* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. ca4de263184e2d62239cc6d63caf2a0812d492b5
@ 2022-10-04 14:53 Peter Müller
0 siblings, 0 replies; only message in thread
From: Peter Müller @ 2022-10-04 14:53 UTC (permalink / raw)
To: ipfire-scm
[-- Attachment #1: Type: text/plain, Size: 40426 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via ca4de263184e2d62239cc6d63caf2a0812d492b5 (commit)
via a308f5bcdefa59a744584a8276b03d80acd97517 (commit)
via 9745a212d4aff2b9cd50de34e30c79c624d21b3c (commit)
via 6efb611cbc97908cbd893806ceb82c167cddeb6a (commit)
via e77ef3639579e88f1fe86ef332d9c831b4e200ca (commit)
via 8399123461b7b790b43d4a8c6ebf27928a44929d (commit)
via a4e5b6d689a7f3094b916251b52e04ff0825add4 (commit)
from 6d0e3c5a5719ea66a47f1859871808d8b2095fa4 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit ca4de263184e2d62239cc6d63caf2a0812d492b5
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Oct 4 13:32:47 2022 +0000
unbound-dhcp-leases-bridge: Fall back to the default domain
When the bridge cannot detect a domain name for any of the leases, it
uses localdomain which is not always the best choice. So instead, this
patches changes the behaviour that we read the default domain of the
firewall.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch(a)ipfire.org>
commit a308f5bcdefa59a744584a8276b03d80acd97517
Author: Peter Müller <peter.mueller(a)ipfire.org>
Date: Tue Oct 4 14:48:04 2022 +0000
Core Update 171: Ship setclock initscript
Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
commit 9745a212d4aff2b9cd50de34e30c79c624d21b3c
Author: Mathew McBride <matt(a)traverse.com.au>
Date: Mon Oct 3 06:20:19 2022 +0000
initscripts: load RTC module (RX8025) for Ten64 board
For reasons I have not been able to determine, the RTC
module for the Ten64 board (rtc-rx8025) is not automatically
loaded at startup, despite every other relevant modules being
loaded.
modprobe it manually if we are on a Ten64 board.
Signed-off-by: Mathew McBride <matt(a)traverse.com.au>
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 6efb611cbc97908cbd893806ceb82c167cddeb6a
Author: Mathew McBride <matt(a)traverse.com.au>
Date: Mon Oct 3 06:20:18 2022 +0000
config: u-boot: bypass the u-boot script on Traverse Ten64
The Ten64 board runs a U-Boot which works best directly
booting EFI. Attempting to load your own DTB or other steps
will cause issues.
(see https://ten64doc.traverse.com.au/faq/#common-issues)
The current stable Ten64 firmware unfortunately searches for
boot.scr before bootaa64.efi. So redirect it back to the EFI path.
A future Ten64 firmware package will prefer EFI first before
any boot script avoiding this issue. I will provide a patch
reversing this when that day comes.
Signed-off-by: Mathew McBride <matt(a)traverse.com.au>
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit e77ef3639579e88f1fe86ef332d9c831b4e200ca
Author: Mathew McBride <matt(a)traverse.com.au>
Date: Mon Oct 3 06:20:17 2022 +0000
kernel: add patches for SFP support on NXP Layerscape/DPAA2 (arm64)
These two patches are needed to support SFP's on NXP DPAA2 platforms
(e.g Traverse Ten64).
The deadlock issue patch was submitted upstream a while ago and
rejected, however I am not aware of any better solutions at present.
The 10G mode additions are part of mainline since 5.16.
These two .patches were sourced from our patchset over here:
https://gitlab.com/traversetech/traverse-kernel-patches/-/tree/lts-5-15/patches
Signed-off-by: Mathew McBride <matt(a)traverse.com.au>
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 8399123461b7b790b43d4a8c6ebf27928a44929d
Author: Mathew McBride <matt(a)traverse.com.au>
Date: Mon Oct 3 06:20:16 2022 +0000
linux: enable options for NXP Layerscape
This change enables support for NXP's QorIQ/Layerscape platforms,
specifically the Traverse Technologies Ten64 (LS1088A).
Signed-off-by: Mathew McBride <matt(a)traverse.com.au>
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit a4e5b6d689a7f3094b916251b52e04ff0825add4
Author: Adolf Belka <adolf.belka(a)ipfire.org>
Date: Tue Oct 4 12:54:42 2022 +0200
rsync: Update to version 3.2.6 and fix Bug#12947
- Update from version 3.2.4 plus CVE-2022-29154 patch to 3.2.6
- Patch for CVE-2022-29154 applied in CU170 turned out to have a bug within it causing
rsync to fail with an error. Four additional commits were done to fix this bug and
its consequences but these were all applied in the rsync git repo after the patch had
been merged into CU170.
- Version 3.2.5 onwards contains the CVE-2022-29154 fix and associated commits.
- No update of rootfile required.
- Changelog
NEWS for rsync 3.2.6 (9 Sep 2022)
BUG FIXES:
More path-cleaning improvements in the file-list validation code to avoid
rejecting of valid args.
A file-list validation fix for a --files-from file that ends without a
line-terminating character.
Added a safety check that prevents the sender from removing destination
files when a local copy using --remove-source-files has some files that are
shared between the sending & receiving hierarchies, including the case
where the source dir & destination dir are identical.
Fixed a bug in the internal MD4 checksum code that could cause the digest to
be sporadically incorrect (the openssl version was/is fine).
A minor tweak to rrsync added "copy-devices" to the list of known args, but
left it disabled by default.
ENHANCEMENTS:
Rename --protect-args to --secluded-args to make it clearer how it differs
from the default backslash-escaped arg-protecting behavior of rsync. The
old option names are still accepted. The environment-variable override did
not change its name.
PACKAGING RELATED:
The configure option --with-protected-args was renamed to
--with-secluded-args. This option makes --secluded-args the default rsync
behavior instead of using backslash escaping for protecting args.
The mkgitver script now makes sure that a .git dir/file is in the top-level
source dir before calling git describe. It also runs a basic check on the
version value. This should avoid using an unrelated git description for
rsync's version.
DEVELOPER RELATED:
The configure script no longer sets the -pedantic-errors CFLAG (which it
used to try to do only for gcc).
The name_num_obj struct was modified to allow its dynamic name_num_item list
to be initialized in a better way.
NEWS for rsync 3.2.5 (14 Aug 2022)
SECURITY FIXES:
Added some file-list safety checking that helps to ensure that a rogue
sending rsync can't add unrequested top-level names and/or include
recursive names that should have been excluded by the sender. These extra
safety checks only require the receiver rsync to be updated. When dealing
with an untrusted sending host, it is safest to copy into a dedicated
destination directory for the remote content (i.e. don't copy into a
destination directory that contains files that aren't from the remote host
unless you trust the remote host). Fixes CVE-2022-29154.
A fix for CVE-2022-37434 in the bundled zlib (buffer overflow issue).
BUG FIXES:
Fixed the handling of filenames specified with backslash-quoted wildcards
when the default remote-arg-escaping is enabled.
Fixed the configure check for signed char that was causing a host that
defaults to unsigned characters to generate bogus rolling checksums. This
made rsync send mostly literal data for a copy instead of finding matching
data in the receiver's basis file (for a file that contains high-bit
characters).
Lots of manpage improvements, including an attempt to better describe how
include/exclude filters work.
If rsync is compiled with an xxhash 0.8 library and then moved to a system
with a dynamically linked xxhash 0.7 library, we now detect this and
disable the XX3 hashes (since these routines didn't stabilize until 0.8).
ENHANCEMENTS:
The --trust-sender option was added as a way to bypass the extra file-list
safety checking (should that be required).
PACKAGING RELATED:
A note to those wanting to patch older rsync versions: the changes in this
release requires the quoted argument change from 3.2.4. Then, you'll want
every single code change from 3.2.5 since there is no fluff in this release.
The build date that goes into the manpages is now based on the developer's
release date, not on the build's local-timezone interpretation of the date.
DEVELOPER RELATED:
Configure now defaults GETGROUPS_T to gid_t when cross compiling.
Configure now looks for the bsd/string.h include file in order to fix the
build on a host that has strlcpy() in the main libc but not defined in the
main string.h file.
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/kernel/kernel.config.aarch64-ipfire | 76 ++++-
config/rootfiles/core/171/filelists/files | 1 +
config/u-boot/boot.cmd | 9 +
config/unbound/unbound-dhcp-leases-bridge | 7 +-
lfs/linux | 3 +
lfs/rsync | 9 +-
src/initscripts/system/setclock | 8 +
...-15-arm64-dpaa2-add-support-for-10g-modes.patch | 39 +++
.../linux-5.15-arm64-dpaa2-fix-lock-issue.patch | 81 ++++++
src/patches/rsync-CVE-2022-29154.patch | 322 ---------------------
10 files changed, 211 insertions(+), 344 deletions(-)
create mode 100644 src/patches/linux/linux-5-15-arm64-dpaa2-add-support-for-10g-modes.patch
create mode 100644 src/patches/linux/linux-5.15-arm64-dpaa2-fix-lock-issue.patch
delete mode 100644 src/patches/rsync-CVE-2022-29154.patch
Difference in files:
diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index e2ae8da17..63dc80d4a 100644
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -297,7 +297,7 @@ CONFIG_ARCH_BERLIN=y
# CONFIG_ARCH_EXYNOS is not set
# CONFIG_ARCH_SPARX5 is not set
# CONFIG_ARCH_K3 is not set
-# CONFIG_ARCH_LAYERSCAPE is not set
+CONFIG_ARCH_LAYERSCAPE=y
# CONFIG_ARCH_LG1K is not set
# CONFIG_ARCH_HISI is not set
# CONFIG_ARCH_KEEMBAY is not set
@@ -372,9 +372,9 @@ CONFIG_SOCIONEXT_SYNQUACER_PREITS=y
CONFIG_ARM64_4K_PAGES=y
# CONFIG_ARM64_16K_PAGES is not set
# CONFIG_ARM64_64K_PAGES is not set
-CONFIG_ARM64_VA_BITS_39=y
-# CONFIG_ARM64_VA_BITS_48 is not set
-CONFIG_ARM64_VA_BITS=39
+# CONFIG_ARM64_VA_BITS_39 is not set
+CONFIG_ARM64_VA_BITS_48=y
+CONFIG_ARM64_VA_BITS=48
CONFIG_ARM64_PA_BITS_48=y
CONFIG_ARM64_PA_BITS=48
# CONFIG_CPU_BIG_ENDIAN is not set
@@ -559,6 +559,7 @@ CONFIG_ARM_ARMADA_37XX_CPUFREQ=m
CONFIG_ARM_ARMADA_8K_CPUFREQ=m
CONFIG_ARM_IMX_CPUFREQ_DT=m
CONFIG_ARM_SCMI_CPUFREQ=m
+CONFIG_QORIQ_CPUFREQ=m
# end of CPU Frequency scaling
# end of CPU Power Management
@@ -1760,6 +1761,7 @@ CONFIG_PCIE_DW_HOST=y
CONFIG_PCIE_DW_PLAT=y
CONFIG_PCIE_DW_PLAT_HOST=y
CONFIG_PCI_IMX6=y
+CONFIG_PCI_LAYERSCAPE=y
# CONFIG_PCI_HISI is not set
# CONFIG_PCIE_ARMADA_8K is not set
CONFIG_PCIE_ROCKCHIP_DW_HOST=y
@@ -1771,6 +1773,7 @@ CONFIG_PCIE_AL=y
#
# Mobiveil PCIe Core Support
#
+# CONFIG_PCIE_LAYERSCAPE_GEN4 is not set
# end of Mobiveil PCIe Core Support
#
@@ -1847,6 +1850,8 @@ CONFIG_GENERIC_ARCH_TOPOLOGY=y
CONFIG_SUN50I_DE2_BUS=y
CONFIG_SUNXI_RSB=y
CONFIG_VEXPRESS_CONFIG=y
+CONFIG_FSL_MC_BUS=y
+CONFIG_FSL_MC_UAPI_SUPPORT=y
CONFIG_MHI_BUS=m
# CONFIG_MHI_BUS_PCI_GENERIC is not set
# end of Bus devices
@@ -2597,9 +2602,14 @@ CONFIG_NET_VENDOR_EZCHIP=y
CONFIG_EZCHIP_NPS_MANAGEMENT_ENET=m
CONFIG_NET_VENDOR_FREESCALE=y
CONFIG_FEC=m
+CONFIG_FSL_FMAN=m
+CONFIG_DPAA_ERRATUM_A050385=y
CONFIG_FSL_PQ_MDIO=m
CONFIG_FSL_XGMAC_MDIO=m
CONFIG_GIANFAR=m
+CONFIG_FSL_DPAA_ETH=m
+CONFIG_FSL_DPAA2_ETH=m
+# CONFIG_FSL_DPAA2_PTP_CLOCK is not set
CONFIG_FSL_DPAA2_SWITCH=m
CONFIG_FSL_ENETC=m
CONFIG_FSL_ENETC_VF=m
@@ -3598,7 +3608,7 @@ CONFIG_I2C_CBUS_GPIO=m
CONFIG_I2C_GPIO=m
# CONFIG_I2C_GPIO_FAULT_INJECTOR is not set
CONFIG_I2C_HISI=m
-# CONFIG_I2C_IMX is not set
+CONFIG_I2C_IMX=m
CONFIG_I2C_IMX_LPI2C=m
CONFIG_I2C_MESON=m
CONFIG_I2C_MV64XXX=y
@@ -3760,6 +3770,7 @@ CONFIG_GPIO_SYSFS=y
CONFIG_GPIO_CDEV=y
CONFIG_GPIO_CDEV_V1=y
CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_REGMAP=m
#
# Memory mapped GPIO drivers
@@ -3778,6 +3789,7 @@ CONFIG_GPIO_GENERIC_PLATFORM=y
# CONFIG_GPIO_HLWD is not set
# CONFIG_GPIO_LOGICVC is not set
# CONFIG_GPIO_MB86S7X is not set
+CONFIG_GPIO_MPC8XXX=y
CONFIG_GPIO_MVEBU=y
CONFIG_GPIO_MXC=m
CONFIG_GPIO_PL061=y
@@ -3798,7 +3810,8 @@ CONFIG_GPIO_ADNP=m
# CONFIG_GPIO_GW_PLD is not set
# CONFIG_GPIO_MAX7300 is not set
# CONFIG_GPIO_MAX732X is not set
-# CONFIG_GPIO_PCA953X is not set
+CONFIG_GPIO_PCA953X=m
+CONFIG_GPIO_PCA953X_IRQ=y
# CONFIG_GPIO_PCA9570 is not set
# CONFIG_GPIO_PCF857X is not set
# CONFIG_GPIO_TPIC2810 is not set
@@ -4306,6 +4319,8 @@ CONFIG_MFD_RK808=y
# CONFIG_MFD_RN5T618 is not set
# CONFIG_MFD_SEC_CORE is not set
# CONFIG_MFD_SI476X_CORE is not set
+CONFIG_MFD_SIMPLE_MFD_I2C=m
+# CONFIG_MFD_SL28CPLD is not set
CONFIG_MFD_SM501=m
CONFIG_MFD_SM501_GPIO=y
# CONFIG_MFD_SKY81452 is not set
@@ -6413,10 +6428,10 @@ CONFIG_MMC_SDHCI_PLTFM=y
CONFIG_MMC_SDHCI_OF_ARASAN=m
# CONFIG_MMC_SDHCI_OF_ASPEED is not set
# CONFIG_MMC_SDHCI_OF_AT91 is not set
-# CONFIG_MMC_SDHCI_OF_ESDHC is not set
+CONFIG_MMC_SDHCI_OF_ESDHC=m
# CONFIG_MMC_SDHCI_OF_DWCMSHC is not set
# CONFIG_MMC_SDHCI_CADENCE is not set
-# CONFIG_MMC_SDHCI_ESDHC_IMX is not set
+CONFIG_MMC_SDHCI_ESDHC_IMX=m
CONFIG_MMC_SDHCI_PXAV3=m
# CONFIG_MMC_SDHCI_F_SDH30 is not set
# CONFIG_MMC_SDHCI_MILBEAUT is not set
@@ -6635,6 +6650,7 @@ CONFIG_RTC_DRV_V3020=m
# on-CPU RTC drivers
#
# CONFIG_RTC_DRV_IMXDI is not set
+# CONFIG_RTC_DRV_FSL_FTM_ALARM is not set
CONFIG_RTC_DRV_MESON_VRTC=m
CONFIG_RTC_DRV_PL030=m
CONFIG_RTC_DRV_PL031=m
@@ -6693,6 +6709,7 @@ CONFIG_DW_DMAC_PCI=m
# CONFIG_DW_EDMA is not set
# CONFIG_DW_EDMA_PCIE is not set
# CONFIG_SF_PDMA is not set
+# CONFIG_FSL_DPAA2_QDMA is not set
#
# DMA Clients
@@ -6735,6 +6752,7 @@ CONFIG_VFIO_PCI_INTX=y
CONFIG_VFIO_PCI=m
# CONFIG_VFIO_PLATFORM is not set
# CONFIG_VFIO_MDEV is not set
+# CONFIG_VFIO_FSL_MC is not set
CONFIG_VIRT_DRIVERS=y
CONFIG_VIRTIO=y
CONFIG_VIRTIO_PCI_LIB=y
