Commit Graph

1443 Commits

Author SHA1 Message Date
Michael Tremer
b952a52b70 libloc: Import latest changes from upstream
This is now a unified patch instead of being split into
individual commits from upstream.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-26 16:15:07 +00:00
Michael Tremer
0be475ca36 libloc: Import changes from upstream
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-25 20:02:30 +00:00
Arne Fitzenreiter
e4f287a268 vdr: update to 2.4.4
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-23 18:15:48 +00:00
Michael Tremer
78a6918d34 libloc: Import more changes from upstream
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-19 13:08:22 +00:00
Michael Tremer
05db64d0ea libloc: Import recent patches from upstream
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-18 19:18:40 +00:00
Arne Fitzenreiter
2e1bf458e2 kernel: update to 4.14.206
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-11-12 09:02:02 +01:00
Peter Müller
987826deb1 Bash: apply patches 12 through 18 as well
Those fix some unintentional behaviour regarding autocompletion I
stumbled across the other day. While there seems nothing security
relevant in this, it irons out a few bugs.

The full and up-to-date list of all Bash 5.0 patches can be obtained
from https://ftp.gnu.org/gnu/bash/bash-5.0-patches/ .

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-03 10:38:25 +00:00
Matthias Fischer
5e11ef0f67 logwatch: Added upstream patch for Bug #12242
Added upstream patch from:

https://sourceforge.net/p/logwatch/mailman/message/37106642/

and

https://sourceforge.net/p/logwatch/mailman/message/37106883/

Fixes the display of "Unknown Entries: reuse_lease: ... " in dhpcd-logs.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-28 11:55:16 +00:00
Arne Fitzenreiter
1dd31d858e samba: update to 4.13.0
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-06 12:19:04 +00:00
Erik Kapfer
aa4ed7637c iptraf-ng: Update to version 1.2.1
Update includes several fixes and enhancements.
The full overview of changes are located in here --> https://github.com/iptraf-ng/iptraf-ng/blob/master/CHANGES .

rvnamed has been merged into iptraf-ng. Fix division by zero patch has been merged into new version, patch is not needed anymore. logrotate configuration for iptraf-ng has been included.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-09-30 09:58:51 +00:00
Stefan Schantl
8be7a2206c libloc: Update to 0.9.4
Also update to the shipped database to 2020-09-21.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-09-24 17:36:38 +00:00
Matthias Fischer
fcb991813b logwatch: Update to 7.5.4
Sorry, there is no changelog available.

For a better overview I moved 'logwatch-7.3.6-date_manip6.patch' to a directory of its own.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-09-24 17:36:38 +00:00
Michael Tremer
b171c68349 collectd: Link against libip4tc
libiptc is no longer being shipped by iptables and has been split
into a version for IPv4 and IPv6.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-09-24 17:36:38 +00:00
Michael Tremer
57b277786e fontconfig: update to 2.13.1
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-09-24 17:36:37 +00:00
Arne Fitzenreiter
3a69555f90 kernel: add patch agains CVE-2020-14386
fixes #12483

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-09-12 09:38:10 +02:00
Arne Fitzenreiter
9dafa28a1c Revert "kernel: add patch against CVE-2020-14386"
This reverts commit f04023b1ca.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-09-11 22:16:27 +02:00
Arne Fitzenreiter
f04023b1ca kernel: add patch against CVE-2020-14386
fixes #12483

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-09-11 21:27:15 +02:00
Arne Fitzenreiter
2c8819992e vim: update to 8.2 and fix crash with gcc-10
the configure.ac has a bug that detects gcc-10 as gcc-1 and so not use
some quirks. Also there is a bug with FORTIFY-SOURCE=2 that crash
if the matchparen plugin is used (enabled by default).

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-08-29 18:08:57 +00:00
Peter Müller
159cab272a OpenSSL: remove ciphers without Forward Secrecy from default ciphersuite
Ciphers not supplying (Perfect) Forward Secrecy are considered dangerous
since they allow content decryption in retrospect, if an attacker is
able to gain access to the servers' private key used for the
corresponding TLS session.

Since IPFire machines establish very few TLS connections by themselves, and
destinations (IPFire.org infrastructure, mirrors, IPS rule sources, etc.)
provide support for Forward Secrecy ciphers - some are even enforcing
them -, it is safe to drop support for anything else.

This patch reduces the OpenSSL default cipher list to:
TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(256) Mac=SHA384
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(256) Mac=SHA384
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256
ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(128) Mac=SHA256
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256
ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(128) Mac=SHA256
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH       Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256
DHE-RSA-CAMELLIA256-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA256
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256
DHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA256
ECDHE-ECDSA-AES256-SHA  TLSv1 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA1
ECDHE-ECDSA-AES128-SHA  TLSv1 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA1
ECDHE-RSA-AES256-SHA    TLSv1 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1
ECDHE-RSA-AES128-SHA    TLSv1 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-17 10:07:56 +00:00
Michael Tremer
6d6f306179 perl: Fix build in toolchain stage
perl searches for headers and libraries in the wrong paths
and detects GCC 10 as GCC 1.x.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-16 10:29:43 +00:00
Michael Tremer
30ddc2e27a kbd: Update to 2.2.0
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-16 10:29:42 +00:00
Michael Tremer
8ba15ff89a syslinux: Fix build with GCC 10
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-16 10:29:42 +00:00
Michael Tremer
ac2d807d1c ipfire-netboot: Fix build with GCC 10
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-16 10:29:42 +00:00
Michael Tremer
fed525f280 7zip: Fix build against GCC 10
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-16 10:29:42 +00:00
Arne Fitzenreiter
f8561a5c16 grub: update to 2.04
fixes: #12463

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-14 15:10:14 +00:00
Arne Fitzenreiter
03cd6810d3 libloc: fix i586 perl module
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-08-03 19:52:38 +02:00
Stefan Schantl
99659ce50b libloc: Only update database once a week
Ensure to download and update the database only once a week, even the
script will be called by cron each hour.

Fixes #12462.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-07-29 17:15:56 +00:00
Arne Fitzenreiter
be03f10353 libloc: use regular stack-protector on i586
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-07-22 20:46:13 +02:00
Stefan Schantl
99f8980dec libloc: Add upstream patch to fix a buffer issue.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-07-21 11:09:54 +00:00
Stefan Schantl
cb4860794b libloc: Apply patch to compile the perl module without stack protector.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-07-21 11:09:51 +00:00
Stefan Schantl
af7f9fc43d :xMerge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-switch-to-libloc
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2020-07-03 18:48:30 +02:00
Michael Tremer
82db9e5945 squidGuard: Update to 1.6.0
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-06-19 17:14:59 +00:00
Matthias Fischer
b2742aebf1 squidguard: Update to 1.5-beta
Changelog:

"Release 1.5

2010-09-09 Fixed inconsistent blocking (bug 59).  Replaced defined routine
in sgDB.c

2010-09-08 Added Russian translation from Vladimir Ipatov to squidGuard.cgi.in.

2009-10-19 Fixed two bypass problems with URLs which length is close to the limit
defined by MAX_BUF. The resulting proxy line exceeds this limit and causes
either squid or squidGuard to properly block a site.

2009-10-15 Fixed a problem with very long URLs. SquidGuard will go into
emergency mode when a overlong URLs are encountered. The emergency mode causes an
entire stop of blocking. This is not appropriate in this situation.

2009-09-30 Added patch by beber and gentoo (thank you!) to fix a problem when cross
compiling (bug 56).

2009-09-27 Added patch by gentoo to fix alocal warnings (bug 57).

2009-09-15 Added a feature to send log messages to syslog based on the patch from
Jun Jiang (thank you). (bug 42) In order to use syslog you have to run
configure with the new option "--with-syslog". In the configuration file you need to add a
line "syslog enable". If any other value but "enable" is used syslog is disabled and logging
to squidGuard.log takes place as usual. The following log level are used: DEBUG, NOTICE,
WARN, ERROR and EMERG. The local4 syslog facility is used by default. If you want to change
this, use the configure option "--with-syslog-facility=<facility>".

2009-09-12 Anonymized passwords (for connecting to the ldap or mysql server) written
to logfiles when squidGuard is starting. Added two configure options for choosing
different location for the LDAP include and library files.

2009-08-25 Added patch to check IP addresses against LDAP. Patch by Denis Bonnenfant
(bug 41) - thank you.

2009-08-23 Added patch to allow quoted strings in the configuration file (bug 53).
For more information see README.QuotedStrings. Thanks to Iain Fothergill for providing
the patch. Removed the fix for usernames starting with a number because it breaks the
time declarations.

2009-05-08 Added patch by INL to enable blocking against DNS based blacklists (bug 55).
Fixed re-opened bug 12: a problem with regular expressions. An entry like "www\.google\.de"
did not block www.google.de which it was supposed to do.
Solving this issue solved bug 46 as well.

2009-03-08 Fixed bug 52: Sometimes squidGuard crashes with an overflow
error message for vsprintf. Thanks to Dirk Schoebel for suggesting the proper fix.
Fixed bug 49: Using numeric username made squidGuard goes into emergency mode. This
has been fixed. Usernames can now start with a number, be numeric and can additionally
contain the following characters: @,à,é,è,ñ,á,ì,í,ò,ó,ù,ú."

Signed-off-by: Matthias Fischer <matthias.fischer at ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-06-19 17:14:59 +00:00
Stefan Schantl
45f4de2bbc libloc: Update to 0.9.2
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2020-06-15 19:47:07 +02:00
Stefan Schantl
4415b1c351 libloc: Import upstream patches.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2020-06-10 20:54:39 +02:00
Stefan Schantl
304abbae22 Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-switch-to-libloc 2020-06-10 18:01:14 +02:00
Arne Fitzenreiter
b923dd3de0 kernel: backport "random: try to actively add entropy"
this backports https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/char/random.c?id=50ee7529ec4500c88f8664560770a7a1b65db72b
to gather enough entropy for initialise the crng faster.
Of some machines like the APU it will need forever if
the machine only wait for entropy without doing anything else.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-06-03 08:03:01 +00:00
Stefan Schantl
89be703297 libloc: Import latest upstream patches.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2020-06-01 21:13:03 +02:00
Stefan Schantl
8b58dbf32a Merge branch 'switch-to-libloc' into next-switch-to-libloc 2020-05-25 19:58:54 +02:00
Michael Tremer
91b23ce05b squidGuard: Fix generating databases with libdb >= 5
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-05-22 12:47:32 +00:00
Michael Tremer
3ca0c6783a openldap: Update to 2.4.49
This patch removes slapd which is unused in IPFire.

Everything linked against the old version needs to
be shipped with this update.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-05-09 12:03:02 +00:00
Arne Fitzenreiter
88e8bf31ce coreutils: add uptream patch to fix build on aarch64
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-05-02 10:39:19 +00:00
Peter Müller
b347830644 coreutils: update to 8.32
Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-05-01 19:08:40 +00:00
Peter Müller
480afae717 automake: update to 1.16.2
This is required in order to build coreutils 8.32.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-05-01 19:08:38 +00:00
Arne Fitzenreiter
b14b37ba67 OpenSSH: fix login on i?86
glibc calls clock_nanosleep_time64 syscall even if it not defined in
the headers for this arch and the seccomp filter kills the process
with because an unknown syscall.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-04-10 21:41:14 +02:00
Peter Müller
59b2a70f7a dma: update to 0.12
All of the dma patches in src/patches/ were merged into its upstream
repository by now, thus becoming obsolete and deleted by this patch.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-03-30 16:44:35 +00:00
Peter Müller
1b1fe2f2b1 smartmontools: update to 7.1
Summary: smartmontools release 7.1
-----------------------------------------------------------
- smartctl: Fixed bogus exception on unknown form factor value (regression).
- smartctl '--json=cg': Suppresses extra spaces also in 'g' format.
- smartctl '-i': ATA ACS-4 and ACS-5 enhancements.
- smartd: No longer truncates very long device names in warning emails.
- smartd: No longer skips scheduled tests if system clock has been adjusted
  to the past.
- smartd '-A': Attribute logs now use local time instead of UTC.
- ATA: Device type '-d jmb39x,N' for drives behind JMicron JMB39x RAID port
  multipliers.
- SCSI: Workaround for incomplete Log subpages response from some SAS SSDs.
- HDD, SSD and USB additions to drive database.
- Autodetection of '-d sntjmicron' type for JMicron USB to NVMe bridges.
- configure: Defines '_FORTIFY_SOURCE=2' if supported and not defined.
- Linux/FreeBSD: Fixed segfault on CCISS transfer sizes > 512 bytes.
- Linux: Fixed smartd.service 'Type' if libsystemd-dev is not available.
- Linux: Fixed '/dev/megaraid_sas_ioctl_node' fd leak.
- Linux: Fixed GPL licensing problem of 'linux_nvme_ioctl.h'.
- FreeBSD update-smart-drivedb: Now uses 'fetch' as default download tool.
- FreeBSD big endian: Fixed NVMe access.
- FreeBSD: Compile fix for FreeBSD 12.
- NetBSD: Fixed device scan crash on empty name list.
- NetBSD: Fixed memory leak in device scan.
- Windows: Fixed log page access via Windows 10 NVMe driver for NVMe 1.2.1+.
- Windows: Allow drive letters as device names for Windows 10 NVMe driver.
- Windows: Workround to allow CSMI access to devices behind AMD RAID drivers.
- Windows: Fixed MinGW options to add relocation info if ASLR is enabled.
- Windows wtssendmsg: No longer writes '\n' line endings to event log.
- Windows wtssendmsg: New options '-t' and '-w'.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-03-26 09:57:27 +00:00
Arne Fitzenreiter
b6632b766a vdr: fix build with glibc 2.31
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-03-22 19:04:14 +00:00
Michael Tremer
a9f381bd89 qemu: Fix build against glibc >= 2.31
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-03-22 07:30:22 +00:00
Michael Tremer
50a04f785d cairo: Update to 1.16.0
This updates the package and adds a patch so that it compiles
with binutils 2.34.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-03-21 15:44:08 +00:00