IPFire-SCM March 2024

ipfire-scm@lists.ipfire.org

1 participants
48 discussions

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 3d947e6e6b9f492fa0a12b40db0495b6eac6d967
by Michael Tremer 26 Mar '24

26 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 3d947e6e6b9f492fa0a12b40db0495b6eac6d967 (commit) from 2e94953dd40134d05d3dd93c9c3e125f5ec427f9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3d947e6e6b9f492fa0a12b40db0495b6eac6d967 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Mar 25 18:44:56 2024 +0100 CU185-update.sh: Add drop hostile in & out logging entries if not already present - This v2 patch corrects that the previous script was looking for =on. If a user had modified the preferences to change it to =off then the script would have resulted in both =on and =off versions being in the settings file. - This patch ensures that those people who updated to CU184 before the CU184-update.sh patch fix to add the logging entries was added will get their optionsfw settings file correctly updated with CU185 - This only adds the LOGDROPHOSTILEIN & LOGDROPHOSTILEOUT entries if they do not already exist in the optionsfw settings file. - This change also does the check for LOGDROPHOSTILEIN and LOGDROPHOSTILEOUT as two separate checks and then runs the firewall update command Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/185/update.sh | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) Difference in files: diff --git a/config/rootfiles/core/185/update.sh b/config/rootfiles/core/185/update.sh index ec4d8ab82..002f92bbb 100644 --- a/config/rootfiles/core/185/update.sh +++ b/config/rootfiles/core/185/update.sh @@ -117,11 +117,17 @@ chown nobody:nobody /var/ipfire/ovpn/ovpnconfig # Check if the drop hostile in and out logging options need to be added # into the optionsfw settings file and apply to firewall -if ! [ $(grep "LOGDROPHOSTILEIN=on" /var/ipfire/optionsfw/settings) ] && \ - ! [ $(grep "LOGDROPHOSTILEOUT=on" /var/ipfire/optionsfw/settings) ]; then - sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings - sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings - /usr/local/bin/firewallctrl +optionsfw="" +if ! [ $(grep "^LOGDROPHOSTILEIN=" /var/ipfire/optionsfw/settings) ]; then + sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings + optionsfw="updated" +fi +if ! [ $(grep "^LOGDROPHOSTILEOUT=" /var/ipfire/optionsfw/settings) ]; then + sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings + optionsfw="updated" +fi +if ! [ -z "$optionsfw" ]; then + /usr/local/bin/firewallctrl fi # Rebuild initial ramdisks hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 2e94953dd40134d05d3dd93c9c3e125f5ec427f9
by Michael Tremer 25 Mar '24

25 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 2e94953dd40134d05d3dd93c9c3e125f5ec427f9 (commit) from cb0488997b9c2237058a0ff8c546c269b6a6f1ed (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2e94953dd40134d05d3dd93c9c3e125f5ec427f9 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Mar 25 14:41:38 2024 +0100 shadow: Update login.defs to remove reference to cracklib - From shadow-15.0.0 all references to cracklib were removed from shadow. Apparently some functions were no longer accessible and the shadow team decided to remove cracklib references completely. This was not mentioned in the changelkog for 15.0.0 - This resulkts in gettinbg the message configuration error - unknown item 'CRACKKLIB_DICTPATH' ( notify administrator ) when logging in to the console. - The login to the console occurs successfully so the message is only a warning that cracklib is no longer used. - IPfire does not use cracklkib anyway so this patch removes the section referring to cracklib from the login.defs configuration file. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/shadow/login.defs | 5 ----- 1 file changed, 5 deletions(-) Difference in files: diff --git a/config/shadow/login.defs b/config/shadow/login.defs index a9559d6c42..2662a62cc9 100644 --- a/config/shadow/login.defs +++ b/config/shadow/login.defs @@ -175,11 +175,6 @@ PASS_WARN_AGE 7 # SU_WHEEL_ONLY no -# -# If compiled with cracklib support, sets the path to the dictionaries -# -CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict - # # Min/max values for automatic uid selection in useradd(8) # hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. cb0488997b9c2237058a0ff8c546c269b6a6f1ed
by Michael Tremer 25 Mar '24

25 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via cb0488997b9c2237058a0ff8c546c269b6a6f1ed (commit) from 08b7500b267a54aa634fb34b67b4dfc0934ae2be (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit cb0488997b9c2237058a0ff8c546c269b6a6f1ed Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Mar 25 12:17:52 2024 +0100 samba: Add wsdd as a dependency to samba - Add wsdd as a dependency to samba so it will be installed together with samba Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/samba | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/lfs/samba b/lfs/samba index 76088abfa..df7811313 100644 --- a/lfs/samba +++ b/lfs/samba @@ -33,9 +33,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 99 +PAK_VER = 100 -DEPS = avahi cups perl-Parse-Yapp perl-JSON +DEPS = avahi cups perl-Parse-Yapp perl-JSON wsdd SERVICES = samba hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 46a9e7a0a462095add7fa508322d837b78912596
by Arne Fitzenreiter 24 Mar '24

24 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 46a9e7a0a462095add7fa508322d837b78912596 (commit) via 08b7500b267a54aa634fb34b67b4dfc0934ae2be (commit) via ad0d064a487c8912cbe4bd77ae652a4212e0fae9 (commit) via 4e8225a778f838dadc530759b9341fc9dbf5d534 (commit) via cf6eaba833abee235fffdf377a0d6379a0ff8406 (commit) via 563e4a4298b881d612a14994d90bbb7503e1d754 (commit) via 0842e694a6b577843362ea6b854d336b867d6f00 (commit) via df7977fde7dec9516036afd8b687acab9f034bf4 (commit) via 738ee720275e56bd6fff06b2b53730f903dd02df (commit) via 0564584a5887b7498ae9ea638bc4799d2a6147e8 (commit) from 6581c6e3a6c28e040c2bbaae21f1f5c926d4b840 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 46a9e7a0a462095add7fa508322d837b78912596 Merge: 6581c6e3a6 08b7500b26 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 24 08:48:51 2024 +0100 Merge remote-tracking branch 'origin/master' into next Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/ids-functions.pl | 11 +++--- config/rootfiles/oldcore/185/filelists/files | 3 ++ .../{131 => 185}/filelists/ids-ruleset-sources | 0 config/rootfiles/oldcore/185/update.sh | 9 +++++ config/suricata/ruleset-sources | 28 +++++++++++++++ html/cgi-bin/ids.cgi | 42 +++++++++++++--------- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + src/scripts/update-ids-ruleset | 2 +- 9 files changed, 75 insertions(+), 22 deletions(-) copy config/rootfiles/oldcore/{131 => 185}/filelists/ids-ruleset-sources (100%) Difference in files: diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index d97431b4a3..c29a5151f9 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -1027,11 +1027,14 @@ sub _store_error_message ($) { sub _get_dl_rulesfile($) { my ($provider) = @_; - # Check if the requested provider is known. - if ($IDS::Ruleset::Providers{$provider}) { - # Gather the download type for the given provider. - my $dl_type = $IDS::Ruleset::Providers{$provider}{'dl_type'}; + # Abort if the requested provider is not known. + return unless($IDS::Ruleset::Providers{$provider}); + # Try to gather the download type for the given provider. + my $dl_type = $IDS::Ruleset::Providers{$provider}{'dl_type'}; + + # Check if a download type could be grabbed. + if ($dl_type) { # Obtain the file suffix for the download file type. my $suffix = $dl_type_to_suffix{$dl_type}; diff --git a/config/rootfiles/oldcore/185/filelists/files b/config/rootfiles/oldcore/185/filelists/files index 750a006418..09ce838868 100644 --- a/config/rootfiles/oldcore/185/filelists/files +++ b/config/rootfiles/oldcore/185/filelists/files @@ -46,9 +46,12 @@ lib/firmware/nvidia/tegra186/vic.bin lib/firmware/nvidia/tegra210/vic.bin srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/dns.cgi +srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/index.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/time.cgi +usr/local/bin/update-ids-ruleset var/ipfire/backup/bin/backup.pl +var/ipfire/ids-functions.pl var/ipfire/main/manualpages var/ipfire/ovpn/openssl/ovpn.cnf diff --git a/config/rootfiles/oldcore/185/filelists/ids-ruleset-sources b/config/rootfiles/oldcore/185/filelists/ids-ruleset-sources new file mode 120000 index 0000000000..a226ada39b --- /dev/null +++ b/config/rootfiles/oldcore/185/filelists/ids-ruleset-sources @@ -0,0 +1 @@ +../../../common/ids-ruleset-sources \ No newline at end of file diff --git a/config/rootfiles/oldcore/185/update.sh b/config/rootfiles/oldcore/185/update.sh index 2c95c41028..ec4d8ab82b 100644 --- a/config/rootfiles/oldcore/185/update.sh +++ b/config/rootfiles/oldcore/185/update.sh @@ -115,6 +115,15 @@ mv /var/ipfire/ovpn/ovpnconfig.new /var/ipfire/ovpn/ovpnconfig # Set correct ownership chown nobody:nobody /var/ipfire/ovpn/ovpnconfig +# Check if the drop hostile in and out logging options need to be added +# into the optionsfw settings file and apply to firewall +if ! [ $(grep "LOGDROPHOSTILEIN=on" /var/ipfire/optionsfw/settings) ] && \ + ! [ $(grep "LOGDROPHOSTILEOUT=on" /var/ipfire/optionsfw/settings) ]; then + sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings + sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings + /usr/local/bin/firewallctrl +fi + # Rebuild initial ramdisks dracut --regenerate-all --force KVER="xxxKVERxxx" diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources index 2b3b4ffcb7..4e9ea5fa93 100644 --- a/config/suricata/ruleset-sources +++ b/config/suricata/ruleset-sources @@ -97,6 +97,34 @@ our %Providers = ( dl_type => "plain", }, + # Positive Technologies Attack Detection Team rules. + attack_detection => { + summary => "PT Attack Detection Team Rules", + website => "https://github.com/ptresearch/AttackDetection", + tr_string => "attack detection team rules", + }, + + # Secureworks Security rules. + secureworks_security => { + summary => "Secureworks Security Ruleset", + website => "https://www.secureworks.com", + tr_string => "secureworks security ruleset", + }, + + # Secureworks Malware rules. + secureworks_malware => { + summary => "Secureworks Malware Ruleset", + website => "https://www.secureworks.com", + tr_string => "secureworks malware ruleset", + }, + + # Secureworks Enhanced rules. + secureworks_enhanced => { + summary => "Secureworks Enhanced Ruleset", + website => "https://www.secureworks.com", + tr_string => "secureworks enhanced ruleset", + }, + # ThreatFox threatfox => { summary => "ThreatFox Indicators Of Compromise Rules", diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 369bf02760..edab971953 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -1162,6 +1162,7 @@ END my $subscription_code = $used_providers{$id}[1]; my $autoupdate_status = $used_providers{$id}[2]; my $status = $used_providers{$id}[3]; + my $unsupported; # Check if the item number is even or not. if ($line % 2) { @@ -1171,13 +1172,9 @@ END } # Handle providers which are not longer supported. - unless ($provider_name) { - # Set the provider name to the provider handle - # to display something helpful. - $provider_name = $provider; - - # Assign background color - $col="bgcolor='#FF4D4D'"; + unless ($IDS::Ruleset::Providers{$provider}{'dl_url'}) { + # Mark this provider as unsupported. + $unsupported = "<img src='/blob.gif' alt='*'>"; } # Choose icons for the checkboxes. @@ -1206,7 +1203,7 @@ END print <<END; <tr> - <td width='33%' class='base' $col>$provider_name</td> + <td width='33%' class='base' $col>$provider_name$unsupported</td> <td width='30%' class='base' $col>$rulesetdate</td> <td align='center' $col> @@ -1262,10 +1259,15 @@ print <<END; <hr> <br> - <div align='right'> - <table width='100%'> - <form method='post' action='$ENV{'SCRIPT_NAME'}'> - <tr> + <table width='100%'> + <form