Development April 2024

development@lists.ipfire.org

10 participants
35 discussions

[RFC PATCH] kernel: Enable XDP
by Michael Tremer 24 Apr '24

24 Apr '24

https://lists.ipfire.org/hyperkitty/list/development@lists.ipfire.org/threa… Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 11 ++++++++++- config/kernel/kernel.config.riscv64-ipfire | 13 ++++++++++++- config/kernel/kernel.config.x86_64-ipfire | 11 ++++++++++- 3 files changed, 32 insertions(+), 3 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index b85d7add9..3d8282ac6 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -93,9 +93,12 @@ CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y # # BPF subsystem # -# CONFIG_BPF_SYSCALL is not set +CONFIG_BPF_SYSCALL=y CONFIG_BPF_JIT=y +CONFIG_BPF_JIT_ALWAYS_ON=y CONFIG_BPF_JIT_DEFAULT_ON=y +CONFIG_BPF_UNPRIV_DEFAULT_OFF=y +# CONFIG_BPF_PRELOAD is not set # end of BPF subsystem CONFIG_PREEMPT_BUILD=y @@ -136,6 +139,7 @@ CONFIG_TREE_SRCU=y CONFIG_TASKS_RCU_GENERIC=y CONFIG_TASKS_RCU=y CONFIG_TASKS_RUDE_RCU=y +CONFIG_TASKS_TRACE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem @@ -179,6 +183,7 @@ CONFIG_PROC_PID_CPUSET=y CONFIG_CGROUP_DEVICE=y CONFIG_CGROUP_CPUACCT=y CONFIG_CGROUP_PERF=y +# CONFIG_CGROUP_BPF is not set # CONFIG_CGROUP_MISC is not set # CONFIG_CGROUP_DEBUG is not set CONFIG_SOCK_CGROUP_DATA=y @@ -1036,6 +1041,8 @@ CONFIG_XFRM_ESP=m CONFIG_XFRM_IPCOMP=m CONFIG_NET_KEY=m CONFIG_NET_KEY_MIGRATE=y +CONFIG_XDP_SOCKETS=y +CONFIG_XDP_SOCKETS_DIAG=m CONFIG_NET_HANDSHAKE=y CONFIG_INET=y CONFIG_IP_MULTICAST=y @@ -1144,6 +1151,7 @@ CONFIG_NETFILTER_SKIP_EGRESS=y CONFIG_NETFILTER_NETLINK=m CONFIG_NETFILTER_FAMILY_BRIDGE=y CONFIG_NETFILTER_FAMILY_ARP=y +CONFIG_NETFILTER_BPF_LINK=y # CONFIG_NETFILTER_NETLINK_HOOK is not set CONFIG_NETFILTER_NETLINK_ACCT=m CONFIG_NETFILTER_NETLINK_QUEUE=m @@ -6466,6 +6474,7 @@ CONFIG_HID_ZYDACRON=m # # HID-BPF support # +# CONFIG_HID_BPF is not set # end of HID-BPF support # diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 2bd39e7de..fd2172a25 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -103,8 +103,13 @@ CONFIG_HAVE_EBPF_JIT=y # # BPF subsystem # -# CONFIG_BPF_SYSCALL is not set +CONFIG_BPF_SYSCALL=y CONFIG_BPF_JIT=y +CONFIG_BPF_JIT_ALWAYS_ON=y +CONFIG_BPF_JIT_DEFAULT_ON=y +CONFIG_BPF_UNPRIV_DEFAULT_OFF=y +# CONFIG_BPF_PRELOAD is not set +# CONFIG_BPF_LSM is not set # end of BPF subsystem CONFIG_PREEMPT_VOLUNTARY_BUILD=y @@ -139,6 +144,7 @@ CONFIG_TREE_RCU=y CONFIG_TREE_SRCU=y CONFIG_TASKS_RCU_GENERIC=y CONFIG_TASKS_RUDE_RCU=y +CONFIG_TASKS_TRACE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem @@ -180,6 +186,7 @@ CONFIG_PROC_PID_CPUSET=y CONFIG_CGROUP_DEVICE=y CONFIG_CGROUP_CPUACCT=y CONFIG_CGROUP_PERF=y +# CONFIG_CGROUP_BPF is not set # CONFIG_CGROUP_MISC is not set # CONFIG_CGROUP_DEBUG is not set CONFIG_SOCK_CGROUP_DATA=y @@ -826,6 +833,8 @@ CONFIG_XFRM_ESP=m CONFIG_XFRM_IPCOMP=m CONFIG_NET_KEY=m CONFIG_NET_KEY_MIGRATE=y +CONFIG_XDP_SOCKETS=y +CONFIG_XDP_SOCKETS_DIAG=m CONFIG_NET_HANDSHAKE=y CONFIG_INET=y CONFIG_IP_MULTICAST=y @@ -934,6 +943,7 @@ CONFIG_NETFILTER_SKIP_EGRESS=y CONFIG_NETFILTER_NETLINK=y CONFIG_NETFILTER_FAMILY_BRIDGE=y CONFIG_NETFILTER_FAMILY_ARP=y +CONFIG_NETFILTER_BPF_LINK=y # CONFIG_NETFILTER_NETLINK_HOOK is not set CONFIG_NETFILTER_NETLINK_ACCT=m CONFIG_NETFILTER_NETLINK_QUEUE=m @@ -7383,6 +7393,7 @@ CONFIG_BRANCH_PROFILE_NONE=y # CONFIG_PROFILE_ANNOTATED_BRANCHES is not set # CONFIG_BLK_DEV_IO_TRACE is not set CONFIG_UPROBE_EVENTS=y +CONFIG_BPF_EVENTS=y CONFIG_DYNAMIC_EVENTS=y CONFIG_PROBE_EVENTS=y CONFIG_FTRACE_MCOUNT_RECORD=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 8ce66cb4f..ec3bca2e7 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -113,9 +113,12 @@ CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y # # BPF subsystem # -# CONFIG_BPF_SYSCALL is not set +CONFIG_BPF_SYSCALL=y CONFIG_BPF_JIT=y +CONFIG_BPF_JIT_ALWAYS_ON=y CONFIG_BPF_JIT_DEFAULT_ON=y +CONFIG_BPF_UNPRIV_DEFAULT_OFF=y +# CONFIG_BPF_PRELOAD is not set # end of BPF subsystem CONFIG_PREEMPT_BUILD=y @@ -156,6 +159,7 @@ CONFIG_TREE_SRCU=y CONFIG_TASKS_RCU_GENERIC=y CONFIG_TASKS_RCU=y CONFIG_TASKS_RUDE_RCU=y +CONFIG_TASKS_TRACE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem @@ -199,6 +203,7 @@ CONFIG_PROC_PID_CPUSET=y CONFIG_CGROUP_DEVICE=y CONFIG_CGROUP_CPUACCT=y CONFIG_CGROUP_PERF=y +# CONFIG_CGROUP_BPF is not set # CONFIG_CGROUP_MISC is not set # CONFIG_CGROUP_DEBUG is not set CONFIG_SOCK_CGROUP_DATA=y @@ -1099,6 +1104,8 @@ CONFIG_XFRM_ESP=m CONFIG_XFRM_IPCOMP=m CONFIG_NET_KEY=m CONFIG_NET_KEY_MIGRATE=y +CONFIG_XDP_SOCKETS=y +CONFIG_XDP_SOCKETS_DIAG=m CONFIG_NET_HANDSHAKE=y CONFIG_INET=y CONFIG_IP_MULTICAST=y @@ -1207,6 +1214,7 @@ CONFIG_NETFILTER_SKIP_EGRESS=y CONFIG_NETFILTER_NETLINK=y CONFIG_NETFILTER_FAMILY_BRIDGE=y CONFIG_NETFILTER_FAMILY_ARP=y +CONFIG_NETFILTER_BPF_LINK=y # CONFIG_NETFILTER_NETLINK_HOOK is not set CONFIG_NETFILTER_NETLINK_ACCT=m CONFIG_NETFILTER_NETLINK_QUEUE=m @@ -5861,6 +5869,7 @@ CONFIG_HID_SENSOR_HUB=m # # HID-BPF support # +# CONFIG_HID_BPF is not set # end of HID-BPF support # -- 2.39.2

3 5

Enable eBPF XDP/TC kernel feature for IPFire
by Vincent Li 24 Apr '24

24 Apr '24

Hi, I have been working on enabling eBPF XDP/TC kernel feature for IPFire, please refer to https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.s… for where XDP fit in Linux network datapath, XDP will not interfere with existing IPFire firewall rules. XDP is especially good at DDoS packet filtering at high speed, see https://netdevconf.info/0x15/slides/30/Netdev%200x15%20Accelerating%20synpr… I think we only need to enable XDP/TC network filtering capability without eBPF tracing capability which some users are concerned about potential host security information leaks. Please let me know what you think, thanks! Vincent

4 12

[PATCH 1/2] libhtp: Update to 0.5.48
by Michael Tremer 24 Apr '24

24 Apr '24

https://github.com/OISF/libhtp/releases/tag/0.5.48 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/libhtp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/libhtp b/lfs/libhtp index cbd4cb093..d3b56dcb2 100644 --- a/lfs/libhtp +++ b/lfs/libhtp @@ -24,7 +24,7 @@ include Config -VER = 0.5.47 +VER = 0.5.48 THISAPP = libhtp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a2a126052ea528b84dfffd7926a80e633f649968bf098e3ff0f49d441821723a4d3f78f0f15d530e9ce9e393c6173aceced8c0d863afecbe65c736e4ab874a03 +$(DL_FILE)_BLAKE2 = 56eeef3524ffeac593c251846196d09e0ccfacd9aadd03b35061fd1fe6a245d1374c338581b4f7bee67255797740f4e282344fc10bf3d0c0fdf824f159380053 install : $(TARGET) -- 2.39.2

1 1

[PATCH] kmod: Update to 32
by Peter Müller 23 Apr '24

23 Apr '24

Changelog according to the tarball's NEWS file: - Improvements - Use any hash algo known by kernel/openssl instead of keep needing to update the mapping - Teach kmod to load modprobe.d/depmod.d configuration from ${prefix}/lib and allow it to be overriden during build with --with-distconfdir=DIR - Make kernel modules directory configurable. This allows distro to make kmod use only files from /usr regardless of having a compat symlink in place. - Install kmod.pc containing the features selected at build time. - Install all tools and symlinks by default. Previously kmod relied on distro packaging to set up the symlinks in place like modprobe, depmod, lsmod, etc. Now those symlinks are created by kmod itself and they are always placed in $bindir. - Bug Fixes - Fix warnings due to -Walloc-size - Others - Drop python bindings. Those were not update in ages and not compatible with latest python releases. - Cleanup test infra, dropping what was not used anymore - Drop experimental tools `kmod insert` / `kmod remove`. Building those was protected by a configure option never set by distros. They also didn't gain enough traction to replace the older interfaces via modprobe/insmod/rmmod. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/kmod | 2 +- lfs/kmod | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/kmod b/config/rootfiles/common/kmod index 1a0432169..ed30ab10d 100644 --- a/config/rootfiles/common/kmod +++ b/config/rootfiles/common/kmod @@ -9,6 +9,6 @@ sbin/rmmod #usr/lib/libkmod.la #usr/lib/libkmod.so usr/lib/libkmod.so.2 -usr/lib/libkmod.so.2.4.1 +usr/lib/libkmod.so.2.4.2 #usr/lib/pkgconfig/libkmod.pc #usr/share/bash-completion/completions/kmod diff --git a/lfs/kmod b/lfs/kmod index 643573d33..2719083e5 100644 --- a/lfs/kmod +++ b/lfs/kmod @@ -24,7 +24,7 @@ include Config -VER = 31 +VER = 32 THISAPP = kmod-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0dc8572da570315cf0aadd87fa7e83d0f88dea91c8566749e6f3004f9a6df916dce337ca99ea5929d41f45b408c1e3effa50f9d24615d7fa28688150a5ce91cf +$(DL_FILE)_BLAKE2 = 5b5dac4639406549b23bb1da44bedd86a42885304ef4c7c67344dc8fd70b9e0ca3f83d033c6b80f6e00371d7188e205f4b68fadc56a9ddbf9d6a9d28e9b1e9a4 install : $(TARGET) -- 2.35.3

2 1

[PATCH] strongSwan: Update to 5.9.14
by Peter Müller 23 Apr '24

23 Apr '24

Please see https://github.com/strongswan/strongswan/releases/tag/5.9.14 for the changelog of this version. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/strongswan | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/strongswan b/lfs/strongswan index d002290f7..9b2a5bc9f 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 5.9.13 +VER = 5.9.14 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 1d60864a557cf14e84c62d4c04ae64eb24331e2576c157b276cf13691ac2a7f5d1b92925e4c3e6ab51dc1f6f64aeb7c60ffb16309673a9f78a73f652cb24da8c +$(DL_FILE)_BLAKE2 = 8b64903cfa087d42ae0895e7c11a2fcbd9c6a4a4241548d947753e081a4a4e3c5946e5cf4bbd326840e596e51c61554146f007e6882f11c874454b9480f6f7a6 install : $(TARGET) -- 2.35.3

2 1

[PATCH] Lynis: Update to 3.1.1
by Peter Müller 23 Apr '24

23 Apr '24

Please see https://cisofy.com/changelog/lynis/#311 for the changelogs since version 3.0.9. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/lynis | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/lynis b/lfs/lynis index eb906dbeb..38ebac9c6 100644 --- a/lfs/lynis +++ b/lfs/lynis @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Security and System auditing tool -VER = 3.0.9 +VER = 3.1.1 THISAPP = lynis-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = lynis -PAK_VER = 13 +PAK_VER = 14 DEPS = @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = dc7912c7d1782c3ffdf369cc7f0f004267bd2a2c408982909e654db14ecfa83ebdbd2f731c3d3ee8864e7de21945b1faa2f9d2845dedf3e742a4c79c62373eda +$(DL_FILE)_BLAKE2 = 056e689f00ac0fa74bd1a6dc3915cbd70f28cdb5461e0749b68ce2cf84e425c295425f7bb6d5aeb0208693a0e38290cb90925e392928257c79bc5887f6e58498 install : $(TARGET) -- 2.35.3

2 1

[PATCH] Tor: Update to 0.4.8.11
by Peter Müller 23 Apr '24

23 Apr '24

Full changelog according to https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.8.11/ChangeLog: Changes in version 0.4.8.11 - 2024-04-10 This is a minor release mostly to upgrade the fallbackdir list. Worth noting also that directory authority running this version will now automatically reject relays running the end of life 0.4.7.x version. o Minor feature (authority): - Reject 0.4.7.x series at the authority level. Closes ticket 40896. o Minor feature (dirauth, tor26): - New IP address and keys. o Minor feature (directory authority): - Allow BandwidthFiles "node_id" KeyValue without the dollar sign at the start of the hexdigit, in order to easier database queries combining Tor documents in which the relays fingerprint does not include it. Fixes bug 40891; bugfix on 0.4.7 (all supported versions of Tor). o Minor features (fallbackdir): - Regenerate fallback directories generated on April 10, 2024. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2024/04/10. o Minor bugfixes (directory authorities): - Add a warning when publishing a vote or signatures to another directory authority fails. Fixes bug 40910; bugfix on 0.2.0.3-alpha. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/tor b/lfs/tor index aed30805f..488415902 100644 --- a/lfs/tor +++ b/lfs/tor @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Anonymizing overlay network for TCP (The onion router) -VER = 0.4.8.10 +VER = 0.4.8.11 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 84 +PAK_VER = 85 DEPS = libseccomp @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ef470664d85e019f6cac2366e934d5dc31b8ae92f121a2b4c8c95f8267abce5ce4413d30a24affa40a069d587212364ae5a7c3cd114488e50a535f01c54c6e77 +$(DL_FILE)_BLAKE2 = b7f5bb855a6f8fe7dfd0e0efe7b48798e9d4642e401641c83554ed0f98fe238a5f303e9466e9e24a7ade63488a745b3c957ed6cc53a2f5e21f5f9c3f78f7fa78 install : $(TARGET) -- 2.35.3

2 1

[PATCH 1/3] linux: Properly load Landlock module
by Peter Müller 22 Apr '24

22 Apr '24

Fixes: #13645 Tested-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.riscv64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index b85d7add9..af8aae163 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -8066,7 +8066,7 @@ CONFIG_INTEGRITY=y # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set # CONFIG_EVM is not set CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf" # # Kernel hardening options diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 2bd39e7de..ca603ad93 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -6745,7 +6745,7 @@ CONFIG_INTEGRITY=y # CONFIG_IMA is not set # CONFIG_EVM is not set CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf" # # Kernel hardening options diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 8ce66cb4f..fa943a2bb 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -7252,7 +7252,7 @@ CONFIG_INTEGRITY=y # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set # CONFIG_EVM is not set CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf" # # Kernel hardening options -- 2.35.3

1 2

[PATCH] apache: Update to 2.4.59
by Matthias Fischer 22 Apr '24

22 Apr '24

For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.59 Fixes CVE-2024-27316 / CVE-2024-24795 / CVE-2023-38709 Previously applied patch (apache-2.4.58_mod_xml2enc_remove_dependency_on_xmlstring_header.patch) has been removed - is now included. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/apache2 | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index c1973e6d5..0851471fe 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 2.4.58 +VER = 2.4.59 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 2105b8fada99f1dda55201ed89ed5326f0edb078d352cbff44f02cde80d129b65b63e07366a9a744ba474be5687fa8d3d2d8ddc64ac914b47166607f3f4a9de2 +$(DL_FILE)_BLAKE2 = 836e3538a120d71c016149397a4efd61ae6acd8a8fb9d2ce117c7d86209c4b40c0be3c464007891f28c58182e9d40a8793abe9e94e642354492954af91d9878c install : $(TARGET) @@ -75,7 +75,6 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/apache-2.4.58_mod_xml2enc_remove_dependency_on_xmlstring_header.patch ### Add IPFire's layout, too echo "# IPFire layout" >> $(DIR_APP)/config.layout echo "<Layout IPFire>" >> $(DIR_APP)/config.layout -- 2.34.1

3 4

Re: IPFire 2.29 - Core Update 185 released
by Adolf Belka 22 Apr '24

22 Apr '24

Hi Michael, I am sorry but the ovpn.cnf file was not updated with CU185 full release. I don't understand this as I tested it with CU185 Testing and cleared the OpenVPN x509 certificate set and recreated it successfully. However now with CU185 full release it is not working because the ovpn.cnf was not changed. I checked the exclude file in the config/rootfile/core/185 directory and it has the line /var/ipfire/ovpn Does this mean that everything under ovpn is excluded from being updated? If yes then that would explain why it is not working now with the full release but would not explain why it worked for me with CU185 Testing. How do we deal with this now. Sorry, Adolf. On 17/04/2024 18:10, IPFire Project wrote: > I am happy to announce that we finally have a new release of IPFire: IPFire 2.29 - Core Update 185. It comes with a brand new IPFire IPS based on Suricata 7, a number of bug fixes across the distribution and a good amount of package updates. > ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ > > > IPFire_ > > > IPFire 2.29 - Core Update 185 released > > I am happy to announce that we finally have a new release of IPFire: IPFire 2.29 - Core Update 185. It comes with a brand new IPFire IPS based on Suricata 7, a number of bug fixes across the distribution and a good amount of package updates. > > Read The Full Post On Our Blog <https://www.ipfire.org/blog/ipfire-2-29-core-update-185-released?utm_medium…> > > The IPFire Project, c/o Lightning Wire Labs GmbH, Gerhardstraße 8, 45711 Datteln, Germany > > Unsubscribe <https://www.ipfire.org/unsubscribe> >

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2024