@@ -6821,8 +6839,12 @@ CONFIG_COMMON_CLK_SI570=m
# CONFIG_COMMON_CLK_CDCE706 is not set
# CONFIG_COMMON_CLK_CDCE925 is not set
# CONFIG_COMMON_CLK_CS2000_CP is not set
+CONFIG_COMMON_CLK_FSL_FLEXSPI=m
+# CONFIG_COMMON_CLK_FSL_SAI is not set
CONFIG_CLK_TWL6040=m
# CONFIG_COMMON_CLK_AXI_CLKGEN is not set
+CONFIG_CLK_QORIQ=y
+CONFIG_CLK_LS1028A_PLLDIG=m
CONFIG_COMMON_CLK_XGENE=y
# CONFIG_COMMON_CLK_PWM is not set
# CONFIG_COMMON_CLK_VC5 is not set
@@ -6934,13 +6956,16 @@ CONFIG_IOMMU_SUPPORT=y
CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set
-# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set
+CONFIG_IOMMU_DEFAULT_PASSTHROUGH=y
CONFIG_OF_IOMMU=y
CONFIG_IOMMU_DMA=y
CONFIG_ROCKCHIP_IOMMU=y
CONFIG_SUN50I_IOMMU=y
-# CONFIG_ARM_SMMU is not set
-# CONFIG_ARM_SMMU_V3 is not set
+CONFIG_ARM_SMMU=y
+# CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set
+# CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT is not set
+CONFIG_ARM_SMMU_V3=y
+# CONFIG_ARM_SMMU_V3_SVA is not set
# CONFIG_VIRTIO_IOMMU is not set
#
@@ -6984,7 +7009,14 @@ CONFIG_RASPBERRYPI_POWER=y
#
# NXP/Freescale QorIQ SoC drivers
#
+CONFIG_FSL_DPAA=y
+# CONFIG_FSL_DPAA_CHECKING is not set
+# CONFIG_FSL_BMAN_TEST is not set
+# CONFIG_FSL_QMAN_TEST is not set
# CONFIG_QUICC_ENGINE is not set
+CONFIG_FSL_GUTS=y
+CONFIG_FSL_MC_DPIO=y
+CONFIG_DPAA2_CONSOLE=y
# end of NXP/Freescale QorIQ SoC drivers
#
@@ -7085,6 +7117,7 @@ CONFIG_ARM_GIC_V2M=y
CONFIG_ARM_GIC_V3=y
CONFIG_ARM_GIC_V3_ITS=y
CONFIG_ARM_GIC_V3_ITS_PCI=y
+CONFIG_ARM_GIC_V3_ITS_FSL_MC=y
# CONFIG_AL_FIC is not set
CONFIG_BRCMSTB_L2_IRQ=y
CONFIG_DW_APB_ICTL=y
@@ -7094,6 +7127,8 @@ CONFIG_MVEBU_ICU=y
CONFIG_MVEBU_ODMI=y
CONFIG_MVEBU_PIC=y
CONFIG_MVEBU_SEI=y
+CONFIG_LS_EXTIRQ=y
+CONFIG_LS_SCFG_MSI=y
CONFIG_PARTITION_PERCPU=y
CONFIG_MESON_IRQ_GPIO=y
CONFIG_IMX_IRQSTEER=y
@@ -7621,7 +7656,7 @@ CONFIG_CRYPTO_NULL=y
CONFIG_CRYPTO_NULL2=y
CONFIG_CRYPTO_PCRYPT=m
CONFIG_CRYPTO_CRYPTD=y
-CONFIG_CRYPTO_AUTHENC=m
+CONFIG_CRYPTO_AUTHENC=y
CONFIG_CRYPTO_TEST=m
CONFIG_CRYPTO_SIMD=m
CONFIG_CRYPTO_ENGINE=m
@@ -7659,7 +7694,7 @@ CONFIG_CRYPTO_ECB=y
CONFIG_CRYPTO_LRW=m
# CONFIG_CRYPTO_OFB is not set
CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XTS=y
# CONFIG_CRYPTO_KEYWRAP is not set
CONFIG_CRYPTO_NHPOLY1305=m
# CONFIG_CRYPTO_ADIANTUM is not set
@@ -7751,7 +7786,20 @@ CONFIG_CRYPTO_DEV_ALLWINNER=y
# CONFIG_CRYPTO_DEV_SUN4I_SS is not set
# CONFIG_CRYPTO_DEV_SUN8I_CE is not set
# CONFIG_CRYPTO_DEV_SUN8I_SS is not set
-# CONFIG_CRYPTO_DEV_FSL_CAAM is not set
+CONFIG_CRYPTO_DEV_FSL_CAAM_COMMON=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API_DESC=y
+CONFIG_CRYPTO_DEV_FSL_CAAM=m
+# CONFIG_CRYPTO_DEV_FSL_CAAM_DEBUG is not set
+CONFIG_CRYPTO_DEV_FSL_CAAM_JR=m
+CONFIG_CRYPTO_DEV_FSL_CAAM_RINGSIZE=9
+# CONFIG_CRYPTO_DEV_FSL_CAAM_INTC is not set
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_AHASH_API=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_PKC_API=y
+CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API=y
+CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM=y
# CONFIG_CRYPTO_DEV_SAHARA is not set
# CONFIG_CRYPTO_DEV_ATMEL_ECC is not set
# CONFIG_CRYPTO_DEV_ATMEL_SHA204A is not set
diff --git a/config/rootfiles/core/171/filelists/files b/config/rootfiles/core/171/filelists/files
index 99f93cd89..50d76c958 100644
--- a/config/rootfiles/core/171/filelists/files
+++ b/config/rootfiles/core/171/filelists/files
@@ -1,3 +1,4 @@
+etc/rc.d/init.d/setclock
lib/firmware/amdgpu/aldebaran_mec2.bin
lib/firmware/amdgpu/aldebaran_mec.bin
lib/firmware/amdgpu/beige_goby_ce.bin
diff --git a/config/u-boot/boot.cmd b/config/u-boot/boot.cmd
index 64e9c05bc..a27996780 100644
--- a/config/u-boot/boot.cmd
+++ b/config/u-boot/boot.cmd
@@ -1,3 +1,12 @@
+# Traverse Ten64 board can boot EFI directly
+# Redirect it to the EFI process already in the
+# bootloader
+# (Remove on release of the 1.x Ten64 firmwire package)
+if test "${board}" = "ten64"; then
+ load ${devtype} ${devnum}:2 ${kernel_addr_r} efi/boot/bootaa64.efi
+ bootefi ${kernel_addr_r} ${fdt_addr_r}
+fi;
+
if test ${boot_dev} = ""; then
setenv boot_dev mmc;
setenv root_dev /dev/mmcblk0p3;
diff --git a/config/unbound/unbound-dhcp-leases-bridge b/config/unbound/unbound-dhcp-leases-bridge
index 1446c88df..e89e0446b 100644
--- a/config/unbound/unbound-dhcp-leases-bridge
+++ b/config/unbound/unbound-dhcp-leases-bridge
@@ -441,8 +441,11 @@ class Lease(object):
if address in subnet:
return subnets[subnet]
- # Fall back to localdomain if no match could be found
- return "localdomain"
+ # Load main settings
+ settings = self.read_settings("/var/ipfire/main/settings")
+
+ # Fall back to the host domain if no match could be found
+ return settings.get("DOMAINNAME", "localdomain")
@staticmethod
@functools.cache
diff --git a/lfs/linux b/lfs/linux
index d35057b22..ae9745d53 100644
--- a/lfs/linux
+++ b/lfs/linux
@@ -153,6 +153,9 @@ endif
ifeq "$(BUILD_ARCH)" "aarch64"
# Apply Arm-multiarch kernel patches.
cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1
+ # Apply NXP DPAA2 specific patches
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15-arm64-dpaa2-fix-lock-issue.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5-15-arm64-dpaa2-add-support-for-10g-modes.patch
endif
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-3.14.79-amba-fix.patch
diff --git a/lfs/rsync b/lfs/rsync
index c27258929..07a56f96d 100644
--- a/lfs/rsync
+++ b/lfs/rsync
@@ -26,7 +26,7 @@ include Config
SUMMARY = Versatile tool for fast incremental file transfer
-VER = 3.2.4
+VER = 3.2.6
THISAPP = rsync-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = rsync
-PAK_VER = 15
+PAK_VER = 16
DEPS =
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = a67fcb9619874f1c5346a876138e59f4bf508a90736f830fb2b4eaf180ab11f15a0a7db9b3b28c3b990b77c2b0973d8e668bf509e4134f464159ed3172f53d80
+$(DL_FILE)_BLAKE2 = fa0c4aa9cdffbc9ffd4f81e8c3cdc1fda7080f80c1923084c6d705e6872caaba31c13de4603c9462f312dbbdae76520c27d3f4f40b327f1e66c7127b1d05ea73
install : $(TARGET)
@@ -85,9 +85,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
# Replace shebang in rsync-ssl
cd $(DIR_APP) && sed -i -e "s@^#!.*@#!/bin/bash@" rsync-ssl
- # Fix for CVE-2022-29154
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/rsync-CVE-2022-29154.patch
-
cd $(DIR_APP) && ./configure \
--prefix=/usr \
--without-included-popt \
diff --git a/src/initscripts/system/setclock b/src/initscripts/system/setclock
index b566eb716..963507f9a 100644
--- a/src/initscripts/system/setclock
+++ b/src/initscripts/system/setclock
@@ -29,6 +29,14 @@ case ${1} in
boot_mesg "Setting system clock..."
+ FDT_COMPAT_FILE="/sys/firmware/devicetree/base/compatible"
+ # RTC may not be automatically loaded on some
+ # non-x86 machines
+ if [ -f "${FDT_COMPAT_FILE}" ] && \
+ ( grep -q "traverse,ten64" "${FDT_COMPAT_FILE}" ); then
+ modprobe rtc-rx8025
+ fi
+
# udev not create the rtc symlink if rtc is in the kernel
if [ ! -e /dev/rtc ]; then
if [ -e /dev/rtc0 ]; then
diff --git a/src/patches/linux/linux-5-15-arm64-dpaa2-add-support-for-10g-modes.patch b/src/patches/linux/linux-5-15-arm64-dpaa2-add-support-for-10g-modes.patch
new file mode 100644
index 000000000..ef8d459b7
--- /dev/null
+++ b/src/patches/linux/linux-5-15-arm64-dpaa2-add-support-for-10g-modes.patch
@@ -0,0 +1,39 @@
+From c314138bd045e050432158ab021160de3ba51c5e Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel(a)armlinux.org.uk>
+Date: Thu, 30 Jan 2020 22:42:38 +0000
+Subject: [PATCH 2/4] net: dpaa2-mac: add support for more 10G modes
+
+Phylink documentation says:
+ * Note that the PHY may be able to transform from one connection
+ * technology to another, so, eg, don't clear 1000BaseX just
+ * because the MAC is unable to BaseX mode. This is more about
+ * clearing unsupported speeds and duplex settings. The port modes
+ * should not be cleared; phylink_set_port_modes() will help with this.
+
+So add the missing 10G modes.
