From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hJSjk54TQz2ybk for ; Mon, 10 Aug 2026 08:34:50 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hJSjk4jylz2xjZ for ; Mon, 10 Aug 2026 08:34:50 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hJSjY6VZZzvw for ; Mon, 10 Aug 2026 08:34:41 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786350881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=JdZ/Mv89qixJwMmRiZfhjHKWsmG8eKydIlHhCIc6MFs=; b=22PVmqMrdfc/AVJIhqCf3zItbbe0VmWFfRChsU0bc1mba/RfMu4s/wk0E3OtkuLIaNLwTu J1M+XWy1kmfljvAA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786350881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=JdZ/Mv89qixJwMmRiZfhjHKWsmG8eKydIlHhCIc6MFs=; b=JqR7aBB+HhhiekXRTxvNflg6jLjbTVKE2nZWKUzywnFnkulwcQ6F6I4a1HcM8Hz59piC10 DrbLvuUD2xOpXKmH6ZArIJjnMWnH+o3iWFoNAaZzaXEvBQlfZSoQ4rSxzxAla2y6hORn4b qZRXCXI7e0GRLOk2rCTpS8doI7KMJAJiHiZiKPt1C+9YfYJkfof/lvaeK61im+JrN7U6uS 1AfaERh9+M0zDyOUmkYbTf2ByaIZYYCYcwjuLMUktBC5St7TjZPOIGDdAuh5rxRsS5GO7u Y6T5PRHcOWJLU17b+4XnljIUOAynaXWFbsby+joaVOMeEDTM9PHyZkVkltQjKA== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4hJSjY28jZz2y5t; Mon, 10 Aug 2026 08:34:41 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. c872f86c6f9bb7db7744503e1185e313701070d0 X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: 068360263531050f2727b970fdbb50f3add2c505 X-Git-Newrev: c872f86c6f9bb7db7744503e1185e313701070d0 Message-Id: <4hJSjY28jZz2y5t@people01.haj.ipfire.org> Date: Mon, 10 Aug 2026 08:34:41 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via c872f86c6f9bb7db7744503e1185e313701070d0 (commit) via a26209adae494a5dabc4c8345da91e12b0896ad1 (commit) via 7da611b5aeab9a3adb2260cac2ee0aa6b360945c (commit) via 987a6be411cfc2098e335e3cd28c5ec9c754bde4 (commit) from 068360263531050f2727b970fdbb50f3add2c505 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c872f86c6f9bb7db7744503e1185e313701070d0 Author: Adolf Belka Date: Sun Aug 9 23:30:04 2026 +0200 core205: Ship openvpn Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit a26209adae494a5dabc4c8345da91e12b0896ad1 Author: Adolf Belka Date: Sun Aug 9 23:30:06 2026 +0200 openvpn: Update to version 2.7.6 - Update from version 2.7.4 to 2.7.6 - No change in rootfile - 2 CVE Fixes from 2.7.6 and 7 CVE Fixes from 2.7.5 - Changelog 2.7.6 Security fixes: openvpnserv (windows): better scrutinize command line passed in from the control socket to openvpn. This would lead to circumventing admin restrictions on allowed openvpn config directories (but never to "read files the user has no permissions for") (CVE-2026-63649) Bug found by 章鱼哥 (www.aipyaipy.com) dco: make key state desync recoverable This was reported as a "with suitable timing, a key-update de-sync between OpenVPN and the kernel could trigger an ASSERT()", and was initially handled as security report. It turned out to be not exploitable, but the state machine was not very robust and so the opportunity was used to improve the code. Bug found by 章鱼哥 (www.aipyaipy.com) make --x509-username-field work with mbedTLS. In very particular setups, together with a CA creating matching certificates, this could lead to unintentionally permitting a certificate that should not have. This is why this was considered a (low-prio) security bug and a CVE ID was assigned (CVE-2026-63650) Bug found by 章鱼哥 (www.aipyaipy.com) User-visible Changes: if --dev is not specified, default to --dev tun - so for the tun case, this option can now be left out of the openvpn config. --ping and --keepalive settings are now limited to 24 hours maximum - the primary reason for that is to avoid lots of extra code in the DCO kernel to handle arbitrarily large values without overflowing 32 bit integers. 24h is considered much higher than any reasonable use. The TCP_NODELAY socket flag is now "always on". The --tcp-nodelay option is kept, because setting it on a p2mp server also enables pushing of socket-flags TCP_NODELAY to clients, which might not have this code change yet. Remove --providers from --help output on mbedTLS builds. Bugfixes: refuse incoming HARD RESET packets with a sequence ID != 0 (this is basically making an OpenVPN server ignore and log a "should never happen" client-side misbehaviour, which could lead to TLS handshake establishment failures in p2p TLS setups) correctly calculate packet id size if epoch packet format is in use - this was off by 4, for connections openvpn 2.7+ to openvpn 2.7+, exceeding "mssfix mtu" headroom by those 4 bytes (Github: OpenVPN/openvpn#1074) correct minimum packet length check for 802.1q tagged packets (Github: OpenVPN/openvpn#1044). This was also reported (twice) as a security bug, as technically OpenVPN with --client-nat would read and write up to 4 bytes "after the end of the packet" - but due to the OpenVPN packet buffer layouts, which are always full-frame-sized this is fully safe and has no adverse consequences. 2.7.5 Security fixes: openvpnserv (windows): fix DNS SearchList state pollution on (dis)connect. specific combinations of --dns config entries plus local DNS config could lead to corruption of pre-openvpn DNS config (CVE-2026-13379) Bug found by 章鱼哥 (www.aipyaipy.com). Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets (CVE-2026-12996) Bug found by multiple researchers: 章鱼哥 (www.aipyaipy.com) Haiyang Huang Haruki Oyama (Waseda University) Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets (CVE-2026-13117) Bug found by multiple researchers: Trace37 Labs (github.com/trace37labs) Haiyang Huang Fix server crash on reception of suitably malformed auth-token, if --auth-gen-token external-auth is active (CVE-2026-13122) Bug found by Haiyang Huang. Fix memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes (CVE-2026-12932) Bug found by Valton Tahiri. Fix possible 1-byte buffer overrun on NTLMv2 proxy responses. (CVE-2026-11771) Bug found by Tristan Madani (@TristanInSec). Fix another memory leak on reception of suitable tls-crypt-v2 packets that could lead to an out of memory situation and server crash (CVE-2026-13698) Bug found by Max Fillinger. Overlaps with a report from Valton Tahiri that we believe to be fixed by this bugfix as well. Bugfixes: Windows: fix plugin trusted-dir check prefix bypass (this fixes a bug in the path checking logic we do on Windows for "is loading a plugin from this path allowed?", but since we could not find a way to exploit this unless starting with admin privs or a social engineering attack, not classified as a security fix) Windows: openvpnserv: rework ConvertItfDnsDomains and tests (this fixes a buffer overread that is not exploitable and as such not classified as security fix) options: fix use-after-free of DNS options on client connect (using suitable --dns or --dhcp-option DNS options in a server config - not pushed, but applying to the server itself - triggers a double free() and use-after-free condition, possibly crashing the server) (Github: OpenVPN/openvpn#1060) dns: Fix memory leak in dns_server_addr_parse, if too many server addresses are configured (Github: OpenVPN/openvpn#1055) improve multi-socket event handling further - multiple open UDP sockets with concurrent traffic could lead to inefficient processing, and the old code was also very hard to follow. (This was initially triggered by a report from Joshua Rogers using ZeroPath, but turned out to be "just bad code" not a security vulnerability) Null-terminate tls-crypt client keys when testing - non-exploitable strlen() on a buffer that is not null-terminated mudp: send HMAC reset reply synchronously this fixes a bug where multiple incoming tls-crypt-v2 RESET packets on different sockets could end up overwriting each other's control structures, leading to initial handshake packets (HMAC reset reply) being sent to the wrong client IP, or on a non-suitable socket ("v4 packet on a v6 socket"). Since the overall flow here is stateless by nature, do not artificially create state by creating elaborate queues, just send-or-drop. fix port-share and multi-socket interaction - port-share needs TCP listeners, but the check was wrong. So "as long as any of the listening sockets is TCP, port-share can be used" (Github: OpenVPN/openvpn#1027) Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug where a server can push a suitable combination of options and make the client ASSERT(). (Reported as security issue by Haiyang Huang, but it was decided that the server always has means to make the client "not function properly", and it can not be exploited beyond that) Windows: socket: assert buffer length before reading prepended sockaddr family - a misbehaviour in the windows DCO driver could trigger an overread in the userland client. No such bug exists, which this was not treated as a security vulnerability Documentation improvements: improve documentation for --float (Github: OpenVPN/openvpn#358) add documentation for --preresolve (Github: OpenVPN/openvpn#532) impove documentation around DNS config (Github: OpenVPN/openvpn#937) Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 7da611b5aeab9a3adb2260cac2ee0aa6b360945c Author: Adolf Belka Date: Sun Aug 9 23:30:03 2026 +0200 core205: Ship lvm2 Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 987a6be411cfc2098e335e3cd28c5ec9c754bde4 Author: Adolf Belka Date: Sun Aug 9 23:30:05 2026 +0200 lvm2: Update to version 2.03.42 - Update from version 2.03.41 to 2.03.42 - No change in rootfile - Changelog 2.03.42 Add `--lockopt retries=N` to lvmlockd. Add `--lockopt removeretry=SECONDS` to lvmlockd to retry vgremove. Use lockd_lv lock probes for pvmove holder availability in shared VGs. Auto-revert metadata when initial pvmove mirror activation fails. Refuse activation of pvmove-locked LV when pvmove runs on another node. Allow pvmove --abort without args when using lvmlockd. Add cluster lock lifecycle for pvmove LV in shared VGs. Add support for pvmove in a shared VG. Allow lvremove -f to remove pvmove-locked LVs after interrupted pvmove. Handle active pvmove during vgchange -an with force flags. Fix pvmove completion to use suspend+resume for DM table reload. Fix deactivation cascade during active pvmove. Support inactive LVs in pvmove with metadata-only mirror insertion. Kill orphaned polling process on pvmove --abort. Support formatting vdo volumes with kernel vdo target (version >= 9.2). Fix VDO index_memory_size_mb quantization and report minimum required pool size. Add vdo_format.c with pre-format logical size computation for kernel format. Add --enable-asan/--enable-tsan to build with sanitizer options. Mirror cleans orphaned missing DM nodes on image removal. Splitcache deactivates individually activated component. Fix memleak in vgimportclone and vg_write_commit_bad_mdas(). Fix autoactivation on top of MD and loop devices if udev db records incomplete. Make MD device ready state check in udev to be in sync with MD udev rules. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/125 => core/205}/filelists/lvm2 | 0 config/rootfiles/{oldcore/100 => core/205}/filelists/openvpn | 0 lfs/lvm2 | 4 ++-- lfs/openvpn | 4 ++-- 4 files changed, 4 insertions(+), 4 deletions(-) copy config/rootfiles/{oldcore/125 => core/205}/filelists/lvm2 (100%) copy config/rootfiles/{oldcore/100 => core/205}/filelists/openvpn (100%) Difference in files: diff --git a/config/rootfiles/core/205/filelists/lvm2 b/config/rootfiles/core/205/filelists/lvm2 new file mode 120000 index 000000000..d640870b7 --- /dev/null +++ b/config/rootfiles/core/205/filelists/lvm2 @@ -0,0 +1 @@ +../../../common/lvm2 \ No newline at end of file diff --git a/config/rootfiles/core/205/filelists/openvpn b/config/rootfiles/core/205/filelists/openvpn new file mode 120000 index 000000000..493f3f7a4 --- /dev/null +++ b/config/rootfiles/core/205/filelists/openvpn @@ -0,0 +1 @@ +../../../common/openvpn \ No newline at end of file diff --git a/lfs/lvm2 b/lfs/lvm2 index e7a065e1b..3d8ce3d25 100644 --- a/lfs/lvm2 +++ b/lfs/lvm2 @@ -24,7 +24,7 @@ include Config -VER = 2.03.41 +VER = 2.03.42 THISAPP = LVM2.$(VER) DL_FILE = $(THISAPP).tgz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 17dccb4ac2f171bb3ca1d6a542845aebb4690aed5e56aa644b4b42ad5ff085e55f222da3035b28199dd19788b8554ad311f5df14e325c6c4289881b5ee23ecb7 +$(DL_FILE)_BLAKE2 = 1eaa2ab5867adf37e9a8fb62b46d0b79568bf344d5d4ea2e785477a5f1099b8a61443e29dfc3baa4e4bcb5166815fda921a5cf8d2459878fe2e020b0a267c36f install : $(TARGET) diff --git a/lfs/openvpn b/lfs/openvpn index 474ea5f39..010c3a375 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,7 +24,7 @@ include Config -VER = 2.7.4 +VER = 2.7.6 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 8957cde4fbf04a8108e9cb19720ed089275055a96a1accf7a466786606e2b9dc93a0151eb50a8fcfa982b66efc3e699ebd1bd0fdd1fb0b6d810b1f8e6815c190 +$(DL_FILE)_BLAKE2 = 0cf4f6c7337ef3e31cb6f261423863b86fedcaaa69272d26811f4066afcece873ccebca167cb5e9f37bc474ccbbad7f71effc0678b98ed52864a96351a8cc3f0 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree