Commit Graph

9599 Commits

Author SHA1 Message Date
Adolf Belka
4e52721aa2 harfbuzz: Update to version 3.4.0
- Update from 3.1.2 to 3.4.0
- Update of rootfile
- Changelog
	3.4.0
	    Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY. (Behdad Esfahbod)
	    Arabic Mark Transient Reordering Algorithm have been updated to revision 6. (Khaled Hosny)
	    ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag. (Alexis King)
	    It is now possible to get at once all math kerning values for a given glyph at a given corner. (Alexis King)
	    Fix locale_t portability issues on systems the typedef’s it to a void pointer. (Behdad Esfahbod)
	  New API:
	    +HB_BUFFER_FLAG_VERIFY
	    +HB_OT_TAG_MATH_SCRIPT
	    +HB_SCRIPT_MATH
	    +hb_ot_math_kern_entry_t
	    +hb_ot_math_get_glyph_kernings
	  Deprecated API
	    +HB_OT_MATH_SCRIPT
	3.3.2
	  Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic. (Behdad Esfahbod)
	3.3.1
	  Fix heap-use-after-free in harfbuzz-subset introduced in previous release. (Garret Rieger)
	3.3.0
	    Improved documentation. (Matthias Clasen)
	    Internal code cleanup, using C++ standard library more. (Behdad Esfahbod)
	    The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance. (Behdad Esfahbod)
	    Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts. (Behdad Esfahbod)
	    Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation. (Matthias Clasen)
	    When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs. (Behdad Esfahbod)
	    Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details. (Behdad Esfahbod)
	    Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags. (David Corbett)
	    New API:
	    +HB_GLYPH_FLAG_UNSAFE_TO_CONCAT
	    +hb_segment_properties_overlay()
	    +hb_buffer_create_similar()
	    +hb_font_set_synthetic_slant()
	    +hb_font_get_synthetic_slant()
	    +hb_font_get_var_coords_design()
	3.2.0
	  harfbuzz library improvements:
	    Fixed shaping of Apple Color Emoji flags in right-to-left context. (Behdad Esfahbod)
	    Fixed positioning of CFF fonts in HB_TINY profile. (Behdad Esfahbod)
	    OpenType 1.9 language tags update. (David Corbett)
	    Add HB_NO_VERTICAL config option. (Behdad Esfahbod)
	    Add HB_CONFIG_OVERRIDE_H for easier configuration. (Behdad Esfahbod)
	  harfbuzz-subset library improvements:
	    Improved packing of cmap, loca, and Ligature tables. (Garret Rieger)
	    Significantly improved overflow-resolution strategy in the repacker. (Garret Rieger)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:38:57 +00:00
Michael Tremer
a6faddb31d core166: Ship wireless-regdb
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:38:39 +00:00
Michael Tremer
b22cec64d9 core166: Ship SQLite
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:38:04 +00:00
Michael Tremer
6410997d2a core166: Ship OpenSSH
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:37:23 +00:00
Michael Tremer
64a2131815 Start Core Update 166
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:34:48 +00:00
Michael Tremer
d29b3c77ac Sync next with master 2022-03-10 10:29:57 +00:00
Michael Tremer
eb41bf304e samba: Fix rootfile on x86_64
The web UI menu entry, samba.cgi and the control binary were lost in
61d7aaa3ef.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-10 10:25:19 +00:00
Stefan Schantl
47b2640d37 general-functions.pl: Do not die if no red interface could be determined.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:46:19 +00:00
Stefan Schantl
74659290e9 rules.pl: Do not create HOSTILE rules if no red dev is available.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:45:59 +00:00
Stefan Schantl
870c223e0f rules.pl: Adjust code to use sets generated by libloc 0.9.11
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:43:17 +00:00
Stefan Schantl
cd3e5923fe libloc: Update to 0.9.11
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-09 15:41:49 +00:00
Michael Tremer
7f8bb55a60 core165: Ship hyperscan
This package is being built with a different configuration.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-08 10:42:00 +00:00
Michael Tremer
b69659af02 core164: Ship backup exclude file
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:53:09 +00:00
Michael Tremer
c7e0d73e7c backup: Make include/exclude files relative
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:23 +00:00
Michael Tremer
3f8e70f6b3 backup: Don't restore excluded files
Sometimes, we restore a backup that has been created earlier before
exclude files have been changed. To avoid overwriting those files, we
will consider the exlude list upon restore.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:20 +00:00
Michael Tremer
ca1fdb6954 backup: Exclude oinkmaster.conf
This file is a system configuration file and does not contain any
configruation from the user.

Since it can be overwritten in a backup and restored to an older state,
this can cause problems such as #12788.

Fixes: #12788
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:17 +00:00
Michael Tremer
fc717041c4 backup: Abort when the backup could not be extracted
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:51:14 +00:00
Stefan Schantl
dcacf03e80 ids-functions.pl: Do not create an empty ignored settings file.
The file will be created by the WUI, when adding the first host.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:50:34 +00:00
Stefan Schantl
da3611b276 ids-functions.pl: Do not try to chown files while extracting them.
We are almost running as an unprivileged user and therfore have not
the permissions to do this.

This will save us a lot of confusion error messages.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:49:37 +00:00
Peter Müller
6fe4eb6094 Core Update 165: Rename squid-accounting add-on to proxy-accounting
https://lists.ipfire.org/pipermail/development/2022-February/012482.html

The second version of this patch omits bogus directives for restarting a
service, which proxy-accounting is not.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Cc: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:47:23 +00:00
Michael Tremer
ea04468d07 core165: Ship ids.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:46:34 +00:00
Michael Tremer
7b82d83d7e core165: Ship optionsfw.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 18:45:58 +00:00
Stefan Schantl
9106bfca42 ids-functions.pl: Merge same named rulefiles during extract.
In case a rulestarball contains several same-named rulefiles
they have been overwritten each time and so only contained the content
from the last extracted one.

Now the content of those files will be merged by appending the content
to the first extracted one for each time.

Fixes #12792.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-07 17:04:15 +00:00
Stefan Schantl
cad8657532 ids-functions.pl: Do not create an empty ignored settings file.
The file will be created by the WUI, when adding the first host.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 19:28:24 +00:00
Stefan Schantl
2b12a010d7 ids-functions.pl: Merge same named rulefiles during extract.
In case a rulestarball contains several same-named rulefiles
they have been overwritten each time and so only contained the content
from the last extracted one.

Now the content of those files will be merged by appending the content
to the first extracted one for each time.

Fixes #12792.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 19:28:08 +00:00
Peter Müller
ade2424f6b Revert "Core Update 165: Ship update-ids-ruleset"
update-ids-rulesets is relevant for Core Update 164, not Core Update 165.

This reverts commit 9713023546.
2022-03-05 14:35:09 +00:00
Peter Müller
4003479449 Core Update 164: Ship update-ids-rulesets
@Michael: Please cherry-pick this one into "master" as well.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-05 14:34:39 +00:00
Stefan Schantl
96e2e870aa firewall-lib.pl: Remove prefix when dealing with ipset sets.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 14:32:58 +00:00
Stefan Schantl
5841800969 rules.pl: Autodetect ipset db file to restore.
This commit allows the ipset_restore() function to auto-detect
which set file needs to be restored.

Currently it is limitated to country codes only, because we currently
does not support anything else.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 14:32:44 +00:00
Stefan Schantl
7b529f5417 firewall: Move dropping hostile networks to rules.pl.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-05 14:31:55 +00:00
Stefan Schantl
2801213dcc rules.pl: Allow dynamic destory of loaded but unused ipset sets.
Instead of stupidly destroying all ipsets, we now grab the already loaded sets
and compare them with the loaded sets during runtime of the script.

So we are now able to determine which sets are not longer required and
safely can destroy (unload) at a later time.

This saves us from taking care about dropping/flushing rules which are
based on ipset before we can destroy them - because only unused sets are
affected.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Inspired-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-05 14:31:51 +00:00
Peter Müller
65808f8478 update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Please note that the certdata.txt file only appears to drop MD5
checksums in favour of SHA256, so there is no need in shipping
ca-certificates with the next Core Update.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-05 14:31:02 +00:00
Peter Müller
9713023546 Core Update 165: Ship update-ids-ruleset
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-05 14:30:10 +00:00
Stefan Schantl
8353e28ad2 ids-functions.pl: Do not try to chown files while extracting them.
We are almost running as an unprivileged user and therfore have not
the permissions to do this.

This will save us a lot of confusion error messages.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2022-03-05 14:28:36 +00:00
Michael Tremer
419153571b backup: Make include/exclude files relative
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:41:30 +00:00
Michael Tremer
e5ad6e2ab1 backup: Don't restore excluded files
Sometimes, we restore a backup that has been created earlier before
exclude files have been changed. To avoid overwriting those files, we
will consider the exlude list upon restore.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:37:00 +00:00
Michael Tremer
026935a137 backup: Exclude oinkmaster.conf
This file is a system configuration file and does not contain any
configruation from the user.

Since it can be overwritten in a backup and restored to an older state,
this can cause problems such as #12788.

Fixes: #12788
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:27:01 +00:00
Michael Tremer
270d572504 backup: Abort when the backup could not be extracted
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-04 10:19:14 +00:00
Michael Tremer
a735dad621 python3-cffi: Fix armv6l rootfile
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-03-02 13:37:28 +00:00
Peter Müller
d739da6f47 python3-cffi: Add 32 bit ARM rootfile again due to "gnueabi" != "gnu"
My fault, again. :-/

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-03-01 15:25:01 +00:00
Peter Müller
70e23c18a4 python3-yaml: Drop unnecessary armv6l rootfile
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-28 20:18:58 +00:00
Peter Müller
67a38b30b0 Merge branch 'master' into next 2022-02-28 20:16:38 +00:00
Arne Fitzenreiter
6e2c8f4818 suricata: drop unsupported JA3 rule provider
our current suricata version not support JA3 based rules so
this drop the providers from the list.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2022-02-26 14:19:45 +00:00
Peter Müller
f6ec32737f borgbackup: Fix rootfile on 32 bit ARM
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-26 12:16:39 +00:00
Peter Müller
d03ee3218f Python3: Fix rootfile for 32 bit ARM again
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-25 14:04:06 +00:00
Peter Müller
82674728e3 Core Update 165: Ship vpnmain.cgi
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-23 15:54:13 +00:00
Peter Müller
2598706f23 Core Update 165: Ship dhcpcd-related changes
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-23 15:51:33 +00:00
Michael Tremer
9c68992498 dhcpcd: Remove old MTU setting script
This is being replaced by adding the MTU option to any routes that
dhcpcd installs.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-23 15:46:45 +00:00
Peter Müller
5de5bec3f4 Python3: Attempt to fix rootfile on 32 bit ARM
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-22 20:18:27 +00:00
Peter Müller
61d2d36f6c python3-cffi: Fix rootfile more elegant on ARM
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-02-22 20:13:44 +00:00