Development July 2023

development@lists.ipfire.org

8 participants
64 discussions

Security issues and concerns regarding soc addon
by Adolf Belka 28 Jul '23

28 Jul '23

Hi All, To make it clear this is nothing to do with Core Update 177 Testing. Someone on the forum reported a problem with trying to run the sox addon. I had a look at sox and tried to install it and then ran sox --version which then came up with a missing library. Installed the addon that provided that library and then there was another missing library and so on. sox kept having missing libraries until I had installed all of the following:- alsa flac libmad libid3tag lame The only dependency listed in sox was libvorbis. All these others should really be present as well. After installing all those dependencies I ran sox --version and basically sox just hangs with no response at all. Ctrl C was required to stop it. So I was wondering why sox was added to IPFire originally. Looking through the web site info I found that the current version was released in 2015. The last commit looks to have been in 2021. I found that Arch Linux is taking a git snapshot version due to there being many unfixed security vulnerabilities. Additionally they are patching with a patch that was used in Openwall to deal with 8 CVE's plus a fix for a CVE fix that introduced a regression. The above does not make me feel very comfortable at all with having sox in IPFire. It is described as the Swiss Army knife of sound processing programs and my view, based on my investigation, is that it should be removed from IPFire. If users want to use it then it should be done on machines on the lan connected to IPFire, not on IPFire itself. Looking forward to feedback on my observations and conclusion. Regards, Adolf. -- Sent from my laptop

2 1

[PATCH] initskripts: remove buggy remount at halt and reboot
by Arne Fitzenreiter 28 Jul '23

28 Jul '23

mount -f does nothing and also the sync calls should do nothing on a already ro mounted filesystem. fixes: #13195 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/core/177/filelists/files | 2 ++ src/initscripts/system/halt | 5 ----- src/initscripts/system/reboot | 4 ---- 3 files changed, 2 insertions(+), 9 deletions(-) diff --git a/config/rootfiles/core/177/filelists/files b/config/rootfiles/core/177/filelists/files index e9ba30a0c..5f0034d81 100644 --- a/config/rootfiles/core/177/filelists/files +++ b/config/rootfiles/core/177/filelists/files @@ -1,3 +1,5 @@ +etc/rc.d/init.d/halt +etc/rc.d/init.d/reboot lib/firmware/amd-ucode/microcode_amd_fam17h.bin lib/firmware/amd-ucode/microcode_amd_fam19h.bin lib/firmware/amdgpu/aldebaran_mec2.bin diff --git a/src/initscripts/system/halt b/src/initscripts/system/halt index 91c89455c..40a72ac7d 100644 --- a/src/initscripts/system/halt +++ b/src/initscripts/system/halt @@ -24,11 +24,6 @@ case "${1}" in stop) - sync && sync - boot_mesg "Remount root readonly..." - mount -f -o remount,ro / > /dev/null 2>&1 - evaluate_retval - boot_mesg "Prepare for halt..." sleep 2 diff --git a/src/initscripts/system/reboot b/src/initscripts/system/reboot index 30c504025..f87f12921 100644 --- a/src/initscripts/system/reboot +++ b/src/initscripts/system/reboot @@ -24,10 +24,6 @@ case "${1}" in stop) - sync && sync - boot_mesg "Remount root readonly..." - mount -f -o remount,ro / > /dev/null 2>&1 - evaluate_retval boot_mesg "Prepare for reboot..." sleep 2 reboot -d -f -i -- 2.38.1

1 0

[PATCH] ovpnmain.cgi: Fixes bug#13190 - connection status shows disconnected for connected client
by Adolf Belka 27 Jul '23

27 Jul '23

- If the certificate name has underscores in it then the status always shows as DISCONNECTED alothough the actual connection is working and can be used. - The certificate with underscores works fine. RFC5280 accepts underscores in the name. - The code for checking the status splits up the status message and takes the first part as the common name for the connection. Then there is a regex command which rerplaces any underscores in the status common name with spaces. This results in the connection with underscores in the certificate name never matching any status feedback common name as the underscores have been replaced by spaces. - This has been tested to work with my vm test bed. With existing code the connection with underscores in the certificate name permanently showed DISCONNECTED. With the code change the connection shows as CONNECTED very quickly. Fixes: Bug#13190 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 1 - 1 file changed, 1 deletion(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index f734331fa..5afe54f55 100755 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -5502,7 +5502,6 @@ END if ($match[1] ne "Common Name") { $cn = $match[1]; } - $cn =~ s/[_]/ /g; if ($cn eq "$confighash{$key}[2]") { $col1="bgcolor='${Header::colourgreen}'"; $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>"; -- 2.41.0

1 0

[PATCH] samba.cgi: Fixes bug#13193 - disables smb1 unix extensions in smb.conf
by Adolf Belka 26 Jul '23

26 Jul '23

- Around three years ago the samba wui page was simplified and several parts were removed including the ability to set either wide links or unix extensions to be enabled - When the above was done wide links = yes was defined in the samba.cgi code - unix extenstions was not defined and therefore took the default value which was/is yes - unix extensions is now called smb1 unix extensions and has the same default value of yes - With both wide links = yes and smb1 unix extensions = yes means that when there is a wide symlink (one that goes outside the share directory tree) then wide links is disabled because smb1 unix extensions is enabled. This is even though the smb1 protocol is disabled by default. - This patch sets smb1 unix extensions = no in the configuration. - This has been tested in my vm testbed and confirmed that the error message is no longer shown and that any wide links are able to be accessed from the share mounted on a client Fixes: Bug#13193 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/samba.cgi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/html/cgi-bin/samba.cgi b/html/cgi-bin/samba.cgi index 0a3cd8c04..c60dca1d4 100644 --- a/html/cgi-bin/samba.cgi +++ b/html/cgi-bin/samba.cgi @@ -810,6 +810,9 @@ vfs objects = catia fruit streams_xattr recycle # Enable following symlinks wide links = yes +# Disable smb1 unix extensions +smb1 unix extensions = no + END # Server Role -- 2.41.0

1 0

[PATCH] kernel: update to 6.1.41
by Arne Fitzenreiter 26 Jul '23

26 Jul '23

fix for CVE-2023-20593 (Zenbleed) Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- lfs/linux | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 3f6ec5a75..830d9db9b 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.40-ipfire Kernel Configuration +# Linux/arm64 6.1.41-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 4b75c12ec..32fcb18c4 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.40-ipfire Kernel Configuration +# Linux/x86 6.1.41-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y diff --git a/lfs/linux b/lfs/linux index a87161293..4aa8c08cb 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 6.1.40 +VER = 6.1.41 ARM_PATCHES = 6.1.y-ipfire2 THISAPP = linux-$(VER) @@ -75,7 +75,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = a85b3418f8b35889a9b825b46f097b319218ee28e0225abf9190ae3a7b6d8de89bb21d3033ea17ab6a71e10134ff25bd5252195a7d07041bf0e0a790d52e9fac +$(DL_FILE)_BLAKE2 = 7b67b16cb45e8089a4554c59e5be29fef39acd95013345752f5e57af4f185cc79a5effb13741f643d7a9ef2c99555342cfeb1e859f38303be800d889a35972fe arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 7afc460562fb24bcd75784fc79de768f9b60780aedd88d1a847927169e31920bbb475b1ac1466c4a224a7876d16bd8d465b96202de12b74f6e2ccbfcec731ad3 install : $(TARGET) -- 2.34.1

1 0

[PATCH] samba: Update to version 4.18.5
by Adolf Belka 25 Jul '23

25 Jul '23

- Update from version 4.18.4 to 4.18.5 - Update of rootfile not required - Changelog 4.18.5 This is a security release in order to address the following defects: o CVE-2022-2127: When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it. https://www.samba.org/samba/security/CVE-2022-2127.html o CVE-2023-3347: SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. https://www.samba.org/samba/security/CVE-2023-3347.html o CVE-2023-34966: An infinite loop bug in Samba's mdssvc RPC service for Spotlight can be triggered by an unauthenticated attacker by issuing a malformed RPC request. https://www.samba.org/samba/security/CVE-2023-34966.html o CVE-2023-34967: Missing type validation in Samba's mdssvc RPC service for Spotlight can be used by an unauthenticated attacker to trigger a process crash in a shared RPC mdssvc worker process. https://www.samba.org/samba/security/CVE-2023-34967.html o CVE-2023-34968: As part of the Spotlight protocol Samba discloses the server- side absolute path of shares and files and directories in search results. https://www.samba.org/samba/security/CVE-2023-34968.html o Ralph Boehme <slow(a)samba.org> * BUG 15072: CVE-2022-2127. * BUG 15340: CVE-2023-34966. * BUG 15341: CVE-2023-34967. * BUG 15388: CVE-2023-34968. * BUG 15397: CVE-2023-3347. o Volker Lendecke <vl(a)samba.org> * BUG 15072: CVE-2022-2127. o Stefan Metzmacher <metze(a)samba.org> * BUG 15418: Secure channel faulty since Windows 10/11 update 07/2023. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/samba | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/samba b/lfs/samba index 9e104f64a..99f211a3c 100644 --- a/lfs/samba +++ b/lfs/samba @@ -24,7 +24,7 @@ include Config -VER = 4.18.4 +VER = 4.18.5 SUMMARY = A SMB/CIFS File, Print, and Authentication Server THISAPP = samba-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 94 +PAK_VER = 95 DEPS = avahi cups perl-Parse-Yapp perl-JSON @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 1f1aab7eb933111b9b1c72af8c3dd379fe34014085129e9d5cc400b4e434742e1c08ad4fdf2a98291d6063ce9b2ddc811e9ab5dbb133a85e97f2158f83dd7c96 +$(DL_FILE)_BLAKE2 = 24c625372c6e4f7f4393777991221f7a7ad25513717436491ea3238c8d588e738eb1a64791606f691b3608362b3f3741f390f08975b2b0578c497984a4d44392 install : $(TARGET) -- 2.41.0

1 0

[PATCH] kernel: update to 6.1.40
by Arne Fitzenreiter 25 Jul '23

25 Jul '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- lfs/linux | 5 ++--- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 9ad75c92b..3f6ec5a75 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.39-ipfire Kernel Configuration +# Linux/arm64 6.1.40-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index e40181dc6..4b75c12ec 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.39-ipfire Kernel Configuration +# Linux/x86 6.1.40-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y diff --git a/lfs/linux b/lfs/linux index 75fa0c00f..a87161293 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,8 +24,7 @@ include Config -VER = 6.1.39 - +VER = 6.1.40 ARM_PATCHES = 6.1.y-ipfire2 THISAPP = linux-$(VER) @@ -76,7 +75,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = 36bb549b14ccff3bd1751ff8475e74a77f8f65d9531ca2379b1dd2ccfe9adcf6852a764d615c42b3ad8a91c0d96668ae970085ab889dd98e21789f54a2f7641e +$(DL_FILE)_BLAKE2 = a85b3418f8b35889a9b825b46f097b319218ee28e0225abf9190ae3a7b6d8de89bb21d3033ea17ab6a71e10134ff25bd5252195a7d07041bf0e0a790d52e9fac arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 7afc460562fb24bcd75784fc79de768f9b60780aedd88d1a847927169e31920bbb475b1ac1466c4a224a7876d16bd8d465b96202de12b74f6e2ccbfcec731ad3 install : $(TARGET) -- 2.34.1

1 0

[PATCH 1/2] nmap: Update to version 7.94
by Adolf Belka 24 Jul '23

24 Jul '23

- Update from version 7.92 to 7.94 - Update of rootfile - Changelog 7.94 [2023-05-19] o Zenmap and Ndiff now use Python 3! Thanks to the many contributors who made this effort possible: + [GH#2088][GH#1176][Zenmap] Updated Zenmap to Python 3 and PyGObject. [Jakub Kulík] + [GH#1807][GH#1176][Ndiff] Updated Ndiff to Python 3. [Brian Quigley] + Additional Python 3 update fixes by Sam James, Daniel Miller. Special thanks to those who opened Python 3-related issues and pull requests: Eli Schwartz, Romain Leonard, Varunram Ganesh, Pavel Zhukov, Carey Balboa, Hasan Aliyev, and others. o [Windows] Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.71 to the latest version 1.75. It includes dozens of performance improvements, bug fixes and feature enhancements described at https://npcap.com/changelog. o Nmap now prints vendor names based on MAC address for MA-S (24-bit), MA-M (28-bit), and MA-L (36-bit) registrations instead of the fixed 3-byte MAC prefix used previously for lookups. o Added partial silent-install support to the Nmap Windows installer. It previously didn't offer silent mode (/S) because the free/demo version of Npcap Windoes packet capturing driver that it needs and ships with doesn't include a silent installer. Now with the /S option, Nmap checks whether Npcap is already installed (either the free version or OEM) and will silently install itself if so. This is similar to how the Wireshark installer works and is particularly helpful for organizations that want to fully automate their Nmap (and Npcap) deployments. See https://nmap.org/nmap-silent-install for more details. o Lots of profile-guided memory and processing improvements for Nmap, including OS fingerprint matching, probe matching and retransmission lookups for large hostgroups, and service name lookups. Overhauled Nmap's string interning and several other startup-related procedures to speed up start times, especially for scans using OS detection. [Daniel Miller] o Integrated many of the most-submitted IPv4 OS fingerprints for recent versions of Windows, iOS, macOS, Linux, and BSD. Added 22 fingerprints, bringing the new total to 5700! o [NSE][GH#548] Added the tftp-version script which requests a nonexistent file from a TFTP server and matches the error message to a database of known software. [Mak Kolybabi] o [Ncat][GH#1223] Ncat can now accept "connections" from multiple UDP hosts in listen mode with the --keep-open option. This also enables --broker and --chat via UDP. [Daniel Miller] o [GH#2575] Upgraded OpenSSL binaries (for the Windows builds and for RPM's) to version 3.0.8. This resolves some CVE's (CVE-2022-3602; CVE-2022-3786) which don't impact Nmap proper since it doesn't do certificate validation, but could possibly impact Ncat when the --ssl-verify option is used. o Upgrade included libraries: zlib 1.2.13, Lua 5.4.4, libpcap 1.10.4 o [GH#2532] Removed the bogus OpenSSL message from the Windows Nmap executable which looked like "NSOCK ERROR ssl_init_helper(): OpenSSL legacy provider failed to load." We actually already have the legacy provider built-in to our OpenSSL builds, and that's why loading the external one fails. o [GH#2541] UDP port scan (-sU) and version scan (-sV) now both use the same data source, nmap-service-probes, for data payloads. Previously, the nmap-payloads file was used for port scan. Port scan responses will be used to kick-start the version matching process. [Daniel Miller] o Nmap's service scan (-sV) can now probe the UDP service behind a DTLS tunnel, the same as it already does for TCP services with SSL/TLS encryption. The DTLSSessionReq probe has had its rarity lowered to 2 to allow it to be sent sooner in the scan. [Daniel Miller] o [Ncat] Ncat in listen mode with --udp --ssl will use DTLS to secure incoming connections. [Daniel Miller] o [GH#1023] Handle Internationalized Domain Names (IDN) like Яндекс.рф on platforms where getaddrinfo supports the AI_IDN flag. [Daniel Miller] o [Ncat] Addressed an issue from the Debian bug tracker (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969314) regarding data received immediately after a SOCKS CONNECT response. Ncat can now be correctly used in the ProxyCommand option of OpenSSH. o Improved DNS domain name parsing to avoid recursion and enforce name length limits, avoiding a theoretical stack overflow issue with certain crafted DNS server responses, reported by Philippe Antoine. o [GH#2338][NSE] Fix mpint packing in ssh2 library, which was causing OpenSSH errors like "ssh_dispatch_run_fatal: bignum is negative" [Sami Loone] o [GH#2507] Updates to the Japanese manpage translation by Taichi Kotake. o [Ncat][GH#1026][GH#2426] Dramatically speed up Ncat transfers on Windows by avoiding a 125ms wait for every read from STDIN. [scriptjunkie] o [GH#1192][Windows] Periodically reset the system idle timer to keep the system from going to sleep while scans are in process. This only affects port scans and OS detection scans, since NSE and version scan do not rely on timing data to adjust speed. o Updated the Nmap Public Source License (NPSL) to Version 0.95. This just clarifies that the derivative works definition and all other license clauses only apply to parties who choose to accept the license in return for the special rights granted (such as Nmap redistribution rights). If a party can do everything they need to using copyright provisions outside of this license such as fair use, we support that and aren't trying to claim any control over their work. Versions of Nmap released under previous versions of the NPSL may also be used under the NPSL 0.95 terms. o Avoid storing many small strings from IPv4 OS detection results in the global string_pool. These were effectively leaked after a host is done being scanned, since string_pool allocations are not freed until Nmap quits. 7.93 [2022-09-01] o This release commemorates Nmap's 25th anniversary! It all started with this September 1, 1997 Phrack article by Fyodor: https://nmap.org/p51-11.html. o [Windows] Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.50 to the latest version 1.71. It includes dozens of performance improvements, bug fixes and feature enhancements described at https://npcap.com/changelog. o Ensure Nmap builds with OpenSSL 3.0 using no deprecated API functions. Binaries for this release include OpenSSL 3.0.5. o Upgrade included libraries: libssh2 1.10.0, zlib 1.2.12, Lua 5.3.6, libpcap 1.10.1 o [GH#2416] Fix a bug that prevented Nmap from discovering interfaces on Linux when no IPv4 addresses were configured. [Daniel Miller, nnposter] o [NSE][GH#2463] NSE "exception handling" with nmap.new_try() will no longer result in a stack traceback in debug output nor a "ERROR: script execution failed" message in script output, since the intended behavior has always been to end the script immediately without output. [Daniel Miller] o [GH#2494] Update the Nmap output DTD to match actual output since the `<hosthint>` element was added in Nmap 7.90. o [NSE][GH#2496] Fix newtargets support: since Nmap 7.92, scripts could not add targets in script pre-scanning phase. [Daniel Miller] o [GH#2468] Scripts dhcp-discover and broadcast-dhcp-discover now support setting a client identifier. [nnposter] o [GH#2331][GH#2471] Script oracle-tns-version was not reporting the version correctly for Oracle 19c or newer [linholmes] o [GH#2296][GH#2342] Script redis-info was crashing or producing inaccurate information about client connections and/or cluster nodes. [nnposter] o [GH#2379] Nmap and Nping were unable to obtain system routes on FreeBSD [benpratt, nnposter] o [GH#2464] Script ipidseq was broken due to calling an unreachable library function. [nnposter] o [GH#2420][GH#2436] Support for EC crypto was not properly enabled if Nmap was compiled with OpenSSL in a custom location. [nnposter] o [NSE] Improvements to event handling and pcap socket garbage collection, fixing potential hangs and crashes. [Daniel Miller] o We ceased creating the Nmap win32 binary zipfile. It was useful back when you could just unzip it and run Nmap from there, but that hasn't worked well for many years. The win32 self-installer handles Npcap installation and many other dependencies and complexities. Anyone who needs the binaries for some reason can still install Nmap on any system and retrieve them from there. For now we're keeping the Win32 zipfile in the Nmap OEM Edition (https://nmap.org/oem) for companies building Nmap into their own products. But even in that case we believe that running the Nmap OEM self-installer in silent mode is a better approach. o [GH#2388] Fix TDS7 password encoding for mssql.lua, which had been assuming ASCII input even though other parts of the library had been passing it Unicode. o [GH#2402] Replace deprecated CPEs for IIS with their updated identifier, cpe:/a:microsoft:internet_information_services [Esa Jokinen] o [NSE][GH#2393] Fix script-terminating error when unknown BSON data types are encountered. Added parsers for most standard data types. [Daniel Miller] o [Ncat] Fix hostname/certificate comparison and matching to handle ASN.1 strings without null terminators, a similar bug to OpenSSL's CVE-2021-3712. o [Ncat][GH#2365] Added support for SOCKS5 proxies that return bind addresses as hostnames, instead of IPv4/IPv6 addresses. [pomu0325] Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/nmap | 7 ++----- lfs/nmap | 6 +++--- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/config/rootfiles/packages/nmap b/config/rootfiles/packages/nmap index 8c4fb78da..b7627c97f 100644 --- a/config/rootfiles/packages/nmap +++ b/config/rootfiles/packages/nmap @@ -5,8 +5,6 @@ usr/bin/nping #usr/share/man/es/man1 #usr/share/man/es/man1/nmap.1 #usr/share/man/fr/man1/nmap.1 -#usr/share/man/hr -#usr/share/man/hr/man1 #usr/share/man/hr/man1/nmap.1 #usr/share/man/hu #usr/share/man/hu/man1 @@ -24,8 +22,6 @@ usr/bin/nping #usr/share/man/pt_PT #usr/share/man/pt_PT/man1 #usr/share/man/pt_PT/man1/nmap.1 -#usr/share/man/ro -#usr/share/man/ro/man1 #usr/share/man/ro/man1/nmap.1 #usr/share/man/ru/man1/nmap.1 #usr/share/man/sk @@ -37,7 +33,6 @@ usr/bin/nping #usr/share/nmap usr/share/nmap/nmap-mac-prefixes usr/share/nmap/nmap-os-db -usr/share/nmap/nmap-payloads usr/share/nmap/nmap-protocols usr/share/nmap/nmap-rpc usr/share/nmap/nmap-service-probes @@ -108,6 +103,7 @@ usr/share/nmap/nselib/data/rtsp-urls.txt usr/share/nmap/nselib/data/snmpcommunities.lst usr/share/nmap/nselib/data/ssl-fingerprints usr/share/nmap/nselib/data/targets-ipv6-wordlist +usr/share/nmap/nselib/data/tftp-fingerprints.lua usr/share/nmap/nselib/data/tftplist.txt usr/share/nmap/nselib/data/usernames.lst usr/share/nmap/nselib/data/vhosts-default.lst @@ -805,6 +801,7 @@ usr/share/nmap/scripts/telnet-brute.nse usr/share/nmap/scripts/telnet-encryption.nse usr/share/nmap/scripts/telnet-ntlm-info.nse usr/share/nmap/scripts/tftp-enum.nse +usr/share/nmap/scripts/tftp-version.nse usr/share/nmap/scripts/tls-alpn.nse usr/share/nmap/scripts/tls-nextprotoneg.nse usr/share/nmap/scripts/tls-ticketbleed.nse diff --git a/lfs/nmap b/lfs/nmap index 52fd077b7..991245500 100644 --- a/lfs/nmap +++ b/lfs/nmap @@ -26,7 +26,7 @@ include Config SUMMARY = Network exploration tool and security scanner -VER = 7.92 +VER = 7.94 THISAPP = nmap-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nmap -PAK_VER = 15 +PAK_VER = 16 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0f3022e797ffca7d1d3497990c86bb60ac9a80bb93cb4ec7fcfa4f51782cb8d79d4f0aca0fa6119bfd604cfe7b89af3d4223ce13ad3e6c948c021909aebd956b +$(DL_FILE)_BLAKE2 = 5819b458b50e33f6a507ad3c32a731c13e730c40d31a61731c3cfcd41fad8e3fdfcbb721ef46b05a80e406d0a646d0966d4b645551711144822551ef374a443a install : $(TARGET) -- 2.41.0

1 8

[PATCH] udev: Updeate to version 3.2.12
by Adolf Belka 23 Jul '23

23 Jul '23

- Update from version 3.2.11 to 3.2.12 - Update of rootfile - Changelog 3.2.12 rules/50-udev-default.rules: add PTP entry for Hyper-V/Azure by @dermotbradley in #218 Add the BUILD instructions for Gentoo by @lu-zero in #224 Fix warnings by @bbonev in #222 udev: add udev_dir as synonym of udevdir by @oreo639 in #225 build: Remove dead g-i-r configuration by @akiernan in #231 Hwdb.7 by @bbonev in #221 Precompiled hwdb by @bbonev in #223 Merge suitable rules changes from systemd by @bbonev in #220 Merge hwdb from systemd by @bbonev in #219 Fix problems detected by fortified builds by @bbonev in #232 Avoid warning on 32bit by @bbonev in #233 Systemd PR 24353 by @bbonev in #239 Do not free a static string by @bbonev in #238 man: udev.7, mention /usr/lib with split-usr by @omnivagant in #246 Missing tools by @bbonev in #240 Fix compile-time issue on very old kernels by @cockroach in #247 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/udev | 10 ++++++++++ lfs/udev | 6 +++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/udev b/config/rootfiles/common/udev index a34ee46c3..64d33ee6c 100644 --- a/config/rootfiles/common/udev +++ b/config/rootfiles/common/udev @@ -23,9 +23,11 @@ etc/udev/hwdb.d/60-keyboard.hwdb etc/udev/hwdb.d/60-seat.hwdb etc/udev/hwdb.d/60-sensor.hwdb etc/udev/hwdb.d/70-analyzers.hwdb +etc/udev/hwdb.d/70-av-production.hwdb etc/udev/hwdb.d/70-cameras.hwdb etc/udev/hwdb.d/70-joystick.hwdb etc/udev/hwdb.d/70-mouse.hwdb +etc/udev/hwdb.d/70-pda.hwdb etc/udev/hwdb.d/70-pointingstick.hwdb etc/udev/hwdb.d/70-touchpad.hwdb etc/udev/hwdb.d/80-ieee1394-unit-function.hwdb @@ -40,6 +42,8 @@ lib/udev lib/udev/ata_id lib/udev/cdrom_id lib/udev/collect +lib/udev/dmi_memory_id +lib/udev/fido_id lib/udev/init-net-rules.sh lib/udev/mtd_probe lib/udev/network-aqm @@ -51,10 +55,12 @@ lib/udev/rule_generator.functions #lib/udev/rules.d lib/udev/rules.d/25-alsa.rules lib/udev/rules.d/50-udev-default.rules +lib/udev/rules.d/60-autosuspend.rules lib/udev/rules.d/60-block.rules lib/udev/rules.d/60-cdrom_id.rules lib/udev/rules.d/60-drm.rules lib/udev/rules.d/60-evdev.rules +lib/udev/rules.d/60-fido-id.rules lib/udev/rules.d/60-input-id.rules lib/udev/rules.d/60-net.rules lib/udev/rules.d/60-persistent-alsa.rules @@ -65,13 +71,16 @@ lib/udev/rules.d/60-persistent-v4l.rules lib/udev/rules.d/60-sensor.rules lib/udev/rules.d/60-serial.rules lib/udev/rules.d/64-btrfs.rules +lib/udev/rules.d/70-camera.rules lib/udev/rules.d/70-joystick.rules +lib/udev/rules.d/70-memory.rules lib/udev/rules.d/70-mouse.rules lib/udev/rules.d/70-touchpad.rules lib/udev/rules.d/75-net-description.rules lib/udev/rules.d/75-probe_mtd.rules lib/udev/rules.d/78-sound-card.rules lib/udev/rules.d/80-drivers.rules +lib/udev/rules.d/81-net-dhcp.rules lib/udev/rules.d/90-hwrng.rules lib/udev/rules.d/99-aqm.rules lib/udev/rules.d/99-offloading.rules @@ -91,6 +100,7 @@ sbin/udevd #usr/share/doc/udev-20171102/lfs/55-lfs.txt #usr/share/doc/udev-20171102/lfs/README #usr/share/man/man5/udev.conf.5 +#usr/share/man/man7/hwdb.7 #usr/share/man/man7/udev.7 #usr/share/man/man8/udevadm.8 #usr/share/man/man8/udevd.8 diff --git a/lfs/udev b/lfs/udev index e712ef6ea..0046347b3 100644 --- a/lfs/udev +++ b/lfs/udev @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.2.11 +VER = 3.2.12 RULES_VER = 20171102 THISAPP = eudev-$(VER) @@ -42,7 +42,7 @@ objects = $(DL_FILE) udev-lfs-$(RULES_VER).tar.bz2 $(DL_FILE) = $(DL_FROM)/$(DL_FILE) udev-lfs-$(RULES_VER).tar.bz2 = $(DL_FROM)/udev-lfs-$(RULES_VER).tar.bz2 -$(DL_FILE)_BLAKE2 = e1985a4fd0d497b739543d027b5b40033932819e3e5402a51f73fab666144f97f768dff325b5f0e0beb43420efa9afdefb76a9da6b88fa065ad25c76fe1fbc6a +$(DL_FILE)_BLAKE2 = 1d2dcc158432f722904f645749420cb44ff98f68b8b8fc11917e83750c95280d0dc2c4d9a322909a4acdb9455c6ec373eade77aacb1039096daa8e642076d3d1 udev-lfs-$(RULES_VER).tar.bz2_BLAKE2 = b5fb8177a87719e28adc976b83953024dbcfb8739b0c2e61da186cbc4df5e75e62c888da987d15c64db164002bb0a1e66ce0ff206b143dc953d7571b66d5d5c0 install : $(TARGET) -- 2.41.0

1 1

[PATCH] curl: Update to version 8.2.0
by Adolf Belka 21 Jul '23

21 Jul '23

- Update from version 8.1.0 to 8.2.0 - Update of rootfile - Changelog 8.2.0 Changes: curl: add --ca-native and --proxy-ca-native curl: add --trace-ids CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS haproxy: add --haproxy-clientip flag to set client IPs lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID Bugfixes: bufq: make write/pass methods more robust build: drop unused/redundant `HAVE_WINLDAP_H` cf-socket: don't bypass fclosesocket callback if cancelled before connect cf-socket: move ctx declaration under HAVE_GETPEERNAME cf-socket: skip getpeername()/getsockname for TFTP checksrc: modernise perl file open checksrc: quote the file name to work with "funny" letters CI: brew fix for openssl in default path CI: don't install impacket if tests are not run CI: enable parallel make in more builds circleci: install impacket & wolfssl 5.6.0 cmake: add support for "unity" builds cmake: make use of snprintf cmake: stop CMake from quietly ignoring missing Brotli configure: add check for ldap_init_fd configure: fix run-compiler for old /bin/sh configure: the --without forms of the options are also gone connect-timeout.d: mention that the DNS lookup is included curl.h: include <sys/select.h> for vxworks curl: count uploaded data to stop at the originally given size curl: return error when asked to use an unsupported HTTP version curl_easy_nextheader.3: add missing open parenthesis examples curl_log: evaluate log statement only when transfer is verbose curl_mprintf.3: minor fix of the example curl_pushheader_byname/bynum.3: document in their own man pages curl_url_set: enforce the max string length check for all parts CURLOPT_AWS_SIGV4.3: remove unused variable from example CURLOPT_INFILESIZE.3: mention -1 triggers chunked CURLOPT_MIMEPOST.3: clarify what setting to NULL means CURLOPT_SSH_PRIVATE_KEYFILE.3: expand on the file search docs/libcurl/libcurl.3: cleanups and improvements docs: add more .IP after .RE to fix indentation of generate paragraphs docs: fix missing parameter names in examples docs: update CURLOPT_UPLOAD.3 docs: update HTTP3.md for newer ngtcp2 and nghttp3 docs: use a space after RFC when spelling out RFC numbers example/connect-to: show CURLOPT_CONNECT_TO example/crawler: also set CURLOPT_AUTOREFERER example/crawler: make it use a few more options example/default-scheme: set the default scheme for schemeless URLs example/hsts-preload: show one way to HSTS preload example/http2-download: set CURLOPT_BUFFERSIZE example/ipv6: feature CURLOPT_ADDRESS_SCOPE in use example/maxconnects: set maxconnect example example/opensslthreadlock: remove examples/ftpuploadresume.c: add use of CURLOPT_ACCEPTTIMEOUT_MS examples/http-options: show how to send "OPTIONS *" examples/https.c: use CURLOPT_CA_CACHE_TIMEOUT examples/multi-debugcallback.c: avoid the bool typedef examples/smtp-mime: use CURLOPT_MAIL_RCPT_ALLOWFAILS examples/unixsocket.c: example using CURLOPT_UNIX_SOCKET_PATH examples/websocket.c: websocket example using CONNECT_ONLY examples: make use of CURLOPT_(REDIR_|)PROTOCOLS_STR fopen: fix conversion warning on 32-bit Android fopen: optimize hostip.c: Move macOS-specific calls into global init call HTTP/2: upload handling fixes http2: better support for --limit-rate http2: error stream resets with code CURLE_HTTP2_STREAM http2: fix crash in handling stream weights http2: fix variable type http2: h2 and h2-PROXY connection alive check fixes http2: raise header limitations above and beyond http2: send HEADER & DATA together if possible http2: treat initial SETTINGS as a WINDOW_UPDATE HTTP3.md: update openssl version http3/ngtcp2: upload EAGAIN handling http: rectify the outgoing Cookie: header field size check hyper: fix EOF handling on input hyper: unslow imap-append.c: update to make it more likely to work imap: Provide method to disable SASL if it is advertised krb5: add typecast to please Coverity libcurl-url.3: also mention CURLUPART_ZONEID libcurl-ws.3. WebSocket API overview libssh2: provide error message when setting host key type fails libssh2: use custom memory functions ngtcp2: assigning timeout, but value is overwritten before used ngtcp2: build with 0.17.0 and nghttp3 0.13.0 ngtcp2: use ever increasing timestamp in io quiche: avoid NULL deref in debug logging quiche: fix defects found in latest coverity report quote.d: fix indentation of generated paragraphs runtests: abort test run after failure without -a runtests: better handle ^C during slow tests runtests: consistently write the test check summary block runtests: create multiple test runners when requested runtests: include missing valgrind package runtests: make test file directories in log/N runtests: rename server command file runtests: use more consistent failure lines runtests: work around a perl without SIGUSR1 runtests; give each server a unique log lock file scripts: Fix GHA matrix job detection in cijobs.pl sectransp: fix EOF handling system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles test2600: fix the description test427: verify sending more cookies than fit in a 8190 bytes line tests/http: Add mod_h2 directive `H2ProxyRequests` tests/servers.pm: pick unused port number with a server socket tests/servers: generate temp names in /tmp for unix domain sockets tests: fix error messages & handling around sockets tests: improve reliability of TFTP tests testutil: allow multiple %-operators on the same line timeval: use CLOCK_MONOTONIC_RAW if available tls13-ciphers.d: include Schannel tool: remove exclamation marks from error/warning messages tool: remove newlines from all helpf/notef/warnf/errorf calls tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION` tool_getparam: fix comment tool_operate: allow cookie lines up to 8200 bytes tool_parsecfg: accept line lengths up to 10M tool_urlglob: use curl_off_t instead of longs tool_writeout_json: fix encoding of control characters transfer: clear credentials when redirecting to absolute URL urlapi: have *set(PATH) prepend a slash if one is missing urlapi: scheme must start with alpha vtls: avoid memory leak if sha256 call fails websocket-cb: example doing WebSocket download using callback wolfssl: detect when TLS 1.2 support is not built into wolfssl wolfssl: support setting CA certificates as blob ws: make the curl_ws_meta() return pointer a const 8.1.2 Bugfixes: configure: quote the assignments for run-compiler configure: without pkg-config and no custom path, use -lnghttp2 curl: cache the --trace-time value for a second http2: fix EOF handling on uploads with auth negotiation http3: send EOF indicator early as possible lib1560: verify more scheme guessing lib: remove unused functions, make single-use static libcurl.m4: remove trailing 'dnl' that causes this to break autoconf libssh: when keyboard-interactive auth fails, try password misc: fix spelling mistakes page-header: mention curl version and how to figure out current release page-header: minor wording polish in the URL segment scripts/singleuse.pl: add more API calls urlapi: remove superfluous host name check 8.1.1 Bugfixes: cf-socket: completely remove the disabled USE_RECV_BEFORE_SEND_WORKAROUND checksrc: disallow spaces before labels cmake: avoid `list(PREPEND)` for compatibility cmake: repair cross compiling configure: fix --help alignment configure: generate a script to run the compiler curl_easy_getinfo: clarify on return data types docs: document that curl_url_cleanup(NULL) is a safe no-op hostip: move easy_lock.h include above curl_memory.h http2: double http request parser max line length http2: increase stream window size to 10 MB http2: upload improvements lib: fix conversion warnings with gcc on macOS lib: rename struct 'http_req' to 'httpreq' ngtcp2: fix compiler warning about possible null-deref ngtcp2: proper handling of uint64_t when adjusting send buffer os400: update chkstrings.c runtests: handle interrupted reads from IPC pipes runtests: use the correct fd after select sectransp.c: make the code c89 compatible select: avoid returning an error on EINTR from select() or poll() test425: fix the log directory for the upload url: provide better error message when URLs fail to parse urlapi: allow numerical parts in the host name vquic.c: make recvfrom_packets static, avoid compiler warning Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/curl | 6 +++++- lfs/curl | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/curl b/config/rootfiles/common/curl index 82e3988d6..4559aaaa8 100644 --- a/config/rootfiles/common/curl +++ b/config/rootfiles/common/curl @@ -183,6 +183,7 @@ usr/lib/libcurl.so.4.8.0 #usr/share/man/man3/CURLOPT_GSSAPI_DELEGATION.3 #usr/share/man/man3/CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3 #usr/share/man/man3/CURLOPT_HAPROXYPROTOCOL.3 +#usr/share/man/man3/CURLOPT_HAPROXY_CLIENT_IP.3 #usr/share/man/man3/CURLOPT_HEADER.3 #usr/share/man/man3/CURLOPT_HEADERDATA.3 #usr/share/man/man3/CURLOPT_HEADERFUNCTION.3 @@ -225,7 +226,7 @@ usr/lib/libcurl.so.4.8.0 #usr/share/man/man3/CURLOPT_MAIL_AUTH.3 #usr/share/man/man3/CURLOPT_MAIL_FROM.3 #usr/share/man/man3/CURLOPT_MAIL_RCPT.3 -#usr/share/man/man3/CURLOPT_MAIL_RCPT_ALLLOWFAILS.3 +#usr/share/man/man3/CURLOPT_MAIL_RCPT_ALLOWFAILS.3 #usr/share/man/man3/CURLOPT_MAXAGE_CONN.3 #usr/share/man/man3/CURLOPT_MAXCONNECTS.3 #usr/share/man/man3/CURLOPT_MAXFILESIZE.3 @@ -471,6 +472,8 @@ usr/lib/libcurl.so.4.8.0 #usr/share/man/man3/curl_multi_timeout.3 #usr/share/man/man3/curl_multi_wait.3 #usr/share/man/man3/curl_multi_wakeup.3 +#usr/share/man/man3/curl_pushheader_byname.3 +#usr/share/man/man3/curl_pushheader_bynum.3 #usr/share/man/man3/curl_share_cleanup.3 #usr/share/man/man3/curl_share_init.3 #usr/share/man/man3/curl_share_setopt.3 @@ -501,4 +504,5 @@ usr/lib/libcurl.so.4.8.0 #usr/share/man/man3/libcurl-thread.3 #usr/share/man/man3/libcurl-tutorial.3 #usr/share/man/man3/libcurl-url.3 +#usr/share/man/man3/libcurl-ws.3 #usr/share/man/man3/libcurl.3 diff --git a/lfs/curl b/lfs/curl index 995f63cd5..b97e974bb 100644 --- a/lfs/curl +++ b/lfs/curl @@ -24,7 +24,7 @@ include Config -VER = 8.1.0 +VER = 8.2.0 THISAPP = curl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 768a824b8f5f6ddaa073599c4106f07a8134bcbe0e0d666390be1bce16ba25386d85930853bb47bc90b2c8a499a0b2abb9c685042563801e0fe58b9c315ac6cc +$(DL_FILE)_BLAKE2 = 1387869f9ab2e1984217e57a5a8aa3551b4015875fc6a0b4159fa1cbac01b8ec865aa1db03478ce61508592d1bd5f8e9ee51d411cd704805d8f907b56b382923 install : $(TARGET) -- 2.41.0

1 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2023