Development July 2023

development@lists.ipfire.org

8 participants
64 discussions

[PATCH] squid: Update to 6.1
by Matthias Fischer 09 Jul '23

09 Jul '23

For details see: http://lists.squid-cache.org/pipermail/squid-users/2023-July/025929.html "The Squid HTTP Proxy team is very pleased to announce the availability of the Squid-6.1 release! This release is we believe, stable enough for general production use. Support for Squid-5 bug fixes has now officially ceased. Bugs in 5.x will continue to be fixed, however the fixes will be added to the 6.x series. All users of Squid-5.x are encouraged to plan for upgrades." And: http://www.squid-cache.org/Versions/v6/RELEASENOTES.html v6 is running since 6.0.1 here in production use without any seen problems... Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lfs/squid b/lfs/squid index bc0682031..26b8249cc 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 5.9 +VER = 6.1 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 898a34357f8019291379ea37c66fa312e1a6437e8f643987dd4e54d7d52728248e16129b00195c5f6e0378c0f32c9f9ade3f98ca0ec4bb952f9f443357face82 +$(DL_FILE)_BLAKE2 = 840ea8b09f8518f6e3b92a22cc6e6d3befc08b9e9650e13a54b607b398a967f1bc2b30e5b52cae5423a49ee02d0cfc13d3488c2b9ece3b3c0d4df689de390adf install : $(TARGET) @@ -117,6 +117,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --enable-build-info \ --enable-eui \ --enable-async-io=16 \ + --enable-translation \ --enable-unlinkd \ --enable-internal-dns \ --enable-epoll \ -- 2.34.1

2 1

[PATCH] samba: update to 4.18.4
by Arne Fitzenreiter 09 Jul '23

09 Jul '23

--- lfs/samba | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/samba b/lfs/samba index cda2a2820..9e104f64a 100644 --- a/lfs/samba +++ b/lfs/samba @@ -24,7 +24,7 @@ include Config -VER = 4.18.1 +VER = 4.18.4 SUMMARY = A SMB/CIFS File, Print, and Authentication Server THISAPP = samba-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 93 +PAK_VER = 94 DEPS = avahi cups perl-Parse-Yapp perl-JSON @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f8df6582044ff802766a397cc2a9216eb41c9353822d94281b86fb6b833b23eeaf3eb5a0d32e3f2079e59d098a16f87406cf1da65f58818a73767f27b7f7dc1f +$(DL_FILE)_BLAKE2 = 1f1aab7eb933111b9b1c72af8c3dd379fe34014085129e9d5cc400b4e434742e1c08ad4fdf2a98291d6063ce9b2ddc811e9ab5dbb133a85e97f2158f83dd7c96 install : $(TARGET) -- 2.38.1

2 1

[PATCH] squidclamav: Remove package from IPFire as agreed in dev video call 3rd Jul 2023
by Adolf Belka 09 Jul '23

09 Jul '23

- Removal of lfs file - Removal of rootfile - Removal of backup includes file - Removal of three patches - Removal of paks files - Adjustment of make.sh to remove squidclamav Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/backup/includes/squidclamav | 1 - config/rootfiles/packages/squidclamav | 14 -- config/squidclamav/squidclamav.conf | 39 ---- lfs/squidclamav | 95 --------- make.sh | 1 - src/paks/squidclamav/install.sh | 27 --- src/paks/squidclamav/uninstall.sh | 28 --- src/paks/squidclamav/update.sh | 53 ----- .../squidclamav-5.11-dont_use_ipv6.patch | 13 -- ...av-5.11-source-address-parsing-issue.patch | 13 -- ...uidclamav-5.11-squid-helper-protocol.patch | 185 ------------------ 11 files changed, 469 deletions(-) delete mode 100644 config/backup/includes/squidclamav delete mode 100644 config/rootfiles/packages/squidclamav delete mode 100644 config/squidclamav/squidclamav.conf delete mode 100644 lfs/squidclamav delete mode 100644 src/paks/squidclamav/install.sh delete mode 100644 src/paks/squidclamav/uninstall.sh delete mode 100644 src/paks/squidclamav/update.sh delete mode 100644 src/patches/squidclamav-5.11-dont_use_ipv6.patch delete mode 100644 src/patches/squidclamav-5.11-source-address-parsing-issue.patch delete mode 100644 src/patches/squidclamav-5.11-squid-helper-protocol.patch diff --git a/config/backup/includes/squidclamav b/config/backup/includes/squidclamav deleted file mode 100644 index bacc23b67..000000000 --- a/config/backup/includes/squidclamav +++ /dev/null @@ -1 +0,0 @@ -/etc/squidclamav.conf diff --git a/config/rootfiles/packages/squidclamav b/config/rootfiles/packages/squidclamav deleted file mode 100644 index 5976a0c47..000000000 --- a/config/rootfiles/packages/squidclamav +++ /dev/null @@ -1,14 +0,0 @@ -etc/squidclamav.conf -usr/bin/squidclamav -#usr/libexec/squidclamav -#usr/libexec/squidclamav/clwarn.cgi -#usr/libexec/squidclamav/clwarn.cgi.de_DE -#usr/libexec/squidclamav/clwarn.cgi.en_EN -#usr/libexec/squidclamav/clwarn.cgi.fr_FR -#usr/libexec/squidclamav/clwarn.cgi.pt_BR -#usr/libexec/squidclamav/clwarn.cgi.ru_RU -#usr/share/man/man1/squidclamav.1 -#usr/share/squidclamav -#usr/share/squidclamav/README -var/ipfire/backup/addons/includes/squidclamav -srv/web/ipfire/html/clwarn.cgi diff --git a/config/squidclamav/squidclamav.conf b/config/squidclamav/squidclamav.conf deleted file mode 100644 index 2b8f5dc02..000000000 --- a/config/squidclamav/squidclamav.conf +++ /dev/null @@ -1,39 +0,0 @@ -squid_ip 127.0.0.1 -squid_port 800 -# -logfile /var/log/squid/squidclamav.log -redirect http://127.0.0.1:81/clwarn.cgi -# -debug 0 -stat 0 -# -clamd_local /var/run/clamav/clamd -#clamd_ip 192.168.1.5 -#clamd_port 3310 -# -maxsize 5000000 -maxredir 30 -timeout 60 -trust_cache 1 -# -# Do not scan standard HTTP images -abort ^.*\.(ico|gif|png|jpg)$ -abortcontent ^image\/.*$ -# -# Do not scan text and javascript files -abort ^.*\.(css|xml|xsl|js|html|jsp)$ -abortcontent ^text\/.*$ -abortcontent ^application\/x-javascript$ -# -# Do not scan streaming videos -abortcontent ^video\/mp4$ -abortcontent ^video\/x-flv$ -# -# Do not scan pdf and flash -#abort ^.*\.(pdf|swf)$ -# -# Do not scan sequence of framed Microsoft Media Server (MMS) data packets -abortcontent ^.*application\/x-mms-framed.*$ -# -# White list some sites -whitelist .*\.clamav.net diff --git a/lfs/squidclamav b/lfs/squidclamav deleted file mode 100644 index 06133c5de..000000000 --- a/lfs/squidclamav +++ /dev/null @@ -1,95 +0,0 @@ -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -############################################################################### -# Definitions -############################################################################### - -include Config - -SUMMARY = Antivirus redirector for Squid based on ClamAv - -VER = 5.11 - -THISAPP = squidclamav-$(VER) -DL_FILE = $(THISAPP).tar.gz -DL_FROM = $(URL_IPFIRE) -DIR_APP = $(DIR_SRC)/$(THISAPP) -TARGET = $(DIR_INFO)/$(THISAPP) -PROG = squidclamav -PAK_VER = 22 - -DEPS = clamav - -SERVICES = - -############################################################################### -# Top-level Rules -############################################################################### - -objects = $(DL_FILE) - -$(DL_FILE) = $(DL_FROM)/$(DL_FILE) - -$(DL_FILE)_BLAKE2 = 5f180f49685df355c1f142beac6f10161830b6e274cc9efac81564010f751edead9afce6118ddb5308297b6d3eb621f97a567b4f9cf096e08df833f70e03d24f - -install : $(TARGET) - -check : $(patsubst %,$(DIR_CHK)/%,$(objects)) - -download :$(patsubst %,$(DIR_DL)/%,$(objects)) - -b2 : $(subst %,%_BLAKE2,$(objects)) - -dist: - @$(PAK) - -############################################################################### -# Downloading, checking, b2sum -############################################################################### - -$(patsubst %,$(DIR_CHK)/%,$(objects)) : - @$(CHECK) - -$(patsubst %,$(DIR_DL)/%,$(objects)) : - @$(LOAD) - -$(subst %,%_BLAKE2,$(objects)) : - @$(B2SUM) - -############################################################################### -# Installation Details -############################################################################### - -$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) - @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - $(UPDATE_AUTOMAKE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/squidclamav-5.11-dont_use_ipv6.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/squidclamav-5.11-squid-helper-protocol.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/squidclamav-5.11-source-address-parsing-issue.patch - cd $(DIR_APP) && ./configure --prefix=/usr - cd $(DIR_APP) && make install - install -v -m 664 $(DIR_CONF)/squidclamav/squidclamav.conf /etc/squidclamav.conf - chown -v root:nobody /etc/squidclamav.conf - install -v -m 644 $(DIR_SRC)/config/backup/includes/squidclamav /var/ipfire/backup/addons/includes/squidclamav - chmod 755 /srv/web/ipfire/html/clwarn.cgi - @rm -rf $(DIR_APP) - @$(POSTBUILD) diff --git a/make.sh b/make.sh index db9ee9a97..57b6c6f15 100755 --- a/make.sh +++ b/make.sh @@ -1532,7 +1532,6 @@ buildipfire() { lfsmake2 perl-Authen-SASL lfsmake2 perl-MIME-Lite lfsmake2 perl-Email-Date-Format - lfsmake2 squidclamav lfsmake2 vnstat lfsmake2 iw lfsmake2 wpa_supplicant diff --git a/src/paks/squidclamav/install.sh b/src/paks/squidclamav/install.sh deleted file mode 100644 index 42bd5ba36..000000000 --- a/src/paks/squidclamav/install.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -############################################################################ -# # -# This file is part of the IPFire Firewall. # -# # -# IPFire is free software; you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation; either version 2 of the License, or # -# (at your option) any later version. # -# # -# IPFire is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with IPFire; if not, write to the Free Software # -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -# # -# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # -# # -############################################################################ -# -. /opt/pakfire/lib/functions.sh -extract_files -restore_backup ${NAME} -/etc/init.d/squid restart diff --git a/src/paks/squidclamav/uninstall.sh b/src/paks/squidclamav/uninstall.sh deleted file mode 100644 index d2aa435e3..000000000 --- a/src/paks/squidclamav/uninstall.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash -############################################################################ -# # -# This file is part of the IPFire Firewall. # -# # -# IPFire is free software; you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation; either version 2 of the License, or # -# (at your option) any later version. # -# # -# IPFire is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with IPFire; if not, write to the Free Software # -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -# # -# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # -# # -############################################################################ -# -. /opt/pakfire/lib/functions.sh -/etc/init.d/squid stop -make_backup ${NAME} -remove_files -/etc/init.d/squid start diff --git a/src/paks/squidclamav/update.sh b/src/paks/squidclamav/update.sh deleted file mode 100644 index 43760856c..000000000 --- a/src/paks/squidclamav/update.sh +++ /dev/null @@ -1,53 +0,0 @@ -#!/bin/bash -############################################################################ -# # -# This file is part of the IPFire Firewall. # -# # -# IPFire is free software; you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation; either version 2 of the License, or # -# (at your option) any later version. # -# # -# IPFire is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with IPFire; if not, write to the Free Software # -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -# # -# Copyright (C) 2010 IPFire-Team <info(a)ipfire.org>. # -# # -############################################################################ -# -. /opt/pakfire/lib/functions.sh -./uninstall.sh -extract_files - -VERSION=$(cat /opt/pakfire/db/installed/meta-squidclamav | grep Release | cut -d" " -f2) - -if [ "$VERSION" -gt "10" ]; then - restore_backup ${NAME} -fi - -if [ "$VERSION" -lt "11" ]; then - sed -e "s|logfile.*|logfile /var/log/squid/squidclamav.log|g" /etc/squidclamav.conf -fi - -if [ "$VERSION" -lt "16" ]; then - sed -i /etc/squidclamav.conf \ - -e "s/proxy none//g" \ - -e "s/^#squid_ip 127\.0\.0\.1/squid_ip 127\.0\.0\.1/g" \ - -e "s/^#squid_port 3128/squid_port 800/g" \ - -e "s/^#trust_cache 1/trust_cache 1/g" - - # Fix permissions. - chmod 664 /etc/squidclamav.conf - chown root.nobody /etc/squidclamav.conf - - # Regenerate configuration files. - perl /srv/web/ipfire/cgi-bin/proxy.cgi -fi - -/etc/init.d/squid restart diff --git a/src/patches/squidclamav-5.11-dont_use_ipv6.patch b/src/patches/squidclamav-5.11-dont_use_ipv6.patch deleted file mode 100644 index 45889625f..000000000 --- a/src/patches/squidclamav-5.11-dont_use_ipv6.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -Nur a/src/squidclamav.c b/src/squidclamav.c ---- a/src/squidclamav.c 2012-10-29 09:46:06.000000000 +0100 -+++ b/src/squidclamav.c 2013-07-06 19:10:56.375292374 +0200 -@@ -413,6 +413,9 @@ - /* Suppress error: SSL certificate problem, verify that the CA cert is OK */ - curl_easy_setopt (eh, CURLOPT_SSL_VERIFYHOST, 0); - curl_easy_setopt (eh, CURLOPT_SSL_VERIFYPEER, 0); -+ -+ /* Prevent squidclamav from using IPv6 - fix by Nico Prenzel */ -+ curl_easy_setopt (eh, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4); - } - } - /* create a squidguard child process and setup pipes */ diff --git a/src/patches/squidclamav-5.11-source-address-parsing-issue.patch b/src/patches/squidclamav-5.11-source-address-parsing-issue.patch deleted file mode 100644 index 4031c733d..000000000 --- a/src/patches/squidclamav-5.11-source-address-parsing-issue.patch +++ /dev/null @@ -1,13 +0,0 @@ ---- squidclamav-5.11/src/pattern.c~ 2014-10-29 13:08:05.658143495 +0000 -+++ squidclamav-5.11/src/pattern.c 2014-10-29 13:08:20.964642365 +0000 -@@ -151,10 +151,6 @@ - return 1; - } - -- /* extract source ipaddress and source fqdn */ -- if (parseSourceAddress(in_buff.src_address, "/") != 0) { -- } -- - if (debug != 0) - logit(log_file, "DEBUG Parsed request: %s %s/%s %s %s\n", in_buff.url, in_buff.ipaddress, in_buff.fqdn, in_buff.ident, in_buff.method); - diff --git a/src/patches/squidclamav-5.11-squid-helper-protocol.patch b/src/patches/squidclamav-5.11-squid-helper-protocol.patch deleted file mode 100644 index e64bcafef..000000000 --- a/src/patches/squidclamav-5.11-squid-helper-protocol.patch +++ /dev/null @@ -1,185 +0,0 @@ -diff -Naur squidclamav-5.11.org/src/squidclamav.c squidclamav-5.11/src/squidclamav.c ---- squidclamav-5.11.org/src/squidclamav.c 2012-10-29 09:46:06.000000000 +0100 -+++ squidclamav-5.11/src/squidclamav.c 2014-06-03 12:26:36.215696508 +0200 -@@ -483,7 +483,7 @@ - aren't appropriate, then just echo back the line from stdin */ - if (buff_status == 1) { - logit(log_file, "DEBUG Invalid input buffer, aborting: %s\n", sbuff); -- puts(""); -+ puts("BH message=\"Invalid input buffer\""); - fflush(stdout); - continue; - } -@@ -496,7 +496,7 @@ - logit(log_file, "DEBUG No squidguard and no antivir check (TRUSTUSER match) for user: %s\n", in_buff.ident); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"TRUSTUSER match\""); - fflush(stdout); - continue; - } -@@ -508,7 +508,7 @@ - logit(log_file, "DEBUG No squidguard and no antivir check (TRUSTCLIENT match) for address: %s/%s\n",in_buff.ipaddress, in_buff.fqdn); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"TRUSTCLIENT match\""); - fflush(stdout); - continue; - } -@@ -520,7 +520,7 @@ - logit(log_file, "DEBUG No squidguard and no antivir check (WHITELIST match) for url: %s\n", in_buff.url); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"WHITLIST match\""); - fflush(stdout); - continue; - } -@@ -536,7 +536,7 @@ - if ((sockd = dconnect ()) < 0) - { - logit(log_file, "ERROR Can't connect to Clamd daemon, fallback to Squid.\n"); -- puts(""); -+ puts("BH message=\"Cannot connect to clamd\""); - fflush(stdout); - continue; - } -@@ -546,7 +546,7 @@ - if (write (sockd, "zINSTREAM", 10) <= 0) - { - logit(log_file, "ERROR Can't write to Clamd socket.\n"); -- puts(""); -+ puts("BG message=\"Cannot write to clamd socket\""); - fflush(stdout); - continue; - } -@@ -614,8 +614,7 @@ - logit(log_file, "Squid Cache purged of url %s.\n", in_buff.url); - } - } -- fprintf (stdout, "%s %s %s %s\n", urlredir, -- in_buff.src_address, in_buff.ident, in_buff.method); -+ fprintf (stdout, "OK rewrite-url=\"%s\"\n", urlredir); - fflush(stdout); - xfree(urlredir); - if (debug != 0) -@@ -675,7 +674,7 @@ - continue operation (so that Squid still works!), - we simply echo stdin to stdout - i.e. "bridge mode" :-) */ - if (bridge_mode == 1) { -- puts(""); -+ puts("ERR message=\"brigde mode\""); - fflush(stdout); - continue; - } -@@ -685,7 +684,7 @@ - if (buff_status == -1) { - if (debug > 2) - logit(log_file, "DEBUG method is not GET skipping virus scan.\n"); -- puts(""); -+ puts("ERR message=\"method is not GET skipping virus scan\""); - fflush(stdout); - continue; - } -@@ -699,7 +698,7 @@ - timeit(g_start, "Total"); - - /* no replacement for the URL was found */ -- puts(""); -+ puts("ERR message=\"ABORT match\""); - fflush(stdout); - continue; - -@@ -750,7 +749,7 @@ - logit(log_file, "DEBUG HIT Cache found, trust cache enabled, skipping...\n"); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"cache hit found\""); - fflush(stdout); - continue; - } -@@ -762,7 +761,7 @@ - logit(log_file, "ERROR No content length from url %s\n", in_buff.url); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"no content length from URL\""); - fflush(stdout); - continue; - } -@@ -775,7 +774,7 @@ - logit(log_file, "DEBUG No antivir check (Content length is upper than maxsize): %'.2f > %'.2f\n", usize, maxsize); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"content length is upper than maxsize\""); - fflush(stdout); - continue; - } -@@ -787,7 +786,7 @@ - in_buff.url); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"no content type from URL\""); - fflush(stdout); - continue; - } -@@ -799,7 +798,7 @@ - logit(log_file, "DEBUG No antivir check (ABORTCONTENT match) for content-type: %s\n", content_type); - if (statit == 1) - timeit(g_start, "Total"); -- puts(""); -+ puts("ERR message=\"ABORTCONTENT match\""); - fflush(stdout); - continue; - } -@@ -814,7 +813,7 @@ - if ((sockd = dconnect ()) < 0) - { - logit(log_file, "ERROR Can't connect to Clamd daemon, fallback to Squid.\n"); -- puts(""); -+ puts("BH message=\"cannot connect clamd daemon\""); - fflush(stdout); - continue; - } -@@ -824,7 +823,7 @@ - if (write (sockd, "zINSTREAM", 10) <= 0) - { - logit(log_file, "ERROR Can't write to Clamd socket.\n"); -- puts(""); -+ puts("BH message=\"cannot write to clamd socket\""); - fflush(stdout); - continue; - } -@@ -844,7 +843,7 @@ - close (sockd); - if (debug > 1) - logit(log_file, "DEBUG Connection to clamd closed.\n"); -- puts(""); -+ puts("ERR message=\"connection to clamd closed\""); - fflush(stdout); - if (statit == 1) - timeit(g_start, "Total"); -@@ -892,8 +891,7 @@ - logit(log_file, "Squid Cache purged of url %s.\n", in_buff.url); - } - } -- fprintf (stdout, "%s %s %s %s\n", urlredir, -- in_buff.src_address, in_buff.ident, in_buff.method); -+ fprintf (stdout, "OK rewrite-url=\"%s\"\n", urlredir); - fflush(stdout); - xfree(urlredir); - if (debug != 0) -@@ -911,7 +909,7 @@ - if (virusfound == 0) { - if (debug != 0) - logit(log_file, "DEBUG No virus detected.\n"); -- puts(""); -+ puts("ERR message=\"no virus detected\""); - fflush(stdout); - } - } -- 2.41.0

