Commit Graph

18886 Commits

Author SHA1 Message Date
Leo-Andres Hofmann
64db1faf67 manualpages: Add path and file extension to the configuration
This allows to correctly assign an URL to a file without relying
on unique base names.
A custom read function is required because General::readhash()
doesn't allow paths as hash keys. Modifying the existing functions
could affect other CGIs and was therefore dismissed.

Fixes: #12806

Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
2022-06-04 09:23:42 +00:00
Jon Murphy
5f8a1acfe9 make.sh-usage: Ship changes to make files
In make.sh-usage document:
 - updated with descriptions for various commands
 - removed descriptions for old commands

In make.sh script:
 - updated make.sh usage line "Usage: $0 [OPTIONS] {build|check-manualpages|..."
 - removed make.sh clear screen commands in build area and toolchain area

Signed-off-by: Jon Murphy <jon.murphy@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-06-04 08:39:17 +00:00
Peter Müller
9152d4e453 Core Update 169: Ship and restart Unbound
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-06-04 08:38:41 +00:00
Matthias Fischer
ba4f3d9a23 unbound: Update to 1.16.0
For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-16-0

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-06-04 08:37:02 +00:00
Michael Tremer
0585ca7cfd cdrom: Drop menu option for HDT
The Hardware Detection Tool does not work and I do not think it is worth
to investigate. It is an ancient piece of software which does not work
on EFI systems which are becoming more and more common.

Since this has presumably been broken for a long time which nobody has
reported I assume that nobody is using it. There are indeed lots better
live CDs out there with much better diagnostic tools.

Fixes: #12870
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
2022-06-04 08:36:58 +00:00
Matthias Fischer
63243696ac tmux: Update to 3.3
For details see:
https://raw.githubusercontent.com/tmux/tmux/3.3/CHANGES

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-06-04 08:36:55 +00:00
Peter Müller
b2b0bb7d82 Merge branch 'next' into temp-c169-development 2022-06-04 08:36:10 +00:00
Peter Müller
de5896985c intel-microcode: Update rootfile
Reported-by: Jon Murphy <jcmurphy26@gmail.com>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-31 17:21:54 +00:00
Peter Müller
4f4b7fbc13 Update contributor list
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 20:00:53 +00:00
Peter Müller
8065ec2108 Core Update 169: Ship libxslt
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:46:45 +00:00
Adolf Belka
9bee4ce915 libxslt: Update to version 1.1.35
- Update from version 1.1.34 to 1.1.35
- Update of rootfile
- Changelog
   v1.1.35: Feb 16 2022:
     - Security:
	  [CVE-2021-30560] Fix use-after-free in xsltApplyTemplates
	  Fix memory leak in xsltDocumentElem (David King)
	  Fix memory leak in xsltCompileIdKeyPattern (David King)
	  Fix double-free with stylesheets containing entity nodes
     - Fixed regressions:
	  Fix performance regression with predicates in patterns
	  Fix regression in xsltComputeSortResult
     - Bug fixes:
	  Fix conflict resolution for templates with same priority
	  Fix xsl:number generating invalid UTF-8
	  Support attribute value templates in xsl:sort lang attributes
	  Don't pass first <xsl:sort> in <xsl:apply-templates> twice
	  Fix quadratic runtime with text and <xsl:message>
	  Don't allow empty EXSLT durations
     - Improvements:
	  Add xsltproc --huge Argument via libxml XML_PARSE_HUGE (William N. Braswell, Jr.)
     - Tests, code quality, fuzzing:
	  Remove .travis.yml
	  Fix some misleading indentation (David King)
	  Use actual types for templates in struct _xsltStylesheet
	  Add CI for CMake on MSVC (Markus Rickert)
	  Check for null pointer before calling freelocale
	  Add CI test for Python 3
	  Don't set maxDepth in XPath contexts
	  Transfer XPath limits to XPtr context
	  Stop using maxParserDepth XPath limit
	  Make long-to-double cast explicit in date.c
	  Disable LeakSanitizer
	  Run clang CI tests with -Wimplicit-int-conversion
	  Fix implicit-int-conversion warning in exslt/crypto.c
	  Fix clang -Wimplicit-int-conversion warning (David Kilzer)
	  Fix clang -Wconditional-uninitialized warning in libxslt/numbers.c (David Kilzer)
	  Fix -Wshadow warnings in libexslt/dynamic.c (David Kilzer)
	  Also search parent dir for source XML when fuzzing
     - Build system, portability:
	  Add CMake build files (Markus Rickert)
	  Initial support for Python 3 (Suleyman Poyraz)
	  Call ANSI versions of WinAPI functions explicitly
	  Remove redundant flags from pkg-config files
	  Suppress automake warning in tests/XSLTMark
	  Fix linking libexslt dynamic library when using MinGW (Vadim Zeitlin)
	  Added platform specific path separators (Dmitriy Korovkin)
	  win32: allow passing *FLAGS on command line
	  Fix export of xsltExtMarker on Windows (David Kilzer)
	  Fix redundant includes already in libexslt.h (David Kilzer)
	  Minor fixes to configure.js
	  Fix variable syntax in Python configuration
	  Add new EXSLT string tests to EXTRA_DIST
	  Fix xml2-config check in configure script
	  win32: Add configuration for profiler (Chun-wei Fan)
	  Check whether 'xml2-config --dynamic' is supported
     - Documentation:
	  Add Makefile rule to regenerate xsltproc.html
	  Update links
	  Remove MAINTAINERS
	  Upload documentation to GitLab Pages
	  Add documentation in devhelp format
	  Add --enable-rebuild-docs configure option
	  Fix libexslt header summaries
	  Fix validity of tutorial XML (David King)
	  Use DocBook URL for tutorial DTD (David King)
	  Update libxslt.doap
	  Add missing options to xsltproc man page

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:46:16 +00:00
Peter Müller
5d03d99e4c Core Update 169: Ship libxml2
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:45:55 +00:00
Adolf Belka
d30da847cf libxml2: Update to version 2.9.14
- Update from version 2.9.12 to 2.9.14
- Update of rootfile
- Changelog
   v2.9.14: May 02 2022:
     - Security:
	  [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
	  Fix potential double-free in xmlXPtrStringRangeFunction
	  Fix memory leak in xmlFindCharEncodingHandler
	  Normalize XPath strings in-place
	  Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars()
           (David Kilzer)
	  Fix leak of xmlElementContent (David Kilzer)
     - Bug fixes:
	  Fix parsing of subtracted regex character classes
	  Fix recursion check in xinclude.c
	  Reset last error in xmlCleanupGlobals
	  Fix certain combinations of regex range quantifiers
	  Fix range quantifier on subregex
     - Improvements:
	  Fix recovery from invalid HTML start tags
     - Build system, portability:
	  Define LFS macros before including system headers
	  Initialize XPath floating-point globals
	  configure: check for icu DEFS (James Hilliard)
	  configure.ac: produce tar.xz only (GNOME policy) (David Seifert)
	  CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
	  Fix build with older Python versions
	  Fix --without-valid build
   v2.9.13: Feb 19 2022:
     - Security:
	  [CVE-2022-23308] Use-after-free of ID and IDREF attributes
	  (Thanks to Shinji Sato for the report)
	  Use-after-free in xmlXIncludeCopyRange (David Kilzer)
	  Fix Null-deref-in-xmlSchemaGetComponentTargetNs (huangduirong)
	  Fix memory leak in xmlXPathCompNodeTest
	  Fix null pointer deref in xmlStringGetNodeList
	  Fix several memory leaks found by Coverity (David King)
     - Fixed regressions:
	  Fix regression in RelaxNG pattern matching
	  Properly handle nested documents in xmlFreeNode
	  Fix regression with PEs in external DTD
	  Fix random dropping of characters on dumping ASCII encoded XML (Mohammad Razavi)
	  Revert "Make schema validation fail with multiple top-level elements"
	  Fix regression when parsing invalid HTML tags in push mode
	  Fix regression parsing public IDs literals in HTML
	  Fix buffering in xmlOutputBufferWrite
	  Fix whitespace when serializing empty HTML documents
	  Fix XPath recursion limit
	  Fix regression in xmlNodeDumpOutputInternal
	  Work around lxml API abuse
     - Bug fixes:
	  Fix xmlSetTreeDoc with entity references
	  Fix double counting of CRLF in comments
	  Make sure to grow input buffer in xmlParseMisc
	  Don't ignore xmllint options after "-"
	  Don't normalize namespace URIs in XPointer xmlns() scheme
	  Fix handling of XSD with empty namespace
	  Also register HTML document nodes
	  Make xmllint return an error if arguments are missing
	  Fix handling of ctxt->base in xmlXPtrEvalXPtrPart
	  Fix xmllint --maxmem
	  Fix htmlReadFd, which was using a mix of xml and html context functions (Finn Barber)
	  Move current position before possible calling of ctxt->sax->characters (Yulin Li)
	  Fix parse failure when 4-byte character in UTF-16 BE is split across a chunk (David Kilzer)
	  Patch to forbid epsilon-reduction of final states (Arne Becker)
	  Avoid segfault at exit when using custom memory functions (Mike Dalessio)
     - Tests, code quality, fuzzing:
	  Remove .travis.yml
	  Make xmlFuzzReadString return a zero size in error case
	  Fix unused function warning in testapi.c
	  Update NewsML DTD in test suite
	  Add more checks for malloc failures in xmllint.c
	  Avoid potential integer overflow in xmlstring.c
	  Run CI tests with UBSan implicit-conversion checks
	  Fix casting of line numbers in SAX2.c
	  Fix integer conversion warnings in hash.c
	  Add explicit casts in runtest.c
	  Fix integer conversion warning in xmlIconvWrapper
	  Add suffix to unsigned constant in xmlmemory.c
	  Add explicit casts in testchar.c
	  Fix integer conversion warnings in xmlstring.c
	  Add explicit cast in xmlURIUnescapeString
	  Remove unused variable in xmlCharEncOutFunc (David King)
     - Build system, portability:
	  Remove xmlwin32version.h
	  Fix fuzzer test with VPATH build
	  Support custom prefix when installing Python module
	  Remove Makefile.win
	  Remove CVS and SVN-related code
	  Port python 3.x module to Windows and improve distutils (Chun-wei Fan)
	  Correctly install the HTML examples into their subdirectory (Mattia Rizzolo)
	  Refactor the settings of $docdir (Mattia Rizzolo)
	  Remove unused configure checks (Ben Boeckel)
	  python/Makefile.am: use *_LIBADD, not *_LDFLAGS for LIBS (Sam James)
	  Fix check for libtool in autogen.sh
	  Use version in configure.ac for CMake (Timothy Lyanguzov)
	  Add CMake alias targets for embedded projects (Markus Rickert)
     - Documentation:
	  Remove SVN keyword anchors
	  Rework README
	  Remove README.cvs-commits
	  Remove old ChangeLog
	  Update hyperlinks
	  Remove README.docs
	  Remove MAINTAINERS
	  Remove xmltutorial.pdf
	  Upload documentation to GitLab pages
	  Document how to escape XML_CATALOG_FILES
	  Fix libxml2.doap
	  Update URL for libxml++ C++ binding (Kjell Ahlstedt)
	  Generate devhelp2 index file (Emmanuele Bassi)
	  Mention XML_CATALOG_FILES is space-separated (Jan Tojnar)
	  Add documentaiton for xmllint exit code 10 (Rainer Canavan)
	  Fix some validation errors in the FAQ (David King)
	  Add instructions on how to use CMake to compile libxml (Markus Rickert)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:45:21 +00:00
Adolf Belka
1e09fe9b2d libvorbis: Update to version 1.3.7
- Update from version 1.3.6 to 1.3.7
- Update of rootfile
- Changelog
   libvorbis 1.3.7 (2020-07-04)
	* Fix CVE-2018-10393 - out-of-bounds read encoding very low sample rates.
	* Fix CVE-2017-14160 - out-of-bounds read encoding very low sample rates.
	* Fix handling invalid bytes per sample arguments.
	* Fix handling invalid channel count arguments.
	* Fix invalid free on seek failure.
	* Fix negative shift reading blocksize.
	* Fix accepting unreasonable float32 values.
	* Fix tag comparison depending on locale.
	* Fix unnecessarily linking libm.
	* Fix memory leak in test_sharedbook.
	* Update Visual Studio projects for ogg library filename change.
	* Distribute CMake build files with the source package.
	* Remove unnecessary configure --target switch.
	* Add gitlab CI support.
	* Add OSS-Fuzz support.
	* Build system and integration updates.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:45:10 +00:00
Peter Müller
071e31535c Core Update 169: Ship libyang
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:34:47 +00:00
Adolf Belka
a173ac37ef libyang: Update to version 2.0.194
- Update from version 2.0.7 to 2.0.194
- Update of rootfile
- Changelog
   Version 2.0.194 Latest
	    major yanglint improvements
	    minor XPath fixes
	    nested extension handling fixes
	    other minor bugfixes
	    RPM scripts updated
   Version 2.0.164
	    Windows support (thanks to @jktjkt)
	    Schema Mount support
	    schema compilation fixes
	    minor schema printer fixes
	    user-ordered list diff bugfix
	    JSON anyxml/anydata format fixed
	    XML parser CDATA support
	    module caching improvements
	    doc improvements
	    many other various bugfixes
   Version 2.0.112
	    support for XPath variables
	    minor doxygen improvements
	    LYB format bugfixes
	    many other bugfixes
   Version 2.0.97
	    LYB format data length limit of 64kB lifted
	    YANG error-app-tag and error-message improved support
	    XPath * evaluation fix
	    other minor XPath fixes
   Version 2.0.88
	    changed compilation to pedantic and use C11 standard
	    major JSON parser fixes
	    LYB format updated and performance improved
	    LYB big-endian fixes
	    opaque node fixes
	    major identity handling fixes
	    schema compilation refactorization and fixes
	    data validation fixes
	    NETCONF RPC filter attribute support
	    many other minor fixes

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2022-05-30 19:34:08 +00:00
Peter Müller
b93304aa01 Core Update 169: Ship sqlite
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:33:43 +00:00
Adolf Belka
efb7528e3f sqlite: Update to version 3380500
- Update from version 3380300 to 3380500
- Update of rootfile not required
- Changelog
   Version 3.38.5
     The 3.38.4 patch release included a minor change to the CLI source code that did not
      work. The release manager only ran a subset of the normal release tests, and hence
      did not catch the problem. As a result, the CLI will segfault when using columnar
      output modes in version 3.38.4. This blunder did not affect the core SQLite library.
      It only affected the CLI.
     Take-away lesson: Always run all of your tests prior to a release - even a trival
      patch release. Always.
     The 3.38.5 patch release fixes the 3.38.4 blunder.
   Version 3.38.4
     Another user-discovered problem in the new Bloom filter optimization is fixed in this
      patch release. Without the fix, it is possible for a multi-way join that uses a
      Bloom filters for two or more tables in the join to enter an infinite loop if the
      key constraint on one of those tables contains a NULL value.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:33:34 +00:00
Peter Müller
c31e6689ea Core Update 169: Ship gcc
Further changes are necessary due to toolchain update.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:26:59 +00:00
Michael Tremer
89be2a0b3b gcc: Update to 11.3.0
This is just a bug fix release that we should be using.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:25:18 +00:00
Adolf Belka
9c51f71f2f gdb: Update to version 12.1
- Update from version 11.2 to 12.1
- Update of rootfile
- Changelog
   GDB 12.1 Released!
    This version of GDB includes the following changes and enhancements:
        New support for the following native configuration:
            GNU/Linux/OpenRISC or1k*-*-linux*
        New support for the following targets:
            GNU/Linux/LoongArch loongarch*-*-linux*
        New GDBserver support on the following configuration:
            GNU/Linux/OpenRISC or1k*-*-linux*
        Support for the following target has been removed:
            S+core score-*-*
        Multithreaded symbol loading is now enabled by default
        Deprecation Notices:
            GDB 12 is the last release of GDB that will support building against Python 2
            DBX mode is deprecated, and will be removed in GDB 13
        GDB/MI changes:
            The '-add-inferior' with no option flags now inherits the connection of the
             current inferior, this restores the behaviour of GDB as it was prior to
             GDB 10.
            The '-add-inferior' command now accepts a '--no-connection' option, which
             causes the new inferior to start without a connection.
        Python API enhancements:
            It is now possible to add GDB/MI commands implemented in Python
            New function gdb.Architecture.integer_type()
            New gdb.events.gdb_exiting event
            New 'gdb.events.connection_removed' event registry
            New gdb.TargetConnection object
            New gdb.Inferior.connection property
            New read-only attribute gdb.InferiorThread.details
            New gdb.RemoteTargetConnection.send_packet method
            New read-only attributes gdb.Type.is_scalar and gdb.Type.is_signed
            The gdb.Value.format_string method now takes a 'styling' argument
            Various new function in the "gdb" module
        Miscellaneous:
            The FreeBSD native target now supports async mode
            Improved C++ template support
            Support for disabling source highlighting through GNU of the Pygments
             library instead.
            The "print" command has been changed so as to print floating-point values
             with a base-modifying formats such as "/x" to display the underlying bytes
             of the value in the desired base.
            The "clone-inferior" command now ensures that the TTY, CMD and ARGS settings
             are copied from the original inferior to the new one. All modifications to
             the environment variables done using the 'set environment' or 'unset
             environment' commands are also copied to the new inferior.
            Various new commands have been introduced
   GDB 11.2 Released!
    This is a minor corrective release over GDB 11.1, fixing the following issues:
        PR sim/28302 (gdb fails to build with glibc 2.34)
        PR build/28318 (std::thread support configure check does not use CXX_DIALECT)
        PR gdb/28405 (arm-none-eabi: internal-error: ptid_t
           remote_target::select_thread_for_ambiguous_stop_reply(const target_waitstatus*):
           Assertion `first_resumed_thread != nullptr' failed)
        PR tui/28483 ([gdb/tui] breakpoint creation not displayed)
        PR build/28555 (uclibc compile failure since commit
           4655f8509fd44e6efabefa373650d9982ff37fd6)
        PR rust/28637 (Rust characters will be encoded using DW_ATE_UTF)
        PR gdb/28758 (GDB 11 doesn't work correctly on binaries with a SHT_RELR
           (.relr.dyn) section)
        PR gdb/28785 (Support SHT_RELR (.relr.dyn) section)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:24:43 +00:00
Peter Müller
75d3718b24 Core Update 169: Ship changed cloud initscripts
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:24:02 +00:00
Michael Tremer
7154d8bfa6 aws-cli: Update to 1.23.12
This package and python3-botocore have to match exactly. Amazon does not
seem to care too much about compatibility between different versions
which is why we need to keep both in sync.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-05-30 19:21:59 +00:00
Michael Tremer
15194dcc39 python3-botocore: Update to 1.25.12
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-05-30 19:21:59 +00:00
Michael Tremer
9e41373213 cloud: Execute user-data scripts at the end of initialization
This is useful when the user-data needs to reboot an instance.
Previously, some initialization did not happen which is now being done
first before the user-data script is being executed.

This gives users more flexibility about what they are doing in those
scripts.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-05-30 19:21:59 +00:00
Peter Müller
4aab717c07 Core Update 169: Ship xfsprogs
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:21:25 +00:00
Adolf Belka
2e4c8a2163 xfsprogs: Update to version 5.16.0
- Update from 5.14.2 to 5.16.0
- Update of rootfile
- Changelog
   5.16.0
	This release is almost 100% a libxfs sync. I'm trying to catch up, and the
	next release will be 5.18.0-rc0, with both 5.17 and 5.18 libxfs changes synced.
	(there are very few).
	At that point I'll finally start pulling in more functional changes.
	xfsprogs-5.16.0 (04 May 2022)
	        - libxfs: remove kernel stubs from xfs_shared.h (Eric Sandeen)
	        - debian: Generate .gitcensus instead of .census (Bastian Germann))
	xfsprogs-5.16.0-rc0 (28 Apr 2022)
	        - libxfs changes merged from kernel 5.16

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:21:19 +00:00
Peter Müller
1ebf40b37b Core Update 169: Ship OpenVPN due to lzip update
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:20:40 +00:00
Peter Müller
42ceefc743 Core Update 169: Ship lzip
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:20:27 +00:00
Adolf Belka
a742c7f588 lzip: Update to version 1.23
- Update from 1.22 to 1.23
- Update of rootfile not required
- Changelog
   Version 1.23 released.
	* Decompression time has been reduced by 5-12% depending on the file.
	* main.cc (getnum): Show option name and valid range if error.
	* Improve several descriptions in manual, '--help', and man page.
	* lzip.texi: Change GNU Texinfo category to 'Compression'.
	  (Reported by Alfred M. Szmidt).

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:20:19 +00:00
Peter Müller
bfd00e341f Core Update 169: Ship libnetfilter_cthelper
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:19:52 +00:00
Adolf Belka
79e203acc9 libnetfilter_cthelper: Update to version 1.0.1
- Update from version 1.0.0 to 1.0.1
- Update of rootfile not required
- Changelog
   1.0.1
	* Allow build on uclinux
	* Use after free in nfct_helper_free()
	* Double free in nfct-helper-add example
	* Invalid argument error in nftc-helper-add
	* Incorrect netlink message building with multiple nfct helper policies

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:19:43 +00:00
Peter Müller
3307507a4a Core Update 169: Ship libnetfilter_cttimeout
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:19:34 +00:00
Adolf Belka
e83cac87ec libnetfilter_cttimeout: Update to version 1.0.1
- Update from 1.0.0 to 1.0.1
- Update of rootfile not required
- Changelog
   1.0.1
	* Warnings with automake-1.12
	* Allow building on uclinux
	* Fix building with clang

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:18:41 +00:00
Adolf Belka
e53b89a0a0 git: Update to version 2.36.1
- Update from version 2.36.0 to 2.36.1
- Update of rootfile not required
- Changelog
   Git v2.36.1 Release Notes
    Fixes since v2.36
	 * "git submodule update" without pathspec should silently skip an
	   uninitialized submodule, but it started to become noisy by mistake.
	 * "diff-tree --stdin" has been broken for about a year, but 2.36
	   release broke it even worse by breaking running the command with
	   <pathspec>, which in turn broke "gitk" and got noticed.  This has
	   been corrected by aligning its behaviour to that of "log".
	 * Regression fix for 2.36 where "git name-rev" started to sometimes
	   reference strings after they are freed.
	 * "git show <commit1> <commit2>... -- <pathspec>" lost the pathspec
	   when showing the second and subsequent commits, which has been
	   corrected.
	 * "git fast-export -- <pathspec>" lost the pathspec when showing the
	   second and subsequent commits, which has been corrected.
	 * "git format-patch <args> -- <pathspec>" lost the pathspec when
	   showing the second and subsequent commits, which has been
	   corrected.
	 * Get rid of a bogus and over-eager coccinelle rule.
	 * Correct choices of C compilers used in various CI jobs.
    Also contains minor documentation updates and code clean-ups.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:18:18 +00:00
Matthias Fischer
6bea701c49 clamav: Update to 0.105.0
For details see:
https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
2022-05-30 19:18:01 +00:00
Peter Müller
c3810f44e5 Core Update 169: Ship logrotate
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:14:28 +00:00
Matthias Fischer
99516d5836 logrotate: Update to 3.20.1
For details since v3.18.0 see:
https://github.com/logrotate/logrotate/releases/tag/3.20.1
https://github.com/logrotate/logrotate/releases/tag/3.20.0
https://github.com/logrotate/logrotate/releases/tag/3.19.0

logrotate-3.20.1

    drop world-readable permission on state file even when ACLs are enabled (#446)

logrotate-3.20.0

    fix potential DoS from unprivileged users via the state file (CVE-2022-1348)
    fix a misleading debug message with copytruncate and rotate 0 (#443)
    add support for unsigned time_t (#438)
    do not lock state file /dev/null (#433)

logrotate-3.19.0

    continue on EINTR in compressLogFile() (#430)
    enforce stricter parsing of configuration files (#427, #431)
    avoid confusing error message in debug mode (#426)
    fix full_write() on incomplete write (#415)
    do not use alloca() any more (#412)
    do not rotate hard links unless allowhardlink is used (#407)
    change directory after dropping privileges (#397)
    add defence in depth when dropping privileges (#400)
    remove invalid configuration on error (#408)
    do not open symbolic link log files by accident (#399)
    do not write state if state file is /dev/null (#395)

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:13:56 +00:00
Peter Müller
73bac85db4 Core Update 169: Restart firewall engine and require a reboot
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:13:29 +00:00
Peter Müller
b86439a221 Core Update 169: Ship iptables
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:13:08 +00:00
Adolf Belka
2cc3995bc5 iptables: Update to version 1.8.8
- Update from version 1.8.7 to 1.8.8
- Update of rootfile
- Changelog
   Version 1.8.8
      extensions: libxt_conntrack: use bitops for state negation
      extensions: libxt_conntrack: use bitops for status negation
      xtables: Call init_extensions6() for static builds
      xtables: Call init_extensions{,a,b}() for static builds
      iptables-nft: fix -Z option
      libxtables: exit if called by setuid executeable
      iptables-nft: allow removal of empty builtin chains
      extensions: tcpmss: add iptables-translate support
      nft-shared: set correct register value
      nft-shared: support native tcp port delinearize
      nft-shared: support native tcp port range delinearize
      nft-shared: support native udp port delinearize
      nft: prefer native expressions instead of udp match
      nft: prefer native expressions instead of tcp match
      nft-shared: add tcp flag dissection
      nft: add support for native tcp flag matching
      tests: shell: fix bashism
      nft: fix indentation error.
      tests: iptables-test: correct misspelt variable
      extensions: libxt_NFLOG: fix `--nflog-prefix` Python test-cases
      extensions: libxt_NFLOG: remove extra space when saving targets with prefixes
      build: replace `AM_PROG_LIBTOOL` and `AC_DISABLE_STATIC` with `LT_INIT`
      extensions: libxt_NFLOG: fix typo
      tests: iptables-test: rename variable
      tests: add `NOMATCH` test result
      tests: support explicit variant test result
      tests: NFLOG: enable `--nflog-range` tests
      xshared: Implement xtables lock timeout using signals
      extensions: libxt_NFLOG: use nft built-in logging instead of xt_NFLOG
      extensions: libxt_NFLOG: don't truncate log prefix on print/save
      extensions: libxt_NFLOG: disable `--nflog-range` Python test-cases
      fix build for missing ETH_ALEN definition
      libxtables: extend xlate infrastructure
      tests: xlate-test: support multiline expectation
      extensions: libxt_connlimit: add translation
      extensions: libxt_tcp: rework translation to use flags match representation
      extensions: libxt_conntrack: simplify translation using negation
      extensions: libxt_multiport: add translation for -m multiport --ports
      nft-shared: update context register for bitwise expression
      nft: pass struct nft_xt_ctx to parse_meta()
      nft: native mark matching support
      nft: pass handle to helper functions to build netlink payload
      nft: prepare for dynamic register allocation
      nft: split gen_payload() to allocate register and initialize expression
      configure: bump version for 1.8.8 release
      ip6tables: masquerade: use fully-random so that nft can understand the rule
      ebtables: Exit gracefully on invalid table names
      include: Drop libipulog.h
      nft: Fix bitwise expression avoidance detection
      xtables-translate: Fix translation of odd netmasks
      libxtables: Simplify xtables_ipmask_to_cidr() a bit
      nft: cache: Sort chains on demand only
      nft: Increase BATCH_PAGE_SIZE to support huge rulesets
      extensions: sctp: Explain match types in man page
      Eliminate inet_aton() and inet_ntoa()
      nft-arp: Make use of ipv4_addr_to_string()
      extensions: SECMARK: Implement revision 1
      xtables: Make invflags 16bit wide
      xshared: Eliminate iptables_command_state->invert
      xshared: Merge invflags handling code
      ebtables-translate: Use shared ebt_get_current_chain() function
      Use proto_to_name() from xshared in more places
      extensions: sctp: Fix nftables translation
      extensions: sctp: Translate --chunk-types option
      libxtables: Drop leftover variable in xtables_numeric_to_ip6addr()
      extensions: libebt_ip6: Drop unused variables
      libxtables: Fix memleak in xtopt_parse_hostmask()
      nft: Avoid memleak in error path of nft_cmd_new()
      nft: Avoid buffer size warnings copying iface names
      iptables-apply: Drop unused variable
      extensions: libebt_ip6: Use xtables_ip6parse_any()
      libxtables: Introduce xtables_strdup() and use it everywhere
      extensions: libxt_string: Avoid buffer size warning for strncpy()
      doc: ebtables-nft.8: Adjust for missing atomic-options
      ebtables: Dump atomic waste
      nft: Fix for non-verbose check command
      tests/shell: Assert non-verbose mode is silent
      extensions: hashlimit: Fix tests with HZ=100
      iptables-test: Make netns spawning more robust
      extensions: libxt_mac: Fix for missing space in listing
      nft: Use xtables_malloc() in mnl_err_list_node_add()
      nft: Use xtables_{m,c}alloc() everywhere
      tests: iptables-test: Fix missing chain case
      tests: xlate-test: Don't skip any input after the first empty line
      tests: xlate-test: Print errors to stderr
      tests: iptables-test: Print errors to stderr
      tests: xlate-test: Exit non-zero on error
      tests: iptables-test: Exit non-zero on error
      tests: shell: Return non-zero on error
      ebtables: Avoid dropping policy when flushing
      tests: iptables-test: Fix conditional colors on stderr
      nft: cache: Avoid double free of unrecognized base-chains
      nft: Check base-chain compatibility when adding to cache
      nft-chain: Introduce base_slot field
      nft: Delete builtin chains compatibly
      nft: Introduce builtin_tables_lookup()
      xshared: Store optstring in xtables_globals
      nft-shared: Introduce init_cs family ops callback
      xtables: Simplify addr_mask freeing
      nft: Add family ops callbacks wrapping different nft_cmd_* functions
      xtables-standalone: Drop version number from init errors
      libxtables: Introduce xtables_globals print_help callback
      arptables: Use standard data structures when parsing
      nft-arp: Introduce post_parse callback
      nft-shared: Make nft_check_xt_legacy() family agnostic
      xtables: Derive xtables_globals from family
      xtables: arptables accepts empty interface names
      nft: Merge xtables-arp-standalone.c into xtables-standalone.c
      Unbreak xtables-translate
      xlate-test: Print full path if testing all files
      extensions: hashlimit: Fix tests with HZ=1000
      xshared: Merge and share parse_chain()
      nft: Change whitespace printing in save_rule callback
      xshared: Share print_iface() function
      xshared: Share save_rule_details() with legacy
      xshared: Share save_ipv{4,6}_addr() with legacy
      xshared: Share print_rule_details() with legacy
      xshared: Share print_fragment() with legacy
      xshared: Share print_header() with legacy iptables
      nft-shared: Drop unused function print_proto()
      xshared: Make load_proto() static
      xshared: Share print_match_save() between legacy ip*tables
      xshared: Share a common printhelp function
      xshared: Share exit_tryhelp()
      xtables_globals: Embed variant name in .program_version
      libxtables: Extend basic_exit_err()
      iptables-*-restore: Drop pointless line reference
      xtables: Drop xtables' family on demand feature
      xtables: Pull table validity check out of do_parse()
      xtables: Move struct nft_xt_cmd_parse to xshared.h
      xtables: Pass xtables_args to check_empty_interface()
      xtables: Pass xtables_args to check_inverse()
      xtables: Do not pass nft_handle to do_parse()
      xshared: Move do_parse to shared space
      xshared: Store parsed wait and wait_interval in xtables_args
      nft: Move proto_parse and post_parse callbacks to xshared
      iptables: Use xtables' do_parse() function
      ip6tables: Use the shared do_parse, too
      extensions: *NAT: Kill multiple IPv4 range support
      xshared: Fix response to unprivileged users
      nft: Use verbose flag to toggle debug output
      iptables-restore: Support for extra debug output
      nft: Set NFTNL_CHAIN_FAMILY in new chains
      ebtables: Support verbose mode
      nft: Add debug output to table creation
      nft: cache: Dump rules if debugging
      tests: iptables-test: Support variant deviation
      iptables.8: Describe the effect of multiple -v flags
      libxtables: Register only the highest revision extension
      Improve error messages for unsupported extensions
      nft: Simplify immediate parsing
      nft: Speed up immediate parsing
      xshared: Prefer xtables_chain_protos lookup over getprotoent
      nft: Don't pass command state opaque to family ops callbacks
      libxtables: Fix for warning in xtables_ipmask_to_numeric
      Simplify static build extension loading
      nft: Review static extension loading
      tests: shell: Fix 0004-return-codes_0 for static builds
      nft: Reject standard targets as chain names when restoring
      libxtables: Implement notargets hash table
      libxtables: Boost rule target checks by announcing chain names
      xlate-test: Fix for empty source line on failure
      man: DNAT: Describe shifted port range feature
      Revert "libipt_[SD]NAT: avoid false error about multiple destinations specified"
      extensions: ipt_DNAT: Merge v1 and v2 parsers
      extensions: ipt_DNAT: Merge v1/v2 print/save code
      extensions: ipt_DNAT: Combine xlate functions also
      extensions: DNAT: Rename from libipt to libxt
      extensions: Merge IPv4 and IPv6 DNAT targets
      extensions: Merge REDIRECT into DNAT
      extensions: man: Document service name support in DNAT and REDIRECT
      extensions: MARK: Drop extra newline at end of help
      xshared: Move arp_opcodes into shared space
      xshared: Extend xtables_printhelp() for arptables
      libxtables: Drop xtables_globals 'optstring' field
      libxtables: Revert change to struct xtables_pprot
      extensions: DNAT: Merge core printing functions
      man: *NAT: Review --random* option descriptions
      extensions: LOG: Document --log-macdecode in man page
      nft: Fix EPERM handling for extensions without rev 0
      xtables-translate: add missing argument and option to usage
      Fix a few doc typos
      iptables-test.py: print with color escapes only when stdout isatty

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:11:45 +00:00
Peter Müller
922013ca2a Core Update 169: Ship fuse
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:11:22 +00:00
Adolf Belka
37ddc46691 fuse: Update to version 3.11.0
- Update from 3.10.4 to 3.11.0
- Update of rootfile
- Changelog
   fuse 3.11.0 (2022-05-02)
	* Add support for flag FOPEN_NOFLUSH for avoiding flush on close.
	* Fixed returning an error condition to ioctl(2)
   fuse 3.10.5 (2021-09-06)
	* Various improvements to make unit tests more robust.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:11:14 +00:00
Peter Müller
8cd9c34439 Core Update 169: Ship curl
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:10:53 +00:00
Adolf Belka
247d9e685e curl: Update to version 7.83.1
- Update from version 7.83.0 to 7.83.1
- Update of rootfile not required
- Changelog
   version 7.83.1
    This release includes the following bugfixes:
	 o altsvc: fix host name matching for trailing dots [31]
	 o cirrus: Update to FreeBSD 12.3 [24]
	 o cirrus: Use pip for Python packages on FreeBSD [23]
	 o conn: fix typo 'connnection' -> 'connection' in two function names [1]
	 o cookies: make bad_domain() not consider a trailing dot fine [26]
	 o curl: free resource in error path [3]
	 o curl: guard against size_t wraparound in no-clobber code [4]
	 o CURLOPT_DOH_URL.3: mention the known bug [19]
	 o CURLOPT_HSTS*FUNCTION.3: document the involved structs as well [20]
	 o CURLOPT_SSH_AUTH_TYPES.3: fix the default [18]
	 o data/test376: set a proper name
	 o GHA/mbedtls: enabled nghttp2 in the build [11]
	 o gha: build msh3 [5]
	 o gskit: fixed bogus setsockopt calls [17]
	 o gskit: remove unused function set_callback [2]
	 o hsts: ignore trailing dots when comparing hosts names [28]
	 o HTTP-COOKIES: add missing CURLOPT_COOKIESESSION [40]
	 o http: move Curl_allow_auth_to_host() [9]
	 o http_proxy/hyper: handle closed connections [34]
	 o hyper: fix test 357 [32]
	 o Makefile: fix "make ca-firefox" [37]
	 o mbedtls: bail out if rng init fails [14]
	 o mbedtls: fix compile when h2-enabled [12]
	 o mbedtls: fix some error messages
	 o misc: use "autoreconf -fi" instead buildconf [22]
	 o msh3: get msh3 version from MsH3Version [6]
	 o msh3: print boolean value as text representation [10]
	 o msh3: psss remote_port to MsH3ConnectionOpen [7]
	 o ngtcp2: add ca-fallback support for OpenSSL backend [35]
	 o nss: return error if seemingly stuck in a cert loop [30]
	 o openssl: define HAVE_SSL_CTX_SET_EC_CURVES for libressl [8]
	 o post_per_transfer: remove the updated file name [27]
	 o sectransp: bail out if SSLSetPeerDomainName fails [33]
	 o tests/server: declare variable 'reqlogfile' static [39]
	 o tests: fix markdown formatting in README [38]
	 o test{898,974,976}: add 'HTTP proxy' keywords [16]
	 o tls: check more TLS details for connection reuse [25]
	 o url: check SSH config match on connection reuse [21]
	 o urlapi: address (harmless) UndefinedBehavior sanitizer warning [15]
	 o urlapi: reject percent-decoding host name into separator bytes [29]
	 o x509asn1: make do_pubkey handle EC public keys [13]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-30 19:10:46 +00:00
Peter Müller
3f6238f7c1 Merge branch 'next' into temp-c169-development 2022-05-30 19:09:46 +00:00
Michael Tremer
71d53192d3 core168: Add script to automatically repair MDRAID arrays
Please see the header of the script for more details.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-05-30 18:59:34 +00:00
Michael Tremer
69aac83da9 core168: Add rd.auto to kernel command line
This parameter will enable dracut to automatically launch any MDRAID
arrays at boot time.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-05-30 18:59:33 +00:00
Peter Müller
8077bacb82 strongSwan: Bring back firewall rules for permitting IP-in-IP, ESP and AH traffic
Fixes: #12866
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-05-20 05:44:06 +00:00
Peter Müller
b630a9a8a8 Core Update 168: fcrontab != crontab
Silly me.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-05-18 17:42:24 +00:00