- Update from 2.3.0 to 2.3.2
- Update rootfile
- Changelog is too large to include here. Details can be found in the changes.txt file in
the source tarball.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from 3.7.1 to 3.7.2
- Update of rootfile not required
- Changelog
Release 3.7.2 (2021-06-08)
* Added a secondary check so if a mkdir request fails with EPERM an access request
will be tried - returning EEXIST if the access was successful.
Fixes: https://github.com/libfuse/sshfs/issues/243
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from 1.7a (2013) to 1.22c (2021)
- Update rootfile
- Changelog is too large to include here. Full details can be read in the ChangeLog file
in the source tarball
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from 5.11 to 5.14
- Update of rootfile not required
- Changelog
Noteworthy changes in release 5.14 (2021-09-02)
* Improvements
* Implemented decoding of memfd_secret and quotactl_fd syscalls,
introduced in Linux 5.14.
* Enhanced prctl syscall decoding.
* Enhanced decoding of IFLA_* netlink attributes.
* Enhanced decoding of MDBA_ROUTER_PATTR_* mdb router port netlink attributes.
* Updated lists of BPF_*, IORING_*, MADV_*, MOUNT_ATTR_*, SCTP_*,
and UFFD_* constants.
* Updated lists of ioctl commands from Linux 5.14.
* Bug fixes
* Fixed build using bionic libc.
Noteworthy changes in release 5.13 (2021-07-18)
* Improvements
* Print netlink data in a more structured way.
* Implemented decoding of NT_PRSTATUS and NT_FPREGSET regsets
of PTRACE_GETREGSET and PTRACE_SETREGSET requests.
* Implemented decoding of regs argument of PTRACE_GETREGS, PTRACE_GETREGS64,
PTRACE_SETREGS, PTRACE_SETREGS64, PTRACE_GETFPREGS, and PTRACE_SETFPREGS
requests.
* Implemented powerpc System Call Vectored ABI support.
* Implemented decoding of landlock_add_rule, landlock_create_ruleset,
and landlock_restrict_self syscalls introduced in Linux 5.13.
* Enhanced decoding of perf_event_open syscall.
* Updated lists of BPF_*, IORING_*, KEXEC_*, KEY_*, KVM_*, NT_*, PR_*,
PTRACE_*, RTM_*, RTPROT_*, TRAP_*, UFFD_*, UFFDIO_*, and V4L2_* constants.
* Updated lists of ioctl commands from Linux 5.13.
* Portability
* On powerpc and powerpc64, linux kernel >= 2.6.23 is required.
Older versions without a decent PTRACE_GETREGS support will not work.
Noteworthy changes in release 5.12 (2021-04-26)
* Improvements
* Implemented --secontext[=full] option to display SELinux contexts.
* Implemented decoding of mount_setattr syscall introduced in Linux 5.12.
* Updated decoding of IFLA_BRPORT_* netlink attributes to match Linux 5.12.
* Updated lists of DEVCONF_*, IORING_*, KVM_*, MPOL_*, MTD_*, NFT_MSG_*,
RESOLVE_*, RTM_*, ST_*, and V4L2_* constants.
* Updated lists of ioctl commands from Linux 5.12.
* Bug fixes
* Fixed build using bionic libc.
* Portability
* Added binutils 2.36 support to --enable-mpers builds.
- More details of the above changes can be found in the ChangeLog file in the source
tarball
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Install libuv lfs and rootfile
- Add libuv to make.sh
- Tested by running bind utilities on a vm testbed
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from 9.11.32 to 9.16.22
- 9.11 is an ESV (Extended Support Version) that will go EOL in December 2021
9.16 is the replacement ESV whose EOL is not yet defined but will be at least 4 years
so should be supported until at least March 2024 as the 9.16 branch was started in 2020
- Update rootfile
- libuv is now required both to build the bind libraries and for the running of the
utilities.
- Changelog is difficult to define here as this is a change of branch from 9.11 to 9.16
both of which have been running in parallel. However all the changes from the start of
9.16.0 can be found in the CHANGES file in the source tarball.
- nslookup, host and dig utilities tested out by installing this on a vm testbed. All
these utilities worked as the previous version
nsupdate was not able to be tested other than confirming that running nsupdate
opened an interactive session. This utility would be good to be tested by someone
familiar with how to run it.
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Restarting the firewall is not necessary during the upgrade procedure,
and the user is asked to reboot the machine afterwards either way.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
"advproxy advanced web proxy" was meant to be used in the first place,
followed by "advproxy advanced web proxy configuration", as it is done
in other CGIs.
This patch also fixes a missing German translation, and improves
translations of "one X per line" ("eines" != "eins"). :-)
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
- Update from 3.7.6 to 3.8.2
- Update rootfile
- Changelog
Noteworthy changes in release 3.8.2 (2021-09-25) [stable]
Fixed portability issues of bison on Cygwin.
Improvements in glr2.cc: add support for custom error messages (`%define
parse.error custom`), allow linking several parsers together.
Noteworthy changes in release 3.8.1 (2021-09-11) [stable]
The generation of prototypes for yylex and yyerror in Yacc mode is
breaking existing grammar files. To avoid breaking too many grammars, the
prototypes are now generated when `-y/--yacc` is used *and* the
`POSIXLY_CORRECT` environment variable is defined.
Avoid using `-y`/`--yacc` simply to comply with Yacc's file name
conventions, rather, use `-o y.tab.c`. Autoconf's AC_PROG_YACC macro uses
`-y`. Avoid it if possible, for instance by using gnulib's gl_PROG_BISON.
Noteworthy changes in release 3.8 (2021-09-07) [stable]
** Backward incompatible changes
In conformance with the recommendations of the Graphviz team
(https://marc.info/?l=graphviz-devel&m=129418103126092), `-g`/`--graph`
now generates a *.gv file by default, instead of *.dot. A transition
started in Bison 3.4.
To comply with the latest POSIX standard, in Yacc compatibility mode
(options `-y`/`--yacc`) Bison now generates prototypes for yyerror and
yylex. In some situations, this is breaking compatibility: if the user
has already declared these functions but with some differences (e.g., to
declare them as static, or to use specific attributes), the generated
parser will fail to compile. To disable these prototypes, #define yyerror
(to `yyerror`), and likewise for yylex.
** Deprecated features
Support for the YYPRINT macro is removed. It worked only with yacc.c and
only for tokens. It was obsoleted by %printer, introduced in Bison 1.50
(November 2002).
It has always been recommended to prefer `%define api.value.type foo` to
`#define YYSTYPE foo`. The latter is supported in C for compatibility
with Yacc, but not in C++. Warnings are now issued if `#define YYSTYPE`
is used in C++, and eventually support will be removed.
In C++ code, prefer value_type to semantic_type to denote the semantic
value type, which is specified by the `api.value.type` %define variable.
** New features
*** A skeleton for the D programming language
The "lalr1.d" skeleton is now officially part of Bison.
It was originally contributed by Oliver Mangold, based on Paolo Bonzini's
lalr1.java, and was improved by H. S. Teoh. Adela Vais then took over
maintenance and invested a lot of efforts to complete, test and document
it.
It now supports all the bells and whistles of the other deterministic
parsers, which include: pull/push interfaces, verbose and custom error
messages, lookahead correction, token constructors, internationalization,
locations, printers, token and symbol prefixes, etc.
Two examples demonstrate the D parsers: a basic one (examples/d/simple),
and an advanced one (examples/d/calc).
*** Option -H, --header and directive %header
The option `-H`/`--header` supersedes the option `--defines`, and the
directive %header supersedes %defines. Both `--defines` and `%defines`
are, of course, maintained for backward compatibility.
*** Option --html
Since version 2.4 Bison can be used to generate HTML reports. However it
was a two-step process: first bison must be invoked with option `--xml`,
and then xsltproc must be run to the convert the XML reports into HTML.
The new option `--html` combines these steps. The xsltproc program must
be available.
*** A C++ native GLR parser
A new version of the C++ GLR parser was added: "glr2.cc". It generates
"true C++11", instead of a C++ wrapper around a C parser as does the
existing "glr.cc" parser. As a first significant consequence, it supports
`%define api.value.type variant`, contrary to glr.cc.
It should be upward compatible in terms of interface, feature and
performance to "glr.cc". To try it out, simply use
%skeleton "glr2.cc"
It will eventually replace "glr.cc". However we need user feedback on
this skeleton. _Please_ report your results and comments about it.
*** Counterexamples
Counterexamples now show the rule numbers, and always show ε for rules
with an empty right-hand side. For instance
exp
↳ 1: e1 e2 "a"
↳ 3: ε • ↳ 1: ε
instead of
exp
↳ e1 e2 "a"
↳ • ↳ ε
*** Lookahead correction in Java
The Java skeleton (lalr1.java) now supports LAC, via the `parse.lac`
%define variable.
*** Abort parsing for memory exhaustion (C)
User actions may now use `YYNOMEM` (similar to `YYACCEPT` and `YYABORT`)
to abort the current parse with memory exhaustion.
*** Printing locations in debug traces (C)
The `YYLOCATION_PRINT(File, Loc)` macro prints a location. It is defined
when (i) locations are enabled, (ii) the default type for locations is
used, (iii) debug traces are enabled, and (iv) `YYLOCATION_PRINT` is not
already defined.
Users may define `YYLOCATION_PRINT` to cover other cases.
*** GLR traces
There were no debug traces for deferred calls to user actions. They are
logged now.
Noteworthy changes in release 3.7.6 (2021-03-08) [stable]
** Bug fixes
*** Reused Push Parsers
When a push-parser state structure is used for multiple parses, it was
possible for some state to leak from one run into the following one.
*** Fix Table Generation
In some very rare conditions, when there are many useless tokens, it was
possible to generate incorrect parsers.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
These rules do not drop anything, but only alert when internal parts of
the engine trigger an event. This will allow us more insight on what is
happening.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 2.12 to 2.14
- Update rootfile
- Changelog
Version 2.14 Released 2021-09-09
* New Features:
- Add `json_object_getn`, `json_object_setn`, `json_object_deln`, and the
corresponding `nocheck` functions. (#520, by Maxim Zhukov)
* Fixes:
- Handle `sprintf` corner cases (#537, by Tobias Stoeckmann)
* Build:
- Symbol versioning for all exported symbols (#540, by Simon McVittie)
- Fix compiler warnings (#555, by Kelvin Lee)
* Documentation:
- Small fixes (#544, #546, by @i-ky)
- Sphinx 3 compatibility (#543, by Pierce Lopez)
Version 2.13.1 Released 2020-05-07
* Build:
- Include `jansson_version_str()` and `jansson_version_cmp()` in
shared library. (#534)
- Include ``scripts/`` in tarball. (#535)
Version 2.13 Released 2020-05-05
* New Features:
- Add `jansson_version_str()` and `jansson_version_cmp()` for runtime
version checking (#465).
- Add `json_object_update_new()`, `json_object_update_existing_new()`
and `json_object_update_missing_new()` functions (#499).
- Add `json_object_update_recursive()` (#505).
* Build:
- Add ``-Wno-format-truncation`` to suppress format truncation warnings (#489).
* Bug fixes:
- Remove ``strtod`` macro definition for MinGW (#498).
- Add infinite loop check in `json_deep_copy()` (#490).
- Add ``pipe`` macro definition for MinGW (#500).
- Enhance ``JANSSON_ATTRS`` macro to support earlier C standard(C89) (#501).
- Update version detection for sphinx-build (#502).
* Documentation:
- Fix typos (#483, #494).
- Document that call the custom free function to free the return value
of `json_dumps()` if you have a custom malloc/free (#490).
- Add vcpkg installation instructions (#496).
- Document that non-blocking file descriptor is not supported on
`json_loadfd()` (#503).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942
"Various security, performance, accuracy and stability issues have been fixed,
including two TCP evasion issues. CVE 2021-37592 was assigned."
Changelog:
"5.0.8 -- 2021-11-16
Security #4635: tcp: crafted injected packets cause desync after 3whs
Security #4727: Bypass of Payload Detection on TCP RST with options of MD5header
Bug #4345: Failed assert in TCPProtoDetectCheckBailConditions size_ts > 1000000UL
Bug #4382: fileinfo "stored: false" even if the file is kept on disk
Bug #4626: DNP3: intra structure overflow in DNP3DecodeObjectG70V6
Bug #4628: alert count shows up as 0 when stats are disabled
Bug #4631: Protocol detection : confusion with SMB in midstream
Bug #4639: Failed assertion in SMTP SMTPTransactionComplete
Bug #4646: TCP reassembly, failed assert app_progress > last_ack_abs, both sides need to be pruned
Bug #4647: rules: Unable to find the sm in any of the sm lists
Bug #4674: rules: mix of drop and pass rules issues
Bug #4676: rules: drop rules with noalert not fully dropping
Bug #4688: detect: too many prefilter engines lead to FNs
Bug #4690: nfs: failed assert self.tx_data.files_logged > 1
Bug #4691: IPv6 : decoder event on invalid fragment length
Bug #4696: lua: file info callback returns wrong value
Bug #4718: protodetect: SEGV due to NULL ptr deref
Bug #4729: ipv6 evasions : fragmentation
Bug #4788: Memory leak in SNMP with DetectEngineState
Bug #4790: af-packet: threads sometimes get stuck in capture
Bug #4794: loopback: different AF_INET6 values per OS
Bug #4816: flow-manager: cond_t handling in emergency mode is broken
Bug #4831: SWF decompression overread
Bug #4833: Wrong list_id with transforms for http_client_body and http file_data
Optimization #3429: improve err msg for dataset rules parsing
Task #4835: libhtp 0.5.39"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
if the system time is incorrect DNSSec validation fail but it fails sometimes for pool.ntp.org already but not for ping.ipfire.org.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This patch makes this package available for aarch64. There are no
reasons why it shouldn't be.
Compiling has become more resource-hungry which is why the memory
consumption per process has been upped to 3GiB.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
This patch fixes two wrong translations now used by the new
user manual links feature and removes an abandoned constant.
Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Tested-by: Bernhard Bitsch <bbitsch@ipfire.org>
This patch adds a function to verify the user manual links
configuration file at build time.
Run with "./make.sh check-manualpages"
Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
This patch adds a little "help" icon to the page header.
If a manual entry exists for a configuration page, the icon
appears and offers a quick way to access the wiki.
Wiki pages can be configured in the "manualpages" file.
Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Tested-by: Bernhard Bitsch <bbitsch@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 3.3 to 3.4.2
- Update rootfile - No dependency issues due to so bump
- Changelog
3.4.2 Jun-28-21
Add static trampoline support for Linux on x86_64 and ARM64.
Add support for Alibaba's CSKY architecture.
Add support for Kalray's KVX architecture.
Add support for Intel Control-flow Enforcement Technology (CET).
Add support for ARM Pointer Authentication (PA).
Fix 32-bit PPC regression.
Fix MIPS soft-float problem.
Enable tmpdir override with the $LIBFFI_TMPDIR environment variable.
Enable compatibility with MSVC runtime stack checking.
Reject float and small integer argument in ffi_prep_cif_var().
Callers must promote these types themselves.
3.3 Nov-23-19
Add RISC-V support.
New API in support of GO closures.
Add IEEE754 binary128 long double support for 64-bit Power
Default to Microsoft's 64-bit long double ABI with Visual C++.
GNU compiler uses 80 bits (128 in memory) FFI_GNUW64 ABI.
Add Windows on ARM64 (WOA) support.
Add Windows 32-bit ARM support.
Raw java (gcj) API deprecated.
Add pre-built PDF documentation to source distribution.
Many new test cases and bug fixes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Update from 5.1.0 to 5.1.1
- Update rootfile
- Changelog is quite long and detailed so the following are the high level descriptions
of the changes from the NEWS file in the source tarball. More details can be found in
the ChangeLog file in the source tarball.
Changes from 5.1.0 to 5.1.1
1. Infrastructure upgrades: Bison 3.8, Gettext 0.20.2, Automake 1.16.4,
and (will wonders never cease) Autoconf 2.71.
2. asort and asorti now allow FUNCTAB and SYMTAB as the first argument if a
second destination array is supplied. Similarly, using either array as
the second argument is now a fatal error. Additionally, using either
array as the destination for split(), match(), etc. also causes a
fatal error.
3. The new -I/--trace option prints a trace of the byte codes as they
are executed.
4. A number of subtle bugs relating to MPFR mode that caused differences
between regular operation and MPFR mode have been fixed.
5. The API now handles MPFR/GMP values slightly differently, requiring
different memory management for those values. See the manual for the
details if you have an extension using those values. As a result,
the minor version was incremented.
6. $0 and the fields are now cleared before starting a BEGINFILE rule.
7. The duplication of m4 and build-aux directories between the main
directory and the extension directory has been removed. This
simplifies the distribution.
8. The test suite has been improved, making it easier to run the entire
suite with -M. Use `GAWK_TEST_ARGS=-M make check' to do so.
9. Profiling and pretty-printing output has been modified slightly so
that functions are presented in a reasonable order with respect
to the namespaces that contain them.
10. Several example programs in the manual have been updated to their
modern POSIX equivalents.
11. A number of examples in doc/gawkinet.texi have been updated for
current times. Thanks to Juergen Kahrs for the work.
12. Handling of Infinity and NaN values has been improved.
13. There has been a general tightening up of the use of const and
of types.
14. The "no effect" lint warnings have been fixed up and now behave
more sanely.
15. The manual has been updated with much more information about what is
and is not a bug, and the changes in the gawk mailing lists.
16. The behavior of strongly-typed regexp constants when passed as the
third argument to sub() or gsub() has been clarified in the code and
in the manual.
17. Similar to item #4 above, division by zero is now fatal in MPFR
mode, as it is in regular mode.
18. There have been numerous minor code cleanups and bug fixes. See the
ChangeLog for details.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- v2 version is to extend from 4.4.25 to 4.4.26
- Update from 4.4.23 to 4.4.26
- Update of rootfile not required
- Changelog
Version 4.4.26
* Fix compilation on systems with GCC >= 10, that do not support
declarations with __attribute__((symver)).
Version 4.4.25
* Add support for Python 3.11 in the configure script.
* Stricter checking of invalid salt characters (issue #135).
Hashed passphrases are always entirely printable ASCII, and do
not contain any whitespace or the characters ':', ';', '*', '!',
or '\'. (These characters are used as delimiters and special
markers in the passwd(5) and shadow(5) files.)
Version 4.4.24
* Add hash group for Debian in lib/hashes.conf.
Debian has switched to use the yescrypt hashing algorithm as
the default for new user passwords, so we should add a group
for this distribution.
* Overhaul the badsalt test.
Test patterns are now mostly generated rather than manually coded
into a big table. Not reading past the end of the “setting” part
of the string is tested more thoroughly (this would have caught the
sunmd5 $$ bug if it had been available at the time).
Test logs are tidier.
* Add ‘test-programs’ utility target to Makefile.
It is sometimes useful to compile all the test programs but not run
them. Add a Makefile target that does this.
* Fix incorrect bcrypt-related ifdeffage in test/badsalt.c.
The four variants of bcrypt are independently configurable, but the
badsalt tests for them were all being toggled by INCLUDE_bcrypt,
which is only the macro for the $2b$ variant.
* Fix bigcrypt-related test cases in test/badsalt.c.
The test spec was only correct when both or neither of bigcrypt and
descrypt were enabled.
* Detect ASan in configure and disable incompatible tests.
ASan’s “interceptors” for crypt and crypt_r have a semantic conflict
with libxcrypt, requiring a few tests to be disabled for builds with
-fsanitize-address. See commentary in test/crypt-badargs.c for an
explanation of the conflict, and the commentary in
build-aux/zw_detect_asan.m4 for why a configure test is required.
* Fix several issues found by Covscan in the testsuite. These include:
- CWE-170: String not null terminated (STRING_NULL)
- CWE-188: Reliance on integer endianness (INCOMPATIBLE_CAST)
- CWE-190: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
- CWE-569: Wrong sizeof argument (SIZEOF_MISMATCH)
- CWE-573: Missing varargs init or cleanup (VARARGS)
- CWE-687: Argument cannot be negative (NEGATIVE_RETURNS)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
