Development January 2025

development@lists.ipfire.org

7 participants
38 discussions

[PATCH] wpa-supplicant: Update to version 2.11
by Adolf Belka 17 Jan '25

17 Jan '25

- Update from version 2.10 to 2.11 - Update of rootfile not required - Changelog 2.11 * Wi-Fi Easy Connect - add support for DPP release 3 - allow Configurator parameters to be provided during config exchange * MACsec - add support for GCM-AES-256 cipher suite - remove incorrect EAP Session-Id length constraint - add hardware offload support for additional drivers * HE/IEEE 802.11ax/Wi-Fi 6 - support BSS color updates - various fixes * EHT/IEEE 802.11be/Wi-Fi 7 - add preliminary support * support OpenSSL 3.0 API changes * improve EAP-TLS support for TLSv1.3 * EAP-SIM/AKA: support IMSI privacy * improve mitigation against DoS attacks when PMF is used * improve 4-way handshake operations - discard unencrypted EAPOL frames in additional cases - use Secure=1 in message 2 during PTK rekeying * OCV: do not check Frequency Segment 1 Channel Number for 160 MHz cases to avoid interoperability issues * support new SAE AKM suites with variable length keys * support new AKM for 802.1X/EAP with SHA384 * improve cross-AKM roaming with driver-based SME/BSS selection * PASN - extend support for secure ranging - allow PASN implementation to be used with external programs for Wi-Fi Aware * FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP) - this is based on additional details being added in the IEEE 802.11 standard - the new implementation is not backwards compatible, but PMKSA caching with FT-EAP was, and still is, disabled by default * support a pregenerated MAC (mac_addr=3) as an alternative mechanism for using per-network random MAC addresses * EAP-PEAP: require Phase 2 authentication by default (phase2_auth=1) to improve security for still unfortunately common invalid configurations that do not set ca_cert * extend SCS support for QoS Characteristics * extend MSCS support * support unsynchronized service discovery (USD) * add support for explicit SSID protection in 4-way handshake (a mitigation for CVE-2023-52424; disabled by default for now, can be enabled with ssid_protection=1) - in addition, verify SSID after key setup when beacon protection is used * fix SAE H2E rejected groups validation to avoid downgrade attacks * a large number of other fixes, cleanup, and extensions Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/wpa_supplicant | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant index f3c12992d..38a147619 100644 --- a/lfs/wpa_supplicant +++ b/lfs/wpa_supplicant @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.10 +VER = 2.11 THISAPP = wpa_supplicant-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7f6045e5dcf24f7ccf1ea75c99541f9d68fadaea858a6ca11a95c997de14e33b3aa89138e748664579b5a4ea493d247cf6613da3c5fae49a4dbb5cd58dace752 +$(DL_FILE)_BLAKE2 = 71bd0d11cd31eb5bc6beb51caf0f1399856ea188f316d2330053a2d8c81869057811e9f500828e8981eabd0af38f30a18a3ae584d744005c78681c82fa910abf install : $(TARGET) -- 2.48.1

1 0

[PATCH] jquery: Update to version 3.7.1
by Adolf Belka 17 Jan '25

17 Jan '25

- Update from 3.6.3 to 3.7.1 - Update o0f rootfile not required - Changelog is too large to include all here so links provided to changelogs 3.7.1 https://blog.jquery.com/2023/08/28/jquery-3-7-1-released-reliable-table-row… 3.7.0 https://blog.jquery.com/2023/05/11/jquery-3-7-0-released-staying-in-order/ 3.6.4 https://blog.jquery.com/2023/03/08/jquery-3-6-4-released-selector-forgivene… Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/jquery | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/jquery b/lfs/jquery index 0ab12c790..7275ed90f 100644 --- a/lfs/jquery +++ b/lfs/jquery @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.6.3 +VER = 3.7.1 THISAPP = jquery-$(VER) DL_FILE = $(THISAPP).min.js @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ff1c58cc4d8efb7f3c134d4da0d0b6960c83d09edeffc9cff96230733c9c35c259282cb335aa2ceea75ca9d6548721aedbe3dbac6b68fa0a91e405c06f72f1d6 +$(DL_FILE)_BLAKE2 = 3f2c08cb7af88731e896620c5d0a958b209b662e43cc91a8690dda93af360e98e81f8d111c2c71d801e02c81e3b37f733f3aea12765f7b67ef0892353f773cfb install : $(TARGET) -- 2.48.1

1 0

[PATCH] haproxy: Update to version 3.1.2
by Adolf Belka 17 Jan '25

17 Jan '25

- Update from version 3.0.3 to 3.1.2 - Update of rootfile not required - Changelog is very large as there are many entries for the update from 3.0.x to 3.1.x For details read the CHANGELOG file in the source tarball. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/haproxy | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/haproxy b/lfs/haproxy index c433d40e0..d73c94289 100644 --- a/lfs/haproxy +++ b/lfs/haproxy @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,9 +26,9 @@ include Config SUMMARY = The Reliable, High Performance TCP/HTTP Load Balancer -VER = 3.0.3 +VER = 3.1.2 -# From: https://www.haproxy.org/download/3.0/src/haproxy-3.0.3.tar.gz +# From: https://www.haproxy.org/download/ THISAPP = haproxy-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -36,7 +36,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = haproxy -PAK_VER = 30 +PAK_VER = 31 DEPS = @@ -54,7 +54,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d5f10110f0c95e214885b3a2248ed048adaf747e382fd343f90cfd35ed58e58f71a643260d87208e70f4d37101ba80471cd06ccd2d4cd9915031aa42fc86104f +$(DL_FILE)_BLAKE2 = 234a365251f226dcd1892fe89ec0dc11f505a85e08b12be1dba61dfd03808cb4cd8ad0f0548b2250379ade124314a5b5577b634bb401798666bae41fe1cc1388 install : $(TARGET) -- 2.48.1

1 3

Re: [PATCH] rsync: Update to version 3.4.0
by Michael Tremer 17 Jan '25

17 Jan '25

Hello Fred, Thank you for the heads up. Adolf has provided a patch and it was merged into Core Update 191 which is currently available for testing: https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=a32de1bbaec84e18a32… -Michael > On 16 Jan 2025, at 14:05, Kienker, Fred <fred.kienker(a)at4b.com> wrote: > > There are several very significant regressions in rsync 3.4.0 which are > fixed in 3.4.1. Highly recommend pushing the newer version. > > Fred Kienker > fred.kienker(a)at4b.com > 770.518.6166 > > > -----Original Message----- > From: Michael Tremer <michael.tremer(a)ipfire.org> > Sent: Thursday, 16 January, 2025 5:21 AM > To: Adolf Belka <adolf.belka(a)ipfire.org> > Cc: development(a)lists.ipfire.org > Subject: Re: [PATCH] rsync: Update to version 3.4.0 > > Thank you for this patch. I have merged this straight away back into > c190 and pushed the new package out last night. > >> On 15 Jan 2025, at 13:25, Adolf Belka <adolf.belka(a)ipfire.org> wrote: >> >> - Update from version 3.3.0 to 3.4.0 >> - Update of rootfile not required >> - Changelog >> 3.4.0 >> Release 3.4.0 is a security release that fixes a number of important >> vulnerabilities. For more details on the vulnerabilities please see >> the CERT report https://kb.cert.org/vuls/id/952657 >> PROTOCOL NUMBER: >> - The protocol number was changed to 32 to make it easier for >> administrators to check their servers have been updated >> SECURITY FIXES: >> Many thanks to Simon Scannell, Pedro Gallegos, and Jasiel Spelman at >> Google Cloud Vulnerability Research and Aleksei Gorban (Loqpa) for >> discovering these vulnerabilities and working with the rsync project >> to develop and test fixes. >> - CVE-2024-12084 - Heap Buffer Overflow in Checksum Parsing. >> - CVE-2024-12085 - Info Leak via uninitialized Stack contents defeats > ASLR. >> - CVE-2024-12086 - Server leaks arbitrary client files. >> - CVE-2024-12087 - Server can make client write files outside of > destination directory using symbolic links. >> - CVE-2024-12088 - --safe-links Bypass. >> - CVE-2024-12747 - symlink race condition. >> BUG FIXES: >> - Fixed the included popt to avoid a memory error on modern gcc > versions. >> - Fixed an incorrect extern variable's type that caused an ACL issue > on macOS. >> - Fixed IPv6 configure check >> INTERNAL: >> - Updated included popt to version 1.19. >> DEVELOPER RELATED: >> - Various improvements to the release scripts and git setup. >> - Improved packaging/var-checker to identify variable type issues. >> - added FreeBSD and Solaris CI builds >> >> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> >> --- >> lfs/rsync | 20 ++++++++------------ >> 1 file changed, 8 insertions(+), 12 deletions(-) >> >> diff --git a/lfs/rsync b/lfs/rsync >> index fcbcd0ab9..a680a9cca 100644 >> --- a/lfs/rsync >> +++ b/lfs/rsync >> @@ -1,7 +1,7 @@ >> > ######################################################################## > ####### >> # > # >> # IPFire.org - A linux based firewall > # >> -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> > # >> +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> > # >> # > # >> # This program is free software: you can redistribute it and/or modify > # >> # it under the terms of the GNU General Public License as published by > # >> @@ -26,7 +26,7 @@ include Config >> >> SUMMARY = Versatile tool for fast incremental file transfer >> >> -VER = 3.3.0 >> +VER = 3.4.0 >> >> THISAPP = rsync-$(VER) >> DL_FILE = $(THISAPP).tar.gz >> @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) >> DIR_APP = $(DIR_SRC)/$(THISAPP) >> TARGET = $(DIR_INFO)/$(THISAPP) >> PROG = rsync >> -PAK_VER = 19 >> +PAK_VER = 20 >> >> DEPS = >> >> @@ -48,7 +48,7 @@ objects = $(DL_FILE) >> >> $(DL_FILE) = $(DL_FROM)/$(DL_FILE) >> >> -$(DL_FILE)_BLAKE2 = >> 75a3cc50452086aebd16f42d7a309c173cbc1ea156227afb10d2106d0b9043e9736769 >> 95b8199d22840775ae3df8db97d1c0de5f3aa58afa130c5b1348c3f825 >> +$(DL_FILE)_BLAKE2 = >> +ce88fdbc44cbb4522d48b5f8a11ce70b2d4c794612915390a865b478efd05aa1f17a0 >> +a4e1d4e698a968994b5e47ef4df16315c93e87398b848fdcef9e8dc71a1 >> >> install : $(TARGET) >> >> @@ -81,18 +81,14 @@ $(subst %,%_BLAKE2,$(objects)) : >> $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) >> @$(PREBUILD) >> @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) >> - >> # Replace shebang in rsync-ssl >> cd $(DIR_APP) && sed -i -e "s@^#!.*@#!/bin/bash@" rsync-ssl >> - >> cd $(DIR_APP) && ./configure \ >> - --prefix=/usr \ >> - --without-included-popt \ >> - --without-included-zlib \ >> - --disable-xxhash >> - >> + --prefix=/usr \ >> + --without-included-popt \ >> + --without-included-zlib \ >> + --disable-xxhash >> cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && >> make install >> - >> @rm -rf $(DIR_APP) >> @$(POSTBUILD) >> -- >> 2.47.1 >> > > >

1 0

[PATCH 1/2] rsync: Update to version 3.4.1
by Adolf Belka 16 Jan '25

16 Jan '25

- Update from version 3.3.0 to 3.4.1 as the previous patch which went from 3.3.0 to 3.4.0 has only been merged into CU190 and not into next where this patch is being done. Not sure if this will cause problems or not. I updated the PAK_VER of rsynce from 19 to 21 so that it went over the PAK_VER of the version merged into CU190. - If how I have done it is not the best or not correct just let me know how I should do it and I will re-do it. - Update of rootfile not required. - Added in enabling xxhash as we have that available in IPFire as another addon. - Ran rsync -V and confirmed that xxhash is now available to rsync. - Changelog 3.4.1 Release 3.4.1 is a fix for regressions introduced in 3.4.0 BUG FIXES: - fixed handling of -H flag with conflict in internal flag values - fixed a user after free in logging of failed rename - fixed build on systems without openat() - removed dependency on alloca() in bundled popt DEVELOPER RELATED: - fix to permissions handling in the developer release script 3.4.0 (This was already in the previous patch that went from 3.3.0 to 3.4.0 Release 3.4.0 is a security release that fixes a number of important vulnerabilities. For more details on the vulnerabilities please see the CERT report https://kb.cert.org/vuls/id/952657 PROTOCOL NUMBER: - The protocol number was changed to 32 to make it easier for administrators to check their servers have been updated SECURITY FIXES: Many thanks to Simon Scannell, Pedro Gallegos, and Jasiel Spelman at Google Cloud Vulnerability Research and Aleksei Gorban (Loqpa) for discovering these vulnerabilities and working with the rsync project to develop and test fixes. - CVE-2024-12084 - Heap Buffer Overflow in Checksum Parsing. - CVE-2024-12085 - Info Leak via uninitialized Stack contents defeats ASLR. - CVE-2024-12086 - Server leaks arbitrary client files. - CVE-2024-12087 - Server can make client write files outside of destination directory using symbolic links. - CVE-2024-12088 - --safe-links Bypass. - CVE-2024-12747 - symlink race condition. BUG FIXES: - Fixed the included popt to avoid a memory error on modern gcc versions. - Fixed an incorrect extern variable's type that caused an ACL issue on macOS. - Fixed IPv6 configure check INTERNAL: - Updated included popt to version 1.19. DEVELOPER RELATED: - Various improvements to the release scripts and git setup. - Improved packaging/var-checker to identify variable type issues. - added FreeBSD and Solaris CI builds Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/rsync | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/lfs/rsync b/lfs/rsync index fcbcd0ab9..789b100bd 100644 --- a/lfs/rsync +++ b/lfs/rsync @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Versatile tool for fast incremental file transfer -VER = 3.3.0 +VER = 3.4.1 THISAPP = rsync-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,9 +34,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = rsync -PAK_VER = 19 +PAK_VER = 21 -DEPS = +DEPS = libxxhash SERVICES = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 75a3cc50452086aebd16f42d7a309c173cbc1ea156227afb10d2106d0b9043e973676995b8199d22840775ae3df8db97d1c0de5f3aa58afa130c5b1348c3f825 +$(DL_FILE)_BLAKE2 = 79c1cad697547059ee241e20c26d7f97bed3ad062deb856d31a617fead333a2d9f62c7c47c1efaf70033dbc358fe547d034c35e8181abb51a1fc893557882bc7 install : $(TARGET) @@ -89,7 +89,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --prefix=/usr \ --without-included-popt \ --without-included-zlib \ - --disable-xxhash + --enable-xxhash cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && make install -- 2.48.1

1 1

Unending item build
by jon 16 Jan '25

16 Jan '25

Hello all! For the past two or three days the ./make.sh build goes into a loop and builds an item forever. Once it happened when building: samba (4.21.0) [ 9:41:23 ]^C pcengines-apu-firmware (4.19.0.1) [ 1:32:17 ]^C perl-Parse-Yapp (1.21) [ 2:38:07 ]^C When it runs away I will terminate the build. jon@deb12HPZ:~/development/ipfire-2.x$ sudo ./make.sh clean Cleaning build directory... [ DONE ] jon@deb12HPZ:~/development/ipfire-2.x$ sudo ./make.sh build Packaged toolchain compilation Building IPFire stage2 [ 0 ][ DONE ] linux (6.6.47) HEADERS=1 [ 26 ][ DONE ] man-pages (6.9.1) [ 8 ][ DONE ] . . . perl-Device-Modem (1.56) [ 1 ][ DONE ] perl-Apache-Htpasswd (1.9) [ 1 ][ DONE ] perl-Parse-Yapp (1.21) [ 2:38:07 ]^C cp lib/Parse/Yapp.pm blib/lib/Parse/Yapp.pm cp lib/Parse/Yapp/Grammar.pm blib/lib/Parse/Yapp/Grammar.pm cp lib/Parse/Yapp/Output.pm blib/lib/Parse/Yapp/Output.pm cp lib/Parse/Yapp/Parse.pm blib/lib/Parse/Yapp/Parse.pm cp lib/Parse/Yapp/Lalr.pm blib/lib/Parse/Yapp/Lalr.pm cp yapp blib/script/yapp "/usr/bin/perl" -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/yapp Manifying 1 pod document Manifying 1 pod document make[1]: Leaving directory '/usr/src/Parse-Yapp-1.21' cd /usr/src/Parse-Yapp-1.21 && make install make[1]: Entering directory '/usr/src/Parse-Yapp-1.21' Manifying 1 pod document Manifying 1 pod document Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Driver.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Options.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Output.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Lalr.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Grammar.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Parse.pm Installing /usr/share/man/man1/yapp.1 Installing /usr/share/man/man3/Parse::Yapp.3 Installing /usr/bin/yapp Appending installation info to /usr/lib/perl5/5.36.0/x86_64-linux-thread-multi/perllocal.pod make[1]: Leaving directory '/usr/src/Parse-Yapp-1.21' Updating linker cache... Install done; saving file list to /usr/src/log/Parse-Yapp-1.21 ... make: Leaving directory '/usr/src/lfs' ERROR: Build process interrupted [ FAIL ] Check /home/jon/development/ipfire-2.x/log_x86_64/_build.ipfire.log for errors if applicable [ FAIL ] jon@deb12HPZ:~/development/ipfire-2.x$ And here is the build.ipfire.log: make[1]: Leaving directory '/usr/src/Apache-Htpasswd-1.9' Updating linker cache... Install done; saving file list to /usr/src/log/Apache-Htpasswd-1.9 ... make: Leaving directory '/usr/src/lfs' Jan 14 21:51:47: Building perl-Parse-Yapp make: Entering directory '/home/jon/development/ipfire-2.x/lfs' make: Nothing to be done for 'download'. make: Leaving directory '/home/jon/development/ipfire-2.x/lfs' make: Entering directory '/usr/src/lfs' ====================================== Installing Parse-Yapp-1.21 ... Install started; saving file list to /usr/src/lsalr ... cd /usr/src/Parse-Yapp-1.21 && perl Makefile.PL Checking if your kit is complete... Looks good Generating a Unix-style Makefile Writing Makefile for Parse::Yapp Writing MYMETA.yml and MYMETA.json cd /usr/src/Parse-Yapp-1.21 && make -j12 make[1]: Entering directory '/usr/src/Parse-Yapp-1.21' cp lib/Parse/Yapp/Options.pm blib/lib/Parse/Yapp/Options.pm cp lib/Parse/Yapp/Driver.pm blib/lib/Parse/Yapp/Driver.pm cp lib/Parse/Yapp.pm blib/lib/Parse/Yapp.pm cp lib/Parse/Yapp/Grammar.pm blib/lib/Parse/Yapp/Grammar.pm cp lib/Parse/Yapp/Output.pm blib/lib/Parse/Yapp/Output.pm cp lib/Parse/Yapp/Parse.pm blib/lib/Parse/Yapp/Parse.pm cp lib/Parse/Yapp/Lalr.pm blib/lib/Parse/Yapp/Lalr.pm cp yapp blib/script/yapp "/usr/bin/perl" -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/yapp Manifying 1 pod document Manifying 1 pod document make[1]: Leaving directory '/usr/src/Parse-Yapp-1.21' cd /usr/src/Parse-Yapp-1.21 && make install make[1]: Entering directory '/usr/src/Parse-Yapp-1.21' Manifying 1 pod document Manifying 1 pod document Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Driver.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Options.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Output.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Lalr.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Grammar.pm Installing /usr/lib/perl5/site_perl/5.36.0/Parse/Yapp/Parse.pm Installing /usr/share/man/man1/yapp.1 Installing /usr/share/man/man3/Parse::Yapp.3 Installing /usr/bin/yapp Appending installation info to /usr/lib/perl5/5.36.0/x86_64-linux-thread-multi/perllocal.pod make[1]: Leaving directory '/usr/src/Parse-Yapp-1.21' Updating linker cache... Install done; saving file list to /usr/src/log/Parse-Yapp-1.21 ... make: Leaving directory '/usr/src/lfs' Any thoughts on why an item build would not complete? Jon

3 8

[PATCH] rsync: Update to version 3.4.0
by Adolf Belka 16 Jan '25

16 Jan '25

- Update from version 3.3.0 to 3.4.0 - Update of rootfile not required - Changelog 3.4.0 Release 3.4.0 is a security release that fixes a number of important vulnerabilities. For more details on the vulnerabilities please see the CERT report https://kb.cert.org/vuls/id/952657 PROTOCOL NUMBER: - The protocol number was changed to 32 to make it easier for administrators to check their servers have been updated SECURITY FIXES: Many thanks to Simon Scannell, Pedro Gallegos, and Jasiel Spelman at Google Cloud Vulnerability Research and Aleksei Gorban (Loqpa) for discovering these vulnerabilities and working with the rsync project to develop and test fixes. - CVE-2024-12084 - Heap Buffer Overflow in Checksum Parsing. - CVE-2024-12085 - Info Leak via uninitialized Stack contents defeats ASLR. - CVE-2024-12086 - Server leaks arbitrary client files. - CVE-2024-12087 - Server can make client write files outside of destination directory using symbolic links. - CVE-2024-12088 - --safe-links Bypass. - CVE-2024-12747 - symlink race condition. BUG FIXES: - Fixed the included popt to avoid a memory error on modern gcc versions. - Fixed an incorrect extern variable's type that caused an ACL issue on macOS. - Fixed IPv6 configure check INTERNAL: - Updated included popt to version 1.19. DEVELOPER RELATED: - Various improvements to the release scripts and git setup. - Improved packaging/var-checker to identify variable type issues. - added FreeBSD and Solaris CI builds Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/rsync | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/lfs/rsync b/lfs/rsync index fcbcd0ab9..a680a9cca 100644 --- a/lfs/rsync +++ b/lfs/rsync @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Versatile tool for fast incremental file transfer -VER = 3.3.0 +VER = 3.4.0 THISAPP = rsync-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = rsync -PAK_VER = 19 +PAK_VER = 20 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 75a3cc50452086aebd16f42d7a309c173cbc1ea156227afb10d2106d0b9043e973676995b8199d22840775ae3df8db97d1c0de5f3aa58afa130c5b1348c3f825 +$(DL_FILE)_BLAKE2 = ce88fdbc44cbb4522d48b5f8a11ce70b2d4c794612915390a865b478efd05aa1f17a0a4e1d4e698a968994b5e47ef4df16315c93e87398b848fdcef9e8dc71a1 install : $(TARGET) @@ -81,18 +81,14 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - # Replace shebang in rsync-ssl cd $(DIR_APP) && sed -i -e "s@^#!.*@#!/bin/bash@" rsync-ssl - cd $(DIR_APP) && ./configure \ - --prefix=/usr \ - --without-included-popt \ - --without-included-zlib \ - --disable-xxhash - + --prefix=/usr \ + --without-included-popt \ + --without-included-zlib \ + --disable-xxhash cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && make install - @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.47.1

2 1

[PATCH 1/6] openssl: Dynamically link zlib
by Michael Tremer 15 Jan '25

15 Jan '25

The former way was to open libz.so whenever it was needed. This is however not a very good solution and we will have trouble in dependency tracking and discover any linking problems much later. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/openssl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/openssl b/lfs/openssl index e14722c0c..ec8c63c54 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -41,7 +41,7 @@ CONFIGURE_OPTIONS = \ --prefix=/usr \ --openssldir=/etc/ssl \ shared \ - zlib-dynamic \ + zlib \ enable-camellia \ enable-seed \ enable-rfc3779 \ -- 2.39.5

1 5

[PATCH] backup-exclude: Add suricata ruleset-sources to backup exclude file
by Adolf Belka 15 Jan '25

15 Jan '25

- This will ensure that an old version will no longer be restored back onto a users system. - The suricata ruleset-sources file should also be shipped in the CU that this will be applied to make sure that all usders have the correct version installed, in case they have done a restore from an old backup after doing a fresh install. - Tested on my vm testbed system and after making the change, the ruleset-sources file is no longer added to the backup set but also it is excluded from the restore if it is included in an old backup. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/backup/exclude | 1 + 1 file changed, 1 insertion(+) diff --git a/config/backup/exclude b/config/backup/exclude index 0131a87fd..4dc1607a2 100644 --- a/config/backup/exclude +++ b/config/backup/exclude @@ -7,4 +7,5 @@ var/ipfire/ovpn/openssl/* var/ipfire/proxy/calamaris/bin/* var/ipfire/qos/bin/qos.pl var/ipfire/suricata/oinkmaster.conf +var/ipfire/suricata/ruleset-sources var/ipfire/urlfilter/blacklists/*/*.db -- 2.47.1

2 1

[PATCH] dma: Update to version 0.14
by Adolf Belka 13 Jan '25

13 Jan '25

- Update from version 0.13 to 0.14 - Update of rootfile not required - Changelog 0.14 https://github.com/corecode/dma/commits/v0.14/ Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/dma | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/lfs/dma b/lfs/dma index 76b45423e..39507ff6a 100644 --- a/lfs/dma +++ b/lfs/dma @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.13 +VER = 0.14 THISAPP = dma-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,6 +32,8 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) +# https://github.com/corecode/dma + ############################################################################### # Top-level Rules ############################################################################### @@ -40,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 731d250a5e75faa25fe06dc636a72fca1c26382ea3d447665f47afbb6eb40426f2e587520a3e9431d454dea7bc14c323d40a48e2e9165a9477b2e2b1d2035087 +$(DL_FILE)_BLAKE2 = 229088c95abd26999686df65f5aa17a994593793abba5c0afeddbf9c1b0fc53b2cb835c7025286c92fc95e6be7e3c01738ab747f18885210715427c297461413 install : $(TARGET) -- 2.47.1

1 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2025