From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 854c05bebd6a4eefcb8684c53f612798636fd472 Date: Tue, 15 Aug 2023 16:48:33 +0000 Message-ID: <4RQHJx2Mj6z2xXq@people01.haj.ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9084718228739944462==" List-Id: --===============9084718228739944462== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 854c05bebd6a4eefcb8684c53f612798636fd472 (commit) via 3e4e65dd2872399dc9ad2e589e8eb12ebdcdb0e4 (commit) from 9f1636bf11968b431d9d484745346fa2b07fc5d7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 854c05bebd6a4eefcb8684c53f612798636fd472 Author: Adolf Belka Date: Tue Aug 15 14:13:00 2023 +0200 keepalived: Update to version 2.2.8 =20 - Update from version 2.2.7 to 2.2.8 - Update of rootfile not required - Changelog 2.2.8 31th May 2023 This release brings improvements and fix some minor issues reported. It = add some new VRRP and BFD features as well. New vrrp: Add support for Infiniband over IPv6. Github issue #2100 repor= ted that attempting to use IPv6 over Infinband was causing keepa= lived to segfault It turned out that vrrp_ndisc.c had a comment that it s= till needed to be implemented, which we have now been able to do with som= eone in a position to test it. With many thanks for Itel Levy of NVIDIA, I= srael for reporting the issue and and testing the patch to confir= m that it works. vrrp: Add no_virtual_ipaddress keyword. This keyword suppresses warn= ings for no virtual ipaddresses configured and allows none to be= configured when using VRRPv3. vrrp: Add =E2=80=93enable-nm configure option. =E2=80=93enable-nm ad= ds support for Keepalived telling NetworkManager not to manage VMAC interfaces th= e keepalived creates. Early versions of NM (i.e. at least up to v1.1= 2, but resolved at the latest by v1.18) would set the VMAC inerfaces as= managed by NetworkManager, and then if the underlying interface we= nt down, NM would down the VMAC interface and the VRRP instance wou= ld never recover from fault state. vrrp: add v3_checksum_as_v2 configuration option. RFC 5798 (the VRRP= v3 RFC) states regarging the checksum: 5.2.8. Checksum The checksum field is used to detect data corruption in the VRRP message. The checksum is the 16-bit one=E2=80=99= s complement of the one=E2=80=99s complement sum of the entire VRRP message starti= ng with the version field and a =E2=80=9Cpseudo-header=E2=80= =9D as defined in Section 8.1 of [RFC2460]. The next header field in the =E2=80= =9Cpseudo-header=E2=80=9D should be set to 112 (decimal) for VRRP. For computing the= checksum, the checksum field is set to zero. See RFC1071 for m= ore detail Some manufacturers (e.g. Cisco) interpret this to= mean that the pseudo- header is not included in the checksum c= alculation, since RFC2460 only defines a pseudo-header for IPv6. R= FC3768 (the last VRRPv2 RFC) did not include a pseudo-header in t= he checksum. However, keepalived has always included a pseudo= -header in the VRRPv3 IPv4 checksum, which is also consistent w= ith the default setting in Wireshark. In order to allow interope= ration with Cisco routers, and possibly other manufacturers,= the =E2=80=9Cv3_checksum_as_v2=E2=80=9D keyword, whe= n configured in global_defs to set the default for all vrrp_instances, or in in= dividual vrrp_instances, causes those vrrp_instances to e= xclude the pseudo- header from the checksum. The default ac= tion of including the pseudo- header in the checksum remains uncha= nged. vrrp: Add option to revert to backup if thread timer expires. If the= VRRP process is not scheduled for sufficiently long, another= VRRP instance may have taken over as master. For some users, minimisi= ng the number of master switches is desired, and so if nopreempt is conf= igured (if it is not configured the highest priority instance will take = over as master again), and if it is too long after a thread timer expi= res before keepalived is scheduled to run so that another instance= will probably have taken over as master, we will just revert to backu= p state rather than sending further adverts. The keyword that configur= es this is thread_timer_expired. vrrp: Add optional new JSON format including track_process details. = The original JSON format did not allow for adding additiona= l object types other than the original vrrp instances. This commit add= s a json_version 2, which puts the vrrp instances in a named array and a= dds an array of the track_processes. core: add option to check for malloc=E2=80=99s etc returning NULL. C= onfigure option =E2=80=93enable-malloc-check will cause the returned va= lue of malloc/realloc/strdup/strndup to be checked to ensure t= hat they do not return NULL. If any such call does return NULL a messag= e will be logged and the process will terminate. Unless sysctl vm.overco= mmit_memory =3D=3D 2 (default is usually 0), or the malloc would cause the p= rocess virtual address space to exceed the limit, malloc etc will not = return NULL. It is only once there is a write into the memory block tha= t the memory is actually allocated, and if there is insufficient memory= (including swap space), then the OOM killer will step in to either kill= keepalived, or kill another process. Consequently checking for NULL be= ing returned is generally a waste of time and program size. ipvs: Add option to check OpenSSL mallocs/frees for validity. ipvs: Add option to let SSL_GET shutdown comply with TLS spec. bfd: Add multihop option to conform with RFC5883. RFCs 5881 and 5883= state that port 3784 is used for single hop BFD and port 4784 = is used for multihop. The commit adds configuration option =E2=80=9C= multihop=E2=80=9D to use port 4784 rather than port 3784. Improvements vrrp: Don=E2=80=99t adjust vrrp receive timeout during delayed start= . The timeout for a vrrp instance to become master should not be changed = if an advert is received during the delayed start - the timeout is set = to include the delayed start and the (3 to 4) * advert int delay to ta= ke over as master. vrrp: Remove redundant checks of snmp_option. vrrp: deley freeing vrrp instances until all references are freed. T= rackers etc have lists for vrrp instances that are tracking the= m. Therefore the trackers, and their references, must be freed before th= e vrrp instances are freed. vrrp: restore the vmac ipv6 link-local after flapping. The user is n= ot supposed to shutdown a vmac interface created by keepal= ived. However, it can mistakenly happen. When the link is re-establish= ed, the link-local has disappear (the kernel removes all IPv6 a= ddresses on link down except if keep_addr_on_down sysctl is on) and send= ing VRRP packet is no nore possible. Restore the IPv6 Link-Local after = a VMAC interface flapping. A Link-Local is not set when the VRRP packets= are sent from the base interface (vmac-xmit-base). Note that the IPv6= Virtual Addresses are also removed on link down which is the de= sired behavior. Enabling keep_addr_on_down sysctl would keep the link-l= ocal without this patch but would break this behavior. doc: Man pages and documentation updates. Add explanation of why uni= cast VRRPv3 checksum changed. configure: Add systemd auto option. fix default config file with ${p= refix} use. use back-ticks rather than $(=E2=80=A6) for c= ommmands. Improve checking for ${prefix}. ipvs: Don=E2=80=99t report HTTP_CHECK when it is an SSL_CHECK. ipvs: Work around OpenSSL memory leak in versions 3.0.0 to 3.0.4. Th= e memory leak was observed with OpenSSL 3.0.1, and it is resolve= d by version 3.0.5. Also the leak is not observed in v1.1.1n. ipvs: Simplify SSL_GET handling code. Fixes rpm: Fix RPM spec file to use kmod-lib and kmod-devel rather than li= bkmod. vrrp: Fix NFT support to properly handle build with L4PROTO support. vrrp: Resolve segfault when enable_snmp_vrrp is added at a reload. vrrp: workaround GCC LTO bug causing incorrect VRRPv3 checksum. The = problem was observed with GCC versions 11.2, 11.3.1 and 12.1.1,= on Ubuntu 22.04, Fedora 34, Fedora 36 and Fedora 37 (Rawhide). The probl= em did not occur when not using LTO, nor when using clang, even with LTO. vrrp: fix ipv6 vrrp in fault state because no ipv4 address. Setting = an IPv6 VRRP virtual address on an interface that has no IPv4 a= ddress results in a persistent FAULT state. core: Fix segfault when receive netlink message for static default r= oute added. build: Fix order of -lssl -lcrypto. This needs to be correct in orde= r to be able to use static library linking on Alpine Linux. build: Fix build with libressl. SSL_set0_rbio is provided by libress= l since version 3.4.0 and libressl/openbsd(a)c99939f but SSL_s= et0_wbio is not provided resulting in build failure. build: Fix out of tree builds. Fix build error with =E2=80=93disable= -track-process. build: Fix building with =E2=80=93disable-vmac. build: Fix compiler warning when building without VRRP authenticatio= n. parser: Fix segfault caused by extra =E2=80=98}=E2=80=99 and other p= arser fixes. If there was a configuration error in a block, e.g. a vrrp_instanc= e, keepalived would apply the configuration in the rest of the bloc= k to the previous object of that type, e.g. the previous vrrp = instance. If there had been no previous instance, keepalived would= probably segfault. This commit changes the way the parser work= s. A new instance of an object, e.g. a VRRP instance or a virt= ual server, is only added to the list of those objects once the conf= iguration of that object is complete. In particular it no longer a= pplies the configuration to the last entry on the list of the re= levant object type, but keeps a point to the object currently being= configured. parser: Optimise fixing recalculating updated line length. ipvs: Fix memory leaks when configuration is repeated. Use last entr= y if duplicate definition. lib: Fix malloc check code for CPUs without unaligned memory access. =20 Signed-off-by: Adolf Belka commit 3e4e65dd2872399dc9ad2e589e8eb12ebdcdb0e4 Author: Matthias Fischer Date: Tue Aug 15 18:29:34 2023 +0200 monit: Fix for Bug #13246 - No such file or directory '/etc/monit.d' =20 Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/packages/monit | 1 + lfs/keepalived | 6 +++--- lfs/monit | 1 + 3 files changed, 5 insertions(+), 3 deletions(-) Difference in files: diff --git a/config/rootfiles/packages/monit b/config/rootfiles/packages/monit index 4477ea3d2..a375f848f 100644 --- a/config/rootfiles/packages/monit +++ b/config/rootfiles/packages/monit @@ -1,3 +1,4 @@ +etc/monit.d etc/monitrc usr/bin/monit #usr/share/man/man1/monit.1 diff --git a/lfs/keepalived b/lfs/keepalived index 22bd22dd3..fbb60a2ff 100644 --- a/lfs/keepalived +++ b/lfs/keepalived @@ -26,7 +26,7 @@ include Config =20 SUMMARY =3D A keepalive facility for Linux =20 -VER =3D 2.2.7 +VER =3D 2.2.8 =20 THISAPP =3D keepalived-$(VER) DL_FILE =3D $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM =3D $(URL_IPFIRE) DIR_APP =3D $(DIR_SRC)/$(THISAPP) TARGET =3D $(DIR_INFO)/$(THISAPP) PROG =3D keepalived -PAK_VER =3D 14 +PAK_VER =3D 15 =20 DEPS =3D =20 @@ -48,7 +48,7 @@ objects =3D $(DL_FILE) =20 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) =20 -$(DL_FILE)_BLAKE2 =3D 62c4534eb1eebeac596b628a1fa5fb4069498d532fdeff0dc51afb= c71e90125bff7fcffb897da3fd34765c64f43d7b04dcf184169b1bc2cf33413e109f9f5cdc +$(DL_FILE)_BLAKE2 =3D 3d8d738a0c4e6f00ea8dc3603813d21e52e259d301872f2db16c33= 73c3a034bedcf3f02e19d1b50855d90bbfece863e710d75a67e2d6dd057dfe451608a73fcb =20 install : $(TARGET) =20 diff --git a/lfs/monit b/lfs/monit index ed59a3ef0..6b3eecd4f 100644 --- a/lfs/monit +++ b/lfs/monit @@ -89,6 +89,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make install =20 mkdir -p /var/lib/monit + mkdir -p /etc/monit.d =20 # Install backup include file install -v -m 644 $(DIR_SRC)/config/backup/includes/monit \ hooks/post-receive -- IPFire 2.x development tree --===============9084718228739944462==--