Development February 2025

development@lists.ipfire.org

7 participants
29 discussions

[PATCH] tshark: Update to version 4.4.4
by Adolf Belka 20 Feb '25

20 Feb '25

- Update from version 4.4.3 to 4.4.4 - Update of rootfile - Changelog 4.4.4 The following vulnerabilities have been fixed: wnpa-sec-2025-01 Bundle Protocol and CBOR dissector {crash,infinite loop, memory leak}. Issue 20373. The following bugs have been fixed: Crash when sorting columns during capture with display filter active. Issue 20263. OSS-Fuzz 384757274: Invalid-bool-value in dissect_tcp. Issue 20300. Test failure in 4.4.2/4.4.3: test_sharkd_req_follow_http2. Issue 20330. Regression in extcap interface toolbar. Issue 20354. Clicking outside columns in TCP tab of Statistics → Conversations window causes crash. Issue 20357. FTBFS with Ubuntu development (25.04) release. Issue 20359. DNS enable_qname_stats crash Wireshark when QDCOUNT == 0. Issue 20367. Windows: Android extcap plugin fails with "Broken socket connection" if there are no new packets for 2sec. Issue 20386. TECMP: Calculation of lifecycle start in Status message is wrong. Issue 20387. MQTT v5.0 properties total length presentation is incorrect. Issue 20389. TShark doesn’t resolve addresses in custom "hosts" files. Issue 20391. Incorrect JA4 fingerprint with empty ciphers. Issue 20394. New and Updated Features Updated Protocol Support CESoETH, DNS, IEEE 1609.2, ISOBUS, ITS, MPLS, MQTT, PDU Transport, RTP, TCP, TECMP, WebSocket, and WSMP New and Updated Capture File Support CLLog, EMS, and ERF Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/tshark | 4 ++-- lfs/tshark | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/packages/tshark b/config/rootfiles/packages/tshark index 02e4f47e2..c16bff26e 100644 --- a/config/rootfiles/packages/tshark +++ b/config/rootfiles/packages/tshark @@ -12,10 +12,10 @@ usr/bin/dumpcap usr/bin/tshark #usr/lib/libwireshark.so usr/lib/libwireshark.so.18 -usr/lib/libwireshark.so.18.0.3 +usr/lib/libwireshark.so.18.0.4 #usr/lib/libwiretap.so usr/lib/libwiretap.so.15 -usr/lib/libwiretap.so.15.0.3 +usr/lib/libwiretap.so.15.0.4 #usr/lib/libwsutil.so usr/lib/libwsutil.so.16 usr/lib/libwsutil.so.16.0.0 diff --git a/lfs/tshark b/lfs/tshark index ca451fbe7..4c513f307 100644 --- a/lfs/tshark +++ b/lfs/tshark @@ -26,7 +26,7 @@ include Config SUMMARY = A Network Traffic Analyser -VER = 4.4.3 +VER = 4.4.4 THISAPP = wireshark-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tshark DEPS = c-ares -PAK_VER = 21 +PAK_VER = 22 SERVICES = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = b6a7348a4da0f6160e325e3345b508ae9e0ca900a2c0d308cb70d3da216ff90818e0439be3ef5f89dc87166e566d8b7d77f6fff114b5b303a5ad9b72e5665be4 +$(DL_FILE)_BLAKE2 = 86c0d2bdb341f291180a021ecdef5d07c4a05e4296207925ca2443017a78a8cffdb98ac6890c2968c7bd1e42c9a43cab9770599d715729a4e63b486c73ae2ba9 install : $(TARGET) -- 2.48.1

1 0

[PATCH 1/2] libyang: Update to version 3.7.8
by Adolf Belka 20 Feb '25

20 Feb '25

- Update from version 2.1.148 to 3.7.8 - Update of rootfile - Submited as a set with a PAK_VER update of frr as frr needs to be shipped to use this new version. - In the changelog for moving the library from 2.x to 3.0 it mentions that there are some breaking changes but then says they are minor. The library versions are not alligned with the package version numbers. Following is what is said:- * Non-backwards-compatible changes between libyang version 2 and 3 are rather minor and can be summarized as providing * structured error information (instead of a single message), unifying **lyd_new_*()** function options, and some * minor changes such as removing deprecated functions or making a few functions inlined. However, there is another * large change that has not affected the API, specifically configuration system-ordered lists and leaf-lists are now * ordered based on their keys/values, respectively. Except for moderately slower performance and negligible increased * memory requirements, it should not affect existing applications (assuming they do not rely on the previous order of * these instances). - I tested this updated version of libyang with frr. frr built without any problems. It just has the requirement that libyang >= 2.1.128, so no restriction that it must not be version 3. I then installed the IPFire built with the updated libyang and installed the frr that was built with it. I was able to start frr successfully, so all the specified frr daemons successfully started. - I could only test that frr successfully had all the daemons start but could not test out actual functioning of frr as this is something I have never used. I would expect that if all the daemons start successfully then frr should be happy working with libyang-3.7.8 - Changelog 3.7.8 yanglint UTF8 support validation optimizations lots of bugfixes 3.4.2 data handling optimizations 32b build fixes various bugfixes 3.1.0 lots of improvements and bugfixes in various parts of the library 2.2.8 new SO version 3 with some non-backwards compatible changes transition manual from version 2 in docs (leaf-)list instance semantic ordering sorts instances based on their values or their key values minor performance cost logging API improved new parsing flag LYD_PARSE_STORE_ONLY avoids value validation run-time plugin support build improvements lots of other bugfixes and optimizations Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libyang | 6 +++--- lfs/libyang | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/libyang b/config/rootfiles/common/libyang index f06340422..2562e0229 100644 --- a/config/rootfiles/common/libyang +++ b/config/rootfiles/common/libyang @@ -1,13 +1,13 @@ #usr/bin/yanglint #usr/bin/yangre #usr/include/libyang -#usr/include/libyang/config.h #usr/include/libyang/context.h #usr/include/libyang/dict.h #usr/include/libyang/hash_table.h #usr/include/libyang/in.h #usr/include/libyang/libyang.h #usr/include/libyang/log.h +#usr/include/libyang/ly_config.h #usr/include/libyang/metadata.h #usr/include/libyang/out.h #usr/include/libyang/parser_data.h @@ -24,8 +24,8 @@ #usr/include/libyang/tree_schema.h #usr/include/libyang/version.h #usr/lib/libyang.so -usr/lib/libyang.so.2 -usr/lib/libyang.so.2.46.3 +usr/lib/libyang.so.3 +usr/lib/libyang.so.3.6.10 #usr/lib/pkgconfig/libyang.pc #usr/share/man/man1/yanglint.1 #usr/share/man/man1/yangre.1 diff --git a/lfs/libyang b/lfs/libyang index 49163a44d..fb35a1490 100644 --- a/lfs/libyang +++ b/lfs/libyang @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.1.148 +VER = 3.7.8 THISAPP = libyang-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = e955958319a4ad8c241720c3a425ab2a298916b8ba34e91ff2b43bafaae65fb0d41c904af894d3c5025ab253a40cb6f4732137b195169785628f6cedeb054acb +$(DL_FILE)_BLAKE2 = c8a83babe5936e3c5bb80ea1d3762e8ad7db9f8e7cec5712f19559fe4de9605c87451360e8d75e36f897f608254ebc2322e3f6124c02f0cbe4cf8d38238f3b39 install : $(TARGET) -- 2.48.1

1 1

[PATCH] openssh: Update to version 9.9p2
by Adolf Belka 19 Feb '25

19 Feb '25

- Update from version 9.9p1 to 9.9p2 - Update of rootfile not required - Changelog 9.9p2 Security * Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1 (inclusive) contained a logic error that allowed an on-path attacker (a.k.a MITM) to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is off by default. * Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1 (inclusive) is vulnerable to a memory/CPU denial-of-service related to the handling of SSH2_MSG_PING packets. This condition may be mitigated using the existing PerSourcePenalties feature. Both vulnerabilities were discovered and demonstrated to be exploitable by the Qualys Security Advisory team. We thank them for their detailed review of OpenSSH. Bugfixes * ssh(1), sshd(8): fix regression in Match directive that caused failures when predicates and their arguments were separated by '=' characters instead of whitespace (bz3739). * sshd(8): fix the "Match invalid-user" predicate, which was matching incorrectly in the initial pass of config evaluation. * ssh(1), sshd(8), ssh-keyscan(1): fix mlkem768x25519-sha256 key exchange on big-endian systems. * Fix a number of build problems on particular operating systems / configurations. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openssh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index b1c9a1635..f2165a96d 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 9.9p1 +VER = 9.9p2 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 817d267e42b8be74a13e0cfd7999bdb4dab6355c7f62c1a4dd89adad310c5fb7fe3f17109ce1a36cd269a3639c1b8f1d18330c615ab3b419253ec027cfa20997 +$(DL_FILE)_BLAKE2 = 1b5bc09482b3a807ccfee52c86c6be3c363acf0c8e774862e0ae64f76bfeb4ce7cf29b3ed2f99c04c89bb4977da0cf50a7a175b15bf1d9925de1e03c66f8306d install : $(TARGET) -- 2.48.1

2 2

OpenSSH 9.9p2 - Two vulnerabilities discovered
by Michael Tremer 19 Feb '25

19 Feb '25

Hello everyone, Does anyone have time to update OpenSSH for me? https://www.openssh.com/releasenotes.html#9.9p2 Best, -Michael

2 2

Re: Reason why we do not set rigthca in the strongswan conf
by Jonatan Schlag 18 Feb '25

18 Feb '25

Hi, > Am 12.02.2025 um 10:26 schrieb Michael Tremer <michael.tremer(a)ipfire.org>: > Hello Jonatan, > > That is a good question. I am aware of the certificate pinning problem that we have here and that we cannot easily just roll over the host certificate (which we should be able to!) because it is pinned on the remote side. I did not have time to look into this in detail, but simply accepting the CA would be a good solution for this and potentially will make the configuration even easier. > > Long term, I would like to think how to move away from X.509 for IPsec, but that is a story for another day. Because the work of maintaining a certificate is too much? Or what are the reasons? I only need a short explanation. If there is a better alternative to implement then certificates, I’m happy to use this one. And we both don’t need to turn further time into how this strongswan feature works. > > What are the disadvantages of just using the CA? I suppose there is the problem that most people don’t use the FQDN of the remote side to establish their connections. Very often, the firewall does not even have a proper FQDN that actually resolves to the right IP address at all; therefore I believe that we cannot even perform any solid validation based on the certificate’s subject/hostname. > > Usually within IPFire, this should not be a problem because the CA is not issuing that many certificates, but in theory it is possible to use a public CA. Both problems put together would mean that the remote firewall will accept *any* certificate that has ever been issued (even some road warrior certificates that might have been issued); or in case of a public CA like Let’s Encrypt, this could be a large chunk of the internet. > The remote side id is also checked, isn’t it? So we could somehow pin to one certificate even if the hostname does not match. And if Let’s Encrypt provides you with a cert which has a subject alternative name set to something random, I would be very surprised. > How does strongswan deal with incoming connections? Just because it has a CA does not mean that it should find the right connection because this usually is found by the subject of the certificate. Does it simply iterate through all CAs and go with anything that matches? That would be very broad as well I suppose. It’s kind of interesting. I’ve just read the documentation one more time and apparently you are supposed to set this option to the distinguished name of the certificate authority. I simply provided the file of my certificate authority certificate and it seems to work also. So we could set this relatively narrow, to the certificate authority we imported. Jonatan > > So in theory, I like the idea, just the CA should be enough. But I believe in practice there might be some problems. Maybe some of the things I outlined here are not a concern at all; that would need to be tested. Are you up for that? > > -Michael > >> On 8 Feb 2025, at 20:50, Jonatan Schlag <jonatan.schlag(a)ipfire.org> wrote: >> >> Hi list, >> >> recently I had to renew the host cert of my IPFire system for >> strongswan. As we currently write: >> >> rightcert = >> >> into the config (see for this: >> https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=html/cgi-bin/vpnmain.cgi;… >> I have to change the cert of the remote system as well. Is there a >> reason for this? When I use >> >> rightca= >> >> the connection works out of the box. Is there a reason why we make not >> use of this option? >> >> Jonatan

2 1

[PATCH] systemd: Update to 257.3
by Stefan Schantl 16 Feb '25

16 Feb '25

This is a major update to the latest stable version of systemd. * Drop patch for exporting sd-netlink framework * Adjust download URL to use new GitHub macro * Disable bpf-framework which requires clang or bpf-gcc Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- ...evert-sd-netlink-unexport-sd-netlink.patch | 1416 ----------------- systemd/systemd.nm | 19 +- 2 files changed, 13 insertions(+), 1422 deletions(-) delete mode 100644 systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch diff --git a/systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch b/systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch deleted file mode 100644 index 4507a1086..000000000 --- a/systemd/patches/0001-Revert-sd-netlink-unexport-sd-netlink.patch +++ /dev/null @@ -1,1416 +0,0 @@ -From b0ca7a9351fab7a339357cbc17800e11ccae91e8 Mon Sep 17 00:00:00 2001 -From: Jonatan Schlag <jonatan.schlag(a)ipfire.org> -Date: Tue, 19 Sep 2023 11:58:49 +0000 -Subject: [PATCH] Revert "sd-netlink: unexport sd-netlink" - -This reverts commit dd35a61cafb5ffb380f92f45b9d9e3ac1f53351b. ---- - src/libsystemd/libsystemd.sym | 155 ++++++++++++++++++ - src/libsystemd/sd-netlink/netlink-genl.c | 10 +- - .../sd-netlink/netlink-message-rtnl.c | 134 +++++++-------- - src/libsystemd/sd-netlink/netlink-message.c | 100 +++++------ - src/libsystemd/sd-netlink/sd-netlink.c | 26 +-- - src/systemd/meson.build | 2 +- - 6 files changed, 291 insertions(+), 136 deletions(-) - -diff --git a/src/libsystemd/libsystemd.sym b/src/libsystemd/libsystemd.sym -index 56a8831f0f..0f84848064 100644 ---- a/src/libsystemd/libsystemd.sym -+++ b/src/libsystemd/libsystemd.sym -@@ -795,6 +795,161 @@ global: - sd_id128_string_equal; - - sd_hwdb_new_from_path; -+ -+ sd_netlink_open; -+ sd_netlink_open_fd; -+ sd_netlink_increase_rxbuf; -+ sd_netlink_ref; -+ sd_netlink_unref; -+ sd_netlink_send; -+ sd_netlink_call_async; -+ sd_netlink_call; -+ sd_netlink_read; -+ sd_netlink_get_events; -+ sd_netlink_get_timeout; -+ sd_netlink_process; -+ sd_netlink_wait; -+ sd_netlink_add_match; -+ sd_netlink_attach_event; -+ sd_netlink_detach_event; -+ sd_netlink_attach_filter; -+ sd_netlink_message_append_string; -+ sd_netlink_message_append_strv; -+ sd_netlink_message_append_flag; -+ sd_netlink_message_append_u8; -+ sd_netlink_message_append_u16; -+ sd_netlink_message_append_u32; -+ sd_netlink_message_append_u64; -+ sd_netlink_message_append_s8; -+ sd_netlink_message_append_s16; -+ sd_netlink_message_append_s32; -+ sd_netlink_message_append_s64; -+ sd_netlink_message_append_data; -+ sd_netlink_message_append_container_data; -+ sd_netlink_message_append_in_addr; -+ sd_netlink_message_append_in6_addr; -+ sd_netlink_message_append_sockaddr_in; -+ sd_netlink_message_append_sockaddr_in6; -+ sd_netlink_message_append_ether_addr; -+ sd_netlink_message_append_cache_info; -+ sd_netlink_message_open_container; -+ sd_netlink_message_open_container_union; -+ sd_netlink_message_close_container; -+ sd_netlink_message_read; -+ sd_netlink_message_read_data; -+ sd_netlink_message_read_data_suffix0; -+ sd_netlink_message_read_string_strdup; -+ sd_netlink_message_read_string; -+ sd_netlink_message_read_strv; -+ sd_netlink_message_read_u8; -+ sd_netlink_message_read_u16; -+ sd_netlink_message_read_u32; -+ sd_netlink_message_read_ether_addr; -+ sd_netlink_message_read_cache_info; -+ sd_netlink_message_read_in_addr; -+ sd_netlink_message_read_in6_addr; -+ sd_netlink_message_has_flag; -+ sd_netlink_message_enter_container; -+ sd_netlink_message_enter_array; -+ sd_netlink_message_exit_container; -+ sd_netlink_message_open_array; -+ sd_netlink_message_cancel_array; -+ sd_netlink_message_rewind; -+ sd_netlink_message_next; -+ sd_netlink_message_ref; -+ sd_netlink_message_unref; -+ sd_netlink_message_set_request_dump; -+ sd_netlink_message_is_error; -+ sd_netlink_message_get_errno; -+ sd_netlink_message_get_type; -+ sd_netlink_message_set_flags; -+ sd_netlink_message_is_broadcast; -+ sd_netlink_message_get_max_attribute; -+ sd_netlink_slot_ref; -+ sd_netlink_slot_unref; -+ sd_netlink_slot_get_netlink; -+ sd_netlink_slot_get_userdata; -+ sd_netlink_slot_set_userdata; -+ sd_netlink_slot_get_destroy_callback; -+ sd_netlink_slot_set_destroy_callback; -+ sd_netlink_slot_get_floating; -+ sd_netlink_slot_set_floating; -+ sd_netlink_slot_get_description; -+ sd_netlink_slot_set_description; -+ -+ sd_rtnl_message_get_family; -+ sd_rtnl_message_new_addr; -+ sd_rtnl_message_new_addr_update; -+ sd_rtnl_message_addr_set_prefixlen; -+ sd_rtnl_message_addr_set_scope; -+ sd_rtnl_message_addr_set_flags; -+ sd_rtnl_message_addr_get_family; -+ sd_rtnl_message_addr_get_prefixlen; -+ sd_rtnl_message_addr_get_scope; -+ sd_rtnl_message_addr_get_flags; -+ sd_rtnl_message_addr_get_ifindex; -+ sd_rtnl_message_new_link; -+ sd_rtnl_message_link_set_flags; -+ sd_rtnl_message_link_set_type; -+ sd_rtnl_message_link_set_family; -+ sd_rtnl_message_link_get_ifindex; -+ sd_rtnl_message_link_get_flags; -+ sd_rtnl_message_link_get_type; -+ sd_rtnl_message_new_route; -+ sd_rtnl_message_route_set_dst_prefixlen; -+ sd_rtnl_message_route_set_src_prefixlen; -+ sd_rtnl_message_route_set_scope; -+ sd_rtnl_message_route_set_flags; -+ sd_rtnl_message_route_set_table; -+ sd_rtnl_message_route_set_type; -+ sd_rtnl_message_route_get_flags; -+ sd_rtnl_message_route_get_family; -+ sd_rtnl_message_route_get_protocol; -+ sd_rtnl_message_route_get_scope; -+ sd_rtnl_message_route_get_tos; -+ sd_rtnl_message_route_get_table; -+ sd_rtnl_message_route_get_dst_prefixlen; -+ sd_rtnl_message_route_get_src_prefixlen; -+ sd_rtnl_message_route_get_type; -+ sd_rtnl_message_new_nexthop; -+ sd_rtnl_message_nexthop_set_flags; -+ sd_rtnl_message_nexthop_get_flags; -+ sd_rtnl_message_nexthop_get_family; -+ sd_rtnl_message_nexthop_get_protocol; -+ sd_rtnl_message_new_neigh; -+ sd_rtnl_message_neigh_set_flags; -+ sd_rtnl_message_neigh_set_state; -+ sd_rtnl_message_neigh_get_family; -+ sd_rtnl_message_neigh_get_ifindex; -+ sd_rtnl_message_neigh_get_state; -+ sd_rtnl_message_neigh_get_flags; -+ sd_rtnl_message_new_addrlabel; -+ sd_rtnl_message_addrlabel_set_prefixlen; -+ sd_rtnl_message_addrlabel_get_prefixlen; -+ sd_rtnl_message_new_routing_policy_rule; -+ sd_rtnl_message_routing_policy_rule_set_tos; -+ sd_rtnl_message_routing_policy_rule_get_tos; -+ sd_rtnl_message_routing_policy_rule_set_table; -+ sd_rtnl_message_routing_policy_rule_get_table; -+ sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen; -+ sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen; -+ sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen; -+ sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen; -+ sd_rtnl_message_routing_policy_rule_set_fib_type; -+ sd_rtnl_message_routing_policy_rule_get_fib_type; -+ sd_rtnl_message_routing_policy_rule_set_flags; -+ sd_rtnl_message_routing_policy_rule_get_flags; -+ sd_rtnl_message_new_traffic_control; -+ sd_rtnl_message_traffic_control_get_ifindex; -+ sd_rtnl_message_traffic_control_get_handle; -+ sd_rtnl_message_traffic_control_get_parent; -+ sd_rtnl_message_new_mdb; -+ -+ sd_genl_socket_open; -+ sd_genl_message_new; -+ sd_genl_message_get_family_name; -+ sd_genl_message_get_command; -+ sd_genl_add_match; - } LIBSYSTEMD_251; - - LIBSYSTEMD_253 { -diff --git a/src/libsystemd/sd-netlink/netlink-genl.c b/src/libsystemd/sd-netlink/netlink-genl.c -index 1dc62e89ba..aeb4b8a686 100644 ---- a/src/libsystemd/sd-netlink/netlink-genl.c -+++ b/src/libsystemd/sd-netlink/netlink-genl.c -@@ -365,7 +365,7 @@ int genl_get_policy_set_and_header_size( - return 0; - } - --int sd_genl_message_new(sd_netlink *nl, const char *family_name, uint8_t cmd, sd_netlink_message **ret) { -+_public_ int sd_genl_message_new(sd_netlink *nl, const char *family_name, uint8_t cmd, sd_netlink_message **ret) { - const GenericNetlinkFamily *family; - int r; - -@@ -381,7 +381,7 @@ int sd_genl_message_new(sd_netlink *nl, const char *family_name, uint8_t cmd, sd - return genl_message_new(nl, family, cmd, ret); - } - --int sd_genl_message_get_family_name(sd_netlink *nl, sd_netlink_message *m, const char **ret) { -+_public_ int sd_genl_message_get_family_name(sd_netlink *nl, sd_netlink_message *m, const char **ret) { - const GenericNetlinkFamily *family; - uint16_t nlmsg_type; - int r; -@@ -403,7 +403,7 @@ int sd_genl_message_get_family_name(sd_netlink *nl, sd_netlink_message *m, const - return 0; - } - --int sd_genl_message_get_command(sd_netlink *nl, sd_netlink_message *m, uint8_t *ret) { -+_public_ int sd_genl_message_get_command(sd_netlink *nl, sd_netlink_message *m, uint8_t *ret) { - struct genlmsghdr *h; - uint16_t nlmsg_type; - size_t size; -@@ -448,7 +448,7 @@ static int genl_family_get_multicast_group_id_by_name(const GenericNetlinkFamily - return 0; - } - --int sd_genl_add_match( -+_public_ int sd_genl_add_match( - sd_netlink *nl, - sd_netlink_slot **ret_slot, - const char *family_name, -@@ -483,6 +483,6 @@ int sd_genl_add_match( - callback, destroy_callback, userdata, description); - } - --int sd_genl_socket_open(sd_netlink **ret) { -+_public_ int sd_genl_socket_open(sd_netlink **ret) { - return netlink_open_family(ret, NETLINK_GENERIC); - } -diff --git a/src/libsystemd/sd-netlink/netlink-message-rtnl.c b/src/libsystemd/sd-netlink/netlink-message-rtnl.c -index 008e8022b1..ae1d217294 100644 ---- a/src/libsystemd/sd-netlink/netlink-message-rtnl.c -+++ b/src/libsystemd/sd-netlink/netlink-message-rtnl.c -@@ -56,7 +56,7 @@ static bool rtnl_message_type_is_mdb(uint16_t type) { - return IN_SET(type, RTM_NEWMDB, RTM_DELMDB, RTM_GETMDB); - } - --int sd_rtnl_message_route_set_dst_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { -+_public_ int sd_rtnl_message_route_set_dst_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -74,7 +74,7 @@ int sd_rtnl_message_route_set_dst_prefixlen(sd_netlink_message *m, unsigned char - return 0; - } - --int sd_rtnl_message_route_set_src_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { -+_public_ int sd_rtnl_message_route_set_src_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -92,7 +92,7 @@ int sd_rtnl_message_route_set_src_prefixlen(sd_netlink_message *m, unsigned char - return 0; - } - --int sd_rtnl_message_route_set_scope(sd_netlink_message *m, unsigned char scope) { -+_public_ int sd_rtnl_message_route_set_scope(sd_netlink_message *m, unsigned char scope) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -106,7 +106,7 @@ int sd_rtnl_message_route_set_scope(sd_netlink_message *m, unsigned char scope) - return 0; - } - --int sd_rtnl_message_route_set_flags(sd_netlink_message *m, unsigned flags) { -+_public_ int sd_rtnl_message_route_set_flags(sd_netlink_message *m, unsigned flags) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -120,7 +120,7 @@ int sd_rtnl_message_route_set_flags(sd_netlink_message *m, unsigned flags) { - return 0; - } - --int sd_rtnl_message_route_get_flags(sd_netlink_message *m, unsigned *flags) { -+_public_ int sd_rtnl_message_route_get_flags(sd_netlink_message *m, unsigned *flags) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -135,7 +135,7 @@ int sd_rtnl_message_route_get_flags(sd_netlink_message *m, unsigned *flags) { - return 0; - } - --int sd_rtnl_message_route_set_table(sd_netlink_message *m, unsigned char table) { -+_public_ int sd_rtnl_message_route_set_table(sd_netlink_message *m, unsigned char table) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -149,7 +149,7 @@ int sd_rtnl_message_route_set_table(sd_netlink_message *m, unsigned char table) - return 0; - } - --int sd_rtnl_message_route_get_family(sd_netlink_message *m, int *family) { -+_public_ int sd_rtnl_message_route_get_family(sd_netlink_message *m, int *family) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -164,7 +164,7 @@ int sd_rtnl_message_route_get_family(sd_netlink_message *m, int *family) { - return 0; - } - --int sd_rtnl_message_route_get_type(sd_netlink_message *m, unsigned char *type) { -+_public_ int sd_rtnl_message_route_get_type(sd_netlink_message *m, unsigned char *type) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -179,7 +179,7 @@ int sd_rtnl_message_route_get_type(sd_netlink_message *m, unsigned char *type) { - return 0; - } - --int sd_rtnl_message_route_set_type(sd_netlink_message *m, unsigned char type) { -+_public_ int sd_rtnl_message_route_set_type(sd_netlink_message *m, unsigned char type) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -193,7 +193,7 @@ int sd_rtnl_message_route_set_type(sd_netlink_message *m, unsigned char type) { - return 0; - } - --int sd_rtnl_message_route_get_protocol(sd_netlink_message *m, unsigned char *protocol) { -+_public_ int sd_rtnl_message_route_get_protocol(sd_netlink_message *m, unsigned char *protocol) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -208,7 +208,7 @@ int sd_rtnl_message_route_get_protocol(sd_netlink_message *m, unsigned char *pro - return 0; - } - --int sd_rtnl_message_route_get_scope(sd_netlink_message *m, unsigned char *scope) { -+_public_ int sd_rtnl_message_route_get_scope(sd_netlink_message *m, unsigned char *scope) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -223,7 +223,7 @@ int sd_rtnl_message_route_get_scope(sd_netlink_message *m, unsigned char *scope) - return 0; - } - --int sd_rtnl_message_route_get_tos(sd_netlink_message *m, uint8_t *tos) { -+_public_ int sd_rtnl_message_route_get_tos(sd_netlink_message *m, uint8_t *tos) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -238,7 +238,7 @@ int sd_rtnl_message_route_get_tos(sd_netlink_message *m, uint8_t *tos) { - return 0; - } - --int sd_rtnl_message_route_get_table(sd_netlink_message *m, unsigned char *table) { -+_public_ int sd_rtnl_message_route_get_table(sd_netlink_message *m, unsigned char *table) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -253,7 +253,7 @@ int sd_rtnl_message_route_get_table(sd_netlink_message *m, unsigned char *table) - return 0; - } - --int sd_rtnl_message_route_get_dst_prefixlen(sd_netlink_message *m, unsigned char *dst_len) { -+_public_ int sd_rtnl_message_route_get_dst_prefixlen(sd_netlink_message *m, unsigned char *dst_len) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -268,7 +268,7 @@ int sd_rtnl_message_route_get_dst_prefixlen(sd_netlink_message *m, unsigned char - return 0; - } - --int sd_rtnl_message_route_get_src_prefixlen(sd_netlink_message *m, unsigned char *src_len) { -+_public_ int sd_rtnl_message_route_get_src_prefixlen(sd_netlink_message *m, unsigned char *src_len) { - struct rtmsg *rtm; - - assert_return(m, -EINVAL); -@@ -283,7 +283,7 @@ int sd_rtnl_message_route_get_src_prefixlen(sd_netlink_message *m, unsigned char - return 0; - } - --int sd_rtnl_message_new_route(sd_netlink *rtnl, sd_netlink_message **ret, -+_public_ int sd_rtnl_message_new_route(sd_netlink *rtnl, sd_netlink_message **ret, - uint16_t nlmsg_type, int rtm_family, - unsigned char rtm_protocol) { - struct rtmsg *rtm; -@@ -309,7 +309,7 @@ int sd_rtnl_message_new_route(sd_netlink *rtnl, sd_netlink_message **ret, - return 0; - } - --int sd_rtnl_message_new_nexthop(sd_netlink *rtnl, sd_netlink_message **ret, -+_public_ int sd_rtnl_message_new_nexthop(sd_netlink *rtnl, sd_netlink_message **ret, - uint16_t nlmsg_type, int nh_family, - unsigned char nh_protocol) { - struct nhmsg *nhm; -@@ -347,7 +347,7 @@ int sd_rtnl_message_new_nexthop(sd_netlink *rtnl, sd_netlink_message **ret, - return 0; - } - --int sd_rtnl_message_nexthop_set_flags(sd_netlink_message *m, uint8_t flags) { -+_public_ int sd_rtnl_message_nexthop_set_flags(sd_netlink_message *m, uint8_t flags) { - struct nhmsg *nhm; - - assert_return(m, -EINVAL); -@@ -360,7 +360,7 @@ int sd_rtnl_message_nexthop_set_flags(sd_netlink_message *m, uint8_t flags) { - return 0; - } - --int sd_rtnl_message_nexthop_get_flags(sd_netlink_message *m, uint8_t *ret) { -+_public_ int sd_rtnl_message_nexthop_get_flags(sd_netlink_message *m, uint8_t *ret) { - struct nhmsg *nhm; - - assert_return(m, -EINVAL); -@@ -374,7 +374,7 @@ int sd_rtnl_message_nexthop_get_flags(sd_netlink_message *m, uint8_t *ret) { - return 0; - } - --int sd_rtnl_message_nexthop_get_family(sd_netlink_message *m, uint8_t *family) { -+_public_ int sd_rtnl_message_nexthop_get_family(sd_netlink_message *m, uint8_t *family) { - struct nhmsg *nhm; - - assert_return(m, -EINVAL); -@@ -388,7 +388,7 @@ int sd_rtnl_message_nexthop_get_family(sd_netlink_message *m, uint8_t *family) { - return 0; - } - --int sd_rtnl_message_nexthop_get_protocol(sd_netlink_message *m, uint8_t *protocol) { -+_public_ int sd_rtnl_message_nexthop_get_protocol(sd_netlink_message *m, uint8_t *protocol) { - struct nhmsg *nhm; - - assert_return(m, -EINVAL); -@@ -402,7 +402,7 @@ int sd_rtnl_message_nexthop_get_protocol(sd_netlink_message *m, uint8_t *protoco - return 0; - } - --int sd_rtnl_message_neigh_set_flags(sd_netlink_message *m, uint8_t flags) { -+_public_ int sd_rtnl_message_neigh_set_flags(sd_netlink_message *m, uint8_t flags) { - struct ndmsg *ndm; - - assert_return(m, -EINVAL); -@@ -415,7 +415,7 @@ int sd_rtnl_message_neigh_set_flags(sd_netlink_message *m, uint8_t flags) { - return 0; - } - --int sd_rtnl_message_neigh_set_state(sd_netlink_message *m, uint16_t state) { -+_public_ int sd_rtnl_message_neigh_set_state(sd_netlink_message *m, uint16_t state) { - struct ndmsg *ndm; - - assert_return(m, -EINVAL); -@@ -428,7 +428,7 @@ int sd_rtnl_message_neigh_set_state(sd_netlink_message *m, uint16_t state) { - return 0; - } - --int sd_rtnl_message_neigh_get_flags(sd_netlink_message *m, uint8_t *flags) { -+_public_ int sd_rtnl_message_neigh_get_flags(sd_netlink_message *m, uint8_t *flags) { - struct ndmsg *ndm; - - assert_return(m, -EINVAL); -@@ -441,7 +441,7 @@ int sd_rtnl_message_neigh_get_flags(sd_netlink_message *m, uint8_t *flags) { - return 0; - } - --int sd_rtnl_message_neigh_get_state(sd_netlink_message *m, uint16_t *state) { -+_public_ int sd_rtnl_message_neigh_get_state(sd_netlink_message *m, uint16_t *state) { - struct ndmsg *ndm; - - assert_return(m, -EINVAL); -@@ -454,7 +454,7 @@ int sd_rtnl_message_neigh_get_state(sd_netlink_message *m, uint16_t *state) { - return 0; - } - --int sd_rtnl_message_neigh_get_family(sd_netlink_message *m, int *family) { -+_public_ int sd_rtnl_message_neigh_get_family(sd_netlink_message *m, int *family) { - struct ndmsg *ndm; - - assert_return(m, -EINVAL); -@@ -469,7 +469,7 @@ int sd_rtnl_message_neigh_get_family(sd_netlink_message *m, int *family) { - return 0; - } - --int sd_rtnl_message_neigh_get_ifindex(sd_netlink_message *m, int *index) { -+_public_ int sd_rtnl_message_neigh_get_ifindex(sd_netlink_message *m, int *index) { - struct ndmsg *ndm; - - assert_return(m, -EINVAL); -@@ -484,7 +484,7 @@ int sd_rtnl_message_neigh_get_ifindex(sd_netlink_message *m, int *index) { - return 0; - } - --int sd_rtnl_message_new_neigh( -+_public_ int sd_rtnl_message_new_neigh( - sd_netlink *rtnl, - sd_netlink_message **ret, - uint16_t nlmsg_type, -@@ -517,7 +517,7 @@ int sd_rtnl_message_new_neigh( - return 0; - } - --int sd_rtnl_message_link_set_flags(sd_netlink_message *m, unsigned flags, unsigned change) { -+_public_ int sd_rtnl_message_link_set_flags(sd_netlink_message *m, unsigned flags, unsigned change) { - struct ifinfomsg *ifi; - - assert_return(m, -EINVAL); -@@ -533,7 +533,7 @@ int sd_rtnl_message_link_set_flags(sd_netlink_message *m, unsigned flags, unsign - return 0; - } - --int sd_rtnl_message_link_set_type(sd_netlink_message *m, unsigned type) { -+_public_ int sd_rtnl_message_link_set_type(sd_netlink_message *m, unsigned type) { - struct ifinfomsg *ifi; - - assert_return(m, -EINVAL); -@@ -547,7 +547,7 @@ int sd_rtnl_message_link_set_type(sd_netlink_message *m, unsigned type) { - return 0; - } - --int sd_rtnl_message_link_set_family(sd_netlink_message *m, unsigned family) { -+_public_ int sd_rtnl_message_link_set_family(sd_netlink_message *m, unsigned family) { - struct ifinfomsg *ifi; - - assert_return(m, -EINVAL); -@@ -561,7 +561,7 @@ int sd_rtnl_message_link_set_family(sd_netlink_message *m, unsigned family) { - return 0; - } - --int sd_rtnl_message_new_link(sd_netlink *rtnl, sd_netlink_message **ret, -+_public_ int sd_rtnl_message_new_link(sd_netlink *rtnl, sd_netlink_message **ret, - uint16_t nlmsg_type, int index) { - struct ifinfomsg *ifi; - int r; -@@ -586,7 +586,7 @@ int sd_rtnl_message_new_link(sd_netlink *rtnl, sd_netlink_message **ret, - return 0; - } - --int sd_rtnl_message_addr_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { -+_public_ int sd_rtnl_message_addr_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -604,7 +604,7 @@ int sd_rtnl_message_addr_set_prefixlen(sd_netlink_message *m, unsigned char pref - return 0; - } - --int sd_rtnl_message_addr_set_flags(sd_netlink_message *m, unsigned char flags) { -+_public_ int sd_rtnl_message_addr_set_flags(sd_netlink_message *m, unsigned char flags) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -618,7 +618,7 @@ int sd_rtnl_message_addr_set_flags(sd_netlink_message *m, unsigned char flags) { - return 0; - } - --int sd_rtnl_message_addr_set_scope(sd_netlink_message *m, unsigned char scope) { -+_public_ int sd_rtnl_message_addr_set_scope(sd_netlink_message *m, unsigned char scope) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -632,7 +632,7 @@ int sd_rtnl_message_addr_set_scope(sd_netlink_message *m, unsigned char scope) { - return 0; - } - --int sd_rtnl_message_addr_get_family(sd_netlink_message *m, int *ret_family) { -+_public_ int sd_rtnl_message_addr_get_family(sd_netlink_message *m, int *ret_family) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -647,7 +647,7 @@ int sd_rtnl_message_addr_get_family(sd_netlink_message *m, int *ret_family) { - return 0; - } - --int sd_rtnl_message_addr_get_prefixlen(sd_netlink_message *m, unsigned char *ret_prefixlen) { -+_public_ int sd_rtnl_message_addr_get_prefixlen(sd_netlink_message *m, unsigned char *ret_prefixlen) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -662,7 +662,7 @@ int sd_rtnl_message_addr_get_prefixlen(sd_netlink_message *m, unsigned char *ret - return 0; - } - --int sd_rtnl_message_addr_get_scope(sd_netlink_message *m, unsigned char *ret_scope) { -+_public_ int sd_rtnl_message_addr_get_scope(sd_netlink_message *m, unsigned char *ret_scope) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -677,7 +677,7 @@ int sd_rtnl_message_addr_get_scope(sd_netlink_message *m, unsigned char *ret_sco - return 0; - } - --int sd_rtnl_message_addr_get_flags(sd_netlink_message *m, unsigned char *ret_flags) { -+_public_ int sd_rtnl_message_addr_get_flags(sd_netlink_message *m, unsigned char *ret_flags) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -692,7 +692,7 @@ int sd_rtnl_message_addr_get_flags(sd_netlink_message *m, unsigned char *ret_fla - return 0; - } - --int sd_rtnl_message_addr_get_ifindex(sd_netlink_message *m, int *ret_ifindex) { -+_public_ int sd_rtnl_message_addr_get_ifindex(sd_netlink_message *m, int *ret_ifindex) { - struct ifaddrmsg *ifa; - - assert_return(m, -EINVAL); -@@ -707,7 +707,7 @@ int sd_rtnl_message_addr_get_ifindex(sd_netlink_message *m, int *ret_ifindex) { - return 0; - } - --int sd_rtnl_message_new_addr( -+_public_ int sd_rtnl_message_new_addr( - sd_netlink *rtnl, - sd_netlink_message **ret, - uint16_t nlmsg_type, -@@ -736,7 +736,7 @@ int sd_rtnl_message_new_addr( - return 0; - } - --int sd_rtnl_message_new_addr_update( -+_public_ int sd_rtnl_message_new_addr_update( - sd_netlink *rtnl, - sd_netlink_message **ret, - int index, -@@ -752,7 +752,7 @@ int sd_rtnl_message_new_addr_update( - return 0; - } - --int sd_rtnl_message_link_get_ifindex(sd_netlink_message *m, int *ifindex) { -+_public_ int sd_rtnl_message_link_get_ifindex(sd_netlink_message *m, int *ifindex) { - struct ifinfomsg *ifi; - - assert_return(m, -EINVAL); -@@ -767,7 +767,7 @@ int sd_rtnl_message_link_get_ifindex(sd_netlink_message *m, int *ifindex) { - return 0; - } - --int sd_rtnl_message_link_get_flags(sd_netlink_message *m, unsigned *flags) { -+_public_ int sd_rtnl_message_link_get_flags(sd_netlink_message *m, unsigned *flags) { - struct ifinfomsg *ifi; - - assert_return(m, -EINVAL); -@@ -782,7 +782,7 @@ int sd_rtnl_message_link_get_flags(sd_netlink_message *m, unsigned *flags) { - return 0; - } - --int sd_rtnl_message_link_get_type(sd_netlink_message *m, unsigned short *type) { -+_public_ int sd_rtnl_message_link_get_type(sd_netlink_message *m, unsigned short *type) { - struct ifinfomsg *ifi; - - assert_return(m, -EINVAL); -@@ -797,7 +797,7 @@ int sd_rtnl_message_link_get_type(sd_netlink_message *m, unsigned short *type) { - return 0; - } - --int sd_rtnl_message_get_family(sd_netlink_message *m, int *family) { -+_public_ int sd_rtnl_message_get_family(sd_netlink_message *m, int *family) { - assert_return(m, -EINVAL); - assert_return(family, -EINVAL); - -@@ -856,7 +856,7 @@ int sd_rtnl_message_get_family(sd_netlink_message *m, int *family) { - return -EOPNOTSUPP; - } - --int sd_rtnl_message_new_addrlabel( -+_public_ int sd_rtnl_message_new_addrlabel( - sd_netlink *rtnl, - sd_netlink_message **ret, - uint16_t nlmsg_type, -@@ -884,7 +884,7 @@ int sd_rtnl_message_new_addrlabel( - return 0; - } - --int sd_rtnl_message_addrlabel_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { -+_public_ int sd_rtnl_message_addrlabel_set_prefixlen(sd_netlink_message *m, unsigned char prefixlen) { - struct ifaddrlblmsg *addrlabel; - - assert_return(m, -EINVAL); -@@ -901,7 +901,7 @@ int sd_rtnl_message_addrlabel_set_prefixlen(sd_netlink_message *m, unsigned char - return 0; - } - --int sd_rtnl_message_addrlabel_get_prefixlen(sd_netlink_message *m, unsigned char *prefixlen) { -+_public_ int sd_rtnl_message_addrlabel_get_prefixlen(sd_netlink_message *m, unsigned char *prefixlen) { - struct ifaddrlblmsg *addrlabel; - - assert_return(m, -EINVAL); -@@ -915,7 +915,7 @@ int sd_rtnl_message_addrlabel_get_prefixlen(sd_netlink_message *m, unsigned char - return 0; - } - --int sd_rtnl_message_new_routing_policy_rule( -+_public_ int sd_rtnl_message_new_routing_policy_rule( - sd_netlink *rtnl, - sd_netlink_message **ret, - uint16_t nlmsg_type, -@@ -940,7 +940,7 @@ int sd_rtnl_message_new_routing_policy_rule( - return 0; - } - --int sd_rtnl_message_routing_policy_rule_set_tos(sd_netlink_message *m, uint8_t tos) { -+_public_ int sd_rtnl_message_routing_policy_rule_set_tos(sd_netlink_message *m, uint8_t tos) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -954,7 +954,7 @@ int sd_rtnl_message_routing_policy_rule_set_tos(sd_netlink_message *m, uint8_t t - return 0; - } - --int sd_rtnl_message_routing_policy_rule_get_tos(sd_netlink_message *m, uint8_t *tos) { -+_public_ int sd_rtnl_message_routing_policy_rule_get_tos(sd_netlink_message *m, uint8_t *tos) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -968,7 +968,7 @@ int sd_rtnl_message_routing_policy_rule_get_tos(sd_netlink_message *m, uint8_t * - return 0; - } - --int sd_rtnl_message_routing_policy_rule_set_table(sd_netlink_message *m, uint8_t table) { -+_public_ int sd_rtnl_message_routing_policy_rule_set_table(sd_netlink_message *m, uint8_t table) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -982,7 +982,7 @@ int sd_rtnl_message_routing_policy_rule_set_table(sd_netlink_message *m, uint8_t - return 0; - } - --int sd_rtnl_message_routing_policy_rule_get_table(sd_netlink_message *m, uint8_t *table) { -+_public_ int sd_rtnl_message_routing_policy_rule_get_table(sd_netlink_message *m, uint8_t *table) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -996,7 +996,7 @@ int sd_rtnl_message_routing_policy_rule_get_table(sd_netlink_message *m, uint8_t - return 0; - } - --int sd_rtnl_message_routing_policy_rule_set_flags(sd_netlink_message *m, uint32_t flags) { -+_public_ int sd_rtnl_message_routing_policy_rule_set_flags(sd_netlink_message *m, uint32_t flags) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1009,7 +1009,7 @@ int sd_rtnl_message_routing_policy_rule_set_flags(sd_netlink_message *m, uint32_ - return 0; - } - --int sd_rtnl_message_routing_policy_rule_get_flags(sd_netlink_message *m, uint32_t *flags) { -+_public_ int sd_rtnl_message_routing_policy_rule_get_flags(sd_netlink_message *m, uint32_t *flags) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1022,7 +1022,7 @@ int sd_rtnl_message_routing_policy_rule_get_flags(sd_netlink_message *m, uint32_ - return 0; - } - --int sd_rtnl_message_routing_policy_rule_set_fib_type(sd_netlink_message *m, uint8_t type) { -+_public_ int sd_rtnl_message_routing_policy_rule_set_fib_type(sd_netlink_message *m, uint8_t type) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1036,7 +1036,7 @@ int sd_rtnl_message_routing_policy_rule_set_fib_type(sd_netlink_message *m, uint - return 0; - } - --int sd_rtnl_message_routing_policy_rule_get_fib_type(sd_netlink_message *m, uint8_t *type) { -+_public_ int sd_rtnl_message_routing_policy_rule_get_fib_type(sd_netlink_message *m, uint8_t *type) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1050,7 +1050,7 @@ int sd_rtnl_message_routing_policy_rule_get_fib_type(sd_netlink_message *m, uint - return 0; - } - --int sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen(sd_netlink_message *m, uint8_t len) { -+_public_ int sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen(sd_netlink_message *m, uint8_t len) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1064,7 +1064,7 @@ int sd_rtnl_message_routing_policy_rule_set_fib_dst_prefixlen(sd_netlink_message - return 0; - } - --int sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen(sd_netlink_message *m, uint8_t *len) { -+_public_ int sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen(sd_netlink_message *m, uint8_t *len) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1078,7 +1078,7 @@ int sd_rtnl_message_routing_policy_rule_get_fib_dst_prefixlen(sd_netlink_message - return 0; - } - --int sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen(sd_netlink_message *m, uint8_t len) { -+_public_ int sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen(sd_netlink_message *m, uint8_t len) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1092,7 +1092,7 @@ int sd_rtnl_message_routing_policy_rule_set_fib_src_prefixlen(sd_netlink_message - return 0; - } - --int sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen(sd_netlink_message *m, uint8_t *len) { -+_public_ int sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen(sd_netlink_message *m, uint8_t *len) { - struct fib_rule_hdr *frh; - - assert_return(m, -EINVAL); -@@ -1106,7 +1106,7 @@ int sd_rtnl_message_routing_policy_rule_get_fib_src_prefixlen(sd_netlink_message - return 0; - } - --int sd_rtnl_message_new_traffic_control( -+_public_ int sd_rtnl_message_new_traffic_control( - sd_netlink *rtnl, - sd_netlink_message **ret, - uint16_t nlmsg_type, -@@ -1135,7 +1135,7 @@ int sd_rtnl_message_new_traffic_control( - return 0; - } - --int sd_rtnl_message_traffic_control_get_ifindex(sd_netlink_message *m, int *ret) { -+_public_ int sd_rtnl_message_traffic_control_get_ifindex(sd_netlink_message *m, int *ret) { - struct tcmsg *tcm; - - assert_return(m, -EINVAL); -@@ -1149,7 +1149,7 @@ int sd_rtnl_message_traffic_control_get_ifindex(sd_netlink_message *m, int *ret) - return 0; - } - --int sd_rtnl_message_traffic_control_get_handle(sd_netlink_message *m, uint32_t *ret) { -+_public_ int sd_rtnl_message_traffic_control_get_handle(sd_netlink_message *m, uint32_t *ret) { - struct tcmsg *tcm; - - assert_return(m, -EINVAL); -@@ -1163,7 +1163,7 @@ int sd_rtnl_message_traffic_control_get_handle(sd_netlink_message *m, uint32_t * - return 0; - } - --int sd_rtnl_message_traffic_control_get_parent(sd_netlink_message *m, uint32_t *ret) { -+_public_ int sd_rtnl_message_traffic_control_get_parent(sd_netlink_message *m, uint32_t *ret) { - struct tcmsg *tcm; - - assert_return(m, -EINVAL); -@@ -1177,7 +1177,7 @@ int sd_rtnl_message_traffic_control_get_parent(sd_netlink_message *m, uint32_t * - return 0; - } - --int sd_rtnl_message_new_mdb( -+_public_ int sd_rtnl_message_new_mdb( - sd_netlink *rtnl, - sd_netlink_message **ret, - uint16_t nlmsg_type, -diff --git a/src/libsystemd/sd-netlink/netlink-message.c b/src/libsystemd/sd-netlink/netlink-message.c -index 000a50ee3e..33bec2ac9b 100644 ---- a/src/libsystemd/sd-netlink/netlink-message.c -+++ b/src/libsystemd/sd-netlink/netlink-message.c -@@ -113,7 +113,7 @@ int message_new_synthetic_error(sd_netlink *nl, int error, uint32_t serial, sd_n - return 0; - } - --int sd_netlink_message_set_request_dump(sd_netlink_message *m, int dump) { -+_public_ int sd_netlink_message_set_request_dump(sd_netlink_message *m, int dump) { - assert_return(m, -EINVAL); - assert_return(m->hdr, -EINVAL); - assert_return(m->protocol != NETLINK_ROUTE || -@@ -129,7 +129,7 @@ int sd_netlink_message_set_request_dump(sd_netlink_message *m, int dump) { - - DEFINE_TRIVIAL_REF_FUNC(sd_netlink_message, sd_netlink_message); - --sd_netlink_message* sd_netlink_message_unref(sd_netlink_message *m) { -+_public_ sd_netlink_message* sd_netlink_message_unref(sd_netlink_message *m) { - while (m && --m->n_ref == 0) { - unsigned i; - -@@ -146,7 +146,7 @@ sd_netlink_message* sd_netlink_message_unref(sd_netlink_message *m) { - return NULL; - } - --int sd_netlink_message_get_type(sd_netlink_message *m, uint16_t *ret) { -+_public_ int sd_netlink_message_get_type(sd_netlink_message *m, uint16_t *ret) { - assert_return(m, -EINVAL); - assert_return(ret, -EINVAL); - -@@ -155,7 +155,7 @@ int sd_netlink_message_get_type(sd_netlink_message *m, uint16_t *ret) { - return 0; - } - --int sd_netlink_message_set_flags(sd_netlink_message *m, uint16_t flags) { -+_public_ int sd_netlink_message_set_flags(sd_netlink_message *m, uint16_t flags) { - assert_return(m, -EINVAL); - assert_return(flags != 0, -EINVAL); - -@@ -164,7 +164,7 @@ int sd_netlink_message_set_flags(sd_netlink_message *m, uint16_t flags) { - return 0; - } - --int sd_netlink_message_is_broadcast(sd_netlink_message *m) { -+_public_ int sd_netlink_message_is_broadcast(sd_netlink_message *m) { - assert_return(m, -EINVAL); - - return m->multicast_group != 0; -@@ -230,7 +230,7 @@ static int message_attribute_has_type(sd_netlink_message *m, size_t *ret_size, u - return 0; - } - --int sd_netlink_message_append_string(sd_netlink_message *m, uint16_t attr_type, const char *data) { -+_public_ int sd_netlink_message_append_string(sd_netlink_message *m, uint16_t attr_type, const char *data) { - size_t length, size; - int r; - -@@ -256,7 +256,7 @@ int sd_netlink_message_append_string(sd_netlink_message *m, uint16_t attr_type, - return 0; - } - --int sd_netlink_message_append_strv(sd_netlink_message *m, uint16_t attr_type, const char* const *data) { -+_public_ int sd_netlink_message_append_strv(sd_netlink_message *m, uint16_t attr_type, const char* const *data) { - size_t length, size; - int r; - -@@ -284,7 +284,7 @@ int sd_netlink_message_append_strv(sd_netlink_message *m, uint16_t attr_type, co - return 0; - } - --int sd_netlink_message_append_flag(sd_netlink_message *m, uint16_t attr_type) { -+_public_ int sd_netlink_message_append_flag(sd_netlink_message *m, uint16_t attr_type) { - size_t size; - int r; - -@@ -302,7 +302,7 @@ int sd_netlink_message_append_flag(sd_netlink_message *m, uint16_t attr_type) { - return 0; - } - --int sd_netlink_message_append_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t data) { -+_public_ int sd_netlink_message_append_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -319,7 +319,7 @@ int sd_netlink_message_append_u8(sd_netlink_message *m, uint16_t attr_type, uint - return 0; - } - --int sd_netlink_message_append_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t data) { -+_public_ int sd_netlink_message_append_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -336,7 +336,7 @@ int sd_netlink_message_append_u16(sd_netlink_message *m, uint16_t attr_type, uin - return 0; - } - --int sd_netlink_message_append_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t data) { -+_public_ int sd_netlink_message_append_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -353,7 +353,7 @@ int sd_netlink_message_append_u32(sd_netlink_message *m, uint16_t attr_type, uin - return 0; - } - --int sd_netlink_message_append_u64(sd_netlink_message *m, uint16_t attr_type, uint64_t data) { -+_public_ int sd_netlink_message_append_u64(sd_netlink_message *m, uint16_t attr_type, uint64_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -370,7 +370,7 @@ int sd_netlink_message_append_u64(sd_netlink_message *m, uint16_t attr_type, uin - return 0; - } - --int sd_netlink_message_append_s8(sd_netlink_message *m, uint16_t attr_type, int8_t data) { -+_public_ int sd_netlink_message_append_s8(sd_netlink_message *m, uint16_t attr_type, int8_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -387,7 +387,7 @@ int sd_netlink_message_append_s8(sd_netlink_message *m, uint16_t attr_type, int8 - return 0; - } - --int sd_netlink_message_append_s16(sd_netlink_message *m, uint16_t attr_type, int16_t data) { -+_public_ int sd_netlink_message_append_s16(sd_netlink_message *m, uint16_t attr_type, int16_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -404,7 +404,7 @@ int sd_netlink_message_append_s16(sd_netlink_message *m, uint16_t attr_type, int - return 0; - } - --int sd_netlink_message_append_s32(sd_netlink_message *m, uint16_t attr_type, int32_t data) { -+_public_ int sd_netlink_message_append_s32(sd_netlink_message *m, uint16_t attr_type, int32_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -421,7 +421,7 @@ int sd_netlink_message_append_s32(sd_netlink_message *m, uint16_t attr_type, int - return 0; - } - --int sd_netlink_message_append_s64(sd_netlink_message *m, uint16_t attr_type, int64_t data) { -+_public_ int sd_netlink_message_append_s64(sd_netlink_message *m, uint16_t attr_type, int64_t data) { - int r; - - assert_return(m, -EINVAL); -@@ -438,7 +438,7 @@ int sd_netlink_message_append_s64(sd_netlink_message *m, uint16_t attr_type, int - return 0; - } - --int sd_netlink_message_append_data(sd_netlink_message *m, uint16_t attr_type, const void *data, size_t len) { -+_public_ int sd_netlink_message_append_data(sd_netlink_message *m, uint16_t attr_type, const void *data, size_t len) { - int r; - - assert_return(m, -EINVAL); -@@ -451,7 +451,7 @@ int sd_netlink_message_append_data(sd_netlink_message *m, uint16_t attr_type, co - return 0; - } - --int sd_netlink_message_append_container_data( -+_public_ int sd_netlink_message_append_container_data( - sd_netlink_message *m, - uint16_t container_type, - uint16_t attr_type, -@@ -493,11 +493,11 @@ int netlink_message_append_in_addr_union(sd_netlink_message *m, uint16_t attr_ty - return 0; - } - --int sd_netlink_message_append_in_addr(sd_netlink_message *m, uint16_t attr_type, const struct in_addr *data) { -+_public_ int sd_netlink_message_append_in_addr(sd_netlink_message *m, uint16_t attr_type, const struct in_addr *data) { - return netlink_message_append_in_addr_union(m, attr_type, AF_INET, (const union in_addr_union *) data); - } - --int sd_netlink_message_append_in6_addr(sd_netlink_message *m, uint16_t attr_type, const struct in6_addr *data) { -+_public_ int sd_netlink_message_append_in6_addr(sd_netlink_message *m, uint16_t attr_type, const struct in6_addr *data) { - return netlink_message_append_in_addr_union(m, attr_type, AF_INET6, (const union in_addr_union *) data); - } - -@@ -520,15 +520,15 @@ int netlink_message_append_sockaddr_union(sd_netlink_message *m, uint16_t attr_t - return 0; - } - --int sd_netlink_message_append_sockaddr_in(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in *data) { -+_public_ int sd_netlink_message_append_sockaddr_in(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in *data) { - return netlink_message_append_sockaddr_union(m, attr_type, (const union sockaddr_union *) data); - } - --int sd_netlink_message_append_sockaddr_in6(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in6 *data) { -+_public_ int sd_netlink_message_append_sockaddr_in6(sd_netlink_message *m, uint16_t attr_type, const struct sockaddr_in6 *data) { - return netlink_message_append_sockaddr_union(m, attr_type, (const union sockaddr_union *) data); - } - --int sd_netlink_message_append_ether_addr(sd_netlink_message *m, uint16_t attr_type, const struct ether_addr *data) { -+_public_ int sd_netlink_message_append_ether_addr(sd_netlink_message *m, uint16_t attr_type, const struct ether_addr *data) { - int r; - - assert_return(m, -EINVAL); -@@ -565,7 +565,7 @@ int netlink_message_append_hw_addr(sd_netlink_message *m, uint16_t attr_type, co - return 0; - } - --int sd_netlink_message_append_cache_info(sd_netlink_message *m, uint16_t attr_type, const struct ifa_cacheinfo *info) { -+_public_ int sd_netlink_message_append_cache_info(sd_netlink_message *m, uint16_t attr_type, const struct ifa_cacheinfo *info) { - int r; - - assert_return(m, -EINVAL); -@@ -583,7 +583,7 @@ int sd_netlink_message_append_cache_info(sd_netlink_message *m, uint16_t attr_ty - return 0; - } - --int sd_netlink_message_open_container(sd_netlink_message *m, uint16_t attr_type) { -+_public_ int sd_netlink_message_open_container(sd_netlink_message *m, uint16_t attr_type) { - size_t size; - int r; - -@@ -632,7 +632,7 @@ int sd_netlink_message_open_container(sd_netlink_message *m, uint16_t attr_type) - return 0; - } - --int sd_netlink_message_open_container_union(sd_netlink_message *m, uint16_t attr_type, const char *key) { -+_public_ int sd_netlink_message_open_container_union(sd_netlink_message *m, uint16_t attr_type, const char *key) { - const NLAPolicySetUnion *policy_set_union; - int r; - -@@ -671,7 +671,7 @@ int sd_netlink_message_open_container_union(sd_netlink_message *m, uint16_t attr - return 0; - } - --int sd_netlink_message_close_container(sd_netlink_message *m) { -+_public_ int sd_netlink_message_close_container(sd_netlink_message *m) { - assert_return(m, -EINVAL); - assert_return(!m->sealed, -EPERM); - assert_return(m->n_containers > 0, -EINVAL); -@@ -683,7 +683,7 @@ int sd_netlink_message_close_container(sd_netlink_message *m) { - return 0; - } - --int sd_netlink_message_open_array(sd_netlink_message *m, uint16_t attr_type) { -+_public_ int sd_netlink_message_open_array(sd_netlink_message *m, uint16_t attr_type) { - int r; - - assert_return(m, -EINVAL); -@@ -701,7 +701,7 @@ int sd_netlink_message_open_array(sd_netlink_message *m, uint16_t attr_type) { - return 0; - } - --int sd_netlink_message_cancel_array(sd_netlink_message *m) { -+_public_ int sd_netlink_message_cancel_array(sd_netlink_message *m) { - uint32_t rta_len; - - assert_return(m, -EINVAL); -@@ -757,7 +757,7 @@ static int netlink_message_read_internal( - return RTA_PAYLOAD(rta); - } - --int sd_netlink_message_read(sd_netlink_message *m, uint16_t attr_type, size_t size, void *data) { -+_public_ int sd_netlink_message_read(sd_netlink_message *m, uint16_t attr_type, size_t size, void *data) { - void *attr_data; - int r; - -@@ -776,7 +776,7 @@ int sd_netlink_message_read(sd_netlink_message *m, uint16_t attr_type, size_t si - return r; - } - --int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) { -+_public_ int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) { - void *attr_data; - int r; - -@@ -802,7 +802,7 @@ int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size - return r; - } - --int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) { -+_public_ int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) { - void *attr_data; - int r; - -@@ -828,7 +828,7 @@ int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_ty - return r; - } - --int sd_netlink_message_read_string_strdup(sd_netlink_message *m, uint16_t attr_type, char **data) { -+_public_ int sd_netlink_message_read_string_strdup(sd_netlink_message *m, uint16_t attr_type, char **data) { - void *attr_data; - int r; - -@@ -855,7 +855,7 @@ int sd_netlink_message_read_string_strdup(sd_netlink_message *m, uint16_t attr_t - return 0; - } - --int sd_netlink_message_read_string(sd_netlink_message *m, uint16_t attr_type, const char **data) { -+_public_ int sd_netlink_message_read_string(sd_netlink_message *m, uint16_t attr_type, const char **data) { - void *attr_data; - int r; - -@@ -878,7 +878,7 @@ int sd_netlink_message_read_string(sd_netlink_message *m, uint16_t attr_type, co - return 0; - } - --int sd_netlink_message_read_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t *data) { -+_public_ int sd_netlink_message_read_u8(sd_netlink_message *m, uint16_t attr_type, uint8_t *data) { - void *attr_data; - int r; - -@@ -901,7 +901,7 @@ int sd_netlink_message_read_u8(sd_netlink_message *m, uint16_t attr_type, uint8_ - return 0; - } - --int sd_netlink_message_read_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t *data) { -+_public_ int sd_netlink_message_read_u16(sd_netlink_message *m, uint16_t attr_type, uint16_t *data) { - void *attr_data; - bool net_byteorder; - int r; -@@ -929,7 +929,7 @@ int sd_netlink_message_read_u16(sd_netlink_message *m, uint16_t attr_type, uint1 - return 0; - } - --int sd_netlink_message_read_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t *data) { -+_public_ int sd_netlink_message_read_u32(sd_netlink_message *m, uint16_t attr_type, uint32_t *data) { - void *attr_data; - bool net_byteorder; - int r; -@@ -957,7 +957,7 @@ int sd_netlink_message_read_u32(sd_netlink_message *m, uint16_t attr_type, uint3 - return 0; - } - --int sd_netlink_message_read_ether_addr(sd_netlink_message *m, uint16_t attr_type, struct ether_addr *data) { -+_public_ int sd_netlink_message_read_ether_addr(sd_netlink_message *m, uint16_t attr_type, struct ether_addr *data) { - void *attr_data; - int r; - -@@ -1005,7 +1005,7 @@ int netlink_message_read_hw_addr(sd_netlink_message *m, uint16_t attr_type, stru - return 0; - } - --int sd_netlink_message_read_cache_info(sd_netlink_message *m, uint16_t attr_type, struct ifa_cacheinfo *info) { -+_public_ int sd_netlink_message_read_cache_info(sd_netlink_message *m, uint16_t attr_type, struct ifa_cacheinfo *info) { - void *attr_data; - int r; - -@@ -1052,7 +1052,7 @@ int netlink_message_read_in_addr_union(sd_netlink_message *m, uint16_t attr_type - return 0; - } - --int sd_netlink_message_read_in_addr(sd_netlink_message *m, uint16_t attr_type, struct in_addr *data) { -+_public_ int sd_netlink_message_read_in_addr(sd_netlink_message *m, uint16_t attr_type, struct in_addr *data) { - union in_addr_union u; - int r; - -@@ -1063,7 +1063,7 @@ int sd_netlink_message_read_in_addr(sd_netlink_message *m, uint16_t attr_type, s - return r; - } - --int sd_netlink_message_read_in6_addr(sd_netlink_message *m, uint16_t attr_type, struct in6_addr *data) { -+_public_ int sd_netlink_message_read_in6_addr(sd_netlink_message *m, uint16_t attr_type, struct in6_addr *data) { - union in_addr_union u; - int r; - -@@ -1074,7 +1074,7 @@ int sd_netlink_message_read_in6_addr(sd_netlink_message *m, uint16_t attr_type, - return r; - } - --int sd_netlink_message_has_flag(sd_netlink_message *m, uint16_t attr_type) { -+_public_ int sd_netlink_message_has_flag(sd_netlink_message *m, uint16_t attr_type) { - void *attr_data; - int r; - -@@ -1095,7 +1095,7 @@ int sd_netlink_message_has_flag(sd_netlink_message *m, uint16_t attr_type) { - return 1; - } - --int sd_netlink_message_read_strv(sd_netlink_message *m, uint16_t container_type, uint16_t attr_type, char ***ret) { -+_public_ int sd_netlink_message_read_strv(sd_netlink_message *m, uint16_t container_type, uint16_t attr_type, char ***ret) { - _cleanup_strv_free_ char **s = NULL; - const NLAPolicySet *policy_set; - const NLAPolicy *policy; -@@ -1192,7 +1192,7 @@ static int netlink_container_parse( - return 0; - } - --int sd_netlink_message_enter_container(sd_netlink_message *m, uint16_t attr_type) { -+_public_ int sd_netlink_message_enter_container(sd_netlink_message *m, uint16_t attr_type) { - const NLAPolicy *policy; - const NLAPolicySet *policy_set; - void *container; -@@ -1279,7 +1279,7 @@ int sd_netlink_message_enter_container(sd_netlink_message *m, uint16_t attr_type - return 0; - } - --int sd_netlink_message_enter_array(sd_netlink_message *m, uint16_t attr_type) { -+_public_ int sd_netlink_message_enter_array(sd_netlink_message *m, uint16_t attr_type) { - void *container; - size_t size; - int r; -@@ -1308,7 +1308,7 @@ int sd_netlink_message_enter_array(sd_netlink_message *m, uint16_t attr_type) { - return 0; - } - --int sd_netlink_message_exit_container(sd_netlink_message *m) { -+_public_ int sd_netlink_message_exit_container(sd_netlink_message *m) { - assert_return(m, -EINVAL); - assert_return(m->sealed, -EINVAL); - assert_return(m->n_containers > 0, -EINVAL); -@@ -1322,7 +1322,7 @@ int sd_netlink_message_exit_container(sd_netlink_message *m) { - return 0; - } - --int sd_netlink_message_get_max_attribute(sd_netlink_message *m, uint16_t *ret) { -+_public_ int sd_netlink_message_get_max_attribute(sd_netlink_message *m, uint16_t *ret) { - assert_return(m, -EINVAL); - assert_return(m->sealed, -EINVAL); - assert_return(ret, -EINVAL); -@@ -1331,14 +1331,14 @@ int sd_netlink_message_get_max_attribute(sd_netlink_message *m, uint16_t *ret) { - return 0; - } - --int sd_netlink_message_is_error(sd_netlink_message *m) { -+_public_ int sd_netlink_message_is_error(sd_netlink_message *m) { - assert_return(m, 0); - assert_return(m->hdr, 0); - - return m->hdr->nlmsg_type == NLMSG_ERROR; - } - --int sd_netlink_message_get_errno(sd_netlink_message *m) { -+_public_ int sd_netlink_message_get_errno(sd_netlink_message *m) { - struct nlmsgerr *err; - - assert_return(m, -EINVAL); -@@ -1373,7 +1373,7 @@ static int netlink_message_parse_error(sd_netlink_message *m) { - NLMSG_PAYLOAD(m->hdr, hlen)); - } - --int sd_netlink_message_rewind(sd_netlink_message *m, sd_netlink *nl) { -+_public_ int sd_netlink_message_rewind(sd_netlink_message *m, sd_netlink *nl) { - size_t size; - int r; - -diff --git a/src/libsystemd/sd-netlink/sd-netlink.c b/src/libsystemd/sd-netlink/sd-netlink.c -index ce0687eb57..fbebcf301b 100644 ---- a/src/libsystemd/sd-netlink/sd-netlink.c -+++ b/src/libsystemd/sd-netlink/sd-netlink.c -@@ -65,7 +65,7 @@ static int netlink_new(sd_netlink **ret) { - return 0; - } - --int sd_netlink_open_fd(sd_netlink **ret, int fd) { -+_public_ int sd_netlink_open_fd(sd_netlink **ret, int fd) { - _cleanup_(sd_netlink_unrefp) sd_netlink *nl = NULL; - int r, protocol; - -@@ -103,11 +103,11 @@ int sd_netlink_open_fd(sd_netlink **ret, int fd) { - return 0; - } - --int sd_netlink_open(sd_netlink **ret) { -+_public_ int sd_netlink_open(sd_netlink **ret) { - return netlink_open_family(ret, NETLINK_ROUTE); - } - --int sd_netlink_increase_rxbuf(sd_netlink *nl, size_t size) { -+_public_ int sd_netlink_increase_rxbuf(sd_netlink *nl, size_t size) { - assert_return(nl, -EINVAL); - assert_return(!netlink_pid_changed(nl), -ECHILD); - -@@ -145,7 +145,7 @@ static sd_netlink *netlink_free(sd_netlink *nl) { - - DEFINE_TRIVIAL_REF_UNREF_FUNC(sd_netlink, sd_netlink, netlink_free); - --int sd_netlink_send( -+_public_ int sd_netlink_send( - sd_netlink *nl, - sd_netlink_message *message, - uint32_t *serial) { -@@ -451,7 +451,7 @@ static int timeout_compare(const void *a, const void *b) { - return CMP(x->timeout, y->timeout); - } - --int sd_netlink_call_async( -+_public_ int sd_netlink_call_async( - sd_netlink *nl, - sd_netlink_slot **ret_slot, - sd_netlink_message *m, -@@ -516,7 +516,7 @@ int sd_netlink_call_async( - return k; - } - --int sd_netlink_read( -+_public_ int sd_netlink_read( - sd_netlink *nl, - uint32_t serial, - uint64_t usec, -@@ -586,7 +586,7 @@ int sd_netlink_read( - } - } - --int sd_netlink_call( -+_public_ int sd_netlink_call( - sd_netlink *nl, - sd_netlink_message *message, - uint64_t usec, -@@ -606,14 +606,14 @@ int sd_netlink_call( - return sd_netlink_read(nl, serial, usec, ret); - } - --int sd_netlink_get_events(sd_netlink *nl) { -+_public_ int sd_netlink_get_events(sd_netlink *nl) { - assert_return(nl, -EINVAL); - assert_return(!netlink_pid_changed(nl), -ECHILD); - - return ordered_set_size(nl->rqueue) == 0 ? POLLIN : 0; - } - --int sd_netlink_get_timeout(sd_netlink *nl, uint64_t *timeout_usec) { -+_public_ int sd_netlink_get_timeout(sd_netlink *nl, uint64_t *timeout_usec) { - struct reply_callback *c; - - assert_return(nl, -EINVAL); -@@ -689,7 +689,7 @@ static int prepare_callback(sd_event_source *s, void *userdata) { - return 1; - } - --int sd_netlink_attach_event(sd_netlink *nl, sd_event *event, int64_t priority) { -+_public_ int sd_netlink_attach_event(sd_netlink *nl, sd_event *event, int64_t priority) { - int r; - - assert_return(nl, -EINVAL); -@@ -741,7 +741,7 @@ fail: - return r; - } - --int sd_netlink_detach_event(sd_netlink *nl) { -+_public_ int sd_netlink_detach_event(sd_netlink *nl) { - assert_return(nl, -EINVAL); - assert_return(nl->event, -ENXIO); - -@@ -804,7 +804,7 @@ int netlink_add_match_internal( - return 0; - } - --int sd_netlink_add_match( -+_public_ int sd_netlink_add_match( - sd_netlink *rtnl, - sd_netlink_slot **ret_slot, - uint16_t type, -@@ -874,7 +874,7 @@ int sd_netlink_add_match( - destroy_callback, userdata, description); - } - --int sd_netlink_attach_filter(sd_netlink *nl, size_t len, const struct sock_filter *filter) { -+_public_ int sd_netlink_attach_filter(sd_netlink *nl, size_t len, const struct sock_filter *filter) { - assert_return(nl, -EINVAL); - assert_return(len == 0 || filter, -EINVAL); - -diff --git a/src/systemd/meson.build b/src/systemd/meson.build -index a9cdcd24a0..03ef60f92a 100644 ---- a/src/systemd/meson.build -+++ b/src/systemd/meson.build -@@ -13,6 +13,7 @@ _systemd_headers = [ - 'sd-journal.h', - 'sd-login.h', - 'sd-messages.h', -+ 'sd-netlink.h', - 'sd-path.h', - ] - -@@ -35,7 +36,6 @@ _not_installed_headers = [ - 'sd-lldp-tx.h', - 'sd-lldp.h', - 'sd-ndisc.h', -- 'sd-netlink.h', - 'sd-network.h', - 'sd-radv.h', - 'sd-resolve.h', --- -2.39.2 - diff --git a/systemd/systemd.nm b/systemd/systemd.nm index bdb1e3f04..b1eb63571 100644 --- a/systemd/systemd.nm +++ b/systemd/systemd.nm @@ -4,8 +4,8 @@ ############################################################################### name = systemd -version = 254 -release = 3 +version = 257.3 +release = 1 maintainer = Stefan Schantl <stefan.schantl(a)ipfire.org> groups = System/Base @@ -18,7 +18,10 @@ description SysV and LSB init scripts. end -source_dl = https://github.com/%{name}/%{name}/archive/v%{version}.tar.gz#/ +# This project is hosted on GitHub +github_version = v%{version} + +source_dl = %{github_url} build unitdir = %{prefix}/lib/systemd/system @@ -83,7 +86,12 @@ build export LD_LIBRARY_PATH = %{DIR_APP}/.libs + # Disable any kind of automatic or optional + # features configure_options = \ + --auto-features=disabled + + configure_options += \ -Dsysvinit-path= \ -Dsysvrcnd-path= \ -Dnobody-user=nobody \ @@ -103,7 +111,8 @@ build -Dportabled=false \ -Dtimesyncd=false \ -Dtimedated=false \ - -Dpolkit=false + -Dpolkit=false \ + -Dbpf-framework=false # Assign group ids configure_options += \ @@ -316,8 +325,6 @@ packages # Be sure to stop the old udev before updating. /usr/bin/systemctl stop udev.service udev-trigger.service \ udev-control.socket udev-kernel.socket >/dev/null 2>&1 || : - - %{create_groups} end script postup -- 2.47.2

1 0

[PATCH] intel-microcode: Update to version 20250211
by Adolf Belka 14 Feb '25

14 Feb '25

- Update from version 20241112 to 20250211 - Update of rootfile - Changelog 20250211 Security updates for INTEL-SA-01166 Security updates for INTEL-SA-01213 Security updates for INTEL-SA-01139 Security updates for INTEL-SA-01228 Security updates for INTEL-SA-01194 Update for functional issues. Refer to Intel® Core™ Ultra Processor for details. Update for functional issues. Refer to 13th/14th Generation Intel® Core™ Processor Specification Update for details. Update for functional issues. Refer to 12th Generation Intel® Core™ Processor Family for details. Update for functional issues. Refer to 11th Gen Intel® Core™ Processor Specification Update for details. Update for functional issues. Refer to 8th and 9th Generation Intel® Core™ Processor Family Spec Update for details. Update for functional issues. Refer to 5th Gen Intel® Xeon® Scalable Processors Specification Update for details. Update for functional issues. Refer to 4th Gen Intel® Xeon® Scalable Processors Specification Update for details. Update for functional issues. Refer to 3rd Generation Intel® Xeon® Processor Scalable Family Specification Update for details. Update for functional issues. Refer to Intel® Xeon® D-2700 Processor Specification Update for details. Update for functional issues. Refer to Intel® Xeon® E-2300 Processor Specification Update for details. Update for functional issues. Refer to Intel® Xeon® 6700-Series Processor Specification Update for details. Update for functional issues. Refer to Intel® Processors and Intel® Core™ i3 N-Series for details New Platforms Processor Stepping F-M-S/PI Old Ver New Ver Products SRF-SP C0 06-af-03/01 03000330 Xeon 6700-Series Processors with E-Cores Updated Platforms Processor Stepping F-M-S/PI Old Ver New Ver Products ADL C0 06-97-02/07 00000037 00000038 Core Gen12 ADL H0 06-97-05/07 00000037 00000038 Core Gen12 ADL L0 06-9a-03/80 00000435 00000436 Core Gen12 ADL R0 06-9a-04/80 00000435 00000436 Core Gen12 ADL-N N0 06-be-00/19 0000001a 0000001c Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E AZB A0/R0 06-9a-04/40 00000007 00000009 Intel(R) Atom(R) C1100 CFL-H R0 06-9e-0d/22 00000100 00000102 Core Gen9 Mobile CFL-H/S/E3 U0 06-9e-0a/22 000000f8 000000fa Core Gen8 Desktop, Mobile, Xeon E EMR-SP A0 06-cf-01/87 21000283 21000291 Xeon Scalable Gen5 EMR-SP A1 06-cf-02/87 21000283 21000291 Xeon Scalable Gen5 ICL-D B0 06-6c-01/10 010002b0 010002c0 Xeon D-17xx, D-27xx ICX-SP Dx/M1 06-6a-06/87 0d0003e7 0d0003f5 Xeon Scalable Gen3 RPL-E/HX/S B0 06-b7-01/32 0000012b 0000012c Core Gen13/Gen14 RPL-H/P/PX 6+8 J0 06-ba-02/e0 00004123 00004124 Core Gen13 RPL-HX/S C0 06-bf-02/07 00000037 00000038 Core Gen13/Gen14 RPL-U 2+8 Q0 06-ba-03/e0 00004123 00004124 Core Gen13 RPL-S H0 06-bf-05/07 00000037 00000038 Core Gen13/Gen14 RKL-S B0 06-a7-01/02 00000062 00000063 Core Gen11 SPR-HBM Bx 06-8f-08/10 2c000390 2c0003e0 Xeon Max SPR-SP E4/S2 06-8f-07/87 2b000603 2b000620 Xeon Scalable Gen4 SPR-SP E5/S3 06-8f-08/87 2b000603 2b000620 Xeon Scalable Gen4 TWL N0 06-be-00/19 0000001a 0000001c Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E New Disclosures Updated in Prior Releases Processor Stepping F-M-S/PI Old Ver New Ver Products CFL-H/S P0 06-9e-0c/22 000000f6 000000f8 Core Gen9 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/x86_64/intel-microcode | 4 +--- lfs/intel-microcode | 6 +++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/x86_64/intel-microcode b/config/rootfiles/common/x86_64/intel-microcode index 5037ac6a8..f0be425fe 100644 --- a/config/rootfiles/common/x86_64/intel-microcode +++ b/config/rootfiles/common/x86_64/intel-microcode @@ -95,8 +95,6 @@ lib/firmware/intel-ucode/06-8e-09 lib/firmware/intel-ucode/06-8e-0a lib/firmware/intel-ucode/06-8e-0b lib/firmware/intel-ucode/06-8e-0c -lib/firmware/intel-ucode/06-8f-05 -lib/firmware/intel-ucode/06-8f-06 lib/firmware/intel-ucode/06-8f-07 lib/firmware/intel-ucode/06-8f-08 lib/firmware/intel-ucode/06-96-01 @@ -117,10 +115,10 @@ lib/firmware/intel-ucode/06-a6-00 lib/firmware/intel-ucode/06-a6-01 lib/firmware/intel-ucode/06-a7-01 lib/firmware/intel-ucode/06-aa-04 +lib/firmware/intel-ucode/06-af-03 lib/firmware/intel-ucode/06-b7-01 lib/firmware/intel-ucode/06-ba-02 lib/firmware/intel-ucode/06-ba-03 -lib/firmware/intel-ucode/06-ba-08 lib/firmware/intel-ucode/06-be-00 lib/firmware/intel-ucode/06-bf-02 lib/firmware/intel-ucode/06-bf-05 diff --git a/lfs/intel-microcode b/lfs/intel-microcode index 665fa0af1..c59d7744b 100644 --- a/lfs/intel-microcode +++ b/lfs/intel-microcode @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 20241112 +VER = 20250211 THISAPP = Intel-Linux-Processor-Microcode-Data-Files-microcode-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 223721ac561b137513653e1b10dc2afabcc4fc9e304f3fc71c252f1ada9554bf1df812c766831ec4b5f66f57f66c3e1cf563d7d24d17e553a4e26adc659f8d76 +$(DL_FILE)_BLAKE2 = 628d4e1664639d688fded764add9a0e2df38c8aae7a63b0bf93430befcf9938f0b9bec535016bfb2d6ff0538fd09f8eec7b2d721f727406a0ec50c6f809ad698 install : $(TARGET) -- 2.48.1

2 1

Fwd: [intel/Intel-Linux-Processor-Microcode-Data-Files] Release microcode-20250211 - microcode-20250211 Release
by Michael Tremer 13 Feb '25

13 Feb '25

Anyone up for this? I suppose this should go into Core Update 193 because we might run out of space; as far as we know, the security issues can only be exploited by a local user. -Michael > Begin forwarded message: > > From: MCU Administrator <notifications(a)github.com> > Subject: [intel/Intel-Linux-Processor-Microcode-Data-Files] Release microcode-20250211 - microcode-20250211 Release > Date: 11 February 2025 at 17:08:42 GMT > To: intel/Intel-Linux-Processor-Microcode-Data-Files <Intel-Linux-Processor-Microcode-Data-Files(a)noreply.github.com> > Cc: Subscribed <subscribed(a)noreply.github.com> > Reply-To: intel/Intel-Linux-Processor-Microcode-Data-Files <noreply(a)github.com> > > > microcode-20250211 Release <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> > Repository: intel/Intel-Linux-Processor-Microcode-Data-Files <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files> · Tag: microcode-20250211 <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/mi…> · Commit: 8a62de4 <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/commit/…> · Released by: mcu-administrator <https://github.com/mcu-administrator> > microcode-20250211 <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> > Purpose > > Security updates for INTEL-SA-01166 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-01213 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-01139 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-01228 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-01194 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Update for functional issues. Refer to Intel® Core™ Ultra Processor <https://cdrdv2.intel.com/v1/dl/getContent/792254> for details. > > Update for functional issues. Refer to 13th/14th Generation Intel® Core™ Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/740518> for details. > > Update for functional issues. Refer to 12th Generation Intel® Core™ Processor Family <https://cdrdv2.intel.com/v1/dl/getContent/682436> for details. > > Update for functional issues. Refer to 11th Gen Intel® Core™ Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/631123> for details. > > Update for functional issues. Refer to 8th and 9th Generation Intel® Core™ Processor Family Spec Update <https://cdrdv2.intel.com/v1/dl/getContent/337346> for details. > > Update for functional issues. Refer to 5th Gen Intel® Xeon® Scalable Processors Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/793902> for details. > > Update for functional issues. Refer to 4th Gen Intel® Xeon® Scalable Processors Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/772415> for details. > > Update for functional issues. Refer to 3rd Generation Intel® Xeon® Processor Scalable Family Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/637780> for details. > > Update for functional issues. Refer to Intel® Xeon® D-2700 Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/714071> for details. > > Update for functional issues. Refer to Intel® Xeon® E-2300 Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/709192> for details. > > Update for functional issues. Refer to Intel® Xeon® 6700-Series Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/820922> for details. > > Update for functional issues. Refer to Intel® Processors and Intel® Core™ i3 N-Series <https://cdrdv2.intel.com/v1/dl/getContent/764616> for details > > New Platforms > > Processor Stepping F-M-S/PI Old Ver New Ver Products > SRF-SP C0 06-af-03/01 03000330 Xeon 6700-Series Processors with E-Cores > Updated Platforms > > Processor Stepping F-M-S/PI Old Ver New Ver Products > ADL C0 06-97-02/07 00000037 00000038 Core Gen12 > ADL H0 06-97-05/07 00000037 00000038 Core Gen12 > ADL L0 06-9a-03/80 00000435 00000436 Core Gen12 > ADL R0 06-9a-04/80 00000435 00000436 Core Gen12 > ADL-N N0 06-be-00/19 0000001a 0000001c Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E > AZB A0/R0 06-9a-04/40 00000007 00000009 Intel(R) Atom(R) C1100 > CFL-H R0 06-9e-0d/22 00000100 00000102 Core Gen9 Mobile > CFL-H/S/E3 U0 06-9e-0a/22 000000f8 000000fa Core Gen8 Desktop, Mobile, Xeon E > EMR-SP A0 06-cf-01/87 21000283 21000291 Xeon Scalable Gen5 > EMR-SP A1 06-cf-02/87 21000283 21000291 Xeon Scalable Gen5 > ICL-D B0 06-6c-01/10 010002b0 010002c0 Xeon D-17xx, D-27xx > ICX-SP Dx/M1 06-6a-06/87 0d0003e7 0d0003f5 Xeon Scalable Gen3 > RPL-E/HX/S B0 06-b7-01/32 0000012b 0000012c Core Gen13/Gen14 > RPL-H/P/PX 6+8 J0 06-ba-02/e0 00004123 00004124 Core Gen13 > RPL-HX/S C0 06-bf-02/07 00000037 00000038 Core Gen13/Gen14 > RPL-U 2+8 Q0 06-ba-03/e0 00004123 00004124 Core Gen13 > RPL-S H0 06-bf-05/07 00000037 00000038 Core Gen13/Gen14 > RKL-S B0 06-a7-01/02 00000062 00000063 Core Gen11 > SPR-HBM Bx 06-8f-08/10 2c000390 2c0003e0 Xeon Max > SPR-SP E4/S2 06-8f-07/87 2b000603 2b000620 Xeon Scalable Gen4 > SPR-SP E5/S3 06-8f-08/87 2b000603 2b000620 Xeon Scalable Gen4 > TWL N0 06-be-00/19 0000001a 0000001c Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E > New Disclosures Updated in Prior Releases > > Processor Stepping F-M-S/PI Old Ver New Ver Products > CFL-H/S P0 06-9e-0c/22 000000f6 000000f8 Core Gen9 > — > This release has 2 assets: > > Source code (zip) > Source code (tar.gz) > Visit the release page <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> to download them. > > — > You are receiving this because you are watching this repository. > View it on GitHub <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> or unsubscribe <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/unsubsc…> from all notifications for this repository. >

2 1

Reason why we do not set rigthca in the strongswan conf
by Jonatan Schlag 12 Feb '25

12 Feb '25

Hi list, recently I had to renew the host cert of my IPFire system for strongswan. As we currently write: rightcert = into the config (see for this: https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=html/cgi-bin/vpnmain.cgi;… I have to change the cert of the remote system as well. Is there a reason for this? When I use rightca= the connection works out of the box. Is there a reason why we make not use of this option? Jonatan

2 1

[PATCH] apache: Update to 2.4.63
by Matthias Fischer 10 Feb '25

10 Feb '25

For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.63 "Changes with Apache 2.4.63 *) mod_dav: Update redirect-carefully example BrowserMatch config to match more recent client versions. PR 66148, 67039. [Michal Maloszewski <michal.maloszewski canonical.com>, Romain TartiÃ¨re <romain blogreen.org>] *) mod_cache_socache: Fix possible crash on error path. PR 69358. [Ruediger Pluem] *) mod_ssl: Fail cleanly at startup if OpenSSL initialization fails. [StephenWall] *) mod_md: update to version 2.4.31 - Improved error reporting when waiting for ACME server to verify domains or finalizing the order fails, e.g. times out. - Increasing the timeouts to wait for ACME server to verify domain names and issue the certificate from 30 seconds to 5 minutes. - Change a log level from error to debug when Stapling is enabled but a certificate carries no OCSP responder URL. *) mod_proxy_balancer: Fix the handling of the stickysession configuration parameter by the balancer manager. PR 69510 [Yutaka Tokunou <tokunou.yutaka(a)fujitsu.com>] *) Add the ldap-search option to mod_authnz_ldap, allowing authorization to be based on arbitrary expressions that do not include the username. Make sure that when ldap searches are too long, we explicitly log the error. [Graham Leggett] *) mod_proxy: Honor parameters of ProxyPassMatch workers with substitution in the host name or port. PR 69233. [Yann Ylavic] *) mod_log_config: Fix merging for the "LogFormat" directive. PR 65222. [Michael Kaufmann <mail michael-kaufmann.ch>] *) mod_lua: Make r.ap_auth_type writable. PR 62497. [Michael Osipov <michaelo apache.org>] *) mod_md: update to version 2.4.29 - Fixed HTTP-01 challenges to not carry a final newline, as some ACME server fail to ignore it. [Michael Kaufmann (@mkauf)] - Fixed missing label+newline in server-status plain text output when MDStapling is enabled. *) mod_ssl: Restore support for loading PKCS#11 keys via ENGINE without "SSLCryptoDevice" configured. [Joe Orton] *) mod_authnz_ldap: Fix possible memory corruption if the AuthLDAPSubGroupAttribute directive is configured. [Joe Orton] *) mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler. PR 69203. [Yann Ylavic] *) mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten [P] URLs, including "unix:" ones. PR 69235, PR 69260. [Yann Ylavic, Ruediger Pluem] *) mod_rewrite: Error out in case a RewriteRule in directory context uses the proxy, but mod_proxy is not loaded. PR 56264. [Christophe Jaillet, Michael Streeter <mstreeter1(a)gmail.com>] *) http: Remove support for Request-Range header sent by Navigator 2-3 and MSIE 3. [Stefan Fritsch] *) mod_rewrite: Don't require [UNC] flag to preserve a leading // added by applying the perdir prefix to the substitution. [Ruediger Pluem, Eric Covener] *) Windows: Restore the ability to "Include" configuration files on UNC paths. PR 69313 [Eric Covener] *) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs in <Location> (incomplete fix in 2.4.62). PR 69160. [Yann Ylavic] *) mod_md: update to version 2.4.28 - When the server starts, it looks for new, staged certificates to activate. If the staged set of files in 'md/staging/<domain>' is messed up, this could prevent further renewals to happen. Now, when the staging set is present, but could not be activated due to an error, purge the whole directory. [icing] - Fix certificate retrieval on ACME renewal to not require a 'Location:' header returned by the ACME CA. This was the way it was done in ACME before it became an IETF standard. Let's Encrypt still supports this, but other CAs do not. [icing] - Restore compatibility with OpenSSL < 1.1. [ylavic] *) mod_tls: removed the experimental module. It now is availble standalone from https://github.com/icing/mod_tls. The rustls provided API is not stable and does not align with the httpd release cycle. [Stefan Eissing] *) mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F. PR 69197. [Yann Ylavic, Eric Covener] *) mod_http2: Return connection monitoring to the event MPM when blocking on client updates. [Stefan Eissing, Yann Ylavic]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/apache2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index 428ef3419..4abf21793 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 2.4.62 +VER = 2.4.63 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0e5c3b05819771e6ff72933ad715695199a32c384f63de6598e179ff5803580f04639437829305150305c9a2b7d309178552d8c9a2d7248a034c98f445193b95 +$(DL_FILE)_BLAKE2 = adc4b3ad640919a2df1eaae9a4a7d004f60b2d59a6fa4a624c7e97758c0e244378cb06f11d69a54e789dd216f8f3fb8e967b2e01fd3bdab10ce1ae332d2a4d07 install : $(TARGET) -- 2.43.0

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2025