IPFire-SCM December 2015

ipfire-scm@lists.ipfire.org

1 participants
42 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9977da131b2d2e560057b79db714a987977026b4
by git＠ipfire.org 28 Dec '15

28 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 9977da131b2d2e560057b79db714a987977026b4 (commit) via 21ac63688a76cefccf4796fe608fae436c38d5c8 (commit) via c3b4c861f5531712b6579cae839ea621f5336950 (commit) via 2135528774a66fa30143c024993054aed0f60c5a (commit) from 4df3276bb43bfb77e570b8c329da3885f644dabb (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9977da131b2d2e560057b79db714a987977026b4 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sun Dec 27 00:20:13 2015 +0100 bind: Update to 9.10.3-P2 Changelog: [security] Update allowed OpenSSL versions as named is potentially vulnerable to CVE-2015-3193. [maint] H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53. [RT #40556] [security] Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. (CVE-2015-8000) [RT #40987] [security] Address fetch context reference count handling error on socket error. (CVE-2015-8461) [RT#40945] Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 21ac63688a76cefccf4796fe608fae436c38d5c8 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Dec 28 15:37:02 2015 +0100 core97: Ship dnsmasq Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c3b4c861f5531712b6579cae839ea621f5336950 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Thu Dec 24 10:17:16 2015 +0100 dnsmasq 2.75: latest patches from upstream Same procedure as... :-) Best to all for xmas and 2016! Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 2135528774a66fa30143c024993054aed0f60c5a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Dec 28 15:30:13 2015 +0100 core97: Ship pgrep with the updater Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: .../{oldcore/96 => core/97}/filelists/dnsmasq | 0 config/rootfiles/core/97/filelists/files | 1 + config/rootfiles/core/97/update.sh | 2 + lfs/bind | 4 +- lfs/dnsmasq | 5 + ...EDNS0_handling_and_computation_use_of_udp.patch | 643 +++++++++++++++++++++ ...aks_in_handling_unknown_DNSSEC_algorithms.patch | 262 +++++++++ ...obscure_off-by-one_in_DNSSEC_hostname_cmp.patch | 27 + .../028-Minor_tweak_to_previous_commit.patch | 39 ++ .../dnsmasq/029-NSEC3_check_RFC5155_para_8_2.patch | 39 ++ 10 files changed, 1020 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/96 => core/97}/filelists/dnsmasq (100%) create mode 100644 src/patches/dnsmasq/025-Major_tidy_up_of_EDNS0_handling_and_computation_use_of_udp.patch create mode 100644 src/patches/dnsmasq/026-More_tweaks_in_handling_unknown_DNSSEC_algorithms.patch create mode 100644 src/patches/dnsmasq/027-Nasty_rare_and_obscure_off-by-one_in_DNSSEC_hostname_cmp.patch create mode 100644 src/patches/dnsmasq/028-Minor_tweak_to_previous_commit.patch create mode 100644 src/patches/dnsmasq/029-NSEC3_check_RFC5155_para_8_2.patch Difference in files: diff --git a/config/rootfiles/core/97/filelists/dnsmasq b/config/rootfiles/core/97/filelists/dnsmasq new file mode 120000 index 0000000..d469c74 --- /dev/null +++ b/config/rootfiles/core/97/filelists/dnsmasq @@ -0,0 +1 @@ +../../../common/dnsmasq \ No newline at end of file diff --git a/config/rootfiles/core/97/filelists/files b/config/rootfiles/core/97/filelists/files index 409e5fe..643ab97 100644 --- a/config/rootfiles/core/97/filelists/files +++ b/config/rootfiles/core/97/filelists/files @@ -1,2 +1,3 @@ etc/system-release etc/issue +usr/bin/pgrep diff --git a/config/rootfiles/core/97/update.sh b/config/rootfiles/core/97/update.sh index 4727d36..e6d4f21 100644 --- a/config/rootfiles/core/97/update.sh +++ b/config/rootfiles/core/97/update.sh @@ -32,6 +32,7 @@ do done # Stop services +/etc/init.d/dnsmasq stop # Extract files extract_files @@ -40,6 +41,7 @@ extract_files # /usr/local/bin/update-lang-cache # Start services +/etc/init.d/dnsmasq start # This update need a reboot... #touch /var/run/need_reboot diff --git a/lfs/bind b/lfs/bind index 6480798..b0d5185 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.10.3 +VER = 9.10.3-P2 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = d8cbf04a62a139a841d4bf878087a555 +$(DL_FILE)_MD5 = 672dd3c2796b12ac8440f55bcaecfa82 install : $(TARGET) diff --git a/lfs/dnsmasq b/lfs/dnsmasq index c8fd7db..8058663 100644 --- a/lfs/dnsmasq +++ b/lfs/dnsmasq @@ -97,6 +97,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/022-Tidy_up_DNSSEC_non-existence_code_Check_zone_status_is_NSEC_proof_bad.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/023-Fix_brace_botch_in_dnssec_validate_ds.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/024-Do_a_better_job_of_determining_which_DNSSEC_sig_algos_are_supported.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/025-Major_tidy_up_of_EDNS0_handling_and_computation_use_of_udp.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/026-More_tweaks_in_handling_unknown_DNSSEC_algorithms.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/027-Nasty_rare_and_obscure_off-by-one_in_DNSSEC_hostname_cmp.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/028-Minor_tweak_to_previous_commit.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/029-NSEC3_check_RFC5155_para_8_2.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch cd $(DIR_APP) && sed -i src/config.h \ diff --git a/src/patches/dnsmasq/025-Major_tidy_up_of_EDNS0_handling_and_computation_use_of_udp.patch b/src/patches/dnsmasq/025-Major_tidy_up_of_EDNS0_handling_and_computation_use_of_udp.patch new file mode 100644 index 0000000..c016e73 --- /dev/null +++ b/src/patches/dnsmasq/025-Major_tidy_up_of_EDNS0_handling_and_computation_use_of_udp.patch @@ -0,0 +1,643 @@ +From fa14bec83b2db010fd076910fddab56957b9375d Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Sun, 20 Dec 2015 17:12:16 +0000 +Subject: [PATCH] Major tidy up of EDNS0 handling and computation/use of udp + packet size. + +--- + src/auth.c | 8 ++- + src/dnsmasq.h | 7 ++- + src/dnssec.c | 1 - + src/forward.c | 184 ++++++++++++++++++++++++++++++++++++++++---------------- + src/netlink.c | 3 +- + src/rfc1035.c | 81 +++++++------------------ + src/rrfilter.c | 2 +- + 7 files changed, 168 insertions(+), 118 deletions(-) + +diff --git a/src/auth.c b/src/auth.c +index 2b0b7d6..85bd5e7 100644 +--- a/src/auth.c ++++ b/src/auth.c +@@ -81,7 +81,8 @@ int in_zone(struct auth_zone *zone, char *name, char **cut) + } + + +-size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t now, union mysockaddr *peer_addr, int local_query) ++size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t now, union mysockaddr *peer_addr, ++ int local_query, int do_bit, int have_pseudoheader) + { + char *name = daemon->namebuff; + unsigned char *p, *ansp; +@@ -820,6 +821,11 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n + header->ancount = htons(anscount); + header->nscount = htons(authcount); + header->arcount = htons(0); ++ ++ /* Advertise our packet size limit in our reply */ ++ if (have_pseudoheader) ++ return add_pseudoheader(header, ansp - (unsigned char *)header, (unsigned char *)limit, daemon->edns_pktsz, 0, NULL, 0, do_bit); ++ + return ansp - (unsigned char *)header; + } + +diff --git a/src/dnsmasq.h b/src/dnsmasq.h +index 39a930c..abb34c5 100644 +--- a/src/dnsmasq.h ++++ b/src/dnsmasq.h +@@ -1113,7 +1113,7 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *namebuff, + int no_cache, int secure, int *doctored); + size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + struct in_addr local_addr, struct in_addr local_netmask, +- time_t now, int *ad_reqd, int *do_bit); ++ time_t now, int ad_reqd, int do_bit, int have_pseudoheader); + int check_for_bogus_wildcard(struct dns_header *header, size_t qlen, char *name, + struct bogus_addr *addr, time_t now); + int check_for_ignored_address(struct dns_header *header, size_t qlen, struct bogus_addr *baddr); +@@ -1123,6 +1123,8 @@ int check_for_local_domain(char *name, time_t now); + unsigned int questions_crc(struct dns_header *header, size_t plen, char *buff); + size_t resize_packet(struct dns_header *header, size_t plen, + unsigned char *pheader, size_t hlen); ++size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *limit, ++ unsigned short udp_sz, int optno, unsigned char *opt, size_t optlen, int set_do); + size_t add_mac(struct dns_header *header, size_t plen, char *limit, union mysockaddr *l3); + size_t add_source_addr(struct dns_header *header, size_t plen, char *limit, union mysockaddr *source); + #ifdef HAVE_DNSSEC +@@ -1141,7 +1143,8 @@ int private_net(struct in_addr addr, int ban_localhost); + /* auth.c */ + #ifdef HAVE_AUTH + size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, +- time_t now, union mysockaddr *peer_addr, int local_query); ++ time_t now, union mysockaddr *peer_addr, int local_query, ++ int do_bit, int have_pseudoheader); + int in_zone(struct auth_zone *zone, char *name, char **cut); + #endif + +diff --git a/src/dnssec.c b/src/dnssec.c +index 82394ee..299ca64 100644 +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -67,7 +67,6 @@ static char *algo_digest_name(int algo) + case 12: return "gosthash94"; + case 13: return "sha256"; + case 14: return "sha384"; +- + default: return NULL; + } + } +diff --git a/src/forward.c b/src/forward.c +index 3e801c8..041353c 100644 +--- a/src/forward.c ++++ b/src/forward.c +@@ -244,7 +244,6 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + void *hash = &crc; + #endif + unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL); +- unsigned char *pheader; + + (void)do_bit; + +@@ -264,7 +263,8 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + there's no point retrying the query, retry the key query instead...... */ + if (forward->blocking_query) + { +- int fd; ++ int fd, is_sign; ++ unsigned char *pheader; + + forward->flags &= ~FREC_TEST_PKTSZ; + +@@ -276,8 +276,8 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + blockdata_retrieve(forward->stash, forward->stash_len, (void *)header); + plen = forward->stash_len; + +- if (find_pseudoheader(header, plen, NULL, &pheader, NULL)) +- PUTSHORT((forward->flags & FREC_TEST_PKTSZ) ? SAFE_PKTSZ : forward->sentto->edns_pktsz, pheader); ++ if (find_pseudoheader(header, plen, NULL, &pheader, &is_sign) && !is_sign) ++ PUTSHORT(SAFE_PKTSZ, pheader); + + if (forward->sentto->addr.sa.sa_family == AF_INET) + log_query(F_NOEXTRA | F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec"); +@@ -394,32 +394,40 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + forward->log_id = daemon->log_id; + + if (option_bool(OPT_ADD_MAC)) +- plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source); +- ++ { ++ size_t new = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source); ++ if (new != plen) ++ { ++ plen = new; ++ forward->flags |= FREC_ADDED_PHEADER; ++ } ++ } ++ + if (option_bool(OPT_CLIENT_SUBNET)) + { + size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source); + if (new != plen) + { + plen = new; +- forward->flags |= FREC_HAS_SUBNET; ++ forward->flags |= FREC_HAS_SUBNET | FREC_ADDED_PHEADER; + } + } + + #ifdef HAVE_DNSSEC + if (option_bool(OPT_DNSSEC_VALID)) + { +- size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz); ++ size_t new = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz); + ++ if (new != plen) ++ forward->flags |= FREC_ADDED_PHEADER; ++ ++ plen = new; ++ + /* For debugging, set Checking Disabled, otherwise, have the upstream check too, + this allows it to select auth servers when one is returning bad data. */ + if (option_bool(OPT_DNSSEC_DEBUG)) + header->hb4 |= HB4_CD; + +- if (new_plen != plen) +- forward->flags |= FREC_ADDED_PHEADER; +- +- plen = new_plen; + } + #endif + +@@ -469,10 +477,23 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + } + #endif + } +- +- if (find_pseudoheader(header, plen, NULL, &pheader, NULL)) +- PUTSHORT((forward->flags & FREC_TEST_PKTSZ) ? SAFE_PKTSZ : start->edns_pktsz, pheader); + ++#ifdef HAVE_DNSSEC ++ if (option_bool(OPT_DNSSEC_VALID) && !do_bit) ++ { ++ /* Difficult one here. If our client didn't send EDNS0, we will have set the UDP ++ packet size to 512. But that won't provide space for the RRSIGS in many cases. ++ The RRSIGS will be stripped out before the answer goes back, so the packet should ++ shrink again. So, if we added a do-bit, bump the udp packet size to the value ++ known to be OK for this server. Maybe check returned size after stripping and set ++ the truncated bit? */ ++ unsigned char *pheader; ++ int is_sign; ++ if (find_pseudoheader(header, plen, NULL, &pheader, &is_sign)) ++ PUTSHORT(start->edns_pktsz, pheader); ++ } ++#endif ++ + if (retry_send(sendto(fd, (char *)header, plen, 0, + &start->addr.sa, + sa_len(&start->addr)))) +@@ -563,30 +584,34 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server + } + #endif + +- /* If upstream is advertising a larger UDP packet size +- than we allow, trim it so that we don't get overlarge +- requests for the client. We can't do this for signed packets. */ +- + if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign))) + { +- unsigned short udpsz; +- unsigned char *psave = sizep; +- +- GETSHORT(udpsz, sizep); +- +- if (!is_sign && udpsz > daemon->edns_pktsz) +- PUTSHORT(daemon->edns_pktsz, psave); +- + if (check_subnet && !check_source(header, plen, pheader, query_source)) + { + my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch")); + return 0; + } + +- if (added_pheader) ++ if (!is_sign) + { +- pheader = 0; +- header->arcount = htons(0); ++ if (added_pheader) ++ { ++ /* client didn't send EDNS0, we added one, strip it off before returning answer. */ ++ n = rrfilter(header, n, 0); ++ pheader = NULL; ++ } ++ else ++ { ++ /* If upstream is advertising a larger UDP packet size ++ than we allow, trim it so that we don't get overlarge ++ requests for the client. We can't do this for signed packets. */ ++ unsigned short udpsz; ++ unsigned char *psave = sizep; ++ ++ GETSHORT(udpsz, sizep); ++ if (udpsz > daemon->edns_pktsz) ++ PUTSHORT(daemon->edns_pktsz, psave); ++ } + } + } + +@@ -655,14 +680,16 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server + } + + if (option_bool(OPT_DNSSEC_VALID)) +- header->hb4 &= ~HB4_AD; +- +- if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure) +- header->hb4 |= HB4_AD; +- +- /* If the requestor didn't set the DO bit, don't return DNSSEC info. */ +- if (!do_bit) +- n = rrfilter(header, n, 1); ++ { ++ header->hb4 &= ~HB4_AD; ++ ++ if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure) ++ header->hb4 |= HB4_AD; ++ ++ /* If the requestor didn't set the DO bit, don't return DNSSEC info. */ ++ if (!do_bit) ++ n = rrfilter(header, n, 1); ++ } + #endif + + /* do this after extract_addresses. Ensure NODATA reply and remove +@@ -761,8 +788,14 @@ void reply_query(int fd, int family, time_t now) + if ((nn = resize_packet(header, (size_t)n, pheader, plen))) + { + header->hb3 &= ~(HB3_QR | HB3_AA | HB3_TC); +- header->hb4 &= ~(HB4_RA | HB4_RCODE); +- forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0); ++ header->hb4 &= ~(HB4_RA | HB4_RCODE | HB4_CD | HB4_AD); ++ if (forward->flags |= FREC_CHECKING_DISABLED) ++ header->hb4 |= HB4_CD; ++ if (forward->flags |= FREC_AD_QUESTION) ++ header->hb4 |= HB4_AD; ++ if (forward->flags & FREC_DO_QUESTION) ++ add_do_bit(header, nn, (char *)pheader + plen); ++ forward_query(-1, NULL, NULL, 0, header, nn, now, forward, forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION); + return; + } + } +@@ -1007,12 +1040,13 @@ void receive_query(struct listener *listen, time_t now) + { + struct dns_header *header = (struct dns_header *)daemon->packet; + union mysockaddr source_addr; +- unsigned short type; ++ unsigned char *pheader; ++ unsigned short type, udp_size = PACKETSZ; /* default if no EDNS0 */ + struct all_addr dst_addr; + struct in_addr netmask, dst_addr_4; + size_t m; + ssize_t n; +- int if_index = 0, auth_dns = 0; ++ int if_index = 0, auth_dns = 0, do_bit = 0, have_pseudoheader = 0; + #ifdef HAVE_AUTH + int local_auth = 0; + #endif +@@ -1279,10 +1313,30 @@ void receive_query(struct listener *listen, time_t now) + #endif + } + ++ if (find_pseudoheader(header, (size_t)n, NULL, &pheader, NULL)) ++ { ++ unsigned short flags; ++ ++ have_pseudoheader = 1; ++ GETSHORT(udp_size, pheader); ++ pheader += 2; /* ext_rcode */ ++ GETSHORT(flags, pheader); ++ ++ if (flags & 0x8000) ++ do_bit = 1;/* do bit */ ++ ++ /* If the client provides an EDNS0 UDP size, use that to limit our reply. ++ (bounded by the maximum configured). If no EDNS0, then it ++ defaults to 512 */ ++ if (udp_size > daemon->edns_pktsz) ++ udp_size = daemon->edns_pktsz; ++ } ++ + #ifdef HAVE_AUTH + if (auth_dns) + { +- m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth); ++ m = answer_auth(header, ((char *) header) + udp_size, (size_t)n, now, &source_addr, ++ local_auth, do_bit, have_pseudoheader); + if (m >= 1) + { + send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), +@@ -1293,9 +1347,13 @@ void receive_query(struct listener *listen, time_t now) + else + #endif + { +- int ad_reqd, do_bit; +- m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, +- dst_addr_4, netmask, now, &ad_reqd, &do_bit); ++ int ad_reqd = do_bit; ++ /* RFC 6840 5.7 */ ++ if (header->hb4 & HB4_AD) ++ ad_reqd = 1; ++ ++ m = answer_request(header, ((char *) header) + udp_size, (size_t)n, ++ dst_addr_4, netmask, now, ad_reqd, do_bit, have_pseudoheader); + + if (m >= 1) + { +@@ -1397,7 +1455,7 @@ unsigned char *tcp_request(int confd, time_t now, + #ifdef HAVE_AUTH + int local_auth = 0; + #endif +- int checking_disabled, ad_question, do_bit, added_pheader = 0; ++ int checking_disabled, do_bit, added_pheader = 0, have_pseudoheader = 0; + int check_subnet, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0; + size_t m; + unsigned short qtype; +@@ -1414,6 +1472,7 @@ unsigned char *tcp_request(int confd, time_t now, + union mysockaddr peer_addr; + socklen_t peer_len = sizeof(union mysockaddr); + int query_count = 0; ++ unsigned char *pheader; + + if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1) + return packet; +@@ -1508,15 +1567,35 @@ unsigned char *tcp_request(int confd, time_t now, + else + dst_addr_4.s_addr = 0; + ++ do_bit = 0; ++ ++ if (find_pseudoheader(header, (size_t)size, NULL, &pheader, NULL)) ++ { ++ unsigned short flags; ++ ++ have_pseudoheader = 1; ++ pheader += 4; /* udp_size, ext_rcode */ ++ GETSHORT(flags, pheader); ++ ++ if (flags & 0x8000) ++ do_bit = 1;/* do bit */ ++ } ++ + #ifdef HAVE_AUTH + if (auth_dns) +- m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth); ++ m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, ++ local_auth, do_bit, have_pseudoheader); + else + #endif + { +- /* m > 0 if answered from cache */ +- m = answer_request(header, ((char *) header) + 65536, (size_t)size, +- dst_addr_4, netmask, now, &ad_question, &do_bit); ++ int ad_reqd = do_bit; ++ /* RFC 6840 5.7 */ ++ if (header->hb4 & HB4_AD) ++ ad_reqd = 1; ++ ++ /* m > 0 if answered from cache */ ++ m = answer_request(header, ((char *) header) + 65536, (size_t)size, ++ dst_addr_4, netmask, now, ad_reqd, do_bit, have_pseudoheader); + + /* Do this by steam now we're not in the select() loop */ + check_log_writer(1); +@@ -1615,6 +1694,7 @@ unsigned char *tcp_request(int confd, time_t now, + } + + #ifdef HAVE_DNSSEC ++ added_pheader = 0; + if (option_bool(OPT_DNSSEC_VALID)) + { + size_t new_size = add_do_bit(header, size, ((char *) header) + 65536); +@@ -1719,7 +1799,7 @@ unsigned char *tcp_request(int confd, time_t now, + + m = process_reply(header, now, last_server, (unsigned int)m, + option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec, cache_secure, bogusanswer, +- ad_question, do_bit, added_pheader, check_subnet, &peer_addr); ++ ad_reqd, do_bit, added_pheader, check_subnet, &peer_addr); + + break; + } +diff --git a/src/netlink.c b/src/netlink.c +index 753784d..3376d68 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -288,7 +288,8 @@ int iface_enumerate(int family, void *parm, int (*callback)()) + rta = RTA_NEXT(rta, len1); + } + +- if (inaddr && mac && callback_ok) ++ if (!(neigh->ndm_state & (NUD_NOARP | NUD_INCOMPLETE | NUD_FAILED)) && ++ inaddr && mac && callback_ok) + if (!((*callback)(neigh->ndm_family, inaddr, mac, maclen, parm))) + callback_ok = 0; + } +diff --git a/src/rfc1035.c b/src/rfc1035.c +index 188d05f..18858a8 100644 +--- a/src/rfc1035.c ++++ b/src/rfc1035.c +@@ -489,8 +489,8 @@ struct macparm { + union mysockaddr *l3; + }; + +-static size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *limit, +- int optno, unsigned char *opt, size_t optlen, int set_do) ++size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *limit, ++ unsigned short udp_sz, int optno, unsigned char *opt, size_t optlen, int set_do) + { + unsigned char *lenp, *datap, *p; + int rdlen, is_sign; +@@ -508,7 +508,7 @@ static size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned + return plen; + *p++ = 0; /* empty name */ + PUTSHORT(T_OPT, p); +- PUTSHORT(SAFE_PKTSZ, p); /* max packet length, this will be overwritten */ ++ PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */ + PUTSHORT(0, p); /* extended RCODE and version */ + PUTSHORT(set_do ? 0x8000 : 0, p); /* DO flag */ + lenp = p; +@@ -594,7 +594,7 @@ static int filter_mac(int family, char *addrp, char *mac, size_t maclen, void *p + if (!match) + return 1; /* continue */ + +- parm->plen = add_pseudoheader(parm->header, parm->plen, parm->limit, EDNS0_OPTION_MAC, (unsigned char *)mac, maclen, 0); ++ parm->plen = add_pseudoheader(parm->header, parm->plen, parm->limit, PACKETSZ, EDNS0_OPTION_MAC, (unsigned char *)mac, maclen, 0); + + return 0; /* done */ + } +@@ -603,12 +603,6 @@ size_t add_mac(struct dns_header *header, size_t plen, char *limit, union mysock + { + struct macparm parm; + +-/* Must have an existing pseudoheader as the only ar-record, +- or have no ar-records. Must also not be signed */ +- +- if (ntohs(header->arcount) > 1) +- return plen; +- + parm.header = header; + parm.limit = (unsigned char *)limit; + parm.plen = plen; +@@ -699,13 +693,13 @@ size_t add_source_addr(struct dns_header *header, size_t plen, char *limit, unio + struct subnet_opt opt; + + len = calc_subnet_opt(&opt, source); +- return add_pseudoheader(header, plen, (unsigned char *)limit, EDNS0_OPTION_CLIENT_SUBNET, (unsigned char *)&opt, len, 0); ++ return add_pseudoheader(header, plen, (unsigned char *)limit, PACKETSZ, EDNS0_OPTION_CLIENT_SUBNET, (unsigned char *)&opt, len, 0); + } + + #ifdef HAVE_DNSSEC + size_t add_do_bit(struct dns_header *header, size_t plen, char *limit) + { +- return add_pseudoheader(header, plen, (unsigned char *)limit, 0, NULL, 0, 1); ++ return add_pseudoheader(header, plen, (unsigned char *)limit, PACKETSZ, 0, NULL, 0, 1); + } + #endif + +@@ -1525,16 +1519,16 @@ static unsigned long crec_ttl(struct crec *crecp, time_t now) + /* return zero if we can't answer from cache, or packet size if we can */ + size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + struct in_addr local_addr, struct in_addr local_netmask, +- time_t now, int *ad_reqd, int *do_bit) ++ time_t now, int ad_reqd, int do_bit, int have_pseudoheader) + { + char *name = daemon->namebuff; +- unsigned char *p, *ansp, *pheader; ++ unsigned char *p, *ansp; + unsigned int qtype, qclass; + struct all_addr addr; + int nameoffset; + unsigned short flag; + int q, ans, anscount = 0, addncount = 0; +- int dryrun = 0, sec_reqd = 0, have_pseudoheader = 0; ++ int dryrun = 0; + struct crec *crecp; + int nxdomain = 0, auth = 1, trunc = 0, sec_data = 1; + struct mx_srv_record *rec; +@@ -1550,35 +1544,11 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + if (header->hb4 & HB4_CD) + sec_data = 0; + +- /* RFC 6840 5.7 */ +- *ad_reqd = header->hb4 & HB4_AD; +- *do_bit = 0; +- + /* If there is an additional data section then it will be overwritten by + partial replies, so we have to do a dry run to see if we can answer + the query. */ +- + if (ntohs(header->arcount) != 0) +- { +- dryrun = 1; +- +- /* If there's an additional section, there might be an EDNS(0) pseudoheader */ +- if (find_pseudoheader(header, qlen, NULL, &pheader, NULL)) +- { +- unsigned short flags; +- +- have_pseudoheader = 1; +- +- pheader += 4; /* udp size, ext_rcode */ +- GETSHORT(flags, pheader); +- +- if ((sec_reqd = flags & 0x8000)) +- { +- *do_bit = 1;/* do bit */ +- *ad_reqd = 1; +- } +- } +- } ++ dryrun = 1; + + for (rec = daemon->mxnames; rec; rec = rec->next) + rec->offset = 0; +@@ -1603,11 +1573,6 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + GETSHORT(qtype, p); + GETSHORT(qclass, p); + +- /* Don't filter RRSIGS from answers to ANY queries, even if do-bit +- not set. */ +- if (qtype == T_ANY) +- *do_bit = 1; +- + ans = 0; /* have we answered this question */ + + if (qtype == T_TXT || qtype == T_ANY) +@@ -1739,7 +1704,7 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + the zone is unsigned, which implies that we're doing + validation. */ + if ((crecp->flags & (F_HOSTS | F_DHCP | F_CONFIG)) || +- !sec_reqd || ++ !do_bit || + (option_bool(OPT_DNSSEC_VALID) && !(crecp->flags & F_DNSSECOK))) + { + do +@@ -1927,7 +1892,7 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + } + + /* If the client asked for DNSSEC don't use cached data. */ +- if ((crecp->flags & (F_HOSTS | F_DHCP | F_CONFIG)) || !sec_reqd || !(crecp->flags & F_DNSSECOK)) ++ if ((crecp->flags & (F_HOSTS | F_DHCP | F_CONFIG)) || !do_bit || !(crecp->flags & F_DNSSECOK)) + do + { + /* don't answer wildcard queries with data not from /etc/hosts +@@ -1961,17 +1926,12 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + + if (crecp->flags & F_NEG) + { +- /* We don't cache NSEC records, so if a DNSSEC-validated negative answer +- is cached and the client wants DNSSEC, forward rather than answering from the cache */ +- if (!sec_reqd || !(crecp->flags & F_DNSSECOK)) +- { +- ans = 1; +- auth = 0; +- if (crecp->flags & F_NXDOMAIN) +- nxdomain = 1; +- if (!dryrun) +- log_query(crecp->flags, name, NULL, NULL); +- } ++ ans = 1; ++ auth = 0; ++ if (crecp->flags & F_NXDOMAIN) ++ nxdomain = 1; ++ if (!dryrun) ++ log_query(crecp->flags, name, NULL, NULL); + } + else + { +@@ -2209,10 +2169,11 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + + len = ansp - (unsigned char *)header; + ++ /* Advertise our packet size limit in our reply */ + if (have_pseudoheader) +- len = add_pseudoheader(header, len, (unsigned char *)limit, 0, NULL, 0, sec_reqd); ++ len = add_pseudoheader(header, len, (unsigned char *)limit, daemon->edns_pktsz, 0, NULL, 0, do_bit); + +- if (*ad_reqd && sec_data) ++ if (ad_reqd && sec_data) + header->hb4 |= HB4_AD; + else + header->hb4 &= ~HB4_AD; +diff --git a/src/rrfilter.c b/src/rrfilter.c +index ae12261..b26b39f 100644 +--- a/src/rrfilter.c ++++ b/src/rrfilter.c +@@ -243,7 +243,7 @@ size_t rrfilter(struct dns_header *header, size_t plen, int mode) + for (p = rrs[0], i = 1; i < rr_found; i += 2) + { + unsigned char *start = rrs[i]; +- unsigned char *end = (i != rr_found - 1) ? rrs[i+1] : ((unsigned char *)(header+1)) + plen; ++ unsigned char *end = (i != rr_found - 1) ? rrs[i+1] : ((unsigned char *)header) + plen; + + memmove(p, start, end-start); + p += end-start; +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/026-More_tweaks_in_handling_unknown_DNSSEC_algorithms.patch b/src/patches/dnsmasq/026-More_tweaks_in_handling_unknown_DNSSEC_algorithms.patch new file mode 100644 index 0000000..910921b --- /dev/null +++ b/src/patches/dnsmasq/026-More_tweaks_in_handling_unknown_DNSSEC_algorithms.patch @@ -0,0 +1,262 @@ +From d67ecac59d58f249707d26e38d49c29b552af4d8 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Sun, 20 Dec 2015 20:44:23 +0000 +Subject: [PATCH] More tweaks in handling unknown DNSSEC algorithms. + +--- + src/dnssec.c | 128 +++++++++++++++++++++++++++++----------------------------- + 1 file changed, 63 insertions(+), 65 deletions(-) + +diff --git a/src/dnssec.c b/src/dnssec.c +index 299ca64..e09f304 100644 +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -70,7 +70,17 @@ static char *algo_digest_name(int algo) + default: return NULL; + } + } +- ++ ++/* http://www.iana.org/assignments/dnssec-nsec3-parameters/dnssec-nsec3-parame… */ ++static char *nsec3_digest_name(int digest) ++{ ++ switch (digest) ++ { ++ case 1: return "sha1"; ++ default: return NULL; ++ } ++} ++ + /* Find pointer to correct hash function in nettle library */ + static const struct nettle_hash *hash_find(char *name) + { +@@ -667,7 +677,6 @@ static int explore_rrset(struct dns_header *header, size_t plen, int class, int + static int rrset_sz = 0, sig_sz = 0; + unsigned char *p; + int rrsetidx, sigidx, j, rdlen, res; +- int name_labels = count_labels(name); /* For 4035 5.3.2 check */ + int gotkey = 0; + + if (!