Development June 2023

development@lists.ipfire.org

10 participants
38 discussions

[PATCH] Postfix: Update to 3.8.1
by Peter Müller 25 Jun '23

25 Jun '23

Please refer to https://www.postfix.org/announcements/postfix-3.8.1.html for the release announcement of this version. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/postfix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/postfix b/lfs/postfix index 73527c0c9..f2ae45007 100644 --- a/lfs/postfix +++ b/lfs/postfix @@ -26,7 +26,7 @@ include Config SUMMARY = A fast, secure, and flexible mailer -VER = 3.8.0 +VER = 3.8.1 THISAPP = postfix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = postfix -PAK_VER = 40 +PAK_VER = 41 DEPS = @@ -70,7 +70,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 3ef0c0c83eed3263c890143ae962674dfbfa01f589f1b503a01d57497e4732171aa58468357276f29a9454c577573e8442095c2db25005324754dbd305875297 +$(DL_FILE)_BLAKE2 = 83c043d6e74cbbf0c5d739838ff99d4905aa711b13483fe0f427956b962c432e6f76d9828b5c141260e210c9605ac260df950d273d5729c36666c935a3ed4518 install : $(TARGET) -- 2.35.3

1 0

[PATCH] strongswan: Update to 5.9.11
by Peter Müller 25 Jun '23

25 Jun '23

Please refer to https://github.com/strongswan/strongswan/releases/tag/5.9.11 for the release notes of this update. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/strongswan | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/strongswan b/lfs/strongswan index 7cb886fe7..357283b15 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -24,7 +24,7 @@ include Config -VER = 5.9.10 +VER = 5.9.11 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 757d55aa0c623356c5d8bf0360df63990ec18294d06f50b6dd475273b75a883354ea8723708e4856a8f0acc4d3237ac6bcf5adc40346fded7051d78375b2bcc9 +$(DL_FILE)_BLAKE2 = e8e84d79d1530b9a968ce8429fec0e7b3fcf19b75fdbd4371a38763d8564d5b37d012769006330b5c94cff3e914acb1b1a3e2829749effb8c35f9e5d775be491 install : $(TARGET) -- 2.35.3

1 0

[PATCH] freetype: Update to 2.13.1
by Peter Müller 25 Jun '23

25 Jun '23

Changelog is too long to include it here, please refer to the ChangeLog file in the source code tarball. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/freetype | 2 +- lfs/freetype | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/freetype b/config/rootfiles/common/freetype index d42345cc9..9117f66ca 100644 --- a/config/rootfiles/common/freetype +++ b/config/rootfiles/common/freetype @@ -60,7 +60,7 @@ #usr/lib/libfreetype.la #usr/lib/libfreetype.so usr/lib/libfreetype.so.6 -usr/lib/libfreetype.so.6.19.0 +usr/lib/libfreetype.so.6.20.0 #usr/lib/pkgconfig/freetype2.pc #usr/share/aclocal/freetype2.m4 #usr/share/man/man1/freetype-config.1 diff --git a/lfs/freetype b/lfs/freetype index 22ba9b4a4..ca416f7cc 100644 --- a/lfs/freetype +++ b/lfs/freetype @@ -24,7 +24,7 @@ include Config -VER = 2.13.0 +VER = 2.13.1 THISAPP = freetype-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 11aac3cddb3e71cc0e6a616ed609294d6641aa0011842aa8230eace826955883aca0063331660025be14582b44aa189718ce21e0e5193a66bb5d7cffa1d0fb7f +$(DL_FILE)_BLAKE2 = edadf2cdd8eb17362239cc5ab7fdff7cb1ca398908d3a9fa0547c3922b098df331cc87e939cee62ce20a78b01f14372c952c823c30af9ac227fc7da10000d37b install : $(TARGET) -- 2.35.3

1 0

[PATCH 1/3] make.sh: Bump toolchain version
by Michael Tremer 24 Jun '23

24 Jun '23

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- make.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make.sh b/make.sh index 6b9a8146b..1378f7802 100755 --- a/make.sh +++ b/make.sh @@ -35,7 +35,7 @@ GIT_BRANCH="$(git rev-parse --abbrev-ref HEAD)" # Git Branch GIT_TAG="$(git tag | tail -1)" # Git Tag GIT_LASTCOMMIT="$(git rev-parse --verify HEAD)" # Last commit -TOOLCHAINVER=20230210 +TOOLCHAINVER=20230620 # use multicore and max compression ZSTD_OPT="-T0 --ultra -22" -- 2.39.2

2 5

[PATCH] extrahd.cgi: Drop select for FS selection.
by Stefan Schantl 23 Jun '23

23 Jun '23

This feature does not have any benefit because the linux kernel knows best which filesystem a device/partition has. So there is no need for a user to specify this by-hand. This also prevents from choosing a wrong fs type and as a direct result in a not mountable device. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/extrahd.cgi | 35 +++++------------------------------ 1 file changed, 5 insertions(+), 30 deletions(-) diff --git a/html/cgi-bin/extrahd.cgi b/html/cgi-bin/extrahd.cgi index 8f6a91a18..bb67b792d 100644 --- a/html/cgi-bin/extrahd.cgi +++ b/html/cgi-bin/extrahd.cgi @@ -45,16 +45,6 @@ my @valid_mount_dirs = ( "/mnt", ); -# Array which contains the supported file systems. -my @supported_filesystems = ( - "auto", - "ext3", - "ext4", - "xfs", - "vfat", - "ntfs-3g" -); - # Grab all available block devices. my @devices = &get_block_devices(); @@ -252,6 +242,9 @@ END # Convert into human-readable format. my $size = &General::formatBytes($bsize); + # Try to omit the used filesystem. + my $fs = $filesystems{$partition}; + # Get the mountpoint. my $mountpoint = $mountpoints{$partition}; @@ -279,11 +272,9 @@ END } elsif (&is_swap($partition)) { $disabled = "disabled"; $mountpoint = "swap"; + $fs = "swap"; } - # Omit the used filesystem. - my $fs = $filesystems{$partition}; - print <<END <form method='post' action='$ENV{'SCRIPT_NAME'}'> @@ -291,23 +282,7 @@ END <tr> <td align="list">/dev/$partition</td> <td align="center">$Lang::tr{'size'} $size</td> - <td align="center"><select name="FS" $disabled> -END -; - # Loop through the array of supported filesystems. - foreach my $filesystem (@supported_filesystems) { - my $selected; - - # Mark the used filesystem as selected. - if ($filesystem eq $fs) { - $selected = "selected"; - } - - print "<option value='$filesystem' $selected>$filesystem</option>\n"; - } - - print <<END - </select></td> + <td align="center">$fs</td> <td align="center"><input type='text' name='PATH' value='$mountpoint' $disabled></td> <td align="center"> <input type='hidden' name='DEVICE' value='/dev/$partition' /> -- 2.39.2

2 1

[PATCH] pciutils: Update to version 3.10.0
by Adolf Belka 22 Jun '23

22 Jun '23

- Update from version 3.9.0 to 3.10.0 - Update of rootfile - version 3.9.0 failed to output some of the symbols. This was found as a bug in Fedora but also seen by some people in IPFire CU175 with flashrom where the version 3.3 symbol is provided. Fedora made a patch to resolve this issue for 3.9.0 but 3.10.0 has been released since then and Fedora removed the patch that was used for 2.9.0 as pciutils has had that bug fixed - see first item in changelog. - Changelog Released as 3.10.0. Fixed bug in definition of versioned symbol aliases in shared libpci, which made compiling with link-time optimization fail. Filters now accept "0x..." syntax for backward compatibility. Windows: The cfgmgr32 back-end which provides the list of devices can be combined with another back-end which provides access to configuration space. ECAM (Enhanced Configuration Access Mechanism), which is defined by the PCIe standard, is now supported. It requires root privileges, access to physical memory, and also manual configuration on some systems. lspci: Tree view now works on multi-domain systems. It now respects filters properly. Last but not least, pci.ids were updated to the current snapshot of the database. This includes overall cleanup of entries with non-ASCII characters in their names -- such characters are allowed, but only if they convey interesting information (e.g., umlauts in German company names, but not the "registered trade mark" sign). Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/pciutils | 2 +- lfs/pciutils | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/pciutils b/config/rootfiles/common/pciutils index 067f269f3..491bf0567 100644 --- a/config/rootfiles/common/pciutils +++ b/config/rootfiles/common/pciutils @@ -1,7 +1,7 @@ bin/lspci bin/setpci lib/libpci.so.3 -lib/libpci.so.3.9.0 +lib/libpci.so.3.10.0 sbin/update-pciids #usr/include/pci #usr/include/pci/config.h diff --git a/lfs/pciutils b/lfs/pciutils index fdfeb4838..eb9a0b2d7 100644 --- a/lfs/pciutils +++ b/lfs/pciutils @@ -24,7 +24,7 @@ include Config -VER = 3.9.0 +VER = 3.10.0 THISAPP = pciutils-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 59d2a151b114691980b8f0a0bfdf8e48b9e1a0a9976df6dbc94962c251d8bfc61e7bd3b0f3c47a4295f52b5df67ad0e44ed6f2e6a87728e213e4ef0b8a55c028 +$(DL_FILE)_BLAKE2 = 2e1255eb5508c9d1339f5bc772c2592a03cae4d8d097e8939748c9bb5d5d949be53d705d1b7d903f7ea88b2abeea91e39de16e39d2f46f0a1f62f8a9e32c6faa install : $(TARGET) -- 2.41.0

2 1

[PATCH] Revert "parse-func.pl: Adjust regular expression to changed 'tc' output"
by Michael Tremer 22 Jun '23

22 Jun '23

This reverts commit ca06e817b84b8bb737b2811bdc5ad43d034e2c48. The incorrect output has been fixed in tc. Fixes: #13150 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/qos/parse-func.pl | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/config/qos/parse-func.pl b/config/qos/parse-func.pl index 04ca85b7f..991757f92 100644 --- a/config/qos/parse-func.pl +++ b/config/qos/parse-func.pl @@ -46,24 +46,24 @@ class htb 1:10 parent 1:1 prio 0 rate 80Kbit ceil 320Kbit burst 1701b cburst 200 lended: 230876 borrowed: 17112 giants: 0 tokens: 127200 ctokens: 37940 -class htb 1:20 parent 1:1 leaf 4220prio 1 rate 100Kbit ceil 200Kbit burst 1727b cburst 1855b +class htb 1:20 parent 1:1 leaf 4220: prio 1 rate 100Kbit ceil 200Kbit burst 1727b cburst 1855b Sent 2495181573 bytes 44034303 pkts (dropped 5837, overlimits 0) lended: 43825585 borrowed: 208718 giants: 0 tokens: 103424 ctokens: 55808 -class htb 1:30 parent 1:1 leaf 4230prio 3 rate 80Kbit ceil 400Kbit burst 1701b cburst 2111b +class htb 1:30 parent 1:1 leaf 4230: prio 3 rate 80Kbit ceil 400Kbit burst 1701b cburst 2111b Sent 2060213567 bytes 5465574 pkts (dropped 121, overlimits 0) rate 16851bps 35pps lended: 4556992 borrowed: 908582 giants: 0 tokens: -25364 ctokens: 32897 -class htb 1:50 parent 1:1 leaf 4250prio 5 rate 40Kbit ceil 120Kbit burst 1650b cburst 1752b +class htb 1:50 parent 1:1 leaf 4250: prio 5 rate 40Kbit ceil 120Kbit burst 1650b cburst 1752b Sent 6071486687 bytes 24448436 pkts (dropped 8086739, overlimits 0) rate 15801bps 85pps backlog 126p lended: 8324530 borrowed: 16123780 giants: 0 tokens: -202717 ctokens: -172499 -class htb 1:666 parent 1:1 leaf 666prio 7 rate 4Kbit ceil 40Kbit burst 1604b cburst 1650b +class htb 1:666 parent 1:1 leaf 666: prio 7 rate 4Kbit ceil 40Kbit burst 1604b cburst 1650b Sent 2148626078 bytes 6771069 pkts (dropped 2078536, overlimits 0) rate 5221bps 17pps backlog 125p lended: 675330 borrowed: 6095613 giants: 0 @@ -94,7 +94,7 @@ sub parse_class($) { my $line=$tc_output[$i]; # Parsing HTB: # ------------ - if ( $line =~ m/class htb (\d+):(\d+)( root| parent )?(\d+:\d+)?( leaf )?(\d+)?(prio )?(\d+)? rate (.*) ceil (.*) burst (.*) cburst (.*)/ ) { + if ( $line =~ m/class htb (\d+):(\d+)( root| parent )?(\d+:\d+)?( leaf )?(\d+)?:?( prio )?(\d+)? rate (.*) ceil (.*) burst (.*) cburst (.*)/ ) { my $type = "htb"; my $major = $1; my $minor = $2; -- 2.39.2

2 1

[PATCH 1/2] lvm: Fixes bug-13151 - update 69-dm-lvm.rules
by Adolf Belka 18 Jun '23

18 Jun '23

- Redhat updated lvm udev rule 69-dm-lvm.rules to only work with systemd - Update 69-dm-lvm.rules to work with IPFire based on input from @Daniel of what worked to mount an existing lvm volume Suggested-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/lvm/69-dm-lvm.rules | 83 ++++++++++++++++++++++++++++++++++++++ lfs/lvm2 | 2 + 2 files changed, 85 insertions(+) create mode 100644 config/lvm/69-dm-lvm.rules diff --git a/config/lvm/69-dm-lvm.rules b/config/lvm/69-dm-lvm.rules new file mode 100644 index 000000000..a1c6be14f --- /dev/null +++ b/config/lvm/69-dm-lvm.rules @@ -0,0 +1,83 @@ +# Copyright (C) 2012,2021 Red Hat, Inc. All rights reserved. +# +# This file is part of LVM. +# +# This rule requires blkid to be called on block devices before so only devices +# used as LVM PVs are processed (ID_FS_TYPE="LVM2_member"). + +SUBSYSTEM!="block", GOTO="lvm_end" + + +ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", GOTO="lvm_end" + +# Only process devices already marked as a PV - this requires blkid to be called before. +ENV{ID_FS_TYPE}!="LVM2_member", GOTO="lvm_end" +ENV{DM_MULTIPATH_DEVICE_PATH}=="1", GOTO="lvm_end" +ACTION=="remove", GOTO="lvm_end" + +# Create /dev/disk/by-id/lvm-pv-uuid-<PV_UUID> symlink for each PV +ENV{ID_FS_UUID_ENC}=="?*", SYMLINK+="disk/by-id/lvm-pv-uuid-$env{ID_FS_UUID_ENC}" + +# If the PV is a special device listed below, scan only if the device is +# properly activated. These devices are not usable after an ADD event, +# but they require an extra setup and they are ready after a CHANGE event. +# Also support coldplugging with ADD event but only if the device is already +# properly activated. +# This logic should be eventually moved to rules where those particular +# devices are processed primarily (MD and loop). + +# DM device: +KERNEL!="dm-[0-9]*", GOTO="next" +ENV{DM_UDEV_PRIMARY_SOURCE_FLAG}=="1", ENV{DM_ACTIVATION}=="1", GOTO="lvm_scan" +GOTO="lvm_end" + +# MD device: +LABEL="next" +KERNEL!="md[0-9]*", GOTO="next" +IMPORT{db}="LVM_MD_PV_ACTIVATED" +ACTION=="add", ENV{LVM_MD_PV_ACTIVATED}=="1", GOTO="lvm_scan" +ACTION=="change", ENV{LVM_MD_PV_ACTIVATED}!="1", TEST=="md/array_state", ENV{LVM_MD_PV_ACTIVATED}="1", GOTO="lvm_scan" +ACTION=="add", KERNEL=="md[0-9]*p[0-9]*", GOTO="lvm_scan" +GOTO="lvm_end" + +# Loop device: +LABEL="next" +KERNEL!="loop[0-9]*", GOTO="next" +ACTION=="add", ENV{LVM_LOOP_PV_ACTIVATED}=="1", GOTO="lvm_scan" +ACTION=="change", ENV{LVM_LOOP_PV_ACTIVATED}!="1", TEST=="loop/backing_file", ENV{LVM_LOOP_PV_ACTIVATED}="1", GOTO="lvm_scan" +GOTO="lvm_end" + +LABEL="next" +ACTION!="add", GOTO="lvm_end" + +LABEL="lvm_scan" + +# pvscan will check if this device completes a VG, +# i.e. all PVs in the VG are now present with the +# arrival of this PV. If so, it prints to stdout: +# LVM_VG_NAME_COMPLETE='foo' +# +# When the VG is complete it can be activated, so +# vgchange -aay <vgname> is run. It is run via +# systemd since it can take longer to run than +# udev wants to block when processing rules. +# (if there are hundreds of LVs to activate, +# the vgchange can take many seconds.) +# +# pvscan only reads the single device specified, +# and uses temp files under /run/lvm to check if +# other PVs in the VG are present. +# +# If event_activation=0 in lvm.conf, this pvscan +# (using checkcomplete) will do nothing, so that +# no event-based autoactivation will be happen. +# +# TODO: adjust the output of vgchange -aay so that +# it's better suited to appearing in the journal. + +IMPORT{program}="/usr/sbin/lvm pvscan --cache --listvg --checkcomplete --vgonline --autoactivation event --udevoutput --journal=output $env{DEVNAME}" +ENV{LVM_VG_NAME_COMPLETE}=="?*", RUN+="/usr/sbin/lvm vgchange -aay --autoactivation event $env{LVM_VG_NAME_COMPLETE}" +GOTO="lvm_end" + +LABEL="lvm_end" + diff --git a/lfs/lvm2 b/lfs/lvm2 index 2f1e921fc..4e2bd6235 100644 --- a/lfs/lvm2 +++ b/lfs/lvm2 @@ -85,5 +85,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --enable-udev_sync cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install + # copy the tailored lvm udev rules file that will mount volumes without systemd + cp -rf $(DIR_SRC)/config/lvm/69-dm-lvm.rules /lib/udev/rules.d/ @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.41.0

1 1

[PATCH 1/2] suricata: Update to 6.0.13
by Matthias Fischer 16 Jun '23

16 Jun '23

Excerpt from changelog: "6.0.13 -- 2023-06-15 Security #6119: datasets: absolute path in rules can overwrite arbitrary files (6.0.x backport) Bug #6138: Decode-events of IPv6 packets are not triggered (6.0.x backport) Bug #6136: suricata-update: dump-sample-configs: configuration files not found (6.0.x backport) Bug #6125: http2: cpu overconsumption in rust moving/memcpy in http2_parse_headers_blocks (6.0.x backport) Bug #6113: ips: txs still logged for dropped flow (6.0.x backport) Bug #6056: smtp: long line discard logic should be separate for server and client (6.0.x backport) Bug #6055: ftp: long line discard logic should be separate for server and client (6.0.x backport) Bug #5990: smtp: any command post a long command gets skipped (6.0.x backport) Bug #5982: smtp: Long DATA line post boundary is capped at 4k Bytes (6.0.x backport) Bug #5809: smb: convert transaction list to vecdeque (6.0.x backport) Bug #5604: counters: tcp.syn, tcp.synack, tcp.rst depend on flow (6.0.x backport) Bug #5550: dns: allow dns messages with invalid opcodes (6.0.x backport) Task #5984: libhtp 0.5.44 (6.0.x backport) Documentation #6134: userguide: add instructions/explanation for (not) running suricata with root (6.0.x backport) Documentation #6121: datasets: 6.0.x work-arounds for dataset supply chain attacks" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/suricata | 3 +-- lfs/suricata | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/suricata index df297ebd6..89fd6d865 100644 --- a/config/rootfiles/common/suricata +++ b/config/rootfiles/common/suricata @@ -8,8 +8,6 @@ usr/sbin/convert-ids-backend-files #usr/share/doc/suricata/Basic_Setup.txt #usr/share/doc/suricata/GITGUIDE #usr/share/doc/suricata/INSTALL -#usr/share/doc/suricata/INSTALL.PF_RING -#usr/share/doc/suricata/INSTALL.WINDOWS #usr/share/doc/suricata/NEWS #usr/share/doc/suricata/README #usr/share/doc/suricata/Setting_up_IPSinline_for_Linux.txt @@ -45,6 +43,7 @@ usr/share/suricata #usr/share/suricata/threshold.config var/cache/suricata var/lib/suricata +#var/lib/suricata/data var/log/suricata #var/log/suricata/certs #var/log/suricata/files diff --git a/lfs/suricata b/lfs/suricata index b28d5e3e7..c48c1c430 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 6.0.12 +VER = 6.0.13 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 3cd16072014e814ec116bbde6649a0230200e447884028fef0440cbbc38a36b28c1edb39098e4089ee966890464bcd2573ea82d3e35e6d034ad465ac20c4c0b6 +$(DL_FILE)_BLAKE2 = 47dcc47253c462510494dac35a4aa41a110f62bca148871d86509b76ac0c2a873b9fbb9fc981e65897d6443032c27c9f9eeb0fae524f4e56306ed01fe6e32b01 install : $(TARGET) -- 2.34.1

2 2

[PATCH] vpnmain.cgi: unique_subject = yes in index.txt.attr for first attempt with fresh install
by Adolf Belka 15 Jun '23

15 Jun '23

- The patches for Bug#13138 https://patchwork.ipfire.org/project/ipfire/patch/20230603140541.13834-1-ad… https://patchwork.ipfire.org/project/ipfire/patch/20230606104050.8290-1-ado… work for an update to Core Update 175 but a fresh install of CU175 will still fail with the error when creating the root/host certificate set for the first time. - This patch ensures that the unique_subject = yes line is addeed to index.txt.attr when the root/host certificate set is attempted to be created or is uploaded also for the first attempt. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/vpnmain.cgi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index f2aeecdf9..63f875c6a 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -870,6 +870,8 @@ END } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} || $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) { + &newcleanssldatabase(); + if (-f "${General::swroot}/ca/cacert.pem") { $errormessage = $Lang::tr{'valid root certificate already exists'}; goto ROOTCERT_SKIP; -- 2.41.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2023