IPFire-SCM October 2021

ipfire-scm@lists.ipfire.org

1 participants
38 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 832490f063f81a54ecb470caaa3fab8c3f73c12e
by Arne Fitzenreiter 27 Oct '21

27 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 832490f063f81a54ecb470caaa3fab8c3f73c12e (commit) from a7b4f847119660fd58a0da2652d56d5ffeff5e69 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 832490f063f81a54ecb470caaa3fab8c3f73c12e Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Oct 28 00:39:07 2021 +0200 kernel: update to 5.10.76 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.armv6l-ipfire | 14 +++----------- config/kernel/kernel.config.i586-ipfire | 3 +-- config/kernel/kernel.config.x86_64-ipfire | 3 +-- lfs/linux | 6 +++--- 5 files changed, 9 insertions(+), 19 deletions(-) Difference in files: diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 506a10f4f..dd06fc15d 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 5.10.71-ipfire Kernel Configuration +# Linux/arm64 5.10.76-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.1.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index 77a4b8661..29c77b2a2 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.10.55-ipfire Kernel Configuration +# Linux/arm 5.10.76-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.1.0" CONFIG_CC_IS_GCC=y @@ -196,6 +196,7 @@ CONFIG_ELF_CORE=y CONFIG_BASE_FULL=y CONFIG_FUTEX=y CONFIG_FUTEX_PI=y +CONFIG_HAVE_FUTEX_CMPXCHG=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y @@ -635,7 +636,6 @@ CONFIG_CMDLINE="console=ttyAM0,115200 root=/dev/sda1 rootdelay=20" CONFIG_CMDLINE_FROM_BOOTLOADER=y # CONFIG_CMDLINE_EXTEND is not set # CONFIG_CMDLINE_FORCE is not set -# CONFIG_KEXEC is not set CONFIG_CRASH_DUMP=y CONFIG_AUTO_ZRELADDR=y # CONFIG_EFI is not set @@ -705,19 +705,13 @@ CONFIG_NEON=y # # CONFIG_SUSPEND is not set # CONFIG_HIBERNATION is not set -CONFIG_PM_SLEEP=y -CONFIG_PM_SLEEP_SMP=y -# CONFIG_PM_AUTOSLEEP is not set -# CONFIG_PM_WAKELOCKS is not set CONFIG_PM=y # CONFIG_PM_DEBUG is not set CONFIG_APM_EMULATION=y CONFIG_PM_CLK=y CONFIG_PM_GENERIC_DOMAINS=y # CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set -CONFIG_PM_GENERIC_DOMAINS_SLEEP=y CONFIG_PM_GENERIC_DOMAINS_OF=y -CONFIG_CPU_PM=y # CONFIG_ENERGY_MODEL is not set CONFIG_ARCH_SUSPEND_POSSIBLE=y CONFIG_ARM_CPU_SUSPEND=y @@ -1824,7 +1818,6 @@ CONFIG_EXTRA_FIRMWARE="" CONFIG_FW_LOADER_USER_HELPER=y # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set # CONFIG_FW_LOADER_COMPRESS is not set -CONFIG_FW_CACHE=y # end of Firmware loader CONFIG_WANT_DEV_COREDUMP=y @@ -3339,7 +3332,6 @@ CONFIG_TTY=y CONFIG_VT=y CONFIG_CONSOLE_TRANSLATIONS=y CONFIG_VT_CONSOLE=y -CONFIG_VT_CONSOLE_SLEEP=y CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y @@ -6631,6 +6623,7 @@ CONFIG_STAGING=y CONFIG_LTE_GDM724X=m # CONFIG_GS_FPGABOOT is not set # CONFIG_UNISYSSPAR is not set +# CONFIG_COMMON_CLK_XLNX_CLKWZRD is not set # CONFIG_KS7010 is not set CONFIG_BCM_VIDEOCORE=m CONFIG_BCM2835_VCHIQ=m @@ -6854,7 +6847,6 @@ CONFIG_RASPBERRYPI_POWER=y # NXP/Freescale QorIQ SoC drivers # # CONFIG_QUICC_ENGINE is not set -# CONFIG_FSL_RCPM is not set # end of NXP/Freescale QorIQ SoC drivers # diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index b1588dcbf..6ddf536d3 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 5.10.74-ipfire Kernel Configuration +# Linux/x86 5.10.76-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.1.0" CONFIG_CC_IS_GCC=y @@ -5128,7 +5128,6 @@ CONFIG_DRM_AMD_DC=y CONFIG_DRM_AMD_DC_DCN=y CONFIG_DRM_AMD_DC_DCN3_0=y CONFIG_DRM_AMD_DC_HDCP=y -# CONFIG_DRM_AMD_DC_SI is not set # end of Display Engine Configuration CONFIG_DRM_NOUVEAU=m diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6883ccb9f..f27020e62 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 5.10.75-ipfire Kernel Configuration +# Linux/x86 5.10.76-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.1.0" CONFIG_CC_IS_GCC=y @@ -4994,7 +4994,6 @@ CONFIG_DRM_AMD_DC=y CONFIG_DRM_AMD_DC_DCN=y # CONFIG_DRM_AMD_DC_DCN3_0 is not set # CONFIG_DRM_AMD_DC_HDCP is not set -# CONFIG_DRM_AMD_DC_SI is not set # end of Display Engine Configuration # CONFIG_HSA_AMD is not set diff --git a/lfs/linux b/lfs/linux index 04386457f..37271bc8f 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,8 +24,8 @@ include Config -VER = 5.10.75 -ARM_PATCHES = 5.10.75-ipfire1 +VER = 5.10.76 +ARM_PATCHES = 5.10.76-ipfire1 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.xz @@ -77,7 +77,7 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_MD5 = 7880cf2e28a800403c1f25bf93a27210 +$(DL_FILE)_MD5 = 6d9d29908d48ffee0daab4f6f8d98a65 arm-multi-patches-$(ARM_PATCHES).patch.xz_MD5 = 02a75302a5b4a157e3d67ae62af6b178 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a7b4f847119660fd58a0da2652d56d5ffeff5e69
by Arne Fitzenreiter 25 Oct '21

25 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a7b4f847119660fd58a0da2652d56d5ffeff5e69 (commit) via 95539a589e51dc2b0793ae58c1cd35f5fe858320 (commit) via 642318cbaaea173d50315e8cbe3720ea1e79bb05 (commit) via 9d72f4b05932ef53f95b621ea9a40cfd7255cee7 (commit) from b88f6c476b45c173db54ce31d59dc42202c56e34 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a7b4f847119660fd58a0da2652d56d5ffeff5e69 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 16:59:08 2021 +0000 general-functions: remove comment that system_output also in speed.cgi this functions was removed from speed.cgi by reading kernel netowrk statistics instead of parsing ip -s show ... Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 95539a589e51dc2b0793ae58c1cd35f5fe858320 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Oct 23 14:44:56 2021 +0200 Remove orphaned ddns patches These are no longer necessary, since ddns 0.14 comes with both of them applied. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 642318cbaaea173d50315e8cbe3720ea1e79bb05 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Sat Oct 23 18:49:01 2021 +0200 git: Update to version 2.33.1 - Update from 2.31.0 to 2.33.1 - Update rootfile - Changelog is too long to show here. The details can be found in the 2.31.1.txt, 2.32.0.txt, 2.33.0.txt and 2.33.1.txt files in the Documentation/RelNotes directory in the source tarball Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 9d72f4b05932ef53f95b621ea9a40cfd7255cee7 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Sat Oct 23 18:49:32 2021 +0200 htop: Update to version 3.1.1 - Update from 3.0.5 to 3.1.1 - Update of rootfile not required - Changelog is too long to include here. Full details can be found at https://github.com/htop-dev/htop/blob/main/ChangeLog Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/general-functions.pl | 1 - config/rootfiles/packages/git | 1 + lfs/git | 6 ++--- lfs/htop | 7 ++--- ...11-ddnss-fix-unhandled-exeption-on-update-patch | 30 ---------------------- ...13-ddnss-fix-unhandled-exeption-on-update-patch | 30 ---------------------- 6 files changed, 8 insertions(+), 67 deletions(-) delete mode 100644 src/patches/ddns-011-ddnss-fix-unhandled-exeption-on-update-patch delete mode 100644 src/patches/ddns-013-ddnss-fix-unhandled-exeption-on-update-patch Difference in files: diff --git a/config/cfgroot/general-functions.pl b/config/cfgroot/general-functions.pl index c10a04faa..2f26ca12f 100644 --- a/config/cfgroot/general-functions.pl +++ b/config/cfgroot/general-functions.pl @@ -53,7 +53,6 @@ sub system_background($) { } # Returns the output of a shell command -# if you change this also check speed.cgi that include a local copy for systemload reasons sub system_output($) { my @command = @_; my $pid; diff --git a/config/rootfiles/packages/git b/config/rootfiles/packages/git index 508e87f70..67e2015bc 100644 --- a/config/rootfiles/packages/git +++ b/config/rootfiles/packages/git @@ -26,6 +26,7 @@ usr/libexec/git-core/git-check-ignore usr/libexec/git-core/git-check-mailmap usr/libexec/git-core/git-check-ref-format usr/libexec/git-core/git-checkout +usr/libexec/git-core/git-checkout--worker usr/libexec/git-core/git-checkout-index usr/libexec/git-core/git-cherry usr/libexec/git-core/git-cherry-pick diff --git a/lfs/git b/lfs/git index 2290c6e99..59610a6a1 100644 --- a/lfs/git +++ b/lfs/git @@ -24,7 +24,7 @@ include Config -VER = 2.31.0 +VER = 2.33.1 THISAPP = git-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = git -PAK_VER = 19 +PAK_VER = 20 DEPS = perl-Authen-SASL perl-MIME-Base64 perl-Net-SMTP-SSL @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c7f808ab107b666af45fccb56b9d9676 +$(DL_FILE)_MD5 = 3462f34d9c17288eee854b7645f6a0a1 install : $(TARGET) diff --git a/lfs/htop b/lfs/htop index 0dfdf011f..277b6532e 100644 --- a/lfs/htop +++ b/lfs/htop @@ -24,7 +24,7 @@ include Config -VER = 3.0.5 +VER = 3.1.1 THISAPP = htop-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = htop -PAK_VER = 16 +PAK_VER = 17 DEPS = @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 780b79322cfc576a762c2dadb5575d04 +$(DL_FILE)_MD5 = 76ad907a6d43cf38c089e3e9b0100590 install : $(TARGET) @@ -79,6 +79,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./autogen.sh cd $(DIR_APP) && ./configure --prefix=/usr cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/ddns-011-ddnss-fix-unhandled-exeption-on-update-patch b/src/patches/ddns-011-ddnss-fix-unhandled-exeption-on-update-patch deleted file mode 100644 index 95f6391be..000000000 --- a/src/patches/ddns-011-ddnss-fix-unhandled-exeption-on-update-patch +++ /dev/null @@ -1,30 +0,0 @@ -commit 7d0956d14ff8d823551ccd47ccf1492c9da9aac9 -Author: Stefan Schantl <stefan.schantl(a)ipfire.org> -Date: Mon May 25 18:00:51 2020 +0200 - - ProviderDDNSS: Fix unhandled exception on update - - In python > 3.3 the getheader() attribute is not longer part of the - urllib.response response.info() object. It is part of response object - and so directly can be accessed. - - Fixes #12328 - - Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> - -diff --git a/src/ddns/providers.py b/src/ddns/providers.py -index f1fed22..46d8a67 100644 ---- a/src/ddns/providers.py -+++ b/src/ddns/providers.py -@@ -642,10 +642,8 @@ class DDNSProviderDDNSS(DDNSProvider): - response = self.send_request(self.url, data=data) - - # This provider sends the response code as part of the header. -- header = response.info() -- - # Get status information from the header. -- output = header.getheader('ddnss-response') -+ output = response.getheader('ddnss-response') - - # Handle success messages. - if output == "good" or output == "nochg": diff --git a/src/patches/ddns-013-ddnss-fix-unhandled-exeption-on-update-patch b/src/patches/ddns-013-ddnss-fix-unhandled-exeption-on-update-patch deleted file mode 100644 index 95f6391be..000000000 --- a/src/patches/ddns-013-ddnss-fix-unhandled-exeption-on-update-patch +++ /dev/null @@ -1,30 +0,0 @@ -commit 7d0956d14ff8d823551ccd47ccf1492c9da9aac9 -Author: Stefan Schantl <stefan.schantl(a)ipfire.org> -Date: Mon May 25 18:00:51 2020 +0200 - - ProviderDDNSS: Fix unhandled exception on update - - In python > 3.3 the getheader() attribute is not longer part of the - urllib.response response.info() object. It is part of response object - and so directly can be accessed. - - Fixes #12328 - - Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> - -diff --git a/src/ddns/providers.py b/src/ddns/providers.py -index f1fed22..46d8a67 100644 ---- a/src/ddns/providers.py -+++ b/src/ddns/providers.py -@@ -642,10 +642,8 @@ class DDNSProviderDDNSS(DDNSProvider): - response = self.send_request(self.url, data=data) - - # This provider sends the response code as part of the header. -- header = response.info() -- - # Get status information from the header. -- output = header.getheader('ddnss-response') -+ output = response.getheader('ddnss-response') - - # Handle success messages. - if output == "good" or output == "nochg": hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. b88f6c476b45c173db54ce31d59dc42202c56e34
by Arne Fitzenreiter 25 Oct '21

25 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via b88f6c476b45c173db54ce31d59dc42202c56e34 (commit) via be52d700f160b1201d83fb942a0280f3f2d0f16a (commit) via c04ebdccee35ddac7cc483efb182982f7345052f (commit) via c4c756333578fc43d7f712cbc262fc3f3bf1fc52 (commit) from aa60fd7b3e61aeb08c68b67f615f8c94e6545447 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b88f6c476b45c173db54ce31d59dc42202c56e34 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 16:55:26 2021 +0000 core161: add curl Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit be52d700f160b1201d83fb942a0280f3f2d0f16a Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Sep 27 17:32:40 2021 +0200 curl: Update to version 7.79.1 - Update from 7.78.0 to 7.79.1 - Update of rootfile not required - Changelog Fixed in 7.79.1 - September 22 2021 Bugfixes: Curl_http2_setup: don't change connection data on repeat invokes curl_multi_fdset: make FD_SET() not operate on sockets out of range dist: provide lib/.checksrc in the tarball FAQ: add GOPHERS + curl works on data, not files hsts: CURLSTS_FAIL from hsts read callback should fail transfer hsts: handle unlimited expiry http: fix the broken >3 digit response code detection strerror: use sys_errlist instead of strerror on Windows test1184: disable tests/sshserver.pl: make it work with openssh-8.7p1 Fixed in 7.79.0 - September 15 2021 Changes: bearssl: support CURLOPT_CAINFO_BLOB http: consider cookies over localhost to be secure secure transport: support CURLINFO_CERTINFO Bugfixes: CVE-2021-22945: clear the leftovers pointer when sending succeeds CVE-2021-22946: do not ignore --ssl-reqd CVE-2021-22947: reject STARTTLS server response pipelining ares: use ares_getaddrinfo() asyn-ares.c: move all version number checks to the top auth: do not append zero-terminator to authorisation id in kerberos auth: properly handle byte order in kerberos security message auth: use sasl authzid option in kerberos auth: we do not support a security layer after kerberos authentication BINDINGS.md: update links to use https where available build: fix compiler warnings c-hyper: deal with Expect: 100-continue combined with POSTFIELDS c-hyper: fix header value passed to debug callback c-hyper: handle HTTP/1.1 => HTTP/1.0 downgrade on reused connection c-hyper: initial step for 100-continue support c-hyper: initial support for "dumping" 1xx HTTP responses c-hyper: remove the hyper_executor_poll() loop from Curl_http CI/cirrus: reduce compile time with increased parallism CI: use GitHub Container Registry instead of Docker Hub cirrus: Add FreeBSD 13.0 job and disable sanitizer build cmake: avoid poll() on macOS cmake: sync CURL_DISABLE options codeql: fix error "Resource not accessible by integration" compressed.d: it's a request, not an order config.d: escape the backslash properly config.d: note that curlrc is used even when --config config: get rid of the unused HAVE_SIG_ATOMIC_T et. al. configure.ac: revert bad nghttp2 library detection improvements configure: error out if both ngtcp2 and quiche are specified configure: make --disable-hsts work configure: set classic mingw minimum OS version to XP configure: tweak nghttp2 library name fix connect: get local port + ip also when reusing connections connect: remove superfluous conditional curl-openssl.m4: check lib64 for the pkg-config file curl-openssl.m4: show correct output for OpenSSL v3 curl.1: mention "global" flags curl.1: provide examples for each option curl: add warning for ignored data after quoted form parameter curl: add warning for incompatible parameters usage curl: better error message when -O fails to get a good name curl: stop retry if Retry-After: is longer than allowed curl_easy_setopt.3: improve the string copy wording Curl_hsts_loadcb: don't attempt to load if hsts wasn't inited curl_setup.h: sync values for HTTP_ONLY curl_url_get.3: clarify about path and query CURLMOPT_TIMERFUNCTION.3: remove misplaced "time" CURLOPT_DOH_URL.3: CURLOPT_OPENSOCKETFUNCTION is not inherited CURLOPT_SSL_CTX_*.3: tidy up the example CURLOPT_UNIX_SOCKET_PATH.3: remove nginx reference, add see also docs/MQTT: update state of username/password support docs: remove experimental mentions from HSTS and MQTT docs: the security list is reached at security at curl.se now easy: use a custom implementation of wcsdup on Windows examples/*hiperfifo.c: fix calloc arguments to match function proto examples/cookie_interface: avoid printfing time_t directly examples/cookie_interface: fix scan-build printf warning examples/ephiperfifo.c: simplify signal handler FAQ: add two dev related questions getparameter: fix the --local-port number parser happy-eyeballs-timeout-ms.d: polish the wording hostip: Make Curl_ipv6works function independent of getaddrinfo http2: Curl_http2_setup needs to init stream data in all invokes http2: revert a change that broke upgrade to h2c http2: revert call the handle-closed function correctly on closed stream http: disallow >3-digit response codes http: ignore content-length if any transfer-encoding is used http_proxy: clear 'sending' when the outgoing request is sent http_proxy: fix the User-Agent inclusion in CONNECT http_proxy: fix user-agent and custom headers for CONNECT with hyper http_proxy: only wait for writable socket while sending request INTERNALS: bump c-ares requirement to 1.16.0 INTERNALS: c-ares has a new home: c-ares.org lib: don't use strerror() libcurl-errors.3: clarify two CURLUcode errors limit-rate.d: clarify base unit mailing lists: move from cool.haxx.se to lists.haxx.se mbedtls: avoid using a large buffer on the stack mbedTLS: initial 3.0.0 support mbedtls_threadlock: fix unused variable warning mksymbolsmanpage.pl: Fix showing symbol's last used version mksymbolsmanpage.pl: match symbols case insenitively multi: fix compiler warning with `CURL_DISABLE_WAKEUP` ngtcp2: compile with the latest ngtcp2 and nghttp3 ngtcp2: fix build with ngtcp2 and nghttp3 ngtcp2: remove the acked_crypto_offset struct field init ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read ngtcp2: reset the oustanding send buffer again when drained ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream ngtcp2: stop buffering crypto data ngtcp2: utilize crypto API functions to simplify openssl: annotate SSL3_MT_SUPPLEMENTAL_DATA openssl: when creating a new context, there cannot be an old one opt-docs: make sure all man pages have examples opt-docs: verify man page sections + order opts docs: unify phrasing in NAME header output.d: add method to suppress response bodies page-header: add GOPHERS, simplify wording in the 1st para progress: fix a compile warning on some systems progress: make trspeed avoid floats runtests: add option -u to error on server unexpectedly alive schannel: Work around typo in classic mingw macro scripts: invoke interpreters through /usr/bin/env setopt: enable CURLOPT_IGNORE_CONTENT_LENGTH for hyper strerror.h: remove the #include from files not using it symbols-in-versions: fix CURLSSLBACKEND_QSOSSL last used version test1138: remove trailing space to make work with hyper test1173: check references to libcurl options test1280: CRLFify the response to please hyper test1565: fix windows build errors test365: verify response with chunked AND Content-Length headers tests/*server.pl: flush output before executing subprocess tests/*server.py: remove pidfile on server termination tests/runtests.pl: cleanup copy&paste mistakes and unused code tests/server/*.c: align handling of portfile argument and file tests: adjust the tftpd output to work with hyper mode tests: be explicit about using 'python3' instead of 'python' tests: enable test 1129 for hyper builds tests: make three tests pass until 2037 tool/tests: fix potential year 2038 issues tool_operate: Fix --fail-early with parallel transfers url: fix compiler warning in no-verbose builds urlapi.c:seturl: assert URL instead of using if-check vtls: fix typo in schannel_verify.c winbuild/README.md: clarify GEN_PDB option wolfssl: clean up wolfcrypt error queue write-out.d: clarify size_download/upload x509asn1: fix heap over-read when parsing x509 certificates Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit c04ebdccee35ddac7cc483efb182982f7345052f Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 16:52:15 2021 +0000 core161: add strongswan changes to update. this core also stops strongwan before extracting because the updown script is changed. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit c4c756333578fc43d7f712cbc262fc3f3bf1fc52 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Oct 23 14:49:52 2021 +0200 strongSwan: update to 5.9.4 Release notes as per https://github.com/strongswan/strongswan/releases/tag/5.9.4: Fixed a denial-of-service vulnerability in the gmp plugin that was caused by an integer overflow when processing RSASSA-PSS signatures with very large salt lengths. This vulnerability has been registered as CVE-2021-41990. Please refer to our blog for details. Fixed a denial-of-service vulnerability in the in-memory certificate cache if certificates are replaced and a very large random value caused an integer overflow. This vulnerability has been registered as CVE-2021-41991. Please refer to our blog for details. Fixed a related flaw that caused the daemon to accept and cache an infinite number of versions of a valid certificate by modifying the parameters in the signatureAlgorithm field of the outer X.509 Certificate structure. AUTH_LIFETIME notifies are now only sent by a responder if it can't reauthenticate the IKE_SA itself due to asymmetric authentication (i.e. EAP) or the use of virtual IPs. Several corner cases with reauthentication have been fixed (48fbe1d, 36161fe, 0d373e2). Serial number generation in several pki sub-commands has been fixed so they don't start with an unintended zero byte (#631). Loading SSH public keys via vici has been improved (#467). Shared secrets, PEM files, vici messages, PF_KEY messages, swanctl configs and other data is properly wiped from memory. Use a longer dummy key to initialize HMAC instances in the openssl plugin in case it's used in FIPS-mode (#557). The --enable-tpm option now implies --enable-tss-tss2 as the plugin doesn't do anything without a TSS 2.0. libtpmtss is initialized in all programs and libraries that use it. Migrated testing scripts to Python 3. The testing environment uses images based on Debian bullseye by default (support for jessie was removed). To my understanding, IPFire is not affected by CVE-2021-41990, as we do not support creation of IPsec connections using RSASSA-PSS (please correct me if we do :-). In contrast, CVE-2021-41991 affects IPFire installations indeed. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/104 => core/161}/filelists/curl | 0 config/rootfiles/core/161/filelists/files | 1 - .../106/filelists/strongswan => core/161/filelists/stronswan} | 0 config/rootfiles/core/161/update.sh | 5 +++++ lfs/curl | 4 ++-- lfs/strongswan | 4 ++-- 6 files changed, 9 insertions(+), 5 deletions(-) copy config/rootfiles/{oldcore/104 => core/161}/filelists/curl (100%) copy config/rootfiles/{oldcore/106/filelists/strongswan => core/161/filelists/stronswan} (100%) Difference in files: diff --git a/config/rootfiles/core/161/filelists/curl b/config/rootfiles/core/161/filelists/curl new file mode 120000 index 000000000..4b84bef53 --- /dev/null +++ b/config/rootfiles/core/161/filelists/curl @@ -0,0 +1 @@ +../../../common/curl \ No newline at end of file diff --git a/config/rootfiles/core/161/filelists/files b/config/rootfiles/core/161/filelists/files index 544b08d17..3d0a9d1bd 100644 --- a/config/rootfiles/core/161/filelists/files +++ b/config/rootfiles/core/161/filelists/files @@ -14,7 +14,6 @@ srv/web/ipfire/cgi-bin/speed.cgi usr/bin/2to3 usr/bin/hexdump usr/lib/firewall/rules.pl -usr/libexec/ipsec/_updown usr/local/bin/hddshutdown usr/local/bin/makegraphs var/ipfire/backup/exclude diff --git a/config/rootfiles/core/161/filelists/stronswan b/config/rootfiles/core/161/filelists/stronswan new file mode 120000 index 000000000..90c727e26 --- /dev/null +++ b/config/rootfiles/core/161/filelists/stronswan @@ -0,0 +1 @@ +../../../common/strongswan \ No newline at end of file diff --git a/config/rootfiles/core/161/update.sh b/config/rootfiles/core/161/update.sh index 889950824..db0dc1e98 100644 --- a/config/rootfiles/core/161/update.sh +++ b/config/rootfiles/core/161/update.sh @@ -96,6 +96,7 @@ rm -rf /usr/lib/python2* rm -rf /usr/lib/collectd/python.so # Stop services +/etc/init.d/ipsec stop # Extract files extract_files @@ -119,6 +120,9 @@ ldconfig /usr/local/bin/filesystem-cleanup # Start services +if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then + /etc/init.d/ipsec start +fi # Delete orphaned pppd 2.4.8 shared object files rm -rf \ @@ -162,3 +166,4 @@ sync # Don't report the exitcode last command exit 0 +# Stop services diff --git a/lfs/curl b/lfs/curl index 1d516664c..70465bb35 100644 --- a/lfs/curl +++ b/lfs/curl @@ -24,7 +24,7 @@ include Config -VER = 7.78.0 +VER = 7.79.1 THISAPP = curl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 419c2461366cf404160a820f7a902b7e +$(DL_FILE)_MD5 = 74d3c4ca8aaa6c0619806d6e246e65fb install : $(TARGET) diff --git a/lfs/strongswan b/lfs/strongswan index 46c0309fb..45ff8f426 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -24,7 +24,7 @@ include Config -VER = 5.9.3 +VER = 5.9.4 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 80ecabe0ce72d550d2d5de0118f89143 +$(DL_FILE)_MD5 = 9c387eb77f0159fdefbcf7e81c905c35 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. aa60fd7b3e61aeb08c68b67f615f8c94e6545447
by Arne Fitzenreiter 25 Oct '21

25 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via aa60fd7b3e61aeb08c68b67f615f8c94e6545447 (commit) via 98d78fa824fd30a9bc2b90f7d3831ff20c9997b4 (commit) from a38c882bfb59d5b359b22df3d97f3ed88f497d93 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit aa60fd7b3e61aeb08c68b67f615f8c94e6545447 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 18:43:45 2021 +0200 strongswan: remove unneded -j RETURN rules after removimg the mark rules this rules are useless because they should skip expensive policy matches that now are removed. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 98d78fa824fd30a9bc2b90f7d3831ff20c9997b4 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 15:46:07 2021 +0200 makeqosscript: fix typo in comment. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/qos/makeqosscripts.pl | 2 +- src/patches/strongswan-ipfire.patch | 70 +++++++++++++++++-------------------- 2 files changed, 33 insertions(+), 39 deletions(-) Difference in files: diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index 878e4bb43..0694bb78c 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -4,7 +4,7 @@ # IPFire.org - A linux based firewall # # Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # -# This program is free software: you c:an redistribute it and/or modify # +# This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # # the Free Software Foundation, either version 3 of the License, or # # (at your option) any later version. # diff --git a/src/patches/strongswan-ipfire.patch b/src/patches/strongswan-ipfire.patch index 31c32dc4e..0f137ca2a 100644 --- a/src/patches/strongswan-ipfire.patch +++ b/src/patches/strongswan-ipfire.patch @@ -1,6 +1,6 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_updown/_updown.in --- strongswan-5.9.3.org/src/_updown/_updown.in 2020-12-09 19:01:30.000000000 +0100 -+++ strongswan-5.9.3/src/_updown/_updown.in 2021-10-25 13:41:23.791826699 +0200 ++++ strongswan-5.9.3/src/_updown/_updown.in 2021-10-25 17:30:15.669773781 +0200 @@ -242,12 +242,9 @@ # connection to me, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom @@ -55,36 +55,34 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd fi fi ;; -@@ -307,24 +301,18 @@ +@@ -305,34 +299,16 @@ + # connection to client subnet, with (left/right)firewall=yes, coming up + # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. - if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ] - then +- if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ] +- then - iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT - iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables --wait -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ +- -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT -+ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN - fi +- fi # # a virtual IP requires an INPUT and OUTPUT rule on the host # or sometimes host access via the internal IP is needed - if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] - then +- if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] +- then - iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ +- -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT - iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT -+ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN - fi +- fi # # allow IPIP traffic because of the implicit SA created by the kernel if -@@ -332,7 +320,7 @@ + # IPComp is used (for small inbound packets that are not compressed). # INPUT is correct here even for forwarded traffic. if [ -n "$PLUTO_IPCOMP" ] then @@ -93,7 +91,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT fi # -@@ -342,12 +330,29 @@ +@@ -342,47 +318,42 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO \ @@ -125,37 +123,33 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd ;; down-client:iptables) # connection to client subnet, with (left/right)firewall=yes, going down -@@ -355,34 +360,26 @@ + # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. - if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ] - then +- if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ] +- then - iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ - $IPSEC_POLICY_OUT -j ACCEPT - iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables --wait -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT $D_MY_PORT \ +- -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ +- -d $PLUTO_MY_CLIENT $D_MY_PORT \ - $IPSEC_POLICY_IN -j ACCEPT -+ $IPSEC_POLICY_IN -j RETURN - fi +- fi # # a virtual IP requires an INPUT and OUTPUT rule on the host # or sometimes host access via the internal IP is needed - if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] - then +- if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] +- then - iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ - -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT $D_MY_PORT \ +- -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ +- -d $PLUTO_MY_CLIENT $D_MY_PORT \ - $IPSEC_POLICY_IN -j ACCEPT - iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ - $IPSEC_POLICY_OUT -j ACCEPT -+ $IPSEC_POLICY_IN -j RETURN - fi +- fi # # IPIP exception teardown if [ -n "$PLUTO_IPCOMP" ] @@ -165,7 +159,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT fi # -@@ -392,12 +389,29 @@ +@@ -392,12 +363,29 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO -- \ @@ -197,7 +191,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd ;; # # IPv6 -@@ -422,10 +436,10 @@ +@@ -422,10 +410,10 @@ # connection to me, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. @@ -210,7 +204,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT # -@@ -454,10 +468,10 @@ +@@ -454,10 +442,10 @@ # connection to me, with (left/right)firewall=yes, going down # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. @@ -223,7 +217,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT # -@@ -487,10 +501,10 @@ +@@ -487,10 +475,10 @@ # ones, so do not mess with it; see CAUTION comment up at top. if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ] then @@ -236,7 +230,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT fi -@@ -499,10 +513,10 @@ +@@ -499,10 +487,10 @@ # or sometimes host access via the internal IP is needed if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] then @@ -249,7 +243,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_MY_CLIENT $S_MY_PORT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT fi -@@ -535,11 +549,11 @@ +@@ -535,11 +523,11 @@ # ones, so do not mess with it; see CAUTION comment up at top. if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ] then @@ -263,7 +257,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_MY_CLIENT $D_MY_PORT \ $IPSEC_POLICY_IN -j ACCEPT -@@ -549,11 +563,11 @@ +@@ -549,11 +537,11 @@ # or sometimes host access via the internal IP is needed if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] then hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a38c882bfb59d5b359b22df3d97f3ed88f497d93
by Arne Fitzenreiter 25 Oct '21

25 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a38c882bfb59d5b359b22df3d97f3ed88f497d93 (commit) from a8dd6e98ba04b8dc0e7642beab16c9efeaee6e33 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a38c882bfb59d5b359b22df3d97f3ed88f497d93 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 13:45:39 2021 +0200 strongswan: remove CONNMARK rules. the marks are not used by firewall and QoS anymore. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: src/patches/strongswan-ipfire.patch | 86 ++++++++++++------------------------- 1 file changed, 27 insertions(+), 59 deletions(-) Difference in files: diff --git a/src/patches/strongswan-ipfire.patch b/src/patches/strongswan-ipfire.patch index 38202c1ec..31c32dc4e 100644 --- a/src/patches/strongswan-ipfire.patch +++ b/src/patches/strongswan-ipfire.patch @@ -1,7 +1,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_updown/_updown.in --- strongswan-5.9.3.org/src/_updown/_updown.in 2020-12-09 19:01:30.000000000 +0100 -+++ strongswan-5.9.3/src/_updown/_updown.in 2021-10-18 14:51:34.446203334 +0200 -@@ -242,12 +242,15 @@ ++++ strongswan-5.9.3/src/_updown/_updown.in 2021-10-25 13:41:23.791826699 +0200 +@@ -242,12 +242,9 @@ # connection to me, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. @@ -10,17 +10,12 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT - iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -+ -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000 -+ iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ +- -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT -+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j CONNMARK --set-xmark 0x00800000/0x00800000 # # allow IPIP traffic because of the implicit SA created by the kernel if # IPComp is used (for small inbound packets that are not compressed) -@@ -263,10 +266,10 @@ +@@ -263,10 +260,10 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO \ @@ -33,26 +28,21 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd fi fi ;; -@@ -274,12 +277,15 @@ +@@ -274,12 +271,9 @@ # connection to me, with (left/right)firewall=yes, going down # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. - iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -+ -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000 + iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT - iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ +- -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT -+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j CONNMARK --set-xmark 0x00800000/0x00800000 # # IPIP exception teardown if [ -n "$PLUTO_IPCOMP" ] -@@ -294,10 +300,10 @@ +@@ -294,10 +288,10 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO -- \ @@ -65,23 +55,18 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd fi fi ;; -@@ -307,24 +313,30 @@ +@@ -307,24 +301,18 @@ # ones, so do not mess