+
+Signed-off-by: Russell King <rmk+kernel(a)armlinux.org.uk>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+index 8fe32ed4f6dc..3be849cee47b 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+@@ -140,6 +140,12 @@ static void dpaa2_mac_validate(struct phylink_config *config,
+ case PHY_INTERFACE_MODE_10GBASER:
+ case PHY_INTERFACE_MODE_USXGMII:
+ phylink_set(mask, 10000baseT_Full);
++ phylink_set(mask, 10000baseKR_Full);
++ phylink_set(mask, 10000baseCR_Full);
++ phylink_set(mask, 10000baseSR_Full);
++ phylink_set(mask, 10000baseLR_Full);
++ phylink_set(mask, 10000baseLRM_Full);
++ phylink_set(mask, 10000baseER_Full);
+ if (state->interface == PHY_INTERFACE_MODE_10GBASER)
+ break;
+ phylink_set(mask, 5000baseT_Full);
+--
+2.30.1
+
diff --git a/src/patches/linux/linux-5.15-arm64-dpaa2-fix-lock-issue.patch b/src/patches/linux/linux-5.15-arm64-dpaa2-fix-lock-issue.patch
new file mode 100644
index 000000000..587821bac
--- /dev/null
+++ b/src/patches/linux/linux-5.15-arm64-dpaa2-fix-lock-issue.patch
@@ -0,0 +1,81 @@
+From 3a39dbe0c0c41f8dba5246ce6e2c5c4bcd6ba661 Mon Sep 17 00:00:00 2001
+From: Ioana Ciornei <ioana.ciornei(a)nxp.com>
+Date: Thu, 21 Nov 2019 21:15:25 +0200
+Subject: [PATCH 1/4] dpaa2-eth: do not hold rtnl_lock on phylink_create() or
+ _destroy()
+
+The rtnl_lock should not be held when calling phylink_create() or
+phylink_destroy() since it leads to the deadlock listed below:
+
+[ 18.656576] rtnl_lock+0x18/0x20
+[ 18.659798] sfp_bus_add_upstream+0x28/0x90
+[ 18.663974] phylink_create+0x2cc/0x828
+[ 18.667803] dpaa2_mac_connect+0x14c/0x2a8
+[ 18.671890] dpaa2_eth_connect_mac+0x94/0xd8
+
+Fix this by moving the _lock() and _unlock() calls just outside of
+phylink_of_phy_connect() and phylink_disconnect_phy().
+
+Fixes: 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink")
+Reported-by: Russell King <linux(a)armlinux.org.uk>
+Signed-off-by: Ioana Ciornei <ioana.ciornei(a)nxp.com>
+Signed-off-by: Russell King <rmk+kernel(a)armlinux.org.uk>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 ----
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c | 4 ++++
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index 8b7a29e1e221..20e65053f036 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -4214,12 +4214,10 @@ static irqreturn_t dpni_irq0_handler_thread(int irq_num, void *arg)
+ dpaa2_eth_set_mac_addr(netdev_priv(net_dev));
+ dpaa2_eth_update_tx_fqids(priv);
+
+- rtnl_lock();
+ if (dpaa2_eth_has_mac(priv))
+ dpaa2_eth_disconnect_mac(priv);
+ else
+ dpaa2_eth_connect_mac(priv);
+- rtnl_unlock();
+ }
+
+ return IRQ_HANDLED;
+@@ -4513,9 +4511,7 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev)
+ #endif
+
+ unregister_netdev(net_dev);
+- rtnl_lock();
+ dpaa2_eth_disconnect_mac(priv);
+- rtnl_unlock();
+
+ dpaa2_eth_dl_port_del(priv);
+ dpaa2_eth_dl_traps_unregister(priv);
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+index ae6d382d8735..8fe32ed4f6dc 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+@@ -351,7 +351,9 @@ int dpaa2_mac_connect(struct dpaa2_mac *mac)
+ if (mac->pcs)
+ phylink_set_pcs(mac->phylink, &mac->pcs->pcs);
+
++ rtnl_lock();
+ err = phylink_fwnode_phy_connect(mac->phylink, dpmac_node, 0);
++ rtnl_unlock();
+ if (err) {
+ netdev_err(net_dev, "phylink_fwnode_phy_connect() = %d\n", err);
+ goto err_phylink_destroy;
+@@ -372,7 +374,9 @@ void dpaa2_mac_disconnect(struct dpaa2_mac *mac)
+ if (!mac->phylink)
+ return;
+
++ rtnl_lock();
+ phylink_disconnect_phy(mac->phylink);
++ rtnl_unlock();
+ phylink_destroy(mac->phylink);
+ dpaa2_pcs_destroy(mac);
+ }
+--
+2.30.1
+
diff --git a/src/patches/rsync-CVE-2022-29154.patch b/src/patches/rsync-CVE-2022-29154.patch
deleted file mode 100644
index d3b4499a4..000000000
--- a/src/patches/rsync-CVE-2022-29154.patch
+++ /dev/null
@@ -1,322 +0,0 @@
-commit b7231c7d02cfb65d291af74ff66e7d8c507ee871
-Author: Wayne Davison <wayne(a)opencoder.net>
-Date: Sun Jul 31 16:55:34 2022 -0700
-
- Some extra file-list safety checks.
-
-diff --git a/exclude.c b/exclude.c
-index 39073a0c..b670c8ba 100644
---- a/exclude.c
-+++ b/exclude.c
-@@ -27,16 +27,22 @@ extern int am_server;
- extern int am_sender;
- extern int eol_nulls;
- extern int io_error;
-+extern int xfer_dirs;
-+extern int recurse;
- extern int local_server;
- extern int prune_empty_dirs;
- extern int ignore_perishable;
-+extern int old_style_args;
-+extern int relative_paths;
- extern int delete_mode;
- extern int delete_excluded;
- extern int cvs_exclude;
- extern int sanitize_paths;
- extern int protocol_version;
-+extern int list_only;
- extern int module_id;
-
-+extern char *filesfrom_host;
- extern char curr_dir[MAXPATHLEN];
- extern unsigned int curr_dir_len;
- extern unsigned int module_dirlen;
-@@ -44,8 +50,10 @@ extern unsigned int module_dirlen;
- filter_rule_list filter_list = { .debug_type = "" };
- filter_rule_list cvs_filter_list = { .debug_type = " [global CVS]" };
- filter_rule_list daemon_filter_list = { .debug_type = " [daemon]" };
-+filter_rule_list implied_filter_list = { .debug_type = " [implied]" };
-
- int saw_xattr_filter = 0;
-+int trust_sender_filter = 0;
-
- /* Need room enough for ":MODS " prefix plus some room to grow. */
- #define MAX_RULE_PREFIX (16)
-@@ -292,6 +300,125 @@ static void add_rule(filter_rule_list *listp, const char *pat, unsigned int pat_
- }
- }
-
-+/* Each arg the client sends to the remote sender turns into an implied include
-+ * that the receiver uses to validate the file list from the sender. */
-+void add_implied_include(const char *arg)
-+{
-+ filter_rule *rule;
-+ int arg_len, saw_wild = 0, backslash_cnt = 0;
-+ int slash_cnt = 1; /* We know we're adding a leading slash. */
-+ const char *cp;
-+ char *p;
-+ if (old_style_args || list_only || filesfrom_host != NULL)
-+ return;
-+ if (relative_paths) {
-+ cp = strstr(arg, "/./");
-+ if (cp)
-+ arg = cp+3;
-+ } else {
-+ if ((cp = strrchr(arg, '/')) != NULL)
-+ arg = cp + 1;
-+ }
-+ arg_len = strlen(arg);
-+ if (arg_len) {
-+ if (strpbrk(arg, "*[?")) {
-+ /* We need to add room to escape backslashes if wildcard chars are present. */
-+ cp = arg;
-+ while ((cp = strchr(cp, '\\')) != NULL) {
-+ arg_len++;
-+ cp++;
-+ }
-+ saw_wild = 1;
-+ }
-+ arg_len++; /* Leave room for the prefixed slash */
-+ rule = new0(filter_rule);
-+ if (!implied_filter_list.head)
-+ implied_filter_list.head = implied_filter_list.tail = rule;
-+ else {
-+ rule->next = implied_filter_list.head;
-+ implied_filter_list.head = rule;
-+ }
-+ rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0);
-+ p = rule->pattern = new_array(char, arg_len + 1);
-+ *p++ = '/';
-+ cp = arg;
-+ while (*cp) {
-+ switch (*cp) {
-+ case '\\':
-+ backslash_cnt++;
-+ if (saw_wild)
-+ *p++ = '\\';
-+ *p++ = *cp++;
-+ break;
-+ case '/':
-+ if (p[-1] == '/') /* This is safe because of the initial slash. */
-+ break;
-+ if (relative_paths) {
-+ filter_rule const *ent;
-+ int found = 0;
-+ *p = '\0';
-+ for (ent = implied_filter_list.head; ent; ent = ent->next) {
-+ if (ent != rule && strcmp(ent->pattern, rule->pattern) == 0)
-+ found = 1;
-+ }
-+ if (!found) {
-+ filter_rule *R_rule = new0(filter_rule);
-+ R_rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0);
-+ R_rule->pattern = strdup(rule->pattern);
-+ R_rule->u.slash_cnt = slash_cnt;
-+ R_rule->next = implied_filter_list.head;
-+ implied_filter_list.head = R_rule;
-+ }
-+ }
-+ slash_cnt++;
-+ *p++ = *cp++;
-+ break;
-+ default:
-+ *p++ = *cp++;
-+ break;
-+ }
-+ }
-+ *p = '\0';
-+ rule->u.slash_cnt = slash_cnt;
-+ arg = (const char *)rule->pattern;
-+ }
-+
-+ if (recurse || xfer_dirs) {
-+ /* Now create a rule with an added "/" & "**" or "*" at the end */
-+ rule = new0(filter_rule);
-+ if (recurse)
-+ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD | FILTRULE_WILD2;
-+ else
-+ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD;
-+ /* A +4 in the len leaves enough room for / * * \0 or / * \0 \0 */
-+ if (!saw_wild && backslash_cnt) {
-+ /* We are appending a wildcard, so now the backslashes need to be escaped. */
-+ p = rule->pattern = new_array(char, arg_len + backslash_cnt + 3 + 1);
-+ cp = arg;
-+ while (*cp) {
-+ if (*cp == '\\')
-+ *p++ = '\\';
-+ *p++ = *cp++;
-+ }
-+ } else {
-+ p = rule->pattern = new_array(char, arg_len + 3 + 1);
-+ if (arg_len) {
-+ memcpy(p, arg, arg_len);
-+ p += arg_len;
-+ }
-+ }
-+ if (p[-1] != '/')
-+ *p++ = '/';
-+ *p++ = '*';
-+ if (recurse)
-+ *p++ = '*';
-+ *p = '\0';
-+ rule->u.slash_cnt = slash_cnt + 1;
-+ rule->next = implied_filter_list.head;
-+ implied_filter_list.head = rule;
-+ }
-+}
-+
- /* This frees any non-inherited items, leaving just inherited items on the list. */
- static void pop_filter_list(filter_rule_list *listp)
- {
-@@ -718,7 +845,7 @@ static void report_filter_result(enum logcode code, char const *name,
- : name_flags & NAME_IS_DIR ? "directory"
- : "file";
- rprintf(code, "[%s] %sing %s %s because of pattern %s%s%s\n",
-- w, actions[*w!='s'][!(ent->rflags & FILTRULE_INCLUDE)],
-+ w, actions[*w=='g'][!(ent->rflags & FILTRULE_INCLUDE)],
- t, name, ent->pattern,
- ent->rflags & FILTRULE_DIRECTORY ? "/" : "", type);
- }
-@@ -890,6 +1017,7 @@ static filter_rule *parse_rule_tok(const char **rulestr_ptr,
- }
- switch (ch) {
- case ':':
-+ trust_sender_filter = 1;
- rule->rflags |= FILTRULE_PERDIR_MERGE
- | FILTRULE_FINISH_SETUP;
- /* FALL THROUGH */
-diff --git a/flist.c b/flist.c
-index 1ba306bc..0e6bf782 100644
---- a/flist.c
-+++ b/flist.c
-@@ -73,6 +73,7 @@ extern int need_unsorted_flist;
- extern int sender_symlink_iconv;
- extern int output_needs_newline;
- extern int sender_keeps_checksum;
-+extern int trust_sender_filter;
- extern int unsort_ndx;
- extern uid_t our_uid;
- extern struct stats stats;
-@@ -83,8 +84,7 @@ extern char curr_dir[MAXPATHLEN];
-
- extern struct chmod_mode_struct *chmod_modes;
-
--extern filter_rule_list filter_list;
--extern filter_rule_list daemon_filter_list;
-+extern filter_rule_list filter_list, implied_filter_list, daemon_filter_list;
-
- #ifdef ICONV_OPTION
- extern int filesfrom_convert;
-@@ -986,6 +986,19 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
- exit_cleanup(RERR_UNSUPPORTED);
- }
-
-+ if (*thisname != '.' || thisname[1] != '\0') {
-+ int filt_flags = S_ISDIR(mode) ? NAME_IS_DIR : NAME_IS_FILE;
-+ if (!trust_sender_filter /* a per-dir filter rule means we must trust the sender's filtering */
-+ && filter_list.head && check_filter(&filter_list, FINFO, thisname, filt_flags) < 0) {
-+ rprintf(FERROR, "ERROR: rejecting excluded file-list name: %s\n", thisname);
-+ exit_cleanup(RERR_PROTOCOL);
-+ }
-+ if (implied_filter_list.head && check_filter(&implied_filter_list, FINFO, thisname, filt_flags) <= 0) {
-+ rprintf(FERROR, "ERROR: rejecting unrequested file-list name: %s\n", thisname);
-+ exit_cleanup(RERR_PROTOCOL);
-+ }
-+ }
-+
- if (inc_recurse && S_ISDIR(mode)) {
- if (one_file_system) {
- /* Room to save the dir's device for -x */
-diff --git a/io.c b/io.c
-index cf94cee7..a6e3ed30 100644
---- a/io.c
-+++ b/io.c
-@@ -419,6 +419,7 @@ static void forward_filesfrom_data(void)
- while (s != eob) {
- if (*s++ == '\0') {
- ff_xb.len = s - sob - 1;
-+ add_implied_include(sob);
- if (iconvbufs(ic_send, &ff_xb, &iobuf.out, flags) < 0)
- exit_cleanup(RERR_PROTOCOL); /* impossible? */
- write_buf(iobuf.out_fd, s-1, 1); /* Send the '\0'. */
-@@ -450,9 +451,12 @@ static void forward_filesfrom_data(void)
- char *f = ff_xb.buf + ff_xb.pos;
- char *t = ff_xb.buf;
- char *eob = f + len;
-+ char *cur = t;
- /* Eliminate any multi-'\0' runs. */
- while (f != eob) {
- if (!(*t++ = *f++)) {
-+ add_implied_include(cur);
-+ cur = t;
- while (f != eob && *f == '\0')
- f++;
- }
-diff --git a/main.c b/main.c
-index 58920a2d..5a7fbdd7 100644
---- a/main.c
-+++ b/main.c
-@@ -89,6 +89,7 @@ extern int backup_dir_len;
- extern int basis_dir_cnt;
- extern int default_af_hint;
- extern int stdout_format_has_i;
-+extern int trust_sender_filter;
- extern struct stats stats;
- extern char *stdout_format;
- extern char *logfile_format;
-@@ -104,7 +105,7 @@ extern char curr_dir[MAXPATHLEN];
- extern char backup_dir_buf[MAXPATHLEN];
- extern char *basis_dir[MAX_BASIS_DIRS+1];
- extern struct file_list *first_flist;
--extern filter_rule_list daemon_filter_list;
-+extern filter_rule_list daemon_filter_list, implied_filter_list;
-
- uid_t our_uid;
- gid_t our_gid;
-@@ -635,6 +636,7 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char **remote_argv, in
- #ifdef ICONV_CONST
- setup_iconv();
- #endif
-+ trust_sender_filter = 1;
- } else if (local_server) {
- /* If the user didn't request --[no-]whole-file, force
- * it on, but only if we're not batch processing. */
-@@ -1500,6 +1502,8 @@ static int start_client(int argc, char *argv[])
- char *dummy_host;
- int dummy_port = rsync_port;
- int i;
-+ if (filesfrom_fd < 0)
-+ add_implied_include(remote_argv[0]);
- /* For remote source, any extra source args must have either
- * the same hostname or an empty hostname. */
- for (i = 1; i < remote_argc; i++) {
-@@ -1523,6 +1527,7 @@ static int start_client(int argc, char *argv[])
- if (!rsync_port && !*arg) /* Turn an empty arg into a dot dir. */
- arg = ".";
- remote_argv[i] = arg;
-+ add_implied_include(arg);
- }
- }
-
-diff --git a/receiver.c b/receiver.c
-index b3a69da0..93cf8efd 100644
---- a/receiver.c
-+++ b/receiver.c
-@@ -593,10 +593,13 @@ int recv_files(int f_in, int f_out, char *local_name)
- if (DEBUG_GTE(RECV, 1))
- rprintf(FINFO, "recv_files(%s)\n", fname);
-
-- if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0')
-- && check_filter(&daemon_filter_list, FLOG, fname, 0) < 0) {
-- rprintf(FERROR, "attempt to hack rsync failed.\n");
-- exit_cleanup(RERR_PROTOCOL);
-+ if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0')) {
-+ int filt_flags = S_ISDIR(file->mode) ? NAME_IS_DIR : NAME_IS_FILE;
-+ if (check_filter(&daemon_filter_list, FLOG, fname, filt_flags) < 0) {
-+ rprintf(FERROR, "ERROR: rejecting file transfer request for daemon excluded file: %s\n",
-+ fname);
-+ exit_cleanup(RERR_PROTOCOL);
-+ }
- }
-
- #ifdef SUPPORT_XATTRS
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-10-04 14:53 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-04 14:53 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. ca4de263184e2d62239cc6d63caf2a0812d492b5 Peter Müller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox