* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 8b32b8e5e46bc0e2e9e26f2581aaa16a3c4b355d
@ 2026-07-27 19:03 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-07-27 19:03 UTC (permalink / raw)
To: ipfire-scm
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 8b32b8e5e46bc0e2e9e26f2581aaa16a3c4b355d (commit)
via e7be2a9d3d3ed2381198575b36c3c02e0f6107cf (commit)
from 1c6c29c1bcb92768c0a603781b70de3395839d00 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 8b32b8e5e46bc0e2e9e26f2581aaa16a3c4b355d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Mon Jul 27 19:38:12 2026 +0200
keepalived: Update to version 2.4.3
- Update from version 2.3.4 to 2.4.3
- Update of rootfile
- Changelog
2.4.3
Improvements
vrrp: sign the auth_hmac trailer once per advertisement, so the copies sent to
unicast peers share one sequence and HMAC and cost one HMAC per advertisement
instead of one per peer. Pointed out by Aditya Dogra.
Fixes
vrrp: recover the auth_hmac sequence after a corrected clock step. Time mode
restarts from the clock once the stored timestamp runs past the freshness
window. Monotonic mode keeps strict growth. Pointed out by Aditya Dogra.
vrrp: expire an auth_hmac replay mark outside the freshness window, so a receiver
stops rejecting a sender that recovered from a step. Monotonic mode keeps its
mark. Pointed out by Aditya Dogra.
2.4.2
New
vrrp: add a receive-only auth_hmac mode that verifies a present trailer but sends
none. A cluster can now migrate receive-only, then permissive, then enforce,
with every sweep hitless. permissive on its own risked dual active, since a
reloaded node signed toward peers that could not yet verify. Suggested by
Aditya Dogra.
Fixed
vrrp: IPv6 auth_hmac dropped every signed advert. The kernel writes the IPv6
checksum after the trailer is signed, so a receiver that hashed the packet as
received never matched the sender. The VRRP checksum and HMAC fields are now
read as zero on both sides, which removes the asymmetry, as the IETF draft
now specifies. Reported by Aditya Dogra.
2.4.1
Changed
vrrp: the auth_hmac sequence number now splits into seconds, a sub-second
fraction and a small counter. The sub-second timestamp makes same-instant
ties rare, so the previous full width counter is no longer needed.
vrrp: order auth_hmac sequences with serial number arithmetic (RFC 1982) and a
modular freshness window, so the field wrap is a non-event and no special
epoch is required.
vrrp: rename the trailer value from MAC to HMAC, since VRRP already uses MAC for
the Ethernet address. This renames the related log message, the Invalid HMAC
statistic, and the auth_ext_invalid_hmac JSON field.
2.4.0
New
vrrp: new auth_hmac authentication extension. It appends an HMAC-SHA256 trailer
to each advert, carrying a truncated tag and a time based sequence number, so
a receiver can prove an advert came from a holder of the shared key and is
fresh. It behaves the same for VRRPv2 and v3, IPv4 and IPv6, unicast and
multicast, and it is the recommended protection for unicast where the TTL
guard no longer holds. Keys are 32 to 64 bytes, carried inline, read from a
file:, or sourced from a systemd encrypted credential, and support make
before break rotation. A mode permissive eases migration on a running
cluster, and per instance counters report the outcome of each verification.
See the VRRP HMAC Authentication article and the keepalived.conf(5) man page.
config: add ${_ENV ...} to read values from environment variables, so secrets and
host specific values stay out of keepalived.conf.
vrrp: add the vrrp_delay_after_boot global keyword, and hold VRRP instances and
gratuitous ARP until vrrp_startup_delay expires.
check: add an SNMP variable for the number of checkers not run per real server.
Security
check: fix a heap buffer overflow in the HTTP checker regex partial match, where
a crafted server response could overflow the checker buffer.
check: fix a stack buffer overflow in set_ping_group_range.
parser: resolve a heap buffer overflow, fix an invalid free and a SIGFPE in
builtin definitions, and ignore config lines that contain NUL bytes.
core: harden parsing of kernel and untrusted input. Bound netlink attribute
access and require a kernel origin on netlink messages, bound the /proc stat
parse in track_process, validate the BFD event pipe read length, and clamp
the SMTP alert body offset.
notify: validate the resolved symlink target of scripts and of the notify FIFO,
and harden the script execution environment and quoting.
dbus: deny keepalived methods by default, validate the object path, and narrow
the CreateInstance vrid.
vrrp: mask the authentication password in dump and JSON output, wipe HMAC key
material after use, validate the VRRPv2 password against the checked length,
and bound hardware address and interface name copies.
core: abort on out of memory in STRDUP, STRNDUP and REALLOC rather than risk an
invalid free, correct JSON string escaping, and set CLOEXEC on the IPVS
netlink socket.
Improvements
www: the keepalived.org website is rebuilt on Material for MkDocs. The former
Sphinx user guide is migrated into the new framework, the historical
ChangeLog stays available, and the old Sphinx build dependencies and Coverity
scaffolding are removed.
build: discover OpenSSL through pkg-config, which drives the header checks and the
link flags.
build: resolve warnings and errors identified by gcc 16.
build: portability fixes to configure.ac, using command -v, printf and the = test
operator, and avoiding bash substring expansion.
snap: stage the libssl3 and libkmod2 packages.
github: build keepalived explicitly for CodeQL and bump codeql-action to v4.
Fixes
vrrp: fix the strict mode check for instances that have unicast peers.
vrrp: correct the report of MASTER/BACKUP on the notify FIFO at reload.
vrrp: warn when iptables rules cannot be applied, and remove VMAC firewall rules
before deleting the link.
vrrp: log an error when updating sysctl settings fails, and reset rate-limit flags
only after accepting a packet.
check: fix an MD5 context leak and a DNS response length check.
parser: keep the full 64-bit value in read_unsigned64, fix ${NAME param}
substitution when trailing text follows, and handle ~SEQ with a missing close
bracket.
config: improve parameter substitution, comment stripping and continuation lines,
and check PATH_MAX when resolving track file paths.
snmp: reject an out of range instance index and fix operator precedence.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit e7be2a9d3d3ed2381198575b36c3c02e0f6107cf
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Mon Jul 27 19:38:11 2026 +0200
bacula: Update to version 15.0.3
- Update from version 15.0.2 to 15.0.3
- Update of rootfile
- Version 15.0.3 has now been released for 16 months now so seems time to be updated.
- Changelog
15.0.3
- Use the CLOEXEC function in sockets and all file descriptors
- BSOCK improve POLL to detect and report errors
- Check for backquote in check_for_invalid_chars() function
- Detect unsolvable volume cycle in split_bsr_loop()
- Enforce malware database download from Abuse.ch
- Fix #10947 time output without century for locale that use multi bytes utf8
- Fix #10985 Report the FD/SD Encryption in the Job record and the job output
- Fix #11048 About LastBackedUpTo StorageGroup policy not correctly set
- Fix #11058 About fsync error reported for tape driver
- Fix #11197 About error when using bextract on ZSTD compressed data
- Fix #11251 About bcopy not mounting correctly volumes provided with -i option
- Fix Client/Uname field not always updated after a status client
- Fix compilation issue with zstd and without lzo
- Fix compilation variable in var.c and expand.c
- Fix org#2714 Fails to take TLS Allowed CN into account
- Fix org#2738 About error message with generated fileset
- Fix org#2748 About compilation error with ZSTD and not LZO enabled
- Update bsmtp copyright information
- baculum: Add cloud storage status to SD status endpoint
- baculum: Add enable and disable client, storage, job and schedule endpoints
- baculum: Add name and sort parameters to filesets filter
- baculum: Add new query parameters in M365EmailList endpoint
- baculum: Fix #2722 port from Bacularis fix for displaying schedule list
- baculum: Fix compatibility with very old PHP 5.4
- baculum: Fix missing scopes on supported OAuth2 scope list
- baculum: Fix sorting in filesets endpoint if unique filesets parameter is used
- baculum: Update API documentation
- bpipe: Fix org#2737 About segfault with bpipe
- k8s: Add Ingress integration backup/restore
- k8s: Add dockerfile to create an image to compile k8s plugin in any debian/ubuntu distribution
- k8s: Add more options to debug
- k8s: Add new level(In pvc annotations) in selection of backup mode
- k8s: Add parallel job in same namespace
- k8s: Add pvc annotation takes precedence without pod annotation
- k8s: Add pvc clean up from old backup jobs
- k8s: Avoid pvc data when pvc is in Pending status. k8s: Fix redoing backup when pvcdata is 0 bytes and the backup mode is standard
- k8s: Avoid pvcs backup when the pvc status is Terminating
- k8s: Fix #0010901 - Problem when restore service clusterIPs
- k8s: Fix #0011005: ModuleNotFoundError: No module named 'baculak8s.plugins.k8sbackend.ingress'
- k8s: Fix get provisioner permissions
- k8s: Fix restore problem where pod require the pvc data when it starts
- k8s: Fix show pvdatada message when you don't use it
- k8s: Get images from repositories with auth
- show minimal backtrace if gdb is not installed
- win32: Fix unwanted debug messages in windows File Daemon
Bugs fixed/closed since last release:
10291 10901 10947 10985 11005 11048 11058 11197 11251 2722
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/packages/bacula | 6 +++---
config/rootfiles/packages/keepalived | 1 +
lfs/bacula | 8 ++++----
lfs/keepalived | 6 +++---
4 files changed, 11 insertions(+), 10 deletions(-)
Difference in files:
diff --git a/config/rootfiles/packages/bacula b/config/rootfiles/packages/bacula
index ff4e908d3..deb3af76a 100644
--- a/config/rootfiles/packages/bacula
+++ b/config/rootfiles/packages/bacula
@@ -23,13 +23,13 @@ etc/rc.d/init.d/bacula
#opt/bacula
#opt/bacula/log
#usr/lib/bpipe-fd.so
-usr/lib/libbac-15.0.2.so
+usr/lib/libbac-15.0.3.so
#usr/lib/libbac.la
usr/lib/libbac.so
-usr/lib/libbaccfg-15.0.2.so
+usr/lib/libbaccfg-15.0.3.so
#usr/lib/libbaccfg.la
usr/lib/libbaccfg.so
-usr/lib/libbacfind-15.0.2.so
+usr/lib/libbacfind-15.0.3.so
#usr/lib/libbacfind.la
usr/lib/libbacfind.so
#usr/sbin/bacula
diff --git a/config/rootfiles/packages/keepalived b/config/rootfiles/packages/keepalived
index b0fbe7363..4c18e2c21 100644
--- a/config/rootfiles/packages/keepalived
+++ b/config/rootfiles/packages/keepalived
@@ -26,6 +26,7 @@ etc/keepalived/samples
#etc/keepalived/samples/keepalived.conf.vrrp.scripts
#etc/keepalived/samples/keepalived.conf.vrrp.static_ipaddress
#etc/keepalived/samples/keepalived.conf.vrrp.sync
+#etc/keepalived/samples/keepalived.service.d.auth_hmac.conf
#etc/keepalived/samples/sample.misccheck.smbcheck.sh
#etc/keepalived/samples/sample_notify_fifo.sh
etc/rc.d/init.d/keepalived
diff --git a/lfs/bacula b/lfs/bacula
index 3da34fa52..0c98f7930 100644
--- a/lfs/bacula
+++ b/lfs/bacula
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -26,7 +26,7 @@ include Config
SUMMARY = Enterprise-ready Network Backup Software
-VER = 15.0.2
+VER = 15.0.3
THISAPP = bacula-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = bacula
-PAK_VER = 15
+PAK_VER = 16
DEPS =
@@ -51,7 +51,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 1dd0722ce2bb6363936ed9cc9df1b6d842945f17277c77f40884bafc4b0a254c5fdd2c21bd200c6ca8b77c8eb718a319552e50135c9925d2b4ad81a64ab819d2
+$(DL_FILE)_BLAKE2 = 16af09af709406fce5e05b101c3ab1337e24816b353cc1a00c0efe05ba798fdf21f3a36ca1c3f867ff4bd768822494ba5f45d6555d0978754d30e08cfaa638dc
install : $(TARGET)
diff --git a/lfs/keepalived b/lfs/keepalived
index 36c918583..1bc6ac8ca 100644
--- a/lfs/keepalived
+++ b/lfs/keepalived
@@ -26,7 +26,7 @@ include Config
SUMMARY = A keepalive facility for Linux
-VER = 2.3.4
+VER = 2.4.3
THISAPP = keepalived-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = keepalived
-PAK_VER = 17
+PAK_VER = 18
DEPS =
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 6468cbdd8a5ead443bdb0247ad2a2a7043e20f11c72afa870cded9b52ec23ff98493394aa3fee6e4ece953c85585edcfe76582a13532904cbc29b23f65de7850
+$(DL_FILE)_BLAKE2 = a6e170dfcafc14cb8e556ed575bf7d5adcd1a1762aefcbae22c3d633294be1bd096f7f0992516d5b415ca37d7b710cd6b143b00528b126e9abc4218d7a6c343d
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-27 19:03 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-27 19:03 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 8b32b8e5e46bc0e2e9e26f2581aaa16a3c4b355d Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox