These rulefiles are used by various providers as a kind of reference and
to store rules which have been taken out for correctness, performance
reasons or because of other reasons.
Fixes#12794.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
OpenSSL Security Advisory [15 March 2022]
============================================
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(CVE-2022-0778)
==================================================================================
Severity: High
The BN_mod_sqrt() function, which computes a modular square root,
contains
a bug that can cause it to loop forever for non-prime moduli.
Internally this function is used when parsing certificates that contain
elliptic curve public keys in compressed form or explicit elliptic curve
parameters with a base point encoded in compressed form.
It is possible to trigger the infinite loop by crafting a certificate
that
has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the
certificate
signature, any process that parses an externally supplied certificate
may thus
be subject to a denial of service attack. The infinite loop can also be
reached when parsing crafted private keys as they can contain explicit
elliptic curve parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from customers
- Certificate authorities parsing certification requests from
subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the
attacker
can control the parameter values are vulnerable to this DoS issue.
In the OpenSSL 1.0.2 version the public key is not parsed during initial
parsing of the certificate which makes it slightly harder to trigger
the infinite loop. However any operation which requires the public key
from the certificate will trigger the infinite loop. In particular the
attacker can use a self-signed certificate to trigger the loop during
verification of the certificate signature.
This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was
addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022.
OpenSSL 1.0.2 users should upgrade to 1.0.2zd (premium support customers
only)
OpenSSL 1.1.1 users should upgrade to 1.1.1n
OpenSSL 3.0 users should upgrade to 3.0.2
This issue was reported to OpenSSL on the 24th February 2022 by Tavis
Ormandy
from Google. The fix was developed by David Benjamin from Google and
Tomáš Mráz
from OpenSSL.
Note
====
OpenSSL 1.0.2 is out of support and no longer receiving public updates.
Extended
support is available for premium support customers:
https://www.openssl.org/support/contracts.html
OpenSSL 1.1.0 is out of support and no longer receiving updates of any
kind.
It is affected by the issue.
Users of these versions should upgrade to OpenSSL 3.0 or 1.1.1.
References
==========
URL for this Security Advisory:
https://www.openssl.org/news/secadv/20220315.txt
Note: the online version of the advisory may be updated with additional
details
over time.
For details of OpenSSL severity classifications please see:
https://www.openssl.org/policies/secpolicy.html
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Only extract rulefiles which are located in a rules directory and/or in the archive
root.
This prevents us from extracting experimental or binary rules etc. which
often are located in corresponding sub-directories.
Reference: #12794.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
The current setup can fail and block all traffic on RED if the RETURN
rules could not be created.
This can happen when the kernel fails to load the ipset module, as it is
the case after upgrading to a new kernel. Restarting the firewall will
cause that the system is being cut off the internet.
This design now changes that if those rules cannot be created, the
DROP_HOSTILE feature is just inactive, but it would not disrupt any
traffic.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This file contains our custom settings:
* Always load microcodes as early as possible
* We now compress the initrd using Zstandard which is substanstically
faster than XZ, but offers better compression ratios
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
To solve the behavior discribed in bug 12404 I added the path
/var/ipfire/cups to the backup.
Signed-off-by: Daniel Weismueller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.50.0 to 1.50.4
- Update of rootfile
- Changelog
Overview of changes in 1.50.4, 09-02-2022
* Tweak synthetic space sizes
* itemize: Try harder to avoid NULL fonts
* docs: Some additions
* Pass synthetic slant to harfbuzz
* Make sloped carets work with uneven scales
* Fix serialiation on arm
* Avoid an uninitialized variable warning
* Reinstate previous behavior of pango_attr_list_splice
* Deprecated pango_coverage_ref/unref
* Fix serialization on non-glibc systems
* Fix allow-breaks handling
Overview of changes in 1.50.3, 21-12-2021
* pango-view: Add --serialize-to option for easy bug reporting
* Revert a transformation change that broke metrics for vertical text
* Handle fonts without space glyph (such as icon fonts) better
* Fix some corner cases of line width accounting
* Fix line height with emulated Small Caps
Overview of changes in 1.50.2, 16-12-2021
* Fix a problem with font fallback for Arabic
* Fix handling of fonts without a space glyph
* Various documentation improvements
* Fix build issues
Overview of changes in 1.50.1, 10-12-2021
* Fix a crash in tab handling
* Fix tab positioning without line wrapping
* Fix an assertion failure found by fuzzing
* Make underlines work again for broken fonts
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 3.21.6 to 3.22.2
- Update of rootfile
- Changelog
HPLIP 3.22.2 - This release has the following changes:
Added support for following new Distro's:
Elementary OS 6.1
RHEL 8.5
Linux Mint 20.3
Added support for the following new Printers:
HP LaserJet Tank MFP 1602a
HP LaserJet Tank MFP 1602w
HP LaserJet Tank MFP 1604w
HP LaserJet Tank MFP 2602dn
HP LaserJet Tank MFP 2602sdn
HP LaserJet Tank MFP 2602sdw
HP LaserJet Tank MFP 2602dw
HP LaserJet Tank MFP 2604dw
HP LaserJet Tank MFP 2604sdw
HP LaserJet Tank MFP 2603dw
HP LaserJet Tank MFP 2603sdw
HP LaserJet Tank MFP 2605sdw
HP LaserJet Tank MFP 2606dn
HP LaserJet Tank MFP 2606sdn
HP LaserJet Tank MFP 2606sdw
HP LaserJet Tank MFP 2606dw
HP LaserJet Tank MFP 2606dc
HP LaserJet Tank MFP 1005
HP LaserJet Tank MFP 1005w
HP LaserJet Tank MFP 1005nw
HP LaserJet Tank 1502a
HP LaserJet Tank 1502w
HP LaserJet Tank 1504w
HP LaserJet Tank 2502dw
HP LaserJet Tank 2502dn
HP LaserJet Tank 2504dw
HP LaserJet Tank 2503dw
HP LaserJet Tank 2506dw
HP LaserJet Tank 2506d
HP LaserJet Tank 2506dn
HP LaserJet Tank 1020
HP LaserJet Tank 1020w
HP LaserJet Tank 1020nw
HPLIP 3.21.12- This release has the following changes:
Added support for following new Distro's:
MX Linux 21
Elementary OS 6
Fedora 35
HPLIP 3.21.10 - This release has the following changes:
Added support for following new Distro's:
Ubuntu 21.10
Debian 11
Zorin 15
Zorin 16
Added support for the following new Printers:
HP ENVY Inspire 7200e series
HP ENVY Inspire 7900e series
HP LaserJet MFP M140a
HP LaserJet MFP M139a
HP LaserJet MFP M141a
HP LaserJet MFP M142a
HP LaserJet MFP M140w
HP LaserJet MFP M140we
HP LaserJet MFP M139w
HP LaserJet MFP M139we
HP LaserJet MFP M141w
HP LaserJet MFP M141we
HP LaserJet MFP M142we
HP LaserJet MFP M142w
HP LaserJet M109a
HP LaserJet M110a
HP LaserJet M111a
HP LaserJet M112a
HP LaserJet M109w
HP LaserJet M109we
HP LaserJet M110w
HP LaserJet M110we
HP LaserJet M111w
HP LaserJet M111we
HP LaserJet M112we
HP LaserJet M112w
HP DesignJet Z6 Pro 64in
HP DesignJet Z9 Pro 64in
HP PageWide XL Pro 5200 PS MFP series
HP PageWide XL Pro 8200 PS MFP series
HP PageWide XL 3920 MFP
HP PageWide XL 4200 Printer
HP PageWide XL 4200 Multifunction Printer
HP PageWide XL 4700 Printer
HP PageWide XL 4700 Multifunction Printer
HP PageWide XL 5200 Printer
HP PageWide XL 5200 Multifunction Printer
HP PageWide XL 8200 Printer
HPLIP 3.21.8 - This release has the following changes:
Added support for following new Distro's:
Linux Mint 20.2
RHEL 8.4
Manjaro 21.0.7
Added support for the following new Printers:
HP Smart Tank 500 series
HP Smart Tank 530 series
HP Smart Tank Plus 570 series
HP Smart Tank 7600
HP Smart Tank 750
HP Smart Tank 790
HP Smart Tank Plus 710-720
HP Smart Tank Plus 7000
HP Smart Tank Plus 660-670
HP Smart Tank Plus 6000
HP DeskJet Ink Advantage Ultra 4800 All-in-One Printer series
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.18.188 to 1.22.64
- Update of rootfile
- Ran aws in shell and got help response so it is working in principle
- Changelog is too large, with nearly 1700 lines, to include here as there appears to be
a new release nearly every day. so there are a huge number of releases between 1.18.188
from Dec 2nd 2020 to 1.22.64 from Feb 28 2022. It appears that only at weekends no
releases are done. Full changelog can be viewed at
https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 2017.3.23 to 2021.8.22
- Update of rootfile
- Added link to mkfs.ntfs in lfs to provide the binary in sbin as the new package places it
in usr/sbin
- Ran find-dependencies and no problems flagged up.
- Changelog
Stable Version 2021.8.22 (August 30, 2021)
Fixed compile error when building with libfuse < 2.8.0
Fixed obsolete macros in configure.ac
Signalled support of UTIME_OMIT to external libfuse2
Fixed an improper macro usage in ntfscp.c
Updated the repository change in the README
Fixed vulnerability threats caused by maliciously tampered NTFS partitions
Stable Version 2017.3.23AR.6 (February 1, 2021)
Used kernel cacheing on read-only mounts or with lowntfs-3g
Avoided information leak when processing garbled compressed data
Defined option posix_nlink to compute a Posix compliant st_nlink
Recovered space when an index root is shortened
Replaced ENODATA with ENOATTR in xattrs functions for macOS
Added support for 'position' argument in macOS xattr functions
Changed default xattr access method to 'openxattr' for macOS builds
Allowed redefining the target location of the ntfsprogs tools
Fixed updating the allocated size when attribute lies in an extent
Enabled actions on directories in reparse plugins
Inserted the reparse tag in the bad reparse symlink
Supported use of WSL special files
Dropped rejecting having both EA and reparse data
Enabled Creating special files the same way as WSL
Checked the locations of MFT and MFTMirr at startup
Stable Version 2017.3.23AR.5 (April 1, 2020)
Processed the request argument of ioctl() as unsigned
Accepted alternative recording of cluster size
Fixed a poorly sized string in ntfsinfo
Fixed ntfsfallocate on a void file
Decoded execlink reparse points
Fixed object type returned in readdir() for reparse points
Exported the translations of Windows paths to current ones
Stable Version 2017.3.23AR.4 (March 1, 2019)
Fixed reporting an error when failed to build the mountpoint
Reverted accessing reparse directory through internal plugins
Cleaned object ids beyond the updated part
Fixed reacting to missing plugin
Returned a low level error when an ioctl fails
Truncated SSD trimming zones to granularity supported by the device
Stable Version 2017.3.23AR.3 (September 1, 2018)
Made sure log file buffers are properly aligned
Made reparse directories visible through internal plugins
Added an option to ntfscp to copy the modification time
Renamed undeleted files to avoid overwriting existing ones
Extended the allowed cluster size to 2MB
Allocated full clusters for reading and rescuing in ntfsclone
Prevented locally defined headers from interfering with ntfs-3g ones
Attempted mounting read-only after failed permission to read-write
Fixed collecting the label argument in mkntfs
Stable Version 2017.3.23AR.2 (March 1, 2018)
Made sure log file buffers are properly aligned
Checked log file blocks more recent than temporary ones
Processed redo log actions associated to undoing a CompensationlogRecord
Allowed setting a file object id without defining its birth ids
Documented read-only mount when Windows is hibernated
Stopped checking matches of MFTMirr against MFT at record 16
Filtered out reparse flags for selecting plugins
Delayed updating the MFT runlist when resizing in read-only mode
Double-checked whether record 15 is an extent of MFT
Checked whether the device to mount was forced read-only
Stable Version 2017.3.23AR.1 (October 1, 2017)
Bypassed cluster allocation errors using --ignore-fs-check in ntfsclone
Upgraded ntfsrecover to support log files for Windows 10
Fixed the computation of highest_vcn when applying a runlist fixup
Fixed updating the vcn of subtree in ntfsrecover
Relaxed checks on security descriptors
Enabled directory operations in plugins
Decoded more reparse tags in ntfsinfo
Logged falling back to mounting read-only
Fixed compiling on MacOSX (Erik Larsson)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 1.11 (2005) to 1.14 (2020)
- Update of rootfile
- find-dependencies run and no problems flagged
- Package was originally provided by Dug Song in source forge and with a github repository
No response was received from Dug Song to requests for updates and fixes so Oliver Falk
forked the repository and has been working on it and now the Dug Song repository is no
longer present and the old repoistory url redirects to the new ofalk repository
https://github.com/ofalk/libdnet
- Issues raised in this new repository are being actively responded to
- Changelog comment is
Finally release 1.14 with latest fixes included.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 3.1.2 to 3.4.0
- Update of rootfile
- Changelog
3.4.0
Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY. (Behdad Esfahbod)
Arabic Mark Transient Reordering Algorithm have been updated to revision 6. (Khaled Hosny)
ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag. (Alexis King)
It is now possible to get at once all math kerning values for a given glyph at a given corner. (Alexis King)
Fix locale_t portability issues on systems the typedef’s it to a void pointer. (Behdad Esfahbod)
New API:
+HB_BUFFER_FLAG_VERIFY
+HB_OT_TAG_MATH_SCRIPT
+HB_SCRIPT_MATH
+hb_ot_math_kern_entry_t
+hb_ot_math_get_glyph_kernings
Deprecated API
+HB_OT_MATH_SCRIPT
3.3.2
Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic. (Behdad Esfahbod)
3.3.1
Fix heap-use-after-free in harfbuzz-subset introduced in previous release. (Garret Rieger)
3.3.0
Improved documentation. (Matthias Clasen)
Internal code cleanup, using C++ standard library more. (Behdad Esfahbod)
The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance. (Behdad Esfahbod)
Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts. (Behdad Esfahbod)
Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation. (Matthias Clasen)
When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs. (Behdad Esfahbod)
Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details. (Behdad Esfahbod)
Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags. (David Corbett)
New API:
+HB_GLYPH_FLAG_UNSAFE_TO_CONCAT
+hb_segment_properties_overlay()
+hb_buffer_create_similar()
+hb_font_set_synthetic_slant()
+hb_font_get_synthetic_slant()
+hb_font_get_var_coords_design()
3.2.0
harfbuzz library improvements:
Fixed shaping of Apple Color Emoji flags in right-to-left context. (Behdad Esfahbod)
Fixed positioning of CFF fonts in HB_TINY profile. (Behdad Esfahbod)
OpenType 1.9 language tags update. (David Corbett)
Add HB_NO_VERTICAL config option. (Behdad Esfahbod)
Add HB_CONFIG_OVERRIDE_H for easier configuration. (Behdad Esfahbod)
harfbuzz-subset library improvements:
Improved packing of cmap, loca, and Ligature tables. (Garret Rieger)
Significantly improved overflow-resolution strategy in the repacker. (Garret Rieger)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Sometimes, we restore a backup that has been created earlier before
exclude files have been changed. To avoid overwriting those files, we
will consider the exlude list upon restore.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This file is a system configuration file and does not contain any
configruation from the user.
Since it can be overwritten in a backup and restored to an older state,
this can cause problems such as #12788.
Fixes: #12788
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
We are almost running as an unprivileged user and therfore have not
the permissions to do this.
This will save us a lot of confusion error messages.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