with it; see CAUTION comment up at top. if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ] then - iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables --wait -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -+ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN -+ iptables --wait -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ +- -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT - iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000 + iptables --wait -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT -+ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000 ++ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN fi # # a virtual IP requires an INPUT and OUTPUT rule on the host @@ -93,18 +78,13 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ - -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT - iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN -+ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -+ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000 -+ iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ +- -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT -+ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000 ++ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN fi # # allow IPIP traffic because of the implicit SA created by the kernel if -@@ -332,7 +344,7 @@ +@@ -332,7 +320,7 @@ # INPUT is correct here even for forwarded traffic. if [ -n "$PLUTO_IPCOMP" ] then @@ -113,7 +93,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT fi # -@@ -342,12 +354,29 @@ +@@ -342,12 +330,29 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO \ @@ -145,25 +125,19 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd ;; down-client:iptables) # connection to client subnet, with (left/right)firewall=yes, going down -@@ -355,34 +384,42 @@ +@@ -355,34 +360,26 @@ # ones, so do not mess with it; see CAUTION comment up at top. if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ] then - iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ iptables --wait -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ +- -s $PLUTO_MY_CLIENT $S_MY_PORT \ +- -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ - $IPSEC_POLICY_OUT -j ACCEPT - iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000 + iptables --wait -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_MY_CLIENT $D_MY_PORT \ - $IPSEC_POLICY_IN -j ACCEPT -+ $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000 -+ iptables --wait -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -+ -d $PLUTO_MY_CLIENT $D_MY_PORT \ + $IPSEC_POLICY_IN -j RETURN fi # @@ -177,16 +151,10 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -d $PLUTO_MY_CLIENT $D_MY_PORT \ - $IPSEC_POLICY_IN -j ACCEPT - iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ -+ $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000 -+ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \ -+ -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -+ -d $PLUTO_MY_CLIENT $D_MY_PORT \ -+ $IPSEC_POLICY_IN -j RETURN -+ iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \ - -s $PLUTO_MY_CLIENT $S_MY_PORT \ - -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ +- -s $PLUTO_MY_CLIENT $S_MY_PORT \ +- -d $PLUTO_PEER_CLIENT $D_PEER_PORT \ - $IPSEC_POLICY_OUT -j ACCEPT -+ $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000 ++ $IPSEC_POLICY_IN -j RETURN fi # # IPIP exception teardown @@ -197,7 +165,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT fi # -@@ -392,12 +429,29 @@ +@@ -392,12 +389,29 @@ if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ] then logger -t $TAG -p $FAC_PRIO -- \ @@ -229,7 +197,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd ;; # # IPv6 -@@ -422,10 +476,10 @@ +@@ -422,10 +436,10 @@ # connection to me, with (left/right)firewall=yes, coming up # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. @@ -242,7 +210,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT # -@@ -454,10 +508,10 @@ +@@ -454,10 +468,10 @@ # connection to me, with (left/right)firewall=yes, going down # This is used only by the default updown script, not by your custom # ones, so do not mess with it; see CAUTION comment up at top. @@ -255,7 +223,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT # -@@ -487,10 +541,10 @@ +@@ -487,10 +501,10 @@ # ones, so do not mess with it; see CAUTION comment up at top. if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ] then @@ -268,7 +236,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT fi -@@ -499,10 +553,10 @@ +@@ -499,10 +513,10 @@ # or sometimes host access via the internal IP is needed if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] then @@ -281,7 +249,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_MY_CLIENT $S_MY_PORT \ -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT fi -@@ -535,11 +589,11 @@ +@@ -535,11 +549,11 @@ # ones, so do not mess with it; see CAUTION comment up at top. if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ] then @@ -295,7 +263,7 @@ diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_upd -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ -d $PLUTO_MY_CLIENT $D_MY_PORT \ $IPSEC_POLICY_IN -j ACCEPT -@@ -549,11 +603,11 @@ +@@ -549,11 +563,11 @@ # or sometimes host access via the internal IP is needed if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] then hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a8dd6e98ba04b8dc0e7642beab16c9efeaee6e33
by Arne Fitzenreiter 25 Oct '21

25 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a8dd6e98ba04b8dc0e7642beab16c9efeaee6e33 (commit) from 36b00b8ed130601a9aab14036c81c2ea788aa000 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a8dd6e98ba04b8dc0e7642beab16c9efeaee6e33 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 12:58:10 2021 +0200 speed.cgi: replave parsing of ip show output latest ipfroute2 update change the output so this repkace it by reading /sys/class/net/*/statistics Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/qos/makeqosscripts.pl | 2 +- html/cgi-bin/speed.cgi | 47 ++++++++++---------------------------------- 2 files changed, 11 insertions(+), 38 deletions(-) Difference in files: diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index 0694bb78c..878e4bb43 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -4,7 +4,7 @@ # IPFire.org - A linux based firewall # # Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # -# This program is free software: you can redistribute it and/or modify # +# This program is free software: you c:an redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # # the Free Software Foundation, either version 3 of the License, or # # (at your option) any later version. # diff --git a/html/cgi-bin/speed.cgi b/html/cgi-bin/speed.cgi index 651c3c0b3..d4b83df4f 100644 --- a/html/cgi-bin/speed.cgi +++ b/html/cgi-bin/speed.