* [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 4b639c7ee458cdcc019d316c49f89e0d8e625a4e
@ 2026-07-09 10:32 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-07-09 10:32 UTC (permalink / raw)
To: ipfire-scm
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
via 4b639c7ee458cdcc019d316c49f89e0d8e625a4e (commit)
via 3294144f5a6af41ba103340684f29ef32b92b265 (commit)
via 451afb04fad2964dbea01ce57ff385ff3893d4e9 (commit)
via 4357c574e1654de3872b941bd09de1f881bd1105 (commit)
via 69bb0f25a758028ab2fe71afaffc23fc59f7a80e (commit)
via 684e0ee8d6b3e0bbe4933a9d503026a9bf22a0e4 (commit)
via 61b9c9ad2d0cdd264c4886e3f86e3152ec3a08bd (commit)
via 5eda68d8bf5335ff5fa6cb9d6ee96ae10881587d (commit)
via 1da0e55c9a1545a662ce9e719e3ce13e10a223d4 (commit)
via 9f7dee67a933239c60ebda28b8129063f2bb32b8 (commit)
via 55843db3366fd55cfc760fbe14eaf84bc8163442 (commit)
from 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 4b639c7ee458cdcc019d316c49f89e0d8e625a4e
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed Jul 8 13:58:38 2026 +0000
filesystem-cleanup: Ensure the linker cache is always up to date
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 3294144f5a6af41ba103340684f29ef32b92b265
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu Jul 9 12:09:09 2026 +0200
knot-resolver: Force SafeSearch for mobile version of YouTube
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 451afb04fad2964dbea01ce57ff385ff3893d4e9
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu Jul 9 12:07:57 2026 +0200
knot-resolver: Don't overwrite zone apexes
For SafeSearch we want to ensure that there are no leaks, but it is for
obvious reasons nonsensical to overwrite the apex.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 4357c574e1654de3872b941bd09de1f881bd1105
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed Jul 8 18:24:44 2026 +0200
knot-resolver: Use native logging functions
The dummy functions were only to keep development quick when building
the proof-of-concept.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 69bb0f25a758028ab2fe71afaffc23fc59f7a80e
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu Jul 9 10:31:48 2026 +0000
core203: Restart firewall & sysklogd
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 684e0ee8d6b3e0bbe4933a9d503026a9bf22a0e4
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed Jul 8 18:09:12 2026 +0200
sysklogd: Fix sending packets to remove syslog servers
When sysklogd binds to localhost, it will try to use that socket to
reach any remove syslog servers which fails because of obvious reasons.
Therefore we will have to let sysklogd bind to 0.0.0.0 and we create a
separate firewall so that we won't accept any packets from the network
but localhost which is accepted in the LOOPBACK chain.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 61b9c9ad2d0cdd264c4886e3f86e3152ec3a08bd
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed Jul 8 17:50:30 2026 +0200
dns.cgi: Show if we are running in Recursor Mode
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 5eda68d8bf5335ff5fa6cb9d6ee96ae10881587d
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed Jul 8 13:34:44 2026 +0000
knot-resolver: Make multiple addresses work
Backport of: https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1854
Fixes: #14015 - Knot Resolver: returns only first A record (of multiple) for given name
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 1da0e55c9a1545a662ce9e719e3ce13e10a223d4
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed Jul 8 10:42:57 2026 +0000
knot-resolver: Update to 6.4.0
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9f7dee67a933239c60ebda28b8129063f2bb32b8
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu Jul 9 10:30:13 2026 +0000
core203: Ship suricata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 55843db3366fd55cfc760fbe14eaf84bc8163442
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed Jul 8 10:09:27 2026 +0000
suricata: Update to 8.0.6
https://redmine.openinfosecfoundation.org/versions/234
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/knot-resolver/config.lua | 14 +-
config/knot-resolver/leases.lua | 16 +-
config/rootfiles/common/knot-resolver | 14 +-
config/rootfiles/core/203/update.sh | 3 +
doc/language_issues.de | 1 -
doc/language_issues.en | 1 +
doc/language_issues.es | 1 -
doc/language_issues.fr | 1 -
doc/language_issues.it | 1 +
doc/language_issues.nl | 1 +
doc/language_issues.pl | 1 +
doc/language_issues.ru | 1 +
doc/language_issues.tr | 1 +
doc/language_issues.tw | 1 -
doc/language_issues.zh | 1 -
html/cgi-bin/dns.cgi | 5 +
lfs/knot-resolver | 6 +-
lfs/suricata | 4 +-
src/initscripts/system/firewall | 6 +
src/initscripts/system/sysklogd | 2 +-
...resolver-6.3-policy-add-flag-to-force-TCP.patch | 37 ---
src/patches/knot-resolver-6.4.0-1854.patch | 251 +++++++++++++++++++++
src/scripts/filesystem-cleanup | 5 +
23 files changed, 301 insertions(+), 73 deletions(-)
delete mode 100644 src/patches/knot-resolver-6.3-policy-add-flag-to-force-TCP.patch
create mode 100644 src/patches/knot-resolver-6.4.0-1854.patch
Difference in files:
diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua
index c382434c2..ba93fc311 100644
--- a/config/knot-resolver/config.lua
+++ b/config/knot-resolver/config.lua
@@ -329,24 +329,22 @@ function config.load_safesearch(settings)
-- Enable Googe Safe Search
for i, tld in ipairs(GOOGLE_TLDS) do
- local name = string.format("google.%s", tld)
-
- add({ name, "www." .. name}, "forcesafesearch.google.com")
+ add({ string.format("www.google.%s", tld) }, "forcesafesearch.google.com")
end
-- Enable Bing Strict Search
- add({ "bing.com", "www.bing.com" }, "strict.bing.com")
+ add({ "www.bing.com" }, "strict.bing.com")
-- Enable DuckDuckGo Safe Search
- add({ "duckduckgo.com", "www.duckduckgo.com" }, "safe.duckduckgo.com")
+ add({ "www.duckduckgo.com" }, "safe.duckduckgo.com")
-- Enable Yandex Family Search
- add({ "yandex.com", "www.yandex.com" }, "familysearch.yandex.com")
- add({ "yandex.ru", "www.yandex.ru" }, "familysearch.yandex.ru")
+ add({ "www.yandex.com" }, "familysearch.yandex.com")
+ add({ "www.yandex.ru" }, "familysearch.yandex.ru")
-- Enable YouTube Safe Search
if settings["ENABLE_SAFE_SEARCH_YOUTUBE"] == "on" then
- add({ "youtube.com", "www.youtube.com" }, "restrictmoderate.youtube.com")
+ add({ "m.youtube.com", "www.youtube.com" }, "restrictmoderate.youtube.com")
end
-- Create a new zone
diff --git a/config/knot-resolver/leases.lua b/config/knot-resolver/leases.lua
index e07885e60..186dfe4d6 100644
--- a/config/knot-resolver/leases.lua
+++ b/config/knot-resolver/leases.lua
@@ -1,6 +1,10 @@
-- Load modules
+local ffi = require("ffi")
local sqlite3 = require("lsqlite3")
+-- Get access to the C interface
+local C = ffi.C
+
local DB_PATH = "/var/lib/knot-resolver/leases.db"
local TTL = 60
@@ -9,14 +13,6 @@ local db
local sql_fwd
local sql_rev
-local function log_error(s)
- print(s)
-end
-
-local function log_debug(s)
- print(s)
-end
-
-- Initializes the module
function M.init()
-- Open the database
@@ -24,7 +20,7 @@ function M.init()
-- Fail if we cannot open the database
if not db then
- log_error("leases: Failed to open " .. DB_PATH)
+ log_error(C.LOG_GRP_RESOLVER, "leases: Failed to open " .. DB_PATH)
return -1
end
@@ -129,7 +125,7 @@ function M.answer()
-- Log action
log_debug(
- string.format("Called for %s (%d)", qname, qtype)
+ C.LOG_GRP_RESOLVER, string.format("Called for %s (%d)", qname, qtype)
)
local answer = {}
diff --git a/config/rootfiles/common/knot-resolver b/config/rootfiles/common/knot-resolver
index a64cfd4ad..9d5a83460 100644
--- a/config/rootfiles/common/knot-resolver
+++ b/config/rootfiles/common/knot-resolver
@@ -109,13 +109,13 @@ usr/lib/knot-resolver/zonefile.lua
usr/lib/libkres.so.9
#usr/lib/pkgconfig/libkres.pc
usr/lib/python3.10/site-packages/knot_resolver
-usr/lib/python3.10/site-packages/knot_resolver-6.3.0-py3.10.egg-info
-usr/lib/python3.10/site-packages/knot_resolver-6.3.0-py3.10.egg-info/PKG-INFO
-usr/lib/python3.10/site-packages/knot_resolver-6.3.0-py3.10.egg-info/SOURCES.txt
-usr/lib/python3.10/site-packages/knot_resolver-6.3.0-py3.10.egg-info/dependency_links.txt
-usr/lib/python3.10/site-packages/knot_resolver-6.3.0-py3.10.egg-info/entry_points.txt
-usr/lib/python3.10/site-packages/knot_resolver-6.3.0-py3.10.egg-info/requires.txt
-usr/lib/python3.10/site-packages/knot_resolver-6.3.0-py3.10.egg-info/top_level.txt
