* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 782c3f28eacfed314cc31df081891c463b137ec2
@ 2026-06-20 12:06 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-06-20 12:06 UTC (permalink / raw)
To: ipfire-scm
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 782c3f28eacfed314cc31df081891c463b137ec2 (commit)
via 71b85d9fc05cff10a19f8cc3031864ab0eb6bd69 (commit)
via 46a30bd31f3d77bb7717767504bc5a411199866b (commit)
via c2682975669d238d0407be63a74adccbd79f7c8a (commit)
via 4d557b23ac3273b7ebd9da4b09438319088f9631 (commit)
from 50dabaee7bcae3ca916c5d85ee6a30e12e4ed88e (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 782c3f28eacfed314cc31df081891c463b137ec2
Author: Robin Roevens <robin.roevens@disroot.org>
Date: Thu Jun 18 19:58:34 2026 +0200
zabbix_agentd: Add support for kresd metrics
Add new UserParameter ipfire.kresd.stats.get for retrieval of kresd metrics using curl over unix-sockert.
Add curl command to sudoers for Zabbix agent to be able to access the unix-socket.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 71b85d9fc05cff10a19f8cc3031864ab0eb6bd69
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Jun 18 17:28:34 2026 +0200
perl-Encode-Locale: New package required as an observium-agent runtime dependency
Fixes: Bug14017
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 46a30bd31f3d77bb7717767504bc5a411199866b
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Jun 18 17:28:33 2026 +0200
observium-agent: Add perl-Encode-Locale as a run-time dependency
Fixes: Bug14017
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit c2682975669d238d0407be63a74adccbd79f7c8a
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Sat Jun 20 12:04:19 2026 +0000
core204: Ship bind and zone-sync
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 4d557b23ac3273b7ebd9da4b09438319088f9631
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Thu Jun 18 18:46:06 2026 +0200
bind: Update to 9.20.24
For details see:
https://downloads.isc.org/isc/bind9/9.20.24/doc/arm/html/notes.html#notes-for-bind-9-20-24
"Notes for BIND 9.20.24
Removed Features
Remove ineffective TCP fallback after repeated UDP timeouts.
When an authoritative server failed to respond to two consecutive UDP
queries, named marked the next retry as TCP but still sent it over UDP,
producing misleading dnstap records. The ineffective retry path has
been removed; a corrected TCP fallback will be restored in future BIND
9 versions. [GL #5529]
Feature Changes
Fall back to TCP on receipt of a UDP response with a mismatched query
ID.
BIND used to wait silently for the correct DNS message ID on a UDP
fetch, even after receiving a response from the expected server with
the wrong ID, leaving room for off-path spoofing attempts to keep
guessing within that window. The resolver now retries the fetch over
TCP on the first such response, and a new MismatchTCP statistics
counter tracks how often the fallback fires. [GL #5449]
Limit the number of glue records cached from a referral.
When a delegation response contained many glue addresses per listed
nameserver, all of them were cached without a per-nameserver bound,
inflating resolver cache memory beyond what resolution could ever use.
The cache now keeps at most 20 IPv4 and 20 IPv6 glue addresses per
nameserver from a delegation. [GL #5701]
Fix a resolver stall on a CNAME response to a DS query.
A validating resolver could stall for about twelve seconds and then
return SERVFAIL when an authoritative server answered a DS query with a
CNAME. Such responses are now rejected promptly, so the query fails
quickly instead of hanging. [GL #5878]
Bug Fixes
The resolver now removes other RRsets at the same name when caching a
CNAME.
When an RRset is in stale cache and the authoritative server changes
the record type to CNAME, the resolver fails to refresh the stale
cache. This has been fixed. [GL #5302]
Fix nxdomain-redirect combined with dns64.
When a resolver was configured with both nxdomain-redirect and dns64 in
the same view, an AAAA query for a nonexistent name could abort named.
The combination failed whenever the redirect zone held A records but no
AAAA records. The server now serves the empty AAAA response from the
redirect zone as-is, instead of attempting DNS64 synthesis on top of
it. [GL #5789]
Fix DNS64 owner case after DNAME restart.