method='post' action='$ENV{'SCRIPT_NAME'}'> + <tr> + <td> +END + print "<img src='/blob.gif' alt='*'> $Lang::tr{'ids unsupported provider'}\n"; +print <<END; + </td> + <td><div align='right'> END # Only show this button if a ruleset provider is configured. @@ -1274,10 +1276,10 @@ END } print <<END; <input type='submit' name='PROVIDERS' value='$Lang::tr{'ids add provider'}'> - </tr> - </form> - </table> - </div> + </div></td> + </tr> + </form> + </table> END &Header::closebox(); @@ -1709,6 +1711,12 @@ END # Grab the provider handle. my $provider = $tmphash{$provider_name}; + # Check if we are not in edit mode. + if ($cgiparams{'PROVIDERS'} ne "$Lang::tr{'edit'}") { + # Skip unsupported ruleset provider. + next unless(exists($IDS::Ruleset::Providers{$provider}{"dl_url"})); + } + # Pre-select the provider if one is given. if (($used_providers{$cgiparams{'ID'}}[0] eq "$provider") || ($cgiparams{'PROVIDER'} eq "$provider")) { $selected{$provider} = "selected='selected'"; @@ -1809,7 +1817,7 @@ sub show_additional_provider_actions() { } # Disable the manual update button if the provider is not longer supported. - unless ($IDS::Ruleset::Providers{$provider}) { + unless ($IDS::Ruleset::Providers{$provider}{"dl_url"}) { $disabled_update = "disabled"; } diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index f13bddf4bc..b7b86fc7fc 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1416,6 +1416,7 @@ 'ids show' => 'Anzeigen', 'ids the choosen provider is already in use' => 'Der gewhählte Provider wird bereits verwendet.', 'ids unable to download the ruleset' => 'Das Regelset konnte nicht heruntergeladen werden.', +'ids unsupported provider' => 'Provider wird nicht mehr unterstützt', 'ids visit provider website' => 'Anbieter-Webseite besuchen', 'ids working' => 'Änderungen werden übernommen. Bitte warten Sie, bis dieser Vorgang erfolgreich beendet wurde.', 'iface' => 'Iface', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 84370d9f17..8e4ebf3f2d 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1467,6 +1467,7 @@ 'ids subscription code required' => 'The selected ruleset requires a subscription code', 'ids the choosen provider is already in use' => 'The choosen provider is already in use.', 'ids unable to download the ruleset' => 'Unable to download the ruleset', +'ids unsupported provider' => 'Provider is not supported anymore', 'ids visit provider website' => 'Visit provider website', 'ids working' => 'Changes are being applied. Please wait until all operations have completed successfully...', 'iface' => 'Iface', diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset index 553c1a1e1e..806107e1c2 100644 --- a/src/scripts/update-ids-ruleset +++ b/src/scripts/update-ids-ruleset @@ -106,7 +106,7 @@ foreach my $id (keys %providers) { my $autoupdate_status = $providers{$id}[3]; # Skip unsupported providers. - next unless($IDS::Ruleset::Providers{$provider}); + next unless($IDS::Ruleset::Providers{$provider}{'dl_url'}); # Skip the provider if it is not enabled. next unless($enabled_status eq "enabled"); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 08b7500b267a54aa634fb34b67b4dfc0934ae2be
by Michael Tremer 22 Mar '24

22 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 08b7500b267a54aa634fb34b67b4dfc0934ae2be (commit) from ad0d064a487c8912cbe4bd77ae652a4212e0fae9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 08b7500b267a54aa634fb34b67b4dfc0934ae2be Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Wed Mar 20 15:43:27 2024 +0100 CU185-update.sh: Add drop hostile in & out logging entries if not already present - This patch ensures that those people who updated to CU184 before the CU184-update.sh patch fix to add the logging entries was added will get their optionsfw settings file correctly updated with CU185 - This only adds the LOGDROPHOSTILEIN & LOGDROPHOSTILEOUT entries if they do noit already exist in the optionsfw settings file. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/185/update.sh | 9 +++++++++ 1 file changed, 9 insertions(+) Difference in files: diff --git a/config/rootfiles/core/185/update.sh b/config/rootfiles/core/185/update.sh index 2c95c4102..ec4d8ab82 100644 --- a/config/rootfiles/core/185/update.sh +++ b/config/rootfiles/core/185/update.sh @@ -115,6 +115,15 @@ mv /var/ipfire/ovpn/ovpnconfig.new /var/ipfire/ovpn/ovpnconfig # Set correct ownership chown nobody:nobody /var/ipfire/ovpn/ovpnconfig +# Check if the drop hostile in and out logging options need to be added +# into the optionsfw settings file and apply to firewall +if ! [ $(grep "LOGDROPHOSTILEIN=on" /var/ipfire/optionsfw/settings) ] && \ + ! [ $(grep "LOGDROPHOSTILEOUT=on" /var/ipfire/optionsfw/settings) ]; then + sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings + sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings + /usr/local/bin/firewallctrl +fi + # Rebuild initial ramdisks dracut --regenerate-all --force KVER="xxxKVERxxx" hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. ad0d064a487c8912cbe4bd77ae652a4212e0fae9
by Michael Tremer 22 Mar '24

22 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via ad0d064a487c8912cbe4bd77ae652a4212e0fae9 (commit) via 4e8225a778f838dadc530759b9341fc9dbf5d534 (commit) via cf6eaba833abee235fffdf377a0d6379a0ff8406 (commit) via 563e4a4298b881d612a14994d90bbb7503e1d754 (commit) via 0842e694a6b577843362ea6b854d336b867d6f00 (commit) via df7977fde7dec9516036afd8b687acab9f034bf4 (commit) via 738ee720275e56bd6fff06b2b53730f903dd02df (commit) from 0564584a5887b7498ae9ea638bc4799d2a6147e8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ad0d064a487c8912cbe4bd77ae652a4212e0fae9 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Mar 22 06:01:45 2024 +0100 ids.cgi: Improve add provider logic Do not longer add unsupported/removed providers as an option when adding a new/first ruleset provider. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4e8225a778f838dadc530759b9341fc9dbf5d534 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Mar 22 15:29:22 2024 +0000 core185: Ship IPS files Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit cf6eaba833abee235fffdf377a0d6379a0ff8406 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Mar 21 21:51:18 2024 +0100 ids.cgi: Adjust code for marking unsupported providers Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 563e4a4298b881d612a14994d90bbb7503e1d754 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Mar 21 21:51:17 2024 +0100 ruleset-sources: Restore generic details about recently dropped providers At least these informations are required to display something usefull on the webgui, even if a provider has been dropped. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0842e694a6b577843362ea6b854d336b867d6f00 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Mar 21 21:51:16 2024 +0100 update-ids-ruleset: Disable provider if not dl_url can be obtained Unsupported/Removed provides does not longer have these information Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit df7977fde7dec9516036afd8b687acab9f034bf4 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Mar 21 21:51:15 2024 +0100 ids.cgi: Change check if a provider is not longer supported This check is now based on a download URL instead of checking if an entry in the ruleset sources is present. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 738ee720275e56bd6fff06b2b53730f903dd02df Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Mar 21 21:51:14 2024 +0100 ids-functions.pl: Improve logic to get the cached rulesfile of a provider Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/ids-functions.pl | 11 +++++--- config/rootfiles/core/185/filelists/files | 3 +++ config/suricata/ruleset-sources | 28 +++++++++++++++++++++ html/cgi-bin/ids.cgi | 42 ++++++++++++++++++------------- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + src/scripts/update-ids-ruleset | 2 +- 7 files changed, 66 insertions(+), 22 deletions(-) Difference in files: diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index d97431b4a3..c29a5151f9 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -1027,11 +1027,14 @@ sub _store_error_message ($) { sub _get_dl_rulesfile($) { my ($provider) = @_; - # Check if the requested provider is known. - if ($IDS::Ruleset::Providers{$provider}) { - # Gather the download type for the given provider. - my $dl_type = $IDS::Ruleset::Providers{$provider}{'dl_type'}; + # Abort if the requested provider is not known. + return unless($IDS::Ruleset::Providers{$provider}); + # Try to gather the download type for the given provider. + my $dl_type = $IDS::Ruleset::Providers{$provider}{'dl_type'}; + + # Check if a download type could be grabbed. + if ($dl_type) { # Obtain the file suffix for the download file type. my $suffix = $dl_type_to_suffix{$dl_type}; diff --git a/config/rootfiles/core/185/filelists/files b/config/rootfiles/core/185/filelists/files index 750a006418..09ce838868 100644 --- a/config/rootfiles/core/185/filelists/files +++ b/config/rootfiles/core/185/filelists/files @@ -46,9 +46,12 @@ lib/firmware/nvidia/tegra186/vic.bin lib/firmware/nvidia/tegra210/vic.bin srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/dns.cgi +srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/index.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/time.cgi +usr/local/bin/update-ids-ruleset var/ipfire/backup/bin/backup.pl +var/ipfire/ids-functions.pl var/ipfire/main/manualpages var/ipfire/ovpn/openssl/ovpn.cnf diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources index 2b3b4ffcb7..4e9ea5fa93 100644 --- a/config/suricata/ruleset-sources +++ b/config/suricata/ruleset-sources @@ -97,6 +97,34 @@ our %Providers = ( dl_type => "plain", }, + # Positive Technologies Attack Detection Team rules. + attack_detection => { + summary => "PT Attack Detection Team Rules", + website => "https://github.com/ptresearch/AttackDetection", + tr_string => "attack detection team rules", + }, + + # Secureworks Security rules. + secureworks_security => { + summary => "Secureworks Security Ruleset", + website => "https://www.secureworks.com", + tr_string => "secureworks security ruleset", + }, + + # Secureworks Malware rules. + secureworks_malware => { + summary => "Secureworks Malware Ruleset", + website => "https://www.secureworks.com", + tr_string => "secureworks malware ruleset", + }, + + # Secureworks Enhanced rules. + secureworks_enhanced => { + summary => "Secureworks Enhanced Ruleset", + website => "https://www.secureworks.com", + tr_string => "secureworks enhanced ruleset", + }, + # ThreatFox threatfox => { summary => "ThreatFox Indicators Of Compromise Rules", diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 369bf02760..edab971953 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -1162,6 +1162,7 @@ END my $subscription_code = $used_providers{$id}[1]; my $autoupdate_status = $used_providers{$id}[2]; my $status = $used_providers{$id}[3]; + my $unsupported; # Check if the item number is even or not. if ($line % 2) { @@ -1171,13 +1172,9 @@ END } # Handle providers which are not longer supported. - unless ($provider_name) { - # Set the provider name to the provider handle - # to display something helpful. - $provider_name = $provider; - - # Assign background color - $col="bgcolor='#FF4D4D'"; + unless ($IDS::Ruleset::Providers{$provider}{'dl_url'}) { + # Mark this provider as unsupported. + $unsupported = "<img src='/blob.gif' alt='*'>"; } # Choose icons for the checkboxes. @@ -1206,7 +1203,7 @@ END print <<END; <tr> - <td width='33%' class='base' $col>$provider_name</td> + <td width='33%' class='base' $col>$provider_name$unsupported</td> <td width='30%' class='base' $col>$rulesetdate</td> <td align='center' $col> @@ -1262,10 +1259,15 @@ print <<END; <hr> <br> - <div align='right'> - <table width='100%'> - <form method='post' action='$ENV{'SCRIPT_NAME'}'> - <tr> + <table width='100%'> + <form method='post' action='$ENV{'SCRIPT_NAME'}'> + <tr> + <td> +END + print "<img src='/blob.gif' alt='*'> $Lang::tr{'ids unsupported provider'}\n"; +print <<END; + </td> + <td><div