Development

development@lists.ipfire.org

2 participants
6279 discussions

[PATCH] c-ares: Update to version 1.34.3
by Adolf Belka 04 Dec '24

04 Dec '24

- Update from version 1.32.1 to 1.34.3 - Update of rootfile - Changelog 1.34.3 Changes: Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906 Bugfixes: Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911 Android: <=7 needs sys/system_properties.h a70637c Android: CMake needs -D_GNU_SOURCE and others. PR #915 TSAN warns on missing lock, but lock isn’t actually necessary. PR #915 ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558 ares_send() shouldn’t return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7 Fix typos in man pages. PR #905 1.34.2 This release contains a fix for downstream packages detecting the c-ares version based on the contents of the header file rather than the distributed pkgconf or cmake files. 1.34.1 This release fixes a packaging issue. 1.34.0 Features: adig: read arguments from adigrc. PR #856 Add new pending write callback optimization via ares_set_pending_write_cb. PR #857 New function ares_process_fds(). PR #875 Failed servers should be probed rather than redirecting queries which could cause unexpected latency. PR #877 adig: rework command line arguments to mimic dig from bind. PR #890 Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. PR #894 Fix regression with custom socket callbacks due to DNS cookie support. PR #895 ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets PR #887 URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). PR #882 Changes: Connection handling modularization. PR #857, PR #876 Expose library/utility functions to tools. PR #860 Remove ares__ prefix, just use ares_ for internal functions. PR #872 Bugfixes: fix: potential WIN32_LEAN_AND_MEAN redefinition. PR #869 Fix googletest v1.15 compatibility. PR #874 Fix pkgconfig thread dependencies. PR #884 1.33.1 Bugfixes: Work around systemd-resolved quirk that returns unexpected codes for single label names. Also adds test cases to validate the work around works and will continue to work in future releases. PR #863, See Also systemd/systemd#34101 Fix sysconfig ndots default value, also adds containerized test case to prevent future regressions. PR #862 Fix blank DNS name returning error code rather than valid record for commands like: adig -t SOA .. Also adds test case to prevent future regressions. 9e574af Fix calculation of query times > 1s. 2b2eae7 Fix building on old Linux releases that don’t have TCP_FASTOPEN_CONNECT. b7a89b9 Fix minor Android build warnings. PR #848 1.33.0 Features: Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. PR #833 Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. PR #840 Changes: Reorganize source tree. PR #822 Refactoring of connection handling to prevent code duplication. PR #839 New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. PR #841 Bugfixes: ares_destroy() race condition during shutdown due to missing lock. PR #831 Android: Preserve thread name after attaching it to JVM. PR #838 Windows UWP (Store) support fix. PR #845 1.32.3 Changes: Prevent complex recursion during query requeuing and connection cleanup for stability. e8b32b8 Better propagate error codes on requeue situations. a9bc0a2 Try to prevent SIGPIPE from being generated and delivered to integrations. de01baa Bugfixes: Missing manpage for ares_dns_record_set_id() aa462b3 Memory leak in ares__hosts_entry_to_hostent() due to allocation strategy. PR #824 UDP write failure detected via ICMP unreachable should trigger faster failover. PR #821 Fix pycares test case regression due to wrong error code being returned. Regression from 1.31.0. PR #820 Fix possible Windows crash during ares_destroy() when using event threads. 5609bd4 ARES_OPT_MAXTIMEOUTMS wasn’t being honored in all cases. a649c60 1.32.2 Bugfixes: Windows: rework EventThread AFD code for better stability. PR #811 Windows: If an IP address was detected to have changed, it could lead to a crash due to a bad pointer. Regression introduced in 1.31.0. 59e3a1f4 Windows: use QueryPerformanceCounters() instead of GetTickCount64() for better time accuracy (~15ms -> ~1us). 8a50fc6c Windows 32bit config change callback needs to be tagged as stdcall otherwise could result in a crash. 5c2bab35 Tests that need accurate timing should not depend on internal symbols as there are C++ equivalents in std::chrono. PR #809 Kqueue (MacOS, *BSD): If the open socket count exceeded 8 (unlikely), it would try to allocate a new buffer that was too small. 5aad7981 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/c-ares | 9 ++++++++- lfs/c-ares | 6 +++--- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/c-ares b/config/rootfiles/packages/c-ares index df5000f22..6fdaf3b18 100644 --- a/config/rootfiles/packages/c-ares +++ b/config/rootfiles/packages/c-ares @@ -7,7 +7,7 @@ #usr/lib/libcares.la #usr/lib/libcares.so usr/lib/libcares.so.2 -usr/lib/libcares.so.2.17.1 +usr/lib/libcares.so.2.19.2 #usr/lib/pkgconfig/libcares.pc #usr/share/man/man3/ares_cancel.3 #usr/share/man/man3/ares_create_query.3 @@ -48,9 +48,11 @@ usr/lib/libcares.so.2.17.1 #usr/share/man/man3/ares_dns_record_rr_del.3 #usr/share/man/man3/ares_dns_record_rr_get.3 #usr/share/man/man3/ares_dns_record_rr_get_const.3 +#usr/share/man/man3/ares_dns_record_set_id.3 #usr/share/man/man3/ares_dns_rr.3 #usr/share/man/man3/ares_dns_rr_add_abin.3 #usr/share/man/man3/ares_dns_rr_del_abin.3 +#usr/share/man/man3/ares_dns_rr_del_opt_byid.3 #usr/share/man/man3/ares_dns_rr_get_abin.3 #usr/share/man/man3/ares_dns_rr_get_abin_cnt.3 #usr/share/man/man3/ares_dns_rr_get_addr.3 @@ -122,6 +124,9 @@ usr/lib/libcares.so.2.17.1 #usr/share/man/man3/ares_parse_txt_reply.3 #usr/share/man/man3/ares_parse_uri_reply.3 #usr/share/man/man3/ares_process.3 +#usr/share/man/man3/ares_process_fd.3 +#usr/share/man/man3/ares_process_fds.3 +#usr/share/man/man3/ares_process_pending_write.3 #usr/share/man/man3/ares_query.3 #usr/share/man/man3/ares_query_dnsrec.3 #usr/share/man/man3/ares_queue.3 @@ -136,6 +141,7 @@ usr/lib/libcares.so.2.17.1 #usr/share/man/man3/ares_set_local_dev.3 #usr/share/man/man3/ares_set_local_ip4.3 #usr/share/man/man3/ares_set_local_ip6.3 +#usr/share/man/man3/ares_set_pending_write_cb.3 #usr/share/man/man3/ares_set_server_state_callback.3 #usr/share/man/man3/ares_set_servers.3 #usr/share/man/man3/ares_set_servers_csv.3 @@ -144,6 +150,7 @@ usr/lib/libcares.so.2.17.1 #usr/share/man/man3/ares_set_socket_callback.3 #usr/share/man/man3/ares_set_socket_configure_callback.3 #usr/share/man/man3/ares_set_socket_functions.3 +#usr/share/man/man3/ares_set_socket_functions_ex.3 #usr/share/man/man3/ares_set_sortlist.3 #usr/share/man/man3/ares_strerror.3 #usr/share/man/man3/ares_svcb_param_t.3 diff --git a/lfs/c-ares b/lfs/c-ares index 6da5810e4..0b29a6c1c 100644 --- a/lfs/c-ares +++ b/lfs/c-ares @@ -26,7 +26,7 @@ include Config SUMMARY = Tools for asynchronous name resolves -VER = 1.32.1 +VER = 1.34.3 THISAPP = c-ares-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = c-ares -PAK_VER = 3 +PAK_VER = 4 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 662f15e7f1ae39614f0212745fe7883bbf831da667905e4595e011922b37c95b2037423dde96b0a62122a304d6edd04d36e99e428bdbf8f89d6ff9ecb4cfd712 +$(DL_FILE)_BLAKE2 = fb66f4c8ae4c2e03e8f75ee72259dbe83d7bed5e72a7936f785121c3d02267375f67c734bae7213ec48bac9277d48e3bed4225fd03ba69dacd120b97dcc3e421 install : $(TARGET) -- 2.47.1

1 1

Failure building collectd when autoconf has been updated to 2.72
by Adolf Belka 04 Dec '24

04 Dec '24

Hi All, I did an update run with autoconf taking it from 2.71 to 2.72 autoconf built without any problems, however collectd then failed for a syntax error in the configure file. Confirmed that this was due to autoconf by changing the versions back and forward and the problem went away and then came back again. The collectd build error message is checking for size_t... yes checking for uid_t... yes checking for gid_t... yes ./configure: line 18710: syntax error near unexpected token `newline' ./configure: line 18710: `yes:' make: *** [collectd:120: /usr/src/log/collectd-4.10.9] Error 2 The section around line 18710 in the configure file is 18707 do : 18708 as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` 18709 ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" 18710 if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : 18711 cat >>confdefs.h <<_ACEOF 18712 #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 18713 _ACEOF 18714 18715 else 18716 with_libiptc="no (header file missing)" 18717 fi However there are 15 occurrences of the exact same text as line 18710 in the configure file so I am not convinced if that line is the root cause for the syntax error but some other earlier error that causes a knock-on effect. However, my knowledge of the coding syntax is definitely not enough to figure out what needs to be fixed/changed. As collectd is a very old version it is likely that some structural coding or syntax was fine in the past but now with the change from autoconf-2.71 to 2.72 it is no longer allowed, or is flagged up when in the past it was just ignored. There are quite a few changes in autoconf-2.72 with some being marked as backwards compatibilities. All of them except one say that existing configure scripts will continue working. The one that doesn't mention that is the following change:- Configure scripts no longer support pre-1989 C compilers. Specifically, compilers that *only* implement the original “K&R” function definition syntax, and not the newer “prototyped” syntax, will not be able to parse the test programs now emitted by AC_CHECK_FUNC, AC_LANG_CALL, and similar macros. AC_PROG_CC still accepts such compilers, but this may change in the near future. This change was necessary in order to support the upcoming 2024 edition of the C standard (often referred to as “C23”), which will officially remove the function declaration syntax used by AC_CHECK_FUNC in Autoconf 2.71 and earlier. We feel that support for compilers that support only C 2024 is more useful, nowadays, than support for compilers that don’t implement a core feature of C 1989. However I am unable to figure out from this if the problem I am experiencing is related to this or not. I would not have thought so as I don't believe we are using a pre-1989 C compiler. Any ideas from anyone on how to fix this issue? There is nothing critical from a security or other vulnerability aspect in autoconf-2.72 but it would be nice to figure this out before we get to a stage where it has to be made to work. Regards, Adolf.

2 13

Testing of rapid_commit patch
by Adolf Belka 03 Dec '24

03 Dec '24

Hi Michael, I had previously tested your rapid_commit patch on my vm network system. However as that network does not have a problem with the rapid_commit option it was not the best test. I said that i would test it out on my production system after the visit to my family. I have now got around to that. My new ISP, that bought out the very good technically based ISP I used to have, is one of the ones that has a DHCP server that just times out if you have the rapid_commit option in the dhcpcd config file. So I updated my production IPFire to Core-Update 190 Development Build: master/1e2abd66 After rebooting the connection was lost as the rapid_commit option is on by default. I then ran the setup program and unchecked the rapid commit box on the red interface and then rebooted and the connection was running. Another reboot still had the connection running. So I can confirm that the patch is working . The only thing that came to mind is when we do the update people who have removed or commented out the rapid_commit option in dhcpcd.conf will lose their connection. So either * we need to have the update check if the rapid_commit option has been commented out or has been removed and then disable the rapid commit option for the red interface. or * we need to make sure that it is well communicated that anyone who has disabled the rapid_commit option needs to run the setup program after the upgrade (maybe before the reboot) to disable the option for the red interface. We can discuss this at our next conf call meeting on 3rd or 4th Dec. Regards, Adolf.

3 8

Re: IPFire 2.29 - Core Update 190 is available for testing
by Adolf Belka 03 Dec '24

03 Dec '24

Hi All, First feedback on CU190 Testing. I have not found any problems so far. I have tested the OpenVPN roadwarrior and net2net connections and all worked well. I also cleared the x509 certificate set and created from new (as there were problems in the past with that) and a new x509 set could be created without any issues. Restore from previous backup also worked without any issues. All graphs look to be running okay. Bug13029 - IPSec problem when PSK had a comma in it was tested and the base64 encoding is working as intended. Existing PSK's stay as they are. If a new PSK is defined or an existing one edited then the PSK is base64 encoded. In all cases the operation continues with the base64 encoding changes being totally transparent. A PSK with any character, except the single quotation mark, can now be used in the PSK. Tested out with a PSK with back ticks, hash symbol and double quotation marks and the IPSec PSK connection was made without any issues. Bug13074 verified to now have the collectd.d directory for custom variations. Actual custom variations not tested so far. Bug13762 ssh login details not being shown in system logs verified to be fixed. Both sshd and sshd-session lines from the logs are now included in the system logs display. Will continue testing but so far looks very good to me. Regards, Adolf. On 30/11/2024 15:37, IPFire Project wrote: > Dear Community, It is time for the last push of the year: The upcoming > release of IPFire is ready to be tested by you, our awesome community. > It comes with a refreshed kernel and includes a lot of changes that have > been developed at the recent IPFire Developer Meetup. It is scheduled to > be the last update for the year, so let's make it an extra special one > before we all sign off for the holidays. > ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ > > > IPFire_ > > > IPFire 2.29 - Core Update 190 is available for testing > > Dear Community, It is time for the last push of the year: The upcoming > release of IPFire is ready to be tested by you, our awesome community. > It comes with a refreshed kernel and includes a lot of changes that have > been developed at the recent IPFire Developer Meetup. It is scheduled to > be the last update for the year, so let's make it an extra special one > before we all sign off for the holidays. > > Read The Full Post On Our Blog <https://www.ipfire.org/blog/ipfire-2-29- > core-update-190-is-available-for-testing? > utm_medium=email&utm_source=blog-announcement> > > The IPFire Project, c/o Lightning Wire Labs GmbH, Gerhardstraße 8, 45711 > Datteln, Germany > > Unsubscribe <https://www.ipfire.org/unsubscribe> > -- Sent from my laptop

1 0

Changing date for the upcoming December Video Call
by Michael Tremer 02 Dec '24

02 Dec '24

Hello everyone, Next week we have the monthly video call scheduled for December 2nd. Sadly I have a conflict at that time and won’t be able to make it, so I would like to propose the 3rd or 4th as an alternative date. Could we have a quick round of raising hands who is available on these alternative dates? Best, -Michael

2 2

[PATCH v2] sudo: Update to version 1.9.16p2
by Adolf Belka 29 Nov '24

29 Nov '24

- Update fromn version 1.9.16 to 1.9.16p2 - This v2 version replaces the one that went from 1.9.16 to 1.9.16p1 - The previous version has been marked as superceded in Patchwork. - Update of rootfile not required 1.9.16p2 * Sudo now passes the terminal device number to the policy plugin even if it cannot resolve it to a path name. This allows sudo to run without warnings in a chroot jail when the terminal device files are not present. GitHub issue #421. * On Linux systems, sudo will now attempt to use the symbolic links in /proc/self/fd/{0,1,2} when resolving the terminal device number. This can allow sudo to map a terminal device to its path name even when /dev/pts is not mounted in a chroot jail. * Fixed compilation errors with gcc and clang in C23 mode. C23 no longer supports functions with unspecified arguments. 1.9.16p1 * Fixed the test for cross-compiling when checking for C99 snprintf(). The changes made to the test in sudo 1.9.16 resulted in a different problem. GitHub issue #386. * Fixed the date used by the exit record in sudo-format log files. This was a regression introduced in sudo 1.9.16 and only affected file-based logs, not syslog. GitHub issue #405. * Fixed the root cause of the "unable to find terminal name for device" message when running sudo on AIX when no terminal is present. In sudo 1.9.16 this was turned from a debug message into a warning. GitHub issue #408 * When a duplicate alias is found in the sudoers file, the warning message now includes the file and line number of the previous definition. * Added support for the --with-secure-path-value=no configure option to allow packagers to ship the default sudoers file with the secure path line commented out. * Sudo no longer sends mail when a user runs "sudo -nv" or "sudo -nl", even if "mail_badpass" or "mail_always" are set. Sudo already avoids logging to a file or syslog in this case. Bug #1072. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sudo | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/sudo b/lfs/sudo index cac540be0..852f6c8cf 100644 --- a/lfs/sudo +++ b/lfs/sudo @@ -24,7 +24,7 @@ include Config -VER = 1.9.16 +VER = 1.9.16p2 THISAPP = sudo-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 19daa789af3ca2c4832950f0dd6f26a97285fdc155f0d7c18ec1f1accafce9b86f2f5730d3bb0b8e7717c0c55f4079928e03acb3974cb2652c58d4bcb2f74a12 +$(DL_FILE)_BLAKE2 = ef9f1c2cd4044454a808d1dff5f865355e1bd061d1b5c93a005207e28e9b9df7c267cf01358ce60dd2c98f6844b51dab00eac4e7a08bade1d621235c3a4774bf install : $(TARGET) -- 2.47.1

1 0

Re "linux-firmware: ship needed config txt files." commit
by Adolf Belka 29 Nov '24

29 Nov '24

Hi Arne, That was me I am afraid. I remember seeing all the text files in the rootfile and thought that those are not firmware files and so would not be needed. Obviously my assumption about those files not being needed was very wrong. I will make sure not to do the same thing again. It should be unlikely to happen again as @Michael has added the find-linux-firmware-changes tool to the system now which should help make sure I don't remove needed files. Apologies for my error. I hope it didn't cause you too many problems with the builds and testing before you discovered it. Regards, Adolf.

2 1

[PATCH] chkconfig: Update to version 1.30
by Adolf Belka 28 Nov '24

28 Nov '24

- Update from version 1.5 (2015) to 1.30 (Aug 2024) - Fedora now have a github site for chkconfig which has had releases since 2023 - Update of rootfile not required - Changelog 1.30 ostree: move admindir to /etc/alternatives.admindir by @vrothberg in #135 1.29 Translations update from Fedora Weblate by @weblate in #133 Avoid possible leaks in readConfig() by @dtardon in #128 fix issues found by static analyzers by @lnykryn in #125 Mkosi by @lnykryn in #127 1.28 test: return failures from the test suite by @lnykryn in #130 Prepare for bin-sbin merge by @jamacku in #131 1.27 Translations update from Fedora Weblate by @weblate in #124 Alternatives: Fix issues found by static analyzers by @lnykryn in #126 1.26 build(deps): bump actions/checkout from 3 to 4 by @dependabot in #113 Translations update from Fedora Weblate by @weblate in #114 build(deps): bump redhat-plumbers-in-action/differential-shellcheck from 4 to 5 by @dependabot in #115 Fix systemdActive() by @marcosfrm in #117 build(deps): bump github/codeql-action from 2 to 3 by @dependabot in #119 build(deps): bump actions/upload-artifact from 3 to 4 by @dependabot in #120 Translations update from Fedora Weblate by @weblate in #121 Add support for running using tmt by @jamacku in #123 1.25 Translations update from Fedora Weblate by @weblate in #110 Translations update from Fedora Weblate by @weblate in #111 alternatives: fix possible buffer overrun by @lnykryn in #112 1.24 Revert recent rpmautospec and Packit changes by @jamacku in #107 Fix way how we generate next version by @jamacku in #108 1.23 Remove changelog and update translations by @jamacku in #100 Translations update from Fedora Weblate by @weblate in #101 Fix --keep-foreign when the target is missing completely by @lnykryn in #104 Translations update from Fedora Weblate by @weblate in #103 Translations update from Fedora Weblate by @weblate in #105 1.22 Fedora release process (Packit, rpmautospec) by @jamacku in #91 releng: Packit remove extra job trigger by @jamacku in #92 Bump redhat-plumbers-in-action/differential-shellcheck from 3 to 4 by @dependabot in #94 test: fix ShellCheck error[SC2070] by @jamacku in #95 Add Locale linter (Weblate) by @jamacku in #98 Translations update from Fedora Weblate by @weblate in #96 migrate to SPDX license by @lzaoral in #99 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/chkconfig | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/chkconfig b/lfs/chkconfig index f602924cf..86a13ef27 100644 --- a/lfs/chkconfig +++ b/lfs/chkconfig @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,10 +24,10 @@ include Config -VER = 1.5 +VER = 1.30 THISAPP = chkconfig-$(VER) -DL_FILE = $(THISAPP).tar.bz2 +DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5a2f9e3bb03a502dc7efa25ab2f2b78835db801af2fd352ba8c993b5d6e9695ea4956124f04214b3cbe406910a61316be5f51862e930de98dcd5ffc0f9d1877f +$(DL_FILE)_BLAKE2 = ac9164196570fd35ac6ed3167e918ee40f4c4dde8c2ca17d710501d28758be0b43892e6f0e1d0de39cbfa8b81bddb4a48d8cb14f4398ed623092f6c16698ad27 install : $(TARGET) @@ -69,7 +69,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && make alternatives cd $(DIR_APP) && install -v -m 755 alternatives /usr/sbin ln -svf alternatives /usr/sbin/update-alternatives -- 2.47.0

1 6

Logging Locationblock packets
by Rob Brewer 25 Nov '24

25 Nov '24

As a contributor to the SANS ISC, I email my IPTABLES logs hourly to the Dshield database, however the default IPFire IPTABLES logs are incomplete since packets dropped by Locationblock are not logged to syslog. As a workaround I edit the locationblock function of rules.pl to add a IPTABLES rule to log the dropped packets. This edit does not of course survive any Core-Updates that upgrade rules.pl and the edit needs to be re-applied. In addition, unless the Locationblock packets are logged to syslog the data displayed in the Firewall logs sections are incomplete as the packets dropped by Location Block are not displayed. I understand that the original intension of the Location Block feature was to reduce the amount of log messages on installations running on extremely cheap flash storage. I suspect that these installations are now almost zero especially since IPFire no longer supports 32 bit versions. The obvious solution to this to make Location Block logging selectable as a firewall option and my quick look at making a patches for this would seem to be fairly simple task to rules.pl and and optionsfw.cgi. I would be happy to provide the necessary patches should this be acceptable.

3 11

[PATCH] pam: Update to version 1.7.0
by Adolf Belka 24 Nov '24

24 Nov '24

- Update from version 1.6.1 to 1.7.0 - Update of rootfile - pam is now only built via meson. Therefore meson and ninja had to be moved to before pam. This required python3 and python3-setuptools, expta, libffi, gdbm & sqlite to also be moved before meson to ensure build was successful and that the python3 rootfile had all the required python files included. - Changelog 1.7.0 * build: changed build system from autotools to meson. * libpam_misc: use ECHOCTL in the terminal input * pam_access: support UID and GID in access.conf * pam_env: install environment file in vendordir if vendordir is enabled * pam_issue: only count class user if logind support is enabled * pam_limits: use systemd-logind instead of utmp if logind support is enabled * pam_unix: compare password hashes in constant time * Multiple minor bug fixes, build fixes, portability fixes, documentation improvements, and translation updates. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/pam | 300 ++++++++++++++++++------------------ lfs/pam | 26 ++-- make.sh | 16 +- 3 files changed, 172 insertions(+), 170 deletions(-) diff --git a/config/rootfiles/common/pam b/config/rootfiles/common/pam index c38cb9ea5..b98913526 100644 --- a/config/rootfiles/common/pam +++ b/config/rootfiles/common/pam @@ -15,92 +15,52 @@ etc/security #lib/security #lib/security/faillock #lib/security/mkhomedir_helper -#lib/security/pam_access.la lib/security/pam_access.so -#lib/security/pam_canonicalize_user.la #lib/security/pam_canonicalize_user.so -#lib/security/pam_debug.la #lib/security/pam_debug.so -#lib/security/pam_deny.la lib/security/pam_deny.so -#lib/security/pam_echo.la #lib/security/pam_echo.so -#lib/security/pam_env.la lib/security/pam_env.so -#lib/security/pam_exec.la lib/security/pam_exec.so -#lib/security/pam_faildelay.la lib/security/pam_faildelay.so -#lib/security/pam_faillock.la #lib/security/pam_faillock.so #lib/security/pam_filter -#lib/security/pam_filter.la #lib/security/pam_filter.so #lib/security/pam_filter/upperLOWER -#lib/security/pam_ftp.la #lib/security/pam_ftp.so -#lib/security/pam_group.la lib/security/pam_group.so -#lib/security/pam_issue.la lib/security/pam_issue.so -#lib/security/pam_keyinit.la lib/security/pam_keyinit.so -#lib/security/pam_limits.la lib/security/pam_limits.so -#lib/security/pam_listfile.la #lib/security/pam_listfile.so -#lib/security/pam_localuser.la #lib/security/pam_localuser.so -#lib/security/pam_loginuid.la lib/security/pam_loginuid.so -#lib/security/pam_mail.la lib/security/pam_mail.so -#lib/security/pam_mkhomedir.la #lib/security/pam_mkhomedir.so -#lib/security/pam_motd.la #lib/security/pam_motd.so -#lib/security/pam_namespace.la #lib/security/pam_namespace.so #lib/security/pam_namespace_helper -#lib/security/pam_nologin.la lib/security/pam_nologin.so -#lib/security/pam_permit.la lib/security/pam_permit.so -#lib/security/pam_pwhistory.la lib/security/pam_pwhistory.so -#lib/security/pam_rhosts.la lib/security/pam_rhosts.so -#lib/security/pam_rootok.la #lib/security/pam_rootok.so -#lib/security/pam_securetty.la #lib/security/pam_securetty.so -#lib/security/pam_setquota.la #lib/security/pam_setquota.so -#lib/security/pam_shells.la lib/security/pam_shells.so -#lib/security/pam_stress.la #lib/security/pam_stress.so -#lib/security/pam_succeed_if.la #lib/security/pam_succeed_if.so -#lib/security/pam_time.la #lib/security/pam_time.so -#lib/security/pam_timestamp.la #lib/security/pam_timestamp.so #lib/security/pam_timestamp_check -#lib/security/pam_umask.la #lib/security/pam_umask.so -#lib/security/pam_unix.la lib/security/pam_unix.so -#lib/security/pam_userdb.la #lib/security/pam_userdb.so -#lib/security/pam_usertype.la #lib/security/pam_usertype.so -#lib/security/pam_warn.la #lib/security/pam_warn.so -#lib/security/pam_wheel.la #lib/security/pam_wheel.so -#lib/security/pam_xauth.la #lib/security/pam_xauth.so +#lib/security/pwhistory_helper lib/security/unix_chkpwd #usr/include/security #usr/include/security/_pam_compat.h @@ -113,15 +73,12 @@ lib/security/unix_chkpwd #usr/include/security/pam_misc.h #usr/include/security/pam_modules.h #usr/include/security/pam_modutil.h -#usr/lib/libpam.la #usr/lib/libpam.so usr/lib/libpam.so.0 usr/lib/libpam.so.0.85.1 -#usr/lib/libpam_misc.la #usr/lib/libpam_misc.so usr/lib/libpam_misc.so.0 usr/lib/libpam_misc.so.0.82.1 -#usr/lib/libpamc.la #usr/lib/libpamc.so usr/lib/libpamc.so.0 usr/lib/libpamc.so.0.82.1 @@ -131,108 +88,153 @@ usr/lib/libpamc.so.0.82.1 #usr/lib/systemd #usr/lib/systemd/system #usr/lib/systemd/system/pam_namespace.service -#usr/share/doc/Linux-PAM -#usr/share/doc/Linux-PAM/draft-morgan-pam-current.txt -#usr/share/doc/Linux-PAM/index.html -#usr/share/doc/Linux-PAM/rfc86.0.txt -#usr/share/man/man3/misc_conv.3 -#usr/share/man/man3/pam.3 -#usr/share/man/man3/pam_acct_mgmt.3 -#usr/share/man/man3/pam_authenticate.3 -#usr/share/man/man3/pam_chauthtok.3 -#usr/share/man/man3/pam_close_session.3 -#usr/share/man/man3/pam_conv.3 -#usr/share/man/man3/pam_end.3 -#usr/share/man/man3/pam_error.3 -#usr/share/man/man3/pam_fail_delay.3 -#usr/share/man/man3/pam_get_authtok.3 -#usr/share/man/man3/pam_get_authtok_noverify.3 -#usr/share/man/man3/pam_get_authtok_verify.3 -#usr/share/man/man3/pam_get_data.3 -#usr/share/man/man3/pam_get_item.3 -#usr/share/man/man3/pam_get_user.3 -#usr/share/man/man3/pam_getenv.3 -#usr/share/man/man3/pam_getenvlist.3 -#usr/share/man/man3/pam_info.3 -#usr/share/man/man3/pam_misc_drop_env.3 -#usr/share/man/man3/pam_misc_paste_env.3 -#usr/share/man/man3/pam_misc_setenv.3 -#usr/share/man/man3/pam_open_session.3 -#usr/share/man/man3/pam_prompt.3 -#usr/share/man/man3/pam_putenv.3 -#usr/share/man/man3/pam_set_data.3 -#usr/share/man/man3/pam_set_item.3 -#usr/share/man/man3/pam_setcred.3 -#usr/share/man/man3/pam_sm_acct_mgmt.3 -#usr/share/man/man3/pam_sm_authenticate.3 -#usr/share/man/man3/pam_sm_chauthtok.3 -#usr/share/man/man3/pam_sm_close_session.3 -#usr/share/man/man3/pam_sm_open_session.3 -#usr/share/man/man3/pam_sm_setcred.3 -#usr/share/man/man3/pam_start.3 -#usr/share/man/man3/pam_strerror.3 -#usr/share/man/man3/pam_syslog.3 -#usr/share/man/man3/pam_verror.3 -#usr/share/man/man3/pam_vinfo.3 -#usr/share/man/man3/pam_vprompt.3 -#usr/share/man/man3/pam_vsyslog.3 -#usr/share/man/man3/pam_xauth_data.3 -#usr/share/man/man5/access.conf.5 -#usr/share/man/man5/environment.5 -#usr/share/man/man5/faillock.conf.5 -#usr/share/man/man5/group.conf.5 -#usr/share/man/man5/limits.conf.5 -#usr/share/man/man5/namespace.conf.5 -#usr/share/man/man5/pam.conf.5 -#usr/share/man/man5/pam.d.5 -#usr/share/man/man5/pam_env.conf.5 -#usr/share/man/man5/pwhistory.conf.5 -#usr/share/man/man5/time.conf.5 -#usr/share/man/man8/PAM.8 -#usr/share/man/man8/faillock.8 -#usr/share/man/man8/mkhomedir_helper.8 -#usr/share/man/man8/pam.8 -#usr/share/man/man8/pam_access.8 -#usr/share/man/man8/pam_canonicalize_user.8 -#usr/share/man/man8/pam_debug.8 -#usr/share/man/man8/pam_deny.8 -#usr/share/man/man8/pam_echo.8 -#usr/share/man/man8/pam_env.8 -#usr/share/man/man8/pam_exec.8 -#usr/share/man/man8/pam_faildelay.8 -#usr/share/man/man8/pam_faillock.8 -#usr/share/man/man8/pam_filter.8 -#usr/share/man/man8/pam_ftp.8 -#usr/share/man/man8/pam_group.8 -#usr/share/man/man8/pam_issue.8 -#usr/share/man/man8/pam_keyinit.8 -#usr/share/man/man8/pam_limits.8 -#usr/share/man/man8/pam_listfile.8 -#usr/share/man/man8/pam_localuser.8 -#usr/share/man/man8/pam_loginuid.8 -#usr/share/man/man8/pam_mail.8 -#usr/share/man/man8/pam_mkhomedir.8 -#usr/share/man/man8/pam_motd.8 -#usr/share/man/man8/pam_namespace.8 -#usr/share/man/man8/pam_namespace_helper.8 -#usr/share/man/man8/pam_nologin.8 -#usr/share/man/man8/pam_permit.8 -#usr/share/man/man8/pam_pwhistory.8 -#usr/share/man/man8/pam_rhosts.8 -#usr/share/man/man8/pam_rootok.8 -#usr/share/man/man8/pam_securetty.8 -#usr/share/man/man8/pam_setquota.8 -#usr/share/man/man8/pam_shells.8 -#usr/share/man/man8/pam_stress.8 -#usr/share/man/man8/pam_succeed_if.8 -#usr/share/man/man8/pam_time.8 -#usr/share/man/man8/pam_timestamp.8 -#usr/share/man/man8/pam_timestamp_check.8 -#usr/share/man/man8/pam_umask.8 -#usr/share/man/man8/pam_unix.8 -#usr/share/man/man8/pam_userdb.8 -#usr/share/man/man8/pam_usertype.8 -#usr/share/man/man8/pam_warn.8 -#usr/share/man/man8/pam_wheel.8 -#usr/share/man/man8/pam_xauth.8 -#usr/share/man/man8/unix_chkpwd.8 +#usr/share/locale/af/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/am +#usr/share/locale/am/LC_MESSAGES +#usr/share/locale/am/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ar +#usr/share/locale/ar/LC_MESSAGES +#usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/as +#usr/share/locale/as/LC_MESSAGES +#usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/az +#usr/share/locale/az/LC_MESSAGES +#usr/share/locale/az/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/be/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/bg/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/bn +#usr/share/locale/bn/LC_MESSAGES +#usr/share/locale/bn/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/bn_IN +#usr/share/locale/bn_IN/LC_MESSAGES +#usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/bs +#usr/share/locale/bs/LC_MESSAGES +#usr/share/locale/bs/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/cy +#usr/share/locale/cy/LC_MESSAGES +#usr/share/locale/cy/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/de_CH +#usr/share/locale/de_CH/LC_MESSAGES +#usr/share/locale/de_CH/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/el/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/eo/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/et/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/eu/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/fa +#usr/share/locale/fa/LC_MESSAGES +#usr/share/locale/fa/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ga/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/gl/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/gu +#usr/share/locale/gu/LC_MESSAGES +#usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/he +#usr/share/locale/he/LC_MESSAGES +#usr/share/locale/he/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/hi +#usr/share/locale/hi/LC_MESSAGES +#usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/hr/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ia/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/id/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/is +#usr/share/locale/is/LC_MESSAGES +#usr/share/locale/is/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ka/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/km +#usr/share/locale/km/LC_MESSAGES +#usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/kn +#usr/share/locale/kn/LC_MESSAGES +#usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/kw_GB +#usr/share/locale/kw_GB/LC_MESSAGES +#usr/share/locale/kw_GB/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ky/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/lt/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/lv/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/mk +#usr/share/locale/mk/LC_MESSAGES +#usr/share/locale/mk/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ml +#usr/share/locale/ml/LC_MESSAGES +#usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/mn +#usr/share/locale/mn/LC_MESSAGES +#usr/share/locale/mn/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/mr +#usr/share/locale/mr/LC_MESSAGES +#usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/my +#usr/share/locale/my/LC_MESSAGES +#usr/share/locale/my/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ne +#usr/share/locale/ne/LC_MESSAGES +#usr/share/locale/ne/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/nn +#usr/share/locale/nn/LC_MESSAGES +#usr/share/locale/nn/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/or +#usr/share/locale/or/LC_MESSAGES +#usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/pa +#usr/share/locale/pa/LC_MESSAGES +#usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ro/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/si +#usr/share/locale/si/LC_MESSAGES +#usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/sl/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/sq/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/sr@latin +#usr/share/locale/sr@latin/LC_MESSAGES +#usr/share/locale/sr(a)latin/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/te +#usr/share/locale/te/LC_MESSAGES +#usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/tg +#usr/share/locale/tg/LC_MESSAGES +#usr/share/locale/tg/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/th/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/ur +#usr/share/locale/ur/LC_MESSAGES +#usr/share/locale/ur/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/vi/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/yo +#usr/share/locale/yo/LC_MESSAGES +#usr/share/locale/yo/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/zh_HK +#usr/share/locale/zh_HK/LC_MESSAGES +#usr/share/locale/zh_HK/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo +#usr/share/locale/zu +#usr/share/locale/zu/LC_MESSAGES +#usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo diff --git a/lfs/pam b/lfs/pam index 8e5b6f602..8f3d144f8 100644 --- a/lfs/pam +++ b/lfs/pam @@ -24,7 +24,7 @@ include Config -VER = 1.6.1 +VER = 1.7.0 THISAPP = Linux-PAM-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 649b4ff892fbd3eb90adcbd9ccc5b3f5df51bf1c79b9084c7a1613c432587b13b81761d1eb4f31ef12d58843d16af24a3c441d0b6f5d2f2a1db9c8da15a61e2f +$(DL_FILE)_BLAKE2 = 39c8c2ccc6f7d125d12d49439ae44cb8fe115f0529549269246e54f4b4de0b3b24c1099e4d3fa39d4e477af8a92b66dd6dc2cb93f0643ab7b56bcaabdd3b8539 install : $(TARGET) @@ -71,17 +71,17 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) $(UPDATE_AUTOMAKE) - cd $(DIR_APP) && ./configure --libdir=/usr/lib \ - --sbindir=/lib/security \ - --enable-securedir=/lib/security \ - --enable-read-both-confs \ - --disable-nls - - cd $(DIR_APP) && make $(MAKETUNING) - cd $(DIR_APP) && make install - + cd $(DIR_APP) && meson setup \ + --libdir=/usr/lib \ + --sbindir=/lib/security \ + -D securedir=/lib/security \ + -D read-both-confs=true \ + -D nis=disabled \ + -D docs=disabled \ + builddir/ + cd $(DIR_APP) && ninja -C builddir/ $(MAKETUNING) + cd $(DIR_APP) && ninja -C builddir/ install # Install configuration - -mkdir -p /etc/pam.d - + -mkdir -p /etc/pam.d @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/make.sh b/make.sh index 35a602f62..abeb1dd88 100755 --- a/make.sh +++ b/make.sh @@ -1479,6 +1479,14 @@ build_system() { lfsmake2 openssl lfsmake2 popt lfsmake2 libedit + lfsmake2 expat + lfsmake2 libffi + lfsmake2 gdbm + lfsmake2 sqlite + lfsmake2 python3 + lfsmake2 python3-setuptools + lfsmake2 ninja + lfsmake2 meson lfsmake2 pam lfsmake2 libcap lfsmake2 libcap-ng @@ -1501,22 +1509,14 @@ build_system() { lfsmake2 iproute2 lfsmake2 screen lfsmake2 elfutils - lfsmake2 expat lfsmake2 libconfig lfsmake2 curl lfsmake2 libarchive lfsmake2 cmake lfsmake2 json-c lfsmake2 tcl - lfsmake2 libffi - lfsmake2 gdbm - lfsmake2 sqlite - lfsmake2 python3 - lfsmake2 python3-setuptools lfsmake2 python3-MarkupSafe lfsmake2 python3-Jinja2 - lfsmake2 ninja - lfsmake2 meson lfsmake2 kmod lfsmake2 udev lfsmake2 libusb -- 2.47.0

1 9

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development