When BIND 9 was configured to use DNS64 and encountered a DNAME
redirect, it could end up using freed memory for the DNS response owner
name. This caused the response to contain corrupted data. This fix
ensures the correct owner name is used when constructing the
synthesized response after a DNAME redirect. [GL #5934]
Clear REDIRECT flag when it isn't needed.
When nxdomain-redirect is in use, and a recursive query is used to get
the redirected answer, a flag is set to distinguish it from a normal
recursive response. Previously, that flag was left set afterward, which
could trigger an assertion if a normal recursive query was sent later
on behalf of the same client: for example, because the filter-aaaa
plugin was in use. This has been fixed. [GL #5936]
Disable output escaping in bind9.xsl.
The statistics charts were not displaying on some browsers. This has
been fixed. [GL #5990]
Fix crash on badly configured secondary signer.
A badly configured secondary signer that was missing the file entry
caused the server to crash, rather than to reject the configuration.
This has been fixed. [GL #5993]
Fix a possible crash on concurrent TKEY DELETE for the same key.
On a server configured with tkey-gssapi-keytab, an authenticated peer
could crash named by sending two TKEY DELETE requests for the same
dynamic key in rapid succession. This has been fixed. [GL #6001]
Reject RRSIG records covering meta-types.
A recursive resolver could accept and cache an RRSIG record whose
Type-Covered field named a meta-type (ANY, AXFR, IXFR, MAILA, MAILB),
even though no real RRset of those types ever exists. Such records are
now rejected by the DNS message parser. [GL #6002]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/bind | 10 +++++-----
.../rootfiles/{oldcore/100 => core/204}/filelists/bind | 0
.../{oldcore => core}/204/filelists/zone-sync | 0
.../perl-Convert-TNEF => packages/perl-Encode-Locale} | 12 ++++++------
config/zabbix_agentd/sudoers | 1 +
config/zabbix_agentd/userparameter_ipfire.conf | 3 +++
lfs/bind | 4 ++--
lfs/observium-agent | 6 +++---
lfs/{perl-Net-IP => perl-Encode-Locale} | 18 +++++++++---------
make.sh | 1 +
10 files changed, 30 insertions(+), 25 deletions(-)
copy config/rootfiles/{oldcore/100 => core/204}/filelists/bind (100%)
copy config/rootfiles/{oldcore => core}/204/filelists/zone-sync (100%)
copy config/rootfiles/{common/perl-Convert-TNEF => packages/perl-Encode-Locale} (50%)
copy lfs/{perl-Net-IP => perl-Encode-Locale} (87%)
Difference in files:
diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind
index d85eb2b3f..43e1a813d 100644
--- a/config/rootfiles/common/bind
+++ b/config/rootfiles/common/bind
@@ -241,18 +241,18 @@ usr/bin/nsupdate
#usr/include/ns/types.h
#usr/include/ns/update.h
#usr/include/ns/xfrout.h
-usr/lib/libdns-9.20.23.so
+usr/lib/libdns-9.20.24.so
#usr/lib/libdns.la
#usr/lib/libdns.so
-usr/lib/libisc-9.20.23.so
+usr/lib/libisc-9.20.24.so
#usr/lib/libisc.la
#usr/lib/libisc.so
-usr/lib/libisccc-9.20.23.so
+usr/lib/libisccc-9.20.24.so
#usr/lib/libisccc.la
#usr/lib/libisccc.so
-usr/lib/libisccfg-9.20.23.so
+usr/lib/libisccfg-9.20.24.so
#usr/lib/libisccfg.la
#usr/lib/libisccfg.so
-usr/lib/libns-9.20.23.so
+usr/lib/libns-9.20.24.so
#usr/lib/libns.la
#usr/lib/libns.so
diff --git a/config/rootfiles/core/204/filelists/bind b/config/rootfiles/core/204/filelists/bind
new file mode 120000
index 000000000..48a0ebaef
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/bind
@@ -0,0 +1 @@
+../../../common/bind
\ No newline at end of file
diff --git a/config/rootfiles/core/204/filelists/zone-sync b/config/rootfiles/core/204/filelists/zone-sync