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007 Michael Tremer & Christian Schmidt # +# Copyright (C) 2007-2021 IPFire Twan <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,28 +25,6 @@ # high system load # ###########################################OA################################## # -# Returns the output of a shell command -sub General__system_output($) { - my @command = @_; - my $pid; - my @output = (); - - unless ($pid = open(OUTPUT, "-|")) { - open(STDERR, ">&STDOUT"); - exec { ${command[0]} } @command; - die "Could not execute @command: $!"; - } - - waitpid($pid, 0); - - while (<OUTPUT>) { - push(@output, $_); - } - - close(OUTPUT); - return @output; -} -# # Function which will return the used interface for the red network zone (red0, ppp0, etc). sub General__get_red_interface() { @@ -79,21 +57,16 @@ foreach $field (@fields) { } my $interface = &General__get_red_interface(); -my @data_now = &General__system_output("ip", "-s", "link", "show", "$interface"); -my $lastline; -my $rxb_now = 0; -my $txb_now = 0; -foreach (@data_now) { - if ( $lastline =~ /RX/ ) { - @fields = split(/ /, $_); - $rxb_now = $fields[4]; - } elsif ( $lastline =~ /TX/ ) { - @fields = split(/ /, $_); - $txb_now = $fields[4]; - } - $lastline = $_; -} +open(RX, "/sys/class/net/$interface/statistics/rx_bytes") or die "Could not open /sys/class/net/$interface/statistics/rx_bytes"; +my $rxb_now = <RX>; +close(RX); +chomp $rxb_now; + +open(TX, "/sys/class/net/$interface/statistics/tx_bytes") or die "Could not open /sys/class/net/$interface/statistics/tx_bytes"; +my $txb_now = <TX>; +close(TX); +chomp $txb_now; my ($rx_kbs, $tx_kbs); my $rxb_diff = $rxb_now - $rxb_last; hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 36b00b8ed130601a9aab14036c81c2ea788aa000
by Arne Fitzenreiter 25 Oct '21

25 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 36b00b8ed130601a9aab14036c81c2ea788aa000 (commit) from 66bc17dcc16f465fed435f366a8ccf01c6e6d814 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 36b00b8ed130601a9aab14036c81c2ea788aa000 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 25 11:42:16 2021 +0200 makeqosscript: replace marks b< ipt policy match for upsec this is more reliable at not loose some connections. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/qos/makeqosscripts.pl | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) Difference in files: diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index b029a885f..0694bb78c 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -61,9 +61,8 @@ my $QOS_INC_MASK = 0x0000ff00; my $QOS_INC_SHIFT = 8; my $QOS_OUT_MASK = 0x000000ff; my $QOS_OUT_SHIFT = 0; -my $IPSEC_MASK = 0x00800000; -my $QOS_INC_SKIP_MASK = $QOS_INC_MASK | $IPSEC_MASK; -my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK | $IPSEC_MASK; +my $QOS_INC_SKIP_MASK = $QOS_INC_MASK; +my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK; &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); @@ -322,13 +321,15 @@ print <<END ip link set $qossettings{'IMQ_DEV'} up - ### Restore conmark and continue with next filter - tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all u32 \\ - match u32 0 0 \\ - action connmark continue - ### Send all traffic except IPSec to $qossettings{'IMQ_DEV'} + ### Pass IPSec traffic without redirect + tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 1 protocol all basic \\ + match "ipt(-m policy --pol ipsec --dir in)" \\ + action pass + + ### Restore connmark and send rest of the traffic to $qossettings{'IMQ_DEV'} tc filter add dev $qossettings{'RED_DEV'} parent ffff: prio 2 protocol all u32 \\ - match mark 0 $IPSEC_MASK \\ + match u32 0 0 \\ + action connmark \\ action mirred egress redirect dev $qossettings{'IMQ_DEV'} ### ADD HTB QDISC FOR $qossettings{'IMQ_DEV'} hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 66bc17dcc16f465fed435f366a8ccf01c6e6d814
by Arne Fitzenreiter 24 Oct '21

24 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 66bc17dcc16f465fed435f366a8ccf01c6e6d814 (commit) from 572249bbf385d09dad98d0359921f96220a87c9f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 66bc17dcc16f465fed435f366a8ccf01c6e6d814 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Oct 24 17:06:34 2021 +0200 iproute2: build after iptables to get ipt filters for tc to proper filter IPSec im QoS without using mark or connmark i need ipt filters for tc which are only build if iptables are build prior iproute2. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/aarch64/util-linux | 2 ++ config/rootfiles/common/armv6l/util-linux | 2 ++ config/rootfiles/common/i586/util-linux | 2 ++ config/rootfiles/common/iproute2 | 9 +++++++-- config/rootfiles/common/x86_64/util-linux | 2 ++ make.sh | 2 +- 6 files changed, 16 insertions(+), 3 deletions(-) Difference in files: diff --git a/config/rootfiles/common/aarch64/util-linux b/config/rootfiles/common/aarch64/util-linux index 9f4b9866d..fe6b0e431 100644 --- a/config/rootfiles/common/aarch64/util-linux +++ b/config/rootfiles/common/aarch64/util-linux @@ -126,6 +126,8 @@ usr/sbin/partx usr/sbin/resizepart usr/sbin/rtcwake #usr/sbin/uuidd +#usr/share/bash-completion +#usr/share/bash-completion/completions #usr/share/bash-completion/completions/addpart #usr/share/bash-completion/completions/blkdiscard #usr/share/bash-completion/completions/blkid diff --git a/config/rootfiles/common/armv6l/util-linux b/config/rootfiles/common/armv6l/util-linux index d32ed5256..f3f5014f5 100644 --- a/config/rootfiles/common/armv6l/util-linux +++ b/config/rootfiles/common/armv6l/util-linux @@ -126,6 +126,8 @@ usr/sbin/partx usr/sbin/resizepart usr/sbin/rtcwake #usr/sbin/uuidd +#usr/share/bash-completion +#usr/share/bash-completion/completions #usr/share/bash-completion/completions/addpart #usr/share/bash-completion/completions/blkdiscard #usr/share/bash-completion/completions/blkid diff --git a/config/rootfiles/common/i586/util-linux b/config/rootfiles/common/i586/util-linux index 55cc7ecb7..beba8ed9c 100644 --- a/config/rootfiles/common/i586/util-linux +++ b/config/rootfiles/common/i586/util-linux @@ -127,6 +127,8 @@ usr/sbin/partx usr/sbin/resizepart usr/sbin/rtcwake #usr/sbin/uuidd +#usr/share/bash-completion +#usr/share/bash-completion/completions #usr/share/bash-completion/completions/addpart #usr/share/bash-completion/completions/blkdiscard #usr/share/bash-completion/completions/blkid diff --git a/config/rootfiles/common/iproute2 b/config/rootfiles/common/iproute2 index 609b798e3..ce316e11e 100644 --- a/config/rootfiles/common/iproute2 +++ b/config/rootfiles/common/iproute2 @@ -10,12 +10,15 @@ etc/iproute2/rt_scopes etc/iproute2/rt_tables sbin/bridge sbin/ctstat +sbin/dcb +sbin/devlink sbin/genl sbin/ifcfg sbin/ifstat sbin/ip sbin/lnstat sbin/nstat +sbin/rdma sbin/routef sbin/routel sbin/rtacct @@ -24,16 +27,18 @@ sbin/rtpr sbin/rtstat sbin/ss sbin/tc +sbin/tipc +sbin/vdpa #usr/include/iproute2 #usr/include/iproute2/bpf_elf.h #usr/lib/tc #usr/lib/tc/experimental.dist +usr/lib/tc/m_ipt.so +usr/lib/tc/m_xt.so #usr/lib/tc/normal.dist #usr/lib/tc/pareto.dist #usr/lib/tc/paretonormal.dist #usr/sbin/arpd -#usr/share/bash-completion -#usr/share/bash-completion/completions #usr/share/bash-completion/completions/devlink usr/share/bash-completion/completions/tc #usr/share/man/man3/libnetlink.3 diff --git a/config/rootfiles/common/x86_64/util-linux b/config/rootfiles/common/x86_64/util-linux index 0c731e66a..214a09550 100644 --- a/config/rootfiles/common/x86_64/util-linux +++ b/config/rootfiles/common/x86_64/util-linux @@ -128,6 +128,8 @@ usr/sbin/partx usr/sbin/resizepart usr/sbin/rtcwake #usr/sbin/uuidd +#usr/share/bash-completion +#usr/share/bash-completion/completions #usr/share/bash-completion/completions/addpart #usr/share/bash-completion/completions/blkdiscard #usr/share/bash-completion/completions/blkid diff --git a/make.sh b/make.sh index 86e92ecd7..e26753f4e 100755 --- a/make.sh +++ b/make.sh @@ -1128,7 +1128,6 @@ buildbase() { lfsmake2 gperf lfsmake2 gzip lfsmake2 hostname - lfsmake2 iproute2 lfsmake2 jwhois lfsmake2 kbd lfsmake2 less @@ -1190,6 +1189,7 @@ buildipfire() { lfsmake2 libnetfilter_cthelper lfsmake2 libnetfilter_cttimeout lfsmake2 iptables + lfsmake2 iproute2 lfsmake2 screen lfsmake2 elfutils hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 572249bbf385d09dad98d0359921f96220a87c9f
by Arne Fitzenreiter 24 Oct '21

24 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 572249bbf385d09dad98d0359921f96220a87c9f (commit) from 05b6dd44bef2f8a2cc4827533a6ff070a8852b8e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 572249bbf385d09dad98d0359921f96220a87c9f Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Oct 24 12:13:20 2021 +0000 core161: add iproute2 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/106 => core/161}/filelists/iproute2 | 0 1 file changed, 0 insertions(+), 0 deletions(-) copy config/rootfiles/{oldcore/106 => core/161}/filelists/iproute2 (100%) Difference in files: diff --git a/config/rootfiles/core/161/filelists/iproute2 b/config/rootfiles/core/161/filelists/iproute2 new file mode 120000 index 000000000..05f0f71fb --- /dev/null +++ b/config/rootfiles/core/161/filelists/iproute2 @@ -0,0 +1 @@ +../../../common/iproute2 \ No newline at end of file hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 05b6dd44bef2f8a2cc4827533a6ff070a8852b8e
by Arne Fitzenreiter 24 Oct '21

24 Oct '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 05b6dd44bef2f8a2cc4827533a6ff070a8852b8e (commit) from 10941827dbf9dd415a3da8864b09098517e5aef4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 05b6dd44bef2f8a2cc4827533a6ff070a8852b8e Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Tue Sep 7 13:03:22 2021 +0200 iproute2: Update version to 5.14.0 - Update from 5.13.0 to 5.14.0 - Update rootfile - Changelog Alexander Mikhalitsyn (2): ip route: ignore ENOENT during save if RT_TABLE_MAIN is being dumped libnetlink: check error handler is present before a call Andrea Claudi (9): tc: q_ets: drop dead code from argument parsing lib: bpf_legacy: avoid to pass invalid argument to close() dcb: fix return value on dcb_cmd_app_show dcb: fix memory leak tipc: bail out if algname is abnormally long tipc: bail out if key is abnormally long tc: htb: improve burst error messages lib: bpf_legacy: fix potential NULL-pointer dereference lib: bpf_glue: remove useless assignment Ariel Levkovich (2): tc: f_flower: Add option to match on related ct state tc: f_flower: Add missing ct_state flags to usage description Asbjørn Sloth Tønnesen (2): tc: pedit: parse_cmd: add flags argument tc: pedit: add decrement operation Christian Schürmann (1): man8/ip-tunnel.8: fix typo, 'encaplim' is not a valid option David Ahern (6): Update kernel headers Update kernel headers config.mk: Rerun configure when it is newer than config.mk Update kernel headers Update kernel headers Import wwan.h uapi file Dmytro Linkin (3): devlink: Add helper function to validate object handler devlink: Add port func rate support devlink: Add ISO/IEC switch Eric Dumazet (1): tc: fq: add horizon attributes Feng Zhou (1): lib/bpf: Fix btf_load error lead to enable debug log Gal Pressman (2): rdma: update uapi headers rdma: Add copy-on-fork to get sys command Gokul Sivakumar (3): bridge: reorder cmd line arg parsing to let "-c" detected as "color" option bridge: fdb: don't colorize the "dev" & "dst" keywords in "bridge -c fdb" man: bridge: fix the typo to change "-c[lor]" into "-c[olor]" in man page Guillaume Nault (1): utils: bump max args number to 512 for batch files Hangbin Liu (3): configure: add options ability configure: convert LIBBPF environment variables to command-line options ip/bond: add arp_validate filter support Heiko Thiery (1): lib/fs: fix issue when {name,open}_to_handle_at() is not implemented Hoang Le (1): tipc: call a sub-routine in separate socket Jacob Keller (1): devlink: fix infinite loop on flash update for drivers without status Jakub Kicinski (3): ip: align the name of the 'nohandler' stat ip: dynamically size columns when printing stats ss: fix fallback to procfs for raw sockets Jethro Beekman (1): ip: Add nodst option to macvlan type source Jianguo Wu (1): mptcp: make sure flag signal is set when add addr with port Lahav Schlesinger (1): ipmonitor: Fix recvmsg with ancillary data Martynas Pumputis (1): libbpf: fix attach of prog with multiple sections Neta Ostrovsky (3): rdma: Update uapi headers rdma: Add context resource tracking information rdma: Add SRQ resource tracking information Paolo Lungaroni (2): seg6: add counters support for SRv6 Behaviors seg6: add support for SRv6 End.DT46 Behavior Parav Pandit (2): devlink: Add optional controller user input devlink: Show port state values in man page and in the help command Peilin Ye (1): tc/skbmod: Remove misinformation about the swap action Phil Sutter (1): tc: u32: Fix key folding in sample option Roi Dayan (2): police: Add support for json output police: Fix normal output back to what it was Sergey Ryazanov (2): iplink: add support for parent device iplink: support for WWAN devices Stephen Hemminger (6): lib: remove blank line at eof uapi: update kernel headers from 5.14-rc1 libnetlink: cosmetic changes uapi: headers update uapi: update neighbour.h v5.14.0 Tyson Moore (1): tc-cake: update docs to include LE diffserv Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Reviewed-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/iproute2 | 1 + lfs/iproute2 | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) Difference in files: diff --git a/config/rootfiles/common/iproute2 b/config/rootfiles/common/iproute2 index fabf27ca6..609b798e3 100644 --- a/config/rootfiles/common/iproute2 +++ b/config/rootfiles/common/iproute2 @@ -53,6 +53,7 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/devlink-health.8 #usr/share/man/man8/devlink-monitor.8 #usr/share/man/man8/devlink-port.8 +#usr/share/man/man8/devlink-rate.8 #usr/share/man/man8/devlink-region.8 #usr/share/man/man8/devlink-resource.8 #usr/share/man/man8/devlink-sb.8 diff --git a/lfs/iproute2 b/lfs/iproute2 index ac5df26e1..2f20b0c99 100644 --- a/lfs/iproute2 +++ b/lfs/iproute2 @@ -24,7 +24,7 @@ include Config -VER = 5.13.0 +VER = 5.14.0 THISAPP = iproute2-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 15fc3786303a173a14e180afe4cd2ecd +$(DL_FILE)_MD5 = da53966eb3b08ac264f3e9df02e06bfa install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM October 2021