Development April 2023

development@lists.ipfire.org

11 participants
38 discussions

[PATCH] squid-asnbl: Fix for bug#13023 - squid-asnbl-helper segfaulting and shutdown squid
by Adolf Belka 01 Jul '23

01 Jul '23

- Patch provided by bug reporter. Here is the description of the problem from the bug. First I discovered that the helper only sometimes throwing the error and quits even for the same values and queries. Also the timespan until the error happens was quite different for every restart of squid (minutes to hours). And it does not depend on the traffic on the proxy, even one connection could cause a crash while ten or hundrets won't. After a few days of testing different solutions and done a lot of debugging, redesigning the function did not fully solve the problem. Such standard things like checking the result variable for NULL (or it's equivalent "is None" in python) before evaluating it's subfunction produces the exact same error message. But with that knowledge it more and more turns out that python3 sometimes 'detects' the local return variable if it was a misused global. So for a full fix, the return variable also has to be initialized that python3 won't detect it's usage as an 'UnboundLocalError' to succesfully fix this bug. - LFS file updated to run patch before copying helper into place. - Update of rootfile not needed. - Bug reporter has been requested to raise this issue at the git repo for squid-asnbl. Fixes: Bug#13023 Tested-by: Nicolas Pӧhlmann <business(a)hardcoretec.com> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/squid-asnbl | 1 + ...les_to_make_compatible_with_python_3.patch | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch diff --git a/lfs/squid-asnbl b/lfs/squid-asnbl index 130b28460..b003d605b 100644 --- a/lfs/squid-asnbl +++ b/lfs/squid-asnbl @@ -75,6 +75,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zvxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch # Install ASNBL helper script cd $(DIR_APP) && install -o root -g root -m 0755 asnbl-helper.py /usr/bin/asnbl-helper.py diff --git a/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch b/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch new file mode 100644 index 000000000..e540d4e76 --- /dev/null +++ b/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch @@ -0,0 +1,100 @@ +--- squid-asnbl-0.2.4/asnbl-helper_orig.py ++++ squid-asnbl-0.2.4/asnbl-helper.py +@@ -172,17 +172,19 @@ + return parsedasns + + +-def resolve_asn(ipaddr: str, asndb): +- """ Function call: resolve_asn(IP address to be resolved, +- ASN database instance object) +- This function looks up the Autonomous System for the given IP address. It expects +- an IPFire location database object to be passed as a second parameter, hence relying +- on another function to set that up. """ ++def resolve_asn(ipaddr: str): ++ """ Function call: resolve_asn(IP address to be resolved) ++ This function looks up the Autonomous System for the given IP address. """ ++ ++ # Fix for #13023 ++ # Initialize the result variable before it's first use, otherwise python3 ++ # will sometimes detect a 'mismatch' using global and local variables ++ lookup_result = None + + # libloc cannot handle ipaddress objects here, so casting into a string is necessary + # for good measure, to avoid exceptions here... + try: +- result = asndb.lookup(str(ipaddr)) ++ lookup_result = ASNDB.lookup(str(ipaddr)) + except BlockingIOError: + # XXX: Prevent likely libloc bug from causing this helper to crash + # (see upstream bug https://bugzilla.ipfire.org/show_bug.cgi?id=13023) +@@ -190,21 +192,25 @@ + + # In case nothing was returned above, satisfy result expectation to this function... + try: +- if not result.asn: ++ if not lookup_result.asn: + return 0 + except AttributeError: + return 0 + +- return result.asn +- +- +-def asndb_response_tests(testdata: str, asndb): +- """ Function call: asndb_response_tests(response rest data, +- ASN database instance object) ++ return lookup_result.asn ++ ++ ++def asndb_response_tests(testdata: str): ++ """ Function call: asndb_response_tests(response rest data) + + This function asserts the given ASN database to return expected ASNs for + given IP addresses in order to be considered operational. It returns + True if this test succeeds, and False otherwise. """ ++ ++ # Fix for #13023 ++ # Initialize the result variable before it's first use, otherwise python3 ++ # will sometimes detect a 'mismatch' using global and local variables ++ lookup_result_test = None + + tresult = True + +@@ -216,13 +222,13 @@ + + for stestdata in ptdata: + LOGIT.debug("Running response test for '%s' against ASNDB '%s' ...", +- stestdata, asndb) +- +- returndata = resolve_asn(stestdata[0], asndb) +- +- if returndata != int(stestdata[1]): ++ stestdata, ASNDB) ++ ++ lookup_result_test = resolve_asn(stestdata[0]) ++ ++ if lookup_result_test != int(stestdata[1]): + LOGIT.error("Response test failed for ASNDB '%s' (tuple: %s), aborting", +- asndb, stestdata) ++ ASNDB, stestdata) + tresult = False + break + +@@ -428,7 +434,7 @@ + ASNDB = set_up_location_database(config["GENERAL"]["ASNDB_PATH"]) + + LOGIT.debug("Running ASN database response tests...") +-if asndb_response_tests(config["GENERAL"]["TESTDATA"], ASNDB): ++if asndb_response_tests(config["GENERAL"]["TESTDATA"]): + LOGIT.debug("ASN database operational - excellent. Waiting for input...") + else: + LOGIT.error("ASN database response tests failed, aborting") +@@ -490,7 +496,7 @@ + ASNS = [] + for singleip in IPS: + # Enumerate ASN for this IP address... +- resolvedasn = resolve_asn(singleip, ASNDB) ++ resolvedasn = resolve_asn(singleip) + + # In case protection against destinations without public AS announcements for their + # IP addresses is desired, the query will be denied in case ASN = 0 appears in an -- 2.39.2

2 3

[PATCH] rsnapshot: New addon
by Jon Murphy 15 May '23

15 May '23

- What is it? rsnapshot is a filesystem snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of the ipfire device. The code makes extensive use of hard links whenever possible, to greatly reduce the disk space required. See: https://rsnapshot.org - Why is it needed? Rsnapshot backups run multiple times per day (e.g., once per day up to 24 times per day). Rsnapshot is much easier to configure, setup and use than the borg backup add-on. (I found borg somewhat confusing). Rsnapshot completes each backup very fast. Unlike borg, rsnapshot does not compress each backup before storage. During a complete rebuild, borg backup need installation of the borg add-on to recover archived files. Rsnapshot backups can be copied directly from the backup drive. Current backups (backup.pl or borg) could corrupt sqlite3 databases by running a backup during a database write. This add-on includes a script specifically for sqlite backups. - IPFire Wiki In process at: https://wiki.ipfire.org/addons/rsnapshot Thanks to Gerd for creating a first build and a nice template for me! Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/backup/includes/rsnapshot | 1 + config/rootfiles/packages/rsnapshot | 17 +++ config/rsnapshot/backup_sqlite.sh | 40 +++++ config/rsnapshot/rsnapshot-daily | 8 + config/rsnapshot/rsnapshot-hourly | 8 + config/rsnapshot/rsnapshot-monthly | 8 + config/rsnapshot/rsnapshot-weekly | 8 + config/rsnapshot/rsnapshot-yearly | 8 + config/rsnapshot/rsnapshot.conf | 218 ++++++++++++++++++++++++++++ lfs/rsnapshot | 114 +++++++++++++++ make.sh | 1 + 11 files changed, 431 insertions(+) create mode 100644 config/backup/includes/rsnapshot create mode 100644 config/rootfiles/packages/rsnapshot create mode 100644 config/rsnapshot/backup_sqlite.sh create mode 100644 config/rsnapshot/rsnapshot-daily create mode 100644 config/rsnapshot/rsnapshot-hourly create mode 100644 config/rsnapshot/rsnapshot-monthly create mode 100644 config/rsnapshot/rsnapshot-weekly create mode 100644 config/rsnapshot/rsnapshot-yearly create mode 100644 config/rsnapshot/rsnapshot.conf create mode 100644 lfs/rsnapshot diff --git a/config/backup/includes/rsnapshot b/config/backup/includes/rsnapshot new file mode 100644 index 000000000..4d1b48a5a --- /dev/null +++ b/config/backup/includes/rsnapshot @@ -0,0 +1 @@ +/etc/rsnapshot.conf diff --git a/config/rootfiles/packages/rsnapshot b/config/rootfiles/packages/rsnapshot new file mode 100644 index 000000000..d907a615f --- /dev/null +++ b/config/rootfiles/packages/rsnapshot @@ -0,0 +1,17 @@ +etc/fcron.daily/rsnapshot-daily +etc/fcron.hourly/rsnapshot-hourly +etc/fcron.monthly/rsnapshot-monthly +etc/fcron.weekly/rsnapshot-weekly +etc/rsnapshot.conf +etc/rsnapshot.conf.default +usr/bin/rsnapshot +usr/bin/rsnapshot-diff +#usr/share/man/man1/rsnapshot-diff.1 +#usr/share/man/man1/rsnapshot.1 +var/ipfire/backup/addons/includes/rsnapshot +var/ipfire/backup/bin/backup_sqlite.sh +var/ipfire/backup/bin/rsnapshot-daily +var/ipfire/backup/bin/rsnapshot-hourly +var/ipfire/backup/bin/rsnapshot-monthly +var/ipfire/backup/bin/rsnapshot-weekly +var/ipfire/backup/bin/rsnapshot-yearly diff --git a/config/rsnapshot/backup_sqlite.sh b/config/rsnapshot/backup_sqlite.sh new file mode 100644 index 000000000..3ed54e49d --- /dev/null +++ b/config/rsnapshot/backup_sqlite.sh @@ -0,0 +1,40 @@ +#!/bin/bash +set -e +set -u +#set -x + +############################################################################## +# backup_sqlite.sh +# +# http://www.rsnapshot.org/ +# +# This is a simple shell script to backup a sqlite database with rsnapshot. +# +# This script simply needs to dump a file into the current working directory. +# rsnapshot handles everything else. +# +# The assumption is that this will be invoked from rsnapshot. +# See: +# https://rsnapshot.org/rsnapshot/docs/docbook/rest.html#backup-script +# +# Please remember that these backup scripts will be invoked as the user +# running rsnapshot. Make sure your backup scripts are owned by root, +# and not writable by anyone else. +# If you fail to do this, anyone with write access to these backup scripts +# will be able to put commands in them that will be run as the root user. +# If they are malicious, they could take over your server. +# +# chown root:root backup_sqlite.sh +# chmod 700 backup_sqlite.sh +# +############################################################################## + +umask 0077 + +# backup the database +/bin/find /var -iname *.db -exec bash -c ' /usr/bin/file {} | /bin/grep -q "SQLite 3" && /usr/bin/sqlite3 {} ".backup $(/usr/bin/basename {})" ' \; + +# make the backup readable only by root +#/bin/chmod 600 filename.db + +exit diff --git a/config/rsnapshot/rsnapshot-daily b/config/rsnapshot/rsnapshot-daily new file mode 100644 index 000000000..99e560adc --- /dev/null +++ b/config/rsnapshot/rsnapshot-daily @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG daily + +exit diff --git a/config/rsnapshot/rsnapshot-hourly b/config/rsnapshot/rsnapshot-hourly new file mode 100644 index 000000000..8dc2cd75f --- /dev/null +++ b/config/rsnapshot/rsnapshot-hourly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG sync && /usr/bin/rsnapshot -c $CONFIG hourly + +exit diff --git a/config/rsnapshot/rsnapshot-monthly b/config/rsnapshot/rsnapshot-monthly new file mode 100644 index 000000000..9c658250d --- /dev/null +++ b/config/rsnapshot/rsnapshot-monthly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG monthly + +exit diff --git a/config/rsnapshot/rsnapshot-weekly b/config/rsnapshot/rsnapshot-weekly new file mode 100644 index 000000000..f5b18530d --- /dev/null +++ b/config/rsnapshot/rsnapshot-weekly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG weekly + +exit diff --git a/config/rsnapshot/rsnapshot-yearly b/config/rsnapshot/rsnapshot-yearly new file mode 100644 index 000000000..218e9ee84 --- /dev/null +++ b/config/rsnapshot/rsnapshot-yearly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG yearly + +exit diff --git a/config/rsnapshot/rsnapshot.conf b/config/rsnapshot/rsnapshot.conf new file mode 100644 index 000000000..cdec0404b --- /dev/null +++ b/config/rsnapshot/rsnapshot.conf @@ -0,0 +1,218 @@ +################################################# +# rsnapshot.conf - rsnapshot configuration file # +################################################# +# # +# PLEASE BE AWARE OF THE FOLLOWING RULE: # +# # +# This file requires tabs between elements # +# # +################################################# + +####################### +# CONFIG FILE VERSION # +####################### + +config_version 1.2 + +########################### +# SNAPSHOT ROOT DIRECTORY # +########################### + +# All snapshots will be stored under this root directory. +# +snapshot_root /mnt/hdd/snapshots/ + +# If no_create_root is enabled, rsnapshot will not automatically create the +# snapshot_root directory. This is particularly useful if you are backing +# up to removable media, such as a FireWire or USB drive. +# +no_create_root 1 + +################################# +# EXTERNAL PROGRAM DEPENDENCIES # +################################# + +# LINUX USERS: Be sure to uncomment "cmd_cp". This gives you extra features. +# EVERYONE ELSE: Leave "cmd_cp" commented out for compatibility. +# +# See the README file or the man page for more details. +# +cmd_cp /bin/cp + +# uncomment this to use the rm program instead of the built-in perl routine. +# +cmd_rm /bin/rm + +# rsync must be enabled for anything to work. This is the only command that +# must be enabled. +# +cmd_rsync /usr/bin/rsync + +# Uncomment this to enable remote ssh backups over rsync. +# +#cmd_ssh /usr/bin/ssh + +# Comment this out to disable syslog support. +# +cmd_logger /usr/bin/logger + +# Uncomment this to specify the path to "du" for disk usage checks. +# If you have an older version of "du", you may also want to check the +# "du_args" parameter below. +# +cmd_du /usr/bin/du + +# Uncomment this to specify the path to rsnapshot-diff. +# +cmd_rsnapshot_diff /usr/bin/rsnapshot-diff + +# Specify the path to a script (and any optional arguments) to run right +# before rsnapshot syncs files +# +#cmd_preexec /path/to/preexec/script + +# Specify the path to a script (and any optional arguments) to run right +# after rsnapshot syncs files +# +#cmd_postexec /path/to/postexec/script + + +######################################### +# BACKUP LEVELS / INTERVALS # +# Must be unique and in ascending order # +# e.g. alpha, beta, gamma, etc. # +######################################### + +retain hourly 2 # 2 backups in one day (every 12 hours) +#retain hourly 24 # 24 backups in one day +retain daily 7 # 7 backups in one week +retain weekly 4 # 4 backups in one month +retain monthly 12 # 12 backups in one year +retain yearly 2 # 2 backups total + +#retain alpha 6 # 6 backups in one beta +#retain beta 7 # 7 backups in one gamma +#retain gamma 4 # you get the idea! +#retain delta 3 + +############################################ +# GLOBAL OPTIONS # +# All are optional, with sensible defaults # +############################################ + +# Verbose level, 1 through 5. +# 1 Quiet Print fatal errors only +# 2 Default Print errors and warnings only +# 3 Verbose Show equivalent shell commands being executed +# 4 Extra Verbose Show extra verbose information +# 5 Debug mode Everything +# +verbose 2 + +# Same as "verbose" above, but controls the amount of data sent to the +# logfile, if one is being used. The default is 3. +# +loglevel 2 + +# If you enable this, data will be written to the file you specify. The +# amount of data written is controlled by the "loglevel" parameter. +# +#logfile /var/log/rsnapshot.log + +# If enabled, rsnapshot will write a lockfile to prevent two instances +# from running simultaneously (and messing up the snapshot_root). +# If you enable this, make sure the lockfile directory is not world +# writable. Otherwise anyone can prevent the program from running. +# +lockfile /run/rsnapshot.pid + +# By default, rsnapshot check lockfile, check if PID is running +# and if not, consider lockfile as stale, then start +# Enabling this stop rsnapshot if PID in lockfile is not running +# +#stop_on_stale_lockfile 0 + +# Default rsync args. All rsync commands have at least these options set. +# +# Note: This is the exception to the rule of "requires tabs between elements" +# tab between "rsync_long_args" and "--delete" +# space between all other arguments +# +# rsync_long_args<tab>--delete<space>--numeric-ids<space>--relative +# +#rsync_short_args -a +#rsync_long_args --delete --numeric-ids --relative --delete-excluded + +# ssh has no args passed by default, but you can specify some here. +# +#ssh_args -p 22 + +# Default arguments for the "du" program (for disk space reporting). +# The GNU version of "du" is preferred. See the man page for more details. +# If your version of "du" doesn't support the -h flag, try -k flag instead. +# +#du_args -csh + +# If this is enabled, rsync won't span filesystem partitions within a +# backup point. This essentially passes the -x option to rsync. +# The default is 0 (off). +# +#one_fs 0 + +# The include and exclude parameters, if enabled, simply get passed directly +# to rsync. If you have multiple include/exclude patterns, put each one on a +# separate line. Please look up the --include and --exclude options in the +# rsync man page for more details on how to specify file name patterns. +# +exclude .cache/ +exclude /var/cache +#include ??? +#exclude ??? + +# The include_file and exclude_file parameters, if enabled, simply get +# passed directly to rsync. Please look up the --include-from and +# --exclude-from options in the rsync man page for more details. +# +#include_file /path/to/include/file +#exclude_file /path/to/exclude/file + +# If your version of rsync supports --link-dest, consider enabling this. +# This is the best way to support special files (FIFOs, etc) cross-platform. +# The default is 0 (off). +# +link_dest 1 + +# When sync_first is enabled, it changes the default behaviour of rsnapshot. +# Normally, when rsnapshot is called with its lowest interval +# (i.e.: "rsnapshot alpha"), it will sync files AND rotate the lowest +# intervals. With sync_first enabled, "rsnapshot sync" handles the file sync, +# and all interval calls simply rotate files. See the man page for more +# details. The default is 0 (off). +# +sync_first 1 + +# If enabled, rsnapshot will move the oldest directory for each interval +# to [interval_name].delete, then it will remove the lockfile and delete +# that directory just before it exits. The default is 0 (off). +# +#use_lazy_deletes 0 + +# Number of rsync re-tries. If you experience any network problems or +# network card issues that tend to cause ssh to fail with errors like +# "Corrupted MAC on input", for example, set this to a non-zero value +# to have the rsync operation re-tried. +# +#rsync_numtries 0 + + +############################### +### BACKUP POINTS / SCRIPTS ### +############################### + +# LOCALHOST +backup /etc/ localhost/ +backup /var/ localhost/ +backup /root/ localhost/ + +backup_script /var/ipfire/backup/bin/backup_sqlite.sh localhost/sqlite3/ + diff --git a/lfs/rsnapshot b/lfs/rsnapshot new file mode 100644 index 000000000..174eff452 --- /dev/null +++ b/lfs/rsnapshot @@ -0,0 +1,114 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2023 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +SUMMARY = filesystem backup & snapshot utility + +VER = 1.4.5 + +THISAPP = rsnapshot-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +PROG = rsnapshot +PAK_VER = 1 + +DEPS = rsync + +SERVICES = + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_BLAKE2 = 2a668aa16991b2b4e611c6204cdcd0e8c9593e5f0af5ea89e787a578e73b6f5987514cd7d0252bb78aea1b157ef85aea947686111ca9e3befdb2a8cef0aa9ecd + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +b2 : $(subst %,%_BLAKE2,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, b2sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_BLAKE2,$(objects)) : + @$(B2SUM) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + cd $(DIR_APP) && [ -x "configure" ] || sh ./autogen.sh + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --sysconfdir=/etc + + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + + # Add conf file to /etc directory + cp -vf $(DIR_CONF)/rsnapshot/rsnapshot.conf /etc + + # install fcron scripts and backup sqlite script + install -v -m 755 $(DIR_CONF)/rsnapshot/{rsnapshot-hourly,rsnapshot-daily} \ + $(DIR_CONF)/rsnapshot/{rsnapshot-weekly,rsnapshot-monthly} \ + $(DIR_CONF)/rsnapshot/{rsnapshot-yearly,backup_sqlite.sh} \ + -t /var/ipfire/backup/bin + + # link rsnapshot interval scripts to various fcron folders + ln -svf /var/ipfire/backup/bin/rsnapshot-hourly /etc/fcron.hourly + ln -svf /var/ipfire/backup/bin/rsnapshot-daily /etc/fcron.daily + ln -svf /var/ipfire/backup/bin/rsnapshot-weekly /etc/fcron.weekly + ln -svf /var/ipfire/backup/bin/rsnapshot-monthly /etc/fcron.monthly + #ln -svf /var/ipfire/backup/bin/rsnapshot-yearly /etc/fcron.??? + + # Install backup definition + cp -vf $(DIR_CONF)/backup/includes/rsnapshot /var/ipfire/backup/addons/includes/rsnapshot + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 3b7f9850c..1b6b1e253 100755 --- a/make.sh +++ b/make.sh @@ -1709,6 +1709,7 @@ buildipfire() { lfsmake2 perl-Imager-QRCode lfsmake2 perl-MIME-Base32 lfsmake2 perl-URI-Encode + lfsmake2 rsnapshot } buildinstaller() { -- 2.30.2

2 1

[PATCH] samba: aarch64 rootfile update
by Arne Fitzenreiter 28 Apr '23

28 Apr '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/packages/aarch64/samba | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/config/rootfiles/packages/aarch64/samba b/config/rootfiles/packages/aarch64/samba index 75c95b395..40ccec083 100644 --- a/config/rootfiles/packages/aarch64/samba +++ b/config/rootfiles/packages/aarch64/samba @@ -62,6 +62,7 @@ usr/bin/wbinfo #usr/include/samba-4.0/gen_ndr #usr/include/samba-4.0/gen_ndr/atsvc.h #usr/include/samba-4.0/gen_ndr/auth.h +#usr/include/samba-4.0/gen_ndr/claims.h #usr/include/samba-4.0/gen_ndr/dcerpc.h #usr/include/samba-4.0/gen_ndr/drsblobs.h #usr/include/samba-4.0/gen_ndr/drsuapi.h @@ -196,7 +197,7 @@ usr/lib/libtevent-util.so.0 usr/lib/libtevent-util.so.0.0.1 usr/lib/libwbclient.so usr/lib/libwbclient.so.0 -usr/lib/libwbclient.so.0.15 +usr/lib/libwbclient.so.0.16 #usr/lib/pkgconfig/dcerpc.pc #usr/lib/pkgconfig/dcerpc_samr.pc #usr/lib/pkgconfig/ndr.pc @@ -223,6 +224,7 @@ usr/lib/python3.10/site-packages/samba/auth.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/auth_util.py usr/lib/python3.10/site-packages/samba/colour.py usr/lib/python3.10/site-packages/samba/common.py +usr/lib/python3.10/site-packages/samba/compression.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/credentials.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/crypto.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/dbchecker.py @@ -231,6 +233,7 @@ usr/lib/python3.10/site-packages/samba/dcerpc/__init__.py usr/lib/python3.10/site-packages/samba/dcerpc/atsvc.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/dcerpc/auth.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/dcerpc/base.cpython-310-aarch64-linux-gnu.so +usr/lib/python3.10/site-packages/samba/dcerpc/claims.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/dcerpc/dcerpc.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/dcerpc/dfs.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/dcerpc/dns.cpython-310-aarch64-linux-gnu.so @@ -382,6 +385,8 @@ usr/lib/python3.10/site-packages/samba/provision/kerberos_implementation.py usr/lib/python3.10/site-packages/samba/provision/sambadns.py usr/lib/python3.10/site-packages/samba/registry.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/remove_dc.py +usr/lib/python3.10/site-packages/samba/reparse_symlink.cpython-310-aarch64-linux-gnu.so +usr/lib/python3.10/site-packages/samba/safe_tarfile.py #usr/lib/python3.10/site-packages/samba/samba3 usr/lib/python3.10/site-packages/samba/samba3/__init__.py usr/lib/python3.10/site-packages/samba/samba3/libsmb_samba_cwrapper.cpython-310-aarch64-linux-gnu.so @@ -437,6 +442,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/blackbox/traffic_summary.py #usr/lib/python3.10/site-packages/samba/tests/common.py #usr/lib/python3.10/site-packages/samba/tests/complex_expressions.py +#usr/lib/python3.10/site-packages/samba/tests/compression.py #usr/lib/python3.10/site-packages/samba/tests/core.py #usr/lib/python3.10/site-packages/samba/tests/cred_opt.py #usr/lib/python3.10/site-packages/samba/tests/credentials.py @@ -507,9 +513,11 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/krb5/alias_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/as_canonicalization_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/as_req_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/claims_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/compatability_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/etype_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/fast_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/group_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kcrypto.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_base_test.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tests.py @@ -540,6 +548,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/ldap_referrals.py #usr/lib/python3.10/site-packages/samba/tests/ldap_spn.py #usr/lib/python3.10/site-packages/samba/tests/ldap_upn_sam_account.py +#usr/lib/python3.10/site-packages/samba/tests/libsmb-basic.py #usr/lib/python3.10/site-packages/samba/tests/libsmb.py #usr/lib/python3.10/site-packages/samba/tests/loadparm.py #usr/lib/python3.10/site-packages/samba/tests/logfiles.py @@ -577,12 +586,14 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/pso.py #usr/lib/python3.10/site-packages/samba/tests/py_credentials.py #usr/lib/python3.10/site-packages/samba/tests/registry.py +#usr/lib/python3.10/site-packages/samba/tests/reparsepoints.py #usr/lib/python3.10/site-packages/samba/tests/s3_net_join.py #usr/lib/python3.10/site-packages/samba/tests/s3idmapdb.py #usr/lib/python3.10/site-packages/samba/tests/s3param.py #usr/lib/python3.10/site-packages/samba/tests/s3passdb.py #usr/lib/python3.10/site-packages/samba/tests/s3registry.py #usr/lib/python3.10/site-packages/samba/tests/s3windb.py +#usr/lib/python3.10/site-packages/samba/tests/safe_tarfile.py #usr/lib/python3.10/site-packages/samba/tests/samba3sam.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool #usr/lib/python3.10/site-packages/samba/tests/samba_tool/__init__.py @@ -632,6 +643,9 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/sid_strings.py #usr/lib/python3.10/site-packages/samba/tests/smb-notify.py #usr/lib/python3.10/site-packages/samba/tests/smb.py +#usr/lib/python3.10/site-packages/samba/tests/smb1posix.py +#usr/lib/python3.10/site-packages/samba/tests/smb2symlink.py +#usr/lib/python3.10/site-packages/samba/tests/smb3unix.py #usr/lib/python3.10/site-packages/samba/tests/smbconf.py #usr/lib/python3.10/site-packages/samba/tests/smbd_base.py #usr/lib/python3.10/site-packages/samba/tests/smbd_fuzztest.py @@ -783,6 +797,7 @@ usr/lib/samba/libsmbd-shim-samba4.so usr/lib/samba/libsmbldaphelper-samba4.so usr/lib/samba/libsmbpasswdparser-samba4.so usr/lib/samba/libsocket-blocking-samba4.so +usr/lib/samba/libstable-sort-samba4.so usr/lib/samba/libsys-rw-samba4.so usr/lib/samba/libtalloc-report-printf-samba4.so usr/lib/samba/libtalloc-report-samba4.so -- 2.34.1

1 0

[PATCH] kernel: arm64 rootfile update
by Arne Fitzenreiter 28 Apr '23

28 Apr '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/common/aarch64/linux | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 3258a11bf..023bf52fe 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -297,10 +297,10 @@ boot/dtb-KVER-ipfire #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2c.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2s-oc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2s.dtb -#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus-oc.dtb -#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus-lts-oc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus-lts.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus-oc.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-roc-cc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-roc-pc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-rock-pi-e.dtb @@ -6861,7 +6861,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/ARCH_WANT_DEFAULT_BPF_JIT #lib/modules/KVER-ipfire/build/include/config/ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT #lib/modules/KVER-ipfire/build/include/config/ARCH_WANT_FRAME_POINTERS -#lib/modules/KVER-ipfire/build/include/config/ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP #lib/modules/KVER-ipfire/build/include/config/ARCH_WANT_HUGE_PMD_SHARE #lib/modules/KVER-ipfire/build/include/config/ARCH_WANT_LD_ORPHAN_WARN #lib/modules/KVER-ipfire/build/include/config/ARC_EMAC_CORE @@ -7767,7 +7766,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/DRM_TTM #lib/modules/KVER-ipfire/build/include/config/DRM_TTM_HELPER #lib/modules/KVER-ipfire/build/include/config/DRM_UDL -#lib/modules/KVER-ipfire/build/include/config/DRM_USE_DYNAMIC_DEBUG #lib/modules/KVER-ipfire/build/include/config/DRM_V3D #lib/modules/KVER-ipfire/build/include/config/DRM_VC4 #lib/modules/KVER-ipfire/build/include/config/DRM_VC4_HDMI_CEC @@ -9279,7 +9277,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/NET_CLS_ROUTE4 #lib/modules/KVER-ipfire/build/include/config/NET_CLS_RSVP #lib/modules/KVER-ipfire/build/include/config/NET_CLS_RSVP6 -#lib/modules/KVER-ipfire/build/include/config/NET_CLS_TCINDEX #lib/modules/KVER-ipfire/build/include/config/NET_CLS_U32 #lib/modules/KVER-ipfire/build/include/config/NET_CORE #lib/modules/KVER-ipfire/build/include/config/NET_DEVLINK @@ -10090,6 +10087,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/RTC_CLASS #lib/modules/KVER-ipfire/build/include/config/RTC_DRV_88PM80X #lib/modules/KVER-ipfire/build/include/config/RTC_DRV_88PM860X +#lib/modules/KVER-ipfire/build/include/config/RTC_DRV_ARMADA38X #lib/modules/KVER-ipfire/build/include/config/RTC_DRV_BQ32K #lib/modules/KVER-ipfire/build/include/config/RTC_DRV_BQ4802 #lib/modules/KVER-ipfire/build/include/config/RTC_DRV_DS1286 @@ -10373,7 +10371,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/SERIAL_FSL_LINFLEXUART #lib/modules/KVER-ipfire/build/include/config/SERIAL_FSL_LINFLEXUART_CONSOLE #lib/modules/KVER-ipfire/build/include/config/SERIAL_FSL_LPUART -#lib/modules/KVER-ipfire/build/include/config/SERIAL_FSL_LPUART_CONSOLE #lib/modules/KVER-ipfire/build/include/config/SERIAL_IMX #lib/modules/KVER-ipfire/build/include/config/SERIAL_IMX_CONSOLE #lib/modules/KVER-ipfire/build/include/config/SERIAL_IMX_EARLYCON @@ -21393,6 +21390,7 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/drivers/rtc #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-88pm80x.ko.xz #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-88pm860x.ko.xz +#lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-armada38x.ko.xz #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-bq32k.ko.xz #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-bq4802.ko.xz #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-ds1286.ko.xz @@ -22185,7 +22183,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/net/sched/cls_route.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/cls_rsvp.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/cls_rsvp6.ko.xz -#lib/modules/KVER-ipfire/kernel/net/sched/cls_tcindex.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/cls_u32.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/em_cmp.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/em_ipset.ko.xz -- 2.34.1

1 0

[PATCH 1/3] kernel: add OrangePi R1 Plus LTS
by Arne Fitzenreiter 28 Apr '23

28 Apr '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/common/aarch64/linux | 4 ++++ lfs/linux | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 8d7686427..3258a11bf 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -297,6 +297,10 @@ boot/dtb-KVER-ipfire #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2c.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2s-oc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2s.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus-oc.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus-lts-oc.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-orangepi-r1-plus-lts.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-roc-cc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-roc-pc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-rock-pi-e.dtb diff --git a/lfs/linux b/lfs/linux index e48374f1e..85f767799 100644 --- a/lfs/linux +++ b/lfs/linux @@ -25,7 +25,7 @@ include Config VER = 6.1.24 -ARM_PATCHES = 6.1.y-ipfire1 +ARM_PATCHES = 6.1.y-ipfire2 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.xz @@ -76,7 +76,7 @@ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz $(DL_FILE)_BLAKE2 = 2f20ad999655226bc79caca109bde0f940420d87a293cf000f2d8304122bdfcc388c1a558ff26f2f551c9b6133b8fb120dbd537f914e1b88d0fbbd5408e648b0 -arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 2181ba20d1c9d2752d67438784da12470f5c9cb8acc4eb748637ae1e8bf9d7cd0e7a08a51fad5cac98764d46ae6a20521ddda31da7002d48dbd180ff04a4d9aa +arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 7afc460562fb24bcd75784fc79de768f9b60780aedd88d1a847927169e31920bbb475b1ac1466c4a224a7876d16bd8d465b96202de12b74f6e2ccbfcec731ad3 install : $(TARGET) -- 2.34.1

1 2

[PATCH] dbus: Fixes Bug#13094 - Check for existing user before `useradd`
by Jon Murphy 26 Apr '23

26 Apr '23

- The dbus install.sh script useradd command causes an error: "failed adding user 'messagebus', exit code: 9" - This patch adds a check to only do the useradd if the user does not exist. - See the bump PAK_VER for dbus that Adolf publised. See this patch: https://lists.ipfire.org/pipermail/development/2023-April/015816.html Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- src/paks/dbus/install.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/paks/dbus/install.sh b/src/paks/dbus/install.sh index bf4e5a6d5..e4f2abda2 100644 --- a/src/paks/dbus/install.sh +++ b/src/paks/dbus/install.sh @@ -17,13 +17,13 @@ # along with IPFire; if not, write to the Free Software # # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # # # -# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# Copyright (C) 2007-2023 IPFire-Team <info(a)ipfire.org>. # # # ############################################################################ # . /opt/pakfire/lib/functions.sh extract_files -useradd messagebus +id -u messagebus &>/dev/null || useradd -r -d /var/empty -s /bin/false messagebus # Create start links ln -svf ../init.d/messagebus /etc/rc.d/rc3.d/S15messagebus -- 2.30.2

1 0

[PATCH] cups: Fixes Bug#12924 - Can't access https pages in cups
by Adolf Belka 26 Apr '23

26 Apr '23

- Version 2.4.2 had some bugs that caused the self signed certificates to not be read or created properly. The two involved bug fix patches are applied in this submission. - Corrected the configure options related to avahi and TLS. Using Openssl for the TLS. - Built .ipfire package installed into vm testbed and tested. With existing 2.4.2 any https pages come up with an error for the secure connection. With this version the https admin page opens up and config file was able to be successfully modified via it. Fixes: Bug#12924 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/cups | 8 +- ...ificate_generation_bugs_with_openssl.patch | 337 ++++++++++++++++++ ..._default_cupsd_keychain_with_OpenSSL.patch | 16 + 3 files changed, 358 insertions(+), 3 deletions(-) create mode 100644 src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch create mode 100644 src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch diff --git a/lfs/cups b/lfs/cups index 6485f8df4..f1b8df1c7 100644 --- a/lfs/cups +++ b/lfs/cups @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/cups-$(VER) TARGET = $(DIR_INFO)/$(THISAPP) PROG = cups -PAK_VER = 33 +PAK_VER = 34 DEPS = avahi cups-filters dbus ghostscript @@ -80,6 +80,8 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch $(UPDATE_AUTOMAKE) cd $(DIR_APP) && \ ./configure \ @@ -87,9 +89,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --sysconfdir=/var/ipfire \ --localstatedir=/var \ --enable-debug \ - --enable-avahi \ + --with-dnssd=avahi \ --enable-dbus \ - --enable-gnutls \ + --with-tls=openssl \ --enable-libusb cd $(DIR_APP) && make $(MAKETUNING) diff --git a/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch b/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch new file mode 100644 index 000000000..a356474d2 --- /dev/null +++ b/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch @@ -0,0 +1,337 @@ +--- cups-2.4.2/cups/tls-openssl.c.orig 2022-05-26 08:17:21.000000000 +0200 ++++ cups-2.4.2/cups/tls-openssl.c 2023-04-24 20:13:16.431108315 +0200 +@@ -1,7 +1,7 @@ + /* + * TLS support code for CUPS using OpenSSL/LibreSSL. + * +- * Copyright © 2020-2022 by OpenPrinting ++ * Copyright © 2020-2023 by OpenPrinting + * Copyright © 2007-2019 by Apple Inc. + * Copyright © 1997-2007 by Easy Software Products, all rights reserved. + * +@@ -35,7 +35,8 @@ + static time_t http_get_date(X509 *cert, int which); + //static void http_load_crl(void); + static const char *http_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext); +-static void http_x509_add_san(X509 *cert, const char *name); ++static int http_x509_add_ext(X509 *cert, int nid, const char *value); ++static void http_x509_add_san(GENERAL_NAMES *gens, const char *name); + + + /* +@@ -79,11 +80,15 @@ + cups_lang_t *language; // Default language info + time_t curtime; // Current time + X509_NAME *name; // Subject/issuer name ++ ASN1_INTEGER *serial; // Serial number ++ ASN1_TIME *notBefore, // Initial date ++ *notAfter; // Expiration date + BIO *bio; // Output file + char temp[1024], // Temporary directory name + crtfile[1024], // Certificate filename + keyfile[1024]; // Private key filename + const char *common_ptr; // Pointer into common name ++ GENERAL_NAMES *gens; // Names for SubjectAltName certificate extension + + + DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date)); +@@ -104,7 +109,7 @@ + // Create the encryption key... + DEBUG_puts("1cupsMakeServerCredentials: Creating key pair."); + +- if ((rsa = RSA_generate_key(2048, RSA_F4, NULL, NULL)) == NULL) ++ if ((rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL)) == NULL) + { + _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1); + return (0); +@@ -131,25 +136,43 @@ + return (0); + } + +- curtime = time(NULL); +- language = cupsLangDefault(); ++ curtime = time(NULL); ++ ++ notBefore = ASN1_TIME_new(); ++ ASN1_TIME_set(notBefore, curtime); ++ X509_set_notBefore(cert, notBefore); ++ ASN1_TIME_free(notBefore); ++ ++ notAfter = ASN1_TIME_new(); ++ ASN1_TIME_set(notAfter, expiration_date); ++ X509_set_notAfter(cert, notAfter); ++ ASN1_TIME_free(notAfter); ++ ++ serial = ASN1_INTEGER_new(); ++ ASN1_INTEGER_set(serial, (int)curtime); ++ X509_set_serialNumber(cert, serial); ++ ASN1_INTEGER_free(serial); + +- ASN1_TIME_set(X509_get_notBefore(cert), curtime); +- ASN1_TIME_set(X509_get_notAfter(cert), expiration_date); +- ASN1_INTEGER_set(X509_get_serialNumber(cert), (int)curtime); + X509_set_pubkey(cert, pkey); + +- name = X509_get_subject_name(cert); ++ language = cupsLangDefault(); ++ name = X509_NAME_new(); + if (strlen(language->language) == 5) +- X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, (unsigned char *)language->language + 3, -1, -1, 0); ++ X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)language->language + 3, -1, -1, 0); + else +- X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, (unsigned char *)"US", -1, -1, 0); +- X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); +- X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0); ++ X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)"US", -1, -1, 0); ++ X509_NAME_add_entry_by_txt(name, SN_commonName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0); ++ X509_NAME_add_entry_by_txt(name, SN_organizationName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0); ++ X509_NAME_add_entry_by_txt(name, SN_organizationalUnitName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); ++ X509_NAME_add_entry_by_txt(name, SN_stateOrProvinceName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); ++ X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); + + X509_set_issuer_name(cert, name); ++ X509_set_subject_name(cert, name); ++ X509_NAME_free(name); + +- http_x509_add_san(cert, common_name); ++ gens = sk_GENERAL_NAME_new_null(); ++ http_x509_add_san(gens, common_name); + if ((common_ptr = strstr(common_name, ".local")) == NULL) + { + // Add common_name.local to the list, too... +@@ -161,7 +184,7 @@ + *localptr = '\0'; + strlcat(localname, ".local", sizeof(localname)); + +- http_x509_add_san(cert, localname); ++ http_x509_add_san(gens, localname); + } + + if (num_alt_names > 0) +@@ -171,10 +194,22 @@ + for (i = 0; i < num_alt_names; i ++) + { + if (strcmp(alt_names[i], "localhost")) +- http_x509_add_san(cert, alt_names[i]); ++ http_x509_add_san(gens, alt_names[i]); + } + } + ++ // Add extension with DNS names and free buffer for GENERAL_NAME ++ X509_add1_ext_i2d(cert, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT); ++ sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); ++ ++ // Add extensions that are required to make Chrome happy... ++ http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:FALSE,pathlen:0"); ++ http_x509_add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment"); ++ http_x509_add_ext(cert, NID_ext_key_usage, "1.3.6.1.5.5.7.3.1"); ++ http_x509_add_ext(cert, NID_subject_key_identifier, "hash"); ++ http_x509_add_ext(cert, NID_authority_key_identifier, "keyid,issuer"); ++ X509_set_version(cert, 2); // v3 ++ + X509_sign(cert, pkey, EVP_sha256()); + + // Save them... +@@ -959,6 +994,7 @@ + const char *cn, // Common name to lookup + *cnptr; // Pointer into common name + int have_creds = 0; // Have credentials? ++ int key_status, crt_status; // Key and certificate load status + + context = SSL_CTX_new(TLS_server_method()); + +@@ -1002,6 +1038,8 @@ + else + cn = tls_common_name; + ++ _cupsMutexLock(&tls_mutex); ++ + if (cn) + { + // First look in the CUPS keystore... +@@ -1042,20 +1080,41 @@ + { + DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", cn)); + +- if (!cupsMakeServerCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 365 * 86400)) ++ if (!cupsMakeServerCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 3650 * 86400)) + { + DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed."); + http->error = errno = EINVAL; + http->status = HTTP_STATUS_ERROR; + _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1); +- SSL_CTX_free(context); ++ SSL_CTX_free(context); ++ _cupsMutexUnlock(&tls_mutex); + + return (-1); + } + } + +- SSL_CTX_use_PrivateKey_file(context, keyfile, SSL_FILETYPE_PEM); +- SSL_CTX_use_certificate_file(context, crtfile, SSL_FILETYPE_PEM); ++ _cupsMutexUnlock(&tls_mutex); ++ ++ DEBUG_printf(("4_httpTLSStart: Using private key file '%s'.", keyfile)); ++ DEBUG_printf(("4_httpTLSStart: Using certificate file '%s'.", crtfile)); ++ ++ crt_status = SSL_CTX_use_certificate_chain_file(context, crtfile); ++ key_status = SSL_CTX_use_PrivateKey_file(context, keyfile, SSL_FILETYPE_PEM); ++ ++ if (!key_status || !crt_status) ++ { ++ // Unable to load private key or certificate... ++ DEBUG_puts("4_httpTLSStart: Unable to use private key or certificate chain file."); ++ if ((error = ERR_get_error()) != 0) ++ _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, ERR_error_string(error, NULL), 0); ++ ++ http->status = HTTP_STATUS_ERROR; ++ http->error = EIO; ++ ++ SSL_CTX_free(context); ++ ++ return (-1); ++ } + } + + // Set TLS options... +@@ -1068,6 +1127,8 @@ + strlcat(cipherlist, ":!SHA1:!SHA256:!SHA384", sizeof(cipherlist)); + strlcat(cipherlist, ":@STRENGTH", sizeof(cipherlist)); + ++ DEBUG_printf(("4_httpTLSStart: cipherlist='%s', tls_min_version=%d, tls_max_version=%d", cipherlist, tls_min_version, tls_max_version)); ++ + SSL_CTX_set_min_proto_version(context, versions[tls_min_version]); + SSL_CTX_set_max_proto_version(context, versions[tls_max_version]); + SSL_CTX_set_cipher_list(context, cipherlist); +@@ -1094,7 +1155,8 @@ + + if (http->mode == _HTTP_MODE_CLIENT) + { +- // Negotiate as a server... ++ // Negotiate as a client... ++ DEBUG_puts("4_httpTLSStart: Calling SSL_connect..."); + if (SSL_connect(http->tls) < 1) + { + // Failed +@@ -1109,12 +1171,15 @@ + SSL_free(http->tls); + http->tls = NULL; + ++ DEBUG_printf(("4_httpTLSStart: Returning -1 (%s)", ERR_error_string(error, NULL))); ++ + return (-1); + } + } + else + { + // Negotiate as a server... ++ DEBUG_puts("4_httpTLSStart: Calling SSL_accept..."); + if (SSL_accept(http->tls) < 1) + { + // Failed +@@ -1129,10 +1194,14 @@ + SSL_free(http->tls); + http->tls = NULL; + ++ DEBUG_printf(("4_httpTLSStart: Returning -1 (%s)", ERR_error_string(error, NULL))); ++ + return (-1); + } + } + ++ DEBUG_puts("4_httpTLSStart: Returning 0."); ++ + return (0); + } + +@@ -1152,6 +1221,8 @@ + SSL_shutdown(http->tls); + SSL_CTX_free(context); + SSL_free(http->tls); ++ ++ http->tls = NULL; + } + + +@@ -1564,32 +1635,62 @@ + + + // +-// 'http_x509_add_san()' - Add a subjectAltName extension to an X.509 certificate. ++// 'http_x509_add_ext()' - Add an extension to a certificate. + // + +-static void +-http_x509_add_san(X509 *cert, // I - Certificate +- const char *name) // I - Hostname ++static int // O - 1 on success, 0 on failure ++http_x509_add_ext(X509 *cert, // I - Certificate ++ int nid, // I - Extension ID ++ const char *value) // I - Value + { +- char dns_name[1024]; // DNS: prefixed hostname +- X509_EXTENSION *san_ext; // Extension for subjectAltName +- ASN1_OCTET_STRING *san_asn1; // ASN1 string ++ int ret; // Return value ++ X509_EXTENSION *ex = NULL; // Extension ++ X509V3_CTX ctx; // Certificate context + + +- // The subjectAltName value for DNS names starts with a DNS: prefix... +- snprintf(dns_name, sizeof(dns_name), "DNS: %s", name); ++ DEBUG_printf(("3http_x509_add_ext(cert=%p, nid=%d, value=\"%s\")", (void *)cert, nid, value)); + +- if ((san_asn1 = ASN1_OCTET_STRING_new()) == NULL) +- return; ++ // Don't use a configuration database... ++ X509V3_set_ctx_nodb(&ctx); + +- ASN1_OCTET_STRING_set(san_asn1, (unsigned char *)dns_name, strlen(dns_name)); +- if ((san_ext = X509_EXTENSION_create_by_NID(NULL, NID_subject_alt_name, 0, san_asn1)) == NULL) ++ // Self-signed certificates use the same issuer and subject... ++ X509V3_set_ctx(&ctx, /*issuer*/cert, /*subject*/cert, /*req*/NULL, /*crl*/NULL, /*flags*/0); ++ ++ // Create and add the extension... ++ if ((ex = X509V3_EXT_conf_nid(/*conf*/NULL, &ctx, nid, value)) == NULL) + { +- ASN1_OCTET_STRING_free(san_asn1); +- return; ++ DEBUG_puts("4http_x509_add_ext: Unable to create extension, returning false."); ++ return (0); + } + +- X509_add_ext(cert, san_ext, -1); +- X509_EXTENSION_free(san_ext); +- ASN1_OCTET_STRING_free(san_asn1); ++ ret = X509_add_ext(cert, ex, -1) != 0; ++ ++ DEBUG_printf(("4http_x509_add_ext: X509_add_ext returned %s.", ret ? "true" : "false")); ++ ++ // Free the extension and return... ++ X509_EXTENSION_free(ex); ++ ++ return (ret); ++} ++ ++ ++// ++// 'http_x509_add_san()' - Add a subjectAltName to GENERAL_NAMES used for ++// the extension to an X.509 certificate. ++// ++ ++static void ++http_x509_add_san(GENERAL_NAMES *gens, // I - Concatenation of DNS names ++ const char *name) // I - Hostname ++{ ++ GENERAL_NAME *gen_dns = GENERAL_NAME_new(); ++ // DNS: name ++ ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new(); ++ // Hostname string ++ ++ ++ // Set the strings and push it on the GENERAL_NAMES list... ++ ASN1_STRING_set(ia5, name, strlen(name)); ++ GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5); ++ sk_GENERAL_NAME_push(gens, gen_dns); + } diff --git a/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch b/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch new file mode 100644 index 000000000..ebd3a4843 --- /dev/null +++ b/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch @@ -0,0 +1,16 @@ +--- cups-2.4.2/scheduler/conf.c.orig 2022-05-26 08:17:21.000000000 +0200 ++++ cups-2.4.2/scheduler/conf.c 2023-04-23 15:37:48.521145700 +0200 +@@ -605,11 +605,11 @@ + ClassifyOverride = 0; + + #ifdef HAVE_TLS +-# ifdef HAVE_GNUTLS ++# if defined HAVE_GNUTLS || defined HAVE_OPENSSL + cupsdSetString(&ServerKeychain, "ssl"); + # else + cupsdSetString(&ServerKeychain, "/Library/Keychains/System.keychain"); +-# endif /* HAVE_GNUTLS */ ++# endif /* HAVE_GNUTLS || HAVE_OPENSSL */ + + _httpTLSSetOptions(_HTTP_TLS_NONE, _HTTP_TLS_1_0, _HTTP_TLS_MAX); + #endif /* HAVE_TLS */ -- 2.40.0

1 1

[PATCH] firewall: Allow traffic from multicast networks
by Stefan Schantl 26 Apr '23

26 Apr '23

The multicast network segment 224.0.0.0/4 is used for a lot of different services provided by the local ISP's. (IPTV etc.) We have to allow traffic from this networks when using one of the BOGON blocklists in order to get those ISP services still accessable. https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xh… Fixes 13092. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/firewall/rules.pl | 1 + 1 file changed, 1 insertion(+) diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index 6c08feb86..7edb910e2 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -55,6 +55,7 @@ my @PRIVATE_NETWORKS = ( "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", + "224.0.0.0/4", ); # MARK masks -- 2.30.2

2 1

[PATCH] apr: Update 1.7.2 => 1.7.4
by Matthias Fischer 25 Apr '23

25 Apr '23

For details see: https://downloads.apache.org/apr/CHANGES-APR-1.7 "Changes for APR 1.7.4 *) Fix a regression where writing to a file opened with both APR_FOPEN_APPEND and APR_FOPEN_BUFFERED did not properly append the data on Windows. (This regression was introduced in APR 1.7.3) [Evgeny Kotkov] Changes for APR 1.7.3 *) apr-1-config: Fix crosscompiling detection in apr-1-config. PR 66510 [Ruediger Pluem] *) configure: Add --enable-sysv-shm to use SysV shared memory (shmget) if available. [Ruediger Pluem] *) apr_socket_sendfile: Use WSAIoctl() to get TransmitFile function pointer on Windows. [Ivan Zhakov] *) apr_dir_read: Do not request short file names on Windows 7 and later. [Ivan Zhakov] *) apr_file_gets: Optimize for buffered files on Windows. [Evgeny Kotkov] *) Fix a deadlock when writing to locked files opened with APR_FOPEN_APPEND on Windows. PR 50058. [Evgeny Kotkov] *) Don't seek to the end when opening files with APR_FOPEN_APPEND on Windows. [Evgeny Kotkov] *) apr_file_write: Optimize large writes to buffered files on Windows. [Evgeny Kotkov] *) apr_file_read: Optimize large reads from buffered files on Windows. [Evgeny Kotkov]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/apr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/apr b/lfs/apr index 6ef88fd18..1375448ff 100644 --- a/lfs/apr +++ b/lfs/apr @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 1.7.2 +VER = 1.7.4 THISAPP = apr-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a17ee4311a33acee0bdeb9e5225a198f9dec1b2e0267a742080c77d5342e5052392a5a2100a0ba85f5a192b8679838a7002d4c9a12aa5bdd7921eff025b75d15 +$(DL_FILE)_BLAKE2 = a93b9d3f2c46fe0a34ce1d544e7a43ba40720e2fae8b8a7d0957413ac695057902378dbf96f067ced7486da86c8e513b7fbd48fa79839efeeb40a3295fe2d3df install : $(TARGET) -- 2.34.1

2 2

[PATCH] apr 1.7.4: Fix for rootfile
by Matthias Fischer 25 Apr '23

25 Apr '23

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/apr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/common/apr b/config/rootfiles/common/apr index 50b811bdd..c49b93a58 100644 --- a/config/rootfiles/common/apr +++ b/config/rootfiles/common/apr @@ -45,7 +45,7 @@ usr/bin/apr-1-config #usr/lib/libapr-1.la #usr/lib/libapr-1.so usr/lib/libapr-1.so.0 -usr/lib/libapr-1.so.0.7.2 +usr/lib/libapr-1.so.0.7.4 #usr/lib/pkgconfig/apr-1.pc #usr/share/apr-1 #usr/share/apr-1/build -- 2.34.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2023