new file mode 120000
index 000000000..14f00b0c6
--- /dev/null
+++ b/config/rootfiles/core/204/filelists/zone-sync
@@ -0,0 +1 @@
+../../../common/zone-sync
\ No newline at end of file
diff --git a/config/rootfiles/packages/perl-Encode-Locale b/config/rootfiles/packages/perl-Encode-Locale
new file mode 100644
index 000000000..d687f5ec7
--- /dev/null
+++ b/config/rootfiles/packages/perl-Encode-Locale
@@ -0,0 +1,6 @@
+#usr/lib/perl5/site_perl/5.36.0/Encode
+usr/lib/perl5/site_perl/5.36.0/Encode/Locale.pm
+#usr/lib/perl5/site_perl/5.36.0/xxxMACHINExxx-linux-thread-multi/auto/Encode
+#usr/lib/perl5/site_perl/5.36.0/xxxMACHINExxx-linux-thread-multi/auto/Encode/Locale
+#usr/lib/perl5/site_perl/5.36.0/xxxMACHINExxx-linux-thread-multi/auto/Encode/Locale/.packlist
+#usr/share/man/man3/Encode::Locale.3
diff --git a/config/zabbix_agentd/sudoers b/config/zabbix_agentd/sudoers
index 50a9e69de..13edfcce9 100644
--- a/config/zabbix_agentd/sudoers
+++ b/config/zabbix_agentd/sudoers
@@ -12,3 +12,4 @@ zabbix ALL=(ALL) NOPASSWD: /opt/pakfire/pakfire status, /usr/sbin/fping, /usr/sb
zabbix ALL=(ALL) NOPASSWD: /usr/local/bin/openvpnctrl rw log, /usr/local/bin/wireguardctrl dump
zabbix ALL=(ALL) NOPASSWD: /var/ipfire/zabbix_agentd/scripts/ipfire_certificate_detail.sh
zabbix ALL=(ALL) NOPASSWD: /var/ipfire/zabbix_agentd/scripts/ipfire_services.pl
+zabbix ALL=(ALL) NOPASSWD: /usr/bin/curl -s --unix-socket /var/run/knot-resolver/kres-api.sock http\://localhost/metrics/json
diff --git a/config/zabbix_agentd/userparameter_ipfire.conf b/config/zabbix_agentd/userparameter_ipfire.conf
index e88c20298..a91e305a3 100644
--- a/config/zabbix_agentd/userparameter_ipfire.conf
+++ b/config/zabbix_agentd/userparameter_ipfire.conf
@@ -10,9 +10,12 @@ UserParameter=ipfire.captive.clients,awk -F ',' 'length($2) == 17 {sum += 1} END
UserParameter=ipfire.services.get,sudo /var/ipfire/zabbix_agentd/scripts/ipfire_services.pl
# IPS throughput bypassed/scanned/whitelisted in bytes/type (JSON)
UserParameter=ipfire.ips.throughput.get,sudo /usr/local/bin/getipstat -xm | awk 'BEGIN{ORS="";print "{"}/Chain IPS/{f=1}/BYPASSED/&&f{printf "\"bypassed\":%s",$2}/SCANNED/&&f{printf ",\"scanned\":%s",$2}/WHITELISTED/&&f{printf ",\"whitelisted\":%s",$2}/^$/{f=0}END{print "}"}'
+# Knot DNS resolver statistics
+UserParameter=ipfire.kresd.stats.get,sudo /usr/bin/curl -s --unix-socket /var/run/knot-resolver/kres-api.sock http://localhost/metrics/json
# Addon: Guardian: Number of currently blocked IP's
UserParameter=ipfire.guardian.blocked.count,sudo /usr/local/bin/getipstat | awk 'BEGIN{ORS="";c=0}/Chain GUARDIAN/{f=1}/DROP/&&f{c++}/^$/{f=0}END{print c}'
#
# Allow item key to be called with (unused) parameters. This allows the #SINGLETON method of discovering this item only when specific service is active
Alias=ipfire.ips.throughput.get[]:ipfire.ips.throughput.get
+Alias=ipfire.kresd.stats.get[]:ipfire.kresd.stats.get
Alias=ipfire.guardian.blocked.count[]:ipfire.guardian.blocked.count
\ No newline at end of file
diff --git a/lfs/bind b/lfs/bind
index 67a1a1ef0..ef03c4e7b 100644
--- a/lfs/bind
+++ b/lfs/bind
@@ -25,7 +25,7 @@
include Config
-VER = 9.20.23
+VER = 9.20.24
THISAPP = bind-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f4f5526fac2832685204ccc93087df3ce2dd3fbb267a5b68d0cf8074365a8f1d6e7b9ff130b41a023ea8dd96499a361a0396188f0a71a08630c54ec13e63c39a
+$(DL_FILE)_BLAKE2 = 06fde034ef2d3f4432caf5d9a701f70f32dec94be63e64dfd5484d9e008245ca5707c067c0fa19e1e2c0a3d83d2bbeb465c6ec18aceed48ffaad6973c8a77a54
install : $(TARGET)
diff --git a/lfs/observium-agent b/lfs/observium-agent
index 20982467c..86d7c5f47 100644
--- a/lfs/observium-agent
+++ b/lfs/observium-agent
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -34,9 +34,9 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/observium
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = observium-agent
-PAK_VER = 4
+PAK_VER = 5
-DEPS = xinetd
+DEPS = xinetd perl-Encode-Locale
SERVICES =
diff --git a/lfs/perl-Encode-Locale b/lfs/perl-Encode-Locale
new file mode 100644
index 000000000..e89251853
--- /dev/null
+++ b/lfs/perl-Encode-Locale
@@ -0,0 +1,88 @@
+###############################################################################
+# #
+# IPFire.org - A linux based firewall #
+# Copyright (C) 2026-2026 IPFire Team <info@ipfire.org> #
+# #
+# This program is free software: you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation, either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# This program is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+# #
+###############################################################################
+
+
+###############################################################################
+# Definitions
+###############################################################################
+
+include Config
+
+SUMMARY = Perl extension to determine the locale encoding
+
+VER = 1.05
+
+THISAPP = Encode-Locale-$(VER)
+DL_FILE = ${THISAPP}.tar.gz
+DL_FROM = $(URL_IPFIRE)
+DIR_APP = $(DIR_SRC)/$(THISAPP)
+TARGET = $(DIR_INFO)/$(THISAPP)
+PROG = perl-Encode-Locale
+DEPS =
+PAK_VER = 1
+
+SERVICES =
+
+###############################################################################
+# Top-level Rules
+###############################################################################
+
+objects = $(DL_FILE)
+
+$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
+
+$(DL_FILE)_BLAKE2 = f66bac8ebf012e7673b344b3899bed755558b80833a68b009b6083aeadd9d69748a63bee4e5e3c20dffaf7f2551fd6c9c778273ae992752c426e081d35715dee
+
+install : $(TARGET)
+
+check : $(patsubst %,$(DIR_CHK)/%,$(objects))
+
+download :$(patsubst %,$(DIR_DL)/%,$(objects))
+
+b2 : $(subst %,%_BLAKE2,$(objects))
+
+dist:
+ @$(PAK)
+
+###############################################################################
+# Downloading, checking, b2sum
+###############################################################################
+
+$(patsubst %,$(DIR_CHK)/%,$(objects)) :
+ @$(CHECK)
+
+$(patsubst %,$(DIR_DL)/%,$(objects)) :
+ @$(LOAD)
+
+$(subst %,%_BLAKE2,$(objects)) :
+ @$(B2SUM)
+
+###############################################################################
+# Installation Details
+###############################################################################
+
+$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
+ @$(PREBUILD)
+ @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
+ cd $(DIR_APP) && perl Makefile.PL
+ cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
+ cd $(DIR_APP) && make install
+ @rm -rf $(DIR_APP)
+ @$(POSTBUILD)
diff --git a/make.sh b/make.sh
index cfcbb7635..b060bfbdf 100755
--- a/make.sh
+++ b/make.sh
@@ -1884,6 +1884,7 @@ build_system() {
lfsmake2 qemu
lfsmake2 nagios_nrpe
lfsmake2 nagios-plugins
+ lfsmake2 perl-Encode-Locale
lfsmake2 observium-agent
lfsmake2 ebtables
lfsmake2 faad2
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-06-20 12:06 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-06-20 12:06 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 782c3f28eacfed314cc31df081891c463b137ec2 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox