Commit Graph

17428 Commits

Author SHA1 Message Date
Leo-Andres Hofmann
43f20d6e5a memory.cgi: Fix memory usage table
procps 3.3.10 introduced a new output format for the "free" command.
This patch adapts the new format.

Fixes: #12628

Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Tested-by: Bernhard Bitsch <bbitsch@ipfire.org>
Tested-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-10 09:12:15 +00:00
Michael Tremer
65171dc956 intel-microcode: Update to 20210608
Fixes various security vulnerabilities:

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-09 17:02:11 +00:00
Michael Tremer
52c84741cf Merge branch 'master' into next 2021-06-08 14:10:22 +00:00
Michael Tremer
abd5cc3cb7 Revert "collectd: Use libstatgrab for reading disk stats"
This reverts commit 86beff5f75.

This patch breaks reading statistics on systems running a 4.14 kernel.
It seems like it is not dependant on the kernel, though.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-08 14:08:44 +00:00
Michael Tremer
f8b0610c53 Update linux-firmware to 20210511
Core Update 158 specifically ships files that are new or have changed to
keep the size of the update down.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-08 13:38:15 +00:00
Michael Tremer
613db5c199 flash-image: Increase root partition size to 1600MB
This is necessary due to the increased size of the base OS which is
mostly driven by linux-firmware.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-08 13:37:33 +00:00
Michael Tremer
0aad67988b core158: Ship apache2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-07 11:15:34 +00:00
Matthias Fischer
0957a949db apache: Update to 2.4.48
apache: Update to 2.4.48

For details see:
https://mirror.synyx.de/apache//httpd/CHANGES_2.4.48

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-07 11:15:01 +00:00
Michael Tremer
a86c5df80d core158: Ship rng-tools
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-07 11:14:40 +00:00
Peter Müller
41749b748b rng-tools: update to 6.12
Please refer to https://github.com/nhorman/rng-tools/releases for a full
list of meaningful changes between 6.4 and 6.12. "--without-pkcs11" is
necessary to avoid additional dependencies, which do not make sense on
IPFire since there are no use-cases for it.

Rootfiles did not change, our patch to use RDRDAND on i586 as well is
still valid.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-07 11:13:40 +00:00
Peter Müller
7086c36246 ~/src/patches/: Clean up orphaned patches, second batch
This also moves existing patches into their applications' directory
within ~/src/patches/, if already existant.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-06-04 18:24:23 +02:00
Peter Müller
c1d98bbbb3 ~/src/patches/: Clean up orphaned patches, duplicates and application patches outside existing directory structures
This patch represents the first batch of various patches we do not use
anymore, hence there is no sense in keeping them, polluting ~/src/patches/.

Two coreutils patches have been moved into the already existing
coreutils folder, while one libloc patch has been a duplicate to that
one already existing in ~/src/patches/libloc/.

Cleaning up this dump remains a non-exhaustive attempt, though. There
are several other patches I could not locate in LFS files in the first
place, which means that the amount of files we can drop from this
directory is likely to be greater than this patch currently covers.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-06-04 18:23:12 +02:00
Michael Tremer
6f8a114146 Revert "python3-msgpack: update to 1.0.0"
This reverts commit f94fd54e0c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 15:26:16 +00:00
Adolf Belka
bf2891dc5b perl-TimeDate: Update to 2.33
- Update from 1.20(2009) to 2.33(2020)
- Update rootfile
- Changelog
   2.33 -- Wed May 19 11:34:00 MT 2020
     * Remove PAX Headers in tarball using GNU tar
   2.32 -- Wed Mar 04 14:41:00 MT 2020
    * Fix t/date.t to run on leap years [arc]
   2.31 -- Thu Jan 16 14:00:00 MT 2020
     * Fix year 2020 bug from t/getdate.t [Prajith]
     * Fix warnings from t/date.t
     * Fix pod issue in lib/Date/Parse.pm
     * Fix for French language using English day suffixes in %o [mitchjacksontech]
     * RT#84075: Fix Date::Parse::str2time century issue. [perlpilot]
     * Adds Occitan language. [Quenty31]
     * Migrate GitHub repo and bugtracker to atoomic/perl-TimeDate
   2.30 -- Mon Feb 18 13:31:03 CST 2013
     * Syncing distribution version number with Date::Parse, not functional changes

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:50:14 +00:00
Michael Tremer
84f7176501 core158: Ship pcre2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:50:01 +00:00
Adolf Belka
7112adbc86 pcre2: Update to 10.37
- Update from 10.36 to 10.37
- Update rootfile
- find-dependencies run to check impact of so lib bump
   No issues found
- Changelog
   Version 10.37 26-May-2021
    1. Change RunGrepTest to use tr instead of sed when testing with binary
       zero bytes, because sed varies a lot from system to system and has problems
       with binary zeros. This is from Bugzilla #2681. Patch from Jeremie
       Courreges-Anglas via Nam Nguyen. This fixes RunGrepTest for OpenBSD. Later:
       it broke it for at least one version of Solaris, where tr can't handle binary
       zeros. However, that system had /usr/xpg4/bin/tr installed, which works OK, so
       RunGrepTest now checks for that command and uses it if found.
    2. Compiling with gcc 10.2's -fanalyzer option showed up a hypothetical problem
       with a NULL dereference. I don't think this case could ever occur in practice,
       but I have put in a check in order to get rid of the compiler error.
    3. An alternative patch for CMakeLists.txt because 10.36 #4 breaks CMake on
       Windows. Patch from email@cs-ware.de fixes bugzilla #2688.
    4. Two bugs related to over-large numbers have been fixed so the behaviour is
       now the same as Perl.
       (a) A pattern such as /\214748364/ gave an overflow error instead of being
           treated as the octal number \214 followed by literal digits.
       (b) A sequence such as {65536 that has no terminating } so is not a
           quantifier was nevertheless complaining that a quantifier number was too big.
    5. A run of autoconf suggested that configure.ac was out-of-date with respect
       to the lastest autoconf. Running autoupdate made some valid changes, some valid
       suggestions, and also some invalid changes, which were fixed by hand. Autoconf
       now runs clean and the resulting "configure" seems to work, so I hope nothing
       is broken. Later: the requirement for autoconf 2.70 broke some automatic test
       robots. It doesn't seem to be necessary: trying a reduction to 2.60.
    6. The pattern /a\K.(?0)*/ when matched against "abac" by the interpreter gave
       the answer "bac", whereas Perl and JIT both yield "c". This was because the
       effect of \K was not propagating back from the full pattern recursion. Other
       recursions such as /(a\K.(?1)*)/ did not have this problem.
    7. Restore single character repetition optimization in JIT. Currently fewer
       character repetitions are optimized than in 10.34.
    8. When the names of the functions in the POSIX wrapper were changed to
       pcre2_regcomp() etc. (see change 10.33 #4 below), functions with the original
       names were left in the library so that pre-compiled programs would still work.
       However, this has proved troublesome when programs link with several libraries,
       some of which use PCRE2 via the POSIX interface while others use a native POSIX
       library. For this reason, the POSIX function names are removed in this release.
       The macros in pcre2posix.h should ensure that re-compiling fixes any programs
       that haven't been compiled since before 10.33.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:49:47 +00:00
Adolf Belka
c372d43950 netsnmpd: Update to 5.9.1
- Update from 5.8 to 5.9.1
- Update rootfile
- find-dependencies run to check impact of so lib bump
   no issues found
- Changelog - for more details on the Many bug fixes for 5.9.1 see the
   ChangeLog file in the source tarball
   The following is from the CHANGES file in the source tarball
   *5.9.1*:
     General: Many bug fixes
   *5.9*
     snmplib:
      - Add IPv6 support to DTLSUDP transport
      - use new netsnmp_sockaddr_storage in netsnmp_addr_pair
      - add base_transport ptr for tunneled transports
      - Add support for OpenSSL 1.1.1
      - Dtls: overhaul of debug
      - Remove inline versions of container funcs
     snmpd:
      - Use ETHTOOL_GLINKSETTINGS when available Newer Linux kernels
	support ETHTOOL_GLINKSETTINGS. Use it when available instead of the
	older and deprecated ETHTOOL_GSET. This patch avoids that the Linux
	kernel reports the following kernel warning: warning: 'snmpd' uses
	legacy ethtool link settings API, link modes are only partially
	reported See also https://sourceforge.net/p/net-snmp/patches/1387/.
	[bvanassche: reworked this patch significantly]
      - Reduce the time needed to execute "pass" scripts on BSD systems See
	also https://github.com/net-snmp/net-snmp/issues/8.
      - [BUG 2926]: Make it possible to set agentXPingInterval for a
	subagent - register agentXPingInterval for the subagent list
	handler, before it was registered for snmp - added agentxTimeout to
	the subagent list handler. It's now possible to set for snmpd and
	the subagent. See 'man snmpd.conf' - added agentxRetries to the
	subagent list handler. See 'man snmpd.conf'. It's never used in the
	subagent, but it's now following the documentation Signed-off-by:
	Anders Wallin <wallinux@gmail.com>
     snmptrap:
      - BUG: 2899: Patch from Drew Roedersheimer to set library
	engineboots/time values before sending
     snmptrapd:
      - Add support for the latest libmysqlclient version
     libsnmp:
      - Scan MIB directories in alphabetical order This guarantees that
	e.g. mibs/RFC1213-MIB.txt is read before mibs/SNMPv2-MIB.txt. The
	order in which these MIBs is read matters because both define
	sysLocation but with different attributes.
     unspecified:
      - [BUG 2930]: Fix a Solaris hrSWInst crash Avoid that snmpd crashes
	on Solaris when querying software packages with an empty CATEGORY
	field. See also https://sourceforge.net/p/net-snmp/bugs/2930/. See
	also https://sourceforge.net/p/net-snmp/patches/1390/.
     FreeBSD:
      - Fix first byte of IF-MIB::ifPhysAddress   Don't write past the
	interface name, and use temporary copy instead. This fixes the
	first byte of ifPhysAddress always being 0 on FreeBSD. See also
	https://sourceforge.net/p/net-snmp/code/merge-requests/20/. [
	bvanassche: edited patch title / added test for malloc() result /
	reduced number of free(if_name) calls ]
     Win32:
      - BUG: 2779541 Fixed handle leak in pass_persist.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:49:31 +00:00
Michael Tremer
b2c32cae42 core158: Ship libnl-3
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:49:17 +00:00
Adolf Belka
0f12e034f0 libnl-3: Update to 3.5.0
- Update from 3.2.25 (2014) to 3.5.0 (2019)
- Update rootfile
- Added --disable-static to ./configure
- Added --bindir=/usr/sbin otherwise binaries were installed in /usr/bin
   Previous version installed the binaries in /usr/sbin without any command
   This maintains location of binaries the same across the versions
- Changelog is no longer provided. Changes have to be found by reading
   through the commits. https://github.com/thom311/libnl/releases
    This is too large to include here.
    There are 664 commits across 7 releases

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:48:35 +00:00
Michael Tremer
f8ac400cb8 core158: Ship libcap
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:48:17 +00:00
Adolf Belka
179f3ec082 libcap: Update to 2.50
- Update from 2.49 to 2.50
- Update rootfile
- Version 2.50 failed to install capsh - bug raised for this
   https://bugzilla.kernel.org/show_bug.cgi?id=213261
   patch to fix this bug created and used in this build
- Changelog
   Release notes for 2.50
    2021-05-24 12:05:16 -0700
      Some new capsh features:
          --explain=cap_foo: describe what cap_foo does (Bug 212451)
          --suggest=phrase: search all the cap descriptions and describe those that match the phrase
      Add "keepcaps" module argument support to pam_cap.so (reported by Zoltan Fridrich. Bug 212945)
          extend libcap to include cap_prctl() and cap_prctlw() functions to regain feature parity with Go "cap" package. These are only needed when linking against -lpsx for keepcaps POSIX semantics.
          this likely requires substantial application changes to make Ambient capability support usable in general, but doing our part for the admin.
      Add a test case for recent kernel fix (Bug 212737)
      Go pragma fix for convenience functions in "cap" module (reported by Lorenz Bauer. Bug 212321)
      Minor man documentation updates
      Minor build tree improvements (mostly for maintainer)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:47:48 +00:00
Michael Tremer
331ba89bfd core158: Ship gnutls
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:47:34 +00:00
Adolf Belka
f5e719df3e gnutls: Update to 3.6.16
- Update from 3.6.14 to 3.6.16
- Update rootfile
- Changelog
   * Version 3.6.16 (released 2021-05-24)
     ** libgnutls: Fixed potential miscalculation of ECDSA/EdDSA code backported from
        Nettle.  In GnuTLS, as long as it is built and linked against the fixed
        version of Nettle, this only affects GOST curves.  [CVE-2021-20305]
     ** libgnutls: Fixed potential use-after-free in sending "key_share"
        and "pre_shared_key" extensions. When sending those extensions, the
        client may dereference a pointer no longer valid after
        realloc. This happens only when the client sends a large Client
        Hello message, e.g., when HRR is sent in a resumed session
        previously negotiated large FFDHE parameters, because the initial
        allocation of the buffer is large enough without having to call
        realloc (#1151).  [GNUTLS-SA-2021-03-10, CVSS: low]
   * Version 3.6.15 (released 2020-09-04)
     ** libgnutls: Fixed "no_renegotiation" alert handling at incorrect timing.
        The server sending a "no_renegotiation" alert in an unexpected timing,
        followed by an invalid second handshake was able to cause a TLS 1.3 client to
        crash via a null-pointer dereference. The crash happens in the application's
        error handling path, where the gnutls_deinit function is called after
        detecting a handshake failure (#1071).  [GNUTLS-SA-2020-09-04, CVSS: medium]
     ** libgnutls: If FIPS self-tests are failed, gnutls_fips140_mode_enabled() now
        indicates that with a false return value (!1306).
     ** libgnutls: Under FIPS mode, the generated ECDH/DH public keys are checked
        accordingly to SP800-56A rev 3 (!1295, !1299).
     ** libgnutls: gnutls_x509_crt_export2() now returns 0 upon success, rather than
        the size of the internal base64 blob (#1025). The new behavior aligns to the
        existing documentation.
     ** libgnutls: Certificate verification failue due to OCSP must-stapling is not
        honered is now correctly marked with the GNUTLS_CERT_INVALID flag
        (!1317). The new behavior aligns to the existing documentation.
     ** libgnutls: The audit log message for weak hashes is no longer printed twice
        (!1301).
     ** libgnutls: Fixed version negotiation when TLS 1.3 is enabled and TLS 1.2 is
        disabled in the priority string. Previously, even when TLS 1.2 is explicitly
        disabled with "-VERS-TLS1.2", the server still offered TLS 1.2 if TLS 1.3 is
        enabled (#1054).

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:46:43 +00:00
Michael Tremer
e027e094cb Revert "~/src/patches/: Clean up orphaned patches, duplicates and application patches outside existing directory structures"
This reverts commit 5adde58cd5.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-04 10:46:30 +00:00
Peter Müller
5adde58cd5 ~/src/patches/: Clean up orphaned patches, duplicates and application patches outside existing directory structures
This patch represents the first batch of various patches we do not use
anymore, hence there is no sense in keeping them, polluting ~/src/patches/.

Two coreutils patches have been moved into the already existing
coreutils folder, while one libloc patch has been a duplicate to that
one already existing in ~/src/patches/libloc/.

Cleaning up this dump remains a non-exhaustive attempt, though. There
are several other patches I could not locate in LFS files in the first
place, which means that the amount of files we can drop from this
directory is likely to be greater than this patch currently covers.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:49:29 +00:00
Peter Müller
f94fd54e0c python3-msgpack: update to 1.0.0
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:49:18 +00:00
Peter Müller
3e60ed14e2 Clean up whatever remained from ALGs in userspace
This patch removes translations, directives in LFS files, and ALG shared
object files which all became orphaned after we disabled ALGs due to NAT
Slipstreaming vulnerability in Core Update 155.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:16:30 +00:00
Peter Müller
2c8a20af47 Drop unmaintained add-on dpfhack
This package seems to be unmaintained for at least five years. It's
(former?) upstream traces back to https://section5.ch/index.php/2011/01/13/dpf-hacking/,
but download links to both dpfhack and a patched version of lcd4linux
point to http://localhost/.

http://tech.section5.ch/files/dpfhack-0.1alpha.tgz still serves
something apparently related to dpfhack, but it is unclear whether that
is a previous version than the "0.12devel" we know about, or a
successor. https://tech.section5.ch/files/dpfhack-0.1alpha.tgz, just to
have it noticed, comes with a X.509 certificate not issued for this
FQDN.

dpfhack is solely needed as a dependancy for lcd4linux, which appears to
be unmaintained as well, hence being dropped in a dedicated patch.

Given the status quo, bugs in dpfhack cannot be reported properly,
security issues won't be addressed (by anybody else then ourselves), and
technical questions cannot be clarified aside a reverse engineering
approach.

We should not allow such an add-on to be installed on a firewall system.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:16:21 +00:00
Peter Müller
c62adbc448 Drop unmaintained add-on lcd4linux
This package has not received any updates or attention within the last
three years. It's sole known upstream URL (https://ssl.bulix.org/projects/lcd4linux/)
returns a HTTP error 404 nowadays, and the author was unable to locate
any upstream source that appears to be still maintained today.

Given the status quo, bugs in lcd4linux cannot be reported properly,
security issues won't be addressed (by anybody else then ourselves), and
technical questions cannot be clarified aside a reverse engineering
approach.

We should not allow such an add-on to be installed on a firewall system.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:16:13 +00:00
Michael Tremer
0b38fd75d4 core158: Ship dmidecode
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:15:15 +00:00
Peter Müller
740549d85a dmidecode: update to 3.3
Notable changes as per https://git.savannah.gnu.org/cgit/dmidecode.git/plain/NEWS:

Version 3.3 (Wed Oct 14 2020)
  - [BUILD] Allow overriding build settings from the environment.
  - [COMPATIBILITY] Document how the UUID fields are interpreted.
  - [PORTABILITY] Don't use memcpy on /dev/mem on arm64.
  - [PORTABILITY] Only scan /dev/mem for entry point on x86.
  - Support for SMBIOS 3.3.0. This includes new processor names, new port
    connector types, and new memory device form factors, types and
    technologies.
  - Add bios-revision, firmware-revision and system-sku-number to -s option.
  - Use the most appropriate unit for cache size.
  - Decode system slot base bus width and peers.
  - Important bug fixes:
    Fix Redfish Hostname print length
    Fix formatting of TPM table output
    Fix System Slot Information for PCIe SSD
    Don't choke on invalid processor voltage
  - Use the most appropriate unit for cache size.

Version 3.2 (Wed Sep 14 2018)
  - [COMPATIBILITY] The UUID is now displayed using lowercase letters, per
    RFC 4122 (#53569). You must ensure that any code parsing it is
    case-insensitive.
  - Support for SMBIOS 3.2.0. This includes new processor names, new socket
    and port connector types, new system slot state and property, and support
    for non-volatile memory (NVDIMM).
  - Support for Redfish management controllers.
  - A new command line option to query a specific structure by its handle.
  - A new command line option to query the system family string.
  - Support for 3 ThinkPad-specific structures (patch #9642).
  - Support for HPE's new company name.
  - Support UEFI on FreeBSD.
  - Important bug fixes:
    Fix firmware version of TPM device
    Fix the HPE UEFI feature flag check
  - (biosdecode) A new command line option to fully decode PIR information
    (support request #109339).

This patch also features two new patches recommended by upstream, whose
online version can be retrieved at
https://git.savannah.gnu.org/cgit/dmidecode.git/commit/?id=1117390ccd9cea139638db6f460bb6de70e28f94
https://git.savannah.gnu.org/cgit/dmidecode.git/commit/?id=11e134e54d15e67a64c39a623f492a28df922517.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:14:21 +00:00
Michael Tremer
31faaf2b14 core158: Ship gzip
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:14:06 +00:00
Peter Müller
0ebe81821f gzip: update to 1.10
Relevant excerpt from Changelog as per
https://savannah.gnu.org/forum/forum.php?forum_id=9339:

NEWS

* Noteworthy changes in release 1.10 (2018-12-29) [stable]

** Changes in behavior

  Compressed gzip output no longer contains the current time as a
  timestamp when the input is not a regular file.  Instead, the output
  contains a null (zero) timestamp.  This makes gzip's behavior more
  reproducible when used as part of a pipeline.  (As a reminder, even
  regular files will use null timestamps after the year 2106, due to a
  limitation in the gzip format.)

** Bug fixes

  A use of uninitialized memory on some malformed inputs has been fixed.
  [bug present since the beginning]

  A few theoretical race conditions in signal handers have been fixed.
  These bugs most likely do not happen on practical platforms.
  [bugs present since the beginning]

In addition, gzip 1.10 comes with the GNU library patch applied, so
there is no need to carry this file around any more.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-03 09:13:00 +00:00
Michael Tremer
c9dbf671d4 core158: Ship perl files with changed permissions
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-02 09:45:04 +00:00
Peter Müller
55f0bafb7b configroot: prevent any Perl file within /var/ipfire/ from being owned by nobody
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-02 09:42:50 +00:00
Michael Tremer
839451c527 dnsdist: Improve initscript to prevent reload on config error
start, restart and reload will now be prohibited if the configuration
file has an incorrect syntax. This avoids killing a running daemon and
is showing an indication to the user instead of having the daemon dying
silently in the background.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-06-01 11:39:09 +02:00
Matthias Fischer
ceb5733c59 Deleted no longer used 'if' clauses (ALG) from firewall init
In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25
all ALGs were removed from UI.

But they remained - somehow - in the initscript (firewall).

I tried to remove the remnants - hopefully in the correct way.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:41:52 +00:00
Michael Tremer
0e734ef7a8 core158: Ship sshd_config
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:41:41 +00:00
Peter Müller
a9fb87809e OpenSSH: restrict file permissions for sshd_config to 0600
This file does not have to be readable by anybody else than the user
running an OpenSSH server. While it does not really contain confidential
information, exposing it to the rest of the world makes no sense either.

This will silence a Lynis warning. :-)

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:41:13 +00:00
Michael Tremer
97c76ea56f core158: Ship expat
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:41:00 +00:00
Adolf Belka
f8513e6f57 expat: Update to 2.4.1
- Update from 2.3.0 to 2.4.1
- Update rootfile
- Changelog (URL in changelog changed to https://verbump(dot)de as mail was
   rejected by IPFire mail system due to policy violation because URL was
   highlighted as a blacklisted addresss
   Release 2.4.1 Sun May 23 2021
        Bug fixes:
         #488 #490  Autotools: Fix installed header expat_config.h for multilib
                    systems; regression introduced in 2.4.0 by pull request #486
        Other changes:
         #491 #492  Version info bumped from 9:0:8 to 9:1:8;
                    see https://verbump(dot)de/ for what these numbers do
        Special thanks to:
            Gentoo's QA check "multilib_check_headers"
   Release 2.4.0 Sun May 23 2021
        Security fixes:
         #34 #466 #484  CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks
                    (denial-of-service; flavors targeting CPU time or RAM or both,
                    leveraging general entities or parameter entities or both)
                    by tracking and limiting the input amplification factor
                    (<amplification> := (<direct> + <indirect>) / <direct>).
                    By conservative default, amplification up to a factor of 100.0
                    is tolerated and rejection only starts after 8 MiB of output bytes
                    (=<direct> + <indirect>) have been processed.
                    The fix adds the following to the API:
                    - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to
                      signals this specific condition.
                    - Two new API functions ..
                      - XML_SetBillionLaughsAttackProtectionMaximumAmplification and
                      - XML_SetBillionLaughsAttackProtectionActivationThreshold
                      .. to further tighten billion laughs protection parameters
                      when desired.  Please see file "doc/reference.html" for details.
                      If you ever need to increase the defaults for non-attack XML
                      payload, please file a bug report with libexpat.
                    - Two new XML_FEATURE_* constants ..
                      - that can be queried using the XML_GetFeatureList function, and
                      - that are shown in "xmlwf -v" output.
                    - Two new environment variable switches ..
                      - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and
                      - EXPAT_ENTITY_DEBUG=(0|1)
                      .. for runtime debugging of accounting and entity processing.
                      Specific behavior of these values may change in the future.
                    - Two new command line arguments "-a FACTOR" and "-b BYTES"
                      for xmlwf to further tighten billion laughs protection
                      parameters when desired.
                      If you ever need to increase the defaults for non-attack XML
                      payload, please file a bug report with libexpat.
        Bug fixes:
         #332 #470  For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake)
                    or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault
                    for UTF-16 payloads containing CDATA sections.
         #485 #486  Autotools: Fix generated CMake files for non-64bit and
                    non-Linux platforms (e.g. macOS and MinGW in particular)
                    that were introduced with release 2.3.0
        Other changes:
         #468 #469  xmlwf: Improve help output and the xmlwf man page
              #463  xmlwf: Improve maintainability through some refactoring
              #477  xmlwf: Fix man page DocBook validity
         #458 #459  CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR
                    and CMAKE_INSTALL_INCLUDEDIR
         #471 #481  CMake: Add support for standard variable BUILD_SHARED_LIBS
              #457  Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters
              #467  Resolve macro HAVE_EXPAT_CONFIG_H
              #472  Delete unused legacy helper file "conftools/PrintPath"
         #473 #483  Improve attribution
         #464 #465 #477  doc/reference.html: Fix XHTML validity
         #475 #478  doc/reference.html: Replace the 90s look by OK.css
              #479  Version info bumped from 8:0:7 to 9:0:8
                    due to addition of new symbols and error codes;
                    see https://verbump(dot)de/ for what these numbers do
        Infrastructure:
              #456  CI: Enable periodic runs
              #457  CI: Start covering the list of exported symbols
              #474  CI: Isolate coverage task
         #476 #482  CI: Adapt to breaking changes in image "ubuntu-18.04"
              #477  CI: Cover well-formedness and DocBook/XHTML validity
                    of doc/reference.html and doc/xmlwf.xml
        Special thanks to:
            Dimitry Andric
            Eero Helenius
            Nick Wellnhofer
            Rhodri James
            Tomas Korbar
            Yury Gribov and Clang LeakSan
            JetBrains
            OSS-Fuzz

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:40:44 +00:00
Michael Tremer
8c06bb2df9 core158: Ship curl
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:40:34 +00:00
Adolf Belka
abcabf673e curl: Update to 7.77.0
- Update from 7.76.1 to 7.77.0
- Update rootfile
- Changelog is too large to include here. It can be accesed at
   https://curl.se/changes.html
   There are 5 changes and 133 bug fixes of which 3 are related to CVE's

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:40:11 +00:00
Adolf Belka
5423f33385 cmake: Update to 3.20.3
- Update from 3.20.2 to 3.20.3
- Update of rootfile not required
- Changelog
   Changes made since CMake 3.20.2:
   Brad King (7):
    Help: Use relative path for IDE Integration guide link to preset schema
    BinUtils: Use more-private temporary variable names
    ObjectiveC: Respect OSX_ARCHITECTURES for OBJC
    FindBoost: Add support for Boost 1.76
    Ninja: Restore support for Fortran in a symlinked build tree
    Utilities/Sphinx: Update man page config for Sphinx 4
    CMake 3.20.3
   Craig Scott (2):
    ExternalProject: Ensure git fetch if updating to hash we don’t have yet
    ExternalProject: Only add git config setting with git 1.7.7 or later
   Kyle Edwards (2):
    Ninja Multi-Config: Split long command lines by config
    CMP0082: Check EXCLUDE_FROM_ALL property at generate time
   Raul Tambre (3):
    GNU: C++17 default version
    GNU: Final C++20 flags
    GNU: C++23 support
   Robert Maynard (6):
    CUDA: improve regex for CUDA Toolkit root from nvcc verbose output
    cmCommandLineArgument: Correctly record parsing failures
    cmake: --build and --install error out when encountering bad flags
    cmCommandLineArgument: Provide more information syntax error messages
    NVHPC: Support explicit language flags
    NVHPC: Support Ninja dependency scanning

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:40:02 +00:00
Michael Tremer
b9714c0eee core158: Ship zstd
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:39:47 +00:00
Adolf Belka
2a2219ae9b zstd: Update to 1.5.0
- Update from 1.4.9 to 1.5.0
- Update of rootfile
- Changelog
    v1.5.0  (May 11, 2021)
     api: Various functions promoted from experimental to stable API: (#2579-2581, @senhuang42)
       `ZSTD_defaultCLevel()`
       `ZSTD_getDictID_fromCDict()`
     api: Several experimental functions have been deprecated and will emit a compiler warning (#2582, @senhuang42)
       `ZSTD_compress_advanced()`
       `ZSTD_compress_usingCDict_advanced()`
       `ZSTD_compressBegin_advanced()`
       `ZSTD_compressBegin_usingCDict_advanced()`
       `ZSTD_initCStream_srcSize()`
       `ZSTD_initCStream_usingDict()`
       `ZSTD_initCStream_usingCDict()`
       `ZSTD_initCStream_advanced()`
       `ZSTD_initCStream_usingCDict_advanced()`
       `ZSTD_resetCStream()`
     api: ZSTDMT_NBWORKERS_MAX reduced to 64 for 32-bit environments (@Cyan4973)
     perf: Significant speed improvements for middle compression levels (#2494, @senhuang42 @terrelln)
     perf: Block splitter to improve compression ratio, enabled by default for high compression levels (#2447, @senhuang42)
     perf: Decompression loop refactor, speed improvements on `clang` and for `--long` modes (#2614 #2630, @Cyan4973)
     perf: Reduced stack usage during compression and decompression entropy stage (#2522 #2524, @terrelln)
     bug: Improve setting permissions of created files (#2525, @felixhandte)
     bug: Fix large dictionary non-determinism (#2607, @terrelln)
     bug: Fix non-determinism test failures on Linux i686 (#2606, @terrelln)
     bug: Fix various dedicated dictionary search bugs (#2540 #2586, @senhuang42 @felixhandte)
     bug: Ensure `ZSTD_estimateCCtxSize*() `monotonically increases with compression level (#2538, @senhuang42)
     bug: Fix --patch-from mode parameter bound bug with small files (#2637, @occivink)
     bug: Fix UBSAN error in decompression (#2625, @terrelln)
     bug: Fix superblock compression divide by zero bug (#2592, @senhuang42)
     bug: Make the number of physical CPU cores detection more robust (#2517, @PaulBone)
     doc: Improve `zdict.h` dictionary training API documentation (#2622, @terrelln)
     doc: Note that public `ZSTD_free*()` functions accept NULL pointers (#2521, @animalize)
     doc: Add style guide docs for open source contributors (#2626, @Cyan4973)
     tests: Better regression test coverage for different dictionary modes (#2559, @senhuang42)
     tests: Better test coverage of index reduction (#2603, @terrelln)
     tests: OSS-Fuzz coverage for seekable format (#2617, @senhuang42)
     tests: Test coverage for ZSTD threadpool API (#2604, @senhuang42)
     build: Dynamic library built multithreaded by default (#2584, @senhuang42)
     build: Move  `zstd_errors.h`  and  `zdict.h`  to  `lib/`  root (#2597, @terrelln)
     build: Allow `ZSTDMT_JOBSIZE_MIN` to be configured at compile-time, reduce default to 512KB (#2611, @Cyan4973)
     build: Single file library build script moved to `build/` directory (#2618, @felixhandte)
     build: `ZBUFF_*()` is no longer built by default (#2583, @senhuang42)
     build: Fixed Meson build (#2548, @SupervisedThinking @kloczek)
     build: Fix excessive compiler warnings with clang-cl and CMake (#2600, @nickhutchinson)
     build: Detect presence of `md5` on Darwin (#2609, @felixhandte)
     build: Avoid SIGBUS on armv6 (#2633, @bmwiedmann)
     cli: `--progress` flag added to always display progress bar (#2595, @senhuang42)
     cli: Allow reading from block devices with `--force` (#2613, @felixhandte)
     cli: Fix CLI filesize display bug (#2550, @Cyan4973)
     cli: Fix windows CLI `--filelist` end-of-line bug (#2620, @Cyan4973)
     contrib: Various fixes for linux kernel patch (#2539, @terrelln)
     contrib: Seekable format - Decompression hanging edge case fix (#2516, @senhuang42)
     contrib: Seekable format - New seek table-only API  (#2113 #2518, @mdittmer @Cyan4973)
     contrib: Seekable format - Fix seek table descriptor check when loading (#2534, @foxeng)
     contrib: Seekable format - Decompression fix for large offsets, (#2594, @azat)
     misc: Automatically published release tarballs available on Github (#2535, @felixhandte)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:39:33 +00:00
Adolf Belka
69d65dee13 zerofree: Update to 1.1.1
- Update from 1.0.1 (2008) to 1.1.1 (2018)
- Update of rootfile not required
- Changelog information is not available in the source tarball or in the
   zerofree website

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:39:19 +00:00
Michael Tremer
66c55e6cb0 core158: Ship zd1211-firmware
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:39:01 +00:00
Adolf Belka
05f1889aa8 zd1211-firmware: Update to 1.5
- Update from 1.4 (2007) to 1.5 (2014)
- Update of rootfile not required
- Changelog
    Sync to vendor driver v3.0.0.56
    Header files taken from LinuxUSB_AR2524-3.0.0.56.tgz

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:38:41 +00:00
Michael Tremer
a0112ac028 core158: Ship perl-XML-Parser
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-05-31 12:38:23 +00:00