align='right'> END # Only show this button if a ruleset provider is configured. @@ -1274,10 +1276,10 @@ END } print <<END; <input type='submit' name='PROVIDERS' value='$Lang::tr{'ids add provider'}'> - </tr> - </form> - </table> - </div> + </div></td> + </tr> + </form> + </table> END &Header::closebox(); @@ -1709,6 +1711,12 @@ END # Grab the provider handle. my $provider = $tmphash{$provider_name}; + # Check if we are not in edit mode. + if ($cgiparams{'PROVIDERS'} ne "$Lang::tr{'edit'}") { + # Skip unsupported ruleset provider. + next unless(exists($IDS::Ruleset::Providers{$provider}{"dl_url"})); + } + # Pre-select the provider if one is given. if (($used_providers{$cgiparams{'ID'}}[0] eq "$provider") || ($cgiparams{'PROVIDER'} eq "$provider")) { $selected{$provider} = "selected='selected'"; @@ -1809,7 +1817,7 @@ sub show_additional_provider_actions() { } # Disable the manual update button if the provider is not longer supported. - unless ($IDS::Ruleset::Providers{$provider}) { + unless ($IDS::Ruleset::Providers{$provider}{"dl_url"}) { $disabled_update = "disabled"; } diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index f13bddf4bc..b7b86fc7fc 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1416,6 +1416,7 @@ 'ids show' => 'Anzeigen', 'ids the choosen provider is already in use' => 'Der gewhählte Provider wird bereits verwendet.', 'ids unable to download the ruleset' => 'Das Regelset konnte nicht heruntergeladen werden.', +'ids unsupported provider' => 'Provider wird nicht mehr unterstützt', 'ids visit provider website' => 'Anbieter-Webseite besuchen', 'ids working' => 'Änderungen werden übernommen. Bitte warten Sie, bis dieser Vorgang erfolgreich beendet wurde.', 'iface' => 'Iface', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 0113f8811f..8e50aba767 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1467,6 +1467,7 @@ 'ids subscription code required' => 'The selected ruleset requires a subscription code', 'ids the choosen provider is already in use' => 'The choosen provider is already in use.', 'ids unable to download the ruleset' => 'Unable to download the ruleset', +'ids unsupported provider' => 'Provider is not supported anymore', 'ids visit provider website' => 'Visit provider website', 'ids working' => 'Changes are being applied. Please wait until all operations have completed successfully...', 'iface' => 'Iface', diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset index 553c1a1e1e..806107e1c2 100644 --- a/src/scripts/update-ids-ruleset +++ b/src/scripts/update-ids-ruleset @@ -106,7 +106,7 @@ foreach my $id (keys %providers) { my $autoupdate_status = $providers{$id}[3]; # Skip unsupported providers. - next unless($IDS::Ruleset::Providers{$provider}); + next unless($IDS::Ruleset::Providers{$provider}{'dl_url'}); # Skip the provider if it is not enabled. next unless($enabled_status eq "enabled"); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6581c6e3a6c28e040c2bbaae21f1f5c926d4b840
by Arne Fitzenreiter 22 Mar '24

22 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 6581c6e3a6c28e040c2bbaae21f1f5c926d4b840 (commit) from 790c04a6eaafcf695315dcd3f4f39ec6b35be48c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6581c6e3a6c28e040c2bbaae21f1f5c926d4b840 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Mar 22 11:58:49 2024 +0100 kernel: update aarch64 rootfile Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/aarch64/linux | 1 + 1 file changed, 1 insertion(+) Difference in files: diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 3dcacfd4d..57c93f242 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -23220,6 +23220,7 @@ lib/modules/KVER-ipfire/modules.symbols.bin sbin/gen_init_cpio #usr/bin/cpufreq-bench_plot.sh usr/bin/cpupower +#usr/include/cpufreq.h #usr/include/cpuidle.h #usr/include/powercap.h #usr/lib/libcpupower.so hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 790c04a6eaafcf695315dcd3f4f39ec6b35be48c
by Arne Fitzenreiter 22 Mar '24

22 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 790c04a6eaafcf695315dcd3f4f39ec6b35be48c (commit) via 24d23a7053c6565606f5e9834a1def8a57d75617 (commit) via 28796e09e5e5997d2ee9e11e3de7ca4b139d4c11 (commit) via 77bae935e6f5823d1527f5d97959c97b737e3379 (commit) via 81986d40a9acfcdc1658beae925052f4464191df (commit) from 08d869d54f4903593992d7aee2ef17d79d235108 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 790c04a6eaafcf695315dcd3f4f39ec6b35be48c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Mar 22 06:39:34 2024 +0100 core186: start update Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 24d23a7053c6565606f5e9834a1def8a57d75617 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 21 19:12:14 2024 +0100 vulnerabilities.cgi: add RFDS (CVE-2ß23-28746) to list Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 28796e09e5e5997d2ee9e11e3de7ca4b139d4c11 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Mar 20 17:28:43 2024 +0100 kernel: update to 6.6.22 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 77bae935e6f5823d1527f5d97959c97b737e3379 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Mar 20 09:28:51 2024 +0100 cpufrequtils: remove cpufrequtils the only file in the package is now the initskript to configre powersave mode using cpupower which is shipped with the kernel. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 81986d40a9acfcdc1658beae925052f4464191df Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Mar 20 09:27:50 2024 +0100 kernel: build cpupower cpupower replace the function of cpufrequtils which is not updated since years. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/kernel/kernel.config.aarch64-ipfire | 8 ++-- config/kernel/kernel.config.x86_64-ipfire | 9 +++-- config/rootfiles/common/aarch64/linux | 31 +++++++++++++++ config/rootfiles/common/riscv64/linux | 29 ++++++++++++++ config/rootfiles/common/x86_64/linux | 33 ++++++++++++++++ config/rootfiles/core/{185 => 186}/exclude | 0 .../124 => core/186}/filelists/aarch64/linux | 0 .../core/{185 => 186}/filelists/core-files | 0 .../{oldcore/178 => core/186}/filelists/files | 1 - .../181 => core/186}/filelists/riscv64/linux | 0 .../100 => core/186}/filelists/x86_64/linux | 0 .../rootfiles/{oldcore/178 => core/186}/update.sh | 30 ++++++--------- config/rootfiles/{core => oldcore}/185/exclude | 0 .../185/filelists/aarch64/binutils | 0 .../{core => oldcore}/185/filelists/aarch64/glibc | 0 .../185/filelists/aarch64/util-linux | 0 .../{core => oldcore}/185/filelists/arping | 0 .../rootfiles/{core => oldcore}/185/filelists/bind | 0 .../185/filelists/ca-certificates | 0 .../{core => oldcore}/185/filelists/core-files | 0 .../{core => oldcore}/185/filelists/elfutils | 0 .../{core => oldcore}/185/filelists/ethtool | 0 .../{core => oldcore}/185/filelists/expat | 0 .../{core => oldcore}/185/filelists/files | 0 .../{core => oldcore}/185/filelists/iproute2 | 0 .../{core => oldcore}/185/filelists/iputils | 0 .../rootfiles/{core => oldcore}/185/filelists/knot | 0 .../{core => oldcore}/185/filelists/libcap | 0 .../{core => oldcore}/185/filelists/libffi | 0 .../{core => oldcore}/185/filelists/libgpg-error | 0 .../{core => oldcore}/185/filelists/libhtp | 0 .../{core => oldcore}/185/filelists/libpng | 0 .../rootfiles/{core => oldcore}/185/filelists/newt | 0 .../rootfiles/{core => oldcore}/185/filelists/ntp | 0 .../{core => oldcore}/185/filelists/openjpeg | 0 .../{core => oldcore}/185/filelists/openssh | 0 .../{core => oldcore}/185/filelists/pango | 0 .../{core => oldcore}/185/filelists/pciutils | 0 .../{core => oldcore}/185/filelists/pixman | 0 .../{core => oldcore}/185/filelists/poppler | 0 .../rootfiles/{core => oldcore}/185/filelists/ppp | 0 .../rootfiles/{core => oldcore}/185/filelists/qpdf | 0 .../185/filelists/riscv64/binutils | 0 .../{core => oldcore}/185/filelists/riscv64/glibc | 0 .../185/filelists/riscv64/util-linux | 0 .../{core => oldcore}/185/filelists/shadow | 0 .../{core => oldcore}/185/filelists/sqlite | 0 .../{core => oldcore}/185/filelists/squid | 0 .../{core => oldcore}/185/filelists/suricata | 0 .../rootfiles/{core => oldcore}/185/filelists/tcl | 0 .../{core => oldcore}/185/filelists/unbound | 0 .../rootfiles/{core => oldcore}/185/filelists/wget | 0 .../{core => oldcore}/185/filelists/whois | 0 .../185/filelists/x86_64/binutils | 0 .../{core => oldcore}/185/filelists/x86_64/glibc | 0 .../185/filelists/x86_64/intel-microcode | 0 .../185/filelists/x86_64/util-linux | 0 .../rootfiles/{core => oldcore}/185/filelists/xz | 0 config/rootfiles/{core => oldcore}/185/update.sh | 0 config/rootfiles/packages/cpufrequtils | 16 -------- html/cgi-bin/vulnerabilities.cgi | 1 + langs/en/cgi-bin/en.pl | 1 + lfs/cpufrequtils | 44 ++++------------------ lfs/linux | 9 ++++- make.sh | 2 +- src/initscripts/packages/cpufreq | 11 +----- 66 files changed, 133 insertions(+), 92 deletions(-) copy config/rootfiles/core/{185 => 186}/exclude (100%) copy config/rootfiles/{oldcore/124 => core/186}/filelists/aarch64/linux (100%) copy config/rootfiles/core/{185 => 186}/filelists/core-files (100%) copy config/rootfiles/{oldcore/178 => core/186}/filelists/files (68%) copy config/rootfiles/{oldcore/181 => core/186}/filelists/riscv64/linux (100%) copy config/rootfiles/{oldcore/100 => core/186}/filelists/x86_64/linux (100%) copy config/rootfiles/{oldcore/178 => core/186}/update.sh (88%) rename config/rootfiles/{core => oldcore}/185/exclude (100%) rename config/rootfiles/{core => oldcore}/185/filelists/aarch64/binutils (100%) rename config/rootfiles/{core => oldcore}/185/filelists/aarch64/glibc (100%) rename config/rootfiles/{core => oldcore}/185/filelists/aarch64/util-linux (100%) rename config/rootfiles/{core => oldcore}/185/filelists/arping (100%) rename config/rootfiles/{core => oldcore}/185/filelists/bind (100%) rename config/rootfiles/{core => oldcore}/185/filelists/ca-certificates (100%) rename config/rootfiles/{core => oldcore}/185/filelists/core-files (100%) rename config/rootfiles/{core => oldcore}/185/filelists/elfutils (100%) rename config/rootfiles/{core => oldcore}/185/filelists/ethtool (100%) rename config/rootfiles/{core => oldcore}/185/filelists/expat (100%) rename config/rootfiles/{core => oldcore}/185/filelists/files (100%) rename config/rootfiles/{core => oldcore}/185/filelists/iproute2 (100%) rename config/rootfiles/{core => oldcore}/185/filelists/iputils (100%) rename config/rootfiles/{core => oldcore}/185/filelists/knot (100%) rename config/rootfiles/{core => oldcore}/185/filelists/libcap (100%) rename config/rootfiles/{core => oldcore}/185/filelists/libffi (100%) rename config/rootfiles/{core => oldcore}/185/filelists/libgpg-error (100%) rename config/rootfiles/{core => oldcore}/185/filelists/libhtp (100%) rename config/rootfiles/{core => oldcore}/185/filelists/libpng (100%) rename config/rootfiles/{core => oldcore}/185/filelists/newt (100%) rename config/rootfiles/{core => oldcore}/185/filelists/ntp (100%) rename config/rootfiles/{core => oldcore}/185/filelists/openjpeg (100%) rename config/rootfiles/{core => oldcore}/185/filelists/openssh (100%) rename config/rootfiles/{core => oldcore}/185/filelists/pango (100%) rename config/rootfiles/{core => oldcore}/185/filelists/pciutils (100%) rename config/rootfiles/{core => oldcore}/185/filelists/pixman (100%) rename config/rootfiles/{core => oldcore}/185/filelists/poppler (100%) rename config/rootfiles/{core => oldcore}/185/filelists/ppp (100%) rename config/rootfiles/{core => oldcore}/185/filelists/qpdf (100%) rename config/rootfiles/{core => oldcore}/185/filelists/riscv64/binutils (100%) rename config/rootfiles/{core => oldcore}/185/filelists/riscv64/glibc (100%) rename config/rootfiles/{core => oldcore}/185/filelists/riscv64/util-linux (100%) rename config/rootfiles/{core => oldcore}/185/filelists/shadow (100%) rename config/rootfiles/{core => oldcore}/185/filelists/sqlite (100%) rename config/rootfiles/{core => oldcore}/185/filelists/squid (100%) rename config/rootfiles/{core => oldcore}/185/filelists/suricata (100%) rename config/rootfiles/{core => oldcore}/185/filelists/tcl (100%) rename config/rootfiles/{core => oldcore}/185/filelists/unbound (100%) rename config/rootfiles/{core => oldcore}/185/filelists/wget (100%) rename config/rootfiles/{core => oldcore}/185/filelists/whois (100%) rename config/rootfiles/{core => oldcore}/185/filelists/x86_64/binutils (100%) rename config/rootfiles/{core => oldcore}/185/filelists/x86_64/glibc (100%) rename config/rootfiles/{core => oldcore}/185/filelists/x86_64/intel-microcode (100%) rename config/rootfiles/{core => oldcore}/185/filelists/x86_64/util-linux (100%) rename config/rootfiles/{core => oldcore}/185/filelists/xz (100%) rename config/rootfiles/{core => oldcore}/185/update.sh (100%) Difference in files: diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 04d65d6ce8..11a3ef593d 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,20 +1,21 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.6.15-ipfire Kernel Configuration +# Linux/arm64 6.6.22-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0" CONFIG_CC_IS_GCC=y CONFIG_GCC_VERSION=130200 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y -CONFIG_AS_VERSION=24100 +CONFIG_AS_VERSION=24200 CONFIG_LD_IS_BFD=y -CONFIG_LD_VERSION=24100 +CONFIG_LD_VERSION=24200 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y CONFIG_PAHOLE_VERSION=0 @@ -4556,7 +4557,6 @@ CONFIG_MFD_SM501_GPIO=y # CONFIG_MFD_STMPE is not set CONFIG_MFD_SUN6I_PRCM=y CONFIG_MFD_SYSCON=y -# CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_LP8788 is not set # CONFIG_MFD_TI_LMU is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 79375e954d..319aa2effc 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,20 +1,21 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.6.15-ipfire Kernel Configuration +# Linux/x86 6.6.22-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0" CONFIG_CC_IS_GCC=y CONFIG_GCC_VERSION=130200 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y -CONFIG_AS_VERSION=24100 +CONFIG_AS_VERSION=24200 CONFIG_LD_IS_BFD=y -CONFIG_LD_VERSION=24100 +CONFIG_LD_VERSION=24200 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y @@ -508,6 +509,7 @@ CONFIG_CPU_IBRS_ENTRY=y CONFIG_CPU_SRSO=y CONFIG_SLS=y # CONFIG_GDS_FORCE_MITIGATION is not set +CONFIG_MITIGATION_RFDS=y CONFIG_ARCH_HAS_ADD_PAGES=y # @@ -4402,7 +4404,6 @@ CONFIG_MFD_SM501=m CONFIG_MFD_SM501_GPIO=y # CONFIG_MFD_SKY81452 is not set CONFIG_MFD_SYSCON=y -# CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_TI_LMU is not set # CONFIG_TPS6105X is not set diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 92c4a4286c..3dcacfd4da 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -442,6 +442,7 @@ boot/dtb-KVER-ipfire #boot/dtb-KVER-ipfire/synaptics/berlin4ct-dmp.dtb #boot/dtb-KVER-ipfire/synaptics/berlin4ct-stb.dtb boot/vmlinuz-KVER-ipfire +#etc/cpufreq-bench.conf etc/modprobe.d/framebuffer.conf etc/modprobe.d/ipv6.conf #lib/modules @@ -8507,6 +8508,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/GACT_PROB #lib/modules/KVER-ipfire/build/include/config/GARP #lib/modules/KVER-ipfire/build/include/config/GCC11_NO_ARRAY_BOUNDS +#lib/modules/KVER-ipfire/build/include/config/GCC_ASM_GOTO_OUTPUT_WORKAROUND #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGINS #lib/modules/KVER-ipfire/build/include/config/GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS #lib/modules/KVER-ipfire/build/include/config/GCC_VERSION @@ -12463,6 +12465,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/at91.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/axi-dmac.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/dw-dmac.h +#lib/modules/KVER-ipfire/build/include/dt-bindings/dma/fsl-edma.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/jz4775-dma.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/jz4780-dma.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/nbpfaxi.h @@ -23215,3 +23218,31 @@ lib/modules/KVER-ipfire/modules.symbols lib/modules/KVER-ipfire/modules.symbols.bin #lib/modules/KVER-ipfire/source sbin/gen_init_cpio +#usr/bin/cpufreq-bench_plot.sh +usr/bin/cpupower +#usr/include/cpuidle.h +#usr/include/powercap.h +#usr/lib/libcpupower.so +usr/lib/libcpupower.so.0.0.1 +usr/lib/libcpupower.so.1 +#usr/man/man1/cpupower-frequency-info.1 +#usr/man/man1/cpupower-frequency-set.1 +#usr/man/man1/cpupower-idle-info.1 +#usr/man/man1/cpupower-idle-set.1 +#usr/man/man1/cpupower-info.1 +#usr/man/man1/cpupower-monitor.1 +#usr/man/man1/cpupower-powercap-info.1 +#usr/man/man1/cpupower-set.1 +#usr/man/man1/cpupower.1 +#usr/sbin/cpufreq-bench +#usr/share/bash-completion/completions/cpupower +#usr/share/doc/packages +#usr/share/doc/packages/cpupower +#usr/share/doc/packages/cpupower/README-BENCH +#usr/share/doc/packages/cpupower/cpufreq-bench_script.sh +#usr/share/locale/cs/LC_MESSAGES/cpupower.mo +#usr/share/locale/de/LC_MESSAGES/cpupower.mo +#usr/share/locale/fr/LC_MESSAGES/cpupower.mo +#usr/share/locale/it/LC_MESSAGES/cpupower.mo +#usr/share/locale/ka/LC_MESSAGES/cpupower.mo +#usr/share/locale/pt/LC_MESSAGES/cpupower.mo diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux index 5e1ac921cb..0955b0882c 100644 --- a/config/rootfiles/common/riscv64/linux +++ b/config/rootfiles/common/riscv64/linux @@ -16,6 +16,7 @@ boot/dtb-KVER-ipfire #boot/dtb-KVER-ipfire/starfive/jh7110-starfive-visionfive-2-v1.2a.dtb #boot/dtb-KVER-ipfire/starfive/jh7110-starfive-visionfive-2-v1.3b.dtb boot/vmlinuz-KVER-ipfire +#etc/cpufreq-bench.conf etc/modprobe.d/framebuffer.conf etc/modprobe.d/ipv6.conf #lib/modules @@ -22462,3 +22463,31 @@ lib/modules/KVER-ipfire/modules.symbols lib/modules/KVER-ipfire/modules.symbols.bin #lib/modules/KVER-ipfire/source sbin/gen_init_cpio +#usr/bin/cpufreq-bench_plot.sh +usr/bin/cpupower +#usr/include/cpuidle.h +#usr/include/powercap.h +#usr/lib/libcpupower.so +usr/lib/libcpupower.so.0.0.1 +usr/lib/libcpupower.so.1 +#usr/man/man1/cpupower-frequency-info.1 +#usr/man/man1/cpupower-frequency-set.1 +#usr/man/man1/cpupower-idle-info.1 +#usr/man/man1/cpupower-idle-set.1 +#usr/man/man1/cpupower-info.1 +#usr/man/man1/cpupower-monitor.1 +#usr/man/man1/cpupower-powercap-info.1 +#usr/man/man1/cpupower-set.1 +#usr/man/man1/cpupower.1 +#usr/sbin/cpufreq-bench +#usr/share/bash-completion/completions/cpupower +#usr/share/doc/packages +#usr/share/doc/packages/cpupower +#usr/share/doc/packages/cpupower/README-BENCH +#usr/share/doc/packages/cpupower/cpufreq-bench_script.sh +#usr/share/locale/cs/LC_MESSAGES/cpupower.mo +#usr/share/locale/de/LC_MESSAGES/cpupower.mo +#usr/share/locale/fr/LC_MESSAGES/cpupower.mo +#usr/share/locale/it/LC_MESSAGES/cpupower.mo +#usr/share/locale/ka/LC_MESSAGES/cpupower.mo +#usr/share/locale/pt/LC_MESSAGES/cpupower.mo diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index f3a8dea19c..be499ef5f3 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -1,6 +1,7 @@ boot/System.map-KVER-ipfire boot/config-KVER-ipfire boot/vmlinuz-KVER-ipfire +#etc/cpufreq-bench.conf etc/modprobe.d/framebuffer.conf etc/modprobe.d/ipv6.conf #lib/modules @@ -8191,6 +8192,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/GACT_PROB #lib/modules/KVER-ipfire/build/include/config/GARP #lib/modules/KVER-ipfire/build/include/config/GCC11_NO_ARRAY_BOUNDS +#lib/modules/KVER-ipfire/build/include/config/GCC_ASM_GOTO_OUTPUT_WORKAROUND #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGINS #lib/modules/KVER-ipfire/build/include/config/GCC_VERSION #lib/modules/KVER-ipfire/build/include/config/GENERIC_ALLOCATOR @@ -9202,6 +9204,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/MISC_RTSX #lib/modules/KVER-ipfire/build/include/config/MISC_RTSX_PCI #lib/modules/KVER-ipfire/build/include/config/MISC_RTSX_USB +#lib/modules/KVER-ipfire/build/include/config/MITIGATION_RFDS #lib/modules/KVER-ipfire/build/include/config/MLX4_CORE #lib/modules/KVER-ipfire/build/include/config/MLX4_CORE_GEN2 #lib/modules/KVER-ipfire/build/include/config/MLX4_EN @@ -12482,6 +12485,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/at91.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/axi-dmac.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/dw-dmac.h +#lib/modules/KVER-ipfire/build/include/dt-bindings/dma/fsl-edma.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/jz4775-dma.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/jz4780-dma.h #lib/modules/KVER-ipfire/build/include/dt-bindings/dma/nbpfaxi.h @@ -23699,3 +23703,32 @@ lib/modules/KVER-ipfire/modules.symbols lib/modules/KVER-ipfire/modules.symbols.bin #lib/modules/KVER-ipfire/source sbin/gen_init_cpio +#usr/bin/cpufreq-bench_plot.sh +usr/bin/cpupower +#usr/include/cpufreq.h +#usr/include/cpuidle.h +#usr/include/powercap.h +#usr/lib/libcpupower.so +usr/lib/libcpupower.so.0.0.1 +usr/lib/libcpupower.so.1 +#usr/man/man1/cpupower-frequency-info.1 +#usr/man/man1/cpupower-frequency-set.1 +#usr/man/man1/cpupower-idle-info.1 +#usr/man/man1/cpupower-idle-set.1 +#usr/man/man1/cpupower-info.1 +#usr/man/man1/cpupower-monitor.1 +#usr/man/man1/cpupower-powercap-info.1 +#usr/man/man1/cpupower-set.1 +#usr/man/man1/cpupower.1 +#usr/sbin/cpufreq-bench +#usr/share/bash-completion/completions/cpupower +#usr/share/doc/packages +#usr/share/doc/packages/cpupower +#usr/share/doc/packages/cpupower/README-BENCH +#usr/share/doc/packages/cpupower/cpufreq-bench_script.sh +#usr/share/locale/cs/LC_MESSAGES/cpupower.mo +#usr/share/locale/de/LC_MESSAGES/cpupower.mo +#usr/share/locale/fr/LC_MESSAGES/cpupower.mo +#usr/share/locale/it/LC_MESSAGES/cpupower.mo +#usr/share/locale/ka/LC_MESSAGES/cpupower.mo +#usr/share/locale/pt/LC_MESSAGES/cpupower.mo diff --git a/config/rootfiles/core/185/exclude b/config/rootfiles/core/186/exclude similarity index 100% rename from config/rootfiles/core/185/exclude rename to config/rootfiles/core/186/exclude diff --git a/config/rootfiles/core/186/filelists/aarch64/linux b/config/rootfiles/core/186/filelists/aarch64/linux new file mode 120000 index 0000000000..3a2532bc7d --- /dev/null +++ b/config/rootfiles/core/186/filelists/aarch64/linux @@ -0,0 +1 @@ +../../../../common/aarch64/linux \ No newline at end of file diff --git a/config/rootfiles/core/185/filelists/core-files b/config/rootfiles/core/186/filelists/core-files similarity index 100% rename from config/rootfiles/core/185/filelists/core-files rename to config/rootfiles/core/186/filelists/core-files diff --git a/config/rootfiles/core/186/filelists/files b/config/rootfiles/core/186/filelists/files new file mode 100644 index 0000000000..00198bcc3e --- /dev/null +++ b/config/rootfiles/core/186/filelists/files @@ -0,0 +1 @@ +srv/web/ipfire/cgi-bin/vulnerabilities.cgi diff --git a/config/rootfiles/core/186/filelists/riscv64/linux b/config/rootfiles/core/186/filelists/riscv64/linux new file mode 120000 index 0000000000..c8e8350ca6 --- /dev/null +++ b/config/rootfiles/core/186/filelists/riscv64/linux @@ -0,0 +1 @@ +../../../../common/riscv64/linux \ No newline at end of file diff --git a/config/rootfiles/core/186/filelists/x86_64/linux b/config/rootfiles/core/186/filelists/x86_64/linux new file mode 120000 index 0000000000..0615b5b9ad --- /dev/null +++ b/config/rootfiles/core/186/filelists/x86_64/linux @@ -0,0 +1 @@ +../../../../common/x86_64/linux \ No newline at end of file diff --git a/config/rootfiles/core/186/update.sh b/config/rootfiles/core/186/update.sh new file mode 100644 index 0000000000..d79a35133d --- /dev/null +++ b/config/rootfiles/core/186/update.sh @@ -0,0 +1,141 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 3 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2024 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +/usr/local/bin/backupctrl exclude >/dev/null 2>&1 + +core=186 + +exit_with_error() { + # Set last succesfull installed core. + echo $(($core-1)) > /opt/pakfire/db/core/mine + # force fsck at next boot, this may fix free space on xfs + touch /forcefsck + # don't start pakfire again at error + killall -KILL pak_update + /usr/bin/logger -p syslog.emerg -t ipfire \ + "core-update-${core}: $1" + exit $2 +} + +# Remove old core updates from pakfire cache to save space... +for (( i=1; i<=$core; i++ )); do + rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire +done + +# Stop services + +KVER="xxxKVERxxx" + +# Backup uEnv.txt if exist +if [ -e /boot/uEnv.txt ]; then + cp -vf /boot/uEnv.txt /boot/uEnv.txt.org +fi + +# Do some sanity checks prior to the kernel update +case $(uname -r) in + *-ipfire*) + # Ok. + ;; + *) + exit_with_error "ERROR cannot update. No IPFire Kernel." 1 + ;; +esac + +# Check diskspace on root and size of boot +ROOTSPACE=$( df / -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1 ) +if [ $ROOTSPACE -lt 200000 ]; then + exit_with_error "ERROR cannot update because not enough free space on root." 2 +fi +BOOTSIZE=$( df /boot -Pk | sed "s| * | |g" | cut -d" " -f2 | tail -n 1 ) +if [ $BOOTSIZE -lt 100000 ]; then + exit_with_error "ERROR cannot update. BOOT partition is to small." 3 +fi + +# Remove the old kernel +rm -rvf \ + /boot/System.map-* \ + /boot/config-* \ + /boot/ipfirerd-* \ + /boot/initramfs-* \ + /boot/vmlinuz-* \ + /boot/uImage-* \ + /boot/zImage-* \ + /boot/uInit-* \ + /boot/dtb-* \ + /lib/modules + +# Extract files +extract_files + +# Remove files +#rm -rvf \ +# /XXX + +# update linker config +ldconfig + +# Update Language cache +/usr/local/bin/update-lang-cache + +# Filesytem cleanup +/usr/local/bin/filesystem-cleanup + +# Start services + +# Build initial ramdisks +dracut --regenerate-all --force +KVER="xxxKVERxxx" +case "$(uname -m)" in + aarch64) + mkimage -A arm64 -T ramdisk -C lzma -d /boot/initramfs-${KVER}-ipfire.img /boot/uInit-${KVER}-ipfire + # dont remove initramfs because grub need this to boot. + ;; +esac + +# Upadate Kernel version in uEnv.txt +if [ -e /boot/uEnv.txt ]; then + sed -i -e "s/KVER=.*/KVER=${KVER}/g" /boot/uEnv.txt +fi + +# Call user update script (needed for some ARM boards) +if [ -e /boot/pakfire-kernel-update ]; then + /boot/pakfire-kernel-update ${KVER} +fi + +# This update needs a reboot... +touch /var/run/need_reboot + +# Finish +/etc/init.d/fireinfo start +sendprofile + +# Update grub config to display new core version +if [ -e /boot/grub/grub.cfg ]; then + /usr/bin/install-bootloader +fi + +sync + +# Don't report the exitcode last command +exit 0 diff --git a/config/rootfiles/oldcore/185/exclude b/config/rootfiles/oldcore/185/exclude new file mode 100644 index 0000000000..8ee1c3c2f5 --- /dev/null +++ b/config/rootfiles/oldcore/185/exclude @@ -0,0 +1,35 @@ +boot/config.txt +boot/grub/grub.cfg +boot/grub/grubenv +boot/uEnv.txt +etc/alternatives +etc/collectd.custom +etc/default/grub +etc/ipsec.conf +etc/ipsec.secrets +etc/ipsec.user.conf +etc/ipsec.user.secrets +etc/localtime +etc/shadow +etc/snort/snort.conf +etc/ssl/openssl.cnf +etc/sudoers +etc/sysconfig/firewall.local +etc/sysconfig/rc.local +etc/udev/rules.d/30-persistent-network.rules +srv/web/ipfire/html/proxy.pac +var/ipfire/dma +var/ipfire/time +var/ipfire/firewall/locationblock +var/ipfire/fwhosts/customlocationgrp +var/ipfire/ovpn +var/ipfire/urlfilter/blacklist +var/ipfire/urlfilter/settings +var/lib/alternatives +var/lib/location/database.db +var/lib/location/ipset +var/log/cache +var/log/dhcpcd.log +var/log/messages +var/state/dhcp/dhcpd.leases +var/updatecache diff --git a/config/rootfiles/core/185/filelists/aarch64/binutils b/config/rootfiles/oldcore/185/filelists/aarch64/binutils similarity index 100% rename from config/rootfiles/core/185/filelists/aarch64/binutils rename to config/rootfiles/oldcore/185/filelists/aarch64/binutils diff --git a/config/rootfiles/core/185/filelists/aarch64/glibc b/config/rootfiles/oldcore/185/filelists/aarch64/glibc similarity index 100% rename from config/rootfiles/core/185/filelists/aarch64/glibc rename to config/rootfiles/oldcore/185/filelists/aarch64/glibc diff --git a/config/rootfiles/core/185/filelists/aarch64/util-linux b/config/rootfiles/oldcore/185/filelists/aarch64/util-linux similarity index 100% rename from config/rootfiles/core/185/filelists/aarch64/util-linux rename to config/rootfiles/oldcore/185/filelists/aarch64/util-linux diff --git a/config/rootfiles/core/185/filelists/arping b/config/rootfiles/oldcore/185/filelists/arping similarity index 100% rename from config/rootfiles/core/185/filelists/arping rename to config/rootfiles/oldcore/185/filelists/arping diff --git a/config/rootfiles/core/185/filelists/bind b/config/rootfiles/oldcore/185/filelists/bind similarity index 100% rename from config/rootfiles/core/185/filelists/bind rename to config/rootfiles/oldcore/185/filelists/bind diff --git a/config/rootfiles/core/185/filelists/ca-certificates b/config/rootfiles/oldcore/185/filelists/ca-certificates similarity index 100% rename from config/rootfiles/core/185/filelists/ca-certificates rename to config/rootfiles/oldcore/185/filelists/ca-certificates diff --git a/config/rootfiles/oldcore/185/filelists/core-files b/config/rootfiles/oldcore/185/filelists/core-files new file mode 100644 index 0000000000..0dec37e538 --- /dev/null +++ b/config/rootfiles/oldcore/185/filelists/core-files @@ -0,0 +1,5 @@ +etc/system-release +etc/issue +etc/os-release +srv/web/ipfire/cgi-bin/credits.cgi +var/ipfire/langs diff --git a/config/rootfiles/core/185/filelists/elfutils b/config/rootfiles/oldcore/185/filelists/elfutils similarity index 100% rename from config/rootfiles/core/185/filelists/elfutils rename to config/rootfiles/oldcore/185/filelists/elfutils diff --git a/config/rootfiles/core/185/filelists/ethtool b/config/rootfiles/oldcore/185/filelists/ethtool similarity index 100% rename from config/rootfiles/core/185/filelists/ethtool rename to config/rootfiles/oldcore/185/filelists/ethtool diff --git a/config/rootfiles/core/185/filelists/expat b/config/rootfiles/oldcore/185/filelists/expat similarity index 100% rename from config/rootfiles/core/185/filelists/expat rename to config/rootfiles/oldcore/185/filelists/expat diff --git a/config/rootfiles/core/185/filelists/files b/config/rootfiles/oldcore/185/filelists/files similarity index 100% rename from config/rootfiles/core/185/filelists/files rename to config/rootfiles/oldcore/185/filelists/files diff --git a/config/rootfiles/core/185/filelists/iproute2 b/config/rootfiles/oldcore/185/filelists/iproute2 similarity index 100% rename from config/rootfiles/core/185/filelists/iproute2 rename to config/rootfiles/oldcore/185/filelists/iproute2 diff --git a/config/rootfiles/core/185/filelists/iputils b/config/rootfiles/oldcore/185/filelists/iputils similarity index 100% rename from config/rootfiles/core/185/filelists/iputils rename to config/rootfiles/oldcore/185/filelists/iputils diff --git a/config/rootfiles/core/185/filelists/knot b/config/rootfiles/oldcore/185/filelists/knot similarity index 100% rename from config/rootfiles/core/185/filelists/knot rename to config/rootfiles/oldcore/185/filelists/knot diff --git a/config/rootfiles/core/185/filelists/libcap b/config/rootfiles/oldcore/185/filelists/libcap similarity index 100% rename from config/rootfiles/core/185/filelists/libcap rename to config/rootfiles/oldcore/185/filelists/libcap diff --git a/config/rootfiles/core/185/filelists/libffi b/config/rootfiles/oldcore/185/filelists/libffi similarity index 100% rename from config/rootfiles/core/185/filelists/libffi rename to config/rootfiles/oldcore/185/filelists/libffi diff --git a/config/rootfiles/core/185/filelists/libgpg-error b/config/rootfiles/oldcore/185/filelists/libgpg-error similarity index 100% rename from config/rootfiles/core/185/filelists/libgpg-error rename to config/rootfiles/oldcore/185/filelists/libgpg-error diff --git a/config/rootfiles/core/185/filelists/libhtp b/config/rootfiles/oldcore/185/filelists/libhtp similarity index 100% rename from config/rootfiles/core/185/filelists/libhtp rename to config/rootfiles/oldcore/185/filelists/libhtp diff --git a/config/rootfiles/core/185/filelists/libpng b/config/rootfiles/oldcore/185/filelists/libpng similarity index 100% rename from config/rootfiles/core/185/filelists/libpng rename to config/rootfiles/oldcore/185/filelists/libpng diff --git a/config/rootfiles/core/185/filelists/newt b/config/rootfiles/oldcore/185/filelists/newt similarity index 100% rename from config/rootfiles/core/185/filelists/newt rename to config/rootfiles/oldcore/185/filelists/newt diff --git a/config/rootfiles/core/185/filelists/ntp b/config/rootfiles/oldcore/185/filelists/ntp similarity index 100% rename from config/rootfiles/core/185/filelists/ntp rename to config/rootfiles/oldcore/185/filelists/ntp diff --git a/config/rootfiles/core/185/filelists/openjpeg b/config/rootfiles/oldcore/185/filelists/openjpeg similarity index 100% rename from config/rootfiles/core/185/filelists/openjpeg rename to config/rootfiles/oldcore/185/filelists/openjpeg diff --git a/config/rootfiles/core/185/filelists/openssh b/config/rootfiles/oldcore/185/filelists/openssh similarity index 100% rename from config/rootfiles/core/185/filelists/openssh rename to config/rootfiles/oldcore/185/filelists/openssh diff --git a/config/rootfiles/core/185/filelists/pango b/config/rootfiles/oldcore/185/filelists/pango similarity index 100% rename from config/rootfiles/core/185/filelists/pango rename to config/rootfiles/oldcore/185/filelists/pango diff --git a/config/rootfiles/core/185/filelists/pciutils b/config/rootfiles/oldcore/185/filelists/pciutils similarity index 100% rename from config/rootfiles/core/185/filelists/pciutils rename to config/rootfiles/oldcore/185/filelists/pciutils diff --git a/config/rootfiles/core/185/filelists/pixman b/config/rootfiles/oldcore/185/filelists/pixman similarity index 100% rename from config/rootfiles/core/185/filelists/pixman rename to config/rootfiles/oldcore/185/filelists/pixman diff --git a/config/rootfiles/core/185/filelists/poppler b/config/rootfiles/oldcore/185/filelists/poppler similarity index 100% rename from config/rootfiles/core/185/filelists/poppler rename to config/rootfiles/oldcore/185/filelists/poppler diff --git a/config/rootfiles/core/185/filelists/ppp b/config/rootfiles/oldcore/185/filelists/ppp similarity index 100% rename from config/rootfiles/core/185/filelists/ppp rename to config/rootfiles/oldcore/185/filelists/ppp diff --git a/config/rootfiles/core/185/filelists/qpdf b/config/rootfiles/oldcore/185/filelists/qpdf similarity index 100% rename from config/rootfiles/core/185/filelists/qpdf rename to config/rootfiles/oldcore/185/filelists/qpdf diff --git a/config/rootfiles/core/185/filelists/riscv64/binutils b/config/rootfiles/oldcore/185/filelists/riscv64/binutils similarity index 100% rename from config/rootfiles/core/185/filelists/riscv64/binutils rename to config/rootfiles/oldcore/185/filelists/riscv64/binutils diff --git a/config/rootfiles/core/185/filelists/riscv64/glibc b/config/rootfiles/oldcore/185/filelists/riscv64/glibc similarity index 100% rename from config/rootfiles/core/185/filelists/riscv64/glibc rename to config/rootfiles/oldcore/185/filelists/riscv64/glibc diff --git a/config/rootfiles/core/185/filelists/riscv64/util-linux b/config/rootfiles/oldcore/185/filelists/riscv64/util-linux similarity index 100% rename from config/rootfiles/core/185/filelists/riscv64/util-linux rename to config/rootfiles/oldcore/185/filelists/riscv64/util-linux diff --git a/config/rootfiles/core/185/filelists/shadow b/config/rootfiles/oldcore/185/filelists/shadow similarity index 100% rename from config/rootfiles/core/185/filelists/shadow rename to config/rootfiles/oldcore/185/filelists/shadow diff --git a/config/rootfiles/core/185/filelists/sqlite b/config/rootfiles/oldcore/185/filelists/sqlite similarity index 100% rename from config/rootfiles/core/185/filelists/sqlite rename to config/rootfiles/oldcore/185/filelists/sqlite diff --git a/config/rootfiles/core/185/filelists/squid b/config/rootfiles/oldcore/185/filelists/squid similarity index 100% rename from config/rootfiles/core/185/filelists/squid rename to config/rootfiles/oldcore/185/filelists/squid diff --git a/config/rootfiles/core/185/filelists/suricata b/config/rootfiles/oldcore/185/filelists/suricata similarity index 100% rename from config/rootfiles/core/185/filelists/suricata rename to config/rootfiles/oldcore/185/filelists/suricata diff --git a/config/rootfiles/core/185/filelists/tcl b/config/rootfiles/oldcore/185/filelists/tcl