As the list of symbolic links was not sorted at all I sorted it now by
the order of start or stop.
This seems to be the most useful way as you can now understand the
startup sequence from this file and add/remove scripts at a useful
place.
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
As some lines are already now to long, this increase the indention to
improve readablitity.
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
- Adds borgbackup run time dependency - python3-exceptiongroup
- Adds python3-exceptiongroup build time dependency - python3-flit_scm
- Removes python3-attr that is no longer required in borgbackup dependency chain
Fixes: Bug#13076
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Moved rootfile from common to packages and commented out all entries.
- Updated lfs file from addon to core package that is only used for build
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- In Core 173 python3-trio was updated to version 0.22.0 when python was upgraded to 3.10.8
Although the build of python3-trio was successful it was missed that there was a new
run-time dependency of python3-exceptiongroup for python3-pyfuse3 to work.
python2-flit_scm is required as a build dependency for python3-exceptiongroup.
- The modified packages were installed in my vm testbed and confirmed that borg mount then
worked again.
- It was also noted that python3-attr was no longer needed neither as a runtime
dependency nor as a build time dependency.
- Dependencies line of python3-trio updated for these two changes.
Fixes: Bug#13076
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
newer grep versions ignore * in --exclude
work around this by excluding all arch specific directories with
--exclude-dir
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
this lower the compression ratio sligtly (the ramdlisk is 100kb
larger) and use only a single thread now. (it's still faster than
before on a dual core.)
fixes: #13091
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
- The base version has not changed but patches to fix 4 bugs have been released.
- Update to rootfile not required.
- Bug fix changelog
1 A test of the thousands separator in tsprintf.c is based on the output from
the GNU C Library up to 2.36, which is incorrect. The output has changed in
2.37 (partly fixed), so that tsprintf fails with glibc 2.37. The
tsprintf-thousands patch modifies the test to conform to POSIX and also
avoid the buggy case in 2.36 and below. However, this new test, which was
expected to succeed, triggers a serious bug in 2.37
(bug 30068 / CVE-2023-25139). We did not modify the test again since this
bug affects MPFR's mpfr_sprintf function, with a possible buffer overflow
in particular cases. This bug has been fixed in the 2.37 branch. In short,
this patch is useful (and needed) for a fixed glibc 2.37 and some other
libraries, depending on the current locales.
Corresponding changesets in the 4.2 branch: 4f03d40b5, 78ff7526d, e66bb7121.
2 The mpfr_ui_pow_ui function has infinite loop in case of overflow. This can
affect mpfr_log10, which uses this function (this is how this bug was
found). This bug is fixed by the ui_pow_ui-overflow patch (with testcases).
Corresponding changeset in the 4.2 branch: 0216f40ed.
3 The tfprintf and tprintf tests may fail in locales where decimal_point has
several bytes, such as ps_AF. This is fixed by the multibyte-decimal_point
patch, which makes the tests aware of the length of decimal_point.
Corresponding changeset in the 4.2 branch: 0383bea85.
4 In particular cases that are very hard to round, mpfr_rec_sqrt may yield a
stack overflow due to many small allocations in the stack, based on alloca().
This is due to the fact that the working precision is increased each step
(Ziv loop) by 32 or 64 bits only, until the approximate result can be
rounded (thus we have an arithmetic progression here, while a geometric
progression is used for the other functions), and that at each iteration,
the previous allocations in the stack cannot be freed. Individual
allocations in the stack are limited to 16384 bytes, so that the issue can
occur only when there are many iterations in working precisions that are
not too large, which is possible with an arithmetic progression. This bug
is fixed by the rec_sqrt-zivloop patch, which changes the Ziv loop to use
the standard MPFR_ZIV_* macros; the patch also provides a testcase obtained
by a function that constructs a hard-to-round case involving large enough
precisions (this function is commonly used in the MPFR testsuite, but not
with so large precisions). This bug was originally reported by Fredrik
Johansson.
Corresponding changeset in the 4.2 branch: 934dd8842.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- Since lvmetad was removed then the configure option --enable-lvmetad is no longer valid.
A warning is now shown - configure: WARNING: unrecognized options: --enable-lvmetad
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- libcap places the files by default in /lib and not /usr/lib etc. To fix this libcap made
a symlink for the library file from /lib to /usr/lib. However the .pc files were left
in /lib/pkgconfig and not /usr/lib/pkgconfig and were therefore not found by the update
of rng-tools which now required libcap to be found.
- Changed the prefix settings for libcap which placed the libraries and .pc files in the
correct locations while keeping the executables in their existing location.
- This removed the need for symlinking /usr/lib/libcap.so to /lib/libcap.so.2.67 as the
libraries are now placed in /usr/lib
- Installed the ipfire build with these changes into a vm system and confirmed that
everything worked. Input from Michael Tremer that if ping worked then libcap was
functioning correctly.
- The prefixes have to be applied to both make and make install to end up with the files
in the correct places.
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- This v2 version corrects an error where a debug echo statement was left in the lfs file
- Update from version 2.14 to 2.16
- Update of rootfile not required
- Version 2.16 required libcap to be available, which it is, but it could not be found by
rng-tools. This is because rng-tools is using pkg-config and the required libcap.pc file
was not stored in the standard directory location for .pc files. Therefore a patch for
libcap is bundled together with this update to fix this.
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- With the last update of lvm2 lvmetad was removed from lvm2. I did not recognise that
lvmetad had been setup as an automatic initscript, so it no longer works as the
binary is no longer provided.
- This patch removes the lvmetad initscript, the reference to lvmetad in the initscript
lfs file and the lvmetad initscript entries in the rootfile for each architecture.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Read-in the requested backup file line by line and directly deliver this
as stream to the client.
This fixes the problem with very big backups on systems with very
limited RAM, which resulted in an OOM kill of the CGI and delivery
process.
Fixes#13096.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
- Based on input from Arne Fitzenreiter there are conf files that alsa complains about if
they are not present. This patch uncomments all the default conf files
- The backup include file is also added to the rootfile.
Suggested-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- start_service added to install.sh and stop_service to uninstall.sh
This ensures that the modules are loaded after install
- The /etc/asound.state file was touched by the install.sh cript but the alsactl store and
restore commands have default location of /var/lib/alsa/ so the touch command created
an asound.state file that was then not used subsequently. It also meant that the first
start of alsa would fail as it would try and restore from /var/lib/alsa/asound.state
but the file did not exist.
- This patch corrects the path for the touch command for asound.state
- The install.sh script also checks if /etc/asound.state, that was never used, exists and
if it does removes it.
- Uninstalling alsa left the sound modules installed until a reboot was carried out.
Uninstallation should unload the alsa kernel modules.
This patch adds the modprobe -r commands to the uninstall.sh file to unload all the snd
modules when alsa is uninstalled.
- make_backup and restore_backup commands added to ther install.sh and uninstall.sh scripts
Fixes: Bug#13087
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- This will backup the sound card status with the asound.state file when the addon is
uninstalled so that if it is re-installed in the future the status can be rerstored.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
- alsa has an initscript but it is not starting and stopping a traditional daemon service.
The initscript loads some alsa modules and then restores the asound.state file
- This patch updates the PAK_VER number and removes the services entry and explicitly
adds alsa in for the initscript installation.
- Additionally this patch also adds the installation of a backup include file for alsa
which savces the soundcards status file asound.state
Fixes: Bug#13087
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
From the kernel documentation:
> Driver for the internal USB role switch for switching the USB data
> lines between the xHCI host controller and the dwc3 gadget controller
> found on various Intel SoCs. [...]
This may unblock USB-LAN-adaptor usage on certain boards, as reported
once in #12750. Overall affected devices seem to be scanty;
nevertheless, enabling this as a module only is highly unlikely to cause
any harm, so let's give it a try.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
- Configure Zabbix Agent to log to syslog instead of its own logs.
- Remove old zabbix log-dir and logrotate settings from rootfile, lfs
and install-script.
- Update log.dat to view Zabbix Agent logging from syslog.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
For details see:
https://github.com/OISF/libhtp/releases/tag/0.5.43
"htp: do not log content-encoding: none
htp: do not error on multiple 100 Continue
readme: remove note on libhtp not being stable
uri: fix compile warning strict-prototypes
bstr: fix compile warning strict-prototypes
fuzz_diff: Free the rust test object.
github: add CIFuzz workflow"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Excerpt from changelog:
"6.0.11 -- 2023-04-13
Security #5947: byte_math: Division by zero possible. (6.0.x backport)
Bug #5970: detect: reload can stall if flow housekeeping takes too long (6.0.x backport)
Bug #5967: flowworker: Assertion in CheckWorkQueue (6.0.x backport)
Bug #5953: http: multipart data is not filled up to request.body-limit (6.0.x backport)
Bug #5951: detect: multi-tenancy crash (6.0.x backport)
Bug #5950: http2: quadratic complexity when reducing dynamic headers table size (6.0.x backport)
Bug #5949: smtp: quadratic complexity for tx iterator with linked list (6.0.x backport)
Bug #5948: fast_pattern assignment of specific content in combination with urilen results in FN (6.0.x backport)
Bug #5946: flow/manager: fix unhandled division by 0 (prealloc: 0) (6.0.x backport)
Bug #5942: exception/policy: flow action doesn't fall back to packet action when there's no flow (6.0.x backports)
Bug #5933: smb: tx logs sometimes have duplicate `tree_id` output (6.0.x backport)
Bug #5932: rfb/eve: depth in pixel format logged twice (6.0.x backport)
Bug #5906: dns: unused events field can overflow as an integer
Bug #5903: UBSAN: undefined shift in DetectByteMathDoMatch (6.0.x backport)
Bug #5899: smb: no consistency check between NBSS length and length field for some SMB operations (6.0.x backport)
Bug #5898: smb: possible evasion with trailing nbss data (6.0.x backport)
Bug #5896: base64_decode not populating up to an invalid character (6.0.x backport)
Bug #5895: stream: connections time out too early (6.0.x backport)
Bug #5889: stream: SYN/ACK timestamp checking blocks valid traffic (6.0.x backport)
Bug #5888: false-positive drop event_types possible on passed packets (6.0.x backport)
Bug #5887: stream: overlap with different data false positive (6.0.x backport)
Bug #5886: mime: debug assertion on fuzz input (6.0.x backport)
Bug #5879: netmap: Module registration displays whether info about new API usage
Bug #5863: netmap: packet stalls (6.0.x backport)
Bug #5854: SMTP does not handle LF post line limit properly (6.0.x backport)
Bug #5852: tcp/stream: session reuse on tcp flows w/o sessions (6.0.x backport)
Feature #5853: yaml: set suricata version in generated config (6.0.x backport)
Task #5985: libhtp 0.5.43 (6.0.x backport)"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
For details see:
https://downloads.isc.org/isc/bind9/9.16.40/doc/arm/html/notes.html#notes-for-bind-9-16-40
"Notes for BIND 9.16.40
Bug Fixes
Logfiles using timestamp-style suffixes were not always correctly
removed when the number of files exceeded the limit set by versions.
This has been fixed for configurations which do not explicitly specify
a directory path as part of the file argument in the channel
specification. [GL #3959] [GL #3991]
Performance of DNSSEC validation in zones with many DNSKEY records has
been improved. [GL #3981]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
For details see:
https://blog.clamav.net/2023/05/clamav-110-released.html
"Major changes
Added the ability to extract images embedded in HTML CSS <style> blocks.
Updated to Sigtool so that the --vba option will extract VBA code from
Microsoft Office documents the same way that libclamav extracts VBA.
This resolves several issues where Sigtool could not extract VBA.
Sigtool will also now display the normalized VBA code instead of the
pre-normalized VBA code.
Added a new ClamScan and ClamD option: --fail-if-cvd-older-than=days.
Additionally, we introduce FailIfCvdOlderThan as a clamd.conf synonym
for --fail-if-cvd-older-than. When passed, it causes ClamD to exit on
startup with a non-zero return code if the virus database is older than
the specified number of days.
Added a new function cl_cvdgetage() to the libclamav API. This function
will retrieve the age in seconds of the youngest file in a database
directory, or the age of a single CVD (or CLD) file.
Added a new function cl_engine_set_clcb_vba() to the libclamav API. Use
this function to set a cb_vba callback function. The cb_vba callback
function will be run whenever VBA is extracted from office documents.
The provided data will be a normalized copy of the extracted VBA. This
callback was added to support Sigtool so that it can use the same VBA
extraction logic that ClamAV uses to scan documents.
Other improvements
Removed the vendored TomsFastMath library in favor of using OpenSSL to
perform "big number"/multiprecision math operations. Work courtesy of
Sebastian Andrzej Siewior.
Build system: Added CMake option DO_NOT_SET_RPATH to avoid setting
RPATH on Unix systems. Feature courtesy of Sebastian Andrzej Siewior.
Build system: Enabled version-scripts with CMake to limit symbol
exports for libclamav, libfreshclam, libclamunrar_iface, and
libclamunrar shared libraries on Unix systems, excluding macOS.
Improvement courtesy of Orion Poplawski and Sebastian Andrzej Siewior.
Build system: Enabled users to pass in custom Rust compiler flags using
the RUSTFLAGS CMake variable. Feature courtesy of Orion Poplawski.
Removed a hard-coded alert for CVE-2004-0597. The CVE is old enough
that it is no longer a threat and the detection had occasional
false-positives.
Set Git attributes to prevent Git from altering line endings for Rust
vendored libraries. Third-party Rust libraries are bundled in the
ClamAV release tarball. We do not commit them to our own Git
repository, but community package maintainers may now store the tarball
contents in Git. The Rust build system verifies the library manifest,
and this change ensures that the hashes are correct. Improvement
courtesy of Nicolas R.
Fixed compile time warnings. Improvement courtesy of Razvan Cojocaru.
Added a minor optimization when matching domain name regex signatures
for PDB, WDB and CDB type signatures.
Build system: Enabled the ability to select a specific Python version.
When building, you may use the CMake option -D
PYTHON_FIND_VER=<version> to choose a specific Python version. Feature
courtesy of Matt Jolly.
Added improvements to the ClamOnAcc process log output so that it is
easier to diagnose bugs.
Windows: Enabled the MSI installer to upgrade between feature versions
more easily when ClamAV is installed to a location different from the
default (i.e., not C:\Program Files\ClamAV). This means that the MSI
installer can find a previous ClamAV 1.0.x installation to upgrade to
ClamAV 1.1.0.
Sigtool: Added the ability to change the location of the temp directory
using the --tempdir option and added the ability to retain the temp
files created by Sigtool using the --leave-temps option.
Other minor improvements.
Bug fixes
Fixed the broken ExcludePUA / --exclude-pua feature. Fix courtesy of
Ged Haywood and Shawn Iverson.
Fixed an issue with integer endianness when parsing Windows executables
on big-endian systems. Fix courtesy of Sebastian Andrzej Siewior.
Fixed a possible stack overflow read when parsing WDB signatures. This
issue is not a vulnerability.
Fixed a possible index out of bounds when loading CRB signatures. This
issue is not a vulnerability.
Fixed a possible use after free when reading logical signatures. This
issue is not a vulnerability.
Fixed a possible heap overflow read when reading PDB signatures. This
issue is not a vulnerability.
Fixed a possible heap overflow read in javascript normalizer module.
This issue is not a vulnerability.
Fixed two bugs that would cause Freshclam to fail update when applying
a CDIFF database patch if that patch adds a file to the database
archive or removes a file from the database archive. This bug also
caused Sigtool to fail to create such a patch.
Fixed an assortment of complaints identified by Coverity static analysis.
Fixed one of the Freshclam tests that was failing on some Fedora
systems due to a bug printing debug-level log messages to stdout. Fix
courtesy of Arjen de Korte.
Correctly remove temporary files generated by the VBA and XLM
extraction modules so that the files are not leaked in patched versions
of ClamAV where temporary files are written directly to the
temp-directory instead of writing to a unique subdirectory."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
