Development July 2024

development@lists.ipfire.org

9 participants
39 discussions

[PATCH] Updates to u-boot script for Raspberry Pi 4b devices
by Craig Setera 22 Sep '24

22 Sep '24

Updates to u-boot script for Raspberry Pi 4b devices to properly configure the serial console and to choose the proper boot address to be used on newer board revisions. With these changes in place, I'm able to fully boot into a serial console in u-boot. The serial console configuration was derived from the Grub configuration, while the boot address changes were taken from the IPFire Raspberry 4b documentation page: https://www.ipfire.org/docs/hardware/arm/rpi/four Per the conversation in the forums, I don't know why the boot address changes are required. I was simply trying to automate those changes such that downloaded builds will work out of the box. https://community.ipfire.org/t/hang-with-kernel-starting-on-raspberry-pi/11… NOTE: The use of the different parameter options to the test command to minimize the need for deeply nested conditionals. I did try more bash-shell like syntax, but u-boot didn't seem to like that. The operators used here were found in the u-boot source. Tested-by: Craig Setera <craigjunk(a)setera.org> Signed-off-by: Craig Setera <craigjunk(a)setera.org> --- config/u-boot/boot.cmd | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/config/u-boot/boot.cmd b/config/u-boot/boot.cmd index a27996780..eedd5776d 100644 --- a/config/u-boot/boot.cmd +++ b/config/u-boot/boot.cmd @@ -51,7 +51,11 @@ if test "${SERIAL-CONSOLE}" = "ON"; then if test "${fdtfile}" = "broadcom/bcm2837-rpi-3-b.dtb"; then setenv console ttyS1,115200n8; else - setenv console ttyAMA0,115200n8; + if test "${fdtfile}" = "broadcom/bcm2711-rpi-4-b.dtb"; then + setenv console ttyS0,115200n8; + else + setenv console ttyAMA0,115200n8; + fi; fi; fi; else @@ -95,11 +99,28 @@ else setenv ramdisk_addr -; fi; +# +# Handle Raspberry Pi 4 address differences +# https://www.ipfire.org/docs/hardware/arm/rpi/four +# +setenv booti_fdt_addr ${fdt_addr_r}; +if test "${board}" -eq "rpi" -a ${cpu} -eq "armv8" -a "${fdtfile}" -eq "broadcom/bcm2711-rpi-4-b.dtb"; then + # Hardware revision 1.4 + if test ${board_revision} -eq 0xB03114 -o ${board_revision} -eq 0xC03114 -o ${board_revision} -eq 0xD03114; then + setenv booti_fdt_addr ${fdt_addr}; + fi + + # Hardware revision 1.5 + if test ${board_revision} -eq 0xB03115 -o ${board_revision} -eq 0xC03115 -o ${board_revision} -eq 0xD03115; then + setenv booti_fdt_addr ${fdt_addr}; + fi +fi; + bootz ${kernel_addr_r} ${ramdisk_addr} ${fdt_addr_r}; -booti ${kernel_addr_r} ${ramdisk_addr} ${fdt_addr_r}; +booti ${kernel_addr_r} ${ramdisk_addr} ${booti_fdt_addr}; bootz ${kernel_addr_r} - ${fdt_addr_r}; -booti ${kernel_addr_r} - ${fdt_addr_r}; +booti ${kernel_addr_r} - ${booti_fdt_addr}; # Recompile with: # mkimage -C none -A arm -T script -d /boot/boot.cmd /boot/boot.scr -- 2.40.1

2 6

Test of cleanup branch
by Adolf Belka 08 Aug '24

08 Aug '24

Hi Michael, I installed CU188 from the nightly onto a vm system and looked though all the WUI pages and everything looked fine. I then restored a CU187 backup from my testing and then checked the OpenVPN RW and N2N. Both worked fine with no problems. Also the logging for that all worked with no problems. Also checked out the IPS, IP Blocklists, Firewall groups and rules, DNS ... Everything I have looked at shows no impact from the cleanup branch changes. It looks good to me. Of course good for others to also evaluate. Regards, Adolf.

2 20

The unshared changes give a problem with build after doing git pull on next
by Adolf Belka 02 Aug '24

02 Aug '24

Hi Michael, I ran git pull origin next on my local repo and then went to try a package update build. The gettoolchain and downloadsrc worked fine. However the ./make.sh clean just came straight back to the cursor without removing any of the directories in my repo. I am now using my master repo version for doing the package update but something has gone wrong with the unshared migration because the clean command worked fine when it was in your own repo. Regards, Adolf.

3 9

[PATCH] RPZ: install new add-on
by Jon Murphy 30 Jul '24

30 Jul '24

What is it? Response Policy Zone (RPZ) is a mechanism to define local policies in a standardised way and load those policies from external sources. Bottom line: RPZ allows admins to easily block access to websites via DNS lookup. RPZ can block websites via categories. Examples include: fake websites, annoying pop-up ads, newly registered domains, DoH bypass sites, bad "host" services, maliscious top level domains (e.g., *.zip, *.mov), piracy, gambling, pornography, and more. RPZ lists come from various RPZ providers and their available catagories. This RPZ add-on enables the RPZ functionality by adding a couple lines in a configuration file. This add-on simply adds a configuration file and adds three scripts (config, metrics and sleep) to make RPZ easier for the admin to use. RPZ was release in 2010 and has been part of the IPFire build since ~2015. Why is it needed? Some IPFire admin's utilize pihole to block unwanted websites via DNS lookup. Moving the pihole base functionality (without pretty graphs) to IPFire removes one device from the admin's local network. And hopefully this reduces the pihole questions from the Community. A list of RPZ providers can be recommended by IPFire and coded into a set list. Or, if prefered, the local admin can choose their own RPZ providers. This is a: * simple replacement for pihole base functionality * RPZ can be a nice replacement for the URL Filter IPFire Wiki In process at: https://www.ipfire.org/docs/addons/rpz more info: * https://en.wikipedia.org/wiki/Response_policy_zone * https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering/rpz.html I need help with... 1) The custom allow and block lists are currently located at `/var/ipfire/rpz`. Is this correct? 2) The three bash scripts are currently located at `/usr/sbin`. Is this correct? Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/backup/includes/rpz | 5 + config/rootfiles/packages/rpz | 11 ++ config/rpz/00-rpz.conf | 18 ++++ config/rpz/rpz-config | 194 ++++++++++++++++++++++++++++++++++ config/rpz/rpz-metrics | 143 +++++++++++++++++++++++++ config/rpz/rpz-sleep | 58 ++++++++++ lfs/rpz | 88 +++++++++++++++ make.sh | 2 + 8 files changed, 519 insertions(+) create mode 100644 config/backup/includes/rpz create mode 100644 config/rootfiles/packages/rpz create mode 100644 config/rpz/00-rpz.conf create mode 100644 config/rpz/rpz-config create mode 100644 config/rpz/rpz-metrics create mode 100644 config/rpz/rpz-sleep create mode 100644 lfs/rpz diff --git a/config/backup/includes/rpz b/config/backup/includes/rpz new file mode 100644 index 000000000..4d59bb40c --- /dev/null +++ b/config/backup/includes/rpz @@ -0,0 +1,5 @@ +/var/ipfire/rpz/allowlist +/var/ipfire/rpz/blocklist +/etc/unbound/zonefiles/allow.rpz +/etc/unbound/zonefiles/block.rpz +/etc/unbound/local.d/*rpz.conf diff --git a/config/rootfiles/packages/rpz b/config/rootfiles/packages/rpz new file mode 100644 index 000000000..2ffa715dd --- /dev/null +++ b/config/rootfiles/packages/rpz @@ -0,0 +1,11 @@ +etc/unbound/local.d/00-rpz.conf +etc/unbound/zonefiles +etc/unbound/zonefiles/allow.rpz +etc/unbound/zonefiles/block.rpz +usr/sbin/rpz-config +usr/sbin/rpz-metrics +usr/sbin/rpz-sleep +var/ipfire/backup/addons/includes/rpz +var/ipfire/rpz +var/ipfire/rpz/allowlist +var/ipfire/rpz/blocklist diff --git a/config/rpz/00-rpz.conf b/config/rpz/00-rpz.conf new file mode 100644 index 000000000..72c1d12e5 --- /dev/null +++ b/config/rpz/00-rpz.conf @@ -0,0 +1,18 @@ +server: + module-config: "respip validator iterator" + +rpz: + name: allow.rpz + zonefile: /etc/unbound/zonefiles/allow.rpz + rpz-action-override: passthru + rpz-log: yes + rpz-log-name: allow + rpz-signal-nxdomain-ra: yes + +rpz: + name: block.rpz + zonefile: /etc/unbound/zonefiles/block.rpz + rpz-action-override: nxdomain + rpz-log: yes + rpz-log-name: block + rpz-signal-nxdomain-ra: yes diff --git a/config/rpz/rpz-config b/config/rpz/rpz-config new file mode 100644 index 000000000..98dc0a4ca --- /dev/null +++ b/config/rpz/rpz-config @@ -0,0 +1,194 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +# v22 - 2024-07-12 + +############### Functions ############### + +msg_log () { + /usr/bin/logger --tag "${tagName}" "$*" + if tty --silent ; then + echo "${tagName}:" "$*" + fi +} + +check_name () { + local testName="${1}" + # check for a valid name + regex='^[a-zA-Z0-9_]+$' + if [[ ! "${testName}" =~ $regex ]] ; then + msg_log "error: rpz: the NAME is not valid: \"${testName}\". exit." + exit 1 + fi +} + +check_unbound_conf () { + # check the above config files + msg_log "info: rpz: check for errors with \"unbound-checkconf\"" + /usr/sbin/unbound-checkconf + exit_code=$? + if [[ "${exit_code}" -ne 0 ]] ; then + msg_log "error: rpz: unbound-checkconf. exit." + exit "${exit_code}" + fi +} + +make_rpz_file () { + local theType="${1}" # allow or block + + theList="/var/ipfire/rpz/${theType}list" # input user list of domains + theZoneFile="/etc/unbound/zonefiles/${theType}.rpz" # output file for RPZ + + theAction='.' + if [[ "${theType}" =~ "block" ]] ; then + theAction='rpz-passthru.' + fi + + # does a list exist? + if [[ -s "${theList}" ]] ; then + # drop any extra "blanks" and add "CNAME <RPZ action>." to each line + actionList=$( /usr/bin/awk '{$1=$1};1' "${theList}" | + /bin/sed "/^[^;].*[[:alnum:]]/ s|$| CNAME ${theAction}|" ) + + msg_log "info: rpz: create zonefile for ${theList}" + + /bin/cat <<-EOF > "${theZoneFile}" + ; Name: ${theType} list + ; Last modified: $(date "+%Y-%m-%d at %H.%M.%S %Z") + ; + ; domains with actions list + ; + ${actionList} + EOF + + # reload the zone that was just updated + zoneBase=$( basename "${theZoneFile}" ) + /usr/sbin/unbound-control auth_zone_reload -q "${zoneBase}" + fi +} + +############### Main ############### + +tagName="unbound" + +theAction="${1}" # input action +theName="${2}" # input RPZ name +theURL="${3}" # input RPZ URL + +check_name "${theName}" # is this a valid name? + +rpzConfig="/etc/unbound/local.d/${theName}.rpz.conf" # output zone conf file +rpzFile="/etc/unbound/zonefiles/${theName}.rpz" # output for RPZ file + +case "${theAction}" in + + # add new rpz list + add ) + # does this config already exist? If yes, then exit + if [[ -f "${rpzConfig}" ]] ; then + msg_log "info: rpz: ${rpzConfig} already exists. exit" + exit 1 + fi + + # is this a valid URL? + regex='^https://[-[:alnum:]\+&@#/%?=~_|!:,.;]*[-[:alnum:]\+&@#/%=~_|]' + if ! [[ "${theURL}" =~ $regex ]] ; then + msg_log "error: rpz: the URL is not valid: \"${theURL}\". exit." + exit 1 + fi + + # create the zone config file + msg_log "info: rpz: add config file \"${theName}.rpz.conf\"" + cat <<-EOF > "${rpzConfig}" + rpz: + name: ${theName}.rpz + zonefile: /etc/unbound/zonefiles/${theName}.rpz + url: ${theURL} + rpz-action-override: nxdomain + rpz-log: yes + rpz-log-name: ${theName} + rpz-signal-nxdomain-ra: yes + EOF + + # set-up zone file + /usr/bin/touch "${rpzFile}" + # unbound requires these settings for rpz files + /bin/chown --verbose nobody:nobody "${rpzFile}" + /bin/chmod --verbose 644 "${rpzFile}" + ;; + + # trash config file & rpz file + remove ) + if ! [[ -f "${rpzConfig}" ]] ; then + msg_log "info: rpz: ${rpzConfig} does not exist. exit" + exit 1 + fi + + msg_log "info: rpz: remove config file & rpz file \"${theName}\"" + /bin/rm --verbose "${rpzConfig}" + /bin/rm --verbose "${rpzFile}" + + check_unbound_conf + ;; + + # make a new allow or block rpz file + make ) + case "${theName}" in + allow ) + make_rpz_file allow + ;; + + block ) + make_rpz_file block + ;; + + allowblock ) + make_rpz_file allow + make_rpz_file block + ;; + + * ) + msg_log "error: rpz: the NAME is not valid: \"${theName}\". exit." + exit 1 + ;; + esac + + check_unbound_conf + ;; + + *) + msg_log "error: rpz: missing or incorrect parameter" + /usr/bin/printf "Usage: rpzConfig.sh <ACTION> <NAME> <URL>\n" + exit 1 + ;; + +esac + +# reload due to the changes +msg_log "rpz: running \"unbound-control reload\"" +/usr/sbin/unbound-control reload +exit_code=$? +if [[ "${exit_code}" -ne 0 ]] ; then + msg_log "error: rpz: unbound-control \"${theName}\". exit." + exit "${exit_code}" +fi + +exit diff --git a/config/rpz/rpz-metrics b/config/rpz/rpz-metrics new file mode 100644 index 000000000..0f97c7911 --- /dev/null +++ b/config/rpz/rpz-metrics @@ -0,0 +1,143 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +# v18 on 2024-07-05 + +############### Main ############### + +weeks="${1:-2}" # default to two message logs +sortBy="${2:-name}" # by name or by hits + +# get the list of message logs for N weeks +messageLogs=$( find /var/log/messages* -type f | + /usr/bin/sort --version-sort | + head -"${weeks}" ) + +# get the list of RPZ names & counts from the message log(s) +rpzNameCount=$( for logf in ${messageLogs} ; do + /usr/bin/zgrep --text --fixed-strings 'info: rpz: applied' "${logf}" | + /usr/bin/awk '$10 ~ /\[\w*]/ { print $10 }' ; + done | /usr/bin/sort | /usr/bin/uniq --count ) + +# flip results and remove brackets `[` and `]` +rpzNameCount=$( /bin/echo "${rpzNameCount}" | + /usr/bin/awk '{ print $2, $1 }' | + /bin/sed --regexp-extended 's|^\[(.*)\]|\1|' ) + +# grab only names +rpzNames=$( /bin/echo "${rpzNameCount}" | /usr/bin/awk '{ print $1 }' ) + +# get list of RPZ files +rpzFileList=$( /bin/find /etc/unbound/zonefiles -type f -iname "*.rpz" ) + +# get basename of those files +rpzBaseNames=$( /bin/echo "${rpzFileList}" | + /bin/sed 's|/etc/unbound/zonefiles/||g ; s|\.rpz||g ;' ) + +# add to rpzNames +rpzNames="${rpzNames}"$'\n'"${rpzBaseNames}" + +# drop duplicate names +rpzNames=$( echo "${rpzNames}" | /usr/bin/sort --unique ) + +# get line count for each RPZ +lineCount=$( /bin/echo "${rpzFileList}" | /usr/bin/xargs wc -l ) + +# get comment line count and blank line count for each RPZ +commentCount=$( /bin/echo "${rpzFileList}" | + /usr/bin/xargs /bin/grep --count -e "^$" -e "^;" ) + +# get modified date each RPZ +modDateList=$( /bin/echo "${rpzFileList}" | xargs stat -c '%.10y %n' ) + +ucListAuthZones=$( /usr/sbin/unbound-control list_auth_zones ) + +# get width of RPZ names +pWidth=$( /bin/echo "${rpzNames}" | /usr/bin/awk '{ print $1" " }' | wc -L ) +pFormat="%-${pWidth}s %-8s %-8s %-8s %10s %12s\n" + +# print title line +printf "${pFormat}" "name" "hits" "active" "lines" "hits/line%" "last update" +printf -- "--------------" + +theResults="" +totalLines=0 +totalHits=0 +while read -r theName +do + printf -- "-" # pretend progress bar + # get hit count + theHits="0" + if output=$( /bin/grep "^${theName}\s" <<< "${rpzNameCount}" ) ; then + theHits=$( /bin/echo "${output}" | + /usr/bin/awk '{ print $2 }' ) + totalHits=$(( totalHits + theHits )) + fi + + # is this RPZ list active? + theActive="disabled" + if /bin/grep --quiet "^${theName}\.rpz" <<< "${ucListAuthZones}" + then + theActive="enabled" + fi + + # get line count then subtract comment count and blank line count + # from total line count + theLines="n/a" + hitsPerLine="0" + if output=$( /bin/grep --fixed-strings "/${theName}.rpz" <<< "${lineCount}" ) ; then + theLines=$( /bin/echo "${output}" | /usr/bin/awk '{ print $1 }' ) + totalLines=$(( totalLines + theLines )) + + #hitsPerLine=$( echo "scale=0 ; $theHits / $theLines" | bc ) + hitsPerLine=$(( 100 * theHits / theLines )) + fi + + # get modification date + theModDate="n/a" + if output=$( /bin/grep --fixed-strings "/${theName}.rpz" <<< "${modDateList}" ) ; then + theModDate=$( /bin/echo "${output}" | /usr/bin/awk '{ print $1 }' ) + fi + + # add to results list + theResults+="${theName} ${theHits} ${theActive} ${theLines} ${hitsPerLine} ${theModDate}"$'\n' +done <<< "${rpzNames}" + +case "${sortBy}" in + names|name) sortArg=(-k3,3r -k1,1) ;; # sort by "active" then by "name" + + hits|hit) sortArg=(-k3,3r -k2,2nr -k1,1) ;; # sort by "active" then by "hits" then by "name" + + lines|line) sortArg=(-k3,3r -k4,4nr -k1,1) ;; # sort by "active" then by "lines" then by "name" +esac + +printf -- "--------------\n" +# remove blank lines, sort, print as columns +/bin/echo "${theResults}" | + /usr/bin/awk '!/^[[:space:]]*$/' | + /usr/bin/sort "${sortArg[@]}" | + /usr/bin/awk --assign=width="${pWidth}" \ + '{ printf "%-*s %-8s %-8s %-8s %10s %12s\n", width, $1, $2, $3, $4, $5, $6 }' + +printf "${pFormat}" "" "=======" "" "========" "" "" +printf "${pFormat}" "Totals -->" "${totalHits}" "" "${totalLines}" "" "" + +exit diff --git a/config/rpz/rpz-sleep b/config/rpz/rpz-sleep new file mode 100644 index 000000000..eeef1174a --- /dev/null +++ b/config/rpz/rpz-sleep @@ -0,0 +1,58 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +# v04 on 2024-07-05 + +############### Functions ############### + +# send message to message log +msg_log () { + /usr/bin/logger --tag "${tagName}" "$*" + if /usr/bin/tty --silent ; then + echo "${tagName}:" "$*" + fi +} + +############### Main ############### + +tagName="unbound" + +sleepTime="${1:-5m}" # default to sleep for 5m (5 minutes) + +zoneList=$( /usr/sbin/unbound-control list_auth_zones | /usr/bin/awk '{print $1}' ) + +for zone in ${zoneList} ; do + /usr/bin/printf "disable ${zone}\t" + /usr/sbin/unbound-control rpz_disable "${zone}" +done + +msg_log "info: rpz: disabled all zones for ${sleepTime}" + +/bin/sleep "${sleepTime}" + +for zone in ${zoneList} ; do + /usr/bin/printf "enable ${zone}\t" + /usr/sbin/unbound-control rpz_enable "${zone}" +done + +msg_log "info: rpz: enabled all zones" + +exit diff --git a/lfs/rpz b/lfs/rpz new file mode 100644 index 000000000..319c10b7f --- /dev/null +++ b/lfs/rpz @@ -0,0 +1,88 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +SUMMARY = response policy zone - RPZ reputation system for unbound DNS + +VER = 1.0.0 + +THISAPP = rpz-$(VER) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +PROG = rpz +PAK_VER = 1 + +DEPS = + +SERVICES = + +############################################################################### +# Top-level Rules +############################################################################### + +install : $(TARGET) + +check : + +download : + +b2 : + +dist: + @$(PAK) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : + @$(PREBUILD) + @rm -rf $(DIR_APP) + + # install RPZ scripts + install -v -m 755 \ + $(DIR_CONF)/rpz/{rpz-config,rpz-metrics,rpz-sleep} -t /usr/sbin + + # Install settings folder and two empty files + mkdir -pv /var/ipfire/rpz + touch /var/ipfire/rpz/allowlist + touch /var/ipfire/rpz/blocklist + + # Add conf file to /etc directory + cp -vf $(DIR_CONF)/rpz/00-rpz.conf /etc/unbound/local.d + + # create zonefiles directory for the RPZ files and add two empty RPZ + # files to avoid a unbound config error + mkdir -pv /etc/unbound/zonefiles + chown -v nobody:nobody /etc/unbound/zonefiles + touch /etc/unbound/zonefiles/allow.rpz + touch /etc/unbound/zonefiles/block.rpz + + # Install backup definition + cp -vf $(DIR_CONF)/backup/includes/rpz /var/ipfire/backup/addons/includes/rpz + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 9bbbeb0f1..886d3760a 100755 --- a/make.sh +++ b/make.sh @@ -1721,6 +1721,8 @@ buildipfire() { lfsmake2 btrfs-progs lfsmake2 inotify-tools lfsmake2 grub-btrfs + lfsmake2 rpz + # Kernelbuild ... current we have no platform that need # multi kernel builds so KCFG is empty -- 2.30.2

4 6

[PATCH] rrdtool: Update tp 1.9.0
by Matthias Fischer 30 Jul '24

30 Jul '24

For details see: https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.9.0 "RRDtool 1.9.0 — 2024-07-29 Bugfixes Fix ytop and ybase adjustments for overlaping area issue on transparent areas @turban Suppress warnings of implicit fall through @youpong Update tarball download link in doc @c72578 Fix unsigned integer overflow in rrdtool first. Add test for rrd_first() @c72578 Fix tests under MSYS2 (Windows) @c72578 Fix BUILD_DATE in rrdtool help output @c72578 acinclude.m4: Include <stdlib.h> when using exit @ryandesign rrdtool-release: Create NUMVERS from VERSION file @c72578 Avoids leaking of file descriptors in multi threaded programs by @ensc Avoids potential unterminated string because of fixed PATH_MAX buffer Fix extra reference of parameters of rrd_fetch_dbi_{long,double} @jamborm" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/rrdtool | 196 ++++++++++++++++---------------- lfs/rrdtool | 6 +- 2 files changed, 101 insertions(+), 101 deletions(-) diff --git a/config/rootfiles/common/rrdtool b/config/rootfiles/common/rrdtool index d7503ba15..67d9ea93e 100644 --- a/config/rootfiles/common/rrdtool +++ b/config/rootfiles/common/rrdtool @@ -20,104 +20,104 @@ usr/lib/perl5/site_perl/5.36.0/xxxMACHINExxx-linux-thread-multi/RRDs.pm #usr/lib/perl5/site_perl/5.36.0/xxxMACHINExxx-linux-thread-multi/auto/RRDs/.packlist usr/lib/perl5/site_perl/5.36.0/xxxMACHINExxx-linux-thread-multi/auto/RRDs/RRDs.so #usr/lib/pkgconfig/librrd.pc -#usr/share/doc/rrdtool-1.8.0 -#usr/share/doc/rrdtool-1.8.0/html -#usr/share/doc/rrdtool-1.8.0/html/RRDp.html -#usr/share/doc/rrdtool-1.8.0/html/RRDs.html -#usr/share/doc/rrdtool-1.8.0/html/bin_dec_hex.html -#usr/share/doc/rrdtool-1.8.0/html/cdeftutorial.html -#usr/share/doc/rrdtool-1.8.0/html/index.html -#usr/share/doc/rrdtool-1.8.0/html/librrd.html -#usr/share/doc/rrdtool-1.8.0/html/rpntutorial.html -#usr/share/doc/rrdtool-1.8.0/html/rrd-beginners.html -#usr/share/doc/rrdtool-1.8.0/html/rrd_pdpcalc.html -#usr/share/doc/rrdtool-1.8.0/html/rrdbuild.html -#usr/share/doc/rrdtool-1.8.0/html/rrdcached.html -#usr/share/doc/rrdtool-1.8.0/html/rrdcgi.html -#usr/share/doc/rrdtool-1.8.0/html/rrdcreate.html -#usr/share/doc/rrdtool-1.8.0/html/rrddump.html -#usr/share/doc/rrdtool-1.8.0/html/rrdfetch.html -#usr/share/doc/rrdtool-1.8.0/html/rrdfirst.html -#usr/share/doc/rrdtool-1.8.0/html/rrdflushcached.html -#usr/share/doc/rrdtool-1.8.0/html/rrdgraph.html -#usr/share/doc/rrdtool-1.8.0/html/rrdgraph_data.html -#usr/share/doc/rrdtool-1.8.0/html/rrdgraph_examples.html -#usr/share/doc/rrdtool-1.8.0/html/rrdgraph_graph.html -#usr/share/doc/rrdtool-1.8.0/html/rrdgraph_rpn.html -#usr/share/doc/rrdtool-1.8.0/html/rrdinfo.html -#usr/share/doc/rrdtool-1.8.0/html/rrdlast.html -#usr/share/doc/rrdtool-1.8.0/html/rrdlastupdate.html -#usr/share/doc/rrdtool-1.8.0/html/rrdlist.html -#usr/share/doc/rrdtool-1.8.0/html/rrdresize.html -#usr/share/doc/rrdtool-1.8.0/html/rrdrestore.html -#usr/share/doc/rrdtool-1.8.0/html/rrdthreads.html -#usr/share/doc/rrdtool-1.8.0/html/rrdtool.html -#usr/share/doc/rrdtool-1.8.0/html/rrdtune.html -#usr/share/doc/rrdtool-1.8.0/html/rrdtutorial.html -#usr/share/doc/rrdtool-1.8.0/html/rrdupdate.html -#usr/share/doc/rrdtool-1.8.0/html/rrdxport.html -#usr/share/doc/rrdtool-1.8.0/txt -#usr/share/doc/rrdtool-1.8.0/txt/bin_dec_hex.pod -#usr/share/doc/rrdtool-1.8.0/txt/bin_dec_hex.txt -#usr/share/doc/rrdtool-1.8.0/txt/cdeftutorial.pod -#usr/share/doc/rrdtool-1.8.0/txt/cdeftutorial.txt -#usr/share/doc/rrdtool-1.8.0/txt/librrd.txt -#usr/share/doc/rrdtool-1.8.0/txt/rpntutorial.pod -#usr/share/doc/rrdtool-1.8.0/txt/rpntutorial.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrd-beginners.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrd-beginners.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrd_pdpcalc.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrd_pdpcalc.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdbuild.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdbuild.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdcached.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdcached.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdcgi.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdcgi.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdcreate.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdcreate.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrddump.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrddump.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdfetch.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdfetch.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdfirst.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdfirst.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdflushcached.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdflushcached.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_data.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_data.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_examples.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_examples.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_graph.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_graph.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_rpn.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdgraph_rpn.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdinfo.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdinfo.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdlast.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdlast.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdlastupdate.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdlastupdate.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdlist.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdlist.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdresize.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdresize.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdrestore.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdrestore.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdthreads.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdthreads.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdtool.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdtool.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdtune.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdtune.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdtutorial.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdtutorial.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdupdate.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdupdate.txt -#usr/share/doc/rrdtool-1.8.0/txt/rrdxport.pod -#usr/share/doc/rrdtool-1.8.0/txt/rrdxport.txt +#usr/share/doc/rrdtool-1.9.0 +#usr/share/doc/rrdtool-1.9.0/html +#usr/share/doc/rrdtool-1.9.0/html/RRDp.html +#usr/share/doc/rrdtool-1.9.0/html/RRDs.html +#usr/share/doc/rrdtool-1.9.0/html/bin_dec_hex.html +#usr/share/doc/rrdtool-1.9.0/html/cdeftutorial.html +#usr/share/doc/rrdtool-1.9.0/html/index.html +#usr/share/doc/rrdtool-1.9.0/html/librrd.html +#usr/share/doc/rrdtool-1.9.0/html/rpntutorial.html +#usr/share/doc/rrdtool-1.9.0/html/rrd-beginners.html +#usr/share/doc/rrdtool-1.9.0/html/rrd_pdpcalc.html +#usr/share/doc/rrdtool-1.9.0/html/rrdbuild.html +#usr/share/doc/rrdtool-1.9.0/html/rrdcached.html +#usr/share/doc/rrdtool-1.9.0/html/rrdcgi.html +#usr/share/doc/rrdtool-1.9.0/html/rrdcreate.html +#usr/share/doc/rrdtool-1.9.0/html/rrddump.html +#usr/share/doc/rrdtool-1.9.0/html/rrdfetch.html +#usr/share/doc/rrdtool-1.9.0/html/rrdfirst.html +#usr/share/doc/rrdtool-1.9.0/html/rrdflushcached.html +#usr/share/doc/rrdtool-1.9.0/html/rrdgraph.html +#usr/share/doc/rrdtool-1.9.0/html/rrdgraph_data.html +#usr/share/doc/rrdtool-1.9.0/html/rrdgraph_examples.html +#usr/share/doc/rrdtool-1.9.0/html/rrdgraph_graph.html +#usr/share/doc/rrdtool-1.9.0/html/rrdgraph_rpn.html +#usr/share/doc/rrdtool-1.9.0/html/rrdinfo.html +#usr/share/doc/rrdtool-1.9.0/html/rrdlast.html +#usr/share/doc/rrdtool-1.9.0/html/rrdlastupdate.html +#usr/share/doc/rrdtool-1.9.0/html/rrdlist.html +#usr/share/doc/rrdtool-1.9.0/html/rrdresize.html +#usr/share/doc/rrdtool-1.9.0/html/rrdrestore.html +#usr/share/doc/rrdtool-1.9.0/html/rrdthreads.html +#usr/share/doc/rrdtool-1.9.0/html/rrdtool.html +#usr/share/doc/rrdtool-1.9.0/html/rrdtune.html +#usr/share/doc/rrdtool-1.9.0/html/rrdtutorial.html +#usr/share/doc/rrdtool-1.9.0/html/rrdupdate.html +#usr/share/doc/rrdtool-1.9.0/html/rrdxport.html +#usr/share/doc/rrdtool-1.9.0/txt +#usr/share/doc/rrdtool-1.9.0/txt/bin_dec_hex.pod +#usr/share/doc/rrdtool-1.9.0/txt/bin_dec_hex.txt +#usr/share/doc/rrdtool-1.9.0/txt/cdeftutorial.pod +#usr/share/doc/rrdtool-1.9.0/txt/cdeftutorial.txt +#usr/share/doc/rrdtool-1.9.0/txt/librrd.txt +#usr/share/doc/rrdtool-1.9.0/txt/rpntutorial.pod +#usr/share/doc/rrdtool-1.9.0/txt/rpntutorial.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrd-beginners.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrd-beginners.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrd_pdpcalc.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrd_pdpcalc.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdbuild.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdbuild.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdcached.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdcached.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdcgi.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdcgi.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdcreate.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdcreate.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrddump.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrddump.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdfetch.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdfetch.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdfirst.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdfirst.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdflushcached.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdflushcached.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_data.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_data.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_examples.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_examples.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_graph.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_graph.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_rpn.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdgraph_rpn.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdinfo.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdinfo.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdlast.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdlast.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdlastupdate.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdlastupdate.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdlist.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdlist.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdresize.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdresize.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdrestore.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdrestore.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdthreads.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdthreads.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdtool.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdtool.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdtune.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdtune.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdtutorial.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdtutorial.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdupdate.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdupdate.txt +#usr/share/doc/rrdtool-1.9.0/txt/rrdxport.pod +#usr/share/doc/rrdtool-1.9.0/txt/rrdxport.txt #usr/share/locale/fr/LC_MESSAGES/rrdtool.mo #usr/share/locale/hu/LC_MESSAGES/rrdtool.mo #usr/share/man/man1/bin_dec_hex.1 diff --git a/lfs/rrdtool b/lfs/rrdtool index abf2b50b3..4777f3afe 100644 --- a/lfs/rrdtool +++ b/lfs/rrdtool @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.8.0 +VER = 1.9.0 THISAPP = rrdtool-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d821d662af432c53760bc0e9636b84d9209933a810fa71091fc4c2b44518c89c7ad509bde7955d952279ee41464c3bfa4f631662dde61b6fff46699bb382653f +$(DL_FILE)_BLAKE2 = a5633b1bcacf53823f95f7899872e67d9941faec235c56546de8b66faf15a958a7c0d6a86d569c078e11a478dc272b1fbe784c3d3d9d45e8c3de696f0d6e378a install : $(TARGET) -- 2.34.1

1 0

[PATCH] network-hotplug-vlan: Fix for bug 12676
by Adolf Belka 29 Jul '24

29 Jul '24

- https://bugzilla.ipfire.org/show_bug.cgi?id=12676#c3 Suggested-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/udev/network-hotplug-vlan | 42 +++++++++++++++----------------- 1 file changed, 20 insertions(+), 22 deletions(-) diff --git a/config/udev/network-hotplug-vlan b/config/udev/network-hotplug-vlan index 178e1a67b..07ae5a61c 100644 --- a/config/udev/network-hotplug-vlan +++ b/config/udev/network-hotplug-vlan @@ -1,25 +1,23 @@ #!/bin/bash -############################################################################ -# # -# This file is part of the IPFire Firewall. # -# # -# IPFire is free software; you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation; either version 2 of the License, or # -# (at your option) any later version. # -# # -# IPFire is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with IPFire; if not, write to the Free Software # -# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # -# # -# Copyright (C) 2015 IPFire Team <info(a)ipfire.org> # -# # -############################################################################ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2015-2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### [ -n "${INTERFACE}" ] || exit 2 @@ -62,7 +60,7 @@ for interface in green0 red0 blue0 orange0; do # If the parent device (MAC or name) does not match the interface that # has just come up, we will go on for the next one. - [ "${PARENT_DEV}" = "${INTERFACE}" ] || [ "${PARENT_DEV}" = "$(</sys/class/net/${INTERFACE}/address)" ] || continue + [ "${PARENT_DEV}" = "${INTERFACE}" -o "${PARENT_DEV}" = "$(</sys/class/net/${INTERFACE}/address)" ] || continue # If the current zone is operating in bridge mode, give the VLAN interface a generic name (e.g. eth0.99 for VLAN 99 on eth0) if [ "${ZONE_MODE}" = "bridge" ]; then -- 2.45.2

1 0

[PATCH] bird: Update to version 2.15.1
by Adolf Belka 26 Jul '24

26 Jul '24

- Update from version 2.14 to 2.15.1 - Update of rootfile not required - Changelog 2.15.1 o OSPF: Fix regression in handling PtP links o RPKI: Handle connection resets properly o Static: Reject invalid combination of options o Fix builds with limited set of protocols 2.15 o BGP: Send hold timer o BGP: New options to specify required BGP capabilities o BFD: Improvements to 'show bfd sessions' command o RPKI: New 'local address' configuration option o Linux: Support for more route attributes, including TCP congestion control algorithm o Support for UDP logging o Static routes can have both nexthop and interface specified o Completion of command options in BIRD client o Many bugfixes and improvements Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/bird | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/bird b/lfs/bird index e9dc6c5f8..eae26ffbe 100644 --- a/lfs/bird +++ b/lfs/bird @@ -26,7 +26,7 @@ include Config SUMMARY = The BIRD Internet Routing Daemon -VER = 2.14 +VER = 2.15.1 THISAPP = bird-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = bird -PAK_VER = 13 +PAK_VER = 14 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = fe16b89c7f0ff35c5126366920960e0c55f57fe343380b2c32230122cf24f9abc3eb4d6ed9f37d2176f9e9340a83dffd1e68fed276b59b86cf1bdf5b8bd3c169 +$(DL_FILE)_BLAKE2 = c3fe95ae2b8a3dca036278c8014f3ce2d1fd224c65c10abcc77b2cc1dbdfaa1b5766e8643b873a12ac33f00cd5e866aa7ce853ead78150ec4314b53457ad554a install : $(TARGET) -- 2.45.2

1 0

[PATCH] nginx: Update to version 1.26.1
by Adolf Belka 21 Jul '24

21 Jul '24

- Update from version 1.24.0 to 1.26.1 - Update of rootfile not required - Version 1.24.0 is now a legacy version, no longer being supported. Stable version has changed to 1.26.x series. - Various CVE fixes in 1.26.1 and in 1.25.4, the development branch that became 1.26.0, that the legacy version 1.24.0 is also vulnerable to. - Changelog 1.26.1 *) Security: when using HTTP/3, processing of a specially crafted QUIC session might cause a worker process crash, worker process memory disclosure on systems with MTU larger than 4096 bytes, or might have potential other impact (CVE-2024-32760, CVE-2024-31079, CVE-2024-35200, CVE-2024-34161). *) Bugfix: reduced memory consumption for long-lived requests if "gzip", "gunzip", "ssi", "sub_filter", or "grpc_pass" directives are used. *) Bugfix: nginx could not be built by gcc 14 if the --with-atomic option was used. *) Bugfix: in HTTP/3. 1.26.0 *) 1.26.x stable branch. 1.25.5 *) Feature: virtual servers in the stream module. *) Feature: the ngx_stream_pass_module. *) Feature: the "deferred", "accept_filter", and "setfib" parameters of the "listen" directive in the stream module. *) Feature: cache line size detection for some architectures. *) Feature: support for Homebrew on Apple Silicon. *) Bugfix: Windows cross-compilation bugfixes and improvements. *) Bugfix: unexpected connection closure while using 0-RTT in QUIC. 1.25.4 *) Security: when using HTTP/3 a segmentation fault might occur in a worker process while processing a specially crafted QUIC session (CVE-2024-24989, CVE-2024-24990). *) Bugfix: connections with pending AIO operations might be closed prematurely during graceful shutdown of old worker processes. *) Bugfix: socket leak alerts no longer logged when fast shutdown was requested after graceful shutdown of old worker processes. *) Bugfix: a socket descriptor error, a socket leak, or a segmentation fault in a worker process (for SSL proxying) might occur if AIO was used in a subrequest. *) Bugfix: a segmentation fault might occur in a worker process if SSL proxying was used along with the "image_filter" directive and errors with code 415 were redirected with the "error_page" directive. *) Bugfixes and improvements in HTTP/3. 1.25.3 *) Change: improved detection of misbehaving clients when using HTTP/2. *) Feature: startup speedup when using a large number of locations. Thanks to Yusuke Nojima. *) Bugfix: a segmentation fault might occur in a worker process when using HTTP/2 without SSL; the bug had appeared in 1.25.1. *) Bugfix: the "Status" backend response header line with an empty reason phrase was handled incorrectly. *) Bugfix: memory leak during reconfiguration when using the PCRE2 library. *) Bugfixes and improvements in HTTP/3. 1.25.2 *) Feature: path MTU discovery when using HTTP/3. *) Feature: TLS_AES_128_CCM_SHA256 cipher suite support when using HTTP/3. *) Change: now nginx uses appname "nginx" when loading OpenSSL configuration. *) Change: now nginx does not try to load OpenSSL configuration if the --with-openssl option was used to built OpenSSL and the OPENSSL_CONF environment variable is not set. *) Bugfix: in the $body_bytes_sent variable when using HTTP/3. *) Bugfix: in HTTP/3. 1.25.1 *) Feature: the "http2" directive, which enables HTTP/2 on a per-server basis; the "http2" parameter of the "listen" directive is now deprecated. *) Change: HTTP/2 server push support has been removed. *) Change: the deprecated "ssl" directive is not supported anymore. *) Bugfix: in HTTP/3 when using OpenSSL. 1.25.0 *) Feature: experimental HTTP/3 support. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/nginx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/nginx b/lfs/nginx index ef314a177..c344b2955 100644 --- a/lfs/nginx +++ b/lfs/nginx @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config SUMMARY = A HTTP server and IMAP/POP3 proxy server -VER = 1.24.0 +VER = 1.26.1 THISAPP = nginx-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nginx -PAK_VER = 15 +PAK_VER = 16 DEPS = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7f671c57666dec822bff72fcf0e4eec35ecf981b8f1e489827f9bbbf9179036f61c9fdc7e497c076ccaeb35b9ba3dfe7684e4fc91ee9cae52601f68859bb034d +$(DL_FILE)_BLAKE2 = 5df95f6771a93009f5bd1a4038857c29af580d18af841e8cffe073339578b3ae0492d3a4cc797cac03a1039096ac5206ed1fa01da11c98591bce2cc4b2d18679 install : $(TARGET) -- 2.45.2

1 0

nut addon looks for .so library files not .so.0
by Adolf Belka 19 Jul '24

19 Jul '24

Hi Michael & all, nut has a command nut-scanner which scans for nut systems. An IPFire user has used that command and it came back saying that it couldn't find the USB library libusb-1.0.so which is commented out in the rootfile. It looks like nut when it is checking what libraries are available for the nut-scanner is looking for the .so files only and not the .so.0 or .so.0.3.0 files. The same thing is occurring with avahi and netsnmp where nut is again only looking for the .so files, so in all three cases nut concludes that the usb, avahi and netsnmp libraries are not present even when they are. It looks like no one has ever used the nut-scanner command and flagged up the issue as it will have had this problem for ever, as the libusb-1.0.so file has always been commented out (standard IPFire practice for rootfiles) What should we do in this case when nut is only looking for the .so files. Should we uncomment the required .so libs? The only alternative that I can see would be to comment out the command nut-scanner. If we do uncomment the .so lib files mentioned above, how do we ensure that they stay uncommented and someone in the future does not see them and comment them out in the rootfiles. I did that with nut about two years ago. I don't know now if that means that some of nut will not be properly working or not. Should I now go an uncomment all the nut .so file entries in the nut rootfile? Feedback and suggestions of the best approach for this gladly accepted. Regards, Adolf. -- Sent from my laptop

2 3

[PATCH] apache: Update to 2.4.62
by Matthias Fischer 19 Jul '24

19 Jul '24

"All good things go by three..." For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.62 "Changes with Apache 2.4.62 *) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (cve.mitre.org) SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. Credits: Smi1e (DBAPPSecurity Ltd.) *) SECURITY: CVE-2024-40725: Apache HTTP Server: source code disclosure with handlers configured via AddType (cve.mitre.org) A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue. *) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets with BalancerMember(s). PR 69168. [Yann Ylavic] *) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs. PR 69160 [Yann Ylavic] *) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2. [Joe Orton] *) mod_ssl: Add support for loading certs/keys from pkcs11: URIs via OpenSSL 3.x providers. [Ingo Franzki <ifranzki linux.ibm.com>] *) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0. [Ruediger Pluem, Yann Ylavic] *) mpm_worker: Fix possible warning (AH00045) about children processes not terminating timely. [Yann Ylavic]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/apache2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index 2dfd8b39d..428ef3419 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.4.61 +VER = 2.4.62 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9299ef5843888829143732b3a60d1713aff688ed2f6c2b7f154be16bc075ec747a5b116716f188491ebc9947ff2dfe09dfc71f5245d98a4be3ba27ada28ec8a5 +$(DL_FILE)_BLAKE2 = 0e5c3b05819771e6ff72933ad715695199a32c384f63de6598e179ff5803580f04639437829305150305c9a2b7d309178552d8c9a2d7248a034c98f445193b95 install : $(TARGET) -- 2.34.1

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2024