(p = skip_questions(header, plen))) +@@ -678,7 +687,7 @@ static int explore_rrset(struct dns_header *header, size_t plen, int class, int + j != 0; j--) + { + unsigned char *pstart, *pdata; +- int stype, sclass, algo, type_covered, labels, sig_expiration, sig_inception; ++ int stype, sclass, type_covered; + + pstart = p; + +@@ -712,12 +721,7 @@ static int explore_rrset(struct dns_header *header, size_t plen, int class, int + return 0; /* bad packet */ + + GETSHORT(type_covered, p); +- algo = *p++; +- labels = *p++; +- p += 4; /* orig_ttl */ +- GETLONG(sig_expiration, p); +- GETLONG(sig_inception, p); +- p += 2; /* key_tag */ ++ p += 16; /* algo, labels, orig_ttl, sig_expiration, sig_inception, key_tag */ + + if (gotkey) + { +@@ -749,11 +753,8 @@ static int explore_rrset(struct dns_header *header, size_t plen, int class, int + } + } + +- /* Don't count signatures for algos we don't support */ +- if (check_date_range(sig_inception, sig_expiration) && +- labels <= name_labels && +- type_covered == type && +- verify_func(algo)) ++ ++ if (type_covered == type) + { + if (!expand_workspace(&sigs, &sig_sz, sigidx)) + return 0; +@@ -795,7 +796,7 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in + char *name, char *keyname, char **wildcard_out, struct blockdata *key, int keylen, int algo_in, int keytag_in) + { + unsigned char *p; +- int rdlen, j, name_labels; ++ int rdlen, j, name_labels, sig_expiration, sig_inception; + struct crec *crecp = NULL; + int algo, labels, orig_ttl, key_tag; + u16 *rr_desc = rrfilter_desc(type); +@@ -828,13 +829,16 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in + algo = *p++; + labels = *p++; + GETLONG(orig_ttl, p); +- p += 8; /* sig_expiration, sig_inception already checked */ ++ GETLONG(sig_expiration, p); ++ GETLONG(sig_inception, p); + GETSHORT(key_tag, p); + + if (!extract_name(header, plen, &p, keyname, 1, 0)) + return STAT_BOGUS; + +- if (!(hash = hash_find(algo_digest_name(algo))) || ++ if (!check_date_range(sig_inception, sig_expiration) || ++ labels > name_labels || ++ !(hash = hash_find(algo_digest_name(algo))) || + !hash_init(hash, &ctx, &digest)) + continue; + +@@ -1112,7 +1116,10 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch + else + { + a.addr.keytag = keytag; +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %u"); ++ if (verify_func(algo)) ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %u"); ++ else ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %u (not supported)"); + + recp1->addr.key.keylen = rdlen - 4; + recp1->addr.key.keydata = key; +@@ -1235,7 +1242,11 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char + else + { + a.addr.keytag = keytag; +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS keytag %u"); ++ if (hash_find(ds_digest_name(digest)) && verify_func(algo)) ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS keytag %u"); ++ else ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS keytag %u (not supported)"); ++ + crecp->addr.ds.digest = digest; + crecp->addr.ds.keydata = key; + crecp->addr.ds.algo = algo; +@@ -1660,7 +1671,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns + *nons = 1; + + /* Look though the NSEC3 records to find the first one with +- an algorithm we support (currently only algo == 1). ++ an algorithm we support. + + Take the algo, iterations, and salt of that record + as the ones we're going to use, and prune any +@@ -1674,7 +1685,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns + p += 10; /* type, class, TTL, rdlen */ + algo = *p++; + +- if (algo == 1) ++ if ((hash = hash_find(nsec3_digest_name(algo)))) + break; /* known algo */ + } + +@@ -1724,10 +1735,6 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns + nsecs[i] = nsec3p; + } + +- /* Algo is checked as 1 above */ +- if (!(hash = hash_find("sha1"))) +- return 0; +- + if ((digest_len = hash_name(name, &digest, hash, salt, salt_len, iterations)) == 0) + return 0; + +@@ -1843,8 +1850,10 @@ static int prove_non_existence(struct dns_header *header, size_t plen, char *key + + if (type_found == T_NSEC) + return prove_non_existence_nsec(header, plen, nsecset, nsecs_found, daemon->workspacename, keyname, name, qtype, nons); +- else ++ else if (type_found == T_NSEC3) + return prove_non_existence_nsec3(header, plen, nsecset, nsecs_found, daemon->workspacename, keyname, name, qtype, wildname, nons); ++ else ++ return 0; + } + + /* Check signing status of name. +@@ -1857,7 +1866,7 @@ static int prove_non_existence(struct dns_header *header, size_t plen, char *key + */ + static int zone_status(char *name, int class, char *keyname, time_t now) + { +- int secure_ds, name_start = strlen(name); ++ int name_start = strlen(name); + struct crec *crecp; + char *p; + +@@ -1867,51 +1876,40 @@ static int zone_status(char *name, int class, char *keyname, time_t now) + + if (!(crecp = cache_find_by_name(NULL, keyname, now, F_DS))) + return STAT_NEED_DS; ++ ++ /* F_DNSSECOK misused in DS cache records to non-existance of NS record. ++ F_NEG && !F_DNSSECOK implies that we've proved there's no DS record here, ++ but that's because there's no NS record either, ie this isn't the start ++ of a zone. We only prove that the DNS tree below a node is unsigned when ++ we prove that we're at a zone cut AND there's no DS record. */ ++ if (crecp->flags & F_NEG) ++ { ++ if (crecp->flags & F_DNSSECOK) ++ return STAT_INSECURE; /* proved no DS here */ ++ } + else + { +- secure_ds = 0; +- ++ int gotone = 0; ++ ++ /* If all the DS records have digest and/or sig algos we don't support, ++ then the zone is insecure. Note that if an algo ++ appears in the DS, then RRSIGs for that algo MUST ++ exist for each RRset: 4035 para 2.2 So if we find ++ a DS here with digest and sig we can do, we're entitled ++ to assume we can validate the zone and if we can't later, ++ because an RRSIG is missing we return BOGUS. ++ */ + do + { +- if (crecp->uid == (unsigned int)class) +- { +- /* F_DNSSECOK misused in DS cache records to non-existance of NS record. +- F_NEG && !F_DNSSECOK implies that we've proved there's no DS record here, +- but that's because there's no NS record either, ie this isn't the start +- of a zone. We only prove that the DNS tree below a node is unsigned when +- we prove that we're at a zone cut AND there's no DS record. +- */ +- if (crecp->flags & F_NEG) +- { +- if (crecp->flags & F_DNSSECOK) +- return STAT_INSECURE; /* proved no DS here */ +- } +- else if (!hash_find(ds_digest_name(crecp->addr.ds.digest)) || !verify_func(crecp->addr.ds.algo)) +- return STAT_INSECURE; /* algo we can't use - insecure */ +- else +- secure_ds = 1; +- } ++ if (crecp->uid == (unsigned int)class && ++ hash_find(ds_digest_name(crecp->addr.ds.digest)) && ++ verify_func(crecp->addr.ds.algo)) ++ gotone = 1; + } + while ((crecp = cache_find_by_name(crecp, keyname, now, F_DS))); +- } +- +- if (secure_ds) +- { +- /* We've found only DS records that attest to the DNSKEY RRset in the zone, so we believe +- that RRset is good. Furthermore the DNSKEY whose hash is proved by the DS record is +- one we can use. However the DNSKEY RRset may contain more than one key and +- one of the other keys may use an algorithm we don't support. If that's +- the case the zone is insecure for us. */ +- +- if (!(crecp = cache_find_by_name(NULL, keyname, now, F_DNSKEY))) +- return STAT_NEED_KEY; + +- do +- { +- if (crecp->uid == (unsigned int)class && !verify_func(crecp->addr.key.algo)) +- return STAT_INSECURE; +- } +- while ((crecp = cache_find_by_name(crecp, keyname, now, F_DNSKEY))); ++ if (!gotone) ++ return STAT_INSECURE; + } + + if (name_start == 0) +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/027-Nasty_rare_and_obscure_off-by-one_in_DNSSEC_hostname_cmp.patch b/src/patches/dnsmasq/027-Nasty_rare_and_obscure_off-by-one_in_DNSSEC_hostname_cmp.patch new file mode 100644 index 0000000..031339e --- /dev/null +++ b/src/patches/dnsmasq/027-Nasty_rare_and_obscure_off-by-one_in_DNSSEC_hostname_cmp.patch @@ -0,0 +1,27 @@ +From 3e86d316c4bb406ed813aa5256615c8a95cac6d8 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Sun, 20 Dec 2015 20:50:05 +0000 +Subject: [PATCH] Nasty, rare and obscure off-by-one in DNSSEC hostname_cmp(). + +--- + src/dnssec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/dnssec.c b/src/dnssec.c +index e09f304..29848e1 100644 +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -1394,8 +1394,8 @@ static int hostname_cmp(const char *a, const char *b) + if (sb == b) + return 1; + +- ea = sa--; +- eb = sb--; ++ ea = --sa; ++ eb = --sb; + } + } + +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/028-Minor_tweak_to_previous_commit.patch b/src/patches/dnsmasq/028-Minor_tweak_to_previous_commit.patch new file mode 100644 index 0000000..f3758fc --- /dev/null +++ b/src/patches/dnsmasq/028-Minor_tweak_to_previous_commit.patch @@ -0,0 +1,39 @@ +From a86fdf437ecc29398f9715ceb5240442a17ac014 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Sun, 20 Dec 2015 21:19:20 +0000 +Subject: [PATCH] Minor tweak to previous commit. + +--- + src/dnssec.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/src/dnssec.c b/src/dnssec.c +index 29848e1..9fa64b6 100644 +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -1889,8 +1889,6 @@ static int zone_status(char *name, int class, char *keyname, time_t now) + } + else + { +- int gotone = 0; +- + /* If all the DS records have digest and/or sig algos we don't support, + then the zone is insecure. Note that if an algo + appears in the DS, then RRSIGs for that algo MUST +@@ -1904,11 +1902,11 @@ static int zone_status(char *name, int class, char *keyname, time_t now) + if (crecp->uid == (unsigned int)class && + hash_find(ds_digest_name(crecp->addr.ds.digest)) && + verify_func(crecp->addr.ds.algo)) +- gotone = 1; ++ break; + } + while ((crecp = cache_find_by_name(crecp, keyname, now, F_DS))); + +- if (!gotone) ++ if (!crecp) + return STAT_INSECURE; + } + +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/029-NSEC3_check_RFC5155_para_8_2.patch b/src/patches/dnsmasq/029-NSEC3_check_RFC5155_para_8_2.patch new file mode 100644 index 0000000..33219d2 --- /dev/null +++ b/src/patches/dnsmasq/029-NSEC3_check_RFC5155_para_8_2.patch @@ -0,0 +1,39 @@ +From ce5732e84fc46d7f99c152f736cfb4ef5ec98a01 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Sun, 20 Dec 2015 21:39:19 +0000 +Subject: [PATCH] NSEC3 check: RFC5155 para 8.2 + +--- + src/dnssec.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/dnssec.c b/src/dnssec.c +index 9fa64b6..486e422 100644 +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -1704,7 +1704,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns + for (i = 0; i < nsec_count; i++) + { + unsigned char *nsec3p = nsecs[i]; +- int this_iter; ++ int this_iter, flags; + + nsecs[i] = NULL; /* Speculative, will be restored if OK. */ + +@@ -1716,8 +1716,12 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns + if (*p++ != algo) + continue; + +- p++; /* flags */ ++ flags = *p++; /* flags */ + ++ /* 5155 8.2 */ ++ if (flags != 0 && flags != 1) ++ continue; ++ + GETSHORT(this_iter, p); + if (this_iter != iterations) + continue; +-- +1.7.10.4 + hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 4df3276bb43bfb77e570b8c329da3885f644dabb
by git＠ipfire.org 26 Dec '15

26 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 4df3276bb43bfb77e570b8c329da3885f644dabb (commit) via b94e0ffc689e6a659809fb874b6c18053faf1f48 (commit) via b37e91c3b5527527ae354e66d91f6912e6e534de (commit) from eddda7f9bd4489e6c5e37bf88eac83196210616b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4df3276bb43bfb77e570b8c329da3885f644dabb Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Dec 26 17:37:53 2015 +0100 ncurses: rootfile update. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit b94e0ffc689e6a659809fb874b6c18053faf1f48 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Dec 26 17:34:13 2015 +0100 dnsdist: rootfile update. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit b37e91c3b5527527ae354e66d91f6912e6e534de Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Dec 26 17:33:30 2015 +0100 diffutils: rootfile update. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/armv5tel/initscripts | 1 + config/rootfiles/common/diffutils | 2 ++ config/rootfiles/common/i586/initscripts | 1 + config/rootfiles/common/ncurses | 3 +++ config/rootfiles/common/x86_64/initscripts | 1 + config/rootfiles/packages/dnsdist | 1 + 6 files changed, 9 insertions(+) Difference in files: diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts index a2a2ea0..e6d328b 100644 --- a/config/rootfiles/common/armv5tel/initscripts +++ b/config/rootfiles/common/armv5tel/initscripts @@ -25,6 +25,7 @@ etc/rc.d/init.d/console #etc/rc.d/init.d/cyrus-sasl etc/rc.d/init.d/dhcp etc/rc.d/init.d/dhcrelay +#etc/rc.d/init.d/dnsdist etc/rc.d/init.d/dnsmasq etc/rc.d/init.d/fcron #etc/rc.d/init.d/fetchmail diff --git a/config/rootfiles/common/diffutils b/config/rootfiles/common/diffutils index 9fe53d1..b00abdb 100644 --- a/config/rootfiles/common/diffutils +++ b/config/rootfiles/common/diffutils @@ -2,7 +2,9 @@ usr/bin/cmp usr/bin/diff #usr/bin/diff3 #usr/bin/sdiff +#usr/info #usr/info/diff.info +#usr/info/dir #usr/man/man1/cmp.1 #usr/man/man1/diff.1 #usr/man/man1/diff3.1 diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts index aabc8a6..80ae0dd 100644 --- a/config/rootfiles/common/i586/initscripts +++ b/config/rootfiles/common/i586/initscripts @@ -27,6 +27,7 @@ etc/rc.d/init.d/console #etc/rc.d/init.d/cyrus-sasl etc/rc.d/init.d/dhcp etc/rc.d/init.d/dhcrelay +#etc/rc.d/init.d/dnsdist etc/rc.d/init.d/dnsmasq etc/rc.d/init.d/fcron #etc/rc.d/init.d/fetchmail diff --git a/config/rootfiles/common/ncurses b/config/rootfiles/common/ncurses index 46b3bd9..da434e9 100644 --- a/config/rootfiles/common/ncurses +++ b/config/rootfiles/common/ncurses @@ -77,6 +77,8 @@ usr/lib/libtic.so.5.9 usr/lib/libtinfo.so.5 usr/lib/libtinfo.so.5.9 #usr/lib/terminfo +#usr/man +#usr/man/man1 #usr/man/man1/captoinfo.1m #usr/man/man1/clear.1 #usr/man/man1/infocmp.1m @@ -941,6 +943,7 @@ usr/lib/libtinfo.so.5.9 #usr/man/man5 #usr/man/man5/term.5 #usr/man/man5/terminfo.5 +#usr/man/man7 #usr/man/man7/term.7 #usr/share/tabset #usr/share/tabset/std diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index aabc8a6..80ae0dd 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -27,6 +27,7 @@ etc/rc.d/init.d/console #etc/rc.d/init.d/cyrus-sasl etc/rc.d/init.d/dhcp etc/rc.d/init.d/dhcrelay +#etc/rc.d/init.d/dnsdist etc/rc.d/init.d/dnsmasq etc/rc.d/init.d/fcron #etc/rc.d/init.d/fetchmail diff --git a/config/rootfiles/packages/dnsdist b/config/rootfiles/packages/dnsdist index 8b1e15d..ba7381f 100644 --- a/config/rootfiles/packages/dnsdist +++ b/config/rootfiles/packages/dnsdist @@ -1,2 +1,3 @@ usr/bin/dnsdist #usr/share/man/man1/dnsdist.1 +etc/rc.d/init.d/dnsdist hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. eddda7f9bd4489e6c5e37bf88eac83196210616b
by git＠ipfire.org 26 Dec '15

26 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via eddda7f9bd4489e6c5e37bf88eac83196210616b (commit) from f25314afd71657a51e1dc02759edaf99c22bb270 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit eddda7f9bd4489e6c5e37bf88eac83196210616b Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Dec 26 13:16:59 2015 +0100 gcc: include libstdc++ to rootfile Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/armv5tel/gcc | 2 +- config/rootfiles/common/i586/gcc | 2 +- config/rootfiles/common/x86_64/gcc | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) Difference in files: diff --git a/config/rootfiles/common/armv5tel/gcc b/config/rootfiles/common/armv5tel/gcc index 60300b1..121ac17 100644 --- a/config/rootfiles/common/armv5tel/gcc +++ b/config/rootfiles/common/armv5tel/gcc @@ -1058,7 +1058,7 @@ usr/lib/libssp.so.0.0.0 #usr/lib/libssp_nonshared.a #usr/lib/libssp_nonshared.la #usr/lib/libstdc++.a -#usr/lib/libstdc++.so.6.0.20 +usr/lib/libstdc++.so.6.0.20 #usr/lib/libstdc++.so.6.0.20-gdb.py #usr/lib/libsupc++.a #usr/lib/libsupc++.la diff --git a/config/rootfiles/common/i586/gcc b/config/rootfiles/common/i586/gcc index a055ec6..0e4b5c7 100644 --- a/config/rootfiles/common/i586/gcc +++ b/config/rootfiles/common/i586/gcc @@ -1136,7 +1136,7 @@ usr/lib/libssp.so.0.0.0 #usr/lib/libssp_nonshared.a #usr/lib/libssp_nonshared.la #usr/lib/libstdc++.a -#usr/lib/libstdc++.so.6.0.20 +usr/lib/libstdc++.so.6.0.20 #usr/lib/libstdc++.so.6.0.20-gdb.py #usr/lib/libsupc++.a #usr/lib/libsupc++.la diff --git a/config/rootfiles/common/x86_64/gcc b/config/rootfiles/common/x86_64/gcc index ae541a3..e378d93 100644 --- a/config/rootfiles/common/x86_64/gcc +++ b/config/rootfiles/common/x86_64/gcc @@ -1143,7 +1143,7 @@ usr/lib/libquadmath.so.0.0.0 #usr/lib/libssp_nonshared.a #usr/lib/libssp_nonshared.la #usr/lib/libstdc++.a -#usr/lib/libstdc++.so.6.0.20 +usr/lib/libstdc++.so.6.0.20 #usr/lib/libstdc++.so.6.0.20-gdb.py #usr/lib/libsupc++.a #usr/lib/libsupc++.la hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f25314afd71657a51e1dc02759edaf99c22bb270
by git＠ipfire.org 25 Dec '15

25 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f25314afd71657a51e1dc02759edaf99c22bb270 (commit) from aa6684235847375033842ab4ed99e22bcd9a13c2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f25314afd71657a51e1dc02759edaf99c22bb270 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Dec 25 12:45:05 2015 +0100 vdr_eepg: fix source download. the external server has changed the compression so the md5 has changed. Always use the IPFire server as primary download source. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/vdr_eepg | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) Difference in files: diff --git a/lfs/vdr_eepg b/lfs/vdr_eepg index fddd075..3a91256 100644 --- a/lfs/vdr_eepg +++ b/lfs/vdr_eepg @@ -29,7 +29,9 @@ VER = master THISAPP = vdr-plugin-eepg-$(VER) DL_FILE = vdr-plugin-eepg-$(GIT_VER).tar.bz2 -DL_FROM = http://projects.vdr-developer.org/git/vdr-plugin-eepg.git/snapshot +# SOURCE http://projects.vdr-developer.org/git/vdr-plugin-eepg.git/snapshot + +DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = vdr_eepg hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. c26171b4b4d6606e2e64bb9c4de36223fea0924d
by git＠ipfire.org 23 Dec '15

23 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via c26171b4b4d6606e2e64bb9c4de36223fea0924d (commit) from 32dd84e81722dfb6b3053b9643deef1e6113e68f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c26171b4b4d6606e2e64bb9c4de36223fea0924d Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Dec 23 11:32:53 2015 +0100 core96: remove rrd ramdisk entry from fstab ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/96/update.sh | 3 +++ 1 file changed, 3 insertions(+) Difference in files: diff --git a/config/rootfiles/core/96/update.sh b/config/rootfiles/core/96/update.sh index 6672364..fa53cea 100644 --- a/config/rootfiles/core/96/update.sh +++ b/config/rootfiles/core/96/update.sh @@ -58,6 +58,9 @@ extract_files # Update Language cache /usr/local/bin/update-lang-cache +# Remove Ramdisk entry from fstab +sed -i -e "s|^none\s/var/log/rrd.*||g" /etc/fstab + # Keep (almost) old ramdisk behaviour if [ ! -e "/etc/sysconfig/ramdisk" ]; then echo "RAMDISK_MODE=2" > /etc/sysconfig/ramdisk hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core96, updated. c26171b4b4d6606e2e64bb9c4de36223fea0924d
by git＠ipfire.org 23 Dec '15

23 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core96 has been updated via c26171b4b4d6606e2e64bb9c4de36223fea0924d (commit) from 32dd84e81722dfb6b3053b9643deef1e6113e68f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c26171b4b4d6606e2e64bb9c4de36223fea0924d Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Dec 23 11:32:53 2015 +0100 core96: remove rrd ramdisk entry from fstab ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/96/update.sh | 3 +++ 1 file changed, 3 insertions(+) Difference in files: diff --git a/config/rootfiles/core/96/update.sh b/config/rootfiles/core/96/update.sh index 6672364..fa53cea 100644 --- a/config/rootfiles/core/96/update.sh +++ b/config/rootfiles/core/96/update.sh @@ -58,6 +58,9 @@ extract_files # Update Language cache /usr/local/bin/update-lang-cache +# Remove Ramdisk entry from fstab +sed -i -e "s|^none\s/var/log/rrd.*||g" /etc/fstab + # Keep (almost) old ramdisk behaviour if [ ! -e "/etc/sysconfig/ramdisk" ]; then echo "RAMDISK_MODE=2" > /etc/sysconfig/ramdisk hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. aa6684235847375033842ab4ed99e22bcd9a13c2
by git＠ipfire.org 23 Dec '15

23 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via aa6684235847375033842ab4ed99e22bcd9a13c2 (commit) from 98b8cabf4d80909b636e56a59091665798043f61 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit aa6684235847375033842ab4ed99e22bcd9a13c2 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Dec 23 10:14:26 2015 +0100 kernel: apply arm-multi grsecurity fixes only at arm-multi build ----------------------------------------------------------------------- Summary of changes: lfs/linux | 6 +----- ...rsec-compile-fixes.patch => arm-multi-grsec-compile-fixes.patch} | 0 2 files changed, 1 insertion(+), 5 deletions(-) rename src/patches/{kernel-grsec-compile-fixes.patch => arm-multi-grsec-compile-fixes.patch} (100%) Difference in files: diff --git a/lfs/linux b/lfs/linux index 2f76209..1a0ae10 100644 --- a/lfs/linux +++ b/lfs/linux @@ -186,6 +186,7 @@ ifeq "$(KCFG)" "-multi" # Apply Arm7-multiarch kernel patches. cd $(DIR_APP) && xzcat $(DIR_DL)/arm7-multi-patches-$(A7M_PATCHES).patch.xz | patch -Np1 + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/arm-multi-grsec-compile-fixes.patch # Install switch api userspace header cd $(DIR_APP) && install -v -m644 include/uapi/linux/switch.h /usr/include/linux/ @@ -197,11 +198,6 @@ ifeq "$(KCFG)" "-rpi" cd $(DIR_APP) && xzcat $(DIR_DL)/rpi-patches-$(RPI_PATCHES).patch.xz | patch -Np1 endif - # Compile fixes -ifeq "$(KCFG)" "-headers" - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/kernel-grsec-compile-fixes.patch -endif - ifeq "$(KCFG)" "-headers" # Install the header files cd $(DIR_APP) && make ARCH=$(HEADERS_ARCH) INSTALL_HDR_PATH=dest headers_install diff --git a/src/patches/arm-multi-grsec-compile-fixes.patch b/src/patches/arm-multi-grsec-compile-fixes.patch new file mode 100644 index 0000000..530d69e --- /dev/null +++ b/src/patches/arm-multi-grsec-compile-fixes.patch @@ -0,0 +1,11 @@ +--- a/arch/arm/mach-omap2/cclock3xxx_data.c~ 2015-12-12 11:00:10.474423373 +0000 ++++ b/arch/arm/mach-omap2/cclock3xxx_data.c 2015-12-12 11:30:31.198452547 +0000 +@@ -250,7 +250,7 @@ + + static struct clk dpll1_ck; + +-static struct clk_ops dpll1_ck_ops; ++static clk_ops_no_const dpll1_ck_ops; + + static struct clk_ops dpll1_ck_ops_34xx __initdata = { + .init = &omap2_init_clk_clkdm, diff --git a/src/patches/kernel-grsec-compile-fixes.patch b/src/patches/kernel-grsec-compile-fixes.patch deleted file mode 100644 index 530d69e..0000000 --- a/src/patches/kernel-grsec-compile-fixes.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/arch/arm/mach-omap2/cclock3xxx_data.c~ 2015-12-12 11:00:10.474423373 +0000 -+++ b/arch/arm/mach-omap2/cclock3xxx_data.c 2015-12-12 11:30:31.198452547 +0000 -@@ -250,7 +250,7 @@ - - static struct clk dpll1_ck; - --static struct clk_ops dpll1_ck_ops; -+static clk_ops_no_const dpll1_ck_ops; - - static struct clk_ops dpll1_ck_ops_34xx __initdata = { - .init = &omap2_init_clk_clkdm, hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 98b8cabf4d80909b636e56a59091665798043f61
by git＠ipfire.org 22 Dec '15

22 Dec '15

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core96, updated. 32dd84e81722dfb6b3053b9643deef1e6113e68f
by git＠ipfire.org 22 Dec '15

22 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core96 has been updated via 32dd84e81722dfb6b3053b9643deef1e6113e68f (commit) via 1a781c8a29b2a8e758ec556d4e6f845b6db78dff (commit) via ff441e4d3fb96d71b4d547fb7b4ab65ef18a51bd (commit) from df00a3f1cd6a23ef48c80e431b8e472a4a340e5b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 32dd84e81722dfb6b3053b9643deef1e6113e68f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 22 15:10:31 2015 +0000 core96: Regenerate language cache Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 1a781c8a29b2a8e758ec556d4e6f845b6db78dff Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 22 10:27:26 2015 +0000 core96: Correctly call qosctrl Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ff441e4d3fb96d71b4d547fb7b4ab65ef18a51bd Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 22 10:26:27 2015 +0000 core96: Fix deleting the old ramdisk directory Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/96/update.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) Difference in files: diff --git a/config/rootfiles/core/96/update.sh b/config/rootfiles/core/96/update.sh index a3cf5cf..6672364 100644 --- a/config/rootfiles/core/96/update.sh +++ b/config/rootfiles/core/96/update.sh @@ -34,13 +34,13 @@ done # Stop services /etc/init.d/fcron stop /etc/init.d/collectd stop -qosctrl stop +/usr/local/bin/qosctrl stop # Backup RRDs if [ -d "/var/log/rrd.bak" ]; then # Umount ramdisk umount -l "/var/log/rrd" - rm -f "/var/log/rrd" + rm -rf "/var/log/rrd" mv "/var/log/rrd.bak/vnstat" "/var/log/vnstat" mv "/var/log/rrd.bak" "/var/log/rrd" @@ -56,7 +56,7 @@ rm -f /etc/rc.d/init.d/tmpfs \ extract_files # Update Language cache -# /usr/local/bin/update-lang-cache +/usr/local/bin/update-lang-cache # Keep (almost) old ramdisk behaviour if [ ! -e "/etc/sysconfig/ramdisk" ]; then @@ -83,7 +83,7 @@ fi /etc/init.d/vnstat start /etc/init.d/fcron start /etc/init.d/dnsmasq restart -qosctrl start +/usr/local/bin/qosctrl start # Disable loading of cryptodev sed -e "s/^cryptodev/# &/g" -i /etc/sysconfig/modules hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 32dd84e81722dfb6b3053b9643deef1e6113e68f
by git＠ipfire.org 22 Dec '15

22 Dec '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 32dd84e81722dfb6b3053b9643deef1e6113e68f (commit) from 1a781c8a29b2a8e758ec556d4e6f845b6db78dff (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 32dd84e81722dfb6b3053b9643deef1e6113e68f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 22 15:10:31 2015 +0000 core96: Regenerate language cache Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/96/update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/config/rootfiles/core/96/update.sh b/config/rootfiles/core/96/update.sh index acd8b0c..6672364 100644 --- a/config/rootfiles/core/96/update.sh +++ b/config/rootfiles/core/96/update.sh @@ -56,7 +56,7 @@ rm -f /etc/rc.d/init.d/tmpfs \ extract_files # Update Language cache -# /usr/local/bin/update-lang-cache +/usr/local/bin/update-lang-cache # Keep (almost) old ramdisk behaviour if [ ! -e "/etc/sysconfig/ramdisk" ]; then hooks/post-receive -- IPFire 2.x development tree

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM December 2015