Development March 2024

development@lists.ipfire.org

11 participants
55 discussions

[PATCH] CU184-update.sh: Add drop hostile in & out logging entries
by Adolf Belka 18 Mar '24

18 Mar '24

- My drop hostile patch set updated the WUI entries to include in and out logging options but the values need to be added to the optionsfw entries for existing systems being upgraded. - After the existing CU184 update the LOGDROPHOSTILEIN and LOGDROPHO)STILEOUT entries are not in the settings file which trewats them as being set to off, even though they are enabled in the WUI update. - This patch adds the LOGDROPHOSTILEIN and LOGDROPHOSTILEOUT entries into the settings file and then runs the firewallctrl command to apply to the firewall. - Ran a CU184 update on a CU183 vm system and then ran the comands added into the update.sh script and then did a reboot. Entries include and DROP_HOSTILE entries start to be logged again. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/core/184/update.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/rootfiles/core/184/update.sh b/config/rootfiles/core/184/update.sh index aa593047d..1a0e67c66 100644 --- a/config/rootfiles/core/184/update.sh +++ b/config/rootfiles/core/184/update.sh @@ -80,6 +80,12 @@ xz --check=crc32 --lzma2=dict=512KiB /lib/modules/6.6.15-ipfire/extra/wlan/8812a # Apply local configuration to sshd_config /usr/local/bin/sshctrl +# Add the drop hostile in and out logging options +# into the optionsfw settings file and apply to firewall +sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings +sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings +/usr/local/bin/firewallctrl + # Start services telinit u /etc/init.d/vnstat start -- 2.44.0

2 4

[PATCH] unbound: Update to 1.19.3
by Matthias Fischer 16 Mar '24

16 Mar '24

For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-3 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index f5274dcd1..95dafc4da 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.25 +usr/lib/libunbound.so.8.1.26 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 0a5106064..f09e76b1b 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ include Config -VER = 1.19.2 +VER = 1.19.3 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f8dcee649e5e1dfaab9285964419b4d957f0035e484021e3131784512fed842ee46c25d7b47304aca4f03a0480877b939968bca22e80620434d1d2cb7013c9b6 +$(DL_FILE)_BLAKE2 = 5d9cbc26510afc2b92ecce6307cd9924a1b450892f7839f076535177ab35f78059d271e628e2aa995b62f5cf97add2363561a819d6e0181beb6b44421661d8f0 install : $(TARGET) -- 2.34.1

1 0

Can't pull or push anymore...
by Matthias Fischer 16 Mar '24

16 Mar '24

Hi, I don't know what might have changed but my "Devels" can't push or pull anymore. The only reaction I get is...: ... root@Devel64-1: /git/ipfire-2.x # git fetch origin core184:core184 ssh: connect to host git.ipfire.org port 22: Network is unreachable fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. ... Can anyone confirm? Best, Matthias

2 3

[PATCH] ppp: Update to include bug fixes that should be in 2.5.1 but not yet released
by Adolf Belka 15 Mar '24

15 Mar '24

- Update from version 2.5.0 to commit e1266c7 - Update of rootfile - When ppp-2.5.0 was released it had a bug bin it that the lock and run directories had non standard defaults but also that if the directory did not exist ppp just ignored it and continued to start but would then have error messages in the logs about not being able to cretae the lock file - This issue was raised in the ppp github issues and a set of patches merged into ppp. - The plan was written in Nov 2023 that this would be released as 2.5.1, however nearly three months later there is no sight of 2.5.1 being released and people continue to flag up the lock directory issues and have to apply a workaround to create the directory in local.rc - This patch has taken the zip source tarball of master at the commit e1266c7. The zip tarball was then extracted and then tar'd back up as a tar.gz file with the version set at e1266c7 rather than master. I could not find any other way to get a source tarball\ created at a certain commit stage. - The patch ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch had to be updated due to some changes in the source files. - The patch ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch was removed as the changes are now built into the source tarball. - This will need to be tested thoroughly by people with ppp to confirm that the lock directory is created if it doesn't exist on the system. I can't test that as I have no access to a ppp connection system. - For a view of the changelog between 2.5.0 and e1266c7 the github commits list needs to be reviewed. https://github.com/ppp-project/ppp/commits/master/?before=e1266c76d1ad39f98… Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/ppp | 46 +++++------ lfs/ppp | 10 +-- ...to-see-if-we-have-struct-sockaddr_ll.patch | 37 --------- ...266c7-2-everywhere-O_CLOEXEC-harder.patch} | 82 +++++++++---------- 4 files changed, 69 insertions(+), 106 deletions(-) delete mode 100644 src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch rename src/patches/ppp/{ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch => ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch} (75%) diff --git a/config/rootfiles/common/ppp b/config/rootfiles/common/ppp index 379c64af4..6a27af3e7 100644 --- a/config/rootfiles/common/ppp +++ b/config/rootfiles/common/ppp @@ -35,29 +35,29 @@ etc/ppp/standardloginscript #usr/include/pppd/upap.h #usr/lib/pkgconfig/pppd.pc usr/lib/pppd -usr/lib/pppd/2.5.0 -#usr/lib/pppd/2.5.0/minconn.la -usr/lib/pppd/2.5.0/minconn.so -#usr/lib/pppd/2.5.0/openl2tp.la -usr/lib/pppd/2.5.0/openl2tp.so -#usr/lib/pppd/2.5.0/passprompt.la -usr/lib/pppd/2.5.0/passprompt.so -#usr/lib/pppd/2.5.0/passwordfd.la -usr/lib/pppd/2.5.0/passwordfd.so -#usr/lib/pppd/2.5.0/pppoatm.la -usr/lib/pppd/2.5.0/pppoatm.so -#usr/lib/pppd/2.5.0/pppoe.la -usr/lib/pppd/2.5.0/pppoe.so -#usr/lib/pppd/2.5.0/pppol2tp.la -usr/lib/pppd/2.5.0/pppol2tp.so -#usr/lib/pppd/2.5.0/radattr.la -usr/lib/pppd/2.5.0/radattr.so -#usr/lib/pppd/2.5.0/radius.la -usr/lib/pppd/2.5.0/radius.so -#usr/lib/pppd/2.5.0/radrealms.la -usr/lib/pppd/2.5.0/radrealms.so -#usr/lib/pppd/2.5.0/winbind.la -usr/lib/pppd/2.5.0/winbind.so +#usr/lib/pppd/2.5.1-dev +#usr/lib/pppd/2.5.1-dev/minconn.la +usr/lib/pppd/2.5.1-dev/minconn.so +#usr/lib/pppd/2.5.1-dev/openl2tp.la +usr/lib/pppd/2.5.1-dev/openl2tp.so +#usr/lib/pppd/2.5.1-dev/passprompt.la +usr/lib/pppd/2.5.1-dev/passprompt.so +#usr/lib/pppd/2.5.1-dev/passwordfd.la +usr/lib/pppd/2.5.1-dev/passwordfd.so +#usr/lib/pppd/2.5.1-dev/pppoatm.la +usr/lib/pppd/2.5.1-dev/pppoatm.so +#usr/lib/pppd/2.5.1-dev/pppoe.la +usr/lib/pppd/2.5.1-dev/pppoe.so +#usr/lib/pppd/2.5.1-dev/pppol2tp.la +usr/lib/pppd/2.5.1-dev/pppol2tp.so +#usr/lib/pppd/2.5.1-dev/radattr.la +usr/lib/pppd/2.5.1-dev/radattr.so +#usr/lib/pppd/2.5.1-dev/radius.la +usr/lib/pppd/2.5.1-dev/radius.so +#usr/lib/pppd/2.5.1-dev/radrealms.la +usr/lib/pppd/2.5.1-dev/radrealms.so +#usr/lib/pppd/2.5.1-dev/winbind.la +usr/lib/pppd/2.5.1-dev/winbind.so usr/sbin/chat usr/sbin/pppd usr/sbin/pppdump diff --git a/lfs/ppp b/lfs/ppp index 54aa1caf5..a16859002 100644 --- a/lfs/ppp +++ b/lfs/ppp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.5.0 +VER = e1266c7 THISAPP = ppp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 6a0e9efcbff3cb499705071cc7d0e3411cf4871fd53b2bfedbb1f2cf3ad80728eb436050cf33b78e36d473be64f15907a21da17f283337455f0af379bc18272d +$(DL_FILE)_BLAKE2 = be60fadeed632ae2511e2d60148905da9868bd4271139b4fecab6b4b93e4a403e645d84204f907a8661748fb1a18b59c893925d91565520b9af791a45b0aaf4f install : $(TARGET) @@ -72,13 +72,13 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./autogen.sh cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-1-we-don-t-want-to-accidentally-leak-fds.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-4-increase-max-padi-attempts.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-6-patch-configure-to-handle-cflags-properly.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc \ diff --git a/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch b/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch deleted file mode 100644 index a7823d424..000000000 --- a/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 9d6d326b2530cffb1414e4c401675117c42d43ce Mon Sep 17 00:00:00 2001 -From: Eivind Naess <eivnaes(a)yahoo.com> -Date: Sun, 23 Apr 2023 11:30:43 -0700 -Subject: [PATCH] Add configure check to see if we have struct sockaddr_ll - -Fixes issue #411. - -Signed-off-by: Eivind Naess <eivnaes(a)yahoo.com> ---- - configure.ac | 3 ++- - pppd/plugins/pppoe/config.h.in | 2 ++ - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index 1180f64ec..38b24af92 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -75,7 +75,8 @@ AM_COND_IF([LINUX], [ - linux/if_ether.h \ - linux/if_packet.h \ - netinet/if_ether.h \ -- netpacket/packet.h])]) -+ netpacket/packet.h]) -+ AC_CHECK_TYPES([struct sockaddr_ll], [], [], [#include <linux/if_packet.h>])]) - - AC_CHECK_SIZEOF(unsigned int) - AC_CHECK_SIZEOF(unsigned long) -diff --git a/pppd/plugins/pppoe/config.h.in b/pppd/plugins/pppoe/config.h.in -index d447f5e89..d7d61c01c 100644 ---- a/pppd/plugins/pppoe/config.h.in -+++ b/pppd/plugins/pppoe/config.h.in -@@ -69,3 +69,5 @@ - /* The size of `unsigned short', as computed by sizeof. */ - #undef SIZEOF_UNSIGNED_SHORT - -+/* Define to 1 if the system has the type `struct sockaddr_ll'. */ -+#undef HAVE_STRUCT_SOCKADDR_LL diff --git a/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch b/src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch similarity index 75% rename from src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch rename to src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch index c205c0e08..b6fd842a7 100644 --- a/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch +++ b/src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch @@ -1,6 +1,6 @@ -diff -Naur pppd.orig/eap.c pppd/eap.c ---- pppd.orig/eap.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/eap.c 2023-06-30 12:58:07.984676045 +0200 +diff -Naur ppp-e1266c7-orig/pppd/eap.c ppp-e1266c7/pppd/eap.c +--- ppp-e1266c7-orig/pppd/eap.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/eap.c 2024-03-15 10:40:53.637190252 +0100 @@ -1542,7 +1542,7 @@ if ((path = name_of_pn_file()) == NULL) @@ -10,10 +10,10 @@ diff -Naur pppd.orig/eap.c pppd/eap.c err = errno; free(path); errno = err; -diff -Naur pppd.orig/main.c pppd/main.c ---- pppd.orig/main.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/main.c 2023-06-30 13:00:15.155195676 +0200 -@@ -479,7 +479,7 @@ +diff -Naur ppp-e1266c7-orig/pppd/main.c ppp-e1266c7/pppd/main.c +--- ppp-e1266c7-orig/pppd/main.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/main.c 2024-03-15 10:41:43.842037617 +0100 +@@ -480,7 +480,7 @@ die(0); /* Make sure fds 0, 1, 2 are open to somewhere. */ @@ -22,10 +22,10 @@ diff -Naur pppd.orig/main.c pppd/main.c if (fd_devnull < 0) fatal("Couldn't open %s: %m", PPP_DEVNULL); while (fd_devnull <= 2) { -diff -Naur pppd.orig/options.c pppd/options.c ---- pppd.orig/options.c 2023-06-30 12:42:19.262593140 +0200 -+++ pppd/options.c 2023-06-30 13:01:58.388323345 +0200 -@@ -1718,9 +1718,9 @@ +diff -Naur ppp-e1266c7-orig/pppd/options.c ppp-e1266c7/pppd/options.c +--- ppp-e1266c7-orig/pppd/options.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/options.c 2024-03-15 10:43:02.867753370 +0100 +@@ -1719,9 +1719,9 @@ ppp_option_error("unable to drop permissions to open %s: %m", *argv); return 0; } @@ -37,10 +37,10 @@ diff -Naur pppd.orig/options.c pppd/options.c err = errno; if (!privileged_option && seteuid(euid) == -1) fatal("unable to regain privileges: %m"); -diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c ---- pppd.orig/sys-linux.c 2023-06-30 12:43:20.634453475 +0200 -+++ pppd/sys-linux.c 2023-06-30 13:11:25.715511251 +0200 -@@ -666,7 +666,7 @@ +diff -Naur ppp-e1266c7-orig/pppd/sys-linux.c ppp-e1266c7/pppd/sys-linux.c +--- ppp-e1266c7-orig/pppd/sys-linux.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/sys-linux.c 2024-03-15 10:49:59.310297165 +0100 +@@ -656,7 +656,7 @@ goto err; } dbglog("using channel %d", chindex); @@ -49,7 +49,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd < 0) { error("Couldn't reopen /dev/ppp: %m"); goto err; -@@ -904,7 +904,7 @@ +@@ -894,7 +894,7 @@ dbglog("in make_ppp_unit, already had /dev/ppp open?"); close(ppp_dev_fd); } @@ -58,7 +58,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (ppp_dev_fd < 0) fatal("Couldn't open /dev/ppp: %m"); flags = fcntl(ppp_dev_fd, F_GETFL); -@@ -1025,7 +1025,7 @@ +@@ -1015,7 +1015,7 @@ if (!new_style_driver) return -1; @@ -67,7 +67,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (master_fd < 0) fatal("Couldn't open /dev/ppp: %m"); if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) { -@@ -2533,7 +2533,7 @@ +@@ -2541,7 +2541,7 @@ if (tune_kernel) { forw_path = path_to_procfs("/sys/net/ipv4/ip_forward"); if (forw_path != 0) { @@ -76,7 +76,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd >= 0) { if (write(fd, "1", 1) != 1) error("Couldn't enable IP forwarding: %m"); -@@ -2878,7 +2878,7 @@ +@@ -2886,7 +2886,7 @@ sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch); kernel_version = KVERSION(osmaj, osmin, ospatch); @@ -85,7 +85,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd >= 0) { new_style_driver = 1; -@@ -3056,7 +3056,7 @@ +@@ -3064,7 +3064,7 @@ #if __GLIBC__ >= 2 updwtmp(_PATH_WTMP, &ut); #else @@ -94,7 +94,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (wtmp >= 0) { flock(wtmp, LOCK_EX); -@@ -3280,7 +3280,7 @@ +@@ -3288,7 +3288,7 @@ int fd; path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); @@ -103,7 +103,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (write(fd, "1", 1) != 1) error("Couldn't enable dynamic IP addressing: %m"); close(fd); -@@ -3534,7 +3534,7 @@ +@@ -3542,7 +3542,7 @@ /* * Try the unix98 way first. */ @@ -112,7 +112,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (mfd >= 0) { int ptn; if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) { -@@ -3545,7 +3545,8 @@ +@@ -3553,7 +3553,8 @@ if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0) warn("Couldn't unlock pty slave %s: %m", pty_name); #endif @@ -122,7 +122,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c { warn("Couldn't open pty slave %s: %m", pty_name); close(mfd); -@@ -3559,10 +3560,10 @@ +@@ -3567,10 +3568,10 @@ for (i = 0; i < 64; ++i) { slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", 'p' + i / 16, i % 16); @@ -135,19 +135,19 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (sfd >= 0) { ret = fchown(sfd, uid, -1); if (ret != 0) { -diff -Naur pppd.orig/tdb.c pppd/tdb.c ---- pppd.orig/tdb.c 2021-07-23 06:41:07.000000000 +0200 -+++ pppd/tdb.c 2023-06-30 13:12:55.034900600 +0200 -@@ -1728,7 +1728,7 @@ - goto internal; +diff -Naur ppp-e1266c7-orig/pppd/tdb.c ppp-e1266c7/pppd/tdb.c +--- ppp-e1266c7-orig/pppd/tdb.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/tdb.c 2024-03-15 10:51:25.182882191 +0100 +@@ -1732,7 +1732,7 @@ } + again: - if ((tdb->fd = open(name, open_flags, mode)) == -1) { + if ((tdb->fd = open(name, open_flags | O_CLOEXEC, mode)) == -1) { - TDB_LOG((tdb, 5, "tdb_open_ex: could not open file %s: %s\n", - name, strerror(errno))); - goto fail; /* errno set by open(2) */ -@@ -1971,7 +1971,7 @@ + if ((open_flags & O_CREAT) && errno == ENOENT && + mkdir_recursive(PPP_PATH_VARRUN) == 0) + goto again; +@@ -1979,7 +1979,7 @@ } if (close(tdb->fd) != 0) TDB_LOG((tdb, 0, "tdb_reopen: WARNING closing tdb->fd failed!\n")); @@ -156,9 +156,9 @@ diff -Naur pppd.orig/tdb.c pppd/tdb.c if (tdb->fd == -1) { TDB_LOG((tdb, 0, "tdb_reopen: open failed (%s)\n", strerror(errno))); goto fail; -diff -Naur pppd.orig/tty.c pppd/tty.c ---- pppd.orig/tty.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/tty.c 2023-06-30 13:14:06.450418113 +0200 +diff -Naur ppp-e1266c7-orig/pppd/tty.c ppp-e1266c7/pppd/tty.c +--- ppp-e1266c7-orig/pppd/tty.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/tty.c 2024-03-15 10:52:35.828341901 +0100 @@ -621,7 +621,7 @@ ppp_set_status(EXIT_OPEN_FAILED); goto errret; @@ -177,10 +177,10 @@ diff -Naur pppd.orig/tty.c pppd/tty.c break; if (errno != EINTR) { error("Failed to reopen %s: %m", devnam); -diff -Naur pppd.orig/utils.c pppd/utils.c ---- pppd.orig/utils.c 2022-12-30 02:12:39.000000000 +0100 -+++ pppd/utils.c 2023-06-30 13:15:47.860182369 +0200 -@@ -843,14 +843,14 @@ +diff -Naur ppp-e1266c7-orig/pppd/utils.c ppp-e1266c7/pppd/utils.c +--- ppp-e1266c7-orig/pppd/utils.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/utils.c 2024-03-15 10:55:27.176832115 +0100 +@@ -926,14 +926,14 @@ slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", PPP_PATH_LOCKDIR, dev); #endif @@ -197,7 +197,7 @@ diff -Naur pppd.orig/utils.c pppd/utils.c if (fd < 0) { if (errno == ENOENT) /* This is just a timing problem. */ continue; -@@ -933,7 +933,7 @@ +@@ -1016,7 +1016,7 @@ if (lock_file[0] == 0) return -1; -- 2.44.0

1 0

[PATCH v2 1/2] dns.cgi: Revert "dns.cgi: Fixes bug#12395 - German umlauts not correctly displayed in remarks"
by Adolf Belka 15 Mar '24

15 Mar '24

- This reverts commit 7c6ff5ff12331a53f416080a44c8d6145e78bfac - That commit removed the cleanhtml command which is not advised, based on feedback from Michael Tremer from other patch submissions as it creates a potential security problem. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/dns.cgi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi index f3dd5c7a9..0a34d3fd6 100644 --- a/html/cgi-bin/dns.cgi +++ b/html/cgi-bin/dns.cgi @@ -141,6 +141,8 @@ if (($cgiparams{'SERVERS'} eq $Lang::tr{'save'}) || ($cgiparams{'SERVERS'} eq $L # Go further if there was no error. if ( ! $errormessage) { + # Check if a remark has been entered. + $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'}); my %dns_servers = (); my $id; -- 2.44.0

2 6

Error message being shown from IPFire2.x build
by Adolf Belka 15 Mar '24

15 Mar '24

Hi All, Seems that the code that is checking if an architecture has been used in a rootfile is also looking at the Core Update update.sh file. I just got this error message. Error! 'aarch64' in rootfiles files found! ./config/rootfiles/core/185/update.sh: aarch64) Replace by xxxMACHINExxx ! The aarch64 use in update.sh makes sense as it is a command to only be run for aarch64 and not at all for x86_64. It is not a big problem and can be ignored in this case but the check code probably should only look in the common and the packages rootfile directories and sub-directories. Regards, Adolf

2 2

[PATCH] time.cgi: add current date-time to this WebGUI page
by Jon Murphy 15 Mar '24

15 Mar '24

- added words and date-time format to english (en.pl) - other languages are needed - seconds included since time is accurate to < .1s https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=2234e8aacac2e0d0b06dac4… Code-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- html/cgi-bin/time.cgi | 4 ++++ langs/en/cgi-bin/en.pl | 2 ++ 2 files changed, 6 insertions(+) diff --git a/html/cgi-bin/time.cgi b/html/cgi-bin/time.cgi index 57a02a4b6..04c1e771f 100644 --- a/html/cgi-bin/time.cgi +++ b/html/cgi-bin/time.cgi @@ -287,6 +287,10 @@ print <<END </table> END ; + +my $now = strftime($Lang::tr{'timeformat'}, localtime); +print "<hr>$Lang::tr{'system time'}: $now"; + &Header::closebox(); &Header::openbox('100%',1,$Lang::tr{'ntp sync'}); print <<END diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 667fb5d7e..2e036adb3 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2462,6 +2462,7 @@ 'system log viewer' => 'System Log Viewer', 'system logs' => 'System Logs', 'system status information' => 'System Status Information', +'system time' => 'System time (as of last page load)', 'ta key' => 'TLS-Authentification-Key', 'taa zombieload2' => 'TSX Async Abort/ZombieLoad v2', 'tcp more reliable' => 'TCP (more reliable)', @@ -2490,6 +2491,7 @@ 'time' => 'Time', 'time date manually reset' => 'Time/Date manually reset.', 'time server' => 'Time Server', +'timeformat' => '%Y-%m-%d at %H:%M:%S %Z', 'timeout must be a number' => 'Timeout must be a number.', 'title' => 'Title', 'to' => 'To', -- 2.30.2

4 7

[PATCH] dns.cgi: Add use Encode + encode back to UTF-8
by Adolf Belka 15 Mar '24

15 Mar '24

- use Encode was missed out in the previous patch for dns.cgi This would mean that the decode from UTF-8 would fail. I had tested the previous change but forgot to copy across the use Encode line when I created the patch. - This patch adds an encode back to UTF-8 after running the cleanhtml command. This way the text is decoded from UTF-8 so that the cleanhtml command works correctly on umlauted characters and then is encoded back to UTF-8 so that all text in the cgi page is UTF-8. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/dns.cgi | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi index eb6f908d5..c864c127d 100644 --- a/html/cgi-bin/dns.cgi +++ b/html/cgi-bin/dns.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2020 IPFire Development Team # +# Copyright (C) 2005-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -21,6 +21,7 @@ use strict; use IO::Socket; +use Encode; # enable only the following on debugging purpose #use warnings; @@ -151,6 +152,9 @@ if (($cgiparams{'SERVERS'} eq $Lang::tr{'save'}) || ($cgiparams{'SERVERS'} eq $L # are correctly encoded to their html entities $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'}); + # encode the text back to UTF-8 after running the cleanhtml command + $cgiparams{'REMARK'} = encode("UTF-8", $cgiparams{'REMARK'}); + my %dns_servers = (); my $id; my $status; -- 2.44.0

2 2

[PATCH] expat: Update to version 2.6.2
by Adolf Belka 14 Mar '24

14 Mar '24

- Update from version 2.6.1 to 2.6.2 - Update of rootfile - Changelog 2.6.2 Security fixes: #839 #842 CVE-2024-28757 -- Prevent billion laughs attacks with isolated use of external parsers. Please see the commit message of commit 1d50b80cf31de87750103656f6eb693746854aa8 for details. Bug fixes: #839 #841 Reject direct parameter entity recursion and avoid the related undefined behavior Other changes: #847 Autotools: Fix build for DOCBOOK_TO_MAN containing spaces #837 Add missing #821 and #824 to 2.6.1 change log #838 #843 Version info bumped from 10:1:9 (libexpat*.so.1.9.1) to 10:2:9 (libexpat*.so.1.9.2); see https://verbump.de/ for what these numbers do Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/expat | 20 ++++++++++---------- lfs/expat | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat index bb4db5687..2ab49e910 100644 --- a/config/rootfiles/common/expat +++ b/config/rootfiles/common/expat @@ -3,21 +3,21 @@ #usr/include/expat_config.h #usr/include/expat_external.h #usr/lib/cmake -#usr/lib/cmake/expat-2.6.1 -#usr/lib/cmake/expat-2.6.1/expat-config-version.cmake -#usr/lib/cmake/expat-2.6.1/expat-config.cmake -#usr/lib/cmake/expat-2.6.1/expat-noconfig.cmake -#usr/lib/cmake/expat-2.6.1/expat.cmake +#usr/lib/cmake/expat-2.6.2 +#usr/lib/cmake/expat-2.6.2/expat-config-version.cmake +#usr/lib/cmake/expat-2.6.2/expat-config.cmake +#usr/lib/cmake/expat-2.6.2/expat-noconfig.cmake +#usr/lib/cmake/expat-2.6.2/expat.cmake #usr/lib/libexpat.la #usr/lib/libexpat.so usr/lib/libexpat.so.1 -usr/lib/libexpat.so.1.9.1 +usr/lib/libexpat.so.1.9.2 #usr/lib/pkgconfig/expat.pc #usr/share/doc/expat -#usr/share/doc/expat-2.6.1 -#usr/share/doc/expat-2.6.1/ok.min.css -#usr/share/doc/expat-2.6.1/reference.html -#usr/share/doc/expat-2.6.1/style.css +#usr/share/doc/expat-2.6.2 +#usr/share/doc/expat-2.6.2/ok.min.css +#usr/share/doc/expat-2.6.2/reference.html +#usr/share/doc/expat-2.6.2/style.css #usr/share/doc/expat/AUTHORS #usr/share/doc/expat/changelog #usr/share/man/man1/xmlwf.1 diff --git a/lfs/expat b/lfs/expat index 484e27125..3a37bf2d2 100644 --- a/lfs/expat +++ b/lfs/expat @@ -24,7 +24,7 @@ include Config -VER = 2.6.1 +VER = 2.6.2 THISAPP = expat-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 21a177ae8d70ca1bf41cae75c299a3021a9fc1b9d5eb01eb2945b16d7b24dcbeabad855379bdd8a14de804e1a1648105ce03b505f68c2beb4096a81020e35848 +$(DL_FILE)_BLAKE2 = aae019270e1ab233fe8480b7eaa77f648f23ef3383dc772dc946cb13163067431716dc5446862eb502315fd089f2f52f3d476589b74a97e462575cd54df44db4 install : $(TARGET) -- 2.44.0

1 0

[PATCH] iproute2: Update to version 6.8.0
by Adolf Belka 14 Mar '24

14 Mar '24

- Update from version 6.7.0 to 6.8.0 - Update of rootfile - Changelog is only available from the git commits. https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/ Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/iproute2 | 4 +--- lfs/iproute2 | 4 ++-- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/iproute2 b/config/rootfiles/common/iproute2 index fb68e31f2..da7134d2d 100644 --- a/config/rootfiles/common/iproute2 +++ b/config/rootfiles/common/iproute2 @@ -30,8 +30,6 @@ sbin/vdpa #usr/include/iproute2/bpf_elf.h #usr/lib/tc #usr/lib/tc/experimental.dist -usr/lib/tc/m_ipt.so -usr/lib/tc/m_xt.so #usr/lib/tc/normal.dist #usr/lib/tc/pareto.dist #usr/lib/tc/paretonormal.dist @@ -129,6 +127,7 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/tc-fq_codel.8 #usr/share/man/man8/tc-fq_pie.8 #usr/share/man/man8/tc-fw.8 +#usr/share/man/man8/tc-gact.8 #usr/share/man/man8/tc-gate.8 #usr/share/man/man8/tc-hfsc.8 #usr/share/man/man8/tc-htb.8 @@ -160,7 +159,6 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/tc-tunnel_key.8 #usr/share/man/man8/tc-u32.8 #usr/share/man/man8/tc-vlan.8 -#usr/share/man/man8/tc-xt.8 #usr/share/man/man8/tc.8 #usr/share/man/man8/tipc-bearer.8 #usr/share/man/man8/tipc-link.8 diff --git a/lfs/iproute2 b/lfs/iproute2 index ce2ee1f81..17f25dddc 100644 --- a/lfs/iproute2 +++ b/lfs/iproute2 @@ -24,7 +24,7 @@ include Config -VER = 6.7.0 +VER = 6.8.0 # https://mirrors.edge.kernel.org/pub/linux/utils/net/iproute2/ THISAPP = iproute2-$(VER) @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = df55dffc54ed196d43a86ce40e887dca6390b91289a492266568ff31aa8b2827fbd91c18676e14706df844fbfe3a5c50bf927ed4401e098e385d401ec3d5c116 +$(DL_FILE)_BLAKE2 = d30cdff8522627c27c9165f068f42adbec38f15548a8f2cd31276f283880dc402e10c5989e7227e80cdc891bcc4a574b330d634ae550e689758b849c0506c31f install : $(TARGET) -- 2.44.0

1 9

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2024