Development June 2023

development@lists.ipfire.org

10 participants
38 discussions

Re: IPFire 2.27 - Core Update 164 is available for testing
by Adolf Belka 28 May '24

28 May '24

Hi All, Just tested out CU164 on my vm testbed system. The update went without any problems. You see the pakfire log status again on the wui page during the update. OpenVPN RW setup ran without any issues. Connection successfully made. IPS has the multiple providers option successfully in place. I eventually found the Force Update of rules button, which was very useful for my vm testbed as it is not running all the time and so the rules were a bit out of date. As far as I can tell everything is working fine on it. No issues detected. I will let it run over the next few days during the daytime and see how things go. Regards, Adolf. On 20/02/2022 18:35, IPFire Project wrote: > IPFire Logo > > there is a new post from Michael Tremer on the IPFire Blog: > > *IPFire 2.27 - Core Update 164 is available for testing* > > It is time to test another release for IPFire: IPFire 2.27 - Core Update 164. It comes with a vastly improved firewall engine, a new kernel and various security and bug fixes. Please help us testing this release and if you would like to support us, please donate. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-164-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

4 8

Start local and uplink network independent
by Jonatan Schlag 21 Aug '23

21 Aug '23

Hi, this is the first try for a patch series which makes the startup of local and uplink networks independent. This resolves in the end #11502. It should further allow us to keep waiting for a DHCP lease, because at least our local networks are all up when we get to the red network. This might have some small quirks, even when my testing so far shows no problems. I still think it is now better to share result, then to wait any longer. As this touches quite important parts of our network stack, I might be a could idea to merge this in two stages. After the patch, titled "network startup: Clean up duplicated Code ", might be a good breaking point. But in the end, this is up to you. Please keep in mind, I only tested the full patch set: Remove ipsec interface creation from network startup Remove Start/Stop links for client175 Use bash as shebang in network initscripts network initscripts: check if the zone in the current config exists network initscripts: Remove code for old zone scheme network scripts: remove check for AUTOCONNECT network startup: Reload routing informations for every interface network startup: Always cleanup before red gets started network startup: check for correct action at start network startup: Refactor how cmd args are processed network startup: Clean up duplicated Code network script: add extra scripts for action that depend on a network network startup: Add scripts for local and uplink network startup: Start local and uplink network independent network startup: Only work with configured zones config/rootfiles/common/aarch64/initscripts | 31 +++-- config/rootfiles/common/riscv64/initscripts | 31 +++-- config/rootfiles/common/x86_64/initscripts | 31 +++-- lfs/initscripts | 36 +++--- src/initscripts/networking/any | 31 ++++- src/initscripts/networking/functions.network | 14 +- src/initscripts/networking/red | 5 +- .../networking/red.up/99-pakfire-update | 2 +- src/initscripts/system/depends-on-network | 40 ++++++ src/initscripts/system/network | 121 ++++++++---------- 10 files changed, 218 insertions(+), 124 deletions(-) create mode 100644 src/initscripts/system/depends-on-network Looking forward to your feedback Greetings Jonatan

2 34

Re: IPFire 2.27 - Core Update 176 is available for testing
by Adolf Belka 11 Jul '23

11 Jul '23

Hi All, So far everything I have tested has worked as expected. That includes the OpenVPN roadwarrior connection. Looking good so far :crossed_fingers: Regards, Adolf. On 29/06/2023 12:20, IPFire Project wrote: > IPFire Logo > > there is a new post from Peter Müller on the IPFire Blog: > > *IPFire 2.27 - Core Update 176 is available for testing* > > The next update, IPFire 2.27 - Core Update 176, is available for testing. It features a toolchain and package updates (among the security-relevant of them are Intel microcodes), brings the latest batch of bug fixes. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-176-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

3 3

[PATCH] iproute2: Update to version 6.4.0
by Adolf Belka 03 Jul '23

03 Jul '23

- Update from version 6.3.0 to 6.4.0 - Update of rootfile not required - Changelog can only be reviewed by looking at the commits in the git repo https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/ Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/iproute2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/iproute2 b/lfs/iproute2 index c773291f3..cfdb474cb 100644 --- a/lfs/iproute2 +++ b/lfs/iproute2 @@ -24,7 +24,7 @@ include Config -VER = 6.3.0 +VER = 6.4.0 THISAPP = iproute2-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a7b48c59c8a30f56ca810136f4d9f681fe38359999c260227a6229b972ce70b233d2865a6543cf3f70ed586825f9191c22d459a9fc5cc8c7dbf3ab417064c8a7 +$(DL_FILE)_BLAKE2 = 76369d2a794afd13dba1a34ee9a7425775bb7b43c22164274749c01b18d061669aa5abd51d32a15d68f48e75f4837a887dfc28ea41e34d8e4c36b2ab865628dd install : $(TARGET) -- 2.41.0

3 6

[PATCH] squid-asnbl: Fix for bug#13023 - squid-asnbl-helper segfaulting and shutdown squid
by Adolf Belka 01 Jul '23

01 Jul '23

- Patch provided by bug reporter. Here is the description of the problem from the bug. First I discovered that the helper only sometimes throwing the error and quits even for the same values and queries. Also the timespan until the error happens was quite different for every restart of squid (minutes to hours). And it does not depend on the traffic on the proxy, even one connection could cause a crash while ten or hundrets won't. After a few days of testing different solutions and done a lot of debugging, redesigning the function did not fully solve the problem. Such standard things like checking the result variable for NULL (or it's equivalent "is None" in python) before evaluating it's subfunction produces the exact same error message. But with that knowledge it more and more turns out that python3 sometimes 'detects' the local return variable if it was a misused global. So for a full fix, the return variable also has to be initialized that python3 won't detect it's usage as an 'UnboundLocalError' to succesfully fix this bug. - LFS file updated to run patch before copying helper into place. - Update of rootfile not needed. - Bug reporter has been requested to raise this issue at the git repo for squid-asnbl. Fixes: Bug#13023 Tested-by: Nicolas Pӧhlmann <business(a)hardcoretec.com> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/squid-asnbl | 1 + ...les_to_make_compatible_with_python_3.patch | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch diff --git a/lfs/squid-asnbl b/lfs/squid-asnbl index 130b28460..b003d605b 100644 --- a/lfs/squid-asnbl +++ b/lfs/squid-asnbl @@ -75,6 +75,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zvxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch # Install ASNBL helper script cd $(DIR_APP) && install -o root -g root -m 0755 asnbl-helper.py /usr/bin/asnbl-helper.py diff --git a/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch b/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch new file mode 100644 index 000000000..e540d4e76 --- /dev/null +++ b/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch @@ -0,0 +1,100 @@ +--- squid-asnbl-0.2.4/asnbl-helper_orig.py ++++ squid-asnbl-0.2.4/asnbl-helper.py +@@ -172,17 +172,19 @@ + return parsedasns + + +-def resolve_asn(ipaddr: str, asndb): +- """ Function call: resolve_asn(IP address to be resolved, +- ASN database instance object) +- This function looks up the Autonomous System for the given IP address. It expects +- an IPFire location database object to be passed as a second parameter, hence relying +- on another function to set that up. """ ++def resolve_asn(ipaddr: str): ++ """ Function call: resolve_asn(IP address to be resolved) ++ This function looks up the Autonomous System for the given IP address. """ ++ ++ # Fix for #13023 ++ # Initialize the result variable before it's first use, otherwise python3 ++ # will sometimes detect a 'mismatch' using global and local variables ++ lookup_result = None + + # libloc cannot handle ipaddress objects here, so casting into a string is necessary + # for good measure, to avoid exceptions here... + try: +- result = asndb.lookup(str(ipaddr)) ++ lookup_result = ASNDB.lookup(str(ipaddr)) + except BlockingIOError: + # XXX: Prevent likely libloc bug from causing this helper to crash + # (see upstream bug https://bugzilla.ipfire.org/show_bug.cgi?id=13023) +@@ -190,21 +192,25 @@ + + # In case nothing was returned above, satisfy result expectation to this function... + try: +- if not result.asn: ++ if not lookup_result.asn: + return 0 + except AttributeError: + return 0 + +- return result.asn +- +- +-def asndb_response_tests(testdata: str, asndb): +- """ Function call: asndb_response_tests(response rest data, +- ASN database instance object) ++ return lookup_result.asn ++ ++ ++def asndb_response_tests(testdata: str): ++ """ Function call: asndb_response_tests(response rest data) + + This function asserts the given ASN database to return expected ASNs for + given IP addresses in order to be considered operational. It returns + True if this test succeeds, and False otherwise. """ ++ ++ # Fix for #13023 ++ # Initialize the result variable before it's first use, otherwise python3 ++ # will sometimes detect a 'mismatch' using global and local variables ++ lookup_result_test = None + + tresult = True + +@@ -216,13 +222,13 @@ + + for stestdata in ptdata: + LOGIT.debug("Running response test for '%s' against ASNDB '%s' ...", +- stestdata, asndb) +- +- returndata = resolve_asn(stestdata[0], asndb) +- +- if returndata != int(stestdata[1]): ++ stestdata, ASNDB) ++ ++ lookup_result_test = resolve_asn(stestdata[0]) ++ ++ if lookup_result_test != int(stestdata[1]): + LOGIT.error("Response test failed for ASNDB '%s' (tuple: %s), aborting", +- asndb, stestdata) ++ ASNDB, stestdata) + tresult = False + break + +@@ -428,7 +434,7 @@ + ASNDB = set_up_location_database(config["GENERAL"]["ASNDB_PATH"]) + + LOGIT.debug("Running ASN database response tests...") +-if asndb_response_tests(config["GENERAL"]["TESTDATA"], ASNDB): ++if asndb_response_tests(config["GENERAL"]["TESTDATA"]): + LOGIT.debug("ASN database operational - excellent. Waiting for input...") + else: + LOGIT.error("ASN database response tests failed, aborting") +@@ -490,7 +496,7 @@ + ASNS = [] + for singleip in IPS: + # Enumerate ASN for this IP address... +- resolvedasn = resolve_asn(singleip, ASNDB) ++ resolvedasn = resolve_asn(singleip) + + # In case protection against destinations without public AS announcements for their + # IP addresses is desired, the query will be denied in case ASN = 0 appears in an -- 2.39.2

2 3

[PATCH] sudo: Update to version 1.9.14
by Adolf Belka 01 Jul '23

01 Jul '23

- Update from version 1.9.13p3 to 1.9.14 - Update of rootfile not required - Changelog Significant change is that use_pty is now defined as the default setting. This parameter was made available back in version 1.8.0 but not as default. It was implemented in response to a variety of CVE's related to being vulnerable to privilege escalation via TIOCSTI and/or lesser-known TIOCLINUX command injection. Apparently it was not made default as that would change the way that sudo worked. As various existing bugs have been resolved it has now been declared by the sudo devs that now sudo with a pseudo terminal works close to the same as with the users terminal Hence in this version the use of the pseudo terminal is now default. See https://github.com/sudo-project/sudo/issues/258 for more details. 1.9.14 Fixed a bug where if the intercept or log_subcmds sudoers option was enabled and a sub-command was run where the first entry of the argument vector didn't match the command being run. This resulted in commands like sudo su - being killed due to the mismatch. Bug #1050. The sudoers plugin now canonicalizes command path names before matching (where possible). This fixes a bug where sudo could execute the wrong path if there are multiple symbolic links with the same target and the same base name in sudoers that a user is allowed to run. GitHub issue #228. Improved command matching when a chroot is specified in sudoers. The sudoers plugin will now change the root directory id needed before performing command matching. Previously, the root directory was simply prepended to the path that was being processed. When NETGROUP_BASE is set in the ldap.conf file, sudo will now perform its own netgroup lookups of the host name instead of using the system innetgr(3) function. This guarantees that user and host netgroup lookups are performed using the same LDAP server (or servers). Fixed a bug introduced in sudo 1.9.13 that resulted in a missing " ; " separator between environment variables and the command in log entries. The visudo utility now displays a warning when it ignores a file in an include dir such as /etc/sudoers.d. When running a command in a pseudo-terminal, sudo will initialize the terminal settings even if it is the background process. Previously, sudo only initialized the pseudo-terminal when running in the foreground. This fixes an issue where a program that checks the window size would read the wrong value when sudo was running in the background. Fixed a bug where only the first two digits of the TSID field being was logged. Bug #1046. The use_pty sudoers option is now enabled by default. To restore the historic behavior where a command is run in the user's terminal, add Defaults !use_pty to the sudoers file. GitHub issue #258. Sudo's -b option now works when the command is run in a pseudo-terminal. When disabling core dumps, sudo now only modifies the soft limit and leaves the hard limit as-is. This avoids problems on Linux when sudo does not have CAP_SYS_RESOURCE, which may be the case when run inside a container. GitHub issue #42. Sudo configuration file paths have been converted to colon-separated lists of paths. This makes it possible to have configuration files on a read-only file system while still allowing for local modifications in a different (writable) directory. The new --enable-adminconf configure option can be used to specify a directory that is searched for configuration files in preference to the sysconfdir (which is usually /etc). The intercept_verify sudoers option is now only applied when the intercept option is set in sudoers. Previously, it was also applied when log_subcmds was enabled. The NETGROUP_QUERY ldap.conf parameter can now be disabled for LDAP servers that do not support querying the nisNetgroup object by its nisNetgroupTriple attribute, while still allowing sudo to query the LDAP server directly to determine netgroup membership. Fixed a long-standing bug where a sudoers rule without an explicit runas list allowed the user to run a command as root and any group instead of just one of the groups that root is a member of. For example, a rule such as myuser ALL = ALL would permit sudo -u root -g othergroup even if root did not belong to othergroup. Fixed a bug where a sudoers rule with an explicit runas list allowed a user to run sudo commands as themselves. For example, a rule such as myuser ALL = (root) ALL, myuser should only allow commands to be run as root (optionally using one of root's groups). However, the rule also allowed the user to run sudo -u myuser -g myuser command. Fixed a bug that prevented the user from specifying a group on the command line via sudo -g if the rule's Runas_Spec contained a Runas_Alias. Sudo now requires a C99 compiler due to the use of flexible array members. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sudo | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/sudo b/lfs/sudo index 759e3c83a..3a55174d3 100644 --- a/lfs/sudo +++ b/lfs/sudo @@ -24,7 +24,7 @@ include Config -VER = 1.9.13p3 +VER = 1.9.14 THISAPP = sudo-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 46218ecf4cf06d2280ccf4c257b12a6f697eda17b96a6b7aa56f6c7f22d847ec2a8036b9f615c3328d985656539c95f37a40c6c72dfa5f65786ab45a28cf353f +$(DL_FILE)_BLAKE2 = 5731eda1cabb23dd3b77851ce1fcde8e1b7efc1b4fa27fe65522c7b8e23c0330003eb2d4ebb47d63416fb3a52db478b2f60ca22da6a2d66cb27c52ea5264749e install : $(TARGET) -- 2.41.0

2 1

[PATCH] ntp: Update to version 4.2.8p17
by Adolf Belka 01 Jul '23

01 Jul '23

- Update from version 4.2.8p15 to 4.2.8p17 - Update of rootfile not required - Tested out on vm testbed. Time correctly updated every hour and pakfire was able to download and install various addons without any problems indicating that the time is working correctly. - patch to enable build with glibc-2.34 no longer needed. ntp updated to work correctly with glibc-2.34 but IPFire running with version 2.37. Version 2.4.8p17 built without any problems without the patch. - Changelog 4.2.8p17 2023/06/06 Released by Harlan Stenn <stenn(a)ntp.org> * [Bug 3824] Spurious "ntpd: daemon failed to notify parent!" logged at event_sync. Reported by Edward McGuire. <hart(a)ntp.org> * [Bug 3822] ntpd significantly delays first poll of servers specified by name. <hart(a)ntp.org> Miroslav Lichvar identified regression in 4.2.8p16. * [Bug 3821] 4.2.8p16 misreads hex authentication keys, won't interop with 4.2.8p15 or earlier. Reported by Matt Nordhoff, thanks to Miroslav Lichvar and Matt for rapid testing and identifying the problem. <hart(a)ntp.org> * Add tests/libntp/digests.c to catch regressions reading keys file or with symmetric authentication digest output. 4.2.8p16 2023/05/31 Released by Harlan Stenn <stenn(a)ntp.org> * [Sec 3808] Assertion failure in ntpq on malformed RT-11 date <perlinger(a)ntp.org> * [Sec 3807] praecis_parse() in the Palisade refclock driver has a hypothetical input buffer overflow. Reported by ... stenn@ * [Sec 3806] libntp/mstolfp.c needs bounds checking <perlinger(a)ntp.org> - solved numerically instead of using string manipulation * [Sec 3767] An OOB KoD RATE value triggers an assertion when debug is enabled. <stenn(a)ntp.org> * [Bug 3819] Updated libopts/Makefile.am was missing NTP_HARD_* values. <stenn@> * [Bug 3817] Bounds-check "tos floor" configuration. <hart(a)ntp.org> * [Bug 3814] First poll delay of new or cleared associations miscalculated. <hart(a)ntp.org> * [Bug 3802] ntp-keygen -I default identity modulus bits too small for OpenSSL 3. Reported by rmsh1216(a)163.com <hart(a)ntp.org> * [Bug 3801] gpsdjson refclock gps_open() device name mishandled. <hart(a)ntp.org> * [Bug 3800] libopts-42.1.17 does not compile with Microsoft C. <hart(a)ntp.org> * [Bug 3799] Enable libopts noreturn compiler advice for MSC. <hart(a)ntp.org> * [Bug 3797] Windows getaddrinfo w/AI_ADDRCONFIG fails for localhost when disconnected, breaking ntpq and ntpdc. <hart(a)ntp.org> * [Bug 3795] pollskewlist documentation uses | when it shouldn't. - ntp.conf manual page and miscopt.html corrections. <hart(a)ntp.org> * [Bug 3793] Wrong variable type passed to record_raw_stats(). <hart(a)ntp.org> - Report and patch by Yuezhen LUAN <wei6410(a)sina.com>. * [Bug 3786] Timer starvation on high-load Windows ntpd. <hart(a)ntp.org> * [Bug 3784] high-load ntpd on Windows deaf after enough ICMP TTL exceeded. <hart(a)ntp.org> * [Bug 3781] log "Unable to listen for broadcasts" for IPv4 <hart(a)ntp.org> * [Bug 3774] mode 6 packets corrupted in rawstats file <hart(a)ntp.org> - Reported by Edward McGuire, fix identified by <wei6410(a)sina.com>. * [Bug 3758] Provide a 'device' config statement for refclocks <perlinger(a)ntp.org> * [Bug 3757] Improve handling of Linux-PPS in NTPD <perlinger(a)ntp.org> * [Bug 3741] 4.2.8p15 can't build with glibc 2.34 <perlinger(a)ntp.org> * [Bug 3725] Make copyright of clk_wharton.c compatible with Debian. Philippe De Muyter <phdm(a)macqel.be> * [Bug 3724] ntp-keygen with openSSL 1.1.1 fails on Windows <perlinger(a)ntp.org> - openssl applink needed again for openSSL-1.1.1 * [Bug 3719] configure.ac checks for closefrom() and getdtablesize() missing. Reported by Brian Utterback, broken in 2010 by <hart(a)ntp.org> * [Bug 3699] Problems handling drift file and restoring previous drifts <perlinger(a)ntp.org> - command line options override config statements where applicable - make initial frequency settings idempotent and reversible - make sure kernel PLL gets a recovered drift componsation * [Bug 3695] Fix memory leak with ntpq on Windows Server 2019 <perlinger(a)ntp.org> * [Bug 3694] NMEA refclock seems to unnecessarily require location in messages - misleading title; essentially a request to ignore the receiver status. Added a mode bit for this. <perlinger(a)ntp.org> * [Bug 3693] Improvement of error handling key lengths <perlinger(a)ntp.org> - original patch by Richard Schmidt, with mods & unit test fixes * [Bug 3692] /dev/gpsN requirement prevents KPPS <perlinger(a)ntp.org> - implement/wrap 'realpath()' to resolve symlinks in device names * [Bug 3691] Buffer Overflow reading GPSD output - original patch by matt<ntpbr(a)mattcorallo.com> - increased max PDU size to 4k to avoid truncation * [Bug 3690] newline in ntp clock variable (parse) <perlinger(a)ntp.org> - patch by Frank Kardel * [Bug 3689] Extension for MD5, SHA-1 and other keys <perlinger(a)ntp.org> - ntp{q,dc} now use the same password processing as ntpd does in the key file, so having a binary secret >= 11 bytes is possible for all keys. (This is a different approach to the problem than suggested) * [Bug 3688] GCC 10 build errors in testsuite <perlinger(a)ntp.org> * [Bug 3687] ntp_crypto_rand RNG status not known <perlinger(a)ntp.org> - patch by Gerry Garvey * [Bug 3682] Fixes for warnings when compiled without OpenSSL <perlinger(a)ntp.org> - original patch by Gerry Garvey * [Bug 3677] additional peer events not decoded in associations listing <perlinger(a)ntp.org> - original patch by Gerry Garvey * [Bug 3676] compiler warnings (CMAC, interrupt_buf, typo, fallthrough) - applied patches by Gerry Garvey * [Bug 3675] ntpq ccmds[] stores pointer to non-persistent storage * [Bug 3674] ntpq command 'execute only' using '~' prefix <perlinger(a)ntp.org> - idea+patch by Gerry Garvey * [Bug 3672] fix biased selection in median cut <perlinger(a)ntp.org> * [Bug 3666] avoid unlimited receive buffer allocation <perlinger(a)ntp.org> - follow-up: fix inverted sense in check, reset shortfall counter * [Bug 3660] Revert 4.2.8p15 change to manycast. <hart(a)ntp.org> * [Bug 3640] document "discard monitor" and fix the code. <hart(a)ntp.org> - fixed bug identified by Edward McGuire <perlinger(a)ntp.org> * [Bug 3626] (SNTP) UTC offset calculation needs dst flag <perlinger(a)ntp.org> - applied patch by Gerry Garvey * [Bug 3428] ntpd spinning consuming CPU on Linux router with full table. Reported by Israel G. Lugo. <hart(a)ntp.org> * [Bug 3103] libopts zsave_warn format string too few arguments <bkorb(a)gnu.org> * [Bug 2990] multicastclient incorrectly causes bind to broadcast address. Integrated patch from Brian Utterback. <hart(a)ntp.org> * [Bug 2525] Turn on automake subdir-objects across the project. <hart(a)ntp.org> * [Bug 2410] syslog an error message on panic exceeded. <brian.utterback(a)oracle.com> * Use correct rounding in mstolfp(). perlinger/hart * M_ADDF should use u_int32. <hart(a)ntp.org> * Only define tv_fmt_libbuf() if we will use it. <stenn(a)ntp.org> * Use recv_buffer instead of the longer recv_space.X_recv_buffer. hart/stenn * Make sure the value returned by refid_str() prints cleanly. <stenn(a)ntp.org> * If DEBUG is enabled, the startup banner now says that debug assertions are in force and that ntpd will abort if any are violated. <stenn(a)ntp.org> * syslog valid incoming KoDs. <stenn(a)ntp.org> * Rename a poorly-named variable. <stenn(a)ntp.org> * Disable "embedded NUL in string" messages in libopts, when we can. <stenn@> * Use https in the AC_INIT URLs in configure.ac. <stenn(a)ntp.org> * Implement NTP_FUNC_REALPATH. <stenn(a)ntp.org> * Lose a gmake construct in ntpd/Makefile.am. <stenn(a)ntp.org> * upgrade to: autogen-5.18.16 * upgrade to: libopts-42.1.17 * upgrade to: autoconf-2.71 * upgrade to: automake-1.16.15 * Upgrade to libevent-2.1.12-stable <stenn(a)ntp.org> * Support OpenSSL-3.0 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/ntp | 7 ++--- ...tp-4.2.8p15-build-fix-for-glibc-2.34.patch | 29 ------------------- 2 files changed, 3 insertions(+), 33 deletions(-) delete mode 100644 src/patches/ntp-4.2.8p15-build-fix-for-glibc-2.34.patch diff --git a/lfs/ntp b/lfs/ntp index 241a21e1c..aadfbd0c1 100644 --- a/lfs/ntp +++ b/lfs/ntp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.2.8p15 +VER = 4.2.8p17 THISAPP = ntp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5697d6623d79686f9ca9ad907172bf942383067d1e9817117d20db042e9f7410644f236f1a0d77ab6bf6ec468476e12ea65b494a28f0dd8674bf08fc8875cfef +$(DL_FILE)_BLAKE2 = 5c0e90a234cdeab76e7443b42dfd5a0c3c78693a11bdb0fa21c8def91adbdf9b9871498df9d211509632812a9107501da3470104122e9621577541ffd6cd1ab6 install : $(TARGET) @@ -70,7 +70,6 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/ntp-4.2.8p15-build-fix-for-glibc-2.34.patch $(UPDATE_AUTOMAKE) cd $(DIR_APP) && \ ./configure \ diff --git a/src/patches/ntp-4.2.8p15-build-fix-for-glibc-2.34.patch b/src/patches/ntp-4.2.8p15-build-fix-for-glibc-2.34.patch deleted file mode 100644 index 442fe7828..000000000 --- a/src/patches/ntp-4.2.8p15-build-fix-for-glibc-2.34.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 082a504cfcc046c3d8adaae1164268bc94e5108a Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem(a)gmail.com> -Date: Sat, 31 Jul 2021 10:51:41 -0700 -Subject: [PATCH] libntp: Do not use PTHREAD_STACK_MIN on glibc -In glibc 2.34+ PTHREAD_STACK_MIN is not a compile-time constant which -could mean different stack sizes at runtime on different architectures -and it also causes compile failure. Default glibc thread stack size -or 64Kb set by ntp should be good in glibc these days. -Upstream-Status: Pending -Signed-off-by: Khem Raj <raj.khem(a)gmail.com> ---- - libntp/work_thread.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) -diff --git a/libntp/work_thread.c b/libntp/work_thread.c -index 03a5647..3ddd751 100644 ---- a/libntp/work_thread.c -+++ b/libntp/work_thread.c -@@ -41,7 +41,7 @@ - #ifndef THREAD_MINSTACKSIZE - # define THREAD_MINSTACKSIZE (64U * 1024) - #endif --#ifndef __sun -+#if !defined(__sun) && !defined(__GLIBC__) - #if defined(PTHREAD_STACK_MIN) && THREAD_MINSTACKSIZE < PTHREAD_STACK_MIN - # undef THREAD_MINSTACKSIZE - # define THREAD_MINSTACKSIZE PTHREAD_STACK_MIN --- -2.32.0 - -- 2.41.0

2 1

[PATCH 1/8] extrahd.cgi: Add various perl functions deal with block devices
by Stefan Schantl 01 Jul '23

01 Jul '23

This functions are going to replace the former used scan/write to file/read from file approach by directly collecting the required informations from the kernel sysfs and devfs. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/extrahd.cgi | 360 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 360 insertions(+) diff --git a/html/cgi-bin/extrahd.cgi b/html/cgi-bin/extrahd.cgi index 36c0efc2e..44065a8a1 100644 --- a/html/cgi-bin/extrahd.cgi +++ b/html/cgi-bin/extrahd.cgi @@ -255,3 +255,363 @@ END &Header::closebigbox(); &Header::closepage(); + +# +## Function which return an array with all available block devices. +# +sub get_block_devices () { + my @devices; + + # Open directory from kernel sysfs. + opendir(DEVICES, "/sys/block"); + + # Loop through the directory. + while(readdir(DEVICES)) { + # Skip . and .. + next if($_ =~ /^\.$/); + next if($_ =~ /^\..$/); + + # Skip any loopback and ram devices. + next if($_ =~ "^loop"); + next if($_ =~ "^ram"); + + # Add the device to the array of found devices. + push(@devices, $_); + } + + # Close directory handle. + closedir(DEVICES); + + # Return the devices array. + return @devices; +} + +# +## Function which return all partitions of a given block device. +# +sub get_device_partitions ($) { + my ($device) = @_; + + # Array to store the known partitions for the given + # device. + my @partitions; + + # Assign device directory. + my $device_dir = "$sysfs_block_dir/$device"; + + # Abort and return nothing if the device dir does not exist. + return unless(-d "$device_dir"); + + opendir(DEVICE, "$sysfs_block_dir/$device"); + while(readdir(DEVICE)) { + next unless($_ =~ "^$device"); + + push(@partitions, $_); + } + + closedir(DEVICE); + + @partitions = sort(@partitions); + + return @partitions; +} + +# +## Returns the vendor of a given block device. +# +sub get_device_vendor ($) { + my ($device) = @_; + + # Assign device directory. + my $device_dir = "$sysfs_block_dir/$device"; + + # Abort and return nothing if the device dir does not exist + # or no vendor file exists. + return unless(-d "$device_dir"); + return unless(-f "$device_dir/device/vendor"); + + # Open and read-in the device vendor. + open(VENDOR, "$device_dir/device/vendor"); + my $vendor = <VENDOR>; + close(VENDOR); + + # Abort and return nothing if no vendor could be read. + return unless($vendor); + + # Remove any newlines from the vendor string. + chomp($vendor); + + # Return the omited vendor. + return $vendor; +} + +# +## Returns the model name (string) of a given block device. +# +sub get_device_model ($) { + my ($device) = @_; + + # Assign device directory. + my $device_dir = "$sysfs_block_dir/$device"; + + # Abort and return nothing if the device dir does not exist + # or no model file exists. + return unless(-d "$device_dir"); + return unless(-f "$device_dir/device/model"); + + # Open and read-in the device model. + open(MODEL, "$device_dir/device/model"); + my $model = <MODEL>; + close(MODEL); + + # Abort and return nothing if no model could be read. + return unless($model); + + # Remove any newlines from the model string. + chomp($model); + + # Return the model string. + return $model; +} + +# +## Returns the size of a given device in bytes. +# +sub get_device_size ($) { + my ($device) = @_; + + # Assign device directory. + my $device_dir = "$sysfs_block_dir/$device"; + + # Abort and return nothing if the device dir does not exist + # or no size file exists. + return unless(-d "$device_dir"); + return unless(-f "$device_dir/size"); + + # Open and read-in the device size. + open(SIZE, "$device_dir/size"); + my $size = <SIZE>; + close(SIZE); + + # Abort and return nothing if the size could not be read. + return unless($size); + + # Remove any newlines for the size string. + chomp($size); + + # The omited size only contains the amount of blocks from the + # given device. To convert this into bytes we have to multiply this + # value with 512 bytes for each block. This is a static value used by + # the linux kernel. + $size = $size * 512; + + # Return the size in bytes. + return $size; +} + +# +## Function which returns all currently mounted devices as a hash. +## example: "sda1" -> "/boot" +# +sub get_mountpoints () { + my %mounts; + + # Open and read-in the current mounts from the + # kernel file system. + open(MOUNT, "/proc/mounts"); + + # Loop through the known mounts. + while(<MOUNT>) { + # Skip mounts which does not belong to a device. + next unless ($_ =~ "^/dev"); + + # Cut the line into pieces and assign nice variables. + my ($dev, $mpoint, $fs, $options, $a, $b) = split(/ /, $_); + + # Split the device name. + my @tmp = split("/", $dev); + + # Assign the plain device name to a new variable. + # It is the last element of the array. + my $device = $tmp[-1]; + + # Add the mountpoint to the hash of mountpoints. + $mounts{"$device"} = $mpoint; + } + + # Close file handle. + close(MOUNT); + + # Return the hash of known mountpoints. + return %mounts; +} + +sub get_swaps () { + my @swaps; + + # Open and read the swaps file. + open(SWAP, "/proc/swaps"); + + # Loop though the file content. + while(<SWAP>) { + # Skip lines which does not belong to a device. + next unless ($_ =~ "^/dev"); + + # Split the line and assign nice variables. + my ($dev, $type, $size, $used, $prio) = split(/ /, $_); + + # Cut the device line into pieces. + my @tmp = split("/", $dev); + + my $device = @tmp[-1]; + + # Add the found swap to the array of swaps. + push(@swaps, $device); + } + + # Close file handle. + close(SWAP); + + # Sort the array. + @swaps = sort(@swaps); + + # Return the array. + return @swaps; +} + +# +## Function with returns the mounted devices and the used filesystems as a hash. +## Example: "sda1" -> "ext4" +# +sub get_mountedfs () { + my %mountedfs; + + # Open and read the current mounts from the kernel + # file system. + open(MOUNT, "/proc/mounts"); + + # Loop through the known mounts. + while(<MOUNT>) { + # Skip mounts which does not belong to a device. + next unless ($_ =~ "^/dev"); + + # Split line and assign nice variables. + my ($dev, $mpoint, $fs, $options, $a, $b) = split(/ /, $_); + + # Cut the device line into pieces. + my @tmp = split("/", $dev); + + # Assign the plain device name to a variable + # It is the last element of the temporary array. + my $device = $tmp[-1]; + + # Convert the filesystem into lower case format. + $fs = lc($fs); + + # Add the mounted file system. + $mountedfs{$device} = $fs; + } + + # Close file handle. + close(MOUNT); + + # Return the hash with the mounted filesystems. + return %mountedfs; +} + +# +## Function which returns all known UUID's as a hash. +## Example: "sda1" -> "1234-5678-abcd" +# +sub get_uuids () { + my %uuids; + + # Directory where the uuid mappings can be found. + my $uuid_dir = "/dev/disk/by-uuid"; + + # Open uuid directory and read-in the current known uuids. + opendir(UUIDS, "$uuid_dir"); + + # Loop through the uuids. + foreach my $uuid (readdir(UUIDS)) { + # Skip . and .. + next if($uuid eq "." or $uuid eq ".."); + + # Skip everything which is not a symbolic link. + next unless(-l "$uuid_dir/$uuid"); + + # Resolve the target of the symbolic link. + my $target = readlink("$uuid_dir/$uuid"); + + # Split the link target into pieces. + my @tmp = split("/", $target); + + # Assign the last element of the array to the dev variable. + my $dev = "$tmp[-1]"; + + # Add the device and uuid to the hash of uuids. + $uuids{$dev} = $uuid; + } + + # Close directory handle. + closedir(UUIDS); + + # Return the hash of uuids. + return %uuids; +} + +# +## Returns the device name of a given uuid. +# +sub device_by_uuid ($) { + my ($uuid) = @_; + + # Reverse the main uuids hash. + my %uuids = reverse %uuids; + + # Lookup and return the device name. + return $uuids{$uuid}; +} + +# +## Returns "True" in case a given path is a known mountpoint. +# +sub is_mounted ($) { + my ($mpoint) = @_; + + my %mountpoints = reverse %mountpoints; + + # Return "True" if the requested mountpoint is known and + # therefore mounted. + return 1 if($mountpoints{$mpoint}); +} + +# +## Returns "True" if a given mountpoint is a subdirectory of one +## of the directories specified by the valid_mount_dirs array abouve. +# +sub is_valid_dir ($) { + my ($mpoint) = @_; + + # Split the given mountpoint into pieces and store them + # in a temporay array. + my @tmp = split("/", $mpoint); + + # Exit and return nothing if the temporary array is empty. + return unless(@tmp); + + # Build the root path based on the given mount point. + my $root_path = "/" . @tmp[1]; + + # Check if the root path is valid. + return 1 if(grep /$root_path/, @valid_mount_dirs); +} + +# +# Returns "True" if a device is used as swap. +# +sub is_swap ($) { + my ($device) = @_; + + return 1 if(grep /$device/, @swaps); +} -- 2.39.2

3 10

[PATCH] extrahd.cgi: Requires "auto" as hidden FS type to mount a new device
by Stefan Schantl 27 Jun '23

27 Jun '23

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/extrahd.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/extrahd.cgi b/html/cgi-bin/extrahd.cgi index bb67b792d..08d62172d 100644 --- a/html/cgi-bin/extrahd.cgi +++ b/html/cgi-bin/extrahd.cgi @@ -305,6 +305,7 @@ END } else { unless($disabled) { print "<input type='hidden' name='ACTION' value='$Lang::tr{'add'}'>\n"; + print "<input type='hidden' name='FS' value='auto'>\n"; print "<img src='/images/updbooster/updxl-led-gray.gif' alt='$Lang::tr{'extrahd not configured'}' title='$Lang::tr{'extrahd not configured'}'> \n"; print "<input type='image' alt='$Lang::tr{'add'}' title='$Lang::tr{'add'}' src='/images/add.gif'>\n"; } -- 2.39.2

2 1

[PATCH] CUPS: Update to 2.4.6
by Peter Müller 25 Jun '23

25 Jun '23

Several security-relevant bugs have been fixed since version 2.4.2, please refer to https://github.com/OpenPrinting/cups/releases for the respective changelogs. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/cups | 8 +- ...ificate_generation_bugs_with_openssl.patch | 337 ------------------ ..._default_cupsd_keychain_with_OpenSSL.patch | 16 - 3 files changed, 3 insertions(+), 358 deletions(-) delete mode 100644 src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch delete mode 100644 src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch diff --git a/lfs/cups b/lfs/cups index 80b34580b..70839736f 100644 --- a/lfs/cups +++ b/lfs/cups @@ -24,7 +24,7 @@ include Config -VER = 2.4.2 +VER = 2.4.6 SUMMARY = The Common UNIX Printing System THISAPP = cups-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/cups-$(VER) TARGET = $(DIR_INFO)/$(THISAPP) PROG = cups -PAK_VER = 35 +PAK_VER = 36 DEPS = avahi cups-filters dbus ghostscript libexif @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 97053feb502d4fdc28810b806000b6c84a6795d5adcec0789e73e5477d5802d46a99381366d16219f627166df088f6decde5c144bd0c38b5745815dc1e426bc5 +$(DL_FILE)_BLAKE2 = 4e61112ddaa46f20b1cfcb8f523dd07ba7d82604b9857754b288a2a9c5bc50ce242cfa119867347e4696818dc2eb505cf7fff1f9a0634e314edb2500395b83e4 install : $(TARGET) @@ -80,8 +80,6 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch $(UPDATE_AUTOMAKE) cd $(DIR_APP) && \ ./configure \ diff --git a/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch b/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch deleted file mode 100644 index a356474d2..000000000 --- a/src/patches/cups-2.4.2_Fix_TLS_certificate_generation_bugs_with_openssl.patch +++ /dev/null @@ -1,337 +0,0 @@ ---- cups-2.4.2/cups/tls-openssl.c.orig 2022-05-26 08:17:21.000000000 +0200 -+++ cups-2.4.2/cups/tls-openssl.c 2023-04-24 20:13:16.431108315 +0200 -@@ -1,7 +1,7 @@ - /* - * TLS support code for CUPS using OpenSSL/LibreSSL. - * -- * Copyright © 2020-2022 by OpenPrinting -+ * Copyright © 2020-2023 by OpenPrinting - * Copyright © 2007-2019 by Apple Inc. - * Copyright © 1997-2007 by Easy Software Products, all rights reserved. - * -@@ -35,7 +35,8 @@ - static time_t http_get_date(X509 *cert, int which); - //static void http_load_crl(void); - static const char *http_make_path(char *buffer, size_t bufsize, const char *dirname, const char *filename, const char *ext); --static void http_x509_add_san(X509 *cert, const char *name); -+static int http_x509_add_ext(X509 *cert, int nid, const char *value); -+static void http_x509_add_san(GENERAL_NAMES *gens, const char *name); - - - /* -@@ -79,11 +80,15 @@ - cups_lang_t *language; // Default language info - time_t curtime; // Current time - X509_NAME *name; // Subject/issuer name -+ ASN1_INTEGER *serial; // Serial number -+ ASN1_TIME *notBefore, // Initial date -+ *notAfter; // Expiration date - BIO *bio; // Output file - char temp[1024], // Temporary directory name - crtfile[1024], // Certificate filename - keyfile[1024]; // Private key filename - const char *common_ptr; // Pointer into common name -+ GENERAL_NAMES *gens; // Names for SubjectAltName certificate extension - - - DEBUG_printf(("cupsMakeServerCredentials(path=\"%s\", common_name=\"%s\", num_alt_names=%d, alt_names=%p, expiration_date=%d)", path, common_name, num_alt_names, alt_names, (int)expiration_date)); -@@ -104,7 +109,7 @@ - // Create the encryption key... - DEBUG_puts("1cupsMakeServerCredentials: Creating key pair."); - -- if ((rsa = RSA_generate_key(2048, RSA_F4, NULL, NULL)) == NULL) -+ if ((rsa = RSA_generate_key(3072, RSA_F4, NULL, NULL)) == NULL) - { - _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create key pair."), 1); - return (0); -@@ -131,25 +136,43 @@ - return (0); - } - -- curtime = time(NULL); -- language = cupsLangDefault(); -+ curtime = time(NULL); -+ -+ notBefore = ASN1_TIME_new(); -+ ASN1_TIME_set(notBefore, curtime); -+ X509_set_notBefore(cert, notBefore); -+ ASN1_TIME_free(notBefore); -+ -+ notAfter = ASN1_TIME_new(); -+ ASN1_TIME_set(notAfter, expiration_date); -+ X509_set_notAfter(cert, notAfter); -+ ASN1_TIME_free(notAfter); -+ -+ serial = ASN1_INTEGER_new(); -+ ASN1_INTEGER_set(serial, (int)curtime); -+ X509_set_serialNumber(cert, serial); -+ ASN1_INTEGER_free(serial); - -- ASN1_TIME_set(X509_get_notBefore(cert), curtime); -- ASN1_TIME_set(X509_get_notAfter(cert), expiration_date); -- ASN1_INTEGER_set(X509_get_serialNumber(cert), (int)curtime); - X509_set_pubkey(cert, pkey); - -- name = X509_get_subject_name(cert); -+ language = cupsLangDefault(); -+ name = X509_NAME_new(); - if (strlen(language->language) == 5) -- X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, (unsigned char *)language->language + 3, -1, -1, 0); -+ X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)language->language + 3, -1, -1, 0); - else -- X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, (unsigned char *)"US", -1, -1, 0); -- X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); -- X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0); -+ X509_NAME_add_entry_by_txt(name, SN_countryName, MBSTRING_ASC, (unsigned char *)"US", -1, -1, 0); -+ X509_NAME_add_entry_by_txt(name, SN_commonName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0); -+ X509_NAME_add_entry_by_txt(name, SN_organizationName, MBSTRING_ASC, (unsigned char *)common_name, -1, -1, 0); -+ X509_NAME_add_entry_by_txt(name, SN_organizationalUnitName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); -+ X509_NAME_add_entry_by_txt(name, SN_stateOrProvinceName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); -+ X509_NAME_add_entry_by_txt(name, SN_localityName, MBSTRING_ASC, (unsigned char *)"Unknown", -1, -1, 0); - - X509_set_issuer_name(cert, name); -+ X509_set_subject_name(cert, name); -+ X509_NAME_free(name); - -- http_x509_add_san(cert, common_name); -+ gens = sk_GENERAL_NAME_new_null(); -+ http_x509_add_san(gens, common_name); - if ((common_ptr = strstr(common_name, ".local")) == NULL) - { - // Add common_name.local to the list, too... -@@ -161,7 +184,7 @@ - *localptr = '\0'; - strlcat(localname, ".local", sizeof(localname)); - -- http_x509_add_san(cert, localname); -+ http_x509_add_san(gens, localname); - } - - if (num_alt_names > 0) -@@ -171,10 +194,22 @@ - for (i = 0; i < num_alt_names; i ++) - { - if (strcmp(alt_names[i], "localhost")) -- http_x509_add_san(cert, alt_names[i]); -+ http_x509_add_san(gens, alt_names[i]); - } - } - -+ // Add extension with DNS names and free buffer for GENERAL_NAME -+ X509_add1_ext_i2d(cert, NID_subject_alt_name, gens, 0, X509V3_ADD_DEFAULT); -+ sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); -+ -+ // Add extensions that are required to make Chrome happy... -+ http_x509_add_ext(cert, NID_basic_constraints, "critical,CA:FALSE,pathlen:0"); -+ http_x509_add_ext(cert, NID_key_usage, "critical,digitalSignature,keyEncipherment"); -+ http_x509_add_ext(cert, NID_ext_key_usage, "1.3.6.1.5.5.7.3.1"); -+ http_x509_add_ext(cert, NID_subject_key_identifier, "hash"); -+ http_x509_add_ext(cert, NID_authority_key_identifier, "keyid,issuer"); -+ X509_set_version(cert, 2); // v3 -+ - X509_sign(cert, pkey, EVP_sha256()); - - // Save them... -@@ -959,6 +994,7 @@ - const char *cn, // Common name to lookup - *cnptr; // Pointer into common name - int have_creds = 0; // Have credentials? -+ int key_status, crt_status; // Key and certificate load status - - context = SSL_CTX_new(TLS_server_method()); - -@@ -1002,6 +1038,8 @@ - else - cn = tls_common_name; - -+ _cupsMutexLock(&tls_mutex); -+ - if (cn) - { - // First look in the CUPS keystore... -@@ -1042,20 +1080,41 @@ - { - DEBUG_printf(("4_httpTLSStart: Auto-create credentials for \"%s\".", cn)); - -- if (!cupsMakeServerCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 365 * 86400)) -+ if (!cupsMakeServerCredentials(tls_keypath, cn, 0, NULL, time(NULL) + 3650 * 86400)) - { - DEBUG_puts("4_httpTLSStart: cupsMakeServerCredentials failed."); - http->error = errno = EINVAL; - http->status = HTTP_STATUS_ERROR; - _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to create server credentials."), 1); -- SSL_CTX_free(context); -+ SSL_CTX_free(context); -+ _cupsMutexUnlock(&tls_mutex); - - return (-1); - } - } - -- SSL_CTX_use_PrivateKey_file(context, keyfile, SSL_FILETYPE_PEM); -- SSL_CTX_use_certificate_file(context, crtfile, SSL_FILETYPE_PEM); -+ _cupsMutexUnlock(&tls_mutex); -+ -+ DEBUG_printf(("4_httpTLSStart: Using private key file '%s'.", keyfile)); -+ DEBUG_printf(("4_httpTLSStart: Using certificate file '%s'.", crtfile)); -+ -+ crt_status = SSL_CTX_use_certificate_chain_file(context, crtfile); -+ key_status = SSL_CTX_use_PrivateKey_file(context, keyfile, SSL_FILETYPE_PEM); -+ -+ if (!key_status || !crt_status) -+ { -+ // Unable to load private key or certificate... -+ DEBUG_puts("4_httpTLSStart: Unable to use private key or certificate chain file."); -+ if ((error = ERR_get_error()) != 0) -+ _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, ERR_error_string(error, NULL), 0); -+ -+ http->status = HTTP_STATUS_ERROR; -+ http->error = EIO; -+ -+ SSL_CTX_free(context); -+ -+ return (-1); -+ } - } - - // Set TLS options... -@@ -1068,6 +1127,8 @@ - strlcat(cipherlist, ":!SHA1:!SHA256:!SHA384", sizeof(cipherlist)); - strlcat(cipherlist, ":@STRENGTH", sizeof(cipherlist)); - -+ DEBUG_printf(("4_httpTLSStart: cipherlist='%s', tls_min_version=%d, tls_max_version=%d", cipherlist, tls_min_version, tls_max_version)); -+ - SSL_CTX_set_min_proto_version(context, versions[tls_min_version]); - SSL_CTX_set_max_proto_version(context, versions[tls_max_version]); - SSL_CTX_set_cipher_list(context, cipherlist); -@@ -1094,7 +1155,8 @@ - - if (http->mode == _HTTP_MODE_CLIENT) - { -- // Negotiate as a server... -+ // Negotiate as a client... -+ DEBUG_puts("4_httpTLSStart: Calling SSL_connect..."); - if (SSL_connect(http->tls) < 1) - { - // Failed -@@ -1109,12 +1171,15 @@ - SSL_free(http->tls); - http->tls = NULL; - -+ DEBUG_printf(("4_httpTLSStart: Returning -1 (%s)", ERR_error_string(error, NULL))); -+ - return (-1); - } - } - else - { - // Negotiate as a server... -+ DEBUG_puts("4_httpTLSStart: Calling SSL_accept..."); - if (SSL_accept(http->tls) < 1) - { - // Failed -@@ -1129,10 +1194,14 @@ - SSL_free(http->tls); - http->tls = NULL; - -+ DEBUG_printf(("4_httpTLSStart: Returning -1 (%s)", ERR_error_string(error, NULL))); -+ - return (-1); - } - } - -+ DEBUG_puts("4_httpTLSStart: Returning 0."); -+ - return (0); - } - -@@ -1152,6 +1221,8 @@ - SSL_shutdown(http->tls); - SSL_CTX_free(context); - SSL_free(http->tls); -+ -+ http->tls = NULL; - } - - -@@ -1564,32 +1635,62 @@ - - - // --// 'http_x509_add_san()' - Add a subjectAltName extension to an X.509 certificate. -+// 'http_x509_add_ext()' - Add an extension to a certificate. - // - --static void --http_x509_add_san(X509 *cert, // I - Certificate -- const char *name) // I - Hostname -+static int // O - 1 on success, 0 on failure -+http_x509_add_ext(X509 *cert, // I - Certificate -+ int nid, // I - Extension ID -+ const char *value) // I - Value - { -- char dns_name[1024]; // DNS: prefixed hostname -- X509_EXTENSION *san_ext; // Extension for subjectAltName -- ASN1_OCTET_STRING *san_asn1; // ASN1 string -+ int ret; // Return value -+ X509_EXTENSION *ex = NULL; // Extension -+ X509V3_CTX ctx; // Certificate context - - -- // The subjectAltName value for DNS names starts with a DNS: prefix... -- snprintf(dns_name, sizeof(dns_name), "DNS: %s", name); -+ DEBUG_printf(("3http_x509_add_ext(cert=%p, nid=%d, value=\"%s\")", (void *)cert, nid, value)); - -- if ((san_asn1 = ASN1_OCTET_STRING_new()) == NULL) -- return; -+ // Don't use a configuration database... -+ X509V3_set_ctx_nodb(&ctx); - -- ASN1_OCTET_STRING_set(san_asn1, (unsigned char *)dns_name, strlen(dns_name)); -- if ((san_ext = X509_EXTENSION_create_by_NID(NULL, NID_subject_alt_name, 0, san_asn1)) == NULL) -+ // Self-signed certificates use the same issuer and subject... -+ X509V3_set_ctx(&ctx, /*issuer*/cert, /*subject*/cert, /*req*/NULL, /*crl*/NULL, /*flags*/0); -+ -+ // Create and add the extension... -+ if ((ex = X509V3_EXT_conf_nid(/*conf*/NULL, &ctx, nid, value)) == NULL) - { -- ASN1_OCTET_STRING_free(san_asn1); -- return; -+ DEBUG_puts("4http_x509_add_ext: Unable to create extension, returning false."); -+ return (0); - } - -- X509_add_ext(cert, san_ext, -1); -- X509_EXTENSION_free(san_ext); -- ASN1_OCTET_STRING_free(san_asn1); -+ ret = X509_add_ext(cert, ex, -1) != 0; -+ -+ DEBUG_printf(("4http_x509_add_ext: X509_add_ext returned %s.", ret ? "true" : "false")); -+ -+ // Free the extension and return... -+ X509_EXTENSION_free(ex); -+ -+ return (ret); -+} -+ -+ -+// -+// 'http_x509_add_san()' - Add a subjectAltName to GENERAL_NAMES used for -+// the extension to an X.509 certificate. -+// -+ -+static void -+http_x509_add_san(GENERAL_NAMES *gens, // I - Concatenation of DNS names -+ const char *name) // I - Hostname -+{ -+ GENERAL_NAME *gen_dns = GENERAL_NAME_new(); -+ // DNS: name -+ ASN1_IA5STRING *ia5 = ASN1_IA5STRING_new(); -+ // Hostname string -+ -+ -+ // Set the strings and push it on the GENERAL_NAMES list... -+ ASN1_STRING_set(ia5, name, strlen(name)); -+ GENERAL_NAME_set0_value(gen_dns, GEN_DNS, ia5); -+ sk_GENERAL_NAME_push(gens, gen_dns); - } diff --git a/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch b/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch deleted file mode 100644 index ebd3a4843..000000000 --- a/src/patches/cups-2.4.2_Fix_default_cupsd_keychain_with_OpenSSL.patch +++ /dev/null @@ -1,16 +0,0 @@ ---- cups-2.4.2/scheduler/conf.c.orig 2022-05-26 08:17:21.000000000 +0200 -+++ cups-2.4.2/scheduler/conf.c 2023-04-23 15:37:48.521145700 +0200 -@@ -605,11 +605,11 @@ - ClassifyOverride = 0; - - #ifdef HAVE_TLS --# ifdef HAVE_GNUTLS -+# if defined HAVE_GNUTLS || defined HAVE_OPENSSL - cupsdSetString(&ServerKeychain, "ssl"); - # else - cupsdSetString(&ServerKeychain, "/Library/Keychains/System.keychain"); --# endif /* HAVE_GNUTLS */ -+# endif /* HAVE_GNUTLS || HAVE_OPENSSL */ - - _httpTLSSetOptions(_HTTP_TLS_NONE, _HTTP_TLS_1_0, _HTTP_TLS_MAX); - #endif /* HAVE_TLS */ -- 2.35.3

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2023