+usr/lib/python3.10/site-packages/knot_resolver-6.4.0-py3.10.egg-info
+usr/lib/python3.10/site-packages/knot_resolver-6.4.0-py3.10.egg-info/PKG-INFO
+usr/lib/python3.10/site-packages/knot_resolver-6.4.0-py3.10.egg-info/SOURCES.txt
+usr/lib/python3.10/site-packages/knot_resolver-6.4.0-py3.10.egg-info/dependency_links.txt
+usr/lib/python3.10/site-packages/knot_resolver-6.4.0-py3.10.egg-info/entry_points.txt
+usr/lib/python3.10/site-packages/knot_resolver-6.4.0-py3.10.egg-info/requires.txt
+usr/lib/python3.10/site-packages/knot_resolver-6.4.0-py3.10.egg-info/top_level.txt
#usr/lib/python3.10/site-packages/knot_resolver/__init__.py
#usr/lib/python3.10/site-packages/knot_resolver/client
#usr/lib/python3.10/site-packages/knot_resolver/client/__init__.py
diff --git a/config/rootfiles/core/203/update.sh b/config/rootfiles/core/203/update.sh
index 110111934..5b314664f 100644
--- a/config/rootfiles/core/203/update.sh
+++ b/config/rootfiles/core/203/update.sh
@@ -119,7 +119,10 @@ ldconfig
/usr/local/bin/sshctrl
# Start services
+/etc/init.d/firewall restart
+/etc/init.d/sysklogd restart
/etc/init.d/fcron restart
+/etc/init.d/suricata restart
# Restart IPsec
if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then
diff --git a/doc/language_issues.de b/doc/language_issues.de
index bfcb004a6..2682349e2 100644
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -261,7 +261,6 @@ WARNING: translation string unused: dns mode for qname minimisation
WARNING: translation string unused: dns new 0
WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns proxy server
-WARNING: translation string unused: dns recursor mode
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dnsbl acl
diff --git a/doc/language_issues.en b/doc/language_issues.en
index 2bbfef5b5..903e75868 100644
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -613,6 +613,7 @@ WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS ser
WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns recursor mode = Recursor Mode
WARNING: untranslated string: dns resolver = DNS Resolver
WARNING: untranslated string: dns servers = DNS Servers
WARNING: untranslated string: dns title = Domain Name System
diff --git a/doc/language_issues.es b/doc/language_issues.es
index 99941f8f3..b47e0f34b 100644
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -286,7 +286,6 @@ WARNING: translation string unused: dns mode for qname minimisation
WARNING: translation string unused: dns new 0
WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns proxy server
-WARNING: translation string unused: dns recursor mode
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index 79d276e4d..d0611eb25 100644
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -286,7 +286,6 @@ WARNING: translation string unused: dns mode for qname minimisation
WARNING: translation string unused: dns new 0
WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns proxy server
-WARNING: translation string unused: dns recursor mode
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dnssec disabled warning
diff --git a/doc/language_issues.it b/doc/language_issues.it
index a03d4abf2..6a234503e 100644
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -1044,6 +1044,7 @@ WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS ser
WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns recursor mode = Recursor Mode
WARNING: untranslated string: dns resolver = DNS Resolver
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index 19a67628d..6df55b9b6 100644
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -1043,6 +1043,7 @@ WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS ser
WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns recursor mode = Recursor Mode
WARNING: untranslated string: dns resolver = DNS Resolver
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 385e281ce..d84ed5f79 100644
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -999,6 +999,7 @@ WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS ser
WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns recursor mode = Recursor Mode
WARNING: untranslated string: dns resolver = DNS Resolver
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 819aba832..a4b622777 100644
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -997,6 +997,7 @@ WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS ser
WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns recursor mode = Recursor Mode
WARNING: untranslated string: dns resolver = DNS Resolver
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 12c38a7fa..6b15730eb 100644
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -1025,6 +1025,7 @@ WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS ser
WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns recursor mode = Recursor Mode
WARNING: untranslated string: dns resolver = DNS Resolver
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
diff --git a/doc/language_issues.tw b/doc/language_issues.tw
index 95d63140b..b1df45dea 100644
--- a/doc/language_issues.tw
+++ b/doc/language_issues.tw
@@ -288,7 +288,6 @@ WARNING: translation string unused: dns mode for qname minimisation
WARNING: translation string unused: dns new 0
WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns proxy server
-WARNING: translation string unused: dns recursor mode
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
diff --git a/doc/language_issues.zh b/doc/language_issues.zh
index 95d63140b..b1df45dea 100644
--- a/doc/language_issues.zh
+++ b/doc/language_issues.zh
@@ -288,7 +288,6 @@ WARNING: translation string unused: dns mode for qname minimisation
WARNING: translation string unused: dns new 0
WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns proxy server
-WARNING: translation string unused: dns recursor mode
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi
index c02f0a4b7..6735e61a1 100644
--- a/html/cgi-bin/dns.cgi
+++ b/html/cgi-bin/dns.cgi
@@ -444,6 +444,11 @@ sub show_nameservers () {
$dns_status_col = "${Header::colourred}";
}
+ # Show if we are running in recursor mode
+ if (scalar %dns_servers == 0) {
+ $dns_status_string .= " - $Lang::tr{'dns recursor mode'}";
+ }
+
print <<END;
<table width='100%'>
<tr>
diff --git a/lfs/knot-resolver b/lfs/knot-resolver
index 6bcfd6820..3d49a3bc7 100644
--- a/lfs/knot-resolver
+++ b/lfs/knot-resolver
@@ -24,7 +24,7 @@
include Config
-VER = 6.3.0
+VER = 6.4.0
THISAPP = knot-resolver-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 5745be9d031d58e7a9175d29307fb7453b76a6ef65a3b9970b9e5c256a38b2f13e5f4eb5bd126c44e4263b5dbebef2f5addf9c495c80e4a8d4ebe5c2169c0a9c
+$(DL_FILE)_BLAKE2 = dbe67ea0ad3484aba912406f960568c2c92630910863eaf33aeba9b15dce0279810a7df8844aa7d5617f1055de957445042a80c7479972f185bbfff457e96e1d
install : $(TARGET)
@@ -70,7 +70,7 @@ $(subst %,%_BLAKE2,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
- cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/knot-resolver-6.3-policy-add-flag-to-force-TCP.patch
+ cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/knot-resolver-6.4.0-1854.patch
cd $(DIR_APP) && meson setup \
--prefix=/usr \
-Duser=knot-resolver \
diff --git a/lfs/suricata b/lfs/suricata
index 992128d9d..018209bac 100644
--- a/lfs/suricata
+++ b/lfs/suricata
@@ -24,7 +24,7 @@
include Config
-VER = 8.0.5
+VER = 8.0.6
THISAPP = suricata-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = b8250ecfa2658e780624eaf2812c8bb758602efce8bce2b216efa8338544c2df4c4909cc23a8ddeca5889cc26b7cc147f3d19646b6894c7d259b13b5c056c91e
+$(DL_FILE)_BLAKE2 = 37ceed6b6ac608df628bda315f2e864d82424b66d6e8e64e1b7cebcb306fe90679b0ca2a19f0be98274aaade5d0c6986619182c56a353b93d71bce9d58892f19
install : $(TARGET)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index c7642282f..a97758dc3 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -322,6 +322,12 @@ iptables_init() {
iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
fi
+ # Drop any messages to syslog
+ iptables -N SYSLOG
+ iptables -A SYSLOG -p udp --dport 514 -j DROP
+ iptables -A SYSLOG -p tcp --dport 514 -j DROP
+ iptables -A INPUT -j SYSLOG
+
# WIRELESS chains
iptables -N WIRELESSINPUT
iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
diff --git a/src/initscripts/system/sysklogd b/src/initscripts/system/sysklogd
index c2531b1eb..9263daf0c 100644
--- a/src/initscripts/system/sysklogd
+++ b/src/initscripts/system/sysklogd
@@ -25,7 +25,7 @@
case "${1}" in
start)
boot_mesg "Starting system log daemon..."
- loadproc syslogd -m 0 -r -k -b 127.0.0.1
+ loadproc syslogd -m 0 -r -k
boot_mesg "Saving Bootlog..."
if [ -e /var/log/bootlog ]; then
diff --git a/src/patches/knot-resolver-6.3-policy-add-flag-to-force-TCP.patch b/src/patches/knot-resolver-6.3-policy-add-flag-to-force-TCP.patch
deleted file mode 100644
index f19d5d3bb..000000000
--- a/src/patches/knot-resolver-6.3-policy-add-flag-to-force-TCP.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 5a936de58bc68f6004f6beb5abbb7b7724c6320f Mon Sep 17 00:00:00 2001
-From: Michael Tremer <michael.tremer@ipfire.org>
-Date: Wed, 27 May 2026 11:41:27 +0000
-Subject: [PATCH] policy: Add flag to force TCP as transport
-
-This is already implemented in the backend, but the flag has not been
-exposed. This patch adds the flag so that any forwarders will be
-connected to using TCP.
-
-Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
----
- modules/policy/policy.lua | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/modules/policy/policy.lua b/modules/policy/policy.lua
-index 77fa29a71..88e235a8b 100644
---- a/modules/policy/policy.lua
-+++ b/modules/policy/policy.lua
-@@ -914,6 +914,7 @@ Throws lua exceptions when detecting something fishy.
- i.e. we trust their DNSSEC validation.
- - for auths this inserts a negative trust anchor
- Beware that setting .set_insecure() *later* would override that.
-+ .tcp to force transport over TCP
- \param targets same format as policy.TLS_FORWARD() except that `tls = true`
- can be specified for each address (defaults to false)
- --]]
-@@ -924,6 +925,7 @@ function policy.rule_forward_add(subtree, options, targets)
- {
- is_nods = options.dnssec == false,
- is_auth = options.auth,
-+ is_tcp = options.tcp
- },
- targets_3
- ) == 0)
---
-2.47.3
-
diff --git a/src/patches/knot-resolver-6.4.0-1854.patch b/src/patches/knot-resolver-6.4.0-1854.patch
new file mode 100644
index 000000000..94267c2a4
--- /dev/null
+++ b/src/patches/knot-resolver-6.4.0-1854.patch
@@ -0,0 +1,251 @@
+diff --git a/lib/cache/cdb_api.h b/lib/cache/cdb_api.h
+index 9e8a34d58..b589b564a 100644
+--- a/lib/cache/cdb_api.h
++++ b/lib/cache/cdb_api.h
+@@ -65,11 +65,15 @@ struct kr_cdb_api {
+ * \return error code - accepting RW transactions can fail with LMDB.
+ */
+ int (*commit)(kr_cdb_pt db, struct kr_cdb_stats *stat, bool accept_rw, bool reset_ro);
++ /** Run before a row of operations to ensure they happen in a single RW transaction,
++ * at least in case of successes. */
++ int (*txn_open_rw)(kr_cdb_pt db, struct kr_cdb_stats *stat/*unused*/);
+
+ /* Data access */
+
+ int (*read)(kr_cdb_pt db, struct kr_cdb_stats *stat,
+ const knot_db_val_t *key, knot_db_val_t *val, int maxcount);
++ /* TODO: the behavior of write() around transactions is a bit complex. */
+ int (*write)(kr_cdb_pt db, struct kr_cdb_stats *stat, const knot_db_val_t *key,
+ knot_db_val_t *val, int maxcount);
+
+@@ -111,13 +115,19 @@ struct kr_cdb_api {
+ int (*check_health)(kr_cdb_pt db, struct kr_cdb_stats *stat);
+
+
+- /** Start iterating; return the first *val with *key.
++ /** Start iterating: get the first *val with *key + return error code.
+ *
+- * This only makes sense if !is_cache.
+- * TODO: it only works inside RO transactions for now.
++ * - in cache: ensures a RO transaction (and commits the RW txn if any)
++ * - in ruledb: transaction is preserved if exists, otherwise RO txn gets opened
+ */
+ int (*it_first)(kr_cdb_pt db, struct kr_cdb_stats *stat,
+ const knot_db_val_t *key, knot_db_val_t *val);
+- /** Advance to the next *val with the same key. */
++ /** Advance to the next *val with the same key. Return error code. */
+ int (*it_next)(kr_cdb_pt db, struct kr_cdb_stats *stat, knot_db_val_t *val);
++ /** Delete the current *val + return error code.
++ *
++ * You can it_next() to continue.
++ * This assumed that you got it_first() in a RW txn.
++ */
++ int (*it_del)(kr_cdb_pt db, struct kr_cdb_stats *stat);
+ };
+diff --git a/lib/cache/cdb_lmdb.c b/lib/cache/cdb_lmdb.c
+index 0319b5cbb..6221c9492 100644
+--- a/lib/cache/cdb_lmdb.c
++++ b/lib/cache/cdb_lmdb.c
+@@ -38,12 +38,13 @@ struct lmdb_env
+ *
+ * - only one of (ro,rw) may be active at once
+ * - non-NULL .ro may be active or reset
+- * - non-NULL .rw is always active
++ * - ro_curs can survive an RW transaction and renewed later in an RO txn
++ * - non-NULL .rw is always active, non-NULL rw_curs is always active
+ */
+ struct {
+ bool ro_active, ro_curs_active;
+ MDB_txn *ro, *rw;
+- MDB_cursor *ro_curs;
++ MDB_cursor *ro_curs, *rw_curs;
+ } txn;
+
+ bool is_cache; /**< cache vs. rules; from struct kr_cdb_opts::is_cache */
+@@ -236,6 +237,7 @@ static int cdb_commit(kr_cdb_pt db, struct kr_cdb_stats *stats, bool accept_rw,
+ mdb_txn_abort(env->txn.rw);
+ }
+ env->txn.rw = NULL; /* the transaction got freed even in case of errors */
++ env->txn.rw_curs = NULL; /* auto-closed with txn if existed */
+ } else if (reset_ro && env->txn.ro && env->txn.ro_active) {
+ mdb_txn_reset(env->txn.ro);
+ env->txn.ro_active = false;
+@@ -244,21 +246,39 @@ static int cdb_commit(kr_cdb_pt db, struct kr_cdb_stats *stats, bool accept_rw,
+ return ret;
+ }
+
+-/** Obtain a read-only cursor (and a read-only transaction).
+- * TODO: allow RW transaction (for ruledb iterator) */
++static int cdb_txn_open_rw(kr_cdb_pt db, struct kr_cdb_stats *stat/*unused*/)
++{
++ struct lmdb_env *env = db2env(db);
++ MDB_txn *txn = NULL;
++ return txn_get(env, &txn, false);
++}
++
++/** Obtain a cursor (and a transaction).
++ *
++ * - for cache these are read only
++ * - for policy the RW transaction gets preserved if open */
+ static int txn_curs_get(struct lmdb_env *env, MDB_cursor **curs, struct kr_cdb_stats *stats)
+ {
+ if (kr_fails_assert(env && curs))
+ return kr_error(EINVAL);
+ if (env->txn.ro_curs_active)
+- goto success;
+- /* Only in a read-only txn; TODO: it's a bit messy/coupled
+- * At least for rules we don't do the auto-commit feature. */
+- if (env->txn.rw) {
+- if (!env->is_cache) return kr_error(EINPROGRESS);
++ goto success_ro;
++ /* Only in a read-only txn if for cache; TODO: it's a bit messy/coupled */
++ if (env->txn.rw && env->is_cache) {
+ int ret = cdb_commit(env2db(env), stats, true, false);
+ if (ret) return ret;
+ }
++ if (env->txn.rw && !env->is_cache) {
++ if (!env->txn.rw_curs) {
++ MDB_txn *txn = env->txn.rw;
++ int ret = mdb_cursor_open(txn, env->dbi, &env->txn.rw_curs);
++ if (ret) return lmdb_error(env, ret);
++ }
++ if (kr_fails_assert(env->txn.rw_curs))
++ return kr_error(EINVAL);
++ *curs = env->txn.rw_curs;
++ return kr_ok();
++ }
+ MDB_txn *txn = NULL;
+ int ret = txn_get(env, &txn, true);
+ if (ret) return ret;
+@@ -270,7 +290,7 @@ static int txn_curs_get(struct lmdb_env *env, MDB_cursor **curs, struct kr_cdb_s
+ }
+ if (ret) return lmdb_error(env, ret);
+ env->txn.ro_curs_active = true;
+-success:
++success_ro:
+ kr_assert(env->txn.ro_curs_active && env->txn.ro && env->txn.ro_active
+ && !env->txn.rw);
+ *curs = env->txn.ro_curs;
+@@ -301,6 +321,7 @@ static void txn_abort(struct lmdb_env *env)
+ if (env->txn.rw) {
+ mdb_txn_abort(env->txn.rw);
+ env->txn.rw = NULL; /* the transaction got freed even in case of errors */
++ env->txn.rw_curs = NULL; /* auto-closed with txn if existed */
+ }
+ }
+
+@@ -940,7 +961,7 @@ static int cdb_it_next(kr_cdb_pt db, struct kr_cdb_stats *stats, knot_db_val_t *
+ if (kr_fails_assert(db && val))
+ return kr_error(EINVAL);
+ struct lmdb_env *env = db2env(db);
+- if (kr_fails_assert(!env->is_cache && env->txn.ro_curs_active))
++ if (kr_fails_assert(!env->is_cache && (env->txn.ro_curs_active || env->txn.rw_curs)))
+ return kr_error(EINVAL);
+
+ MDB_cursor *curs = NULL;
+@@ -952,19 +973,35 @@ static int cdb_it_next(kr_cdb_pt db, struct kr_cdb_stats *stats, knot_db_val_t *
+ *val = val_mdb2knot(val2_m);
+ return kr_ok();
+ }
++static int cdb_it_del(kr_cdb_pt db, struct kr_cdb_stats *stats)
++{
++ if (kr_fails_assert(db))
++ return kr_error(EINVAL);
++ struct lmdb_env *env = db2env(db);
++ if (kr_fails_assert(!env->is_cache && env->txn.rw_curs))
++ return kr_error(EINVAL);
++
++ MDB_cursor *curs = NULL;
++ int ret = txn_curs_get(env, &curs, stats);
++ if (ret) return ret;
++ ret = mdb_cursor_del(curs, 0);
++ if (ret) return lmdb_error(env, ret);
++ return kr_ok();
++}
+
+
+ const struct kr_cdb_api *kr_cdb_lmdb(void)
+ {
+ static const struct kr_cdb_api api = {
+ "lmdb",
+- cdb_init, cdb_deinit, cdb_count, cdb_clear, cdb_commit,
++ cdb_init, cdb_deinit, cdb_count, cdb_clear,
++ cdb_commit, cdb_txn_open_rw,
+ cdb_readv, cdb_writev, cdb_remove,
+ cdb_match,
+ cdb_read_leq, cdb_read_less,
+ cdb_usage_percent, cdb_get_maxsize,
+ cdb_check_health,
+- cdb_it_first, cdb_it_next,
++ cdb_it_first, cdb_it_next, cdb_it_del,
+ };
+ return &api;
+ }
+diff --git a/lib/rules/api.c b/lib/rules/api.c
+index d9dbfcf1f..4c213d6f5 100644
+--- a/lib/rules/api.c
++++ b/lib/rules/api.c
+@@ -663,21 +663,27 @@ int kr_rule_local_data_merge(const knot_rrset_t *rrs, const kr_rule_tags_t tags,
+ uint8_t key_data[KEY_MAXLEN];
+ knot_db_val_t key = local_data_key(rrs, key_data, RULESET_DEFAULT);
+ knot_db_val_t val;
++ int ret = ruledb_op(txn_open_rw);
++ if (ret)
++ return kr_error(ret);
+ // Transaction: we assume that we're in a RW transaction already,
+ // so that here we already "have a lock" on the last version.
+- // FIXME: iterate over multiple tags, once iterator supports RW TXN
+- int ret = ruledb_op(read, &key, &val, 1);
++ // Multiple variants are possible, with different tags.
++ for (ret = ruledb_op(it_first, &key, &val); ret == 0; ret = ruledb_op(it_next, &val)) {
++ // we're looking for the same tag-set
++ kr_rule_tags_t tags_old;
++ if (deserialize_fails_assert(&val, &tags_old) || tags_old != tags)
++ continue;
++ kr_rule_opts_t opts_old;
++ if (deserialize_fails_assert(&val, &opts_old))
++ continue;
++ break;
++ }
+ if (abs(ret) == abs(ENOENT))
+ goto fallback;
+ if (ret)
+ return kr_error(ret);
+- // check tags
+- kr_rule_tags_t tags_old;
+- if (deserialize_fails_assert(&val, &tags_old) || tags_old != tags)
+- goto fallback;
+- kr_rule_opts_t opts_old;
+- if (deserialize_fails_assert(&val, &opts_old))
+- goto fallback;
++
+ // merge TTLs
+ uint32_t ttl;
+ if (deserialize_fails_assert(&val, &ttl))
+@@ -700,6 +706,10 @@ int kr_rule_local_data_merge(const knot_rrset_t *rrs, const kr_rule_tags_t tags,
+ mm_ctx_delete(mm);
+ return kr_error(ret);
+ }
++ // ATM ruledb does not overwrite, so we `remove` before `write`.
++ ret = ruledb_op(it_del);
++ if (ret)
++ return kr_error(ret);
+ // everything is ready to insert the merged RRset
+ ret = local_data_ins(key, &rrs_new, NULL, tags, opts);
+ mm_ctx_delete(mm);
+diff --git a/lib/rules/api.h b/lib/rules/api.h
+index feea98e09..c3af5901b 100644
+--- a/lib/rules/api.h
++++ b/lib/rules/api.h
+@@ -144,10 +144,8 @@ const uint32_t KR_RULE_TTL_DEFAULT;
+ KR_EXPORT
+ int kr_rule_local_data_ins(const knot_rrset_t *rrs, const knot_rdataset_t *sig_rds,
+ kr_rule_tags_t tags, kr_rule_opts_t opts);
+-/** Merge RRs into a local data rule.
++/** Merge RRs into a local data rule with the same set of tags.
+ *
+- * - FIXME: with multiple tags variants for the same name-type pair,
+- * you typically end up with a single RR per RRset
+ * - RRSIGs get dropped, if any were attached.
+ * - We assume that this is called with a RW transaction open already,
+ * which is always true in normal usage (long RW txn covering whole config).
diff --git a/src/scripts/filesystem-cleanup b/src/scripts/filesystem-cleanup
index 60e33a772..17cbfb8d3 100644
--- a/src/scripts/filesystem-cleanup
+++ b/src/scripts/filesystem-cleanup
@@ -101,6 +101,11 @@ main() {
done
done
done
+
+ # Update the linker cache again (just in case)
+ ldconfig
+
+ return 0
}
main "$@" || exit $?
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-09 10:32 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-09 10:32 [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 4b639c7ee458cdcc019d316c49f89e0d8e625a4e Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox