- Update from versionj number 2.7.1 to 2.8.2 - Update of rootfile - Changelog 2.8.2 exports: Fix referrals when --enable-junction=no Commit 15dc0bea ("exportd: Moved cache upcalls routines into libexport.a") caused write_fsloc() to be elided when junction support is disabled. Remove the not needed #ifdef HAVE_JUNCTION_SUPPORT which blocks the referrals from working when --enable-junction=no is set. (only the #ifdef HAVE_JUNCTION_SUPPORT should be around actual junction code). Fixes: 15dc0bea ("exportd: Moved cache upcalls routines into libexport.a") Link: https://bugs.debian.org/1035908 Link: https://bugs.debian.org/1083098 nfsidmap(v2): Add guards around [nfsidmap] usages of [sysconf]. sysconf(_SC_GETPW_R_SIZE_MAX) and sysconf(_SC_GETGR_R_SIZE_MAX) return -1 on musl, which causes either segmentation faults or ENOMEM errors. Replace all usages of sysconf with dedicated methods that guard against a result of -1. libnsm(v2): fix the safer atomic filenames fix Commit 9f7a91b51ffc ("libnsm: safer atomic filenames") messed up the length arguement to snprintf() in nsm_make_temp_pathname such that the length is longer than the computed string. When compiled with "-O -D_FORTIFY_SOURCE=3", __snprintf_chk will fail and abort statd. The fix is to correct the original size calculation, then pull one from the snprintf length for the final "/". Revert "libnsm: fix the safer atomic filenames fix" This reverts commit 8fcddae4437510137baf108f477d116ce345ce80. libnsm: fix the safer atomic filenames fix Commit 9f7a91b51ffc ("libnsm: safer atomic filenames") messed up the length arguement to snprintf() in nsm_make_temp_pathname such that the length is longer than the computed string. When compiled with "-O -D_FORTIFY_SOURCE=3", __snprintf_chk will fail and abort statd. The fix is to correct the original size calculation, then pull one from the snprintf length for the final "/". nfsd: dump default number of threads to 16 nfsdctl defaults to 16 threads. Since the nfs-server.service file first tries nfsdctl and then falls back to rpc.nfsd, it would probably be wise to make the default in rpc.nfsd and nfs.conf 16, for the sake of consistency and to avoid surprises. autoconf: don't build nfsdcltrack by default Now that we've started the process to remove legacy v4 client tracking methods, let's stop building nfsdcltrack by default. nfs(5): Update rsize/wsize options The rsize/wsize values are not multiples of 1024 but multiples of the system's page size or powers of 2 if < system's page size as defined in fs/nfs/internal.h:nfs_io_size(). nfsdctl: clarify when versions can be set on the man page Attempting to make version changes while there are nfsd threads running fails with -EBUSY, so make note of it on the man page. nfsdctl: fix up the help text in version_usage() The help text in version_usage() has examples with a 'v' character in the version string, but the format string in the sscanf() call in version_func() doesn't contain a 'v' character. libnsm: safer atomic filenames We've gotten a report of reboot notifications being sent to domains that end in '.new', which can happen if the NSM temporary pathname code leaves a file behind. Let's fix this up by prepending a single '.' to the temp path which will never be resolvable as a DNS record. https://lore.kernel.org/linux-nfs/04D30B5A-C53E-4920-ADCB-C77F5577669E@oracl... nfs-utils: fixup statd testing simulator host arg The getopt setup for the host arg was not expecing a value, update it as expected reexport.h: Include unistd.h to compile with musl Makefile.am: allow mount.nfs to be writeable by owner On Red Hat-based systems, the debug symbol files are built with a .gdb_index section to speed up gdb initialization. The gdb-add-index program calls objcopy to merge the index file into the object file. That fails if the object file isn't writeable by the owner. mount.nfs: retry NFSv3 mount after NFSv4 failure in auto negotiation The problem happens when a v3 mount fails with ETIMEDOUT after the v4 mount failed with EPROTONOSUPPORT, in mount auto negotiation. It immediately breaks from the "for" loop in nfsmount_fg() or nfsmount_child() due to EPROTONOSUPPORT, never doing the expected retries until timeout. 2.8.1 nfs-utils: use getpwuid_r() and getpwnam_r() in gssd gssd uses getpwuid(3) and getpwnam(3) in a pthreads context but these functions are not thread safe. nfsdcld: prevent from accessing /var/lib/nfs/nfsdcld in read-only file system during boot I saw a VMWare guest that hit a rare condition during boot; nfsdcld started too early to check access on /var/lib/nfs/nfsdcld which were still in read-only file system as follows: nfsdcld[...]: Unexpected error when checking access on /var/lib/nfs/nfsdcld: Read-only file system systemd[1]: nfsdcld.service: Main process exited, code=exited, status=226/NAMESPACE systemd[1]: nfsdcld.service: Failed with result 'exit-code'. nfsdcld.service needs to wait the root file system to be remounted at least. systemd: use nfsdctl to start and stop the nfs server Attempt to use nfsdctl to start and stop the nfs-server. If that fails for any reason, use rpc.nfsd to do it instead. nfsdctl: asciidoc source for the manpage Convert to manpage with: asciidoctor -b manpage nfsdctl.adoc nfsdctl: add the nfsdctl utility to nfs-utils This tool is based on Lorenzo's original nfsdctl tool [1]. His original tool used getopt_long to indicate the command, but that's somewhat limiting. This converts it to a subcommand-based interface, where each subcommand can take its own options, in the spirit of commands like nmcli or virsh. There are currently 6 different subcommands: pool-mode get/set current pool mode setting listener get/set listener info version get/set supported NFS versions threads get/set nfsd thread settings status get current RPC processing info autostart start server with settings from /etc/nfs.conf Each can take different options, and we can expand this interface later with more commands as necessary. This is based on Lorenzo's original userland tool: https://github.com/LorenzoBianconi/nfsdctl rpc.idmapd: nfsopen() failures should not be fatal dirscancb() loops over all clnt* subdirectories of /run/rpc_pipefs/nfs/. Some of these directories contain /idmap files, others don't. nfsopen() returns -1 for the latter; we then want to skip the directory, not abort the entire scan. mount.nfs: improve EPROTO error message for RDMA mounts When mounting NFS shares using RDMA, users may encounter this rather unclear error message: mount.nfs: Protocol error Often there are either no RDMA interfaces existing, or that routing is being done via other interfaces. This patch enhances the `mount_error` function to provide a more informative message in such cases. support/junction/path.c: Fix buld for musl Fixed: path.c:164:24: error: implicit declaration of function 'strchrnul'; did you mean 'strchr'? [-Wimplicit-function-declaration] [snip] path.c:239:27: error: 'NAME_MAX' undeclared (first use in this function); did you mean 'AF_MAX'? support/include/junction.h: Define macros for musl Fixed 1: In file included from cache.c:1217: ../../support/include/junction.h:128:21: error: expected ';' before 'char' 128 | __attribute_malloc__ | ^ | ; 129 | char **nfs_dup_string_array(char **array); Fixed 2: junction.c: In function 'junction_set_sticky_bit': junction.c:164:39: error: 'ALLPERMS' undeclared (first use in this function) 164 | stb.st_mode &= (unsigned int)~ALLPERMS; nfsdcld: don't send null client ids to the kernel It's apparently possible for the sqlite database to get corrupted and cause one or more rows to have null in the id column. The knfsd fix was posted here: https://lore.kernel.org/linux-nfs/20240903111446.659884-1-lilingfeng3@huawei... nfsdcld should have a similar fix. If we encounter a client record with a null id, just skip it instead of sending it to the kernel.

Signed-off-by: Adolf Belka adolf.belka@ipfire.org --- config/rootfiles/packages/nfs | 4 ++-- lfs/nfs | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/config/rootfiles/packages/nfs b/config/rootfiles/packages/nfs index 2090e30e5..b8acffb58 100644 --- a/config/rootfiles/packages/nfs +++ b/config/rootfiles/packages/nfs @@ -1,7 +1,6 @@ etc/rc.d/init.d/nfs-server sbin/mount.nfs sbin/mount.nfs4 -sbin/nfsdcltrack sbin/umount.nfs sbin/umount.nfs4 #usr/include/nfsidmap.h @@ -35,6 +34,7 @@ usr/sbin/nfsconf usr/sbin/nfsdcld usr/sbin/nfsdclddb usr/sbin/nfsdclnts +usr/sbin/nfsdctl usr/sbin/nfsidmap usr/sbin/nfsiostat usr/sbin/nfsref @@ -68,7 +68,7 @@ usr/sbin/start-statd #usr/share/man/man8/nfsdcld.8 #usr/share/man/man8/nfsdclddb.8 #usr/share/man/man8/nfsdclnts.8 -#usr/share/man/man8/nfsdcltrack.8 +#usr/share/man/man8/nfsdctl.8 #usr/share/man/man8/nfsidmap.8 #usr/share/man/man8/nfsiostat.8 #usr/share/man/man8/nfsref.8 diff --git a/lfs/nfs b/lfs/nfs index 3c7766645..a81586514 100644 --- a/lfs/nfs +++ b/lfs/nfs @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team info@ipfire.org # +# Copyright (C) 2007-2025 IPFire Team info@ipfire.org # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config

SUMMARY = Support Utilities for Kernel nfsd

-VER = 2.7.1 +VER = 2.8.2

THISAPP = nfs-utils-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nfs -PAK_VER = 24 +PAK_VER = 25

DEPS = rpcbind

@@ -48,7 +48,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_BLAKE2 = 0b62f9e86c687c5608947b667526b23cb480c1c526a4303db4d3e551383e5d482ea5b088e26d7f70240abcac405db3668f71377679294bd80796b42717d05f3b +$(DL_FILE)_BLAKE2 = b3b876dd1b4c745f4fe26b6ae9ec4690f7a946f5616276ce543a7cf0504156408e59682499b80aca4d09fe819de75c6499a11726bec0a392a277685199b56ac6

install : $(TARGET)

- Update from version 4.99.4 to 4.99.5 - Update of rootfile not required - Changelog 4.99.5 Refine protocol decoding for: Arista: Use the test .pcap file from pull request #955 (HwInfo). BGP: Fix an undefined behavior when it tries to parse a too-short packet. CARP: Print the protocol name before any GET_(). CDP: only hex-dump unknown TLVs in verbose mode. DHCP: parse the SZTP redirect tag. DHCPv6: client-id/server-id DUID type 2 correction; parse the user class, boot file URL, and SZTP redirect options; add DUID-UUID printing (RFC6355). DNS: Detect and correctly handle too-short URI RRs. EAP: Assign ndo_protocol in the eap_print() function. ESP: Don't use EVP_add_cipher_alias() (fixes building on OpenBSD 7.5). Frame Relay (Multilink): Fix the Timestamp Information Element printing. ICMPv6: Fix printing the Home Agent Address Discovery Reply Message. IEEE 802.11: no need for an element ID in the structures for IEs, make the length in the IE structures a u_int, include the "TA" field while printing Block Ack Control frame. IP: Enable TSO (TCP Segmentation Offload) support; fix printing invalid cases as invalid, not truncated; use ND_ICHECKMSG_ZU() to test the header length. IPv6: Fix printing invalid cases as invalid, not truncated; use ND_ICHECKMSG_U() to print an invalid version. IPv6: Fix invalid 32-bit versus 64-bit printouts of fragment headers. ISAKMP: Fix printing Delete payload SPI when size is zero. Kerberos: Print the protocol name, remove a redundant bounds check. lwres: Fix an undefined behavior in pointer arithmetic. OpenFlow 1.0: Fix indentation of PORT_MOD, improve handling of some lengths, and fix handling of snapend. TCP: Test ports < 1024 in port order to select the printer. UDP: Move source port equal BCM_LI_PORT to bottom of long if else chain. UDP: Test ports < 1024 in port order to select the printer. LDP: Add missing fields of the Common Session Parameters TLV and fix the offset for the A&D bits. NFLOG: Use correct AF code points on all OSes. NFS: Avoid printing non-ASCII characters. OSPF: Pad TLVs in LS_OPAQUE_TYPE_RI to multiples of 4 bytes. OSPF: Update LS-Ack printing not to run off the end of the packet. OSPF6: Fix an undefined behavior. pflog: use nd_ types in struct pfloghdr. PPP: Check if there is some data to hexdump. PPP: Remove an extra colon before LCP Callback Operation. Use the buffer stack for de-escaping PPP; fixes CVE-2024-2397; Note: This problem does not affect any tcpdump release. PTP: Fix spelling of type SIGNALING, Parse major and minor version correctly, Print majorSdoId field instead of just the first bit. RIP: Make a couple trivial protocol updates. RPKI-Router: Refine length and bounds checks. RX: Use the "%Y-%m-%d" date format. smbutil.c: Use the "%Y-%m-%d" date format. SNMP: Fix two undefined behaviors. Text protocols: Fix printing truncation if it is not the case. ZEP: Use the "%Y-%m-%d" date format. ZMTP: Replace custom code with bittok2str(). User interface: Print the supported time stamp types (-J) to stdout instead of stderr. Print the list of data link types (-L) to stdout instead of stderr. Use symmetrical quotation characters in error messages. Update --version option to print 32/64-bit build and time_t size. Improve error messages for invalid interface indexes specified with -i. Support "3des" as an alias for "des_ede3_cbc" even if the crypto library doesn't support adding aliases. Source code: tcpdump: Fix a memory leak. child_cleanup: reap as many child processes as possible. Ignore failures when setting the default "any" device DLL to LINUX_SLL2. Fix for backends which doesn't support capsicum. Update ND_BYTES_BETWEEN() macro for better accuracy. Update ND_BYTES_AVAILABLE_AFTER() macro for better accuracy. Introduce new ND_ICHECK*() macros to deduplicate more code. Skip privilege dropping when using -Z root on --with-user builds. Add a nd_printjn() function. Make nd_trunc_longjmp() not static inline. Include <time.h> from netdissect.h. Remove init_crc10_table() and the entourage. Initialize tzcode early. Capsicum support: Fix a 'not defined' macro error. Update the "Error converting time" tests for packet times. Fix warnings when building for 32-bit and defining _TIME_BITS=64. Free interface list just before exiting where it wasn't being freed. Building and testing: Add a configure option to help debugging (--enable-instrument-functions). At build time require a proof of suitable snprintf(3) implementation in libc (and document Solaris 9 as unsupported because of that). Makefile.in: Add two "touch .devel" commands in the releasecheck target. Autoconf: Get --with-user and --with-chroot right. Autoconf: Fix --static-pcap-only test on Solaris 10. Autoconf: Add some warning flags for clang 13 or newer. Autoconf: Update config.{guess,sub}, timestamps 2024-01-01. Autoconf: Add autogen.sh, remove configure and config.h.in and put these generated files in the release tarball. Autoconf: Update the install-sh script to the 2020-11-14.01 version. configure: Apply autoupdate 2.69. CMake: improve the comment before project(tcpdump C). Do not require vsnprintf(). tests: Use the -tttt option, by default, for the tests. Autoconf, CMake: Get the size of a void * and a time_t. Fix propagation of cc_werr_cflags() output. Makefile.in: Fix the depend target. mkdep: Exit with a non-zero status if a command fails. Autoconf: use V_INCLS to update the list of include search paths. Autoconf: don't put anything before -I and -L flags for local libpcap. Autoconf, CMake: work around an Xcode 15+ issue. Autoconf, CMake: use pkg-config and Homebrew when looking for libcrypto. Fix Sun C invocation from CMake. mkdep: Use TMPDIR if it is set and not null. Add initial support for building with TinyCC. Makefile.in: Use the variable MAKE instead of the make command. Makefile.in: Add instrumentation configuration in releasecheck target. Make various improvements to the TESTrun script. Untangle detection of pcap_findalldevs(). Autoconf: don't use egrep, use $EGREP. Autoconf: check for gethostbyaddr(), not gethostbyname(). Autoconf, CMake: search for gethostbyaddr() in libnetwork. Make illumos build warning-free. Documentation: Fixed errors in doc/README.Win32.md and renamed it to README.windows.md. Make various improvements to the man page. Add initial README file for Haiku. Make various improvements to CONTRIBUTING.md.

Signed-off-by: Adolf Belka adolf.belka@ipfire.org --- lfs/tcpdump | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lfs/tcpdump b/lfs/tcpdump index 4015577ce..2ac5b19de 100644 --- a/lfs/tcpdump +++ b/lfs/tcpdump @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team info@ipfire.org # +# Copyright (C) 2007-2025 IPFire Team info@ipfire.org # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,15 +26,15 @@ include Config

SUMMARY = A Packet Sniffer

-VER = 4.99.4 +VER = 4.99.5

THISAPP = tcpdump-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.xz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tcpdump -PAK_VER = 16 +PAK_VER = 17

DEPS =

@@ -48,7 +48,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_BLAKE2 = f100e10774574ef04a770bc30d4e2d06fd0f1f16a7b2c88848be6e8290cc4838666ff378d9f78fdc418f4ffab9716a11214edc3588c292cb5ff39636cd7cfd2d +$(DL_FILE)_BLAKE2 = 30b8e81e29f37f220ab9301185301190c5abb6ee8a8105c899e53e96b93265d3d408a181b75ee18bd70f96494c5dcf12374aedddd1db6fd7ab41e5c5ba35c7e5

install : $(TARGET)

@@ -80,7 +80,7 @@ $(subst %,%_BLAKE2,$(objects)) :

$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && \ ./configure \ --prefix=/usr \