Development September 2022

development@lists.ipfire.org

14 participants
62 discussions

[PATCH 1/2] efivar: Update to version 38
by Adolf Belka 12 Sep '22

12 Sep '22

- Update from version 37 to 38 - Update of rootfile - mandoc is now a build dependency for efivar - Old compile fixes patches are no longer required with version 38 - Details for lfs build of version 38 obtained from Beyond Linux From Scratch - Changelog bug fixes Rework some makefile bits to make overriding some options simpler. by @vathpela in #140 Handle /sys/devices/virtual/{nvme-fabrics,nvme-subsystem} devices by @vathpela in #139 guids.S: Include <cet.h> when CET is enabled by @hjl-tools in #149 Fix /sys/block sysfs parsing for eMMC-s by @jwrdegoede in #150 Properly check mmap return error by @hannob in #152 Fix s{yt,ty}le typo in efi_get_variable(3) by @nabijaczleweli in #162 Handle NULL set_variable() by @lcp in #159 Fix parsing for nvme-subsystem devices by @dannf in #158 Attempt to fix the identified thread safety bugs by @vathpela in #155 Make thread-test depend on libefivar.so by @hjl-tools in #176 Upstream a local patch from rawhide by @frozencemetery in #177 Fix conversion from UTF8 to UCS2 by @freedge in #171 efivar: make docs match current code for 'efivar -A' by @vathpela in #178 Migrate CI to Github actions by @frozencemetery in #179 Add code of conduct by @frozencemetery in #180 Misc minor fixes by @vathpela in #182 Add efi_time_t declarations and helper functions. by @vathpela in #183 More misc fixes by @vathpela in #185 Run CI on more targets by @vathpela in #187 Coverity fixes 20211208 by @vathpela in #189 CI: run abicheck by @frozencemetery in #190 Fix linux virtual root device parsing by @vathpela in #188 efivar.spec.in: fix license to be valid SPDX by @frozencemetery in #192 Add efisecdb tooling by @vathpela in #184 Fix linker string comparison for dash by @frozencemetery in #194 Full changelog diff between version 37 and 38 is available in github repo https://github.com/rhboot/efivar/compare/37...38 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/x86_64/efivar | 15 +- lfs/efivar | 12 +- src/patches/efivar-37-compile-fixes-1.patch | 56 ------- src/patches/efivar-37-compile-fixes-2.patch | 168 -------------------- 4 files changed, 18 insertions(+), 233 deletions(-) delete mode 100644 src/patches/efivar-37-compile-fixes-1.patch delete mode 100644 src/patches/efivar-37-compile-fixes-2.patch diff --git a/config/rootfiles/common/x86_64/efivar b/config/rootfiles/common/x86_64/efivar index 4fd100167..e83c62d98 100644 --- a/config/rootfiles/common/x86_64/efivar +++ b/config/rootfiles/common/x86_64/efivar @@ -1,19 +1,30 @@ +usr/bin/efisecdb usr/bin/efivar #usr/include/efivar #usr/include/efivar/efiboot-creator.h #usr/include/efivar/efiboot-loadopt.h #usr/include/efivar/efiboot.h +#usr/include/efivar/efisec-secdb.h +#usr/include/efivar/efisec-types.h +#usr/include/efivar/efisec.h #usr/include/efivar/efivar-dp.h #usr/include/efivar/efivar-guids.h +#usr/include/efivar/efivar-time.h +#usr/include/efivar/efivar-types.h #usr/include/efivar/efivar.h #usr/lib/libefiboot.so usr/lib/libefiboot.so.1 -usr/lib/libefiboot.so.1.37 +usr/lib/libefiboot.so.1.38 +#usr/lib/libefisec.so +usr/lib/libefisec.so.1 +usr/lib/libefisec.so.1.38 #usr/lib/libefivar.so usr/lib/libefivar.so.1 -usr/lib/libefivar.so.1.37 +usr/lib/libefivar.so.1.38 #usr/lib/pkgconfig/efiboot.pc +#usr/lib/pkgconfig/efisec.pc #usr/lib/pkgconfig/efivar.pc +#usr/share/man/man1/efisecdb.1 #usr/share/man/man1/efivar.1 #usr/share/man/man3/efi_append_variable.3 #usr/share/man/man3/efi_del_variable.3 diff --git a/lfs/efivar b/lfs/efivar index c5d2c8f44..6a54ee091 100644 --- a/lfs/efivar +++ b/lfs/efivar @@ -24,7 +24,7 @@ include Config -VER = 37 +VER = 38 THISAPP = efivar-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 813d477d31562b773f6e19f20e9e237b94beed437ce221771770e7d46ff0e657530285f035dc942cc20609185be92dc50319bfe8e10dee642c8bd88403ef6ffe +$(DL_FILE)_BLAKE2 = 0b96f3d71ddc2246e6a11a5cd32af3d007823c4a283186a428c3f145cd74425a31bd22c4671ad1ab252a3c572991bb1698381cb8bdf51efcbebd62befdc6c070 install : $(TARGET) @@ -72,11 +72,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/efivar-37-compile-fixes-1.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/efivar-37-compile-fixes-2.patch - - # -Werror, not even once - cd $(DIR_APP) && sed -e "s/-Werror//g" -i gcc.specs + # fix an issue in Makefile causing the package to be rebuilt during installation + # obtained from https://linuxfromscratch.org/blfs/view/11.1/postlfs/efivar.html + cd $(DIR_APP) && sed '/prep :/a\\ttouch prep' -i src/Makefile cd $(DIR_APP) && make CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/efivar-37-compile-fixes-1.patch b/src/patches/efivar-37-compile-fixes-1.patch deleted file mode 100644 index f40942f45..000000000 --- a/src/patches/efivar-37-compile-fixes-1.patch +++ /dev/null @@ -1,56 +0,0 @@ -From b98ba8921010d03f46704a476c69861515deb1ca Mon Sep 17 00:00:00 2001 -From: Peter Jones <pjones(a)redhat.com> -Date: Mon, 7 Jan 2019 10:30:59 -0500 -Subject: [PATCH] dp.h: make format_guid() handle misaligned guid pointers - safely. - -GCC 9 adds -Werror=address-of-packed-member, which causes us to see the -build error reported at - https://bugzilla.opensuse.org/show_bug.cgi?id=1120862 . - -That bug report shows us the following: - -In file included from dp.c:26: -dp.h: In function 'format_vendor_helper': -dp.h:120:37: error: taking address of packed member of 'struct <anonymous>' may result in an unaligned pointer value [-Werror=address-of-packed-member] - 120 | format_guid(buf, size, off, label, &dp->hw_vendor.vendor_guid); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -dp.h:74:25: note: in definition of macro 'format_guid' - 74 | _rc = efi_guid_to_str(guid, &_guidstr); \ - | ^~~~ -cc1: all warnings being treated as errors - -This patch makes format_guid() use a local variable as a bounce buffer -in the case that the guid we're passed is aligned as chaotic neutral. - -Note that this only fixes this instance and there may be others that bz -didn't show because it exited too soon, and I don't have a gcc 9 build -in front of me right now. - -Signed-off-by: Peter Jones <pjones(a)redhat.com> ---- - src/dp.h | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/src/dp.h b/src/dp.h -index aa4e390..20cb608 100644 ---- a/src/dp.h -+++ b/src/dp.h -@@ -70,8 +70,15 @@ - #define format_guid(buf, size, off, dp_type, guid) ({ \ - int _rc; \ - char *_guidstr = NULL; \ -- \ -- _rc = efi_guid_to_str(guid, &_guidstr); \ -+ efi_guid_t _guid; \ -+ const efi_guid_t * const _guid_p = \ -+ likely(__alignof__(guid) == sizeof(guid)) \ -+ ? guid \ -+ : &_guid; \ -+ \ -+ if (unlikely(__alignof__(guid) == sizeof(guid))) \ -+ memmove(&_guid, guid, sizeof(_guid)); \ -+ _rc = efi_guid_to_str(_guid_p, &_guidstr); \ - if (_rc < 0) { \ - efi_error("could not build %s GUID DP string", \ - dp_type); \ diff --git a/src/patches/efivar-37-compile-fixes-2.patch b/src/patches/efivar-37-compile-fixes-2.patch deleted file mode 100644 index bbb6a99a3..000000000 --- a/src/patches/efivar-37-compile-fixes-2.patch +++ /dev/null @@ -1,168 +0,0 @@ -From c3c553db85ff10890209d0fe48fb4856ad68e4e0 Mon Sep 17 00:00:00 2001 -From: Peter Jones <pjones(a)redhat.com> -Date: Thu, 21 Feb 2019 15:20:12 -0500 -Subject: [PATCH] Fix all the places -Werror=address-of-packed-member catches. - -This gets rid of all the places GCC 9's -Werror=address-of-packed-member -flags as problematic. - -Fixes github issue #123 - -Signed-off-by: Peter Jones <pjones(a)redhat.com> ---- - src/dp-message.c | 6 ++++-- - src/dp.h | 12 ++++-------- - src/guid.c | 2 +- - src/include/efivar/efivar.h | 2 +- - src/ucs2.h | 27 +++++++++++++++++++-------- - 5 files changed, 29 insertions(+), 20 deletions(-) - -diff --git a/src/dp-message.c b/src/dp-message.c -index 3724e5f..9f96466 100644 ---- a/src/dp-message.c -+++ b/src/dp-message.c -@@ -620,11 +620,13 @@ _format_message_dn(char *buf, size_t size, const_efidp dp) - ) / sizeof(efi_ip_addr_t); - format(buf, size, off, "Dns", "Dns("); - for (int i=0; i < end; i++) { -- const efi_ip_addr_t *addr = &dp->dns.addrs[i]; -+ efi_ip_addr_t addr; -+ -+ memcpy(&addr, &dp->dns.addrs[i], sizeof(addr)); - if (i != 0) - format(buf, size, off, "Dns", ","); - format_ip_addr(buf, size, off, "Dns", -- dp->dns.is_ipv6, addr); -+ dp->dns.is_ipv6, &addr); - } - format(buf, size, off, "Dns", ")"); - break; -diff --git a/src/dp.h b/src/dp.h -index 20cb608..1f921d5 100644 ---- a/src/dp.h -+++ b/src/dp.h -@@ -71,13 +71,9 @@ - int _rc; \ - char *_guidstr = NULL; \ - efi_guid_t _guid; \ -- const efi_guid_t * const _guid_p = \ -- likely(__alignof__(guid) == sizeof(guid)) \ -- ? guid \ -- : &_guid; \ -- \ -- if (unlikely(__alignof__(guid) == sizeof(guid))) \ -- memmove(&_guid, guid, sizeof(_guid)); \ -+ const efi_guid_t * const _guid_p = &_guid; \ -+ \ -+ memmove(&_guid, guid, sizeof(_guid)); \ - _rc = efi_guid_to_str(_guid_p, &_guidstr); \ - if (_rc < 0) { \ - efi_error("could not build %s GUID DP string", \ -@@ -86,7 +82,7 @@ - _guidstr = onstack(_guidstr, \ - strlen(_guidstr)+1); \ - _rc = format(buf, size, off, dp_type, "%s", \ -- _guidstr); \ -+ _guidstr); \ - } \ - _rc; \ - }) -diff --git a/src/guid.c b/src/guid.c -index 306c9ff..3156b3b 100644 ---- a/src/guid.c -+++ b/src/guid.c -@@ -31,7 +31,7 @@ - extern const efi_guid_t efi_guid_zero; - - int NONNULL(1, 2) PUBLIC --efi_guid_cmp(const efi_guid_t *a, const efi_guid_t *b) -+efi_guid_cmp(const void * const a, const void * const b) - { - return memcmp(a, b, sizeof (efi_guid_t)); - } -diff --git a/src/include/efivar/efivar.h b/src/include/efivar/efivar.h -index 316891c..ad6449d 100644 ---- a/src/include/efivar/efivar.h -+++ b/src/include/efivar/efivar.h -@@ -128,7 +128,7 @@ extern int efi_symbol_to_guid(const char *symbol, efi_guid_t *guid) - - extern int efi_guid_is_zero(const efi_guid_t *guid); - extern int efi_guid_is_empty(const efi_guid_t *guid); --extern int efi_guid_cmp(const efi_guid_t *a, const efi_guid_t *b); -+extern int efi_guid_cmp(const void * const a, const void * const b); - - /* import / export functions */ - typedef struct efi_variable efi_variable_t; -diff --git a/src/ucs2.h b/src/ucs2.h -index dbb5900..edd8367 100644 ---- a/src/ucs2.h -+++ b/src/ucs2.h -@@ -23,16 +23,21 @@ - (((val) & ((mask) << (shift))) >> (shift)) - - static inline size_t UNUSED --ucs2len(const uint16_t * const s, ssize_t limit) -+ucs2len(const void *vs, ssize_t limit) - { - ssize_t i; -- for (i = 0; i < (limit >= 0 ? limit : i+1) && s[i] != (uint16_t)0; i++) -+ const uint16_t *s = vs; -+ const uint8_t *s8 = vs; -+ -+ for (i = 0; -+ i < (limit >= 0 ? limit : i+1) && s8[0] != 0 && s8[1] != 0; -+ i++, s8 += 2, s++) - ; - return i; - } - - static inline size_t UNUSED --ucs2size(const uint16_t * const s, ssize_t limit) -+ucs2size(const void *s, ssize_t limit) - { - size_t rc = ucs2len(s, limit); - rc *= sizeof (uint16_t); -@@ -69,10 +74,11 @@ utf8size(uint8_t *s, ssize_t limit) - } - - static inline unsigned char * UNUSED --ucs2_to_utf8(const uint16_t * const chars, ssize_t limit) -+ucs2_to_utf8(const void * const voidchars, ssize_t limit) - { - ssize_t i, j; - unsigned char *ret; -+ const uint16_t * const chars = voidchars; - - if (limit < 0) - limit = ucs2len(chars, -1); -@@ -124,10 +130,12 @@ ucs2_to_utf8(const uint16_t * const chars, ssize_t limit) - } - - static inline ssize_t UNUSED NONNULL(4) --utf8_to_ucs2(uint16_t *ucs2, ssize_t size, int terminate, uint8_t *utf8) -+utf8_to_ucs2(void *ucs2void, ssize_t size, int terminate, uint8_t *utf8) - { - ssize_t req; - ssize_t i, j; -+ uint16_t *ucs2 = ucs2void; -+ uint16_t val16; - - if (!ucs2 && size > 0) { - errno = EINVAL; -@@ -162,10 +170,13 @@ utf8_to_ucs2(uint16_t *ucs2, ssize_t size, int terminate, uint8_t *utf8) - val = utf8[i] & 0x7f; - i += 1; - } -- ucs2[j] = val; -+ val16 = val; -+ ucs2[j] = val16; -+ } -+ if (terminate) { -+ val16 = 0; -+ ucs2[j++] = val16; - } -- if (terminate) -- ucs2[j++] = (uint16_t)0; - return j; - }; - -- 2.37.2

2 3

[PATCH] fetchmail: Update to version 6.4.32
by Adolf Belka 12 Sep '22

12 Sep '22

- Update from version 6.4.19 to 6.4.32 - Update of rootfile not required - Changelog - range of security and bug fixes fetchmail-6.4.32 (released 2022-07-30, 31696 LoC): # FIXES: * Use configure to find rst2html, some systems install it only with .py suffix, others only without, and some install both. * Update README.maintainer # TRANSLATIONS: language translations were updated by these fine people: (in alphabetical order of language codes so as not to prefer people): * cs: Petr Pisar [Czech] * es: Cristian Othón Martínez Vera [Spanish] * ja: Takeshi Hamasaki [Japanese] * pl: Jakub Bogusz [Polish] * ro: Remus-Gabriel Chelu [Romanian] * sq: Besnik Bleta [Albanian] * sv: Göran Uddeborg [Swedish] fetchmail-6.4.31 (released 2022-07-16, 31694 LoC): # BUG FIXES: * Try to fix ./configure --with-ssl=... for systems that have multiple OpenSSL versions installed. Issues reported by Dennis Putnam. * The netrc parser now reports its errors to syslog or logfile when appropriate, previously it would always log to stderr. * Add error checking to .netrc parser. # CHANGES: * manpage: use .UR/.UE macros instead of .URL for URIs. * manpage: fix contractions. Found with FreeBSD's igor tool. * manpage: HTML now built with pandoc -> python-docutils (manServer.pl was dropped) fetchmail-6.4.30 (released 2022-04-26, 31666 LoC): # BREAKING CHANGES: * Bump wolfSSL minimum required version to 5.2.0 to pull in security fix. # CHANGES: * Using OpenSSL 1.* before 1.1.1n elicits a compile-time warning. * Using OpenSSL 3.* before 3.0.2 elicits a compile-time warning. * configure.ac was tweaked in order to hopefully fix cross-compilation issues report, and different patch suggested, by Fabrice Fontaine, https://gitlab.com/fetchmail/fetchmail/-/merge_requests/42 # TRANSLATIONS: language translations were updated by this fine person: * ro: Remus-Gabriel Chelu [Romanian] fetchmail-6.4.29 (released 2022-03-20, 31661 LoC): # TRANSLATIONS: language translations were updated by this fine person: * vi: Trần Ngọc Quân [Vietnamese] fetchmail-6.4.28 (released 2022-03-05, 31661 LoC): # DOCUMENTATION: * Fix a typo in the manual page, courtesy of Jeremy Petch. # TRANSLATIONS: language translations were updated by this fine person: * es: Cristian Othón Martínez Vera [Spanish] fetchmail-6.4.27 (released 2022-01-26, 31661 LoC): # BREAKING CHANGES: * Bump wolfSSL minimum required version to 5.1.1 to pull in security fix. # TRANSLATIONS: language translations were updated by this fine person: * ro: Remus-Gabriel Chelu [Romanian] fetchmail-6.4.26 (released 2021-12-26, 31661 LoC): # FIXES: * When using wolfSSL 5.0.0, work around a bug that appears to hit wolfSSL when receiving handshake records while still in SSL_peek(). Workaround is to read 1 byte and cache it, then call SSL_peek() again. This affects only some servers. https://github.com/wolfSSL/wolfssl/issues/4593 # TRANSLATIONS: language translations were updated by this fine person: * sr: Мирослав Николић (Miroslav Nikolić) [Serbian] fetchmail-6.4.25 (released 2021-12-10, 31653 LoC): # BREAKING CHANGES: * Since distributions continue patching for LibreSSL use, which cannot be linked legally, block out LibreSSL in configure.ac and socket.c, and refer to COPYING, unless on OpenBSD (which ships it in the base system). OpenSSL and wolfSSL 5 can be used. SSL-related documentation was updated, do re-read COPYING, INSTALL, README, README.packaging, README.SSL. * Bump OpenSSL version requirement to 1.0.2f in order to safely remove the obsolete OpenSSL flag SSL_OP_SINGLE_DH_USE. This blocks out 1.0.2e and older 1.0.2 versions. 1.0.2f was a security fix release, and 1.0.2u is publicly available from https://www.openssl.org/source/old/1.0.2/ * Some of the configure.ac fiddling MIGHT have broken cross-compilation again. The maintainer does not test cross-compiling fetchmail; if you have difficulties, try setting PKG_CONFIG_LIBDIR to the pkg-config path containing your target/host libraries, or see if --with-ssl-prefix or --with-wolfssl-prefix, or overriding LDFLAGS/LIBS/CPPFLAGS, can help. Feedback solicited on compliant systems that are before end-of-life. # BUG FIXES: * 6.4.24's workaround for OpenSSL 1.0.2's X509_V_FLAG_TRUSTED_FIRST flag contained a typo and would not kick in properly. * Library and/or rpath setting from configure.ac was fixed. # ADDITIONS: * Added an example systemd unit file and instructions to contrib/systemd/ which runs fetchmail as a daemon with 5-minute poll intervals. Courteously contributed by Barak A. Pearlmutter, Debian Bug#981464. * fetchmail can now be used with wolfSSL 5's OpenSSL compatibility layer, see INSTALL and README.SSL. This is considered experimental. Feedback solicited. # CHANGES: * The getstats.py dist-tool now counts lines of .ac and .am files. * ./configure --with-ssl now supports pkg-config module names, too. See INSTALL. # TRANSLATIONS: language translations were updated by these fine people: (in reverse alphabetical order of language codes so as not to prefer people): * sv: Göran Uddeborg [Swedish] * sq: Besnik Bleta [Albanian] * pl: Jakub Bogusz [Polish] * ja: Takeshi Hamasaki [Japanese] * fr: Frédéric Marchal [French] * eo: Keith Bowes [Esperanto] * cs: Petr Pisar [Czech] fetchmail-6.4.24 (released 2021-11-20, 30218 LoC): # OPENSSL AND LICENSING NOTE: > see fetchmail-6.4.22 below, and the file COPYING. Note that distribution of packages linked with LibreSSL is not feasible due to a missing GPLv2 clause 2(b) exception. # COMPATIBILITY: * Bison 3.8 dropped yytoknum altogether, breaking compilation due to a warning workaround. Remove the cast of yytoknum to void. This may cause a compiler warning to reappear with older Bison versions. * OpenSSL 1.0.2: Workaround for systems that keep the expired DST Root CA X3 certificate in its trust store because OpenSSL by default prefers the untrusted certificate and fails. Fetchmail now sets the X509_V_FLAG_TRUSTED_FIRST flag (on OpenSSL 1.0.2 only). This is workaround #2 from the OpenSSL Blog. For details, see both: https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ NOTE: OpenSSL 1.0.2 is end of life, it is assumed that the OpenSSL library is kept up to date by a distributor or via OpenSSL support contract. Where this is not the case, please upgrade to a supported OpenSSL version. # DOCUMENTATION: * The manual page was revised after re-checking with mandoc -Tlint, aspell, igor. Some more revisions were made for clarity. # TRANSLATIONS: language translations were updated by these fine people: * sv: Göran Uddeborg [Swedish] * pl: Jakub Bogusz [Polish] * fr: Frédéric Marchal [French] * cs: Petr Pisar [Czech] * eo: Keith Bowes [Esperanto] * ja: Takeshi Hamasaki [Japanese] fetchmail-6.4.23 (released 2021-10-31, 30206 LoC): # USABILITY: * For common ssh-based IMAP PREAUTH setups (i. e. those that use a plugin - no matter its contents - and that set auth ssh), change the STARTTLS error message to suggest sslproto '' instead. This is a commonly reported issue after the CVE-2021-39272 fix in 6.4.22. Fixes Redhat Bugzilla 2008160. Fixes GitLab #39. # TRANSLATIONS: language translations were updated by these fine people: * ja: Takeshi Hamasaki [Japanese] * sr: Мирослав Николић (Miroslav Nikolić) [Serbian] fetchmail-6.4.22 (released 2021-09-13, 30201 LoC): # OPENSSL AND LICENSING NOTE: * fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0. OpenSSL's licensing changed between these releases from dual OpenSSL/SSLeay license to Apache License v2.0, which is considered incompatible with GPL v2 by the FSF. For implications and details, see the file COPYING. # SECURITY FIXES: * CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections, without --ssl and with nonempty --sslproto, meaning that fetchmail is to enforce TLS, and when the server or an attacker sends a PREAUTH greeting, fetchmail used to continue an unencrypted connection. Now, log the error and abort the connection. --Recommendation for servers that support SSL/TLS-wrapped or "implicit" mode on a dedicated port (default 993): use --ssl, or the ssl user option in an rcfile. --Reported by: Andrew C. Aitchison, based on the USENIX Security 21 paper "Why TLS is better without STARTTLS - A Security Analysis of STARTTLS in the Email Context" by Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian Schinzel. The paper did not mention fetchmail. * On IMAP and POP3 connections, --auth ssh no longer prevents STARTTLS negotiation. * On IMAP connections, fetchmail does not permit overriding a server-side LOGINDISABLED with --auth password any more. * On POP3 connections, the possibility for RPA authentication (by probing with an AUTH command without arguments) no longer prevents STARTTLS negotiation. * For POP3 connections, only attempt RPA if the authentication type is "any". # BUG FIXES: * On IMAP connections, when AUTHENTICATE EXTERNAL fails and we have received the tagged (= final) response, do not send "*". * On IMAP connections, AUTHENTICATE EXTERNAL without username will properly send a "=" for protocol compliance. * On IMAP connections, AUTHENTICATE EXTERNAL will now check if the server advertised SASL-IR (RFC-4959) support and otherwise refuse (fetchmail <= 6.4 has not supported and does not support the separate challenge/response with command continuation) * On IMAP connections, when --auth external is requested but not advertised by the server, log a proper error message. * Fetchmail no longer crashes when attempting a connection with --plugin "" or --plugout "". * Fetchmail no longer leaks memory when processing the arguments of --plugin or --plugout on connections. * On POP3 connections, the CAPAbilities parser is now caseblind. * Fix segfault on configurations with "defaults ... no envelope". Reported by Bjørn Mork. Fixes Debian Bug#992400. This is a regression in fetchmail 6.4.3 and happened when plugging memory leaks, which did not account for that the envelope parameter is special when set as "no envelope". The segfault happens in a constant strlen(-1), triggered by trusted local input => no vulnerability. * Fix program abort (SIGABRT) with "internal error" when invalid sslproto is given with OpenSSL 1.1.0 API compatible SSL implementations. # CHANGES: * IMAP: When fetchmail is in not-authenticated state and the server volunteers CAPABILITY information, use it and do not re-probe. (After STARTTLS, fetchmail must and will re-probe explicitly.) * For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl option do not match, emit a warning and continue. Closes Gitlab #31. (cherry-picked from 6.5 beta branch "legacy_6x") * fetchmail.man and README.SSL were updated in line with RFC-8314/8996/8997 recommendations to prefer Implicit TLS (--ssl/ssl) and TLS v1.2 or newer, placing --sslproto tls1.2+ more prominently. The defaults shall not change between 6.4.X releases for compatibility. # TRANSLATIONS: language translations were updated by these fine people: * sq: Besnik Bleta [Albanian] * cs: Petr Pisar [Czech] * eo: Keith Bowes [Esperanto] * fr: Frédéric Marchal [French] * pl: Jakub Bogusz [Polish] * sv: Göran Uddeborg [Swedish] fetchmail-6.4.21 (released 2021-08-09, 30042 LoC): # REGRESSION FIX: * The new security fix in 6.4.20 for CVE-2021-36386 caused truncation of messages logged to buffered outputs, from --logfile and --syslog. This also caused lines in the logfile to run into one another because the fragment containing the '\n' line-end character was usually lost. Reason is that on all modern systems (with <stdarg.h> header and vsnprintf() interface), the length of log message fragments was added up twice, so that these ended too deep into a freshly allocated buffer, after the '\0' byte. Unbuffered outputs flushed the fragments right away, which masked the bug. fetchmail-6.4.20 (released 2021-07-28, 30042 LoC): # SECURITY FIX: * When a log message exceeds c. 2 kByte in size, for instance, with very long header contents, and depending on verbosity option, fetchmail can crash or misreport each first log message that requires a buffer reallocation. fetchmail then reallocates memory and re-runs vsnprintf() without another call to va_start(), so it reads garbage. The exact impact depends on many factors around the compiler and operating system configurations used and the implementation details of the stdarg.h interfaces of the two functions mentioned before. To fix CVE-2021-36386. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/fetchmail | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/fetchmail b/lfs/fetchmail index 00ee6a634..6a4860e32 100644 --- a/lfs/fetchmail +++ b/lfs/fetchmail @@ -26,7 +26,7 @@ include Config SUMMARY = Full-Featured POP and IMAP Mail Retrieval Daemon -VER = 6.4.19 +VER = 6.4.32 THISAPP = fetchmail-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = fetchmail -PAK_VER = 11 +PAK_VER = 12 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 679d2c49698dd368d32439a8276412e3f32c0a0f6f0e7607bc323c0294c987307469451b4b085fe521f2d5dd4869d59b4841762b6a57b3c654b992e9de8ba87c +$(DL_FILE)_BLAKE2 = 5d6311c46053abc2e5b040273f04d9df5e737dcd938d1370bcd84415e422ec6a05126ecb59efcad9254e37338671cf7bfa224ea1015b83e8e93483cbeb033b7a install : $(TARGET) -- 2.37.2

2 1

[PATCH] iproute2: Update to version 5.19.0
by Adolf Belka 12 Sep '22

12 Sep '22

- Update from 5.17.0 to 5.19.0 - Update of rootfile - Changelog is only available as the lsit fo commits from the git repository https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/ Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/iproute2 | 1 + lfs/iproute2 | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/iproute2 b/config/rootfiles/common/iproute2 index 0247aa976..11174bd4e 100644 --- a/config/rootfiles/common/iproute2 +++ b/config/rootfiles/common/iproute2 @@ -83,6 +83,7 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/ip-route.8 #usr/share/man/man8/ip-rule.8 #usr/share/man/man8/ip-sr.8 +#usr/share/man/man8/ip-stats.8 #usr/share/man/man8/ip-tcp_metrics.8 #usr/share/man/man8/ip-token.8 #usr/share/man/man8/ip-tunnel.8 diff --git a/lfs/iproute2 b/lfs/iproute2 index 489db23c2..39c2b60ab 100644 --- a/lfs/iproute2 +++ b/lfs/iproute2 @@ -24,7 +24,7 @@ include Config -VER = 5.17.0 +VER = 5.19.0 THISAPP = iproute2-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4310829ebbde7fd21ecc28856deddabfa93f26bf7937b3ef3c0e05e4e0bf925a9b167334efaefe3e275d196e7370a290679739ae8d8397dc6511f4da25dfd459 +$(DL_FILE)_BLAKE2 = ee287065d7c33c0fa97f0fc130bb3a4a3ad5ac9417ad74ce8489e64ec146ff97749d79bb6563043c8835eab91a51631576441d450693cb50808ad0d37b2ea648 install : $(TARGET) -- 2.37.2

2 1

[PATCH] nettle: Update to version 3.8.1
by Adolf Belka 12 Sep '22

12 Sep '22

- Update from version 3.7.3 to 3.8.1 - Update of rootfile - Changelog 3.8.1 release This is a bugfix release, fixing a few portability issues reported for Nettle-3.8. Bug fixes: * Avoid non-posix m4 argument references in the chacha implementation for arm64, powerpc64 and s390x. Reported by Christian Weisgerber, fix contributed by Mamone Tarsha. * Use explicit .machine pseudo-ops where needed in s390x assembly files. Bug report by Andreas K. Huettel, fix contributed by Mamone Tarsha. Optimizations: * Implemented runtime detection of cpu features for OpenBSD on arm64. Contributed by Christian Weisgerber. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.6 and libhogweed.so.6.6, with sonames libnettle.so.8 and libhogweed.so.6. 3.8 release This release includes a couple of new features, and many performance improvements. It adds assembly code for two more architectures: ARM64 and S390x. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.5 and libhogweed.so.6.5, with sonames libnettle.so.8 and libhogweed.so.6. New features: * AES keywrap (RFC 3394), contributed by Nicolas Mora. * SM3 hash function, contributed by Tianjia Zhang. * New functions cbc_aes128_encrypt, cbc_aes192_encrypt, cbc_aes256_encrypt. On processors where AES is fast enough, e.g., x86_64 with aesni instructions, the overhead of using Nettle's general cbc_encrypt can be significant. The new functions can be implemented in assembly, to do multiple blocks with reduced per-block overhead. Note that there's no corresponding new decrypt functions, since the general cbc_decrypt doesn't suffer from the same performance problem. Bug fixes: * Fix fat builds for x86_64 windows, these appear to never have worked. Optimizations: * New ARM64 implementation of AES, GCM, Chacha, SHA1 and SHA256, for processors supporting crypto extensions. Great speedups, and fat builds are supported. Contributed by Mamone Tarsha. * New s390x implementation of AES, GCM, Chacha, memxor, SHA1, SHA256, SHA512 and SHA3. Great speedups, and fat builds are supported. Contributed by Mamone Tarsha. * New PPC64 assembly for ecc modulo/redc operations, contributed by Amitay Isaacs, Martin Schwenke and Alastair D´Silva. * The x86_64 AES implementation using aesni instructions has been reorganized with one separate function per key size, each interleaving the processing of two blocks at a time (when the caller processes multiple blocks with each call). This gives a modest performance improvement on some processors. * Rewritten and faster x86_64 poly1305 assembly. Known issues: * Nettle's testsuite doesn't work out-of-the-box on recent MacOS, due to /bin/sh discarding the DYLD_LIBRARY_PATH environment variable. Nettle's test scripts handle this in some cases, but currently fails the test cases that are themselves written as /bin/sh scripts. As a workaround, use make check EMULATOR='env DYLD_LIBRARY_PATH=$(TEST_SHLIB_DIR)' Miscellaneous: * Updated manual to current makeinfo conventions, with no explicit node pointers. Generate pdf version with texi2pdf, to get working hyper links. * Added square root functions for NIST ecc curves, as a preparation for supporting compact point representation. * Reworked internal GCM/ghash interfaces, simplifying assembly implementations. Deleted unused GCM C implementation variants with less than 8-bit lookup table. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/nettle | 6 ++++-- lfs/nettle | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/nettle b/config/rootfiles/common/nettle index cf1165e80..a9f8aca43 100644 --- a/config/rootfiles/common/nettle +++ b/config/rootfiles/common/nettle @@ -47,6 +47,7 @@ #usr/include/nettle/memxor.h #usr/include/nettle/nettle-meta.h #usr/include/nettle/nettle-types.h +#usr/include/nettle/nist-keywrap.h #usr/include/nettle/pbkdf2.h #usr/include/nettle/pgp.h #usr/include/nettle/pkcs1.h @@ -64,6 +65,7 @@ #usr/include/nettle/sha2.h #usr/include/nettle/sha3.h #usr/include/nettle/siv-cmac.h +#usr/include/nettle/sm3.h #usr/include/nettle/streebog.h #usr/include/nettle/twofish.h #usr/include/nettle/umac.h @@ -72,9 +74,9 @@ #usr/include/nettle/yarrow.h usr/lib/libhogweed.so usr/lib/libhogweed.so.6 -usr/lib/libhogweed.so.6.4 +usr/lib/libhogweed.so.6.6 #usr/lib/libnettle.so usr/lib/libnettle.so.8 -usr/lib/libnettle.so.8.4 +usr/lib/libnettle.so.8.6 #usr/lib/pkgconfig/hogweed.pc #usr/lib/pkgconfig/nettle.pc diff --git a/lfs/nettle b/lfs/nettle index 0c3657df9..779b87199 100644 --- a/lfs/nettle +++ b/lfs/nettle @@ -24,7 +24,7 @@ include Config -VER = 3.7.3 +VER = 3.8.1 THISAPP = nettle-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 8d8efbbff98fc1f3eff3296681d3d72346e78392f356aebfe80138ae6ae1ebf3695bd7f74b906beef0cf3625ba6d84bdb43c0f6707f54f4d98870d50c90ac9a3 +$(DL_FILE)_BLAKE2 = 22b4ec81645b579504356597ba87b637e46285682020c90e03ecaea386ac9b48eaf91ee76ae3b86b6060be355de20c320ab3b74958074ad23fc08ad9ab6a4cbb install : $(TARGET) -- 2.37.2

2 1

[PATCH] elfutils: Update to version 0.187
by Adolf Belka 12 Sep '22

12 Sep '22

- Update from version 0.186 to 0.187 - Update of rootfile - Changelog 0.187 * NEWS * debuginfod: Support -C option for connection thread pooling. debuginfod-client: Negative cache file are now zero sized instead of no-permission files. addr2line: The -A, --absolute option, which shows file names including the full compilation directory is now the default. To get the old behavior use the new option --relative. readelf, elflint: Recognize FDO Packaging Metadata ELF notes libdw, debuginfo-client: Load libcurl lazily only when files need to be fetched remotely. libcurl is now never loaded when DEBUGINFOD_URLS is unset. And when DEBUGINFOD_URLS is set, libcurl is only loaded when the debuginfod_begin function is called. * GIT SHORTLOG * debuginfod: Include "IPv4 IPv6" in server startup message PR29022: 000-permissions files cause problems for backups debuginfod: Use the debuginfod-size response header debuginfod: ensure X-DEBUGINFOD-SIZE contains file size config: simplify profile.*sh.in debuginfod/debuginfod-client.c: use long for cache time configurations readelf: Don't consider padding DT_NULL as dynamic section entry debuginfod: correct concurrency bug in fdcache metrics PR28661: debuginfo connection thread pool support man debuginfod-client-config.7: Elaborate $DEBUGINFOD_URLS PR28708: debuginfod: use MHD_USE_EPOLL for microhttpd threads debuginfod: use single ipv4+ipv6 microhttpd daemon configuration AUTHORS: Use generator script & git mailmap libebl: recognize FDO Packaging Metadata ELF note tests: Don't set DEBUGINFOD_TIMEOUT tests: Add -rdynamic to dwfl_proc_attach_LDFLAGS debuginfod: Use gmtime_r instead of gmtime to avoid data race debuginfod: sqlite3_sharedprefix_fn should not compare past end of string debuginfod: Fix some memory leaks on debuginfod-client error paths. debuginfod: Clear and reset debuginfod_client winning_headers on reuse libdwfl: Don't read beyond end of file in dwfl_segment_report_module debuginfod: Check result of calling MHD_add_response_header. readelf: Workaround stringop-truncation error tests: varlocs workaround format-overflow errors debuginfod: Fix debuginfod_pool leak configure: Add --enable-sanitize-address debuginfod: Don't format clog using 'right' or 'setw(20)'. libdwfl: Don't try to convert too many bytes in dwfl_link_map_report libdwfl: Make sure we know the phdr entry size before searching phdrs. libdwfl: Don't trust e_shentsize in dwfl_segment_report_module libdwfl: Don't install an Elf handle in a Dwfl_Module twice libdwfl: Don't try to convert too many dyns in dwfl_link_map_report libdwfl: Don't allocate more than SIZE_MAX in dwfl_segment_report_module. libelf: Use offsetof to get field of unaligned libdwfl: Make sure phent is sane and there is at least one phdr libdwfl: Add overflow check while iterating in dwfl_segment_report_module tests: Use /bin/sh instead of /bin/ls as always there binary libdwfl: Make sure there is at least one dynamic entry libdwfl: Make sure there is at least one phdr libdwfl: Make sure note data is properly aligned. libdwfl: Make dwfl_segment_report_module aware of maximum Elf size libdwfl: Make sure the note len increases each iteration libelf: Only set shdr state when there is at least one shdr libdwfl: Make sure that ph_buffer_size has room for at least one phdr libdwfl: Make sure dyn_filesz has a sane size libdwfl: Rewrite GElf_Nhdr reading in dwfl_segment_report_module libdwfl: Handle unaligned Ehdr in dwfl_segment_report_module libdwfl: Handle unaligned Phdr in dwfl_segment_report_module libdwfl: Handle unaligned Nhdr in dwfl_segment_report_module libdwfl: Always clean up build_id.memory libdwfl: Make sure dwfl_elf_phdr_memory_callback returns at least minread libdwfl: Call xlatetom on aligned buffers in dwfl_link_map_report libdwfl: Calculate addr to read by hand in link_map.c read_addrs. libdwfl: Fix overflow check in link_map.c read_addrs libdwfl: Handle unaligned Dyns in dwfl_segment_report_module libdwfl: Declare possible zero sized arrays only when non-zero backends: Use PTRACE_GETREGSET for ppc_set_initial_registers_tid configure: Test for _FORTIFY_SOURCE=3 support. addr2line: Make --absolute the default, add --relative option. configure: Use AS_HELP_STRING instead of AC_HELP_STRING. libelf: Take map offset into account for Shdr alignment check in elf_begin libelf: Make sure ar_size starts with a digit before calling atol. libelf: Check alignment of Verdef, Verdaux, Verneed and Vernaux offsets libdwfl: Close ar members when they cannot be processed. libdwfl: Use memcpy to assign image header field values libelf: Don't overflow offsets in elf_cvt_Verneed and elf_cvt_Verdef libelf: Correct alignment of ELF_T_GNUHASH data for ELFCLASS64 tests: Check addsections test binary is 64bit for run-large-elf-file.sh configure: Don't check whether -m64 works for 32bit host biarch check libelf: Sync elf.h from glibc. elflint: Recognize NT_FDO_PACKAGING_METADATA Introduce error_exit as a noreturn variant of error (EXIT_FAILURE, ...) libelf: Also copy/convert partial datastructures in xlate functions libelf: Return already gotten Elf_Data from elf_getdata_rawchunk config: Add versioned requires on libs/libelf for debuginfod-client libdw: Add DWARF5 package file section identifiers, DW_SECT_* tests: Don't try to corrupt sqlite database during test. libdw: Remove unused atomics.h include from libdwP.h readelf: Define dyn_mem outside the while loop. tests: Lower parallel lookups in run-debuginfod-webapi-concurrency.sh debuginfod: Use MHD_USE_ITC in MHD_start_daemon flags elfclassify: Fix --no-stdin flag libelf: Check for mremap, elf_update needs it for ELF_C_RDWR_MMAP debuginfod, libdwfl: Initialize libcurl and dlopen debuginfod-client lazily dwfl: fix potential overflow when reporting on kernel modules debuginfod: fix compilation on platforms without <error.h> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/elfutils | 7 +++---- lfs/elfutils | 6 +++--- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/packages/elfutils b/config/rootfiles/packages/elfutils index 51b169279..fe2c8f301 100644 --- a/config/rootfiles/packages/elfutils +++ b/config/rootfiles/packages/elfutils @@ -27,15 +27,15 @@ usr/bin/eu-unstrip #usr/include/gelf.h #usr/include/libelf.h #usr/include/nlist.h -usr/lib/libasm-0.186.so +usr/lib/libasm-0.187.so #usr/lib/libasm.a #usr/lib/libasm.so usr/lib/libasm.so.1 -usr/lib/libdw-0.186.so +usr/lib/libdw-0.187.so #usr/lib/libdw.a #usr/lib/libdw.so usr/lib/libdw.so.1 -usr/lib/libelf-0.186.so +usr/lib/libelf-0.187.so #usr/lib/libelf.a #usr/lib/libelf.so usr/lib/libelf.so.1 @@ -54,4 +54,3 @@ usr/lib/libelf.so.1 #usr/share/man/man3/elf_clone.3 #usr/share/man/man3/elf_getdata.3 #usr/share/man/man3/elf_update.3 - diff --git a/lfs/elfutils b/lfs/elfutils index 83c299fb4..523980f17 100644 --- a/lfs/elfutils +++ b/lfs/elfutils @@ -26,7 +26,7 @@ include Config SUMMARY = Higher-level library to access ELF files -VER = 0.186 +VER = 0.187 THISAPP = elfutils-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = elfutils -PAK_VER = 7 +PAK_VER = 8 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 49573d0a1f3519eab81d1ba3e94354cbc0935a36a94a3fdb22fe223a47b78cca8fd6e322870b0e335a809529fa6f54180b13c67936dec0242123c54ba20c9fc9 +$(DL_FILE)_BLAKE2 = 00ba3efa689d137808f5f53ecda93fd006be0c18d690ce76616ed1dba442281098579fa4b9a9e91b8ba865a3de15968f0ae06703a7b50b15c48a4beb5c970a46 install : $(TARGET) -- 2.37.2

2 1

[PATCH] Tor: Update to 0.4.7.10
by Peter Müller 11 Sep '22

11 Sep '22

Changes in version 0.4.7.10 - 2022-08-12 This version updates the geoip cache that we generate from IPFire location database to use the August 9th, 2022 one. Everyone MUST update to this latest release else circuit path selection and relay metrics are badly affected. o Major bugfixes (geoip data): - IPFire informed us on August 12th that databases generated after (including) August 10th did not have proper ARIN network allocations. We are updating the database to use the one generated on August 9th, 2022. Fixes bug 40658; bugfix on 0.4.7.9. Changes in version 0.4.7.9 - 2022-08-11 This version contains several major fixes aimed at reducing memory pressure on relays and possible side-channel. It also contains a major bugfix related to congestion control also aimed at reducing memory pressure on relays. Finally, there is last one major bugfix related to Vanguard L2 layer node selection. We strongly recommend to upgrade to this version especially for Exit relays in order to help the network defend against this ongoing DDoS. o Major bugfixes (congestion control): - Implement RFC3742 Limited Slow Start. Congestion control was overshooting the congestion window during slow start, particularly for onion service activity. With this fix, we now update the congestion window more often during slow start, as well as dampen the exponential growth when the congestion window grows above a capping parameter. This should reduce the memory increases guard relays were seeing, as well as allow us to set lower queue limits to defend against ongoing DoS attacks. Fixes bug 40642; bugfix on 0.4.7.5-alpha. o Major bugfixes (relay): - Remove OR connections btrack subsystem entries when the connections close normally. Before this, we would only remove the entry on error and thus leaking memory for each normal OR connections. Fixes bug 40604; bugfix on 0.4.0.1-alpha. - Stop sending TRUNCATED cell and instead close the circuit from which we received a DESTROY cell. This makes every relay in the circuit path to stop queuing cells. Fixes bug 40623; bugfix on 0.1.0.2-rc. o Major bugfixes (vanguards): - We had omitted some checks for whether our vanguards (second layer guards from proposal 333) overlapped. Now make sure to pick each of them to be independent. Also, change the design to allow them to come from the same family. Fixes bug 40639; bugfix on 0.4.7.1-alpha. o Minor features (dirauth): - Add a torrc option to control the Guard flag bandwidth threshold percentile. Closes ticket 40652. - Add an AuthDirVoteGuard torrc option that can allow authorities to assign the Guard flag to the given fingerprints/country code/IPs. This is a needed feature mostly for defense purposes in case a DoS hits the network and relay start losing the Guard flags too fast. - Make UPTIME_TO_GUARANTEE_STABLE, MTBF_TO_GUARANTEE_STABLE, TIME_KNOWN_TO_GUARANTEE_FAMILIAR WFU_TO_GUARANTEE_GUARD tunable from torrc. o Minor features (fallbackdir): - Regenerate fallback directories generated on August 11, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/08/11. o Minor bugfixes (congestion control): - Add a check for an integer underflow condition that might happen in cases where the system clock is stopped, the ORconn is blocked, and the endpoint sends more than a congestion window worth of non- data control cells at once. This would cause a large congestion window to be calculated instead of a small one. No security impact. Fixes bug 40644; bugfix on 0.4.7.5-alpha. o Minor bugfixes (defense in depth): - Change a test in the netflow padding code to make it more _obviously_ safe against remotely triggered crashes. (It was safe against these before, but not obviously so.) Fixes bug 40645; bugfix on 0.3.1.1-alpha. o Minor bugfixes (relay): - Do not propagate either forward or backward a DESTROY remote reason when closing a circuit in order to avoid a possible side channel. Fixes bug 40649; bugfix on 0.1.2.4-alpha. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tor b/lfs/tor index 628ed63a2..c41b6dbed 100644 --- a/lfs/tor +++ b/lfs/tor @@ -26,7 +26,7 @@ include Config SUMMARY = Anonymizing overlay network for TCP (The onion router) -VER = 0.4.7.8 +VER = 0.4.7.10 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 70 +PAK_VER = 71 DEPS = libseccomp @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 40f6eab453d95a09e4531ce7cdb59715a21b84e1d0b1045d107add6a443fb7563a5747734b23e0e1dfda6490a5a7659f912e38c11cdb5fa635535dcff6169eeb +$(DL_FILE)_BLAKE2 = 46a9d932e7451bcc683e18d296d7a26bb4b544767cf4622910ebf90d82715718451ec3e0d6cd215eff5fe2cc3ae8441b8e6065c5877d7fc92c2f26ab5c7fa0cb install : $(TARGET) -- 2.35.3

1 0

[PATCH] util-linux: Update to version 2.38.1
by Adolf Belka 11 Sep '22

11 Sep '22

- Update from version 2.38 to 2.38.1 - Update of rootfile not required - Changelog util-linux 2.38.1 Release Notes BSD: - Use byteswap.h and endian.h defined macos when present [Warner Losh] column: - fix buffer overflow when -l specified [Karel Zak] - fix greedy mode on -l [Karel Zak] configure.ac: - add lsns option [Fabrice Fontaine] dmesg: - fix --since and --until [Karel Zak] docs: - update AUTHORS file [Karel Zak] fstrim: - Remove all skipped entries before de-duplication [Scott Shambarger] - check for ENOSYS when using --quiet-unsupported [Narthorn] hardlink: - Document '-c' option in manpage [FeRD (Frank Dana)] - Fix man page docs for '-v/--verbose' [FeRD (Frank Dana)] - Move -c option in --help [FeRD (Frank Dana)] - require statfs_magic.h only when reflink support enabled [Karel Zak] - use info rather than warning message [Karel Zak] irqtop: - fix compiler warning [-Werror=format-truncation=] [Karel Zak] - remove unused variable [Karel Zak] lib/fileutils: - fix compiler warning [Karel Zak] lib/logindefs: - fix compiler warning [-Werror=format-truncation=] [Karel Zak] lib/strutils: - add ul_strchr_escaped() [Karel Zak] libblkid: - (bsd) fix buffer pointer use [fuzzing] [Karel Zak] - (hfs) fix label use [fuzzing] [Karel Zak] - (hfs) fix make sure buffer is large enough [Karel Zak] - (mac) make sure block size is large enough [fuzzing] [Karel Zak] - (probe) fix size and offset overflows [fuzzing] [Karel Zak] - (swap) fix magic string memcmp [fuzzing] [Karel Zak] - simplify 'leaf' detection [Karel Zak] - update documentation of BLOCK_SIZE tag [Andrey Albershteyn] libfdisk: - (gpt) Add UUID for Marvell Armada 3700 Boot partition [Pali Rohár] - meson.build fix typo [Anatoly Pugachev] libmount: - fix and improve utab update on MS_MOVE [Karel Zak] - when moving a mount point, all sub mount entries in utab should also be updated [Franck Bui] libuuid: - (man) uuid_copy() -- add missing parenthesis [Andrew Price] - improve cache handling [d032747] logger: - make sure structured data are escaped [Karel Zak] loopdev: - set block_size when using LOOP_CONFIGURE [Hideki EIRAKU] losetup: - Fix typo for the --sector-size docs [Alberto Ruiz] lsblk: - fix JSON output when without --bytes [Karel Zak] lscpu: - keep bogomips locale output locale sensitive [Karel Zak] lsfd: - add static modifier to nodev_table [Masatake YAMATO] - delete __unused__ attribute for an used parameter [Masatake YAMATO] - fix compiler warning [-Werror=maybe-uninitialized] [Karel Zak] - fix crash triggered by an empty filter expression [Masatake YAMATO] lsirq: - improve --sort IRQ [Karel Zak] lslogins: - fix free() invalid pointer [Karel Zak] - improve prefixes interpretation [Karel Zak] lsns: - (man) add ip-netns to "SEE ALSO" section [Masatake YAMATO] - improve dependence on NS_GET_ ioctls [Karel Zak] meson: - fix compilation without systemd [Rosen Penev] - fix when HAVE_CLOCK_GETTIME is set [Nicolas Caramelli] more: - avoid infinite loop on --squeeze [Karel Zak] po: - merge changes [Karel Zak] - update de.po (from translationproject.org) [Mario Blättermann] - update hr.po (from translationproject.org) [Božidar Putanec] - update ja.po (from translationproject.org) [Takeshi Hamasaki] - update uk.po (from translationproject.org) [Yuri Chornoivan] po-man: - merge changes [Karel Zak] - update fr.po (from translationproject.org) [Frédéric Marchal] - update uk.po (from translationproject.org) [Yuri Chornoivan] sfdiks: - (man) fix example [Karel Zak] sulogin: - fix includes [Karel Zak] switch_root: - (man) fix return code description [Karel Zak] taskset: - fix use of err_affinity() [csbo98] tests: - don't compile lsfd/mkfds helper on macos, since it's linux only [Anatoly Pugachev] - fdisk/bsd update expected output for ppc64le [Chris Hofstaedtler] - fix misc/setarch run in a docker environment [Anatoly Pugachev] - make libmount tests more portable [Karel Zak] - report failed tests [Karel Zak] unshare: - Fix "you (user xxxx) don't exist" error when uid differs from primary gid [Sol Boucher] uuidd: - allow AF_INET in systemd service [Karel Zak] - remove also PrivateNetwork=yes from systemd service [Karel Zak] zramctl: - fix compiler warning [-Werror=maybe-uninitialized] [Karel Zak] Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/util-linux | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/util-linux b/lfs/util-linux index 422774136..1ae03bab6 100644 --- a/lfs/util-linux +++ b/lfs/util-linux @@ -24,7 +24,7 @@ include Config -VER = 2.38 +VER = 2.38.1 THISAPP = util-linux-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = dd3b2abb3fedd91e35cc5665b49f1913aa93927cbb6eb5c9715a9f2ce06269d43c28fe96f6c67be88c210ca20e574177b06780ab4798cbbb0d7c76df07f3eeab +$(DL_FILE)_BLAKE2 = a0e86ca62f82adaccc01ad6ec5a058dac429b81c310989cbad136f96c2770c60bbd4287067817520e8e0653146a10f13128e0af32122402bab416e1c2d6680b8 install : $(TARGET) -- 2.37.2

2 1

[PATCH] libarchive: Update to version 3.6.1
by Adolf Belka 11 Sep '22

11 Sep '22

- Update from version 3.6.0 to 3.6.1 - Update of rootfile - Changelog Libarchive 3.6.1 is a bugfix and security release. Security fixes: 7zip reader: fix PPMD read beyond boundary (#1671) ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672) ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685) RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0) fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50) fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77) fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715) Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libarchive | 2 +- lfs/libarchive | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/libarchive b/config/rootfiles/common/libarchive index c939d74f4..d6860041b 100644 --- a/config/rootfiles/common/libarchive +++ b/config/rootfiles/common/libarchive @@ -6,7 +6,7 @@ #usr/lib/libarchive.la #usr/lib/libarchive.so usr/lib/libarchive.so.13 -usr/lib/libarchive.so.13.6.0 +usr/lib/libarchive.so.13.6.1 #usr/lib/pkgconfig/libarchive.pc #usr/share/man/man1/bsdcat.1 #usr/share/man/man1/bsdcpio.1 diff --git a/lfs/libarchive b/lfs/libarchive index 42040b6db..46074341a 100644 --- a/lfs/libarchive +++ b/lfs/libarchive @@ -24,7 +24,7 @@ include Config -VER = 3.6.0 +VER = 3.6.1 THISAPP = libarchive-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = e62bb0fccff23f752912de4ca6b8fd5dce6feb0e5f5d59b975d8e6fc9b3153500d6f622b4ea8c4541f0d574e7d8aa5f6903acc0c32b4e47a16f7e1b92ea952e9 +$(DL_FILE)_BLAKE2 = e7b79e97545dabeac164069e87adbd2081d3bd75c22f80b3797c6e487a477b3f6347b6fc14c76668eb69f2f2e5dcdd5a33a694e0a292ce426b8d0d93435218cf install : $(TARGET) -- 2.37.2

2 1

[PATCH] sqlite: Update to version 3390200
by Adolf Belka 11 Sep '22

11 Sep '22

- Update from version 3390000 to 3390200 - Update of rootfile not required - Changelog version 3.39.2 (2022-07-21): Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. version 3.39.1 (2022-07-13): Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view. forum post 174afeae5734d42d. Fix some harmless compiler warnings. Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. Fix the build so that is works when the SQLITE_DEBUG and SQLITE_OMIT_WINDOWFUNC compile-time options are both provided at the same time. Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. Enhance the sqlite_stmt virtual table so that it buffers all of its output. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sqlite | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/sqlite b/lfs/sqlite index a7aa0b499..59233efb6 100644 --- a/lfs/sqlite +++ b/lfs/sqlite @@ -24,7 +24,7 @@ include Config -VER = 3390000 +VER = 3390200 THISAPP = sqlite-autoconf-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5621aee0468184599f5fea172699ce4db969edb794704c6038009c6fe9fda3613f53de5307e1a5077ca790640f0d7fe82fd7f110c7e1acb0553490da5a5c13f6 +$(DL_FILE)_BLAKE2 = 4f1a2fb0416cd7f3a8af4d6ad699f43f6d814e8d6cc0feaf6eeab6ab814e8e0e3baaa7bdc175328ce44f59207c7c6266ef2ec79863aba9d14ec163ace15cbf90 install : $(TARGET) -- 2.37.2

2 1

[PATCH] openvpn: Update to version 2.5.7
by Adolf Belka 11 Sep '22

11 Sep '22

- Update from version 2.5.6 to 2.5.7 - Update of rootfile not required - Changelog 2.5.7. This is mostly a bugfix release, but adds limited support for OpenSSL 3.0. Full support will arrive in OpenVPN 2.6. networking: use OPENVPN_ETH_ALEN instead of ETH_ALEN networking_iproute2: don't pass M_WARN to openvpn_execve_check() t_net.sh: delete dummy iface using iproute command auth-pam.c: add missing include limits.h Add insecure tls-cert-profile options Refactor early initialisation and uninitialisation into methods Allow loading of non default providers Add ubuntu 22.04 to Github Actions Add macos OpenSSL 3.0 and ASAN builds Add --with-openssl-engine autoconf option (auto|yes|no) Fix allowing/showing unsupported ciphers and digests Remove dependency on BF-CBC existance from test_ncp Add message when decoding PKCS12 file fails. Translate OpenSSL 3.0 digest names to OpenSSL 1.1 digest names Fix client-pending-auth error message to say ERROR instead of SUCCESS cipher-negotiation.rst missing from doc/Makefile.am vcpkg-ports\pkcs11-helper: shorten patch filename msvc: adjust build options to harden binaries vcpkg-ports: remove openssl port vcpkg: switch to manifest Fix M_ERRNO behavior on Windows vcpkg-ports/pkcs11-helper: bump to release 1.29 tapctl: Resolve MSVC C4996 warnings Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openvpn | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openvpn b/lfs/openvpn index 8d6ba07ed..0483ac311 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,7 +24,7 @@ include Config -VER = 2.5.6 +VER = 2.5.7 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d0466d2b95dae892606b6369d2c227add1de43fb708bf1c31a3ef78b28fc37382d501cc559767c8c8358ec28b88d3eb80a0eb915d7872ce30757c7080a37fde2 +$(DL_FILE)_BLAKE2 = f5db74445d080f191b09a4ff5512712973fa6c3a6662479e11d2398e5e01c45eba5d50faa3301c715066dd0eb2f7d8702ceefc68d9edb1af264ec699710f8e5c install : $(TARGET) -- 2.37.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2022