Commit Graph

4495 Commits

Author SHA1 Message Date
Michael Tremer
0f7cdd7661 Merge branch 'master' into next 2023-10-11 07:50:21 +00:00
Michael Tremer
c48872ef76 curl: Fix CVE-2023-38545
https://curl.se/docs/CVE-2023-38545.html

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-11 07:47:47 +00:00
Adolf Belka
ebcfcd1003 udev: Update to version 3.2.14
- Update from version 3.2.12 to 3.2.14
- Update of rootfile not required
- This version update includes the patches previously used to add the dummies for tags
   and to update to udev version 251 which is bugfix #253
- Changelog
    3.2.14
	    Clear sysattr cache if a null pointer is passed by @NaofumiHonda in #255
	    Add /usr/local/lib/udev/rules.d by @bbonev in #260
	    Fix := not preventing further assignments to RUN by @bbonev in #257
	    Let libudev find hwdb.bin under UDEV_HWDB_BIN by
	     @vivien-consider-dropping-github in #264
	    Add a generic --output argument to udevadm hwdb by
	     @vivien-consider-dropping-github in #263
	    Dynamically get the udevadm hwdb files with a path variable by
	     @vivien-consider-dropping-github in #262
	    More wording fixes for the manual page for udev by
	     @vivien-consider-dropping-github in #265
	    Add missing API from 247 by @bbonev in #253
	    Ensure that standard file descriptors are open by @bbonev in #266

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:17:26 +00:00
Adolf Belka
375d921d00 sysvinit: Update to version 3.08
- Update from version 3.00 to 3.08
- Update of rootfile
- All the other patches and sed modifications are now built mintyo the source tarball,
   except for the mountpoint patch which is stilol needed
- Changelog
    3.08
	This release focuses on three changes which are basically imports of patches from Gentoo. Special thanks to floppym for supplying these.
	    Applied a patch from floppm which adds kexec option to the halt command. This can be used as "halt -k".
	    floppym provided patch which causes the halt command to call "shutdown -h -H" instead of "shutdown -h" when halt is invoked without parameters. This forces the shutdown command to set the INIT_HALT variable and assume, unless other conditions apply, that the "halt" call really wants to halt the machine and INIT_HALT should be set. In other words we assume halt wants to halt unless told otherwise.
	     Addresses downstream Gentoo bug ID 911257.
	    Updated halt documentation and help output to display parameters in alphabetical order.
    3.07
	The 3.07 release of SysV init mostly introduces fixes and improvements for the
	 killall5 and pidof programs. (These are actually the same program, but are
	 invoked with two different names, which result in different behaviour. The main
	 highlights in this release are:
		Fixed killall5 so that processes in the omit list are not sent any
		 signals, including SIGSTOP.
		Fixed usage message for killall5 to be more accurate.
		pidof was not returning PIDs of programs which were launched using a
		 symbolic link. This has been fixed so programs run from a symbolic link
		 show up in process lists.
    3.06
	    Mark Hindley fixed typo in es.po
	    Mark Hindley cleaned up translation code in src/Makefile.
	    Drop sulogin from Debian build. Removed libcrypt-dev dependency.
	    Fixed pt translation pages which were failing due to mis-matched open/close
	     tags.
	    Makefile now respects ROOT prefix when setting up pidof-to-killall5 symbolic
	     link.
	    Removed redundant translation files from man directory.
	    Makefile now respects DESTDIR. User can specify either ROOT= or DESTDIR= to
	     set install prefix.
    3.05
	This release (3.05) focuses on two things:
	    Updating the translation framework.
	    Fixing compiling issues on various systems.
	The second point, compiling, encompasses a few minor changes to get SysV init to
	 build properly on GNU Hurd, systems without certain GNU assumptions, and systems
	 running the latest glibc library (2.36 at time of writing).
    3.04
	This release contains one minor fix which allows the bootlogd code to properly
	 compile on Debian's GNU Hurd branch.
    3.03
	This release includes two minor changes. One is fixing a typo in the init manual
	 page (init.8). this fix was offered by Mark hindley.
	Mark, and a few other people, also pointed out that a fix in 3.02 for bootlogd
	 introduced reliance on a defined PATH_MAX constant. This is used elsewhere in
	 the code, but is not explicitly defined in bootlogd, which caused bootlogd to
	 not build properly on GNU Hurd and musl C systems. This has been fixed.
    3.02
	    Added q and Q flags to synopsis in shutdown manual page.
	    Applied fixes for markup and spacing in manual pages.
	     Patch provided by Mario Blattermann.
	    Added translation framework (po4a) from Mario Blttermann.
	    Added Makefile for man/ directory. Will handle translations
	     and substitutions.
	    Applied new translations for multiple languages from Mario Blattermann.
	    Added ability to use "@" symbol in command named in the inittab file. This
	     treats commands as literal and does not launch a shell to interpret them.
	    Updated inittab manual page to include overview of symbols which trigger
	     a shell interpretor and how to disable them using the @ symbol.
	    Introduced change which adds error checking in bootlogd when performing
	     chdir(). - Provided by Alexander Vickberg
	    Add check for console using TIOCGDEV on Linux systems in bootlogd to
	     make finding console more robust. - Provided by Alexander Vickberg
    3.01
	    Default to showing processes in the uninterruptable state (D).
	     The -z flag no longer affects whether processes in D state are shown.
	     The -z flag does still toggle whether zombie (Z) processes are shown.
	    Removed unnecessary check which is always true from init tab parsing.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:17:23 +00:00
Arne Fitzenreiter
64d0f1a074 grub: fix mkimage on riscv64 and fix cdrom
the riscv64 image needs more than 1.44MB

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:16:24 +00:00
Arne Fitzenreiter
e275a07b67 kernel: update to 6.1.56
this also builds the dtb files on riscv64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:13:02 +00:00
Michael Tremer
aabdf04299 Merge branch 'master' into next 2023-10-04 12:58:12 +00:00
Michael Tremer
b9215da1ed glibc: Import patches from upstream
This patch imports the latest patches from the 2.38 branch:

  https://git.ipfire.org/?p=thirdparty/glibc.git;a=shortlog;h=refs/heads/release/2.38/master

This includes a fix for a buffer overflow in the tunables code
(CVE-2023-4911) as well as  CVE-2023-4806 and CVE-2023-5156.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-04 12:54:17 +00:00
Adolf Belka
01ed9ff321 urlfilterctrl: Fix bug#10649 - add option to remove urlfilter from fcron directories
- Currently if the urlfilter update is enabled then autoupdate.pl is renamed urlfilter and
   added into either the daily, weekly or monthly fcron directoiries. If the update is
   disabled then the urlfilter update script stays in the directory and is not removed.
- This patch adds in the option of remove to the urlfilterctrl program. The first part
   of the urlfilterctrl.c code removes any existing symlinks so all that needs to be done
   for the remove option is to not add any symlinks to the fcron directories.
- Confirmed in a vm testbed that the current approach leaves the symlink in place. Installed
   the changes from this and the previous patch and confirmed that when the url update is
   disabled the symlink is removed.

Fixes: Bug#10649
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-28 09:39:26 +00:00
Adolf Belka
ef320681e9 procps: Update to version v4.0.4
- Update from version v4.0.3 to v4.0.4
- Update of rootfile
- Removal of patch to fix build failures with gettext-0.22 as this has been incorporated
   into the source tarball.
- Changelog
    procps-ng-4.0.4
	  * library (API & ABI unchanged)
	    increment revision: 0:2:0
	    tolerates all potential 'cpuinfo' formats              issue #272
	    restore the proper main thread tics valuations         issue #280
	    Remove myself from proc count                          merge #193
	    Refactor the escape code                               Debian #1035649
	  * free: -L one line output                               issue #156
	  * pgrep: Use only --signal option for signal             Debian #1031765
	  * pgrep: suppress >15 warning if using regex             Debian #1037450
	  * pidof: Add -t option to show threads                   merge #190
	  * pmap: Reset totals between processes                   issue #298
	  * ps: fixed missing or corrupted fields with -m option   Debian #1036631, issue #279
	  * ps: Fix buffer overflow in -C option CVE-2023-4016     Debian #1042887, issue #297
	  * ps: Add --signames to show signal names in masks       merge #98
	  * sysctl: -N show names                                  merge #198, RH #2222056
	  * tests: dont compare floats with ==                     issue #271
	  * tests: skips tests if maps missing                     merge #197, Gentoo #583036
	  * top: bad command line arguments yield EXIT_FAILURE     issue #273
	  * top: avoids keystroke induced '%Cpu' distortions
	  * top: includes VM (guest) tics in 'system' overhead     issue #274
	  * top: includes VM (guest) tics with '!' toggle          merge #179
	  * top: lessen summary cpu distortions on first display   merge #180
	  * top: better backspace handling wtth line edits         issue #278
	  * vmstat: Print guest time in non-wide mode
	  * w: Fix musl UT_HOSTSIZE issue
	  * watch: Add color support at compile time               issue #296

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-12 16:18:08 +00:00
Adolf Belka
99446eac45 udev: Apply patches to update to version 251 and add dummies for current tags
- eudev-3.2.12 has udev version 243 and this causes the build of libgudev to fail as
   it requires a newer version of udev.
- Just changing the version in eudev from 243 to 251 is insufficient as libgudev also
   expects to see current tags which have been introduced in a more recent version of
   systemd udev.
- Two patches applied from the eudev github issue #249 covering this problem.
- With the two patches applied libgudev built without any problems.
- Update to rootfile not required.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-12 16:06:26 +00:00
Jonatan Schlag
6361fa73c6 network startup: Always cleanup before red gets started
There is no sense in doing this only in /etc/init.d/network
and not in /etc/init.d/networking/red

This files should be always deleted before a startup

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-05 15:15:53 +00:00
Jonatan Schlag
f2e90a6e0e network scripts: remove check for AUTOCONNECT
This setting is also old (2007) and cannot be set via the webinterface
anymore. So why checking for something, which can only be true.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-05 15:15:53 +00:00
Jonatan Schlag
100cd24a17 network initscripts: Remove code for old zone scheme
A long time ago (2007) there were more config types possible then 1, 2, 3
and 4. As our installer currently only accepts config type out of the set
1, 2, 3 and 4 we do not need to check if our CONFIG_TYPE is in this set.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-05 15:15:53 +00:00
Jonatan Schlag
8ae238a588 Use bash as shebang in network initscripts
/bin/sh is a symlink to /bin/bash on ipfire systems. Using /bin/sh in
the scripts as shebang hurts in two ways:

1. We use features which do not work with sh as shell. This is not
   really a problem but if we rely on features of a real bash we can
   state this clearly.
2. The syntay highlighting in vim does not work without a correct
   shebang. As I want and need correct syntax highlighting I propose to
   change the shebang.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-05 15:15:53 +00:00
Adolf Belka
b2c4ea1cc2 hwdata: Update pci.ids to version 2023-08-12 and usb.ids to version 2023-08-24
- Update pci.ids from version 2023-01-18 to 2023-08-12
- Update usb.ids from version 2023-01-16 to 2023-08-24
- Update of rootfile not required
- No changelog available.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-09-05 15:15:53 +00:00
Adolf Belka
cce6aa9e28 traceroute: Update to version 2.1.2
- Update from version 2.1.0 to 2.1.2
- Update of rootfile not required.
- Updated ipfire traceroute patch.
- Changelog
    2.1.2
	*  Fix unprivileged ICMP tracerouting with Linux kernel >= 6.1
	   (Eric Dumazet, SF bug #14)
    2.1.1
	*  Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4.
	   There are no ipv4-mapped addresses in the real network which we
	   operate on, so use just ipv4 in such cases, but allow users
	   to specify it this way for convenience.
	*  Return back more robast poll(2) loop handling.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-30 16:17:24 +00:00
Adolf Belka
ccf88546a2 openssh: Update to version 9.4p1
- Update from version 9.3p2 to 9.4p1
- Update of rootfile not required.
- The openssh check for zlib version incorrectly identifies version 1.3 as being older
   than the buggy zlib version. This bug was found on the oipenssh github pull request page
   but merged after openssh-9.4p1 was issued. Patch implemented to fix zlib version
   identification. This and the autoconf line can be removed when the next version of
   openssh is released.
- Changelog
    9.4p1
	This release fixes a number of bugs and adds some small features.
	Potentially incompatible changes
		 * This release removes support for older versions of libcrypto.
		   OpenSSH now requires LibreSSL >= 3.1.0 or OpenSSL >= 1.1.1.
		   Note that these versions are already deprecated by their upstream
		   vendors.
		 * ssh-agent(1): PKCS#11 modules must now be specified by their full
		   paths. Previously dlopen(3) could search for them in system
		   library directories.
	New features
		 * ssh(1): allow forwarding Unix Domain sockets via ssh -W.
		 * ssh(1): add support for configuration tags to ssh(1).
		   This adds a ssh_config(5) "Tag" directive and corresponding
		   "Match tag" predicate that may be used to select blocks of
		   configuration similar to the pf.conf(5) keywords of the same
		   name.
		 * ssh(1): add a "match localnetwork" predicate. This allows matching
		   on the addresses of available network interfaces and may be used to
		   vary the effective client configuration based on network location.
		 * ssh(1), sshd(8), ssh-keygen(1): infrastructure support for KRL
		   extensions.  This defines wire formats for optional KRL extensions
		   and implements parsing of the new submessages. No actual extensions
		   are supported at this point.
		 * sshd(8): AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
		   accept two additional %-expansion sequences: %D which expands to
		   the routing domain of the connected session and %C which expands
		   to the addresses and port numbers for the source and destination
		   of the connection.
		 * ssh-keygen(1): increase the default work factor (rounds) for the
		   bcrypt KDF used to derive symmetric encryption keys for passphrase
		   protected key files by 50%.
	Bugfixes
		 * ssh-agent(1): improve isolation between loaded PKCS#11 modules
		   by running separate ssh-pkcs11-helpers for each loaded provider.
		 * ssh(1): make -f (fork after authentication) work correctly with
		   multiplexed connections, including ControlPersist. bz3589 bz3589
		 * ssh(1): make ConnectTimeout apply to multiplexing sockets and not
		   just to network connections.
		 * ssh-agent(1), ssh(1): improve defences against invalid PKCS#11
		   modules being loaded by checking that the requested module
		   contains the required symbol before loading it.
		 * sshd(8): fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
		   appears before it in sshd_config. Since OpenSSH 8.7 the
		   AuthorizedPrincipalsCommand directive was incorrectly ignored in
		   this situation. bz3574
		 * sshd(8), ssh(1), ssh-keygen(1): remove vestigal support for KRL
		   signatures When the KRL format was originally defined, it included
		   support for signing of KRL objects. However, the code to sign KRLs
		   and verify KRL signatues was never completed in OpenSSH. This
		   release removes the partially-implemented code to verify KRLs.
		   All OpenSSH tools now ignore KRL_SECTION_SIGNATURE sections in
		   KRL files.
		 * All: fix a number of memory leaks and unreachable/harmless integer
		   overflows.
		 * ssh-agent(1), ssh(1): don't truncate strings logged from PKCS#11
		   modules; GHPR406
		 * sshd(8), ssh(1): better validate CASignatureAlgorithms in
		   ssh_config and sshd_config. Previously this directive would accept
		   certificate algorithm names, but these were unusable in practice as
		   OpenSSH does not support CA chains. bz3577
		 * ssh(1): make `ssh -Q CASignatureAlgorithms` only list signature
		   algorithms that are valid for CA signing. Previous behaviour was
		   to list all signing algorithms, including certificate algorithms.
		 * ssh-keyscan(1): gracefully handle systems where rlimits or the
		   maximum number of open files is larger than INT_MAX; bz3581
		 * ssh-keygen(1): fix "no comment" not showing on when running
		   `ssh-keygen -l` on multiple keys where one has a comment and other
		   following keys do not. bz3580
		 * scp(1), sftp(1): adjust ftruncate() logic to handle servers that
		   reorder requests. Previously, if the server reordered requests then
		   the resultant file would be erroneously truncated.
		 * ssh(1): don't incorrectly disable hostname canonicalization when
		   CanonicalizeHostname=yes and ProxyJump was expicitly set to
		   "none". bz3567
		 * scp(1): when copying local->remote, check that the source file
		   exists before opening an SFTP connection to the server. Based on
		   GHPR#370

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-29 09:52:01 +00:00
Michael Tremer
8d5a43f00b dhcpcd: Fix buffer overflow at startup
Fixes: #13252 - dhcpcd fails in next
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-25 17:25:23 +00:00
Michael Tremer
d45c4768f9 pakfire: Don't give up mirror search on status code 500
The WWW library seems to report status code 500 for issues like DNS
resolving problems and connection timeouts. In that case, we won't go on
searching for another functioning mirror, which we should.

This patch removes that special break clause.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-25 09:44:38 +00:00
Adolf Belka
0f34d606a1 mpfr: Update to version 4.2.1
- Update from version 4.2.0 to 4.2.1
- Update of rootfile
- Changelog
    4.2.1
	patches 1 to 12 from 4.2.0 have been built in to 4.2.1
	Other bugs fixed in the 4.2 branch for the MPFR 4.2.1 release:
	    The + and space flags were ignored on NaN and Inf. While this was loosely
	     documented as such (without an explicit mention of these flags), the MPFR
	     manual also says that the flags have the same meaning as for the standard
	     printf function. So this was contradictory and regarded as a bug. Behaving
	     like the ISO C standard should give less surprise, and this is probably
	     what is expected (better for alignment purpose). See discussion (only for
	     NaN and the + flag at that time).
	     Corresponding changeset in the 4.2 branch: 3761bee3c.
	    Huge negative exponents can trigger integer overflows in mpfr_strtofr,
	     meaning undefined behavior. Two bugs have been identified: 1, 2. In
	     practice, the consequences may be incorrect results. But for the first bug,
	     it has been seen that a GCC optimization makes it invisible. There are
	     other issues with the code for huge exponents, but it is not clear whether
	     the problematic cases can occur in the context of mpfr_strtofr; such
	     potential bugs are not fixed yet.
	     Corresponding changesets in the 4.2 branch: 261d3852b (tests), 06e7b6bc1
	      (bug fixes).

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-24 13:42:04 +00:00
Michael Tremer
6aa8145d5f Merge branch 'master' into next 2023-08-24 10:12:09 +00:00
Adolf Belka
3dcbb53a21 ppp: Patch to stop CU179 Testing error msg - pppd uses obsolete (PF_INET, SOCK_PACKET)
- This issue was found by Peter Müller in the CU179 Testing evaluation.
- The issue was found to have already been raised and closed on the ppp github issues page.
- Patch for fix downloaded and applied to this submission.
- When ppp-2.5.1 is released then this patch can be removed.
- update of rootfile not required.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-24 10:10:32 +00:00
Adolf Belka
e11fc5273b dhcpcd: Update to version 10.0.2
- Update from version 10.0.1 to 10.0.2
- Update of rootfile not required
- Changelog
    10.0.2
       Major changes listed as:-
	    chore: Link to GitHub for the updated commit log by @frazar in #203
	    Additional DHCP options by @rrobgill in #214
	    risc-v fix vendor error by @Im-0xea in #213
	    compat sync by @tobhe in #226
       Commit list can be seen at
        https://github.com/NetworkConfiguration/dhcpcd/compare/v10.0.1...v10.0.2
        This includes two bug fixes for two situations causing segfaults

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-21 09:23:49 +00:00
Michael Tremer
852324e2aa ipfire-netboot: Fix build with binutils 2.41
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-17 14:07:43 +00:00
Michael Tremer
29b41696bf ffmpeg: Fix build with binutils 2.41
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-17 14:07:42 +00:00
Michael Tremer
d4a8484eb1 mountfs: Remove excessive sync-ing before umount
The system should perform all write operations when sync is called and
only return when the write queues are empty.

There is no additional benefit for calling sync again as the buffers
should be empty. If data is still being lost, then that is a bug in
either the storage device or driver.

As the (re-)boot process is already so slow, I would like to get rid of
any unnecessary delays.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-15 09:48:35 +00:00
Michael Tremer
21d8c56c8a mountfs: Mount ExtraHD filesystems
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-15 09:47:25 +00:00
Peter Müller
311f04e46e squid-asnbl: Update to 0.2.5
This upstream release incorporates the patch added for resolving #13023.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-15 09:27:19 +00:00
Arne Fitzenreiter
cd78363404 Merge remote-tracking branch 'origin/master' into next
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2023-08-12 16:48:54 +02:00
Arne Fitzenreiter
41e3393152 initskript: smt: restore IPFire banner
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2023-08-12 09:58:56 +02:00
Arne Fitzenreiter
f41a54a2ea initskript: smt: disable smt on vulnerable cpu
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2023-08-12 09:11:52 +02:00
Arne Fitzenreiter
285740b926 linux-firmware: update to 20230804
also updated amd_familiy_19h patch which was not in 20230804 yet.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2023-08-11 21:12:45 +02:00
Arne Fitzenreiter
a04ae8c43b gcc: fix build on riscv64
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-10 06:35:11 +00:00
Adolf Belka
0d46ef0ce7 libloc: Update to version 0.9.17
- Update from version 0.9.16 to 0.9.17
- Update of rootfile
- Changelog
    0.9.17
	* The importer is now parsing Geofeeds where available. This helps us to create a
          database with better accuracy for large ISPs or cloud providers.
	* The database writer is trying to compress the database harder: It will now look
          for any duplicate networks and merge neighbouring networks which will reduce the
          size of the database by about half.
	* The importer has been improved so that it runs more efficient SQL queries to
          create the database faster.
	* Temuri Doghonadze contributed a Georgian translation.
	* Hans-Christoph Steiner contributed bash-completion for the location(8) command.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-10 06:34:27 +00:00
Matthias Fischer
692ad21dd0 squid: Update to 6.2
For details see:
https://github.com/squid-cache/squid/commits/v6

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-10 06:33:17 +00:00
Adolf Belka
0803c50f76 red: Fixes bug#13164 adjust pppoe plugin name in red initscript
- This patch goes together with the patch for the ppp update to 2.5.0
- The rp-pppoe.so option is no longer available. There is only the pppoe.so available now

Fixes: Bug#13164
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-07 14:12:55 +00:00
Adolf Belka
27a3ef9834 ppp: Fixes bug#13164 - Update to version 2.5.0
- Update from version 2.4.9 to 2.5.0
   This includes breaking changes for third-party plugins but as far as I can see IPFire
    is not using any third party plugins
- Update of rootfile
- Update of patches and sed commands
   - pcap-int.h and if_pppol2tp.h files have not been in source file since at least 2014
   - Some of the patches required updates as additional lines needing to be patched are
      now present. nThis was related to the O_CLOEXEC & SOCK_CLOEXEC related patches
   - connect-errors file location is now defined by a configure command --with-logfile-dir
- install-etcppp is no longer provided. However the install command in this version still
   has the same files available in /etc/ppp as previously. There is a new file,
   openssl.cnf, which I have commented out. If it is required in future it can always be
   uncommented in future releases.
- Build went without any problems with the updated patches.
- I cannot test this as I don't use ppp, however the original bug reporter has agreed to
   test this out when it is released into Testing unless anyone else is capable of testing
   it.
- Changelog
    What's new in ppp-2.5.0.
	The 2.5.0 release is a major release of pppd which contains breaking
	 changes for third-party plugins, a complete revamp of the build-system
	 and that allows for flexibility of configuring features as needed.
	In Summary:
		* Support for PEAP authentication by Eivind Næss and Rustam Kovhaev
		* Support for loading PKCS12 certificate envelopes
		* Adoption of GNU Autoconf / Automake build environment, by Eivind Næss
		  and others.
		* Support for pkgconfig tool has been added by Eivind Næss.
		* Bunch of fixes and cleanup to PPPoE and IPv6 support by Pali Rohár.
		* Major revision to PPPD's Plugin API by Eivind Næss.
		  - Defines in which describes what features was included in pppd
		  - Functions now prefixed with explicit ppp_* to indicate that
		    pppd functions being called.
		  - Header files were renamed to better align with their features,
		    and now use proper include guards
		  - A pppdconf.h file is supplied to allow third-party modules to use
		    the same feature defines pppd was compiled with.
		  - No extern declarations of internal variable names of pppd,
		    continued use of these extern variables are considered
		    unstable.
		* Lots of internal fixes and cleanups for Radius and PPPoE by Jaco Kroon
		* Dropped IPX support, as Linux has dropped support in version 5.15
		  for this protocol.
		* Many more fixes and cleanups.
		* Pppd is no longer installed setuid-root.
		* New pppd options:
		  - ipv6cp-noremote, ipv6cp-nosend, ipv6cp-use-remotenumber,
		    ipv6-up-script, ipv6-down-script
		  - -v, show-options
		  - usepeerwins, ipcp-no-address, ipcp-no-addresses, nosendip
		* On Linux, any baud rate can be set on a serial port provided the
		  kernel serial driver supports that.
	Note that if you have built and installed previous versions of this
	 package and you want to continue having configuration and TDB files in
	 /etc/ppp, you will need to use the --sysconfdir option to ./configure.
	For a list of the changes made during the 2.4 series releases of this
	 package, see the Changes-2.4 file.
	Compression methods.
		This package supports two packet compression methods: Deflate and
		 BSD-Compress.  Other compression methods which are in common use
		 include Predictor, LZS, and MPPC.  These methods are not supported for
		 two reasons - they are patent-encumbered, and they cause some packets
		 to expand slightly, which pppd doesn't currently allow for.
		 BSD-Compress and Deflate (which uses the same algorithm as gzip) don't
		 ever expand packets.

Fixes: bug#13164
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-07 14:10:42 +00:00
Adolf Belka
e9c5d591e5 openldap: Update to version 2.6.5
- Update from version 2.6.1 to 2.6.5
- Update of rootfile not required
- Update of patch script from LFS
- Changelog
    2.6.5 Release (2023/07/10)
	Fixed libldap handling of TCP KEEPALIVE options (ITS#10015)
	Fixed libldap with async connections (ITS#10023)
	Fixed libldap openssl TLSv1.3 cipher suite handling (ITS#10035)
	Fixed slapd callback handling with overlays that do extended operations (ITS#9990)
	Fixed slapd conversion of pcache configurations (ITS#10031)
	Fixed slapd cn=config modification handling with abandon (ITS#10045)
	Fixed slapd-mdb online indexer termination and cleanup (ITS#9993)
	Fixed slapd-mdb online indexer when interrupted (ITS#10047)
	Fixed slapd-monitor connection cleanup (ITS#10042)
	Fixed slapo-constraint handling of push replication (ITS#9953)
	Fixed slapo-dynlist filter evaluation efficiency (ITS#10041)
	Fixed slapo-pcache handling of invalid schema (ITS#10032)
	Fixed slapo-ppolicy handling of push replication (ITS#9953)
	Fixed slapo-ppolicy handling of pwdMinDelay (ITS#10028)
	Fixed slapo-syncprov abandon handling (ITS#10016)
	Fixed slapo-translucent handling of invalid schema (ITS#10032)
	Fixed slapo-unique handling of push replication (ITS#9953)
	Fixed slapo-variant to improve regex handling (ITS#10048)
	Build Environment
		Fixed compatibility with stricter C99 compilers (ITS#10011)
		Keep .pc files during make clean (ITS#9989)
	Contrib
		Fixed slapo-variant handling of push replication (ITS#9953)
	Minor Cleanup
		ITS#9855
		ITS#9995
		ITS#9996
		ITS#9997
		ITS#9998
		ITS#9999
		ITS#10000
		ITS#10003
		ITS#10004
		ITS#10033
		ITS#10037
		ITS#10039
		ITS#10046
		ITS#10063
    2.6.4 Release (2023/02/08)
	Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618)
	Fixed ldapsearch memory leak with paged results (ITS#9860)
	Fixed libldap ldif_open_urlto check for failure (ITS#9904)
	Fixed libldap ldap_url_parsehosts check for failure (ITS#9904)
	Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955)
	Fixed lloadd memory leaks (ITS#9907)
	Fixed lloadd shutdown code to protect memory correctly (ITS#9913)
	Fixed lloadd race in epoch.c (ITS#9947)
	Fixed lloadd potential deadlock with cn=monitor (ITS#9951)
	Fixed lloadd to keep listener base around when not active (ITS#9984)
	Fixed lloadd object reclamation sequencing (ITS#9983)
	Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035)
	Fixed slapd free of redundant cmdline option (ITS#9912)
	Fixed slapd transactions extended operations cleanup after write (ITS#9892)
	Fixed slapd deadlock with replicated cn=config (ITS#9930,ITS#8102)
	Fixed slapd connection close logic (ITS#9991)
	Fixed slapd bconfig locking of cn=config entries (ITS#9045)
	Fixed slapd-mdb max number of index databases to 256 (ITS#9895)
	Fixed slapd-mdb to always release entries from ADD operations (ITS#9942)
	Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940)
	Fixed slapd-monitor memory leaks with lloadd (ITS#9906)
	Fixed slapd-monitor to free remembered cookies (ITS#9339)
	Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880)
	Fixed slapo-deref memory leak (ITS#9924)
	Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897)
	Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929)
	Fixed slapo-dynlist to mark internal searches as such (ITS#9960)
	Fixed slapo-pcache crash in consistency_check (ITS#9966)
	Fixed slapo-remoteauth memory leaks (ITS#9438)
	Fixed slapo-rwm memory leaks (ITS#9817)
	Build Environment
		Fixed ancient DOS related ifdef checks (ITS#9925)
		Fixed build process to not use gmake specific features (ITS#9894)
		Fixed source tree to remove symlinks (ITS#9926)
		Fixed slapo-otp testdir creation (ITS#9437)
		Fixed slapd-tester memory leak (ITS#9908)
		Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901)
		Fixed usage of bashism (ITS#9900)
		Fixed test suite portability (ITS#9931)
	Documentation
		Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind (ITS#9976)
		Fixed slapo-asyncmeta(5) to clarify scheduling for target connections
                 (ITS#9941)
		Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957)
		Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915)
	Minor cleanup
		ITS#9935
		ITS#9336
		ITS#9337
		ITS#9985
    2.6.3 Release (2022/07/14)
	Fixed libldap to check for NULL ld (ITS#9157)
	Fixed libldap memory leaks (ITS#9876)
	Fixed lloadd to correctly tag Notice of Disconnection (ITS#9856)
	Fixed slapd kqueue support (ITS#9847)
	Fixed slapd delta-sync DN leak on ADD ops (ITS#9866)
	Fixed slapd replication with back-glue (ITS#9868)
	Fixed slapd lastbind replication with chaining (ITS#9863)
	Fixed slapd-ldap to correctly set authzid (ITS#9863)
	Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165)
	Fixed slapd-mdb indexer task with replicated config (ITS#9858)
	Fixed slapo-accesslog onetime memory leak (ITS#9864)
	Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871)
	Fixed slapo-rwm to handle escaping special characters (ITS#9817)
	Fixed slapo-syncprov memory leaks (ITS#9867)
	Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823)
	Fixed slapo-unique to not release NULL entry (ITS#8245)
	Build Environment
		Added slapd-watcher -c contextDN option (ITS#9865)
		Fixed librewrite declaration of calloc (ITS#9841)
		Fixed parallel builds (ITS#9840)
		Fixed test020 to skip back-wt (ITS#9859)
		Fixed slapd-watcher SID handling with single URI (ITS#9850)
		Fixed test043 with workaround for ITS#9878
	Contrib
		Added slapo-emptyds contrib module (ITS#8882)
		Added slapo-ciboolean contrib module (ITS#9855)
		Fixed slapo-autogroup backwards compat (ITS#9020)
		Update ppm module to the 2.2 release (ITS#9846)
	Documentation
		Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions
                 (ITS#9824)
		Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter
                 (ITS#9872)
    2.6.2 Release (2022/05/04)
	Added libldap support for OpenSSL 3.0 (ITS#9436)
	Added slapd support for OpenSSL 3.0 (ITS#9436)
	Fixed ldapdelete to prune LDAP subentries (ITS#9737)
	Fixed libldap to drop connection when non-LDAP data is received (ITS#9803)
	Fixed libldap to allow newlines at end of included file (ITS#9811)
	Fixed slapd slaptest conversion of olcLastBind (ITS#9808)
	Fixed slapd to correctly init global_host earlier (ITS#9787)
	Fixed slapd bconfig locking for cn=config replication (ITS#9584)
	Fixed slapd usage of thread local counters (ITS#9789)
	Fixed slapd to clear runqueue task correctly (ITS#9785)
	Fixed slapd idletimeout handling (ITS#9820)
	Fixed slapd syncrepl handling of new sessions (ITS#9584)
	Fixed slapd to clear connections on bind (ITS#9799)
	Fixed slapd to correctly advance connections index (ITS#9831)
	Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801)
	Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802)
	Fixed slapd-ldap memory leak in keepalive setting (ITS#9802)
	Fixed slapd-meta SEGV on config rewrite (ITS#9802)
	Fixed slapd-meta ordering on config rewrite (ITS#9802)
	Fixed slapd-meta memory leak in keepalive setting (ITS#9802)
	Fixed slapd-monitor SEGV on shutdown (ITS#9809)
	Fixed slapd-monitor crash when hitting sizelimit (ITS#9832)
	Fixed slapd-sql to properly escape filter value (ITS#9815)
	Added slapo-autoca support for OpenSSL 3.0 (ITS#9436)
	Added slapo-otp support for OpenSSL 3.0 (ITS#9436)
	Fixed slapo-dynlist dynamic group regression (ITS#9825)
	Fixed slapo-pcache SEGV on shutdown (ITS#9809)
	Fixed slapo-ppolicy operation handling to be consistent (ITS#9794)
	Fixed slapo-translucent to correctly duplicate substring filters (ITS#9818)
	Build Environment
		Add ability to override default compile time paths (ITS#9675)
		Fix compilation with certain versions of gcc (ITS#9790)
		Fix compilation with openssl exclusions (ITS#9791)
		Fix warnings from make jobserver (ITS#9788)
	Contrib
		Update ppm module to the 2.1 release (ITS#9814)
	Documentation
		admin26 Document new lloadd features (ITS#9780)
		Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit
                 documentation (ITS#9804)
		Fixed slapd-sock(5) to clarify "sockresps result" behavior (ITS#8255)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-07 09:19:13 +00:00
Adolf Belka
63fb1beb81 procps: Add patch to fix errors that prevent build with gettext-0.22
- Gettext earlier than 0.21 would still build when it found errors in language files etc.
   With gettext-0.22 if it finds any errors it now stops.
- There were two lines in the french po file in procps that had erros in them. procps have
   raised a commit to fix those. The patch included here carries out that commit.
- Update of rootfile not required.
- This patch will not be needed when the next update of procps occurs.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-08-02 09:17:48 +00:00
Michael Tremer
6ed00db36f Merge branch 'master' into next 2023-08-02 09:11:40 +00:00
Michael Tremer
91443f9234 udev: Drop hwrng rules
This is another fragment of rngd - the gift that keeps giving.

The udev rules file contains a lot of stuff for a prototype which never
went into production. So, that can be dropped.

It would have been left with one rule that starts rngd whenever a HWRNG
is being found. That is however no longer needed as rngd is being
started in the init process. We no longer need to initialize it as early
as possible to seed the kernel's PRNG.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-31 13:47:31 +00:00
Adolf Belka
1f26a78259 mpfr: Update to version 4.2.0p12
- Update from version 4.2.0p9 to 4.2.0p12
- Update of rootfile not required
- Changelog - additional patches from 10 to 12 over previous update
    10 - GCC 12 emits a spurious "may be used uninitialized" warning on tests/tfpif.c
         with -O1, and GCC 13 has the same issue also with -O2 (GCC bug 106155). This can
         make some test scripts fail for the developers. The gcc-pr106155-workaround
         patch provides a workaround for this bug in GCC.
         Corresponding changeset in the 4.2 branch: c0031f1af.
    11 - The mpfr_inp_str function does not handle the '\0' character correctly when it
         is not a whitespace character (which is almost always the case in practice, or
         really always the case). For instance, if the word is the sequence
         { '1', '\0', '2' }, the string "1" is passed to mpfr_set_str because '\0' is
         regarded as a terminating null character, and one gets a valid number (1) while
         '\0' in a word is necessarily invalid. This is fixed by the inp_str-nullchar
         patch. The testcase in the repository cannot be provided in the patch because of
         the null character in one of the files.
         Corresponding changeset in the 4.2 branch: 6a68387b2.
    12 - When '\0' is a whitespace character, i.e. when isspace(0) is true in the current
         locale (as allowed by ISO C for non-"C" locales), the mpfr_strtofr function
         regards a '\0' in the leading whitespace sequence as a whitespace. This is
         incorrect, since from the definition of a string, the first '\0' is the
         terminating null character (before the notion of whitespace is involved). In
         such locales, this is a vulnerability, because characters after the terminating
         null character are read to determine the result; however, such locales are rare
         or nonexistent (Mutt's lib.h suggests that some systems have such locales, but
         this was in 1998). This is fixed by the strtofr-nullchar patch.
         Corresponding changeset in the 4.2 branch: 964fbaa31.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-31 09:20:09 +00:00
Michael Tremer
ef7ae3fd1d Merge branch 'master' into next 2023-07-28 16:57:15 +00:00
Arne Fitzenreiter
0bb82a95dd initskripts: remove buggy remount at halt and reboot
mount -f does nothing and also the sync calls should do nothing
on a already ro mounted filesystem.

fixes: #13195

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-28 16:06:54 +00:00
Adolf Belka
85c32fb394 ebtables: Update to version 2.0.11
- Update from version 2.0.10-4 (Sep 2014) to 2.0.11 (Dec 2019)
- Update of rootfile
- Deletion of patch to prevent installing in usr/local as new tarball now has a ./configure
   file that enables setting prefix to /usr and sysconfdir to /etc

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Michael Tremer
5c4faba67b linux-firmware: Fix AMD microcode updates for Zenbleed
https://lock.cmpxchg8b.com/zenbleed.html

Fixes: CVE-2023-20593
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-25 11:15:45 +00:00
Arne Fitzenreiter
f2d5cb7c99 kernel: update to 6.1.39
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-21 09:34:12 +00:00
Michael Tremer
607d3a26d8 fireinfo: Fix SEGV in detect_hypervisor()
Fixes: #13155 - _fireinfo.detect_hypervisor() rises Segmentation fault
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-13 14:25:22 +00:00
Jon Murphy
525e575e04 pmacct: fix bug 13159
- changes `interface` to `pcap_interface` in pmacct.conf file.
- thank you to @iptom for finding and reporting the issue and
   to many others for pitching in and helping debug!

Signed-off-by: Jon Murphy <jon.murphy@ipfire.org>
2023-07-13 14:22:04 +00:00