similarity index 100% rename from config/rootfiles/core/185/filelists/tcl rename to config/rootfiles/oldcore/185/filelists/tcl diff --git a/config/rootfiles/core/185/filelists/unbound b/config/rootfiles/oldcore/185/filelists/unbound similarity index 100% rename from config/rootfiles/core/185/filelists/unbound rename to config/rootfiles/oldcore/185/filelists/unbound diff --git a/config/rootfiles/core/185/filelists/wget b/config/rootfiles/oldcore/185/filelists/wget similarity index 100% rename from config/rootfiles/core/185/filelists/wget rename to config/rootfiles/oldcore/185/filelists/wget diff --git a/config/rootfiles/core/185/filelists/whois b/config/rootfiles/oldcore/185/filelists/whois similarity index 100% rename from config/rootfiles/core/185/filelists/whois rename to config/rootfiles/oldcore/185/filelists/whois diff --git a/config/rootfiles/core/185/filelists/x86_64/binutils b/config/rootfiles/oldcore/185/filelists/x86_64/binutils similarity index 100% rename from config/rootfiles/core/185/filelists/x86_64/binutils rename to config/rootfiles/oldcore/185/filelists/x86_64/binutils diff --git a/config/rootfiles/core/185/filelists/x86_64/glibc b/config/rootfiles/oldcore/185/filelists/x86_64/glibc similarity index 100% rename from config/rootfiles/core/185/filelists/x86_64/glibc rename to config/rootfiles/oldcore/185/filelists/x86_64/glibc diff --git a/config/rootfiles/core/185/filelists/x86_64/intel-microcode b/config/rootfiles/oldcore/185/filelists/x86_64/intel-microcode similarity index 100% rename from config/rootfiles/core/185/filelists/x86_64/intel-microcode rename to config/rootfiles/oldcore/185/filelists/x86_64/intel-microcode diff --git a/config/rootfiles/core/185/filelists/x86_64/util-linux b/config/rootfiles/oldcore/185/filelists/x86_64/util-linux similarity index 100% rename from config/rootfiles/core/185/filelists/x86_64/util-linux rename to config/rootfiles/oldcore/185/filelists/x86_64/util-linux diff --git a/config/rootfiles/core/185/filelists/xz b/config/rootfiles/oldcore/185/filelists/xz similarity index 100% rename from config/rootfiles/core/185/filelists/xz rename to config/rootfiles/oldcore/185/filelists/xz diff --git a/config/rootfiles/core/185/update.sh b/config/rootfiles/oldcore/185/update.sh similarity index 100% rename from config/rootfiles/core/185/update.sh rename to config/rootfiles/oldcore/185/update.sh diff --git a/config/rootfiles/packages/cpufrequtils b/config/rootfiles/packages/cpufrequtils index d85e02867e..a058f370be 100644 --- a/config/rootfiles/packages/cpufrequtils +++ b/config/rootfiles/packages/cpufrequtils @@ -1,18 +1,2 @@ -usr/bin/cpufreq-aperf -usr/bin/cpufreq-info -usr/bin/cpufreq-set -#usr/include/cpufreq.h -#usr/lib/libcpufreq.a -#usr/lib/libcpufreq.la -usr/lib/libcpufreq.so -usr/lib/libcpufreq.so.0 -usr/lib/libcpufreq.so.0.0.0 -#usr/man/man1/cpufreq-info.1 -#usr/man/man1/cpufreq-set.1 -#usr/share/locale/cs/LC_MESSAGES/cpufrequtils.mo -usr/share/locale/de/LC_MESSAGES/cpufrequtils.mo -#usr/share/locale/fr/LC_MESSAGES/cpufrequtils.mo -#usr/share/locale/it/LC_MESSAGES/cpufrequtils.mo -#usr/share/locale/pt/LC_MESSAGES/cpufrequtils.mo etc/rc.d/init.d/cpufreq etc/rc.d/rc3.d/S18cpufreq diff --git a/html/cgi-bin/vulnerabilities.cgi b/html/cgi-bin/vulnerabilities.cgi index 1946cf171d..217952578a 100644 --- a/html/cgi-bin/vulnerabilities.cgi +++ b/html/cgi-bin/vulnerabilities.cgi @@ -36,6 +36,7 @@ my %VULNERABILITIES = ( "mds" => "$Lang::tr{'fallout zombieload ridl'} (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127, CVE-2019-11091)", "meltdown" => "$Lang::tr{'meltdown'} (CVE-2017-5754)", "mmio_stale_data" => "$Lang::tr{'mmio stale data'} (CVE-2022-21123, CVE-2022-21125, CVE-2022-21127, CVE-2022-21166)", + "reg_file_data_sampling" => "$Lang::tr{'reg_file_data_sampling'} (CVE-2023-28746)", "retbleed" => "$Lang::tr{'retbleed'} (CVE-2022-29900, CVE-2022-29901)", "spec_rstack_overflow" => "$Lang::tr{'spec rstack overflow'} (CVE-2023-20569)", "spec_store_bypass" => "$Lang::tr{'spectre variant 4'} (CVE-2018-3639)", diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 0113f8811f..84370d9f17 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2212,6 +2212,7 @@ 'refresh' => 'Refresh', 'refresh index page while connected' => 'Refresh index.cgi page while connected', 'refresh update list' => 'Refresh update list', +'reg_file_data_sampling' => 'Register File Data Sampling (RFDS)', 'regenerate host certificate' => 'Renew Host Certificate', 'registered user rules' => 'Talos VRT rules for registered users', 'reiserfs warning1' => 'Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.', diff --git a/lfs/cpufrequtils b/lfs/cpufrequtils index 8db0e67508..0383834b64 100644 --- a/lfs/cpufrequtils +++ b/lfs/cpufrequtils @@ -24,17 +24,17 @@ include Config -SUMMARY = Tools to Determine and Set CPUfreq Settings +SUMMARY = compatiblity initscript to set ondemand/powersave gov via cpupower -VER = 008 +VER = ipfire THISAPP = cpufrequtils-$(VER) -DL_FILE = $(THISAPP).tar.bz2 -DL_FROM = $(URL_IPFIRE) +#DL_FILE = $(THISAPP).tar.bz2 +#DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = cpufrequtils -PAK_VER = 14 +PAK_VER = 15 DEPS = @@ -44,54 +44,26 @@ SERVICES = # Top-level Rules ############################################################################### -objects = $(DL_FILE) - -$(DL_FILE) = $(DL_FROM)/$(DL_FILE) - -$(DL_FILE)_BLAKE2 = 4543e0aa7fa5db8ce47db63d1770614c46ac4b2519162c2c0122d2156518d2741dc31888b89f1fce4b530c04497c9fa5bf4ac073f078828383a4cc433cc8301c install : $(TARGET) -check : $(patsubst %,$(DIR_CHK)/%,$(objects)) +check : -download :$(patsubst %,$(DIR_DL)/%,$(objects)) +download : -b2 : $(subst %,%_BLAKE2,$(objects)) +b2 : dist: @$(PAK) -############################################################################### -# Downloading, checking, b2sum -############################################################################### - -$(patsubst %,$(DIR_CHK)/%,$(objects)) : - @$(CHECK) - -$(patsubst %,$(DIR_DL)/%,$(objects)) : - @$(LOAD) - -$(subst %,%_BLAKE2,$(objects)) : - @$(B2SUM) - ############################################################################### # Installation Details ############################################################################### $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cpufrequtils/0001-Only-x86-has-cpuid-instruction.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cpufrequtils/0003-cpufrequtils-aperf-Fix-MSR-read-on-32-bit.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cpufrequtils/0005-cpufrequtils-sysfs-increase-MAX_LINE_LEN.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cpufrequtils/0006-aperf-fix-compilation-on-x86-32-with-fPIC.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cpufrequtils/0007-po-add-missing-word-in-DE.patch - - cd $(DIR_APP) && make - cd $(DIR_APP) && make install #install initscripts $(call INSTALL_INITSCRIPTS,cpufreq) - @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/lfs/linux b/lfs/linux index efd3e8533f..369e94dc1a 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 6.6.15 +VER = 6.6.22 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.xz @@ -72,7 +72,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a630bc7b2463bdc312f8936210a54e92bbe4136fc78995c18d0ccafbcdb27cce5b7b0d4a6ba10c378e14e86855ee7e76e355acc0580f7441e4df64e7dbd8a4b7 +$(DL_FILE)_BLAKE2 = cea542524dbaea79c27e602b3e0534b5b95243ded95abdcab48f7ab1daf5f6de7231b24d2bc42e52fa27f98be9237534fb92f27ff1ba847df72e363b6147d3ab install : $(TARGET) @@ -247,6 +247,11 @@ ifeq "$(LASTKERNEL)" "1" # Disable ipv6 at runtime echo "options ipv6 disable_ipv6=1" > /etc/modprobe.d/ipv6.conf + + # build cpupower utility + cd $(DIR_APP)/tools/power/cpupower && make $(MAKETUNING) + cd $(DIR_APP)/tools/power/cpupower && make install + endif endif diff --git a/make.sh b/make.sh index 64dbef5c4b..1006383bf1 100755 --- a/make.sh +++ b/make.sh @@ -23,7 +23,7 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name # If you update the version don't forget to update backupiso and add it to core update VERSION="2.29" # Version number -CORE="185" # Core Level (Filename) +CORE="186" # Core Level (Filename) SLOGAN="www.ipfire.org" # Software slogan CONFIG_ROOT=/var/ipfire # Configuration rootdir MAX_RETRIES=1 # prefetch/check loop diff --git a/src/initscripts/packages/cpufreq b/src/initscripts/packages/cpufreq index 303eaf4bf4..ce71a4621c 100644 --- a/src/initscripts/packages/cpufreq +++ b/src/initscripts/packages/cpufreq @@ -54,16 +54,9 @@ case "${1}" in echo_ok; ;; esac - CPUCOUNT=`ls /sys/devices/system/cpu/cpu*/cpufreq/affected_cpus 2> /dev/null | wc -l `; - let CPUCOUNT-=1 - # Set the governor to test if it works - cpufreq-set -g $GOV + # Set the governor + cpupower frequency-set -g $GOV >/dev/null if [ ${?} = 0 ]; then - # Set the governor to ondemand for all cpus - for i in `seq 0 $CPUCOUNT`; - do - cpufreq-set -c $i -g $GOV > /dev/null - done echo_ok; else echo_failure; hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 0564584a5887b7498ae9ea638bc4799d2a6147e8
by Michael Tremer 21 Mar '24

21 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 0564584a5887b7498ae9ea638bc4799d2a6147e8 (commit) from 08d869d54f4903593992d7aee2ef17d79d235108 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0564584a5887b7498ae9ea638bc4799d2a6147e8 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 21 14:56:41 2024 +0000 core185: Ship IPS ruleset sources Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/131 => core/185}/filelists/ids-ruleset-sources | 0 1 file changed, 0 insertions(+), 0 deletions(-) copy config/rootfiles/{oldcore/131 => core/185}/filelists/ids-ruleset-sources (100%) Difference in files: diff --git a/config/rootfiles/core/185/filelists/ids-ruleset-sources b/config/rootfiles/core/185/filelists/ids-ruleset-sources new file mode 120000 index 000000000..a226ada39 --- /dev/null +++ b/config/rootfiles/core/185/filelists/ids-ruleset-sources @@ -0,0 +1 @@ +../../../common/ids-ruleset-sources \ No newline at end of file hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 08d869d54f4903593992d7aee2ef17d79d235108
by Michael Tremer 20 Mar '24

20 Mar '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 08d869d54f4903593992d7aee2ef17d79d235108 (commit) via 5e9fd833e6eac8bb3481b744782f1e2409eef6f7 (commit) via d4f66c22a8a240ba87e63fcd7fa0174e6bea03ec (commit) via 3396c743034c41413a7078e752ef426ef074ef77 (commit) via 5552f51de026fe1657bf404ce73e73462389854a (commit) via 4913c14477214f285ade2dfc304baaa6fbfaf2d1 (commit) via 6e600296bb3ec7d5151ed6282726c06c5dda1569 (commit) via cfb0ced3c413cdd4b02b222ed93cebaa75246d53 (commit) via b1e521c8f107c97c2179f0a48907ae1ab6e2810a (commit) via 896ae6eaac5ff5d5cc8e2ad8ba507feb298b9b38 (commit) via c11817a12db5dce22f34f289ff261288c58b2031 (commit) from bd8cc16ffde139820e282de1ba253e2724320a98 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 08d869d54f4903593992d7aee2ef17d79d235108 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Mar 20 10:03:51 2024 +0000 suricata: Update to 7.0.4 https://suricata.io/2024/03/19/suricata-7-0-4-and-6-0-17-released/ Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5e9fd833e6eac8bb3481b744782f1e2409eef6f7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Mar 20 10:01:13 2024 +0000 core185: Ship libhtp Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d4f66c22a8a240ba87e63fcd7fa0174e6bea03ec Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Mar 20 10:00:51 2024 +0000 libhtp: Update to 0.5.47 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 3396c743034c41413a7078e752ef426ef074ef77 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Mar 20 09:56:14 2024 +0000 Config: Update source upload URL Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5552f51de026fe1657bf404ce73e73462389854a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Mar 19 11:14:42 2024 +0000 wsdd: Remove dropped initscript Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4913c14477214f285ade2dfc304baaa6fbfaf2d1 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Mar 18 19:43:14 2024 +0100 wsdd: Update install and uninstall pak files - As wsdd is now started by samba when it is started then the wsdd install and uninstall paks no longer need to create the symlinks for starting and stopping wsdd and no longer need the start_service and stop_service commands in the paks. Fixes: bug#13445 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 6e600296bb3ec7d5151ed6282726c06c5dda1569 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Mar 18 19:43:13 2024 +0100 wsdd: Update of lfs file - fixes bug#13445 - Removal of services line as wsdd will now be started by the samba option in the addon services wui page - Removal of installing separate wsdd initscript as it is nowe integrated into the samba initscript. Fixes: bug#13445 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit cfb0ced3c413cdd4b02b222ed93cebaa75246d53 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Mar 18 19:43:12 2024 +0100 wsdd: remove wsdd initscript as now covered by samba - fixes bug#13445 Fixes: bug#13445 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b1e521c8f107c97c2179f0a48907ae1ab6e2810a Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Mon Mar 18 19:43:11 2024 +0100 samba: Integrate wsdd initscript into samba initscript - bug#13445 - This integrates the wsdd initscript functions into the samba initscript. When samba is started or stopped or the status requested then wsdd is part of that process. - Tested in my vm testbed and confirmed to work for start, stop and status. Confirmed pid's shown with status command are in the appropriate pid files. Fixes: bug#13445 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 896ae6eaac5ff5d5cc8e2ad8ba507feb298b9b38 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Mar 19 11:10:19 2024 +0000 core185: Ship ppp Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c11817a12db5dce22f34f289ff261288c58b2031 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Fri Mar 15 13:38:06 2024 +0100 ppp: Update to include bug fixes that should be in 2.5.1 but not yet released - Update from version 2.5.0 to commit e1266c7 - Update of rootfile - When ppp-2.5.0 was released it had a bug bin it that the lock and run directories had non standard defaults but also that if the directory did not exist ppp just ignored it and continued to start but would then have error messages in the logs about not being able to cretae the lock file - This issue was raised in the ppp github issues and a set of patches merged into ppp. - The plan was written in Nov 2023 that this would be released as 2.5.1, however nearly three months later there is no sight of 2.5.1 being released and people continue to flag up the lock directory issues and have to apply a workaround to create the directory in local.rc - This patch has taken the zip source tarball of master at the commit e1266c7. The zip tarball was then extracted and then tar'd back up as a tar.gz file with the version set at e1266c7 rather than master. I could not find any other way to get a source tarball\ created at a certain commit stage. - The patch ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch had to be updated due to some changes in the source files. - The patch ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch was removed as the changes are now built into the source tarball. - This will need to be tested thoroughly by people with ppp to confirm that the lock directory is created if it doesn't exist on the system. I can't test that as I have no access to a ppp connection system. - For a view of the changelog between 2.5.0 and e1266c7 the github commits list needs to be reviewed. https://github.com/ppp-project/ppp/commits/master/?before=e1266c76d1ad39f98… Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/ppp | 46 ++++++------ .../{oldcore/131 => core/185}/filelists/libhtp | 0 .../{oldcore/125 => core/185}/filelists/ppp | 0 config/rootfiles/core/185/update.sh | 1 + config/rootfiles/packages/wsdd | 1 - lfs/Config | 2 +- lfs/libhtp | 4 +- lfs/ppp | 10 +-- lfs/suricata | 4 +- lfs/wsdd | 7 +- src/initscripts/packages/samba | 40 ++++++++++- src/initscripts/packages/wsdd | 78 -------------------- src/paks/wsdd/install.sh | 7 +- src/paks/wsdd/uninstall.sh | 3 - ...heck-to-see-if-we-have-struct-sockaddr_ll.patch | 37 ---------- ...pp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch} | 82 +++++++++++----------- 16 files changed, 117 insertions(+), 205 deletions(-) copy config/rootfiles/{oldcore/131 => core/185}/filelists/libhtp (100%) copy config/rootfiles/{oldcore/125 => core/185}/filelists/ppp (100%) delete mode 100644 src/initscripts/packages/wsdd delete mode 100644 src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch rename src/patches/ppp/{ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch => ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch} (75%) Difference in files: diff --git a/config/rootfiles/common/ppp b/config/rootfiles/common/ppp index 379c64af44..6a27af3e74 100644 --- a/config/rootfiles/common/ppp +++ b/config/rootfiles/common/ppp @@ -35,29 +35,29 @@ etc/ppp/standardloginscript #usr/include/pppd/upap.h #usr/lib/pkgconfig/pppd.pc usr/lib/pppd -usr/lib/pppd/2.5.0 -#usr/lib/pppd/2.5.0/minconn.la -usr/lib/pppd/2.5.0/minconn.so -#usr/lib/pppd/2.5.0/openl2tp.la -usr/lib/pppd/2.5.0/openl2tp.so -#usr/lib/pppd/2.5.0/passprompt.la -usr/lib/pppd/2.5.0/passprompt.so -#usr/lib/pppd/2.5.0/passwordfd.la -usr/lib/pppd/2.5.0/passwordfd.so -#usr/lib/pppd/2.5.0/pppoatm.la -usr/lib/pppd/2.5.0/pppoatm.so -#usr/lib/pppd/2.5.0/pppoe.la -usr/lib/pppd/2.5.0/pppoe.so -#usr/lib/pppd/2.5.0/pppol2tp.la -usr/lib/pppd/2.5.0/pppol2tp.so -#usr/lib/pppd/2.5.0/radattr.la -usr/lib/pppd/2.5.0/radattr.so -#usr/lib/pppd/2.5.0/radius.la -usr/lib/pppd/2.5.0/radius.so -#usr/lib/pppd/2.5.0/radrealms.la -usr/lib/pppd/2.5.0/radrealms.so -#usr/lib/pppd/2.5.0/winbind.la -usr/lib/pppd/2.5.0/winbind.so +#usr/lib/pppd/2.5.1-dev +#usr/lib/pppd/2.5.1-dev/minconn.la +usr/lib/pppd/2.5.1-dev/minconn.so +#usr/lib/pppd/2.5.1-dev/openl2tp.la +usr/lib/pppd/2.5.1-dev/openl2tp.so +#usr/lib/pppd/2.5.1-dev/passprompt.la +usr/lib/pppd/2.5.1-dev/passprompt.so +#usr/lib/pppd/2.5.1-dev/passwordfd.la +usr/lib/pppd/2.5.1-dev/passwordfd.so +#usr/lib/pppd/2.5.1-dev/pppoatm.la +usr/lib/pppd/2.5.1-dev/pppoatm.so +#usr/lib/pppd/2.5.1-dev/pppoe.la +usr/lib/pppd/2.5.1-dev/pppoe.so +#usr/lib/pppd/2.5.1-dev/pppol2tp.la +usr/lib/pppd/2.5.1-dev/pppol2tp.so +#usr/lib/pppd/2.5.1-dev/radattr.la +usr/lib/pppd/2.5.1-dev/radattr.so +#usr/lib/pppd/2.5.1-dev/radius.la +usr/lib/pppd/2.5.1-dev/radius.so +#usr/lib/pppd/2.5.1-dev/radrealms.la +usr/lib/pppd/2.5.1-dev/radrealms.so +#usr/lib/pppd/2.5.1-dev/winbind.la +usr/lib/pppd/2.5.1-dev/winbind.so usr/sbin/chat usr/sbin/pppd usr/sbin/pppdump diff --git a/config/rootfiles/core/185/filelists/libhtp b/config/rootfiles/core/185/filelists/libhtp new file mode 120000 index 0000000000..676e2c5e87 --- /dev/null +++ b/config/rootfiles/core/185/filelists/libhtp @@ -0,0 +1 @@ +../../../common/libhtp \ No newline at end of file diff --git a/config/rootfiles/core/185/filelists/ppp b/config/rootfiles/core/185/filelists/ppp new file mode 120000 index 0000000000..4844a9b58c --- /dev/null +++ b/config/rootfiles/core/185/filelists/ppp @@ -0,0 +1 @@ +../../../common/ppp \ No newline at end of file diff --git a/config/rootfiles/core/185/update.sh b/config/rootfiles/core/185/update.sh index 3dce4693c4..2c95c41028 100644 --- a/config/rootfiles/core/185/update.sh +++ b/config/rootfiles/core/185/update.sh @@ -59,6 +59,7 @@ rm -rvf \ /usr/lib/grub/x86_64-efi/shim_lock.* \ /usr/lib/grub/x86_64-efi/verifiers.* \ /usr/lib/grub/x86_64-efi/verify.* \ + /usr/lib/pppd/2.5.0 \ /usr/lib/snort_dynamic* \ /usr/local/bin/snortctrl \ /usr/share/usb_modeswitch/1033:0035 \ diff --git a/config/rootfiles/packages/wsdd b/config/rootfiles/packages/wsdd index ce225043ae..f1d0a9a8a6 100644 --- a/config/rootfiles/packages/wsdd +++ b/config/rootfiles/packages/wsdd @@ -1,2 +1 @@ -etc/rc.d/init.d/wsdd usr/bin/wsdd diff --git a/lfs/Config b/lfs/Config index 589bd71956..6711af997b 100644 --- a/lfs/Config +++ b/lfs/Config @@ -79,7 +79,7 @@ ZSTD_OPTIONS = \ # URL_IPFIRE = https://source.ipfire.org/source-2.x URL_TOOLCHAIN = https://source.ipfire.org/toolchains -URL_SOURCE = git.ipfire.org:/pub/sources/source-2.x +URL_SOURCE = people.ipfire.org:/pub/sources/source-2.x # Don't change this; it will be overridden by other makefiles where necessary. # diff --git a/lfs/libhtp b/lfs/libhtp index 882f191d70..cbd4cb0931 100644 --- a/lfs/libhtp +++ b/lfs/libhtp @@ -24,7 +24,7 @@ include Config -VER = 0.5.46 +VER = 0.5.47 THISAPP = libhtp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 326246433b3d8525cd211fec73bc0fdd9fb61a65001fc55d1fed4e966c53b16a1052ef0597990681d805c2c560e670b8b2d2558851971df6c31910dea571d0cc +$(DL_FILE)_BLAKE2 = a2a126052ea528b84dfffd7926a80e633f649968bf098e3ff0f49d441821723a4d3f78f0f15d530e9ce9e393c6173aceced8c0d863afecbe65c736e4ab874a03 install : $(TARGET) diff --git a/lfs/ppp b/lfs/ppp index 54aa1caf52..a16859002f 100644 --- a/lfs/ppp +++ b/lfs/ppp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.5.0 +VER = e1266c7 THISAPP = ppp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 6a0e9efcbff3cb499705071cc7d0e3411cf4871fd53b2bfedbb1f2cf3ad80728eb436050cf33b78e36d473be64f15907a21da17f283337455f0af379bc18272d +$(DL_FILE)_BLAKE2 = be60fadeed632ae2511e2d60148905da9868bd4271139b4fecab6b4b93e4a403e645d84204f907a8661748fb1a18b59c893925d91565520b9af791a45b0aaf4f install : $(TARGET) @@ -72,13 +72,13 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./autogen.sh cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-1-we-don-t-want-to-accidentally-leak-fds.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-4-increase-max-padi-attempts.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-5-headers_4.9.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-6-patch-configure-to-handle-cflags-properly.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc \ diff --git a/lfs/suricata b/lfs/suricata index e8729e3689..17cc455852 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 7.0.3 +VER = 7.0.4 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = b42044428ae5ac4ecd6b41d083f0f3ac5839bf9a0734c3a64bb5e9a6f1a0ffe0c1f5da262f4e167461836bd26ebf9238ec9c0c213ba61f6419b6af1314f3becb +$(DL_FILE)_BLAKE2 = 6c85ee7134548261a5a766ee3e7c0ce095ef478e9323342f17bb48eb0abc74035a66212c7f7e6ba45bd2efd552d82ad6d218d4b09279877f60526f8f79de9764 install : $(TARGET) diff --git a/lfs/wsdd b/lfs/wsdd index aa65e47ef0..bf2a1a0327 100644 --- a/lfs/wsdd +++ b/lfs/wsdd @@ -33,11 +33,11 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = wsdd -PAK_VER = 1 +PAK_VER = 2 DEPS = -SERVICES = wsdd +SERVICES = ############################################################################### # Top-level Rules @@ -82,8 +82,5 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && cp src/wsdd.py /usr/bin/wsdd - #install initscripts - $(call INSTALL_INITSCRIPTS,$(SERVICES)) - @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/src/initscripts/packages/samba b/src/initscripts/packages/samba index 93f14cd292..3945f4384f 100644 --- a/src/initscripts/packages/samba +++ b/src/initscripts/packages/samba @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -30,6 +30,8 @@ function fix_permissions() { mkdir -p /var/run/samba/{nmbd,ncalrpc,winbindd} } +eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) + case "$1" in start) fix_permissions @@ -42,6 +44,35 @@ case "$1" in boot_mesg "Starting winbind..." loadproc /usr/sbin/winbindd + + # Arguments for wsdd command + ARGS=( + # Launch as non-privileged user + "--user" "wsdd:wsdd" + + # Launch in chroot + "--chroot" "/var/run/wsdd" + + # Only use IPv4 + "--ipv4only" + + # Configure the workgroup + "--workgroup" "$(testparm -s --parameter-name workgroup 2>/dev/null)" + ) + + # Conditionally add the GREEN/BLUE interface + for intf in GREEN_DEV BLUE_DEV; do + if [ -n "${!intf}" ]; then + ARGS+=( "--interface" "${!intf}" ) + fi + done + + # Create chroot directory for wsdd + mkdir -p /var/run/wsdd + + PIDFILE="/var/run/wsdd.pid" + boot_mesg "Starting Web Service Discovery Host Daemon..." + loadproc -b -p "${PIDFILE}" /usr/bin/wsdd "${ARGS[@]}" ;; stop) @@ -53,6 +84,10 @@ case "$1" in boot_mesg "Stopping winbind..." killproc /usr/sbin/winbindd + + PIDFILE="/var/run/wsdd.pid" + boot_mesg "Stopping Web Service Discovery Host Daemon..." + killproc -p "${PIDFILE}" /usr/bin/wsdd ;; reload) @@ -76,6 +111,9 @@ case "$1" in statusproc /usr/sbin/nmbd statusproc /usr/sbin/smbd statusproc /usr/sbin/winbindd + + PIDFILE="/var/run/wsdd.pid" + statusproc /usr/bin/wsdd ;; *) diff --git a/src/initscripts/packages/wsdd b/src/initscripts/packages/wsdd deleted file mode 100644 index 68e8f3de00..0000000000 --- a/src/initscripts/packages/wsdd +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/sh -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -. /etc/sysconfig/rc -. $rc_functions - -eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) - -PIDFILE="/var/run/wsdd.pid" - -case "$1" in - start) - ARGS=( - # Launch as non-privileged user - "--user" "wsdd:wsdd" - - # Launch in chroot - "--chroot" "/var/run/wsdd" - - # Only use IPv4 - "--ipv4only" - - # Configure the workgroup - "--workgroup" "$(testparm -s --parameter-name workgroup 2>/dev/null)" - ) - - # Conditionally add the GREEN/BLUE interface - for intf in GREEN_DEV BLUE_DEV; do - if [ -n "${!intf}" ]; then - ARGS+=( "--interface" "${!intf}" ) - fi - done - - # Create chroot directory for wsdd - mkdir -p /var/run/wsdd - - boot_mesg "Starting Web Service Discovery Host Daemon..." - loadproc -b -p "${PIDFILE}" /usr/bin/wsdd "${ARGS[@]}" - ;; - - stop) - boot_mesg "Stopping Web Service Discovery Host Daemon..." - killproc -p "${PIDFILE}" /usr/bin/wsdd - ;; - - status) - statusproc /usr/bin/wsdd - ;; - - restart) - $0 stop - $0 start - ;; - - *) - echo "Usage: $0 (start|stop|status|restart)" - exit 1 - ;; -esac - diff --git a/src/paks/wsdd/install.sh b/src/paks/wsdd/install.sh index 181b84eb99..12fde4802e 100644 --- a/src/paks/wsdd/install.sh +++ b/src/paks/wsdd/install.sh @@ -24,7 +24,7 @@ . /opt/pakfire/lib/functions.sh # If the wsdd user does not exist yet, then create it and add to wsdd group. -if ! getent user wsdd >/dev/null; then +if ! getent passwd wsdd >/dev/null; then useradd -r -U -d / -s /bin/false -c "wsdd user" wsdd usermod -a -G wsdd wsdd fi @@ -32,9 +32,4 @@ fi extract_files restore_backup ${NAME} -# Create startlinks -ln -sf ../init.d/wsdd /etc/rc.d/rc0.d/K35wsdd -ln -sf ../init.d/wsdd /etc/rc.d/rc3.d/S65wsdd -ln -sf ../init.d/wsdd /etc/rc.d/rc6.d/K35wsdd -start_service ${NAME} exit 0 diff --git a/src/paks/wsdd/uninstall.sh b/src/paks/wsdd/uninstall.sh index 4c52ee281e..9dc5202f47 100644 --- a/src/paks/wsdd/uninstall.sh +++ b/src/paks/wsdd/uninstall.sh @@ -22,9 +22,6 @@ ############################################################################ # . /opt/pakfire/lib/functions.sh -stop_service ${NAME} make_backup ${NAME} remove_files -# Remove all start links. -rm -rf /etc/rc.d/rc*.d/*wsdd exit 0 diff --git a/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch b/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch deleted file mode 100644 index a7823d4249..0000000000 --- a/src/patches/ppp/ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 9d6d326b2530cffb1414e4c401675117c42d43ce Mon Sep 17 00:00:00 2001 -From: Eivind Naess <eivnaes(a)yahoo.com> -Date: Sun, 23 Apr 2023 11:30:43 -0700 -Subject: [PATCH] Add configure check to see if we have struct sockaddr_ll - -Fixes issue #411. - -Signed-off-by: Eivind Naess <eivnaes(a)yahoo.com> ---- - configure.ac | 3 ++- - pppd/plugins/pppoe/config.h.in | 2 ++ - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index 1180f64ec..38b24af92 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -75,7 +75,8 @@ AM_COND_IF([LINUX], [ - linux/if_ether.h \ - linux/if_packet.h \ - netinet/if_ether.h \ -- netpacket/packet.h])]) -+ netpacket/packet.h]) -+ AC_CHECK_TYPES([struct sockaddr_ll], [], [], [#include <linux/if_packet.h>])]) - - AC_CHECK_SIZEOF(unsigned int) - AC_CHECK_SIZEOF(unsigned long) -diff --git a/pppd/plugins/pppoe/config.h.in b/pppd/plugins/pppoe/config.h.in -index d447f5e89..d7d61c01c 100644 ---- a/pppd/plugins/pppoe/config.h.in -+++ b/pppd/plugins/pppoe/config.h.in -@@ -69,3 +69,5 @@ - /* The size of `unsigned short', as computed by sizeof. */ - #undef SIZEOF_UNSIGNED_SHORT - -+/* Define to 1 if the system has the type `struct sockaddr_ll'. */ -+#undef HAVE_STRUCT_SOCKADDR_LL diff --git a/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch b/src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch similarity index 75% rename from src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch rename to src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch index c205c0e08c..b6fd842a7f 100644 --- a/src/patches/ppp/ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch +++ b/src/patches/ppp/ppp-e1266c7-2-everywhere-O_CLOEXEC-harder.patch @@ -1,6 +1,6 @@ -diff -Naur pppd.orig/eap.c pppd/eap.c ---- pppd.orig/eap.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/eap.c 2023-06-30 12:58:07.984676045 +0200 +diff -Naur ppp-e1266c7-orig/pppd/eap.c ppp-e1266c7/pppd/eap.c +--- ppp-e1266c7-orig/pppd/eap.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/eap.c 2024-03-15 10:40:53.637190252 +0100 @@ -1542,7 +1542,7 @@ if ((path = name_of_pn_file()) == NULL) @@ -10,10 +10,10 @@ diff -Naur pppd.orig/eap.c pppd/eap.c err = errno; free(path); errno = err; -diff -Naur pppd.orig/main.c pppd/main.c ---- pppd.orig/main.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/main.c 2023-06-30 13:00:15.155195676 +0200 -@@ -479,7 +479,7 @@ +diff -Naur ppp-e1266c7-orig/pppd/main.c ppp-e1266c7/pppd/main.c +--- ppp-e1266c7-orig/pppd/main.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/main.c 2024-03-15 10:41:43.842037617 +0100 +@@ -480,7 +480,7 @@ die(0); /* Make sure fds 0, 1, 2 are open to somewhere. */ @@ -22,10 +22,10 @@ diff -Naur pppd.orig/main.c pppd/main.c if (fd_devnull < 0) fatal("Couldn't open %s: %m", PPP_DEVNULL); while (fd_devnull <= 2) { -diff -Naur pppd.orig/options.c pppd/options.c ---- pppd.orig/options.c 2023-06-30 12:42:19.262593140 +0200 -+++ pppd/options.c 2023-06-30 13:01:58.388323345 +0200 -@@ -1718,9 +1718,9 @@ +diff -Naur ppp-e1266c7-orig/pppd/options.c ppp-e1266c7/pppd/options.c +--- ppp-e1266c7-orig/pppd/options.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/options.c 2024-03-15 10:43:02.867753370 +0100 +@@ -1719,9 +1719,9 @@ ppp_option_error("unable to drop permissions to open %s: %m", *argv); return 0; } @@ -37,10 +37,10 @@ diff -Naur pppd.orig/options.c pppd/options.c err = errno; if (!privileged_option && seteuid(euid) == -1) fatal("unable to regain privileges: %m"); -diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c ---- pppd.orig/sys-linux.c 2023-06-30 12:43:20.634453475 +0200 -+++ pppd/sys-linux.c 2023-06-30 13:11:25.715511251 +0200 -@@ -666,7 +666,7 @@ +diff -Naur ppp-e1266c7-orig/pppd/sys-linux.c ppp-e1266c7/pppd/sys-linux.c +--- ppp-e1266c7-orig/pppd/sys-linux.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/sys-linux.c 2024-03-15 10:49:59.310297165 +0100 +@@ -656,7 +656,7 @@ goto err; } dbglog("using channel %d", chindex); @@ -49,7 +49,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd < 0) { error("Couldn't reopen /dev/ppp: %m"); goto err; -@@ -904,7 +904,7 @@ +@@ -894,7 +894,7 @@ dbglog("in make_ppp_unit, already had /dev/ppp open?"); close(ppp_dev_fd); } @@ -58,7 +58,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (ppp_dev_fd < 0) fatal("Couldn't open /dev/ppp: %m"); flags = fcntl(ppp_dev_fd, F_GETFL); -@@ -1025,7 +1025,7 @@ +@@ -1015,7 +1015,7 @@ if (!new_style_driver) return -1; @@ -67,7 +67,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (master_fd < 0) fatal("Couldn't open /dev/ppp: %m"); if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) { -@@ -2533,7 +2533,7 @@ +@@ -2541,7 +2541,7 @@ if (tune_kernel) { forw_path = path_to_procfs("/sys/net/ipv4/ip_forward"); if (forw_path != 0) { @@ -76,7 +76,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd >= 0) { if (write(fd, "1", 1) != 1) error("Couldn't enable IP forwarding: %m"); -@@ -2878,7 +2878,7 @@ +@@ -2886,7 +2886,7 @@ sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch); kernel_version = KVERSION(osmaj, osmin, ospatch); @@ -85,7 +85,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd >= 0) { new_style_driver = 1; -@@ -3056,7 +3056,7 @@ +@@ -3064,7 +3064,7 @@ #if __GLIBC__ >= 2 updwtmp(_PATH_WTMP, &ut); #else @@ -94,7 +94,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (wtmp >= 0) { flock(wtmp, LOCK_EX); -@@ -3280,7 +3280,7 @@ +@@ -3288,7 +3288,7 @@ int fd; path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); @@ -103,7 +103,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (write(fd, "1", 1) != 1) error("Couldn't enable dynamic IP addressing: %m"); close(fd); -@@ -3534,7 +3534,7 @@ +@@ -3542,7 +3542,7 @@ /* * Try the unix98 way first. */ @@ -112,7 +112,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (mfd >= 0) { int ptn; if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) { -@@ -3545,7 +3545,8 @@ +@@ -3553,7 +3553,8 @@ if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0) warn("Couldn't unlock pty slave %s: %m", pty_name); #endif @@ -122,7 +122,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c { warn("Couldn't open pty slave %s: %m", pty_name); close(mfd); -@@ -3559,10 +3560,10 @@ +@@ -3567,10 +3568,10 @@ for (i = 0; i < 64; ++i) { slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", 'p' + i / 16, i % 16); @@ -135,19 +135,19 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (sfd >= 0) { ret = fchown(sfd, uid, -1); if (ret != 0) { -diff -Naur pppd.orig/tdb.c pppd/tdb.c ---- pppd.orig/tdb.c 2021-07-23 06:41:07.000000000 +0200 -+++ pppd/tdb.c 2023-06-30 13:12:55.034900600 +0200 -@@ -1728,7 +1728,7 @@ - goto internal; +diff -Naur ppp-e1266c7-orig/pppd/tdb.c ppp-e1266c7/pppd/tdb.c +--- ppp-e1266c7-orig/pppd/tdb.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/tdb.c 2024-03-15 10:51:25.182882191 +0100 +@@ -1732,7 +1732,7 @@ } + again: - if ((tdb->fd = open(name, open_flags, mode)) == -1) { + if ((tdb->fd = open(name, open_flags | O_CLOEXEC, mode)) == -1) { - TDB_LOG((tdb, 5, "tdb_open_ex: could not open file %s: %s\n", - name, strerror(errno))); - goto fail; /* errno set by open(2) */ -@@ -1971,7 +1971,7 @@ + if ((open_flags & O_CREAT) && errno == ENOENT && + mkdir_recursive(PPP_PATH_VARRUN) == 0) + goto again; +@@ -1979,7 +1979,7 @@ } if (close(tdb->fd) != 0) TDB_LOG((tdb, 0, "tdb_reopen: WARNING closing tdb->fd failed!\n")); @@ -156,9 +156,9 @@ diff -Naur pppd.orig/tdb.c pppd/tdb.c if (tdb->fd == -1) { TDB_LOG((tdb, 0, "tdb_reopen: open failed (%s)\n", strerror(errno))); goto fail; -diff -Naur pppd.orig/tty.c pppd/tty.c ---- pppd.orig/tty.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/tty.c 2023-06-30 13:14:06.450418113 +0200 +diff -Naur ppp-e1266c7-orig/pppd/tty.c ppp-e1266c7/pppd/tty.c +--- ppp-e1266c7-orig/pppd/tty.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/tty.c 2024-03-15 10:52:35.828341901 +0100 @@ -621,7 +621,7 @@ ppp_set_status(EXIT_OPEN_FAILED); goto errret; @@ -177,10 +177,10 @@ diff -Naur pppd.orig/tty.c pppd/tty.c break; if (errno != EINTR) { error("Failed to reopen %s: %m", devnam); -diff -Naur pppd.orig/utils.c pppd/utils.c ---- pppd.orig/utils.c 2022-12-30 02:12:39.000000000 +0100 -+++ pppd/utils.c 2023-06-30 13:15:47.860182369 +0200 -@@ -843,14 +843,14 @@ +diff -Naur ppp-e1266c7-orig/pppd/utils.c ppp-e1266c7/pppd/utils.c +--- ppp-e1266c7-orig/pppd/utils.c 2024-02-13 10:40:56.000000000 +0100 ++++ ppp-e1266c7/pppd/utils.c 2024-03-15 10:55:27.176832115 +0100 +@@ -926,14 +926,14 @@ slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", PPP_PATH_LOCKDIR, dev); #endif @@ -197,7 +197,7 @@ diff -Naur pppd.orig/utils.c pppd/utils.c if (fd < 0) { if (errno == ENOENT) /* This is just a timing problem. */ continue; -@@ -933,7 +933,7 @@ +@@ -1016,7 +1016,7 @@ if (lock_file[0] == 0) return -1; hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM March 2024