2 1

[PATCH] memtest: update to 6.20
by Arne Fitzenreiter 09 Jul '23

09 Jul '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/memtest | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/memtest b/lfs/memtest index a26beaef4..d5baca8ca 100644 --- a/lfs/memtest +++ b/lfs/memtest @@ -24,7 +24,7 @@ include Config -VER = 6.10 +VER = 6.20 THISAPP = memtest86plus-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 2462c31f1ca27aa166c447e51a9b388872faaf7f845100a122f5dd8eb11dc76e26c503dc14d0825bda397c7180a5259094a020d25dd9d43b1997bfbe424c7f65 +$(DL_FILE)_BLAKE2 = 6e3bea4b18049446f27da2cb1313300c578ef7fdb774b6a20df603271b66a6c0066be64a91b0a6d4ffcc63f1e139132942290a8111f6a991cccc0a5586cac966 install : $(TARGET) -- 2.38.1

2 1

[PATCH] cups: Remove 5 minutes delay in start_service line in install.sh paks file
by Adolf Belka 09 Jul '23

09 Jul '23

- When cups is installed (including when doing a Core Update that includes a cups update) the 5 min delay for starting cups means that it has not restarted by the time that the reboot for the CU has been started. There are then error messages that say that cups couldn't be stopped as it was not running. - When a normal reboot is carried out withoutr any update of cups then the startup has no delay and it starts without any trouble. - This patch removes the 300 secs delay from the start_service line in the install.sh paks file. - The PAK_VER is bumped to ensure that this change is shipped Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/cups | 2 +- src/paks/cups/install.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/cups b/lfs/cups index 70839736f..cae829432 100644 --- a/lfs/cups +++ b/lfs/cups @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/cups-$(VER) TARGET = $(DIR_INFO)/$(THISAPP) PROG = cups -PAK_VER = 36 +PAK_VER = 37 DEPS = avahi cups-filters dbus ghostscript libexif diff --git a/src/paks/cups/install.sh b/src/paks/cups/install.sh index cc5866971..f1d45b697 100644 --- a/src/paks/cups/install.sh +++ b/src/paks/cups/install.sh @@ -25,7 +25,7 @@ extract_files restore_backup "${NAME}" /etc/init.d/messagebus reload -start_service --delay 300 --background ${NAME} +start_service --background ${NAME} ln -svf ../init.d/cups /etc/rc.d/rc0.d/K00cups ln -svf ../init.d/cups /etc/rc.d/rc3.d/S25cups ln -svf ../init.d/cups /etc/rc.d/rc6.d/K00cups -- 2.41.0

2 1

[PATCH v2] pmacct: fix bug 13159
by Jon Murphy 06 Jul '23

06 Jul '23

- changes `interface` to `pcap_interface` in pmacct.conf file. - thank you to @iptom for finding and reporting the issue and to many others for pitching in and helping debug! Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/pmacct/pmacct.conf | 25 ++++++++++++++++++++----- lfs/pmacct | 4 ++-- src/paks/pmacct/install.sh | 12 ++++++++++-- 3 files changed, 32 insertions(+), 9 deletions(-) diff --git a/config/pmacct/pmacct.conf b/config/pmacct/pmacct.conf index 3c1d47efa..79e3fd6a7 100644 --- a/config/pmacct/pmacct.conf +++ b/config/pmacct/pmacct.conf @@ -2,23 +2,38 @@ ! Pmacctd configuration file for IPFire environment ! +!----------------------------------- global ----------------------------------- + syslog: daemon daemonize: true debug: false promisc: true -interface: green0 +pcap_interface: green0 + +imt_mem_pools_number: 256 +plugins: memory[plugin1] # , sqlite3[plugin2] + + +!----------------------------------- memory ----------------------------------- ! ! "plugin1" plugin configuration ! -plugins: memory[plugin1] plugin_buffer_size[plugin1]: 102400 -plugin_pipe_size[plugin1]: 10240000 +plugin_pipe_size[plugin1]: 10240000 -imt_mem_pools_number: 256 imt_path[plugin1]: /var/spool/pmacct/plugin1.pipe aggregate[plugin1]: src_host, src_port, src_mac, dst_host, dst_port, dst_mac, proto -aggregate_filter[plugin1]: ip \ No newline at end of file +aggregate_filter[plugin1]: ip + + +!----------------------------------- sqlite3 ---------------------------------- + +! +! "plugin2" plugin configuration +! + +! add your sqlite3 plugin2 here... diff --git a/lfs/pmacct b/lfs/pmacct index 7c8b32772..4be1be156 100644 --- a/lfs/pmacct +++ b/lfs/pmacct @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2019-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2019-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = pmacct -PAK_VER = 5 +PAK_VER = 6 DEPS = libcdada diff --git a/src/paks/pmacct/install.sh b/src/paks/pmacct/install.sh index 11b16f6c1..abf8ce37e 100755 --- a/src/paks/pmacct/install.sh +++ b/src/paks/pmacct/install.sh @@ -17,7 +17,7 @@ # along with IPFire; if not, write to the Free Software # # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # # # -# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# Copyright (C) 2007-2023 IPFire-Team <info(a)ipfire.org>. # # # ############################################################################ # @@ -26,11 +26,19 @@ extract_files restore_backup ${NAME} +# update needed for a change in config file +# temporary update added for CU 177 +CONFIG="/etc/pmacct/pmacct.conf" +if grep -q "^interface" "${CONFIG}" ; then + if sed -i.bak 's|^interface|pcap_interface|g' "${CONFIG}" ; then + logger -t pmacct "updated ${CONFIG} and changed \"interface\" to \"pcap_interface\"" + fi +fi + # Add symlinks for runlevels ln -s ../init.d/${NAME} /etc/rc.d/rc0.d/K85${NAME} ln -s ../init.d/${NAME} /etc/rc.d/rc3.d/S50${NAME} ln -s ../init.d/${NAME} /etc/rc.d/rc6.d/K85${NAME} start_service ${NAME} - # EOF -- 2.30.2

1 0

[PATCH] pmacct: fix bug 13159
by Jon Murphy 06 Jul '23

06 Jul '23

- changes `interface` to `pcap_interface` in pmacct.conf file. - thank you to @iptom for finding and reporting the issue - thank you to many others for pitching in and helping debug! Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/pmacct/pmacct.conf | 25 ++++++++++++++++++++----- lfs/pmacct | 4 ++-- src/paks/pmacct/install.sh | 12 ++++++++++-- 3 files changed, 32 insertions(+), 9 deletions(-) diff --git a/config/pmacct/pmacct.conf b/config/pmacct/pmacct.conf index 3c1d47efa..79e3fd6a7 100644 --- a/config/pmacct/pmacct.conf +++ b/config/pmacct/pmacct.conf @@ -2,23 +2,38 @@ ! Pmacctd configuration file for IPFire environment ! +!----------------------------------- global ----------------------------------- + syslog: daemon daemonize: true debug: false promisc: true -interface: green0 +pcap_interface: green0 + +imt_mem_pools_number: 256 +plugins: memory[plugin1] # , sqlite3[plugin2] + + +!----------------------------------- memory ----------------------------------- ! ! "plugin1" plugin configuration ! -plugins: memory[plugin1] plugin_buffer_size[plugin1]: 102400 -plugin_pipe_size[plugin1]: 10240000 +plugin_pipe_size[plugin1]: 10240000 -imt_mem_pools_number: 256 imt_path[plugin1]: /var/spool/pmacct/plugin1.pipe aggregate[plugin1]: src_host, src_port, src_mac, dst_host, dst_port, dst_mac, proto -aggregate_filter[plugin1]: ip \ No newline at end of file +aggregate_filter[plugin1]: ip + + +!----------------------------------- sqlite3 ---------------------------------- + +! +! "plugin2" plugin configuration +! + +! add your sqlite3 plugin2 here... diff --git a/lfs/pmacct b/lfs/pmacct index 7c8b32772..4be1be156 100644 --- a/lfs/pmacct +++ b/lfs/pmacct @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2019-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2019-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = pmacct -PAK_VER = 5 +PAK_VER = 6 DEPS = libcdada diff --git a/src/paks/pmacct/install.sh b/src/paks/pmacct/install.sh index 11b16f6c1..160c7eff6 100755 --- a/src/paks/pmacct/install.sh +++ b/src/paks/pmacct/install.sh @@ -17,7 +17,7 @@ # along with IPFire; if not, write to the Free Software # # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # # # -# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# Copyright (C) 2007-2023 IPFire-Team <info(a)ipfire.org>. # # # ############################################################################ # @@ -26,11 +26,19 @@ extract_files restore_backup ${NAME} +# update needed for a change in config file +# temporary update added for CU 177 +CONFIG="/etc/pmacct/pmacct.conf" +if grep -q "^interface" "${CONFIG}" ; then + if sed -i .bak 's|^interface|pcap_interface|g' "${CONFIG}" ; then + logger -t pmacct "updated ${CONFIG} and changed \"interface\" to \"pcap_interface\"" + fi +fi + # Add symlinks for runlevels ln -s ../init.d/${NAME} /etc/rc.d/rc0.d/K85${NAME} ln -s ../init.d/${NAME} /etc/rc.d/rc3.d/S50${NAME} ln -s ../init.d/${NAME} /etc/rc.d/rc6.d/K85${NAME} start_service ${NAME} - # EOF -- 2.30.2

2 1

[PATCH] kernel: update to 6.1.37
by Arne Fitzenreiter 06 Jul '23

06 Jul '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 9 +++--- config/kernel/kernel.config.x86_64-ipfire | 12 +++---- config/rootfiles/common/aarch64/linux | 37 ++++++++++++---------- config/rootfiles/common/x86_64/linux | 37 ++++++++++++---------- lfs/linux | 4 +-- 5 files changed, 55 insertions(+), 44 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 2261c22dc..a2c852654 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,10 +1,10 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.30-ipfire Kernel Configuration +# Linux/arm64 6.1.37-ipfire Kernel Configuration # -CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.2.0" +CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=120200 +CONFIG_GCC_VERSION=130100 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y CONFIG_AS_VERSION=24000 @@ -954,6 +954,7 @@ CONFIG_MAPPING_DIRTY_HELPERS=y # CONFIG_ANON_VMA_NAME is not set # CONFIG_USERFAULTFD is not set # CONFIG_LRU_GEN is not set +CONFIG_LOCK_MM_AND_FIND_VMA=y # # Data Access Monitoring @@ -7835,7 +7836,7 @@ CONFIG_CIFS_FSCACHE=y CONFIG_SMB_SERVER=m CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=y CONFIG_SMB_SERVER_KERBEROS5=y -CONFIG_SMBFS_COMMON=m +CONFIG_SMBFS=m # CONFIG_CODA_FS is not set # CONFIG_AFS_FS is not set CONFIG_NLS=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 121d1cda9..0017a6f54 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,10 +1,10 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.30-ipfire Kernel Configuration +# Linux/x86 6.1.37-ipfire Kernel Configuration # -CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.2.0" +CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=120200 +CONFIG_GCC_VERSION=130100 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y CONFIG_AS_VERSION=24000 @@ -996,6 +996,7 @@ CONFIG_MAPPING_DIRTY_HELPERS=y # CONFIG_ANON_VMA_NAME is not set # CONFIG_USERFAULTFD is not set # CONFIG_LRU_GEN is not set +CONFIG_LOCK_MM_AND_FIND_VMA=y # # Data Access Monitoring @@ -6523,9 +6524,8 @@ CONFIG_AMILO_RFKILL=m CONFIG_FUJITSU_LAPTOP=m # CONFIG_FUJITSU_TABLET is not set # CONFIG_GPD_POCKET_FAN is not set -# CONFIG_HP_ACCEL is not set +# CONFIG_X86_PLATFORM_DRIVERS_HP is not set # CONFIG_WIRELESS_HOTKEY is not set -CONFIG_HP_WMI=m # CONFIG_IBM_RTL is not set CONFIG_IDEAPAD_LAPTOP=m CONFIG_SENSORS_HDAPS=m @@ -7047,7 +7047,7 @@ CONFIG_CIFS_FSCACHE=y CONFIG_SMB_SERVER=m CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=y CONFIG_SMB_SERVER_KERBEROS5=y -CONFIG_SMBFS_COMMON=m +CONFIG_SMBFS=m # CONFIG_CODA_FS is not set # CONFIG_AFS_FS is not set CONFIG_NLS=y diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 243eb8d46..49bbc7c57 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -6277,9 +6277,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/fs/ceph #lib/modules/KVER-ipfire/build/fs/ceph/Kconfig #lib/modules/KVER-ipfire/build/fs/ceph/Makefile -#lib/modules/KVER-ipfire/build/fs/cifs -#lib/modules/KVER-ipfire/build/fs/cifs/Kconfig -#lib/modules/KVER-ipfire/build/fs/cifs/Makefile #lib/modules/KVER-ipfire/build/fs/coda #lib/modules/KVER-ipfire/build/fs/coda/Kconfig #lib/modules/KVER-ipfire/build/fs/coda/Makefile @@ -6370,9 +6367,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/fs/kernfs #lib/modules/KVER-ipfire/build/fs/kernfs/Kconfig #lib/modules/KVER-ipfire/build/fs/kernfs/Makefile -#lib/modules/KVER-ipfire/build/fs/ksmbd -#lib/modules/KVER-ipfire/build/fs/ksmbd/Kconfig -#lib/modules/KVER-ipfire/build/fs/ksmbd/Makefile #lib/modules/KVER-ipfire/build/fs/lockd #lib/modules/KVER-ipfire/build/fs/lockd/Makefile #lib/modules/KVER-ipfire/build/fs/minix @@ -6462,8 +6456,17 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/fs/romfs #lib/modules/KVER-ipfire/build/fs/romfs/Kconfig #lib/modules/KVER-ipfire/build/fs/romfs/Makefile -#lib/modules/KVER-ipfire/build/fs/smbfs_common -#lib/modules/KVER-ipfire/build/fs/smbfs_common/Makefile +#lib/modules/KVER-ipfire/build/fs/smb +#lib/modules/KVER-ipfire/build/fs/smb/Kconfig +#lib/modules/KVER-ipfire/build/fs/smb/Makefile +#lib/modules/KVER-ipfire/build/fs/smb/client +#lib/modules/KVER-ipfire/build/fs/smb/client/Kconfig +#lib/modules/KVER-ipfire/build/fs/smb/client/Makefile +#lib/modules/KVER-ipfire/build/fs/smb/common +#lib/modules/KVER-ipfire/build/fs/smb/common/Makefile +#lib/modules/KVER-ipfire/build/fs/smb/server +#lib/modules/KVER-ipfire/build/fs/smb/server/Kconfig +#lib/modules/KVER-ipfire/build/fs/smb/server/Makefile #lib/modules/KVER-ipfire/build/fs/squashfs #lib/modules/KVER-ipfire/build/fs/squashfs/Kconfig #lib/modules/KVER-ipfire/build/fs/squashfs/Makefile @@ -8796,6 +8799,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/LOCKD_V4 #lib/modules/KVER-ipfire/build/include/config/LOCK_DEBUGGING_SUPPORT #lib/modules/KVER-ipfire/build/include/config/LOCK_DOWN_KERNEL_FORCE_NONE +#lib/modules/KVER-ipfire/build/include/config/LOCK_MM_AND_FIND_VMA #lib/modules/KVER-ipfire/build/include/config/LOCK_SPIN_ON_OWNER #lib/modules/KVER-ipfire/build/include/config/LOGO #lib/modules/KVER-ipfire/build/include/config/LOGO_LINUX_CLUT224 @@ -10429,7 +10433,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/SLICOSS #lib/modules/KVER-ipfire/build/include/config/SLUB #lib/modules/KVER-ipfire/build/include/config/SLUB_CPU_PARTIAL -#lib/modules/KVER-ipfire/build/include/config/SMBFS_COMMON +#lib/modules/KVER-ipfire/build/include/config/SMBFS #lib/modules/KVER-ipfire/build/include/config/SMB_SERVER #lib/modules/KVER-ipfire/build/include/config/SMB_SERVER_CHECK_CAP_NET_ADMIN #lib/modules/KVER-ipfire/build/include/config/SMB_SERVER_KERBEROS5 @@ -21694,8 +21698,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/fs/btrfs/btrfs.ko.xz #lib/modules/KVER-ipfire/kernel/fs/cachefiles #lib/modules/KVER-ipfire/kernel/fs/cachefiles/cachefiles.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/cifs -#lib/modules/KVER-ipfire/kernel/fs/cifs/cifs.ko.xz #lib/modules/KVER-ipfire/kernel/fs/configfs #lib/modules/KVER-ipfire/kernel/fs/configfs/configfs.ko.xz #lib/modules/KVER-ipfire/kernel/fs/efivarfs @@ -21711,8 +21713,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/fs/fuse #lib/modules/KVER-ipfire/kernel/fs/fuse/cuse.ko.xz #lib/modules/KVER-ipfire/kernel/fs/fuse/fuse.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/ksmbd -#lib/modules/KVER-ipfire/kernel/fs/ksmbd/ksmbd.ko.xz #lib/modules/KVER-ipfire/kernel/fs/lockd #lib/modules/KVER-ipfire/kernel/fs/lockd/lockd.ko.xz #lib/modules/KVER-ipfire/kernel/fs/netfs @@ -21787,9 +21787,14 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/fs/ntfs3/ntfs3.ko.xz #lib/modules/KVER-ipfire/kernel/fs/reiserfs #lib/modules/KVER-ipfire/kernel/fs/reiserfs/reiserfs.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/smbfs_common -#lib/modules/KVER-ipfire/kernel/fs/smbfs_common/cifs_arc4.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/smbfs_common/cifs_md4.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb +#lib/modules/KVER-ipfire/kernel/fs/smb/client +#lib/modules/KVER-ipfire/kernel/fs/smb/client/cifs.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb/common +#lib/modules/KVER-ipfire/kernel/fs/smb/common/cifs_arc4.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb/common/cifs_md4.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb/server +#lib/modules/KVER-ipfire/kernel/fs/smb/server/ksmbd.ko.xz #lib/modules/KVER-ipfire/kernel/fs/udf #lib/modules/KVER-ipfire/kernel/fs/udf/udf.ko.xz #lib/modules/KVER-ipfire/kernel/fs/xfs diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index f5e7ced10..2da7da282 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -6112,9 +6112,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/fs/ceph #lib/modules/KVER-ipfire/build/fs/ceph/Kconfig #lib/modules/KVER-ipfire/build/fs/ceph/Makefile -#lib/modules/KVER-ipfire/build/fs/cifs -#lib/modules/KVER-ipfire/build/fs/cifs/Kconfig -#lib/modules/KVER-ipfire/build/fs/cifs/Makefile #lib/modules/KVER-ipfire/build/fs/coda #lib/modules/KVER-ipfire/build/fs/coda/Kconfig #lib/modules/KVER-ipfire/build/fs/coda/Makefile @@ -6205,9 +6202,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/fs/kernfs #lib/modules/KVER-ipfire/build/fs/kernfs/Kconfig #lib/modules/KVER-ipfire/build/fs/kernfs/Makefile -#lib/modules/KVER-ipfire/build/fs/ksmbd -#lib/modules/KVER-ipfire/build/fs/ksmbd/Kconfig -#lib/modules/KVER-ipfire/build/fs/ksmbd/Makefile #lib/modules/KVER-ipfire/build/fs/lockd #lib/modules/KVER-ipfire/build/fs/lockd/Makefile #lib/modules/KVER-ipfire/build/fs/minix @@ -6297,8 +6291,17 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/fs/romfs #lib/modules/KVER-ipfire/build/fs/romfs/Kconfig #lib/modules/KVER-ipfire/build/fs/romfs/Makefile -#lib/modules/KVER-ipfire/build/fs/smbfs_common -#lib/modules/KVER-ipfire/build/fs/smbfs_common/Makefile +#lib/modules/KVER-ipfire/build/fs/smb +#lib/modules/KVER-ipfire/build/fs/smb/Kconfig +#lib/modules/KVER-ipfire/build/fs/smb/Makefile +#lib/modules/KVER-ipfire/build/fs/smb/client +#lib/modules/KVER-ipfire/build/fs/smb/client/Kconfig +#lib/modules/KVER-ipfire/build/fs/smb/client/Makefile +#lib/modules/KVER-ipfire/build/fs/smb/common +#lib/modules/KVER-ipfire/build/fs/smb/common/Makefile +#lib/modules/KVER-ipfire/build/fs/smb/server +#lib/modules/KVER-ipfire/build/fs/smb/server/Kconfig +#lib/modules/KVER-ipfire/build/fs/smb/server/Makefile #lib/modules/KVER-ipfire/build/fs/squashfs #lib/modules/KVER-ipfire/build/fs/squashfs/Kconfig #lib/modules/KVER-ipfire/build/fs/squashfs/Makefile @@ -8671,6 +8674,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/LOCKUP_DETECTOR #lib/modules/KVER-ipfire/build/include/config/LOCK_DEBUGGING_SUPPORT #lib/modules/KVER-ipfire/build/include/config/LOCK_DOWN_KERNEL_FORCE_NONE +#lib/modules/KVER-ipfire/build/include/config/LOCK_MM_AND_FIND_VMA #lib/modules/KVER-ipfire/build/include/config/LOCK_SPIN_ON_OWNER #lib/modules/KVER-ipfire/build/include/config/LOGO #lib/modules/KVER-ipfire/build/include/config/LOGO_LINUX_CLUT224 @@ -10406,7 +10410,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/SLS #lib/modules/KVER-ipfire/build/include/config/SLUB #lib/modules/KVER-ipfire/build/include/config/SLUB_CPU_PARTIAL -#lib/modules/KVER-ipfire/build/include/config/SMBFS_COMMON +#lib/modules/KVER-ipfire/build/include/config/SMBFS #lib/modules/KVER-ipfire/build/include/config/SMB_SERVER #lib/modules/KVER-ipfire/build/include/config/SMB_SERVER_CHECK_CAP_NET_ADMIN #lib/modules/KVER-ipfire/build/include/config/SMB_SERVER_KERBEROS5 @@ -22267,8 +22271,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/fs/btrfs/btrfs.ko.xz #lib/modules/KVER-ipfire/kernel/fs/cachefiles #lib/modules/KVER-ipfire/kernel/fs/cachefiles/cachefiles.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/cifs -#lib/modules/KVER-ipfire/kernel/fs/cifs/cifs.ko.xz #lib/modules/KVER-ipfire/kernel/fs/configfs #lib/modules/KVER-ipfire/kernel/fs/configfs/configfs.ko.xz #lib/modules/KVER-ipfire/kernel/fs/dlm @@ -22286,8 +22288,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/fs/fuse #lib/modules/KVER-ipfire/kernel/fs/fuse/cuse.ko.xz #lib/modules/KVER-ipfire/kernel/fs/fuse/fuse.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/ksmbd -#lib/modules/KVER-ipfire/kernel/fs/ksmbd/ksmbd.ko.xz #lib/modules/KVER-ipfire/kernel/fs/lockd #lib/modules/KVER-ipfire/kernel/fs/lockd/lockd.ko.xz #lib/modules/KVER-ipfire/kernel/fs/netfs @@ -22362,9 +22362,14 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/fs/ntfs3/ntfs3.ko.xz #lib/modules/KVER-ipfire/kernel/fs/reiserfs #lib/modules/KVER-ipfire/kernel/fs/reiserfs/reiserfs.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/smbfs_common -#lib/modules/KVER-ipfire/kernel/fs/smbfs_common/cifs_arc4.ko.xz -#lib/modules/KVER-ipfire/kernel/fs/smbfs_common/cifs_md4.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb +#lib/modules/KVER-ipfire/kernel/fs/smb/client +#lib/modules/KVER-ipfire/kernel/fs/smb/client/cifs.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb/common +#lib/modules/KVER-ipfire/kernel/fs/smb/common/cifs_arc4.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb/common/cifs_md4.ko.xz +#lib/modules/KVER-ipfire/kernel/fs/smb/server +#lib/modules/KVER-ipfire/kernel/fs/smb/server/ksmbd.ko.xz #lib/modules/KVER-ipfire/kernel/fs/udf #lib/modules/KVER-ipfire/kernel/fs/udf/udf.ko.xz #lib/modules/KVER-ipfire/kernel/fs/xfs diff --git a/lfs/linux b/lfs/linux index b30a28fff..87442185a 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 6.1.30 +VER = 6.1.37 ARM_PATCHES = 6.1.y-ipfire2 @@ -76,7 +76,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = d3c4cda0bbd978ad7e39a44e03789f38b7a48a92405312f90fd944a670ca438e1dd212af2b075820896b25405027be92071dbd24455331de742aa5c9f2ac3407 +$(DL_FILE)_BLAKE2 = 9ea4b47123c21b658923f46d3f7d6b911f49e8616f038feefef860b3bb8756b2cbd0b097640b18333d79951b99c37dc32c1a4357263ff69641580c4d3ab4bc56 arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 7afc460562fb24bcd75784fc79de768f9b60780aedd88d1a847927169e31920bbb475b1ac1466c4a224a7876d16bd8d465b96202de12b74f6e2ccbfcec731ad3 install : $(TARGET) -- 2.38.1

2 1

[PATCH] iproute2: Update to version 6.4.0
by Adolf Belka 03 Jul '23

03 Jul '23

- Update from version 6.3.0 to 6.4.0 - Update of rootfile not required - Changelog can only be reviewed by looking at the commits in the git repo https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/ Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/iproute2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/iproute2 b/lfs/iproute2 index c773291f3..cfdb474cb 100644 --- a/lfs/iproute2 +++ b/lfs/iproute2 @@ -24,7 +24,7 @@ include Config -VER = 6.3.0 +VER = 6.4.0 THISAPP = iproute2-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a7b48c59c8a30f56ca810136f4d9f681fe38359999c260227a6229b972ce70b233d2865a6543cf3f70ed586825f9191c22d459a9fc5cc8c7dbf3ab417064c8a7 +$(DL_FILE)_BLAKE2 = 76369d2a794afd13dba1a34ee9a7425775bb7b43c22164274749c01b18d061669aa5abd51d32a15d68f48e75f4837a887dfc28ea41e34d8e4c36b2ab865628dd install : $(TARGET) -- 2.41.0

3 6

[PATCH] ppp: Fixes bug#13164 - Update to version 2.5.0
by Adolf Belka 03 Jul '23

03 Jul '23

- Update from version 2.4.9 to 2.5.0 This includes breaking changes for third-party plugins but as far as I can see IPFire is not using any third party plugins - Update of rootfile - Update of patches and sed commands - pcap-int.h and if_pppol2tp.h files have not been in source file since at least 2014 - Some of the patches required updates as additional lines needing to be patched are now present. nThis was related to the O_CLOEXEC & SOCK_CLOEXEC related patches - connect-errors file location is now defined by a configure command --with-logfile-dir - install-etcppp is no longer provided. However the install command in this version still has the same files available in /etc/ppp as previously. There is a new file, openssl.cnf, which I have commented out. If it is required in future it can always be uncommented in future releases. - Build went without any problems with the updated patches. - I cannot test this as I don't use ppp, however the original bug reporter has agreed to test this out when it is released into Testing unless anyone else is capable of testing it. - Changelog What's new in ppp-2.5.0. The 2.5.0 release is a major release of pppd which contains breaking changes for third-party plugins, a complete revamp of the build-system and that allows for flexibility of configuring features as needed. In Summary: * Support for PEAP authentication by Eivind Næss and Rustam Kovhaev * Support for loading PKCS12 certificate envelopes * Adoption of GNU Autoconf / Automake build environment, by Eivind Næss and others. * Support for pkgconfig tool has been added by Eivind Næss. * Bunch of fixes and cleanup to PPPoE and IPv6 support by Pali Rohár. * Major revision to PPPD's Plugin API by Eivind Næss. - Defines in which describes what features was included in pppd - Functions now prefixed with explicit ppp_* to indicate that pppd functions being called. - Header files were renamed to better align with their features, and now use proper include guards - A pppdconf.h file is supplied to allow third-party modules to use the same feature defines pppd was compiled with. - No extern declarations of internal variable names of pppd, continued use of these extern variables are considered unstable. * Lots of internal fixes and cleanups for Radius and PPPoE by Jaco Kroon * Dropped IPX support, as Linux has dropped support in version 5.15 for this protocol. * Many more fixes and cleanups. * Pppd is no longer installed setuid-root. * New pppd options: - ipv6cp-noremote, ipv6cp-nosend, ipv6cp-use-remotenumber, ipv6-up-script, ipv6-down-script - -v, show-options - usepeerwins, ipcp-no-address, ipcp-no-addresses, nosendip * On Linux, any baud rate can be set on a serial port provided the kernel serial driver supports that. Note that if you have built and installed previous versions of this package and you want to continue having configuration and TDB files in /etc/ppp, you will need to use the --sysconfdir option to ./configure. For a list of the changes made during the 2.4 series releases of this package, see the Changes-2.4 file. Compression methods. This package supports two packet compression methods: Deflate and BSD-Compress. Other compression methods which are in common use include Predictor, LZS, and MPPC. These methods are not supported for two reasons - they are patent-encumbered, and they cause some packets to expand slightly, which pppd doesn't currently allow for. BSD-Compress and Deflate (which uses the same algorithm as gzip) don't ever expand packets. Fixes: bug#13164 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/ppp | 58 +++--- lfs/ppp | 28 +-- ...se-SOCK_CLOEXEC-when-creating-socket.patch | 165 ------------------ ...ppp-2.4.6-increase-max-padi-attempts.patch | 13 -- src/patches/ppp/ppp-2.4.7-headers_4.9.patch | 12 -- ...-configure-to-handle-cflags-properly.patch | 15 -- ...don-t-want-to-accidentally-leak-fds.patch} | 115 +++++++----- ...2.5.0-2-everywhere-O_CLOEXEC-harder.patch} | 136 ++++++--------- ...se-SOCK_CLOEXEC-when-creating-socket.patch | 135 ++++++++++++++ ...p-2.5.0-4-increase-max-padi-attempts.patch | 12 ++ src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch | 12 ++ ...-configure-to-handle-cflags-properly.patch | 18 ++ 12 files changed, 344 insertions(+), 375 deletions(-) delete mode 100644 src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch delete mode 100644 src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch delete mode 100644 src/patches/ppp/ppp-2.4.7-headers_4.9.patch delete mode 100644 src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch rename src/patches/ppp/{0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch => ppp-2.5.0-1-we-don-t-want-to-accidentally-leak-fds.patch} (54%) rename src/patches/ppp/{0013-everywhere-O_CLOEXEC-harder.patch => ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch} (63%) create mode 100644 src/patches/ppp/ppp-2.5.0-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch create mode 100644 src/patches/ppp/ppp-2.5.0-4-increase-max-padi-attempts.patch create mode 100644 src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch create mode 100644 src/patches/ppp/ppp-2.5.0-6-patch-configure-to-handle-cflags-properly.patch diff --git a/config/rootfiles/common/ppp b/config/rootfiles/common/ppp index d61fdf811..6098fa7c3 100644 --- a/config/rootfiles/common/ppp +++ b/config/rootfiles/common/ppp @@ -7,49 +7,57 @@ etc/ppp/dialer etc/ppp/ioptions etc/ppp/ip-down etc/ppp/ip-up +#etc/ppp/openssl.cnf etc/ppp/options etc/ppp/pap-secrets etc/ppp/standardloginscript #usr/include/pppd +#usr/include/pppd/cbcp.h #usr/include/pppd/ccp.h -#usr/include/pppd/chap-new.h +#usr/include/pppd/chap.h #usr/include/pppd/chap_ms.h -#usr/include/pppd/eap-tls.h +#usr/include/pppd/crypto.h +#usr/include/pppd/crypto_ms.h #usr/include/pppd/eap.h #usr/include/pppd/ecp.h #usr/include/pppd/eui64.h #usr/include/pppd/fsm.h #usr/include/pppd/ipcp.h #usr/include/pppd/ipv6cp.h -#usr/include/pppd/ipxcp.h #usr/include/pppd/lcp.h #usr/include/pppd/magic.h -#usr/include/pppd/md4.h -#usr/include/pppd/md5.h #usr/include/pppd/mppe.h -#usr/include/pppd/patchlevel.h -#usr/include/pppd/pathnames.h -#usr/include/pppd/pppcrypt.h +#usr/include/pppd/multilink.h +#usr/include/pppd/options.h #usr/include/pppd/pppd.h +#usr/include/pppd/pppdconf.h #usr/include/pppd/session.h -#usr/include/pppd/sha1.h -#usr/include/pppd/spinlock.h -#usr/include/pppd/tdb.h #usr/include/pppd/upap.h +#usr/lib/pkgconfig/pppd.pc usr/lib/pppd -usr/lib/pppd/2.4.9 -usr/lib/pppd/2.4.9/minconn.so -usr/lib/pppd/2.4.9/openl2tp.so -usr/lib/pppd/2.4.9/passprompt.so -usr/lib/pppd/2.4.9/passwordfd.so -usr/lib/pppd/2.4.9/pppoatm.so -usr/lib/pppd/2.4.9/pppoe.so -usr/lib/pppd/2.4.9/pppol2tp.so -usr/lib/pppd/2.4.9/radattr.so -usr/lib/pppd/2.4.9/radius.so -usr/lib/pppd/2.4.9/radrealms.so -usr/lib/pppd/2.4.9/rp-pppoe.so -usr/lib/pppd/2.4.9/winbind.so +usr/lib/pppd/2.5.0 +#usr/lib/pppd/2.5.0/minconn.la +usr/lib/pppd/2.5.0/minconn.so +#usr/lib/pppd/2.5.0/openl2tp.la +usr/lib/pppd/2.5.0/openl2tp.so +#usr/lib/pppd/2.5.0/passprompt.la +usr/lib/pppd/2.5.0/passprompt.so +#usr/lib/pppd/2.5.0/passwordfd.la +usr/lib/pppd/2.5.0/passwordfd.so +#usr/lib/pppd/2.5.0/pppoatm.la +usr/lib/pppd/2.5.0/pppoatm.so +#usr/lib/pppd/2.5.0/pppoe.la +usr/lib/pppd/2.5.0/pppoe.so +#usr/lib/pppd/2.5.0/pppol2tp.la +usr/lib/pppd/2.5.0/pppol2tp.so +#usr/lib/pppd/2.5.0/radattr.la +usr/lib/pppd/2.5.0/radattr.so +#usr/lib/pppd/2.5.0/radius.la +usr/lib/pppd/2.5.0/radius.so +#usr/lib/pppd/2.5.0/radrealms.la +usr/lib/pppd/2.5.0/radrealms.so +#usr/lib/pppd/2.5.0/winbind.la +usr/lib/pppd/2.5.0/winbind.so usr/sbin/chat usr/sbin/pppd usr/sbin/pppdump @@ -60,5 +68,7 @@ usr/sbin/pppstats #usr/share/man/man8/pppd-radius.8 #usr/share/man/man8/pppd.8 #usr/share/man/man8/pppdump.8 +#usr/share/man/man8/pppoe-discovery.8 #usr/share/man/man8/pppstats.8 var/log/connect-errors + diff --git a/lfs/ppp b/lfs/ppp index fb46d8aac..fc4528ece 100644 --- a/lfs/ppp +++ b/lfs/ppp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.4.9 +VER = 2.5.0 THISAPP = ppp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 2cc885c32b7d33dc48766097f1f4c9cd0754924a8c0630ccaa58b2989e6b43a197ca0d41f5f16956c395278a12023d490e085f5635e23b53c5603ba61cfc40d5 +$(DL_FILE)_BLAKE2 = 6a0e9efcbff3cb499705071cc7d0e3411cf4871fd53b2bfedbb1f2cf3ad80728eb436050cf33b78e36d473be64f15907a21da17f283337455f0af379bc18272d install : $(TARGET) @@ -72,18 +72,20 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && rm -f include/pcap-int.h include/linux/if_pppol2tp.h - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.4.7-headers_4.9.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch - cd $(DIR_APP) && sed -i -e "s+/etc/ppp/connect-errors+/var/log/connect-errors+" pppd/pathnames.h - cd $(DIR_APP) && ./configure --prefix=/usr --cc="gcc" --cflags="$(CFLAGS)" --disable-nls + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-1-we-don-t-want-to-accidentally-leak-fds.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-4-increase-max-padi-attempts.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-6-patch-configure-to-handle-cflags-properly.patch + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --sysconfdir=/etc \ + --with-logfile-dir=/var/log \ + cc="gcc" \ + cflags="$(CFLAGS)" cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install - cd $(DIR_APP) && make install-etcppp touch /var/log/connect-errors -mkdir -p /etc/ppp for i in $(DIR_SRC)/src/ppp/* ; do \ diff --git a/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch deleted file mode 100644 index fffda981d..000000000 --- a/src/patches/ppp/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +++ /dev/null @@ -1,165 +0,0 @@ -From 2a97ab28ee00586e5f06b3ef3a0e43ea0c7c6499 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar <msekleta(a)redhat.com> -Date: Mon, 7 Apr 2014 14:21:41 +0200 -Subject: [PATCH 14/25] everywhere: use SOCK_CLOEXEC when creating socket - ---- - pppd/plugins/pppoatm/pppoatm.c | 2 +- - pppd/plugins/pppol2tp/openl2tp.c | 2 +- - pppd/plugins/pppol2tp/pppol2tp.c | 2 +- - pppd/plugins/pppoe/if.c | 2 +- - pppd/plugins/pppoe/plugin.c | 6 +++--- - pppd/plugins/pppoe/pppoe-discovery.c | 2 +- - pppd/sys-linux.c | 10 +++++----- - pppd/tty.c | 2 +- - 8 files changed, 14 insertions(+), 14 deletions(-) - -diff --git a/pppd/plugins/pppoatm/pppoatm.c b/pppd/plugins/pppoatm/pppoatm.c -index d693350..c31bb34 100644 ---- a/pppd/plugins/pppoatm/pppoatm.c -+++ b/pppd/plugins/pppoatm/pppoatm.c -@@ -135,7 +135,7 @@ static int connect_pppoatm(void) - - if (!device_got_set) - no_device_given_pppoatm(); -- fd = socket(AF_ATMPVC, SOCK_DGRAM, 0); -+ fd = socket(AF_ATMPVC, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (fd < 0) - fatal("failed to create socket: %m"); - memset(&qos, 0, sizeof qos); -diff --git a/pppd/plugins/pppol2tp/openl2tp.c b/pppd/plugins/pppol2tp/openl2tp.c -index 9643b96..1099575 100644 ---- a/pppd/plugins/pppol2tp/openl2tp.c -+++ b/pppd/plugins/pppol2tp/openl2tp.c -@@ -83,7 +83,7 @@ static int openl2tp_client_create(void) - int result; - - if (openl2tp_fd < 0) { -- openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM, 0); -+ openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (openl2tp_fd < 0) { - error("openl2tp connection create: %m"); - return -ENOTCONN; -diff --git a/pppd/plugins/pppol2tp/pppol2tp.c b/pppd/plugins/pppol2tp/pppol2tp.c -index a7e3400..e64a778 100644 ---- a/pppd/plugins/pppol2tp/pppol2tp.c -+++ b/pppd/plugins/pppol2tp/pppol2tp.c -@@ -208,7 +208,7 @@ static void send_config_pppol2tp(int mtu, - struct ifreq ifr; - int fd; - -- fd = socket(AF_INET, SOCK_DGRAM, 0); -+ fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (fd >= 0) { - memset (&ifr, '\0', sizeof (ifr)); - strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -diff --git a/pppd/plugins/pppoe/if.c b/pppd/plugins/pppoe/if.c -index 91e9a57..72aba41 100644 ---- a/pppd/plugins/pppoe/if.c -+++ b/pppd/plugins/pppoe/if.c -@@ -116,7 +116,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - stype = SOCK_PACKET; - #endif - -- if ((fd = socket(domain, stype, htons(type))) < 0) { -+ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { - /* Give a more helpful message for the common error case */ - if (errno == EPERM) { - fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/plugins/pppoe/plugin.c b/pppd/plugins/pppoe/plugin.c -index a8c2bb4..24bdf8f 100644 ---- a/pppd/plugins/pppoe/plugin.c -+++ b/pppd/plugins/pppoe/plugin.c -@@ -137,7 +137,7 @@ PPPOEConnectDevice(void) - /* server equipment). */ - /* Opening this socket just before waitForPADS in the discovery() */ - /* function would be more appropriate, but it would mess-up the code */ -- conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM, PX_PROTO_OE); -+ conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM | SOCK_CLOEXEC, PX_PROTO_OE); - if (conn->sessionSocket < 0) { - error("Failed to create PPPoE socket: %m"); - return -1; -@@ -148,7 +148,7 @@ PPPOEConnectDevice(void) - lcp_wantoptions[0].mru = conn->mru; - - /* Update maximum MRU */ -- s = socket(AF_INET, SOCK_DGRAM, 0); -+ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (s < 0) { - error("Can't get MTU for %s: %m", conn->ifName); - goto errout; -@@ -320,7 +320,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) - } - - /* Open a socket */ -- if ((fd = socket(PF_PACKET, SOCK_RAW, 0)) < 0) { -+ if ((fd = socket(PF_PACKET, SOCK_RAW | SOCK_CLOEXEC, 0)) < 0) { - r = 0; - } - -diff --git a/pppd/plugins/pppoe/pppoe-discovery.c b/pppd/plugins/pppoe/pppoe-discovery.c -index 3d3bf4e..c0d927d 100644 ---- a/pppd/plugins/pppoe/pppoe-discovery.c -+++ b/pppd/plugins/pppoe/pppoe-discovery.c -@@ -121,7 +121,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - stype = SOCK_PACKET; - #endif - -- if ((fd = socket(domain, stype, htons(type))) < 0) { -+ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { - /* Give a more helpful message for the common error case */ - if (errno == EPERM) { - rp_fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 00a2cf5..0690019 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -308,12 +308,12 @@ static int modify_flags(int fd, int clear_bits, int set_bits) - void sys_init(void) - { - /* Get an internet socket for doing socket ioctls. */ -- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); -+ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock_fd < 0) - fatal("Couldn't create IP socket: %m(%d)", errno); - - #ifdef INET6 -- sock6_fd = socket(AF_INET6, SOCK_DGRAM, 0); -+ sock6_fd = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock6_fd < 0) - sock6_fd = -errno; /* save errno for later */ - #endif -@@ -1857,7 +1857,7 @@ get_if_hwaddr(u_char *addr, char *name) - struct ifreq ifreq; - int ret, sock_fd; - -- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); -+ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock_fd < 0) - return 0; - memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); -@@ -2067,7 +2067,7 @@ int ppp_available(void) - /* - * Open a socket for doing the ioctl operations. - */ -- s = socket(AF_INET, SOCK_DGRAM, 0); -+ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (s < 0) - return 0; - -diff --git a/pppd/tty.c b/pppd/tty.c -index bc96695..8e76a5d 100644 ---- a/pppd/tty.c -+++ b/pppd/tty.c -@@ -896,7 +896,7 @@ open_socket(dest) - *sep = ':'; - - /* get a socket and connect it to the other end */ -- sock = socket(PF_INET, SOCK_STREAM, 0); -+ sock = socket(PF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0); - if (sock < 0) { - error("Can't create socket: %m"); - return -1; --- -1.8.3.1 - diff --git a/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch b/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch deleted file mode 100644 index 1b36e8369..000000000 --- a/src/patches/ppp/ppp-2.4.6-increase-max-padi-attempts.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/pppd/plugins/pppoe/pppoe.h b/pppd/plugins/pppoe/pppoe.h -index 9ab2eee..86762bd 100644 ---- a/pppd/plugins/pppoe/pppoe.h -+++ b/pppd/plugins/pppoe/pppoe.h -@@ -148,7 +148,7 @@ extern UINT16_t Eth_PPPOE_Session; - #define STATE_TERMINATED 4 - - /* How many PADI/PADS attempts? */ --#define MAX_PADI_ATTEMPTS 3 -+#define MAX_PADI_ATTEMPTS 4 - - /* Initial timeout for PADO/PADS */ - #define PADI_TIMEOUT 5 diff --git a/src/patches/ppp/ppp-2.4.7-headers_4.9.patch b/src/patches/ppp/ppp-2.4.7-headers_4.9.patch deleted file mode 100644 index 686db9204..000000000 --- a/src/patches/ppp/ppp-2.4.7-headers_4.9.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur ppp-2.4.7.org/pppd/plugins/pppoe/plugin.c ppp-2.4.7/pppd/plugins/pppoe/plugin.c ---- ppp-2.4.7.org/pppd/plugins/pppoe/plugin.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7/pppd/plugins/pppoe/plugin.c 2017-02-09 08:45:12.567493723 +0100 -@@ -49,6 +49,8 @@ - #include <net/ethernet.h> - #include <net/if_arp.h> - #include <linux/ppp_defs.h> -+#define _LINUX_IN_H -+#define _LINUX_IN6_H - #include <linux/if_pppox.h> - - #ifndef _ROOT_PATH diff --git a/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch b/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch deleted file mode 100644 index b36ace192..000000000 --- a/src/patches/ppp/ppp-2.4.9-patch-configure-to-handle-cflags-properly.patch +++ /dev/null @@ -1,15 +0,0 @@ ---- ppp-2.4.9.orig/configure 2021-03-30 21:38:27.415735914 +0200 -+++ ppp-2.4.9/configure 2021-04-01 19:10:48.632314447 +0200 -@@ -121,9 +121,9 @@ - rm -f $2 - if [ -f $1 ]; then - echo " $2 <= $1" -- sed -e "s,@DESTDIR@,$DESTDIR,g" -e "s,@SYSCONF@,$SYSCONF,g" \ -- -e "s,@CROSS_COMPILE@,$CROSS_COMPILE,g" -e "s,@CC@,$CC,g" \ -- -e "s,@CFLAGS@,$CFLAGS,g" $1 >$2 -+ sed -e "s#@DESTDIR@#$DESTDIR#g" -e "s#@SYSCONF@#$SYSCONF#g" \ -+ -e "s#@CROSS_COMPILE@#$CROSS_COMPILE#g" -e "s#@CC@#$CC#g" \ -+ -e "s#@CFLAGS@#$CFLAGS#g" $1 >$2 - fi - } - diff --git a/src/patches/ppp/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch b/src/patches/ppp/ppp-2.5.0-1-we-don-t-want-to-accidentally-leak-fds.patch similarity index 54% rename from src/patches/ppp/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch rename to src/patches/ppp/ppp-2.5.0-1-we-don-t-want-to-accidentally-leak-fds.patch index 90bb2d161..98ab03119 100644 --- a/src/patches/ppp/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch +++ b/src/patches/ppp/ppp-2.5.0-1-we-don-t-want-to-accidentally-leak-fds.patch @@ -1,20 +1,8 @@ -From 82cd789df0f022eb6f3d28646e7a61d1d0715805 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar <msekleta(a)redhat.com> -Date: Mon, 7 Apr 2014 12:23:36 +0200 -Subject: [PATCH 12/25] pppd: we don't want to accidentally leak fds - ---- - pppd/auth.c | 20 ++++++++++---------- - pppd/options.c | 2 +- - pppd/sys-linux.c | 4 ++-- - 3 files changed, 13 insertions(+), 13 deletions(-) - -diff --git a/pppd/auth.c b/pppd/auth.c -index 4271af6..9e957fa 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c -@@ -428,7 +428,7 @@ setupapfile(argv) - option_error("unable to reset uid before opening %s: %m", fname); +diff -Naur pppd.orig/auth.c pppd/auth.c +--- pppd.orig/auth.c 2023-03-25 05:38:30.000000000 +0100 ++++ pppd/auth.c 2023-06-30 12:38:13.748482796 +0200 +@@ -518,7 +518,7 @@ + free(fname); return 0; } - ufile = fopen(fname, "r"); @@ -22,8 +10,8 @@ index 4271af6..9e957fa 100644 if (seteuid(euid) == -1) fatal("unable to regain privileges: %m"); if (ufile == NULL) { -@@ -1413,7 +1413,7 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg) - filename = _PATH_UPAPFILE; +@@ -1535,7 +1535,7 @@ + filename = PPP_PATH_UPAPFILE; addrs = opts = NULL; ret = UPAP_AUTHNAK; - f = fopen(filename, "r"); @@ -31,52 +19,52 @@ index 4271af6..9e957fa 100644 if (f == NULL) { error("Can't open PAP password file %s: %m", filename); -@@ -1512,7 +1512,7 @@ null_login(unit) +@@ -1635,7 +1635,7 @@ if (ret <= 0) { - filename = _PATH_UPAPFILE; + filename = PPP_PATH_UPAPFILE; addrs = NULL; - f = fopen(filename, "r"); + f = fopen(filename, "re"); if (f == NULL) return 0; check_access(f, filename); -@@ -1559,7 +1559,7 @@ get_pap_passwd(passwd) +@@ -1681,7 +1681,7 @@ } - filename = _PATH_UPAPFILE; + filename = PPP_PATH_UPAPFILE; - f = fopen(filename, "r"); + f = fopen(filename, "re"); if (f == NULL) return 0; check_access(f, filename); -@@ -1597,7 +1597,7 @@ have_pap_secret(lacks_ipp) +@@ -1718,7 +1718,7 @@ } - filename = _PATH_UPAPFILE; + filename = PPP_PATH_UPAPFILE; - f = fopen(filename, "r"); + f = fopen(filename, "re"); if (f == NULL) return 0; -@@ -1642,7 +1642,7 @@ have_chap_secret(client, server, need_ip, lacks_ipp) +@@ -1760,7 +1760,7 @@ } - filename = _PATH_CHAPFILE; + filename = PPP_PATH_CHAPFILE; - f = fopen(filename, "r"); + f = fopen(filename, "re"); if (f == NULL) return 0; -@@ -1684,7 +1684,7 @@ have_srp_secret(client, server, need_ip, lacks_ipp) +@@ -1798,7 +1798,7 @@ struct wordlist *addrs; - filename = _PATH_SRPFILE; + filename = PPP_PATH_SRPFILE; - f = fopen(filename, "r"); + f = fopen(filename, "re"); if (f == NULL) return 0; -@@ -1740,7 +1740,7 @@ get_secret(unit, client, server, secret, secret_len, am_server) +@@ -1849,7 +1849,7 @@ addrs = NULL; secbuf[0] = 0; @@ -85,8 +73,8 @@ index 4271af6..9e957fa 100644 if (f == NULL) { error("Can't open chap secret file %s: %m", filename); return 0; -@@ -1797,7 +1797,7 @@ get_srp_secret(unit, client, server, secret, am_server) - filename = _PATH_SRPFILE; +@@ -1902,7 +1902,7 @@ + filename = PPP_PATH_SRPFILE; addrs = NULL; - fp = fopen(filename, "r"); @@ -94,7 +82,7 @@ index 4271af6..9e957fa 100644 if (fp == NULL) { error("Can't open srp secret file %s: %m", filename); return 0; -@@ -2203,7 +2203,7 @@ scan_authfile(f, client, server, secret, addrs, opts, filename, flags) +@@ -2291,7 +2291,7 @@ */ if (word[0] == '@' && word[1] == '/') { strlcpy(atfile, word+1, sizeof(atfile)); @@ -103,12 +91,38 @@ index 4271af6..9e957fa 100644 warn("can't open indirect secret file %s", atfile); continue; } -diff --git a/pppd/options.c b/pppd/options.c -index 45fa742..1d754ae 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -427,7 +427,7 @@ options_from_file(filename, must_exist, check_prot, priv) - option_error("unable to drop privileges to open %s: %m", filename); +@@ -2461,7 +2461,7 @@ + char pkfile[MAXWORDLEN]; + + filename = PPP_PATH_EAPTLSSERVFILE; +- f = fopen(filename, "r"); ++ f = fopen(filename, "re"); + if (f == NULL) + return 0; + +@@ -2518,7 +2518,7 @@ + return 1; + + filename = PPP_PATH_EAPTLSCLIFILE; +- f = fopen(filename, "r"); ++ f = fopen(filename, "re"); + if (f == NULL) + return 0; + +@@ -2738,7 +2738,7 @@ + filename = (am_server ? PPP_PATH_EAPTLSSERVFILE : PPP_PATH_EAPTLSCLIFILE); + addrs = NULL; + +- fp = fopen(filename, "r"); ++ fp = fopen(filename, "re"); + if (fp == NULL) + { + error("Can't open eap-tls secret file %s: %m", filename); +diff -Naur pppd.orig/options.c pppd/options.c +--- pppd.orig/options.c 2023-03-25 05:38:30.000000000 +0100 ++++ pppd/options.c 2023-06-30 12:42:19.262593140 +0200 +@@ -555,7 +555,7 @@ + ppp_option_error("unable to drop privileges to open %s: %m", filename); return 0; } - f = fopen(filename, "r"); @@ -116,11 +130,10 @@ index 45fa742..1d754ae 100644 err = errno; if (check_prot && seteuid(euid) == -1) fatal("unable to regain privileges"); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 72a7727..8a12fa0 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -1412,7 +1412,7 @@ static char *path_to_procfs(const char *tail) +diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c +--- pppd.orig/sys-linux.c 2023-03-10 02:50:41.000000000 +0100 ++++ pppd/sys-linux.c 2023-06-30 12:43:20.634453475 +0200 +@@ -1978,7 +1978,7 @@ /* Default the mount location of /proc */ strlcpy (proc_path, "/proc", sizeof(proc_path)); proc_path_len = 5; @@ -129,7 +142,7 @@ index 72a7727..8a12fa0 100644 if (fp != NULL) { while ((mntent = getmntent(fp)) != NULL) { if (strcmp(mntent->mnt_type, MNTTYPE_IGNORE) == 0) -@@ -1472,7 +1472,7 @@ static int open_route_table (void) +@@ -2038,7 +2038,7 @@ close_route_table(); path = path_to_procfs("/net/route"); @@ -138,6 +151,12 @@ index 72a7727..8a12fa0 100644 if (route_fd == NULL) { error("can't open routing table %s: %m", path); return 0; --- -1.8.3.1 - +@@ -2322,7 +2322,7 @@ + close_route_table(); + + path = path_to_procfs("/net/ipv6_route"); +- route_fd = fopen (path, "r"); ++ route_fd = fopen (path, "re"); + if (route_fd == NULL) { + error("can't open routing table %s: %m", path); + return 0; diff --git a/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch b/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch similarity index 63% rename from src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch rename to src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch index 0fb028779..c205c0e08 100644 --- a/src/patches/ppp/0013-everywhere-O_CLOEXEC-harder.patch +++ b/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch @@ -1,23 +1,7 @@ -From 302c1b736cb656c7885a0cba270fd953a672d8a8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar <msekleta(a)redhat.com> -Date: Mon, 7 Apr 2014 13:56:34 +0200 -Subject: [PATCH 13/25] everywhere: O_CLOEXEC harder - ---- - pppd/eap.c | 2 +- - pppd/main.c | 4 ++-- - pppd/options.c | 4 ++-- - pppd/sys-linux.c | 22 +++++++++++----------- - pppd/tdb.c | 4 ++-- - pppd/tty.c | 4 ++-- - pppd/utils.c | 6 +++--- - 7 files changed, 23 insertions(+), 23 deletions(-) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 6ea6c1f..faced53 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -1226,7 +1226,7 @@ mode_t modebits; +diff -Naur pppd.orig/eap.c pppd/eap.c +--- pppd.orig/eap.c 2023-03-25 05:38:30.000000000 +0100 ++++ pppd/eap.c 2023-06-30 12:58:07.984676045 +0200 +@@ -1542,7 +1542,7 @@ if ((path = name_of_pn_file()) == NULL) return (-1); @@ -26,34 +10,23 @@ index 6ea6c1f..faced53 100644 err = errno; free(path); errno = err; -diff --git a/pppd/main.c b/pppd/main.c -index 87a5d29..152e4a2 100644 ---- a/pppd/main.c -+++ b/pppd/main.c -@@ -400,7 +400,7 @@ main(int argc, char *argv[]) +diff -Naur pppd.orig/main.c pppd/main.c +--- pppd.orig/main.c 2023-03-25 05:38:30.000000000 +0100 ++++ pppd/main.c 2023-06-30 13:00:15.155195676 +0200 +@@ -479,7 +479,7 @@ die(0); /* Make sure fds 0, 1, 2 are open to somewhere. */ -- fd_devnull = open(_PATH_DEVNULL, O_RDWR); -+ fd_devnull = open(_PATH_DEVNULL, O_RDWR | O_CLOEXEC); +- fd_devnull = open(PPP_DEVNULL, O_RDWR); ++ fd_devnull = open(PPP_DEVNULL, O_RDWR | O_CLOEXEC); if (fd_devnull < 0) - fatal("Couldn't open %s: %m", _PATH_DEVNULL); + fatal("Couldn't open %s: %m", PPP_DEVNULL); while (fd_devnull <= 2) { -@@ -1642,7 +1642,7 @@ device_script(char *program, int in, int out, int dont_wait) - if (log_to_fd >= 0) - errfd = log_to_fd; - else -- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0644); -+ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0644); - - ++conn_running; - pid = safe_fork(in, out, errfd); -diff --git a/pppd/options.c b/pppd/options.c -index 1d754ae..8e62635 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -1544,9 +1544,9 @@ setlogfile(argv) - option_error("unable to drop permissions to open %s: %m", *argv); +diff -Naur pppd.orig/options.c pppd/options.c +--- pppd.orig/options.c 2023-06-30 12:42:19.262593140 +0200 ++++ pppd/options.c 2023-06-30 13:01:58.388323345 +0200 +@@ -1718,9 +1718,9 @@ + ppp_option_error("unable to drop permissions to open %s: %m", *argv); return 0; } - fd = open(*argv, O_WRONLY | O_APPEND | O_CREAT | O_EXCL, 0644); @@ -64,11 +37,10 @@ index 1d754ae..8e62635 100644 err = errno; if (!privileged_option && seteuid(euid) == -1) fatal("unable to regain privileges: %m"); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 8a12fa0..00a2cf5 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -459,7 +459,7 @@ int generic_establish_ppp (int fd) +diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c +--- pppd.orig/sys-linux.c 2023-06-30 12:43:20.634453475 +0200 ++++ pppd/sys-linux.c 2023-06-30 13:11:25.715511251 +0200 +@@ -666,7 +666,7 @@ goto err; } dbglog("using channel %d", chindex); @@ -77,7 +49,7 @@ index 8a12fa0..00a2cf5 100644 if (fd < 0) { error("Couldn't reopen /dev/ppp: %m"); goto err; -@@ -619,7 +619,7 @@ static int make_ppp_unit() +@@ -904,7 +904,7 @@ dbglog("in make_ppp_unit, already had /dev/ppp open?"); close(ppp_dev_fd); } @@ -86,7 +58,7 @@ index 8a12fa0..00a2cf5 100644 if (ppp_dev_fd < 0) fatal("Couldn't open /dev/ppp: %m"); flags = fcntl(ppp_dev_fd, F_GETFL); -@@ -693,7 +693,7 @@ int bundle_attach(int ifnum) +@@ -1025,7 +1025,7 @@ if (!new_style_driver) return -1; @@ -95,7 +67,7 @@ index 8a12fa0..00a2cf5 100644 if (master_fd < 0) fatal("Couldn't open /dev/ppp: %m"); if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) { -@@ -1715,7 +1715,7 @@ int sifproxyarp (int unit, u_int32_t his_adr) +@@ -2533,7 +2533,7 @@ if (tune_kernel) { forw_path = path_to_procfs("/sys/net/ipv4/ip_forward"); if (forw_path != 0) { @@ -104,7 +76,7 @@ index 8a12fa0..00a2cf5 100644 if (fd >= 0) { if (write(fd, "1", 1) != 1) error("Couldn't enable IP forwarding: %m"); -@@ -2030,7 +2030,7 @@ int ppp_available(void) +@@ -2878,7 +2878,7 @@ sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch); kernel_version = KVERSION(osmaj, osmin, ospatch); @@ -113,7 +85,7 @@ index 8a12fa0..00a2cf5 100644 if (fd >= 0) { new_style_driver = 1; -@@ -2208,7 +2208,7 @@ void logwtmp (const char *line, const char *name, const char *host) +@@ -3056,7 +3056,7 @@ #if __GLIBC__ >= 2 updwtmp(_PATH_WTMP, &ut); #else @@ -122,7 +94,7 @@ index 8a12fa0..00a2cf5 100644 if (wtmp >= 0) { flock(wtmp, LOCK_EX); -@@ -2394,7 +2394,7 @@ int sifaddr (int unit, u_int32_t our_adr, u_int32_t his_adr, +@@ -3280,7 +3280,7 @@ int fd; path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); @@ -131,7 +103,7 @@ index 8a12fa0..00a2cf5 100644 if (write(fd, "1", 1) != 1) error("Couldn't enable dynamic IP addressing: %m"); close(fd); -@@ -2570,7 +2570,7 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) +@@ -3534,7 +3534,7 @@ /* * Try the unix98 way first. */ @@ -140,17 +112,17 @@ index 8a12fa0..00a2cf5 100644 if (mfd >= 0) { int ptn; if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) { -@@ -2851,7 +2851,8 @@ +@@ -3545,7 +3545,8 @@ if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0) warn("Couldn't unlock pty slave %s: %m", pty_name); #endif - if ((sfd = open(pty_name, O_RDWR | O_NOCTTY)) < 0) + -+ if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) - { ++ if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) + { warn("Couldn't open pty slave %s: %m", pty_name); - close(mfd); -@@ -2865,10 +2866,10 @@ + close(mfd); +@@ -3559,10 +3560,10 @@ for (i = 0; i < 64; ++i) { slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", 'p' + i / 16, i % 16); @@ -161,13 +133,12 @@ index 8a12fa0..00a2cf5 100644 - sfd = open(pty_name, O_RDWR | O_NOCTTY, 0); + sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC, 0); if (sfd >= 0) { - fchown(sfd, uid, -1); - fchmod(sfd, S_IRUSR | S_IWUSR); -diff --git a/pppd/tdb.c b/pppd/tdb.c -index bdc5828..c7ab71c 100644 ---- a/pppd/tdb.c -+++ b/pppd/tdb.c -@@ -1724,7 +1724,7 @@ TDB_CONTEXT *tdb_open_ex(const char *name, int hash_size, int tdb_flags, + ret = fchown(sfd, uid, -1); + if (ret != 0) { +diff -Naur pppd.orig/tdb.c pppd/tdb.c +--- pppd.orig/tdb.c 2021-07-23 06:41:07.000000000 +0200 ++++ pppd/tdb.c 2023-06-30 13:12:55.034900600 +0200 +@@ -1728,7 +1728,7 @@ goto internal; } @@ -176,7 +147,7 @@ index bdc5828..c7ab71c 100644 TDB_LOG((tdb, 5, "tdb_open_ex: could not open file %s: %s\n", name, strerror(errno))); goto fail; /* errno set by open(2) */ -@@ -1967,7 +1967,7 @@ int tdb_reopen(TDB_CONTEXT *tdb) +@@ -1971,7 +1971,7 @@ } if (close(tdb->fd) != 0) TDB_LOG((tdb, 0, "tdb_reopen: WARNING closing tdb->fd failed!\n")); @@ -185,12 +156,11 @@ index bdc5828..c7ab71c 100644 if (tdb->fd == -1) { TDB_LOG((tdb, 0, "tdb_reopen: open failed (%s)\n", strerror(errno))); goto fail; -diff --git a/pppd/tty.c b/pppd/tty.c -index d571b11..bc96695 100644 ---- a/pppd/tty.c -+++ b/pppd/tty.c -@@ -569,7 +569,7 @@ int connect_tty() - status = EXIT_OPEN_FAILED; +diff -Naur pppd.orig/tty.c pppd/tty.c +--- pppd.orig/tty.c 2023-03-25 05:38:30.000000000 +0100 ++++ pppd/tty.c 2023-06-30 13:14:06.450418113 +0200 +@@ -621,7 +621,7 @@ + ppp_set_status(EXIT_OPEN_FAILED); goto errret; } - real_ttyfd = open(devnam, O_NONBLOCK | O_RDWR, 0); @@ -198,7 +168,7 @@ index d571b11..bc96695 100644 err = errno; if (prio < OPRIO_ROOT && seteuid(0) == -1) fatal("Unable to regain privileges"); -@@ -723,7 +723,7 @@ int connect_tty() +@@ -775,7 +775,7 @@ if (connector == NULL && modem && devnam[0] != 0) { int i; for (;;) { @@ -207,12 +177,11 @@ index d571b11..bc96695 100644 break; if (errno != EINTR) { error("Failed to reopen %s: %m", devnam); -diff --git a/pppd/utils.c b/pppd/utils.c -index 29bf970..6051b9a 100644 ---- a/pppd/utils.c -+++ b/pppd/utils.c -@@ -918,14 +918,14 @@ lock(dev) - slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", LOCK_DIR, dev); +diff -Naur pppd.orig/utils.c pppd/utils.c +--- pppd.orig/utils.c 2022-12-30 02:12:39.000000000 +0100 ++++ pppd/utils.c 2023-06-30 13:15:47.860182369 +0200 +@@ -843,14 +843,14 @@ + slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", PPP_PATH_LOCKDIR, dev); #endif - while ((fd = open(lock_file, O_EXCL | O_CREAT | O_RDWR, 0644)) < 0) { @@ -228,7 +197,7 @@ index 29bf970..6051b9a 100644 if (fd < 0) { if (errno == ENOENT) /* This is just a timing problem. */ continue; -@@ -1004,7 +1004,7 @@ relock(pid) +@@ -933,7 +933,7 @@ if (lock_file[0] == 0) return -1; @@ -237,6 +206,3 @@ index 29bf970..6051b9a 100644 if (fd < 0) { error("Couldn't reopen lock file %s: %m", lock_file); lock_file[0] = 0; --- -1.8.3.1 - diff --git a/src/patches/ppp/ppp-2.5.0-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/src/patches/ppp/ppp-2.5.0-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch new file mode 100644 index 000000000..cfd72e468 --- /dev/null +++ b/src/patches/ppp/ppp-2.5.0-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch @@ -0,0 +1,135 @@ +diff -Naur pppd.orig/plugins/pppoatm/pppoatm.c pppd/plugins/pppoatm/pppoatm.c +--- pppd.orig/plugins/pppoatm/pppoatm.c 2023-03-25 05:38:30.000000000 +0100 ++++ pppd/plugins/pppoatm/pppoatm.c 2023-06-30 13:21:33.397378347 +0200 +@@ -146,7 +146,7 @@ + + if (!device_got_set) + no_device_given_pppoatm(); +- fd = socket(AF_ATMPVC, SOCK_DGRAM, 0); ++ fd = socket(AF_ATMPVC, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (fd < 0) + fatal("failed to create socket: %m"); + memset(&qos, 0, sizeof qos); +diff -Naur pppd.orig/plugins/pppoe/if.c pppd/plugins/pppoe/if.c +--- pppd.orig/plugins/pppoe/if.c 2022-12-30 02:12:39.000000000 +0100 ++++ pppd/plugins/pppoe/if.c 2023-06-30 13:24:11.372183452 +0200 +@@ -116,7 +116,7 @@ + stype = SOCK_PACKET; + #endif + +- if ((fd = socket(domain, stype, htons(type))) < 0) { ++ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { + /* Give a more helpful message for the common error case */ + if (errno == EPERM) { + fatal("Cannot create raw socket -- pppoe must be run as root."); +diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c +--- pppd.orig/plugins/pppoe/plugin.c 2023-03-25 05:38:30.000000000 +0100 ++++ pppd/plugins/pppoe/plugin.c 2023-06-30 13:25:58.798782323 +0200 +@@ -155,7 +155,7 @@ + /* server equipment). */ + /* Opening this socket just before waitForPADS in the discovery() */ + /* function would be more appropriate, but it would mess-up the code */ +- conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM, PX_PROTO_OE); ++ conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM | SOCK_CLOEXEC, PX_PROTO_OE); + if (conn->sessionSocket < 0) { + error("Failed to create PPPoE socket: %m"); + return -1; +@@ -166,7 +166,7 @@ + lcp_wantoptions[0].mru = conn->mru = conn->storedmru; + + /* Update maximum MRU */ +- s = socket(AF_INET, SOCK_DGRAM, 0); ++ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (s < 0) { + error("Can't get MTU for %s: %m", conn->ifName); + goto errout; +@@ -364,7 +364,7 @@ + } + + /* Open a socket */ +- if ((fd = socket(PF_PACKET, SOCK_RAW, 0)) < 0) { ++ if ((fd = socket(PF_PACKET, SOCK_RAW | SOCK_CLOEXEC, 0)) < 0) { + r = 0; + } + +diff -Naur pppd.orig/plugins/pppol2tp/openl2tp.c pppd/plugins/pppol2tp/openl2tp.c +--- pppd.orig/plugins/pppol2tp/openl2tp.c 2023-03-10 02:50:41.000000000 +0100 ++++ pppd/plugins/pppol2tp/openl2tp.c 2023-06-30 13:22:30.055768865 +0200 +@@ -93,7 +93,7 @@ + int result; + + if (openl2tp_fd < 0) { +- openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM, 0); ++ openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (openl2tp_fd < 0) { + error("openl2tp connection create: %m"); + return -ENOTCONN; +diff -Naur pppd.orig/plugins/pppol2tp/pppol2tp.c pppd/plugins/pppol2tp/pppol2tp.c +--- pppd.orig/plugins/pppol2tp/pppol2tp.c 2022-12-30 02:12:39.000000000 +0100 ++++ pppd/plugins/pppol2tp/pppol2tp.c 2023-06-30 13:23:13.493756755 +0200 +@@ -220,7 +220,7 @@ + struct ifreq ifr; + int fd; + +- fd = socket(AF_INET, SOCK_DGRAM, 0); ++ fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (fd >= 0) { + memset (&ifr, '\0', sizeof (ifr)); + ppp_get_ifname(ifr.ifr_name, sizeof(ifr.ifr_name)); +diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c +--- pppd.orig/sys-linux.c 2023-06-30 13:11:25.715511251 +0200 ++++ pppd/sys-linux.c 2023-06-30 13:32:50.021272249 +0200 +@@ -499,12 +499,12 @@ + void sys_init(void) + { + /* Get an internet socket for doing socket ioctls. */ +- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); ++ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (sock_fd < 0) + fatal("Couldn't create IP socket: %m(%d)", errno); + + #ifdef PPP_WITH_IPV6CP +- sock6_fd = socket(AF_INET6, SOCK_DGRAM, 0); ++ sock6_fd = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (sock6_fd < 0) + sock6_fd = -errno; /* save errno for later */ + #endif +@@ -2675,7 +2675,7 @@ + struct ifreq ifreq; + int ret, sock_fd; + +- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); ++ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (sock_fd < 0) + return -1; + memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); +@@ -2698,7 +2698,7 @@ + struct ifreq ifreq; + int ret, sock_fd; + +- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); ++ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (sock_fd < 0) + return -1; + +@@ -2915,7 +2915,7 @@ + /* + * Open a socket for doing the ioctl operations. + */ +- s = socket(AF_INET, SOCK_DGRAM, 0); ++ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); + if (s < 0) + return 0; + +diff -Naur pppd.orig/tty.c pppd/tty.c +--- pppd.orig/tty.c 2023-06-30 13:14:06.450418113 +0200 ++++ pppd/tty.c 2023-06-30 13:33:31.285858278 +0200 +@@ -942,7 +942,7 @@ + *sep = ':'; + + /* get a socket and connect it to the other end */ +- sock = socket(PF_INET, SOCK_STREAM, 0); ++ sock = socket(PF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0); + if (sock < 0) { + error("Can't create socket: %m"); + return -1; diff --git a/src/patches/ppp/ppp-2.5.0-4-increase-max-padi-attempts.patch b/src/patches/ppp/ppp-2.5.0-4-increase-max-padi-attempts.patch new file mode 100644 index 000000000..002b6066d --- /dev/null +++ b/src/patches/ppp/ppp-2.5.0-4-increase-max-padi-attempts.patch @@ -0,0 +1,12 @@ +diff -Naur pppd.orig/plugins/pppoe/pppoe.h pppd/plugins/pppoe/pppoe.h +--- pppd.orig/plugins/pppoe/pppoe.h 2022-12-30 02:12:39.000000000 +0100 ++++ pppd/plugins/pppoe/pppoe.h 2023-06-30 13:37:07.189078090 +0200 +@@ -143,7 +143,7 @@ + #define STATE_TERMINATED 4 + + /* How many PADI/PADS attempts? */ +-#define MAX_PADI_ATTEMPTS 3 ++#define MAX_PADI_ATTEMPTS 4 + + /* Initial timeout for PADO/PADS */ + #define PADI_TIMEOUT 5 diff --git a/src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch b/src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch new file mode 100644 index 000000000..dc6c22852 --- /dev/null +++ b/src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch @@ -0,0 +1,12 @@ +diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c +--- pppd.orig/plugins/pppoe/plugin.c 2023-06-30 13:25:58.798782323 +0200 ++++ pppd/plugins/pppoe/plugin.c 2023-06-30 13:50:23.150026201 +0200 +@@ -46,6 +46,8 @@ + #include <signal.h> + #include <net/if_arp.h> + #include <linux/ppp_defs.h> ++#define _LINUX_IN_H ++#define _LINUX_IN6_H + #include <linux/if_pppox.h> + + #include <pppd/pppd.h> diff --git a/src/patches/ppp/ppp-2.5.0-6-patch-configure-to-handle-cflags-properly.patch b/src/patches/ppp/ppp-2.5.0-6-patch-configure-to-handle-cflags-properly.patch new file mode 100644 index 000000000..0e9eab6ed --- /dev/null +++ b/src/patches/ppp/ppp-2.5.0-6-patch-configure-to-handle-cflags-properly.patch @@ -0,0 +1,18 @@ +diff -Naur ppp-2.5.0.orig/configure ppp-2.5.0/configure +--- ppp-2.5.0.orig/configure 2023-03-25 05:38:36.000000000 +0100 ++++ ppp-2.5.0/configure 2023-06-30 14:05:14.773950477 +0200 +@@ -17774,10 +17774,10 @@ + rm -f $2 + if [ -f $1 ]; then + echo " $2 <= $1" +- sed -e "s,@DESTDIR@,$prefix,g" \ +- -e "s,@SYSCONF@,$sysconfdir,g" \ +- -e "s,@CC@,$CC,g" \ +- -e "s|@CFLAGS@|$CFLAGS|g" $1 > $2 ++ sed -e "s#@DESTDIR@#$prefix#g" \ ++ -e "s#@SYSCONF@#$sysconfdir#g" \ ++ -e "s#@CC@#$CC#g" \ ++ -e "s#@CFLAGS@#$CFLAGS#g" $1 > $2 + fi + } + -- 2.41.0

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2023