Commit Graph

4327 Commits

Author SHA1 Message Date
Adolf Belka
f86ae7d1a6 gdb: Patch for building with readline-8.2
- Patch required for successful building with readline-8.2
   In readline 8.2 the type of rl_completer_word_break_characters changed to
   include const.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-11-21 10:58:32 +00:00
Adolf Belka
1ad5a01388 readline: Update to version 8.2 plus patch 1
- Update from version 8.1 to 8.2 plus patch 1
- Update of rootfile
- Changelog
    version 8.2
	There is a new framework for readline timeouts, including new public
	 functions to set timeouts and query how much time is remaining before a
	 timeout hits, and a hook function that can trigger when readline times out.
	 There is a new state value to indicate a timeout. There is a new option:
	 `enable-active-region'. This separates control of the active region and
	 bracketed-paste. It has the same default value as bracketed-paste, and
	 enabling bracketed paste enables the active region. Users can now turn off
	 the active region while leaving bracketed paste enabled. Two new bindable
	 string variables are available; their values are terminal escape sequences
	 that set the color used to display the active region and turn it off,
	 respectively. If set, these are used in place of terminal standout mode.
	 Finally, Readline now checks for changes to locale settings
	 (LC_ALL/LC_CTYPE/LANG) each time it is called, and modifies the appropriate
	 locale-specific display and key binding variables when the locale changes.
	There are a few bug fixes in the redisplay code when restoring the prompt
	 after a digit-argument prompt or incremental search back to a prompt that
	 contains invisible multibyte characters. There are more checks for read
	 errors, especially in the middle of readline commands; previous versions
	 could loop or return incorrect data. Full details are below.
	GNU Readline is a library which provides programs with an input
	 facility including command-line editing and history.  Editing
	 commands similar to both emacs and vi are included.  The GNU
	 History library, which provides facilities for managing a list of
	 previously-typed command lines and an interactive command line
	 recall facility similar to that provided by csh, is also present.
	 The history library is built as part of the readline as well as
	 separately.
	1. Changes to Readline
		a. Fixed a problem with cleaning up active marks when using callback mode.
		b. Fixed a problem with arithmetic comparison operators checking the version.
		c. Fixed a problem that could cause readline not to build on systems without
		   POSIX signal functions.
		d. Fixed a bug that could cause readline to crash if the application removed
		   the callback line handler before readline read all typeahead.
		e. Added additional checks for read errors in the middle of readline commands.
		f. Fixed a redisplay problem that occurred when switching from the digit-
		   argument prompt `(arg: N)' back to the regular prompt and the regular
		   prompt contained invisible characters.
		g. Fixed a problem with restoring the prompt when aborting an incremental
		   search.
		h. Fix a problem with characters > 128 not being displayed correctly in certain
		   single-byte encodings.
		i. Fixed a problem with unix-filename-rubout that caused it to delete too much
		   when applied to a pathname consisting only of one or more slashes.
		j. Fixed a display problem that caused the prompt to be wrapped incorrectly if
		   the screen changed dimensions during a call to readline() and the prompt
		   became longer than the screen width.
		k. Fixed a problem that caused the \r output by turning off bracketed paste
		   to overwrite the line if terminal echo was disabled.
		l. Fixed a bug that could cause colored-completion-prefix to not display if
		   completion-prefix-display-length was set.
		m. Fixed a problem with line wrapping prompts when a group of invisible
		   characters runs to the right edge of the screen and the prompt extends
		   longer then the screen width.
		n. Fixed a couple problems that could cause rl_end to be set incorrectly by
		   transpose-words.
		o. Prevent some display problems when running a command as the result of a
		   trap or one bound using `bind -x' and the command generates output.
		p. Fixed an issue with multi-line prompt strings that have one or more
		   invisible characters at the end of a physical line.
		q. Fixed an issue that caused a history line's undo list to be cleared when
		   it should not have been.
		r. When replacing a history entry, make sure the existing entry has a non-NULL
		   timestamp before copying it; it may have been added by the application, not
		   the history library.
	2. New Features in Readline
		a. There is now an HS_HISTORY_VERSION containing the version number of the
		   history library for applications to use.
		b. History expansion better understands multiple history expansions that may
		   contain strings that would ordinarily inhibit history expansion (e.g.,
		   `abc!$!$').
		c. There is a new framework for readline timeouts, including new public
		   functions to set timeouts and query how much time is remaining before a
		   timeout hits, and a hook function that can trigger when readline times
		   out. There is a new state value to indicate a timeout.
		d. Automatically bind termcap key sequences for page-up and page-down to
		   history-search-backward and history-search-forward, respectively.
		e. There is a new `fetch-history' bindable command that retrieves the history
		   entry corresponding to its numeric argument. Negative arguments count back
		   from the end of the history.
		f. `vi-undo' is now a bindable command.
		g. There is a new option: `enable-active-region'. This separates control of
		   the active region and bracketed-paste. It has the same default value as
		   bracketed-paste, and enabling bracketed paste enables the active region.
		   Users can now turn off the active region while leaving bracketed paste
		   enabled.
		h. rl_completer_word_break_characters is now `const char *' like
		   rl_basic_word_break_characters.
		i. Readline looks in $LS_COLORS for a custom filename extension
		   (*.readline-colored-completion-prefix) and uses that as the default color
		   for the common prefix displayed when `colored-completion-prefix' is set.
		j. Two new bindable string variables: active-region-start-color and
		   active-region-end-color. The first sets the color used to display the
		   active region; the second turns it off. If set, these are used in place
		   of terminal standout mode.
		k. New readline state (RL_STATE_EOF) and application-visible variable
		   (rl_eof_found) to allow applications to detect when readline reads EOF
		   before calling the deprep-terminal hook.
		l. There is a new configuration option: --with-shared-termcap-library, which
		   forces linking the shared readline library with the shared termcap (or
		   curses/ncurses/termlib) library so applications don't have to do it.
		m. Readline now checks for changes to locale settings (LC_ALL/LC_CTYPE/LANG)
		   each time it is called, and modifies the appropriate locale-specific display
		   and key binding variables when the locale changes.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-11-21 10:58:32 +00:00
Adolf Belka
5be71d2a6e bash: Update to version 5.2 plus patches 1 to 9
- Update from version 5.1.16 to version 5.2 plus patches 1 to 9
- Update of rootfile
- Changelog
    This is a terse description of the new features added to bash-5.2 since
     the release of bash-5.1.  As always, the manual page (doc/bash.1) is
     the place to look for complete descriptions.
    1. New Features in Bash
	a. The bash malloc returns memory that is aligned on 16-byte boundaries.
	b. There is a new internal timer framework used for read builtin timeouts.
	c. Rewrote the command substitution parsing code to call the parser recursively
	   and rebuild the command string from the parsed command. This allows better
	   syntax checking and catches errors much earlier. Along with this, if
	   command substitution parsing completes with here-documents remaining to be
	   read, the shell prints a warning message and reads the here-document bodies
	   from the current input stream.
	d. The `ulimit' builtin now treats an operand remaining after all of the options
	   and arguments are parsed as an argument to the last command specified by
	   an option. This is for POSIX compatibility.
	e. Here-document parsing now handles $'...' and $"..." quoting when reading the
	   here-document body.
	f. The `shell-expand-line' and `history-and-alias-expand-line' bindable readline
	   commands now understand $'...' and $"..." quoting.
	g. There is a new `spell-correct-word' bindable readline command to perform
	   spelling correction on the current word.
	h. The `unset' builtin now attempts to treat arguments as array subscripts
	   without parsing or expanding the subscript, even when `assoc_expand_once'
	   is not set.
	i. There is a default value for $BASH_LOADABLES_PATH in config-top.h.
	j. Associative array assignment and certain instances of referencing (e.g.,
	   `test -v' now allow `@' and `*' to be used as keys.
	k. Bash attempts to expand indexed array subscripts only once when executing
	   shell constructs and word expansions.
	l. The `unset' builtin allows a subscript of `@' or `*' to unset a key with
	   that value for associative arrays instead of unsetting the entire array
	   (which you can still do with `unset arrayname'). For indexed arrays, it
	   removes all elements of the array without unsetting it (like `A=()').
	m. Additional builtins (printf/test/read/wait) do a better job of not
	   parsing array subscripts if array_expand_once is set.
	n. New READLINE_ARGUMENT variable set to numeric argument for readline commands
	   defined using `bind -x'.
	o. The new `varredir_close' shell option causes bash to automatically close
	   file descriptors opened with {var}<fn and other styles of varassign
	   redirection unless they're arguments to the `exec' builtin.
	p. The `$0' special parameter is now set to the name of the script when running
	   any (non-interactive) startup files such as $BASH_ENV.
	q. The `enable' builtin tries to load a loadable builtin using the default
	   search path if `enable name' (without any options) attempts to enable a
	   non-existent builtin.
	r. The `printf' builtin has a new format specifier: %Q. This acts like %q but
	   applies any specified precision to the original unquoted argument, then
	   quotes and outputs the result.
	s. The new `noexpand_translations' option controls whether or not the translated
	   output of $"..." is single-quoted.
	t. There is a new parameter transformation operator: @k. This is like @K, but
	   expands the result to separate words after word splitting.
	u. There is an alternate array implementation, selectable at `configure' time,
	   that optimizes access speed over memory use (use the new configure
	    --enable-alt-array-implementation option).
	v. If an [N]<&WORD- or [N]>&WORD- redirection has WORD expand to the empty
	   string, treat the redirection as [N]<&- or [N]>&- and close file descriptor
	   N (default 0).
	w. Invalid parameter transformation operators are now invalid word expansions,
	   and so cause fatal errors in non-interactive shells.
	x. New shell option: patsub_replacement. When enabled, a `&' in the replacement
	   string of the pattern substitution expansion is replaced by the portion of
	   the string that matched the pattern. Backslash will escape the `&' and
	   insert a literal `&'.
	y. `command -p' no longer looks in the hash table for the specified command.
	z. The new `--enable-translatable-strings' option to `configure' allows $"..."
	   support to be compiled in or out.
	aa. The new `globskipdots' shell option forces pathname expansion never to
	    return `.' or `..' unless explicitly matched. It is enabled by default.
	bb. Array references using `@' and `*' that are the value of nameref variables
	    (declare -n ref='v[@]' ; echo $ref) no longer cause the shell to exit if
	    set -u is enabled and the array (v) is unset.
	cc. There is a new bindable readline command name:
	    `vi-edit-and-execute-command'.
	dd. In posix mode, the `printf' builtin checks for the `L' length modifier and
	    uses long double for floating point conversion specifiers if it's present,
	    double otherwise.
	ee. The `globbing' completion code now takes the `globstar' option into account.
	ff. `suspend -f' now forces the shell to suspend even if job control is not
	   currently enabled.
	gg. Since there is no `declare -' equivalent of `local -', make sure to use
	    `local -' in the output of `local -p'.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-11-21 10:57:31 +00:00
Adolf Belka
d116f35a36 rust-iana-time-zone: Required by updated rust-chrono
- Install of version 0.1.51
- Definition of rootfile
- Creation of metadata patch to eliminate windows options

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2022-11-10 15:13:52 +00:00
Adolf Belka
9745d784b9 rust-chrono:Update to version 0.4.22 required by python3-cryptography
- Updated from version 0.4.19 to 0.4.22
- Update of rootfile
- Update of metadata patch as more windows related entries in Cargo.toml to be excluded
- Changelog
	## 0.4.22
		* Allow wasmbindgen to be optional on `wasm32-unknown-unknown` target [(#771)](https://github.com/chronotope/chrono/pull/771)
		* Fix compile error for `x86_64-fortanix-unknown-sgx` [(#767)](https://github.com/chronotope/chrono/pull/767)
		* Update `iana-time-zone` version to 1.44 [(#773)](https://github.com/chronotope/chrono/pull/773)
	## 0.4.21
		* Fall back to UTC timezone in cases where no timezone is found [(#756)](https://github.com/chronotope/chrono/pull/756)
		* Correctly detect timezone on Android [(#756)](https://github.com/chronotope/chrono/pull/756)
		* Improve documentation for strftime `%Y` specifier [(#760)](https://github.com/chronotope/chrono/pull/760)
	## 0.4.20
		* Add more formatting documentation and examples.
		* Add support for microseconds timestamps serde serialization/deserialization (#304)
		* Fix `DurationRound` is not TZ aware (#495)
		* Implement `DurationRound` for `NaiveDateTime`
		* Implement `std::iter::Sum` for `Duration`
		* Add `DateTime::from_local()` to construct from given local date and time (#572)
		* Add a function that calculates the number of years elapsed between now and a given `Date` or `DateTime` (#557)
		* Correct build for wasm32-unknown-emscripten target (#568)
		* Change `Local::now()` and `Utc::now()` documentation from "current date" to "current date and time" (#647)
		* Fix `duration_round` panic on rounding by `Duration::zero()` (#658)
		* Add optional rkyv support.
		* Add support for microseconds timestamps serde serialization for `NaiveDateTime`.
		* Add support for optional timestamps serde serialization for `NaiveDateTime`.
		* Fix build for wasm32-unknown-emscripten (@yu-re-ka #593)
		* Make `ParseErrorKind` public and available through `ParseError::kind()` (#588)
		* Implement `DoubleEndedIterator` for `NaiveDateDaysIterator` and `NaiveDateWeeksIterator`
		* Fix panicking when parsing a `DateTime` (@botahamec)
		* Add support for getting week bounds based on a specific `NaiveDate` and a `Weekday` (#666)
		* Remove libc dependency from Cargo.toml.
		* Add the `and_local_timezone` method to `NaiveDateTime`
		* Fix the behavior of `Duration::abs()` for negative durations with non-zero nanos
		* Add compatibility with rfc2822 comments (#733)
		* Make `js-sys` and `wasm-bindgen` enabled by default when target is `wasm32-unknown-unknown` for ease of API discovery
		* Add the `Months` struct and associated `Add` and `Sub` impls

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2022-11-10 15:13:52 +00:00
Adolf Belka
634f46dc34 zlib: Update to version 1.2.13
- Update from version 1.2.12 to 1.2.13
- Update of rootfile
- Patches for CVE-2022-37434 removed as they are now integarted in the source tarball
- Changelog
    Changes in 1.2.13 (13 Oct 2022)
	- Fix configure issue that discarded provided CC definition
	- Correct incorrect inputs provided to the CRC functions
	- Repair prototypes and exporting of new CRC functions
	- Fix inflateBack to detect invalid input with distances too far
	- Have infback() deliver all of the available output up to any error
	- Fix a bug when getting a gzip header extra field with inflate(CVE-2022-37434)
	- Fix bug in block type selection when Z_FIXED used
	- Tighten deflateBound bounds
	- Remove deleted assembler code references
	- Various portability and appearance improvements

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-11-08 11:10:59 +00:00
Michael Tremer
77e1061bf9 misc-progs: wirelessctrl: Fix missing whitespace for log prefix
Fixes: #12978
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-11-03 15:13:10 +00:00
Robin Roevens
24168c8898 misc-progs: addonctrl: Add support for 'Services' metadata
* Addonctrl will now check in addon metadata for the exact initscript
  names (Services). If more than one initscript is defined for an addon,
  the requested action will be performed on all listed initscripts.
* Added posibility to perform action on a specific initscript of an
  addon instead of on all initscripts of the addon.
* New action 'list-services' to display a list of services related to
  an addon.
* New action 'boot-status' to display wether service(s) are enabled
  to start on boot or not.
* More error checking and cleaner error reporting to user
* General cleanup and code restructuring to avoid code duplication
* Updated and made usage instructions more verbose.

Fixes: Bug#12935
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-10-29 08:56:48 +00:00
Matthias Fischer
3e5190f5c7 samba: Update to 4.17.0
For details see:
https://www.samba.org/samba/latest_news.html#4.17.0

This "just came my way" and I found the CVEs listed on
https://www.samba.org/samba/history/security.html which
address "All versions of Samba prior to 4.16.4" or
"All versions of Samba" rather long.

The 'glibc_headers' patch is now included.

Sad to say, due to the lack of hardware I can only include
the rootfile for x86_64.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
2022-10-24 09:08:01 +00:00
Michael Tremer
e420c103de openvpnctrl: Update CRL before starting the client daemon
If the CRL is outdated for some reason (e.g. a backup restored from ISO
where we don't run the migration scripts), this will update it on
reboot/restart of the service.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-10-24 09:06:16 +00:00
Peter Müller
0d0bfd0e5c libloc: Update to 0.9.15
Please refer to https://lists.ipfire.org/pipermail/location/2022-September/000579.html
for the release announcement of this version.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-10-24 08:57:25 +00:00
Peter Müller
ee2e7db90b linux: Add upstream patches for CVE-2022-4{1674,2719-2722}
https://lists.ipfire.org/pipermail/development/2022-October/014562.html

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-10-17 16:26:19 +00:00
Michael Tremer
692d18285f glibc: Fix added whitespace in syslog messages
Fixes: #12949
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-10-10 09:32:56 +00:00
Mathew McBride
9745a212d4 initscripts: load RTC module (RX8025) for Ten64 board
For reasons I have not been able to determine, the RTC
module for the Ten64 board (rtc-rx8025) is not automatically
loaded at startup, despite every other relevant modules being
loaded.

modprobe it manually if we are on a Ten64 board.

Signed-off-by: Mathew McBride <matt@traverse.com.au>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-10-04 14:45:19 +00:00
Mathew McBride
e77ef36395 kernel: add patches for SFP support on NXP Layerscape/DPAA2 (arm64)
These two patches are needed to support SFP's on NXP DPAA2 platforms
(e.g Traverse Ten64).

The deadlock issue patch was submitted upstream a while ago and
rejected, however I am not aware of any better solutions at present.

The 10G mode additions are part of mainline since 5.16.

These two .patches were sourced from our patchset over here:
https://gitlab.com/traversetech/traverse-kernel-patches/-/tree/lts-5-15/patches

Signed-off-by: Mathew McBride <matt@traverse.com.au>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-10-04 14:45:19 +00:00
Adolf Belka
a4e5b6d689 rsync: Update to version 3.2.6 and fix Bug#12947
- Update from version 3.2.4 plus CVE-2022-29154 patch to 3.2.6
- Patch for CVE-2022-29154 applied  in CU170 turned out to have a bug within it causing
   rsync to fail with an error. Four additional commits were done to fix this bug and
   its consequences but these were all applied in the rsync git repo after the patch had
   been merged into CU170.
- Version 3.2.5 onwards contains the CVE-2022-29154 fix and associated commits.
- No update of rootfile required.
- Changelog
    NEWS for rsync 3.2.6 (9 Sep 2022)
	BUG FIXES:
	    More path-cleaning improvements in the file-list validation code to avoid
             rejecting of valid args.
	    A file-list validation fix for a --files-from file that ends without a
             line-terminating character.
	    Added a safety check that prevents the sender from removing destination
             files when a local copy using --remove-source-files has some files that are
             shared between the sending & receiving hierarchies, including the case
             where the source dir & destination dir are identical.
	    Fixed a bug in the internal MD4 checksum code that could cause the digest to
             be sporadically incorrect (the openssl version was/is fine).
	    A minor tweak to rrsync added "copy-devices" to the list of known args, but
             left it disabled by default.
	ENHANCEMENTS:
	    Rename --protect-args to --secluded-args to make it clearer how it differs
             from the default backslash-escaped arg-protecting behavior of rsync. The
             old option names are still accepted. The environment-variable override did
             not change its name.
	PACKAGING RELATED:
	    The configure option --with-protected-args was renamed to
             --with-secluded-args. This option makes --secluded-args the default rsync
             behavior instead of using backslash escaping for protecting args.
	    The mkgitver script now makes sure that a .git dir/file is in the top-level
             source dir before calling git describe. It also runs a basic check on the
             version value. This should avoid using an unrelated git description for
             rsync's version.
	DEVELOPER RELATED:
	    The configure script no longer sets the -⁠pedantic-errors CFLAG (which it
             used to try to do only for gcc).
	    The name_num_obj struct was modified to allow its dynamic name_num_item list
             to be initialized in a better way.
    NEWS for rsync 3.2.5 (14 Aug 2022)
	SECURITY FIXES:
	    Added some file-list safety checking that helps to ensure that a rogue
             sending rsync can't add unrequested top-level names and/or include
             recursive names that should have been excluded by the sender. These extra
             safety checks only require the receiver rsync to be updated. When dealing
             with an untrusted sending host, it is safest to copy into a dedicated
             destination directory for the remote content (i.e. don't copy into a
             destination directory that contains files that aren't from the remote host
             unless you trust the remote host). Fixes CVE-2022-29154.
	    A fix for CVE-2022-37434 in the bundled zlib (buffer overflow issue).
	BUG FIXES:
	    Fixed the handling of filenames specified with backslash-quoted wildcards
             when the default remote-arg-escaping is enabled.
	    Fixed the configure check for signed char that was causing a host that
             defaults to unsigned characters to generate bogus rolling checksums. This
             made rsync send mostly literal data for a copy instead of finding matching
             data in the receiver's basis file (for a file that contains high-bit
             characters).
	    Lots of manpage improvements, including an attempt to better describe how
             include/exclude filters work.
	    If rsync is compiled with an xxhash 0.8 library and then moved to a system
             with a dynamically linked xxhash 0.7 library, we now detect this and
             disable the XX3 hashes (since these routines didn't stabilize until 0.8).
	ENHANCEMENTS:
	    The --trust-sender option was added as a way to bypass the extra file-list
             safety checking (should that be required).
	PACKAGING RELATED:
	    A note to those wanting to patch older rsync versions: the changes in this
             release requires the quoted argument change from 3.2.4. Then, you'll want
             every single code change from 3.2.5 since there is no fluff in this release.
	    The build date that goes into the manpages is now based on the developer's
             release date, not on the build's local-timezone interpretation of the date.
	DEVELOPER RELATED:
	    Configure now defaults GETGROUPS_T to gid_t when cross compiling.
	    Configure now looks for the bsd/string.h include file in order to fix the
             build on a host that has strlcpy() in the main libc but not defined in the
             main string.h file.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-10-04 14:44:50 +00:00
Peter Müller
5a44d68fc7 ncat: Update to 7.92
This was forgotten when updating nmap to 7.92.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-09-30 21:18:38 +00:00
Matthias Fischer
b655b21a45 suricata: Update to 6.0.8
Changelog:

"6.0.8 -- 2022-09-27

Task #5552: libhtp 0.5.41

6.0.7 -- 2022-09-27

Security #5430: mqtt: DOS by quadratic with too many transactions in one parse (6.0.x backport)
Bug #5559: BUG_ON triggered from TmThreadsInjectFlowById (6.0.x backport)
Bug #5549: Failed assert DeStateSearchState (6.0.x)
Bug #5548: tcp: assertion failed in DoInsertSegment (BUG_ON) (6.0.x)
Bug #5547: rules: less strict parsing of unexpected flowbit options
Bug #5546: rules: don't error on bad hex in content
Bug #5540: detect: transform strip whitespace creates a 0-sized variable-length array: backport6
Bug #5505: http2: slow http2_frames_get_header_value_vec because of allocation [backport6]
Bug #5471: Reject action is no longer working (6.0.x backport)
Bug #5467: rules: more graceful handling of anomalies for stable versions
Bug #5459: Counters are not initialized in all places. (6.0.x backport)
Bug #5448: nfs: add maximum number of operations per compound (6.0.x backport)
Bug #5436: Infinite loop if the sniffing interface temporarily goes down (6.0.x backports)
Bug #5335: flow: vlan.use-for-tracking is not used for ICMPv4 (6.0.x backport)
Bug #4421: flow manager: using too much CPU during idle (6.0.x backport)
Feature #5535: ips: add "reject" action to exception policies (6.0.x backport)
Feature #5500: ips: midstream: add "exception policy" for midstream (6.0.x backport)
Task #5551: doc: add exception policy documentation (6.0.x)
Task #5533: detect/parse: add tests for parsing signatures with reject and drop action (6.0.x backport)
Task #5525: exceptions: error out when invalid configuration value is passed (6.0.x backport)
Task #5381: add `alert-queue-expand-fails` command-line option (6.0.x backport)
Task #5328: python: distutils deprecation warning (6.0.x backport)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-09-30 15:45:58 +00:00
Adolf Belka
c799e441a4 backupiso: Update to ISO file naming - bug#12932
- commit https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=fbd0608c2cb5372fff7857065ec7e605b1bf9cf7
   aligned the ISO file name to the image file name. This change also needed to be added
   to backupiso as the filename is used to download the iso from the IPFire server when
   creating an ISO backup.

Fixes: Bug#12932
Suggested-by: Matthias Fischer <matthias.fischer@ipfire.org>
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
2022-09-19 12:36:52 +00:00
Peter Müller
3890da81da curl: Fix build on armv6l
https://github.com/curl/curl/pull/9054

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-09-15 19:36:29 +00:00
Adolf Belka
922747b205 efivar: Update to version 38
- Update from version 37 to 38
- Update of rootfile
- mandoc is now a build dependency for efivar
- Old compile fixes patches are no longer required with version 38
- Details for lfs build of version 38 obtained from Beyond Linux From Scratch
- Changelog
   bug fixes
    Rework some makefile bits to make overriding some options simpler. by @vathpela in #140
    Handle /sys/devices/virtual/{nvme-fabrics,nvme-subsystem} devices by @vathpela in #139
    guids.S: Include <cet.h> when CET is enabled by @hjl-tools in #149
    Fix /sys/block sysfs parsing for eMMC-s by @jwrdegoede in #150
    Properly check mmap return error by @hannob in #152
    Fix s{yt,ty}le typo in efi_get_variable(3) by @nabijaczleweli in #162
    Handle NULL set_variable() by @lcp in #159
    Fix parsing for nvme-subsystem devices by @dannf in #158
    Attempt to fix the identified thread safety bugs by @vathpela in #155
    Make thread-test depend on libefivar.so by @hjl-tools in #176
    Upstream a local patch from rawhide by @frozencemetery in #177
    Fix conversion from UTF8 to UCS2 by @freedge in #171
    efivar: make docs match current code for 'efivar -A' by @vathpela in #178
    Migrate CI to Github actions by @frozencemetery in #179
    Add code of conduct by @frozencemetery in #180
    Misc minor fixes by @vathpela in #182
    Add efi_time_t declarations and helper functions. by @vathpela in #183
    More misc fixes by @vathpela in #185
    Run CI on more targets by @vathpela in #187
    Coverity fixes 20211208 by @vathpela in #189
    CI: run abicheck by @frozencemetery in #190
    Fix linux virtual root device parsing by @vathpela in #188
    efivar.spec.in: fix license to be valid SPDX by @frozencemetery in #192
    Add efisecdb tooling by @vathpela in #184
    Fix linker string comparison for dash by @frozencemetery in #194
   Full changelog diff between version 37 and 38 is available in github repo
    https://github.com/rhboot/efivar/compare/37...38

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-09-12 09:48:04 +00:00
Michael Tremer
2743dd7eba installer: Fix build against glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
cc388c104e syslinux: Fix build against glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
34097d0bd3 libvirt: Fix build against glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
9060a9c907 collected: Fix build with glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
692416302c qemu: Fix build against glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
b621245815 samba: Fix build with glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
fac5f144bb hdparm: Fix build with glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
03d57d8f1e libarchive: Fix build with glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
79c4be107d efivars: Fix build with glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
7eda830bfd gcc: Fix build against glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
11bea269b0 sysvinit: Fix build against glibc 2.36
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 08:36:17 +00:00
Michael Tremer
cc826e8628 setaliases: Use "secondary" flag instead of scope
The scope option does not seem to work at all now, which is surprising
since I tested it quite well.

The secondary flag cannot be set from userspace (aparently), but it
works, so I would prefer to go with this option for now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-09-11 07:40:46 +00:00
Peter Müller
532c31c529 dbus: Fix "statusproc" call in initscript
Fixes: #12916
Tested-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-09-01 20:36:18 +00:00
Robin Roevens
85bfecc0ba Fix bug 12908 - Correct getipstat pcount 2022-08-17 21:21:32 +00:00
Peter Müller
59b95d4e26 zlib: Add fix for CVE-2022-37434 fix
https://www.openwall.com/lists/oss-security/2022/08/09/1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2022-08-10 10:50:57 +00:00
Michael Tremer
c4fc6eb017 nqptp: New package
This is a PTP clock synchronisation daemon.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2022-08-10 10:44:31 +00:00
Peter Müller
4865b7f6b8 Revert "Revert "kernel: update to 5.15.59""
This reverts commit f25f1b55af.
2022-08-08 13:17:30 +00:00
Michael Tremer
06cb5c1bb7 installer: Increase size of /boot to 256 MiB
On some installations, we are running out of space on the /boot
partition due to growing sizes of the ramdisk and the kernel.

To accomodate for that and have room to grow in the future, we increase
the size of the partition to 256 MiB.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-08-08 10:12:43 +00:00
Peter Müller
30f0ea198d zlib: Incorporate fix for CVE-2022-37434
https://www.cve.org/CVERecord?id=CVE-2022-37434

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-08-08 10:11:09 +00:00
Peter Müller
f25f1b55af Revert "kernel: update to 5.15.59"
This reverts commit 43df4a0373.
2022-08-08 10:10:35 +00:00
Arne Fitzenreiter
43df4a0373 kernel: update to 5.15.59
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2022-08-06 07:45:02 +00:00
Peter Müller
849eeec292 rsync: Patch CVE-2022-29154
https://www.openwall.com/lists/oss-security/2022/08/02/1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-08-06 06:45:39 +00:00
Peter Müller
7ee41667d0 Bash: Update to 5.1.16
This is a maintenance release that bundles all the previously added
patches, which have therefore been deleted.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2022-08-03 10:56:22 +00:00
Robin Roevens
2be67e3841 pakfire: Add getmetadata function
- Added new getmetadata function for easy access to all available
  metadata of a pak without knowledge about or need to parse
  pakfire internal db files.
- Added new 'pakfire info' functionality for displaying all available
  metadata of (a) pak(s) to the user, using the new getmetadata.

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
2022-07-28 13:44:29 +00:00
Robin Roevens
074b509724 pakfire: Refactor status seperating UI and logic
- Removed UI code from status function now returning hash with status
  properties.
- Removed function coreupdate_available as it is now not used anymore
- Added UI code to pakfire status routine
- Added meaningfull exitcode to status:
  - 2: Core update available
  - 3: Pak update available
  - 4: Reboot required
  - Error codes can be added together: 2+3 = 5 means both core update
    and pak update is available

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
2022-07-28 13:44:29 +00:00
Robin Roevens
2b921b796d pakfire: Add list upgrade functionality
- Added possibility to list available upgrades from commandline
  using 'pakfire list upgrade'.
- Added exitcode to 'pakfire list'
- Moved 'Pakfire has finished' log message inside END block to
  always log when pakfire exited.
- Fix: allow [options] between 'list' and [installed/notinstalled/
  upgrade] parameters (Partly fixes Bug #12868)

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
2022-07-28 13:44:29 +00:00
Robin Roevens
5e1dbc95f7 pakfire: Optimize upgradecore function
upgradecore function should just upgrade the core:
Moved check if upgrade is necessary to pakfire upgrade code, removing
code from upgradecore function duplicating codedbinfo workings.
Also adding more vebosity to pakfire upgrade.

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
2022-07-28 13:44:29 +00:00
Robin Roevens
c6d055a85b pakfire: Replace dbgetlist duplicate code
Replace dbgetlist code duplicating dblist and getmetafile
workings with call to actual dblist and getmetafile functions.

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
2022-07-28 13:44:29 +00:00
Robin Roevens
4bac9fdd12 pakfire: Replace duplicate code with dblist functioncall
Replace pakfire install code duplicating dblist working with call
to actual dblist function.

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
2022-07-28 13:44:29 +00:00