This patch enabled that we can compress any firmware files on disk. This
will save some space since /lib/firmware is becoming larger with every
release.
From formerly 828MiB, this is now using ~349MiB which is a saving of
about 480MiB on disk. This is helping us a lot fighting to contain the
distribution to 2GB on /.
Some other firmware that is installed in other packages is not
compressed with this patch which is a bit sad, but potentially not worth
the effort.
In order to ship this change with a Core Update, it might be intuitive
to remove /lib/firmware first and then extract the new update with all
new files. However, I do not know if this all will compress as well as
before since now the files are already individually compressed. It might
be a challenge to ship this.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://downloads.isc.org/isc/bind9/9.16.27/doc/arm/html/notes.html#notes-for-bind-9-16-27
"Security Fixes
The rules for acceptance of records into the cache have been
tightened to prevent the possibility of poisoning if forwarders send
records outside the configured bailiwick. (CVE-2021-25220)
ISC would like to thank Xiang Li, Baojun Liu, and Chaoyi Lu from
Network and Information Security Lab, Tsinghua University, and
Changgen Zou from Qi An Xin Group Corp. for bringing this
vulnerability to our attention. [GL #2950]
TCP connections with keep-response-order enabled could leave the TCP
sockets in the CLOSE_WAIT state when the client did not properly
shut down the connection. (CVE-2022-0396) [GL #3112]
Feature Changes
DEBUG(1)-level messages were added when starting and ending the BIND
9 task-exclusive mode that stops normal DNS operation (e.g. for
reconfiguration, interface scans, and other events that require
exclusive access to a shared resource). [GL #3137]
Bug Fixes
The max-transfer-time-out and max-transfer-idle-out options were not
implemented when the BIND 9 networking stack was refactored in 9.16.
The missing functionality has been re-implemented and outgoing zone
transfers now time out properly when not progressing. [GL #1897]
TCP connections could hang indefinitely if the other party did not
read sent data, causing the TCP write buffers to fill. This has been
fixed by adding a “write” timer. Connections that are hung while
writing now time out after the tcp-idle-timeout period has elapsed.
[GL #3132]
The statistics counter representing the current number of clients
awaiting recursive resolution results (RecursClients) could
be miscalculated in certain resolution scenarios, potentially
causing the value of the counter to drop below zero. This has been
fixed. [GL #3147]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.8.0
"Bugfixes
python bindings: properly convert double values of rrd info
failed to expand 'Py_UNUSED', Invalid usage when expanding 'Py_UNUSED'
document --showtime in xport help output
fix --use-nan-for-all-missing-data
update rrdruby.pod
add missing rrdruby.pod and rrdpython.pod to dist
Set first_weekday to 0 (Sunday), when HAVE__NL_TIME_WEEK_1STDAY is not defined
fix median calculation for all NaN inputs
fix potential leak in xport during failure
fix many warnings raised by Cppcheck
fix many compiler warnings from latest gcc
ensure proper initialization in rrd_daemon
cleanup testsuite
better testing
avoid invalid read in rrd_client
add symbols from rrdc to librrd
Fix duplicate write_changes_to_disk() calls when HAVE_LIBRADOS is true and HAVE_MMAP is false
documentation updates
for SMIN example in docs
fix for pyton3 compatibility
freemem only for valid status <Christian Kr"oger>
fix double meaning of time 0 as uninitialized value
fix for zfs not supporting fallocate. this makes resize work on zfs
add rrdrados.pod to dist
fetch - do not call rrd_freemem on uninitialized pointers
use separate pango fontmap per thread
switch to python 3
do not leak filename when opening a broken file
fix leaks in rrdcached
avoid segfault when flushing cache
escape json in legend entries
fix leak in xport
make rrdcgi param parsing more robust
fix race in journal_write"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
This was introduced in b1c25d7a84, and
subsequently broke the nightly builds, and I failed to spot this in the
first place. :-/
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
It is not necessary to have this key present on IPFire systems anymore,
since it has not been in use for years, and we can expect systems to be
sufficiently up-to-date, so they no longer need to rely on old updates
or add-ons signed with this key.
Also, given the current key was generated in 2018, we should consider a
Pakfire key rollover soon.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
- In sysvinit-2.97 (Dec2020) a patch was added which allows init to load configuration data
from files stored in /etc/inittab.d/
This modification would have come in with Core Update 155.
- When sysvinit was updated from 2.88dsf to 2.98 the /etc/inittab.d/ directory in the
rootfile was commented out.
Sysvinit looks to see if there are any files in inittab.d but as that directory does not
exist then the message "No inittab.d directory found" is written during the boot and is
also shown in the log summary.
- This patch uncomments the directory so that it will be present. No files will be placed
in it but its prescence will stop the error message being shown during boot.
Fixes: Bug #12797
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This script appeared in the rootfiles for Core Updates 65 and 66, being
released in late 2012 and early 2013. It is not used elsewhere, and
there is no sense in keeping it around on IPFire installations.
Should this patch be accepted, a corresponding 'rm' statement is
necessary in the update.sh script of the Core Update it will go into.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
OpenSSL Security Advisory [15 March 2022]
============================================
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(CVE-2022-0778)
==================================================================================
Severity: High
The BN_mod_sqrt() function, which computes a modular square root,
contains
a bug that can cause it to loop forever for non-prime moduli.
Internally this function is used when parsing certificates that contain
elliptic curve public keys in compressed form or explicit elliptic curve
parameters with a base point encoded in compressed form.
It is possible to trigger the infinite loop by crafting a certificate
that
has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the
certificate
signature, any process that parses an externally supplied certificate
may thus
be subject to a denial of service attack. The infinite loop can also be
reached when parsing crafted private keys as they can contain explicit
elliptic curve parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from customers
- Certificate authorities parsing certification requests from
subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the
attacker
can control the parameter values are vulnerable to this DoS issue.
In the OpenSSL 1.0.2 version the public key is not parsed during initial
parsing of the certificate which makes it slightly harder to trigger
the infinite loop. However any operation which requires the public key
from the certificate will trigger the infinite loop. In particular the
attacker can use a self-signed certificate to trigger the loop during
verification of the certificate signature.
This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was
addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022.
OpenSSL 1.0.2 users should upgrade to 1.0.2zd (premium support customers
only)
OpenSSL 1.1.1 users should upgrade to 1.1.1n
OpenSSL 3.0 users should upgrade to 3.0.2
This issue was reported to OpenSSL on the 24th February 2022 by Tavis
Ormandy
from Google. The fix was developed by David Benjamin from Google and
Tomáš Mráz
from OpenSSL.
Note
====
OpenSSL 1.0.2 is out of support and no longer receiving public updates.
Extended
support is available for premium support customers:
https://www.openssl.org/support/contracts.html
OpenSSL 1.1.0 is out of support and no longer receiving updates of any
kind.
It is affected by the issue.
Users of these versions should upgrade to OpenSSL 3.0 or 1.1.1.
References
==========
URL for this Security Advisory:
https://www.openssl.org/news/secadv/20220315.txt
Note: the online version of the advisory may be updated with additional
details
over time.
For details of OpenSSL severity classifications please see:
https://www.openssl.org/policies/secpolicy.html
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This file contains our custom settings:
* Always load microcodes as early as possible
* We now compress the initrd using Zstandard which is substanstically
faster than XZ, but offers better compression ratios
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.50.0 to 1.50.4
- Update of rootfile
- Changelog
Overview of changes in 1.50.4, 09-02-2022
* Tweak synthetic space sizes
* itemize: Try harder to avoid NULL fonts
* docs: Some additions
* Pass synthetic slant to harfbuzz
* Make sloped carets work with uneven scales
* Fix serialiation on arm
* Avoid an uninitialized variable warning
* Reinstate previous behavior of pango_attr_list_splice
* Deprecated pango_coverage_ref/unref
* Fix serialization on non-glibc systems
* Fix allow-breaks handling
Overview of changes in 1.50.3, 21-12-2021
* pango-view: Add --serialize-to option for easy bug reporting
* Revert a transformation change that broke metrics for vertical text
* Handle fonts without space glyph (such as icon fonts) better
* Fix some corner cases of line width accounting
* Fix line height with emulated Small Caps
Overview of changes in 1.50.2, 16-12-2021
* Fix a problem with font fallback for Arabic
* Fix handling of fonts without a space glyph
* Various documentation improvements
* Fix build issues
Overview of changes in 1.50.1, 10-12-2021
* Fix a crash in tab handling
* Fix tab positioning without line wrapping
* Fix an assertion failure found by fuzzing
* Make underlines work again for broken fonts
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 2017.3.23 to 2021.8.22
- Update of rootfile
- Added link to mkfs.ntfs in lfs to provide the binary in sbin as the new package places it
in usr/sbin
- Ran find-dependencies and no problems flagged up.
- Changelog
Stable Version 2021.8.22 (August 30, 2021)
Fixed compile error when building with libfuse < 2.8.0
Fixed obsolete macros in configure.ac
Signalled support of UTIME_OMIT to external libfuse2
Fixed an improper macro usage in ntfscp.c
Updated the repository change in the README
Fixed vulnerability threats caused by maliciously tampered NTFS partitions
Stable Version 2017.3.23AR.6 (February 1, 2021)
Used kernel cacheing on read-only mounts or with lowntfs-3g
Avoided information leak when processing garbled compressed data
Defined option posix_nlink to compute a Posix compliant st_nlink
Recovered space when an index root is shortened
Replaced ENODATA with ENOATTR in xattrs functions for macOS
Added support for 'position' argument in macOS xattr functions
Changed default xattr access method to 'openxattr' for macOS builds
Allowed redefining the target location of the ntfsprogs tools
Fixed updating the allocated size when attribute lies in an extent
Enabled actions on directories in reparse plugins
Inserted the reparse tag in the bad reparse symlink
Supported use of WSL special files
Dropped rejecting having both EA and reparse data
Enabled Creating special files the same way as WSL
Checked the locations of MFT and MFTMirr at startup
Stable Version 2017.3.23AR.5 (April 1, 2020)
Processed the request argument of ioctl() as unsigned
Accepted alternative recording of cluster size
Fixed a poorly sized string in ntfsinfo
Fixed ntfsfallocate on a void file
Decoded execlink reparse points
Fixed object type returned in readdir() for reparse points
Exported the translations of Windows paths to current ones
Stable Version 2017.3.23AR.4 (March 1, 2019)
Fixed reporting an error when failed to build the mountpoint
Reverted accessing reparse directory through internal plugins
Cleaned object ids beyond the updated part
Fixed reacting to missing plugin
Returned a low level error when an ioctl fails
Truncated SSD trimming zones to granularity supported by the device
Stable Version 2017.3.23AR.3 (September 1, 2018)
Made sure log file buffers are properly aligned
Made reparse directories visible through internal plugins
Added an option to ntfscp to copy the modification time
Renamed undeleted files to avoid overwriting existing ones
Extended the allowed cluster size to 2MB
Allocated full clusters for reading and rescuing in ntfsclone
Prevented locally defined headers from interfering with ntfs-3g ones
Attempted mounting read-only after failed permission to read-write
Fixed collecting the label argument in mkntfs
Stable Version 2017.3.23AR.2 (March 1, 2018)
Made sure log file buffers are properly aligned
Checked log file blocks more recent than temporary ones
Processed redo log actions associated to undoing a CompensationlogRecord
Allowed setting a file object id without defining its birth ids
Documented read-only mount when Windows is hibernated
Stopped checking matches of MFTMirr against MFT at record 16
Filtered out reparse flags for selecting plugins
Delayed updating the MFT runlist when resizing in read-only mode
Double-checked whether record 15 is an extent of MFT
Checked whether the device to mount was forced read-only
Stable Version 2017.3.23AR.1 (October 1, 2017)
Bypassed cluster allocation errors using --ignore-fs-check in ntfsclone
Upgraded ntfsrecover to support log files for Windows 10
Fixed the computation of highest_vcn when applying a runlist fixup
Fixed updating the vcn of subtree in ntfsrecover
Relaxed checks on security descriptors
Enabled directory operations in plugins
Decoded more reparse tags in ntfsinfo
Logged falling back to mounting read-only
Fixed compiling on MacOSX (Erik Larsson)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.11 (2005) to 1.14 (2020)
- Update of rootfile
- find-dependencies run and no problems flagged
- Package was originally provided by Dug Song in source forge and with a github repository
No response was received from Dug Song to requests for updates and fixes so Oliver Falk
forked the repository and has been working on it and now the Dug Song repository is no
longer present and the old repoistory url redirects to the new ofalk repository
https://github.com/ofalk/libdnet
- Issues raised in this new repository are being actively responded to
- Changelog comment is
Finally release 1.14 with latest fixes included.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 3.1.2 to 3.4.0
- Update of rootfile
- Changelog
3.4.0
Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY. (Behdad Esfahbod)
Arabic Mark Transient Reordering Algorithm have been updated to revision 6. (Khaled Hosny)
ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag. (Alexis King)
It is now possible to get at once all math kerning values for a given glyph at a given corner. (Alexis King)
Fix locale_t portability issues on systems the typedef’s it to a void pointer. (Behdad Esfahbod)
New API:
+HB_BUFFER_FLAG_VERIFY
+HB_OT_TAG_MATH_SCRIPT
+HB_SCRIPT_MATH
+hb_ot_math_kern_entry_t
+hb_ot_math_get_glyph_kernings
Deprecated API
+HB_OT_MATH_SCRIPT
3.3.2
Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic. (Behdad Esfahbod)
3.3.1
Fix heap-use-after-free in harfbuzz-subset introduced in previous release. (Garret Rieger)
3.3.0
Improved documentation. (Matthias Clasen)
Internal code cleanup, using C++ standard library more. (Behdad Esfahbod)
The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance. (Behdad Esfahbod)
Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts. (Behdad Esfahbod)
Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation. (Matthias Clasen)
When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs. (Behdad Esfahbod)
Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details. (Behdad Esfahbod)
Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags. (David Corbett)
New API:
+HB_GLYPH_FLAG_UNSAFE_TO_CONCAT
+hb_segment_properties_overlay()
+hb_buffer_create_similar()
+hb_font_set_synthetic_slant()
+hb_font_get_synthetic_slant()
+hb_font_get_var_coords_design()
3.2.0
harfbuzz library improvements:
Fixed shaping of Apple Color Emoji flags in right-to-left context. (Behdad Esfahbod)
Fixed positioning of CFF fonts in HB_TINY profile. (Behdad Esfahbod)
OpenType 1.9 language tags update. (David Corbett)
Add HB_NO_VERTICAL config option. (Behdad Esfahbod)
Add HB_CONFIG_OVERRIDE_H for easier configuration. (Behdad Esfahbod)
harfbuzz-subset library improvements:
Improved packing of cmap, loca, and Ligature tables. (Garret Rieger)
Significantly improved overflow-resolution strategy in the repacker. (Garret Rieger)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 2.4.4 to 2.4.6
- Update of rootfile
- Changelog
Release 2.4.6 Sun February 20 2022
Bug fixes:
#566 Fix a regression introduced by the fix for CVE-2022-25313
in release 2.4.5 that affects applications that (1)
call function XML_SetElementDeclHandler and (2) are
parsing XML that contains nested element declarations
(e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>").
Release 2.4.5 Fri February 18 2022
Security fixes:
#562 CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
sequences (e.g. from start tag names) to the XML
processing application on top of Expat can cause
arbitrary damage (e.g. code execution) depending
on how invalid UTF-8 is handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
#561 CVE-2022-25236 -- Passing (one or more) namespace separator
characters in "xmlns[:prefix]" attribute values
made Expat send malformed tag names to the XML
processor on top of Expat which can cause
arbitrary damage (e.g. code execution) depending
on such unexpectable cases are handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
#558 CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
that could be triggered by e.g. a 2 megabytes
file with a large number of opening braces.
Expected impact is denial of service or potentially
arbitrary code execution.
#560 CVE-2022-25314 -- Fix integer overflow in function copyString;
only affects the encoding name parameter at parser creation
time which is often hardcoded (rather than user input),
takes a value in the gigabytes to trigger, and a 64-bit
machine. Expected impact is denial of service.
#559 CVE-2022-25315 -- Fix integer overflow in function storeRawNames;
needs input in the gigabytes and a 64-bit machine.
Expected impact is denial of service or potentially
arbitrary code execution.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
This script is orphaned: It was only used while upgrading to Core Update
89, sitting around in /usr/sbin/ doing nothing ever since.
Keeping it there won't do any harm. On the other hand, dragging an
unused script around on our installations does not make sense either.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
For details see:
https://downloads.isc.org/isc/bind9/9.16.26/doc/arm/html/notes.html#notes-for-bind-9-16-26
"Notes for BIND 9.16.26
Feature Changes
The DLZ API has been updated: EDNS Client-Subnet (ECS) options sent
by a client are now included in the client information sent to DLZ
modules when processing queries. [GL #3082]
Bug Fixes
Previously, recvmmsg support was enabled in libuv 1.35.0 and 1.36.0,
but not in libuv versions 1.37.0 or greater, reducing the maximum
query-response performance. This has been fixed. [GL #3095]
A failed view configuration during a named reconfiguration procedure
could cause inconsistencies in BIND internal structures, causing
a crash or other unexpected errors. This has been fixed. [GL #3060]
Previously, named logged a “quota reached” message when it hit its
hard quota on the number of connections. That message was
accidentally removed but has now been restored. [GL #3125]
Build errors were introduced in some DLZ modules due to an
incomplete change in the previous release. This has been fixed. [GL
#3111]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
