -201,6 +201,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o @@ -96,10 +96,10 @@ diff -Naur a/net/netfilter/Makefile b/net/netfilter/Makefile obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o -diff -Naur a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c ---- a/net/netfilter/nf_conntrack_core.c 2022-01-27 10:05:44.000000000 +0000 -+++ b/net/netfilter/nf_conntrack_core.c 2022-01-29 08:04:32.992637539 +0000 -@@ -636,6 +636,11 @@ +diff -Naur linux-5.15.46.orig/net/netfilter/nf_conntrack_core.c linux-5.15.46/net/netfilter/nf_conntrack_core.c +--- linux-5.15.46.orig/net/netfilter/nf_conntrack_core.c 2022-06-11 14:51:48.599843652 +0000 ++++ linux-5.15.46/net/netfilter/nf_conntrack_core.c 2022-06-11 14:53:07.981494474 +0000 +@@ -648,6 +648,11 @@ */ nf_ct_remove_expectations(ct); @@ -111,24 +111,24 @@ diff -Naur a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core nf_ct_del_from_dying_or_unconfirmed_list(ct); local_bh_enable(); -diff -Naur a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c ---- a/net/netfilter/nf_conntrack_standalone.c 2022-01-27 10:05:44.000000000 +0000 -+++ b/net/netfilter/nf_conntrack_standalone.c 2022-01-29 08:04:32.992637539 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/nf_conntrack_standalone.c linux-5.15.46/net/netfilter/nf_conntrack_standalone.c +--- linux-5.15.46.orig/net/netfilter/nf_conntrack_standalone.c 2022-06-11 14:51:48.603843938 +0000 ++++ linux-5.15.46/net/netfilter/nf_conntrack_standalone.c 2022-06-11 14:54:23.322859367 +0000 @@ -370,6 +370,11 @@ ct_show_zone(s, ct, NF_CT_DEFAULT_ZONE_DIR); ct_show_delta_time(s, ct); -+#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE) ++ #if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE) + if(ct->layer7.app_proto) + seq_printf(s, "l7proto=%s ", ct->layer7.app_proto); -+#endif ++ #endif + - seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)); + seq_printf(s, "use=%u\n", refcount_read(&ct->ct_general.use)); if (seq_has_overflowed(s)) -diff -Naur a/net/netfilter/regexp/regexp.c b/net/netfilter/regexp/regexp.c ---- a/net/netfilter/regexp/regexp.c 1970-01-01 00:00:00.000000000 +0000 -+++ b/net/netfilter/regexp/regexp.c 2022-01-29 08:04:32.992637539 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regexp.c linux-5.15.46/net/netfilter/regexp/regexp.c +--- linux-5.15.46.orig/net/netfilter/regexp/regexp.c 1970-01-01 00:00:00.000000000 +0000 ++++ linux-5.15.46/net/netfilter/regexp/regexp.c 2022-06-11 14:53:07.985494758 +0000 @@ -0,0 +1,1197 @@ +/* + * regcomp and regexec -- regsub and regerror are elsewhere @@ -1327,9 +1327,9 @@ diff -Naur a/net/netfilter/regexp/regexp.c b/net/netfilter/regexp/regexp.c +#endif + + -diff -Naur a/net/netfilter/regexp/regexp.h b/net/netfilter/regexp/regexp.h ---- a/net/netfilter/regexp/regexp.h 1970-01-01 00:00:00.000000000 +0000 -+++ b/net/netfilter/regexp/regexp.h 2022-01-29 08:04:32.992637539 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regexp.h linux-5.15.46/net/netfilter/regexp/regexp.h +--- linux-5.15.46.orig/net/netfilter/regexp/regexp.h 1970-01-01 00:00:00.000000000 +0000 ++++ linux-5.15.46/net/netfilter/regexp/regexp.h 2022-06-11 14:53:07.985494758 +0000 @@ -0,0 +1,41 @@ +/* + * Definitions etc. for regexp(3) routines. @@ -1372,18 +1372,18 @@ diff -Naur a/net/netfilter/regexp/regexp.h b/net/netfilter/regexp/regexp.h +void regerror(char *s); + +#endif -diff -Naur a/net/netfilter/regexp/regmagic.h b/net/netfilter/regexp/regmagic.h ---- a/net/netfilter/regexp/regmagic.h 1970-01-01 00:00:00.000000000 +0000 -+++ b/net/netfilter/regexp/regmagic.h 2022-01-29 08:04:32.992637539 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regmagic.h linux-5.15.46/net/netfilter/regexp/regmagic.h +--- linux-5.15.46.orig/net/netfilter/regexp/regmagic.h 1970-01-01 00:00:00.000000000 +0000 ++++ linux-5.15.46/net/netfilter/regexp/regmagic.h 2022-06-11 14:53:07.985494758 +0000 @@ -0,0 +1,5 @@ +/* + * The first byte of the regexp internal "program" is actually this magic + * number; the start node begins in the second byte. + */ +#define MAGIC 0234 -diff -Naur a/net/netfilter/regexp/regsub.c b/net/netfilter/regexp/regsub.c ---- a/net/netfilter/regexp/regsub.c 1970-01-01 00:00:00.000000000 +0000 -+++ b/net/netfilter/regexp/regsub.c 2022-01-29 08:04:32.992637539 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regsub.c linux-5.15.46/net/netfilter/regexp/regsub.c +--- linux-5.15.46.orig/net/netfilter/regexp/regsub.c 1970-01-01 00:00:00.000000000 +0000 ++++ linux-5.15.46/net/netfilter/regexp/regsub.c 2022-06-11 14:53:07.985494758 +0000 @@ -0,0 +1,95 @@ +/* + * regsub @@ -1480,9 +1480,9 @@ diff -Naur a/net/netfilter/regexp/regsub.c b/net/netfilter/regexp/regsub.c + } + *dst++ = '\0'; +} -diff -Naur a/net/netfilter/xt_layer7.c b/net/netfilter/xt_layer7.c ---- a/net/netfilter/xt_layer7.c 1970-01-01 00:00:00.000000000 +0000 -+++ b/net/netfilter/xt_layer7.c 2022-01-29 08:04:32.992637539 +0000 +diff -Naur linux-5.15.46.orig/net/netfilter/xt_layer7.c linux-5.15.46/net/netfilter/xt_layer7.c +--- linux-5.15.46.orig/net/netfilter/xt_layer7.c 1970-01-01 00:00:00.000000000 +0000 ++++ linux-5.15.46/net/netfilter/xt_layer7.c 2022-06-11 14:53:07.985494758 +0000 @@ -0,0 +1,666 @@ +/* + Kernel module to match application layer (OSI layer 7) data in connections. -- 2.35.3

2 1

[PATCH] Kernel: Mitigate Straight-Line-Speculation on x86_64
by Peter Müller 13 Jun '22

13 Jun '22

See https://lwn.net/Articles/877845/ for the rationale behind this. The feature is currently only available on the x86_64 platform. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.x86_64-ipfire | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index b84698235..b88390314 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -322,6 +322,8 @@ CONFIG_X86_X2APIC=y CONFIG_X86_MPPARSE=y # CONFIG_GOLDFISH is not set CONFIG_RETPOLINE=y +CONFIG_CC_HAS_SLS=y +CONFIG_SLS=y # CONFIG_X86_CPU_RESCTRL is not set CONFIG_X86_EXTENDED_PLATFORM=y # CONFIG_X86_VSMP is not set -- 2.35.3

2 1

[PATCH] Kernel: Disable support for RPC dprintk debugging
by Peter Müller 13 Jun '22

13 Jun '22

This is solely needed for debugging of NFS issues. Due to the attack surface it introduces, grsecurity recommends to disable it; as we do not have a strict necessity for this feature, it is best to follow that recommendation for security reasons. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 3 +-- config/kernel/kernel.config.armv6l-ipfire | 3 +-- config/kernel/kernel.config.riscv64-ipfire | 3 +-- config/kernel/kernel.config.x86_64-ipfire | 3 +-- 4 files changed, 4 insertions(+), 8 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 6dfeae595..4cbb3604e 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -7433,7 +7433,6 @@ CONFIG_NFS_V4_SECURITY_LABEL=y CONFIG_NFS_FSCACHE=y # CONFIG_NFS_USE_LEGACY_DNS is not set CONFIG_NFS_USE_KERNEL_DNS=y -CONFIG_NFS_DEBUG=y CONFIG_NFS_DISABLE_UDP_SUPPORT=y # CONFIG_NFS_V4_2_READ_PLUS is not set CONFIG_NFSD=m @@ -7457,7 +7456,7 @@ CONFIG_SUNRPC_GSS=m CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_RPCSEC_GSS_KRB5=m # CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES is not set -CONFIG_SUNRPC_DEBUG=y +# CONFIG_SUNRPC_DEBUG is not set # CONFIG_CEPH_FS is not set CONFIG_CIFS=m # CONFIG_CIFS_STATS2 is not set diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index 1bb745a87..6347e2af2 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -7439,7 +7439,6 @@ CONFIG_NFS_V4_SECURITY_LABEL=y CONFIG_NFS_FSCACHE=y # CONFIG_NFS_USE_LEGACY_DNS is not set CONFIG_NFS_USE_KERNEL_DNS=y -CONFIG_NFS_DEBUG=y CONFIG_NFS_DISABLE_UDP_SUPPORT=y # CONFIG_NFS_V4_2_READ_PLUS is not set CONFIG_NFSD=m @@ -7463,7 +7462,7 @@ CONFIG_SUNRPC_GSS=m CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_RPCSEC_GSS_KRB5=m # CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES is not set -CONFIG_SUNRPC_DEBUG=y +# CONFIG_SUNRPC_DEBUG is not set # CONFIG_CEPH_FS is not set CONFIG_CIFS=m # CONFIG_CIFS_STATS2 is not set diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 2d1fdbd28..60aee16d4 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -6071,7 +6071,6 @@ CONFIG_NFS_V4_SECURITY_LABEL=y CONFIG_NFS_FSCACHE=y # CONFIG_NFS_USE_LEGACY_DNS is not set CONFIG_NFS_USE_KERNEL_DNS=y -CONFIG_NFS_DEBUG=y CONFIG_NFS_DISABLE_UDP_SUPPORT=y CONFIG_NFS_V4_2_READ_PLUS=y CONFIG_NFSD=m @@ -6095,7 +6094,7 @@ CONFIG_SUNRPC_GSS=m CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_RPCSEC_GSS_KRB5=m # CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES is not set -CONFIG_SUNRPC_DEBUG=y +# CONFIG_SUNRPC_DEBUG is not set # CONFIG_CEPH_FS is not set CONFIG_CIFS=m # CONFIG_CIFS_STATS2 is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index b84698235..f7b03831d 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -6847,7 +6847,6 @@ CONFIG_NFS_V4_SECURITY_LABEL=y CONFIG_NFS_FSCACHE=y # CONFIG_NFS_USE_LEGACY_DNS is not set CONFIG_NFS_USE_KERNEL_DNS=y -CONFIG_NFS_DEBUG=y CONFIG_NFS_DISABLE_UDP_SUPPORT=y CONFIG_NFS_V4_2_READ_PLUS=y CONFIG_NFSD=m @@ -6871,7 +6870,7 @@ CONFIG_SUNRPC_GSS=m CONFIG_SUNRPC_BACKCHANNEL=y CONFIG_RPCSEC_GSS_KRB5=m # CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES is not set -CONFIG_SUNRPC_DEBUG=y +# CONFIG_SUNRPC_DEBUG is not set # CONFIG_CEPH_FS is not set CONFIG_CIFS=m # CONFIG_CIFS_STATS2 is not set -- 2.35.3

2 1

[PATCH] lynis: Update to 3.0.8
by Peter Müller 11 Jun '22

11 Jun '22

Full changelog as retrived from https://cisofy.com/changelog/lynis/#308: - MALW-3274 - Detect McAfee VirusScan Command Line Scanner - PKGS-7346 Check Alpine Package Keeper (apk) - PKGS-7395 Check Alpine upgradeable packages - EOL for Alpine Linux 3.14 and 3.15 - AUTH-9408 - Check for pam_faillock as well (replacement for pam_tally2) - FILE-7524 - Test enhanced to support symlinks - HTTP-6643 - Support ModSecurity version 2 and 3 - KRNL-5788 - Only run relevant tests and improved logging - KRNL-5820 - Additional path for security/limits.conf - KRNL-5830 - Check for /var/run/needs_restarting (Slackware) - KRNL-5830 - Add a presence check for /boot/vmlinuz - PRNT-2308 - Bugfix that prevented test from storing values correctly - Extended location of PAM files for AARCH64 - Some messages in log improved Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/lynis | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/lynis b/lfs/lynis index bc6b29297..afc109945 100644 --- a/lfs/lynis +++ b/lfs/lynis @@ -26,7 +26,7 @@ include Config SUMMARY = Security and System auditing tool -VER = 3.0.7 +VER = 3.0.8 THISAPP = lynis-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = lynis -PAK_VER = 11 +PAK_VER = 12 DEPS = @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d9cddcba9c83ddee08ea38c8e80bf6f0a78179ad102673a876a1fe3d4544612e945d8637a8d026ce7bff72b09d6274223031e1cb6fc74596b2c65f0380fecd67 +$(DL_FILE)_BLAKE2 = 490bd6799619a4247c3fa68cc96f2f1fead651b23db0ffb512394960f8ca0360ab7f25d2bb8d9e742641558972e1fdd4b1e18d7de0d13007988276eed3a97b1f install : $(TARGET) -- 2.35.3

1 0

Duplicate ipsets listed with Locationblock changes.
by Rob Brewer 11 Jun '22

11 Jun '22

If I list the installed ipsets with 'ipset -n list' additional ipsets with the suffix 'v4' are sometimes listed. From what I can see this additional 'v4' list is the same size as the set without the 'v4' extension. For instance: with just code AR selected with location-block.cgi: [root@ipfire-dev2 ~]# ipset -n list ARv4 AR (code AR id duplicated) if I add code AT to AR and list the sets: [root@ipfire-dev2 ~]# ipset -n list AT AR (as expected) and now add code AW to the other 2: [root@ipfire-dev2 ~]# ipset -n list ARv4 AT AR ATv4 AW (now codes AR and AT are duplicated) I see this effect on both my core 167 boxes and wasn't aware of this problem before my upgrade from core 161. Rob

3 6

[PATCH] ovpnmain.cgi: correct spelling
by Jon Murphy 11 Jun '22

11 Jun '22

- change "coment" to "comment" Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index fd6d14ab3..c2558bd81 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2337,17 +2337,17 @@ else if ( $vpnsettings{'ENABLED'} eq 'on'){ print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n"; if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){ - print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n"; + print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Blue interface\r\n"; print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n"; } if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){ - print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n"; + print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n"; print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n"; } } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){ print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n"; if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){ - print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n"; + print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n"; print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n"; } } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){ -- 2.30.2

2 1

[PATCH] apache: Update to 2.4.54
by Matthias Fischer 09 Jun '22

09 Jun '22

Huge changelog, for details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.54 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/apache2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index 11c61580b..336151686 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.4.53 +VER = 2.4.54 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 44acd51a2c18ae66878d64922947f2f24f0ddf8a5fa70718f788572032e18dafd06888fed3cf559e63e2a9e69d9b0a8dcc79e11fc9d8f216b5b073f769494727 +$(DL_FILE)_BLAKE2 = be2ba2d33368f9dd619e36e63dd3635fbcf55773a539ac2840251bda04311f3eb535c08a37ab58d8b184c71e75b90b92e2bdc4e59c722cfb146de516f6e1ed04 install : $(TARGET) -- 2.25.1

2 1

[PATCH] unbound.conf: Aggressive NSEC is enabled by default since Unbound 1.15.0
by Peter Müller 07 Jun '22

07 Jun '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/unbound/unbound.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 9d5e840dd..012beab54 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -39,7 +39,6 @@ server: # Hardening Options harden-large-queries: yes harden-referral-path: yes - aggressive-nsec: yes # TLS tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt -- 2.35.3

1 0

[PATCH] tzdata: Update to 2022a
by Peter Müller 07 Jun '22

07 Jun '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/tzdata | 3 +++ lfs/tzdata | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/tzdata b/config/rootfiles/common/tzdata index 7531cfb64..f6903a057 100644 --- a/config/rootfiles/common/tzdata +++ b/config/rootfiles/common/tzdata @@ -563,6 +563,7 @@ usr/share/zoneinfo #usr/share/zoneinfo/Pacific/Guam #usr/share/zoneinfo/Pacific/Honolulu #usr/share/zoneinfo/Pacific/Johnston +#usr/share/zoneinfo/Pacific/Kanton #usr/share/zoneinfo/Pacific/Kiritimati #usr/share/zoneinfo/Pacific/Kosrae #usr/share/zoneinfo/Pacific/Kwajalein @@ -1179,6 +1180,7 @@ usr/share/zoneinfo #usr/share/zoneinfo/posix/Pacific/Guam #usr/share/zoneinfo/posix/Pacific/Honolulu #usr/share/zoneinfo/posix/Pacific/Johnston +#usr/share/zoneinfo/posix/Pacific/Kanton #usr/share/zoneinfo/posix/Pacific/Kiritimati #usr/share/zoneinfo/posix/Pacific/Kosrae #usr/share/zoneinfo/posix/Pacific/Kwajalein @@ -1795,6 +1797,7 @@ usr/share/zoneinfo #usr/share/zoneinfo/right/Pacific/Guam #usr/share/zoneinfo/right/Pacific/Honolulu #usr/share/zoneinfo/right/Pacific/Johnston +#usr/share/zoneinfo/right/Pacific/Kanton #usr/share/zoneinfo/right/Pacific/Kiritimati #usr/share/zoneinfo/right/Pacific/Kosrae #usr/share/zoneinfo/right/Pacific/Kwajalein diff --git a/lfs/tzdata b/lfs/tzdata index ac3a8dff1..34e7b9fd1 100644 --- a/lfs/tzdata +++ b/lfs/tzdata @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2021a +VER = 2022a TZDATA_VER = $(VER) TZCODE_VER = $(VER) @@ -45,8 +45,8 @@ objects = tzdata$(TZDATA_VER).tar.gz tzcode$(TZCODE_VER).tar.gz tzdata$(TZDATA_VER).tar.gz = $(DL_FROM)/tzdata$(TZDATA_VER).tar.gz tzcode$(TZCODE_VER).tar.gz = $(DL_FROM)/tzcode$(TZCODE_VER).tar.gz -tzdata$(TZDATA_VER).tar.gz_BLAKE2 = b8d177e90e22bd8a3fd23c9a9c19896cb245efd8e768b59ab8c63e56ab141e67331f3231e3a7c802f844375049cfd902e14e912ce677b3aea38fc0d968905e87 -tzcode$(TZCODE_VER).tar.gz_BLAKE2 = 4072685f2344602ffcfe32a7bf92d3b0d93e38ffca842f1c07a60db5e26f1f18ab32fc7b5f155b0bdab49f8d0bfcd5b58f4a192b4d06d7d9639893e5cb596328 +tzdata$(TZDATA_VER).tar.gz_BLAKE2 = 0af5b785a6f5d871b017237ad58d3d9bedd0de38cf18ac51b32cd8df9811215af7af913d8cd3966de695ce65df3f49f52e239196e93b953094763814cc56ecd0 +tzcode$(TZCODE_VER).tar.gz_BLAKE2 = f9b3bb5eedc51896c2a1dd77fe8118518c8a1f35152325fa6c4163e11dd34aeb0c88b16b17a27ad022feb2f6818996ec0e40e06a7e1edd454187f586c3739070 install : $(TARGET) -- 2.35.3

1 0

Can/should we prospectively drop various kernel capabilities related to firmware access?
by Peter Müller 07 Jun '22

07 Jun '22

Hello *, a while ago, we tried to enforce an "integrity" lockdown of the kernel by enabling LSM, and enforcing this mode through the kernel configuration. Ultimately, the latter was reverted due to firmware flashing rendered unusable, since direct PCI access, /dev/mem and various other sensitive functionalities were crippled by LSM. The other day, I stumbled across https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/, and would like to take this article as an opportunity to discuss the kernel capabilities we prospectively want to support in IPFire again. (A news comprehension of that article is, for example, available through https://www.bleepingcomputer.com/news/security/conti-ransomware-targeted-in….) It is not news that ordinary threat actors are capable of deploying UEFI/BIOS rootkits. The first UEFI rootkit used in the wild was spotted in 2018, and TrickBot features such capabilities since 2020 at the latest. To the best of my knowledge, non-state backed miscreants targeting things like Intel ME in "production", however, is a new development, and certainly a worrying one. When asked, we regularly state IPFire is not a general-purpose distribution, and anything being too far from the duties of a firewall should be run elsewhere. (In my perception, we do not state this bold enough, but let's leave that as it is for the time being.) Following this principle, I would like to see things such as the multimedia stack we currently support in IPFire 2.x go in IPFire 3.x. As for kernel capabilities and attack surface, dropping virtualisation support would cause a more noticeable improvement, but I am not sure if this is feasible even for IPFire 3.x. However, with regards to firmware flashing capabilities, I am quite torn: On the one hand, as stated in the aforementioned report, the threat of firmware implants being deployed by cybercrooks en masse particularly _stems_ from firmware being outdated, and even sensitive environments often remain vastly unpatched. Providing IPFire users with an easy possibility of updating their firmware therefore is a good thing, presumed they actually do so. (Which I doubt, given that even after five weeks, merely 40% of all IPFire installations run on an up-to-date Core Update, according to Fireinfo. With less than half of our userbase installing updates in a somewhat timely manner, I doubt the majority of them will even consider firmware updating.) On the other hand, if IPFire's kernel would lack abilities required to flash firmware, deployment of UEFI/BIOS rootkits and eventually Intel ME/SMM implants would be significantly hampered. From an academic standpoint, the little we support, the better. Though, again, regarding post-compromisation activity, we have always preached that IPFire is not intended to have any 3rd party code run on it. If an attacker manages to do this somehow, it's curtains either way. More skilled threat actors are likely to bring their own toolkit. In my opinion, making decisions for IPFire 3.x is a bit too early, with the Pakfire Build System being somewhat-ish working, and something like an 1.0 version of IPFire 3.x anticipated by the end of the year (unforeseen incidents not taken into account). However, I think it is good to have such debates on principles solved sooner rather than later, to avoid breaking changes to security concepts being introduced in production. :-) If anybody has some thoughts and opinions to share on this front, I am happy to hear them. Thanks, and best regards, Peter Müller

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2022