This updated version of this script avoids any errors if collectd is not
running (yet) which might happen during the boot process.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
new openssl need at least 2048 bit rsa keys for apache.
So if the existing is smaller a new 4096 bit key is generated.
fixes#13527
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
To quote from the kernel documentation:
> Historically the kernel has allowed TIOCSTI, which will push
> characters into a controlling TTY. This continues to be used
> as a malicious privilege escalation mechanism, and provides no
> meaningful real-world utility any more. Its use is considered
> a dangerous legacy operation, and can be disabled on most
> systems.
>
> Say Y here only if you have confirmed that your system's
> userspace depends on this functionality to continue operating
> normally.
>
> Processes which run with CAP_SYS_ADMIN, such as BRLTTY, can
> use TIOCSTI even when this is set to N.
>
> This functionality can be changed at runtime with the
> dev.tty.legacy_tiocsti sysctl. This configuration option sets
> the default value of the sysctl.
This patch therefore proposes to no longer allow legacy TIOCSTI usage
in IPFire, given its security implications and the apparent lack of
legitimate usage.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://github.com/htop-dev/htop/blob/main/ChangeLog
"What's new in version 3.3.0
* Multiple refactorings and code improvements
* Shorten docker container IDs to 12 characters
* Settings: preserve empty header
* Fix execlp() argument without pointer cast
* OpenFilesScreen: Make column sizing dynamic for file size, offset and inode
* Add support for "truss" (FreeBSD equivalent of "strace")
* Darwin: add NetworkIOMeter support
* HeaderLayout: add "3 columns - 40/30/30", "... 30/40/30" & "... 30/30/40"
* Meter: use correct unicode characters for digit '9'
* Note in manual re default memory units of KiB
* Add column for process container name
* Add logic to filter the container name (+type) from the CGroup name
* Change NetworkIOMeter value unit from KiB/s to bytes/second
* Cap DiskIOMeter "utilisation" percentage at 100%
* PCP platform implementation of frontswap and zswap accounting
* Shorten podman/libpod container IDs to 12 characters
* Write configuration to temporary file first
* Incorporate shared memory in bar text
* Move shared memory next to used memory
* Correct order of memory meter in help
* Add recalculate to Ctrl-L refresh
* Update process list on thread visibility toggling
* Support dynamic screens with 'top-most' entities beyond processes
* Introduce Row and Table classes for screens beyond top-processes
* Rework ZramMeter and remove MeterClass.comprisedValues
* More robust logic for CPU process percentages (Linux & PCP)
* Show year as start time for processes older than a year
* Short-term fix for docker container detection
* default color preset: use bold blue for better visibility
* Document 'O' keyboard shortcut
* Implement logic for '--max-iterations'
* Update F5 key label on tab switch (Tree <-> List)
* Force re-sorting of the process list view after switching between list/treeview mode
* Linux: (hack) work around the fact that Zswapped pages may be SwapCached
* Linux: implement zswap support
* {Memory,Swap}Meter: add "compressed memory" metrics
* Darwin: add DiskIOMeter support
* Fix scroll relative to followed process
* ZramMeter: update bar mode
* Use shared real memory on FreeBSD
* Increase Search and Filter max string length to 128
* Improve CPU computation code
* Remove LXC special handling for the CPU count
* Create new File Descriptor meter
* PCP: add IRQ PSI meter
* Linux: add IRQ PSI meter
* Linux: highlight username if process has elevated privileges
* Add support for scheduling policies
* Add a systemd user meter to monitor user units.
* FreeBSD: remove duplicate zfs ARC size subtraction"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
This script has been modified when we touched ExtraHD in Core Update
179/180, but has been forgotten to be shipped.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
The "ping" plugin does not re-resolve the gateway IP address after
pinging it for the first time. For most people this won't be a big
problem, but if the default gateway changes, the latency graph won't
work any more.
In order to do re-resolve "gateway", the only way is to restart
collectd.
Fixes: #13522
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
According to the source tarball's NEWS file:
- Improvements
- Allow passing a path to modprobe so the module is loaded from
anywhere from the filesystem, but still handling the module
dependencies recorded in the indexes. This is mostly intended for kernel
developers to speedup testing their kernel modules without having to load the
dependencies manually or override the module in /usr/lib/modules/.
Now it's possible to do:
# modprobe ./drivers/gpu/drm/i915/i915.ko
As long as the dependencies didn't change, this should do the right thing
- Use in-kernel decompression if available. This will check the runtime support
in the kernel for decompressing modules and use it through finit_module().
Previously kmod would fallback to the older init_module() when using
compressed modules since there wasn't a way to instruct the kernel to
uncompress it on load or check if the kernel supported it or not.
This requires a recent kernel (>= 6.4) to have that support and
in-kernel decompression properly working in the kernel.
- Make modprobe fallback to syslog when stderr is not available, as was
documented in the man page, but not implemented
- Better explaing `modprobe -r` and how it differentiates from rmmod
- depmod learned a `-o <dir>` option to allow using a separate output
directory. With this, it's possible to split the output files from
the ones used as input from the kernel build system
- Add compat with glibc >= 2.32.9000 that dropped __xstat
- Improve testsuite to stop skipping tests when sysconfdir is something
other than /etc
- Build system improvements and updates
- Change a few return codes from -ENOENT to -ENODATA to avoid confusing output
in depmod when the module itself lacks a particular ELF section due to e.g.
CONFIG_MODVERSIONS=n in the kernel.
- Bug Fixes
- Fix testsuite using uninitialized memory when testing module removal
with --wait
- Fix testsuite not correctly overriding the stat syscall on 32-bit
platforms. For most architectures this was harmless, but for MIPS it
was causing some tests to fail.
- Fix handling unknown signature algorithm
- Fix linking with a static liblzma, libzstd or zlib
- Fix memory leak when removing module holders
- Fix out-of-bounds access when using very long paths as argument to rmmod
- Fix warnings reported by UBSan
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Noteworthy changes in this release, according to
https://lists.gnu.org/archive/html/info-gnu/2023-05/msg00001.html :
* New option --ignore-dirnlink
Valid in copy-out mode, it instructs cpio to ignore the actual number
of links reported for each directory member and always store 2
instead.
* Changes in --reproducible option
The --reproducible option implies --ignore-dirlink. In other words,
it is equivalent to --ignore-devno --ignore-dirnlink --renumber-inodes.
* Use GNU ls algorithm for deciding timestamp format in -tv mode
* Bugfixes
** Fix cpio header verification.
** Fix handling of device numbers on copy out.
** Fix calculation of CRC in copy-out mode.
** Rewrite the fix for CVE-2015-1197.
** Fix combination of --create --append --directory.
** Fix appending to archives bigger than 2G.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
This reverts commit e0be9eab47.
This change is now producing problems on IPv6-enabled systems as it will
deny access to any website that is IPv6-enabled as well, even if the
client connected using IPv4.
I have tested if squid is now running on fine on systems where IPv6 is
disabled and can confirm that its running just fine.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 3.8.3 to 3.8.4
- Update of rootfile not required
- Permanent fix for smtp smuggling will be in version 3.9. However the fix has been
backported into version 3.8.4 but with the default for the parameter of "no".
- This patch sets the defaults for all the main.cf parameters highlighted by Wietse
Venema in http://www.postfix.org/smtp-smuggling.html
- Additionally the implementation of smtpd_forbid_bare_newline = yes has been added to
the install.sh pak for postfix so that it will be included into any main.cf file being
restored from backup. This parameter is available for the first time in 3.8.4 so will
not be in any backup prior to this release and can therefore be safely applied to
restored versions of main.cf.
- This fix in install.sh will be able to be removed when version 3.9 is released early
in 2024 as the default for that parameter in that version onwards will then be "yes"
- Changelog
3.8.4
Security: with "smtpd_forbid_bare_newline = yes" (default
"no" for Postfix < 3.9), reply with "Error: bare <LF>
received" and disconnect when an SMTP client sends a line
ending in <LF>, violating the RFC 5321 requirement that
lines must end in <CR><LF>. This prevents SMTP smuggling
attacks that target a recipient at a Postfix server. For
backwards compatibility, local clients are excluded by
default with "smtpd_forbid_bare_newline_exclusions =
$mynetworks". Files: mantools/postlink, proto/postconf.proto,
global/mail_params.h, global/smtp_stream.c, global/smtp_stream.h,
smtpd/smtpd.c.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update the patches to include patches 16 to 21
- Update of rootfile not required
- Changelog
patch 21: fix for expanding command substitutions in a word expansion in a
here-document
patch 20: allow time reserved word as first token in command substitution
patch 19: fix case where background job set the terminal process group
patch 18: fix for returning unknown tokens to the bison parser
patch 17: fix for optimizing forks when using the . builtin in a subshell
patch 16: fix for a crash if one of the expressions in an arithmetic for command
expands to NULL
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
openssl 3.x need correct arch configuration or disable
asm optimisation with no-asm config parameter.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Changes in version 0.4.8.10 - 2023-12-08
This is a security release fixing a high severity bug (TROVE-2023-007)
affecting Exit relays supporting Conflux. We strongly recommend to update as
soon as possible.
o Major bugfixes (TROVE-2023-007, exit):
- Improper error propagation from a safety check in conflux leg
linking lead to a desynchronization of which legs were part of a
conflux set, ultimately causing a UAF and NULL pointer dereference
crash on Exit relays. Fixes bug 40897; bugfix on 0.4.8.1-alpha.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on December 08, 2023.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2023/12/08.
o Minor bugfixes (bridges, statistics):
- Correctly report statistics for client count over Pluggable
transport. Fixes bug 40871; bugfix on 0.4.8.4
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 2.2.0 to 2.3.0
- Update of rootfile
2.3.0
- Changes:
* Rename PLIST_UINT to PLIST_INT and add plist_new_int() and plist_get_int_val()
* Add support for JSON format
* Add support for OpenStep format
* Introduce error codes and format constants
* Add return value to import/export functions to allow returning error codes
* Add new plist_sort function
* Add several human-readable output-only formats
* Add new plist_write_to_string/_stream/_file functions
* Add new plist_print function
* Add new plist_read_from_file function
* Add new plist_mem_free() function
* Add a few C++ methods
* Add C++ interface test
* Add PLIST_NULL type
* Some code housekeeping (mostly clang-tidy)
- Breaking:
* plist_from_memory() gets additional parameter
- Bugfixes:
* Fix multiple bugs in all of the parsers
* Fix handling of PLIST_UID nodes
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version commit ad384f9ed3b2cc31e97012ab6bfe5a214ffc65a2 (between 1.2.1 and
1.2.2) to 1.2.4
- Update of rootfile not required
- Changelog
1.2.4
Following on from the security update of 1.2.3, some further changes are
introduced to make the communication path between NQPTP and Shairport Sync
resistant to outside interference. On Linux, nqptp now runs as a restricted user
but with special permission to access ports 319 and 320.
These changes have necessitated changing the SMI interface. The SMI interface is
now at version 10, and Shairport Sync must also be updated to be compatible with
it.
Before updating, it is important that you remove the startup service file as
described in the README.
Please read the Release Notes for more details.
1.2.3
This important update fixes a crashing bug whereby a maliciously-crafted message
to the control port could crash NQPTP. (Supersedes 1.2.2.)
1.2.2
Superseded by version 1.2.3
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 4.1.1 to 4.3.2
- Update of rootfile not required.
- Updating shairport-sync to 4.2 or later also requires an update of nqptp as the newer
version of shairport-sync requires NQPTP with Shared Memory Interface Version smi9 and
will not work with older versions.
- Changelog
4.3.2
This update contains a brand new PipeWire backend with full synchronisation --
your feedback is welcome on this. The update also contains a number of bug fixes.
Enhancements
A totally new PipeWire backend featuring full synchronisation.
Bug Fixes
Stability improvements for the PulseAudio backend.
Fix a crash when the Avahi subsystem became disconnected. This is normally a
rare occurrence, but Shairport Sync was not dereferencing obsolete data
correctly when it happened.
Set and reset Bonjour flags correctly when it's a Classic Airplay session in
AirPlay 2 operation.
Fix a number of FreeBSD compilation errors and warnings.
Fix various errors when breaking into an existing session to terminate it.
Thanks again to aaronk6.
Fix some debug message errors, sigh. Thanks to Nathan Gray.
4.3.1
Bug Fixes
This release, 4.3.1, fixes a bug in Version 4.3 that prevented Shairport
Sync from being added to Home.
4.3
This update contains important security updates, bug fixes and enhancements.
NQPTP must also be updated, and it should be updated before updating Shairport
Sync.
The Shared Memory Interface version of both Shairport Sync and NQPTP is now 10,
i.e. smi10.
Notes
When updating NQPTP on Linux, be sure to remove the old service file as
directed in the README.
Having completed both updates and installations, remember to restart NQPTP
first and then restart Shairport Sync.
Security Updates
A crashing bug in NQPTP has been fixed.
The communications protocol used between NQPTP and Shairport Sync has been
revised and made more resilient to attempted misuse.
In Linux systems, NQPTP no longer runs as root -- instead it runs as the
restriced user nqptp, with access to ports 319 and 320 set by the installer
via the setcap utility.
Enhancements
A new volume control profile called dasl-tapered has been added in which
halving the volume control setting halves the output level.
For example, moving the volume slider from full to half reduces the output
level by 10dB, which roughly corresponds with a perceived halving of the
audio volume level.
Moving the volume slider from half to a quarter reduces the output level by
a further 10dB.
The tapering rate is slightly modified at the lower end of the range if the
device's attenuation range is restricted (less than about 55dB).
To activate the dasl-tapered profile, set the volume_control_profile to
"dasl_tapered" in the configuration file and restart Shairport Sync.
Many thanks to David Leibovic, aka dasl-, for this.
On graceful shutdown, an active_end signal should now be generated if the
system was in the active state. Addresses issue #1647. Thanks to Tucker
Kern for raising the issue.
Bug Fixes
Fixed a bug that causes the Docker image to crash occasionally when OwnTone
interrupted an existing iOS session. Thanks to aaronk6 for the report.
Fixed a cross-compliation error caused by not looking for the correct
version of the ar tool. The fix was to substitute the correct version
during the autoreconf phase. Thanks to sternenseemann for raising the
issue and the PR containing the fix.
Updated the mDNS strings for the Classic AirPlay feature of AP2, so that it
does not appear to provide MFi authentication. Addresses this discussion.
Always uses a revision number of 1 when looking for status updates on the
DACP remote control port. This follows a suggestion in Issue #1658. Thanks
to ejurgensen, as ever, for the report and the suggested fix.
Fixed a statistics bug (the minimum buffer size was incorrectly logged) and
also tidy up the statistics logging interval logic for resetting min and
max counters.
Added an important missing format string argument to a call in the Jack
Audio backend. Many thanks to michieldwitte for their PR.
Maintenance
Stopped using a deprecated FFmpeg data structure reference.
Stopped using deprecated OpenSSL calls. Thanks to yubiuser for their PR --
which did some of the updating -- and for their guidance.
Run workflow-based tests on PRs automatically. Thanks to yubiuser for their PR.
4.2
This release consists of enhancements and important bug fixes to Shairport Sync
Version 4.1. For information on the new features of 4.1, including AirPlay 2
support, please see the Version 4.1 Release Note.
Important
If you are updating an existing installation of Shairport Sync, you must
also update NQPTP. The reason is that this update to Shairport Sync
requires NQPTP with Shared Memory Interface Version smi9 and will not
work with older versions.
For details of the enhancements and bug fixes in this release, please
refer to the RELEASENOTES.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from version 1.9.15p4 to 1.9.15p5
- Update of rootfile not required
- Changelog
1.9.15p5
Fixed evaluation of the lecture, listpw, verifypw, and fdexec sudoers Defaults
settings when used without an explicit value. Previously, if specified
without a value they were evaluated as boolean false, even when the negation
operator (’!’) was not present.
Fixed a bug introduced in sudo 1.9.14 that prevented LDAP netgroup queries
using the NETGROUP_BASE setting from being performed.
Sudo will now transparently rename a user’s lecture file from the older
name-based path to the newer user-ID-based path. GitHub issue #342.
Fixed a bug introduced in sudo 1.9.15 that could cause a memory allocation
failure if sysconf(_SC_LOGIN_NAME_MAX) fails. Bug #1066
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 2.5.4 to 2.5.5
- Update of rootfile
- Changelog
2.5.5 - December 1, 2023
* Update the syscall table for Linux v6.7-rc3
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 3.12 to 3.16
- Update of rootfile not required
- Changelog
3.16 2023-11-30
* Notable user-visible changes
* Multiple test streams started with -P/--parallel will now be
serviced by different threads. This allows iperf3 to take
advantage of multiple CPU cores on modern processors, and will
generally result in significant throughput increases (PR #1591).
* OpenSSL 3 is now detected at build time. If OpenSSL 3 is found,
various older, deprecated, APIs will not be used. iperf3 will
continue to work with OpenSSL 1.1.1. OpenSSL is used as a part
of the iperf3 authentication functionality (Issue #1300, PR
#1589).
* The authorized users file used by the authentication functionality
is now checked for accessibility much earlier during the program
startup, as opposed to being checked near the start of a
test (Issue #1583, PR #1585).
* Developer-visible changes
* BREAKING CHANGE: iperf3 now requires pthreads and C atomic
variables to compile and run.
3.15 2023-09-14
* Notable user-visible changes
* Several bugs that could allow the iperf3 server to hang waiting
for input on the control connection has been fixed. ESnet thanks
Jorge Sancho Larraz from Canonical for reporting this issue. For
more information, see:
https://downloads.es.net/pub/iperf/esnet-secadv-2023-0002.txt.asc
* A bug that caused garbled output with UDP tests on 32-bit hosts
has been fixed (PR #1554, PR #1556). This bug was introduced in
iperf-3.14.
* A bug in counting UDP messages has been fixed (PR #1367, PR
#1380).
3.14 2023-07-07
* Notable user-visible changes
* A memory allocation hazard was fixed (Issue #1542/PR #1543). For
more information see:
https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc
* JSON output was improved, such as print JSON numbers as signed (PR
#1539, Issue #1435), the exit code when doing JSON output was
fixed (PR #1523), and client_api was fixed so that it still
returns an error code when JSON is enabled (Issue #1405). Also,
duplicate fields when using multiple streams was removed from the
JSON output (#1492).
* Prevent UDP packet count and operations overflow (PR #1536/Issue
#1534).
* Statistics are fixed when --omit is used (Issue #1489/PR #1498).
* Developer-visible changes
* CI builds and tests using GitHub actions have been added (PR
#1519).
* A fix for Android "unable to create a new stream error" was added
(PR #1506).
* Support for Voice Admit DSCP code point from RFC 5865 was added
(PR #1490).
* A fix for preventing a crash when RSA public key path doesn't
exist was fixed (PR #1488/Issue #1471).
3.13 2023-02-16
* Notable user-visible changes
* fq-rate (PR #1461, Issue #1366), and bidirectional flag (Issue #1428,
PR #1429) were added to the JSON output.
* Added support for OpenBSD including cleaning up endian handling (PR #1396)
and support for TCP_INFO on systems where it was implemented (PR #1397).
* Fixed bug in how TOS is set in mapped v4 (PR #1427).
* Corrected documentation, such as updating binary download links and text
(Issue #1459), updating version on iperf3 websites, and fixing an
incorrect error message (Issue #1441).
* Fixed crash on rcv-timeout with JSON logfile (#1463, #1460, issue #1360,
PR #1369).
* Fixed a bug that prevented TOS/DSCP from getting set correctly for reverse
tests (PR #1427, Issue #638).
* Developer-visible changes
* Getter and setter are now available for bind_dev (PR #1419).
* Added missing getter for bidirectional tests (PR #1453).
* Added minor changes to clean up .gitignore and error messages (#1408).
* Made sure configure scripts are runnable with /bin/sh (PR #1398).
* Cleaned up RPM spec, such as adding missing RPM build dependencies, dropping
EL5 and removing outdated %changelog (PR #1401) to make.
* Added a fix for a resource leak bug in function iperf_create_pidfile(#1443).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
