Michael Tremer [Tue, 3 Sep 2024 18:00:17 +0000 (18:00 +0000)]
openssl: Update to 3.3.2
Possible denial of service in X.509 name checks (CVE-2024-6119)
===============================================================
Severity: Moderate
Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address resulting in abnormal termination of the application process.
Impact summary: Abnormal termination of an application can a cause a denial of
service.
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an `otherName` subject alternative name of an
X.509 certificate. This may result in an exception that terminates the
application program.
Note that basic certificate chain validation (signatures, dates, ...) is not
affected, the denial of service can occur only when the application also
specifies an expected DNS name, Email address or IP address.
TLS servers rarely solicit client certificates, and even when they do, they
generally don't perform a name check against a "reference identifier" (expected
identity), but rather extract the presented identity after checking the
certificate chain. So TLS servers are generally not affected and the severity
of the issue is Moderate.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
OpenSSL 1.1.1 and 1.0.2 are also not affected by this issue.
OpenSSL 3.3, 3.2, 3.1 and 3.0 are vulnerable to this issue.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Aug 2024 15:28:42 +0000 (15:28 +0000)]
make.sh: Bind-mount /proc as a workaround for unshare
unshare seems to want to change the mount propagation for /proc
before it has been mounted. In order to workaround that problem,
we bind-mount /proc to itself before.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Mon, 26 Aug 2024 12:24:19 +0000 (14:24 +0200)]
openssl: Update to version 3.3.1
- Update from 3.3.0 to 3.3.1
- Update of rootfile not required
- This version has 2 CVE fixes both of which are classified as Low Severity so looks like
they can wait for CU189
- Changelog
3.3.1
* Fixed potential use after free after SSL_free_buffers() is called.
The SSL_free_buffers function is used to free the internal OpenSSL
buffer used when processing an incoming record from the network.
The call is only expected to succeed if the buffer is not currently
in use. However, two scenarios have been identified where the buffer
is freed even when still in use.
The first scenario occurs where a record header has been received
from the network and processed by OpenSSL, but the full record body
has not yet arrived. In this case calling SSL_free_buffers will succeed
even though a record has only been partially processed and the buffer
is still in use.
The second scenario occurs where a full record containing application
data has been received and processed by OpenSSL but the application has
only read part of this data. Again a call to SSL_free_buffers will
succeed even though the buffer is still in use.
([CVE-2024-4741])
* Fixed an issue where checking excessively long DSA keys or parameters may
be very slow.
Applications that use the functions EVP_PKEY_param_check() or
EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
experience long delays. Where the key or parameters that are being checked
have been obtained from an untrusted source this may lead to a Denial of
Service.
To resolve this issue DSA keys larger than OPENSSL_DSA_MAX_MODULUS_BITS
will now fail the check immediately with a DSA_R_MODULUS_TOO_LARGE error
reason.
([CVE-2024-4603])
* Improved EC/DSA nonce generation routines to avoid bias and timing
side channel leaks.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 21 Aug 2024 09:10:33 +0000 (10:10 +0100)]
unbound-dhcp-leases-bridge: Watch unbound
This patch adds a watcher thread which monitors if Unbound is still
alive. If not, it will wait until Unbound comes back, rewrite the leases
file and reload Unbound to get it back into sync.
Afterwards Unbound will receive updates as usual.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 19 Aug 2024 18:13:19 +0000 (19:13 +0100)]
AQM: Revert back to only use fq_codel by default
We have defaulted to CAKE for all devices that quality. That has however
resulted in worse network quality as some devices could not provide the
compute power necessary for CAKE. There are however only very few
benefits to run an unconfigured CAKE.
This patch changes this back to fq_codel which is computationally
cheaper and should deliver 99% of the throughput that CAKE does. This is
presumably the better trade-off.
We don't use fq_codel on wireless devices since the kernel is running
this for each client. It would have been nice to only apply this to
wireless interfaces in AP mode, but I cannot find a way to tell the
difference with asking NETLINK.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 7 Aug 2024 14:02:20 +0000 (16:02 +0200)]
backup.pl: Fixes bug13734 - tar treats colon in filename as remote location
- When a user tries to restore on the console from a backup on IPFire that has a colon in
the filename the tar treats this as meaning that everything after the colon is
information about a remote location to do the extraction to. This results in a filename
that cannot be found, and a remote location that is not correct and the tar operation
fails.
- This has been confirmed by myself.
- If the user tries a restore from a file downloaded to another computer then for most, if
not all browsers, the colon will have been replaced by an underscore or other character.
Firefox, Chromium and Vivaldi do this.
- So any backup file that is selected to be restored using the WUI will no longer have a
colon in the filename.
- This patch adds --force-local to the tar command, which means that tar will treat the
colon as a character in the filename. This will ensure that if a user has any backup
files stored on their IPFire system, with a colon in the filename then doing a restore
from this file will not cause tar to fail.
- The NOW variable is also changed to replace the colon by a dash and to separate the date
and time by an underscore. This filename will be accepted by browsers, without doing
any replacements. Tested out with Firefox, Chromium & Vivaldi.
- The above ensures that both the new and old filename versions will work for doing a
restore.
Fixes: bug13734 Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org> Tested-by: Bernhard Bitsch <bbitsch@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 19 Aug 2024 10:10:47 +0000 (10:10 +0000)]
linux: Tidy up the messy KVER variable
This variable never actually held the kernel version. There were always
suffixes appended and other things changed about it. This makes it a lot
simpler as this variable now holds the actual kernel version.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 19 Aug 2024 18:06:23 +0000 (18:06 +0000)]
make.sh: Fix build with kernels < 6.0.0
unshare(8) seems to fail with kernels older than 6.0.0 when mounting
the /proc filesystem in the inner namespace. This seems to be an bug
where unshare does not even try to mount the /proc filesystem but tries
to make its mount propagation private.
This is now solved in that way that we will use unshare on newer kernels
but will fall back on manually mounting the /proc filesystem once we have
entered the chroot environment.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Sun, 18 Aug 2024 09:15:31 +0000 (11:15 +0200)]
suricata: Use correct red device when using QMI
When using QMI the dial-in option has to be set to "ppp" during setup.
In this case the initscript of suricata will create all related firewall
rules for the ppp0 interface which is not correct when using QMI where
the RED device is called red0.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 16 Aug 2024 13:05:25 +0000 (13:05 +0000)]
suricata: Disable logging of App Layer events by default
This might only be useful for debugging (and even that is questionable).
So instead of flooding logs, we disable this, but it can be easily
enabled for development again.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 15 Aug 2024 07:48:17 +0000 (09:48 +0200)]
netsnmpd: Update to version 5.9.3
- Update from version 5.9.1 to 5.9.3
- Version 5.9.4 exists but it is indicated that SNMP over TLS and/or DTLS is not
functioning properly with various versions of OpenSSL. However I could not find which
versions mentioned in the News or Changelog. The problem will be fixed in a future
version. There are no CVE fixes in 5.9.4, only a relatively few bug fixes so I
decided to wait for the fixed version in case there are users using TLS with SNMP.
- Update of rootfile
- 6 CVE fixes in 5.9.3
- Changelog
5.9.3
security:
- These two CVEs can be exploited by a user with read-only credentials:
- CVE-2022-24805 A buffer overflow in the handling of the INDEX of
NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
- CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable
can cause a NULL pointer dereference.
- These CVEs can be exploited by a user with read-write credentials:
- CVE-2022-24806 Improper Input Validation when SETing malformed
OIDs in master agent and subagent simultaneously
- CVE-2022-24807 A malformed OID in a SET request to
SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
out-of-bounds memory access.
- CVE-2022-24808 A malformed OID in a SET request to
NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
- CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable
can cause a NULL pointer dereference.
- To avoid these flaws, use strong SNMPv3 credentials and do not share them.
If you must use SNMPv1 or SNMPv2c, use a complex community string
and enhance the protection by restricting access to a given IP address
range.
- Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for
reporting the following CVEs that have been fixed in this release, and
to Arista Networks for providing fixes.
misc:
- Snmp-create-v3-user: Fix the snmpd.conf path @datadir@ is
expanded in ${datarootdir} so datarootdir must be set before
@datadir@ is used.
general: Many bug fixes
5.9.2
skipped due to a last minute library versioning found bug -- use 5.9.3 instead
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 14 Aug 2024 19:35:09 +0000 (21:35 +0200)]
samba: Update to version 4.20.4
- Update from version 4.20.2 to 4.20.4
- Successfully built samba on arm builder
- Update of rootfile for x86_64 & aarch64 not required.
- Changelog
4.20.4
* BUG 15673: --version-* options are still not ergonomic, and they reject
tilde characters.
* BUG 15673: --version-* options are still not ergonomic, and they reject
tilde characters.
4.20.3
* BUG 15683: Running samba-bgqd a a standalone systemd service does not work.
* BUG 15655: When claims enabled with heimdal kerberos, unable to log on to a
Windows computer when user account need to change their own password.
* BUG 15671: Invalid client warning about command line passwords.
* BUG 15672: Version string is truncated in manpages.
* BUG 15673: --version-* options are still not ergonomic, and they reject
tilde characters.
* BUG 15674: cmdline_burn does not always burn secrets.
* BUG 15685: Samba does not parse SDDL found in defaultSecurityDescriptor in
AD_DS_Classes_Windows_Server_v1903.ldf.
* BUG 15655: When claims enabled with heimdal kerberos, unable to log on to a
Windows computer when user account need to change their own password.
* BUG 15660: The images don\'t build after the git security release and
CentOS 8 Stream is EOL.
* BUG 15676: Fix clock skew error message and memory cache clock skew
recovery.
* BUG 15603: Heimdal ignores _gsskrb5_decapsulate errors in
init_sec_context/repl_mutual.
* BUG 15621: s4:ldap_server: does not support tls channel bindings
for sasl binds.
* BUG 15678: CTDB socket output queues may suffer unbounded delays under some
special conditions.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 14 Aug 2024 19:09:53 +0000 (21:09 +0200)]
oci-cli: Update to version 3.45.2
- Update from version 3.29.4 to 3.45.2
- Update of rootfile
- Changelog is too large to include here. Details can be found at
https://github.com/oracle/oci-cli/releases
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 14 Aug 2024 19:09:52 +0000 (21:09 +0200)]
ghostscript: Update to version 10.03.1
- Update from version 10.03.0 to 10.03.1
- Update of rootfile
- Several CVE fixes in this release
- Changelog
10.03.1
Fixes for CVE-2024-33869, CVE-2023-52722, CVE-2024-33870, CVE-2024-33871 and
CVE-2024-29510
IMPORTANT: For the 10.04.0 release (fall/autumn 2024) we will be adding
protection for device selection from PostScript input. This will mean that,
by default, only the device specified on the command line will be permitted.
Similar to the file permissions, there will be a "--permit-devices="
allowing a comma separation list of allowed devices. This will also take a
single wildcard "*" allowing any device.
Any application which relies on allowing PostScript to change devices during
a job will have to be aware, and take action to deal with this change.
The exception is "nulldevice", switching to that requires no special action.
A vulnerability was identified in the way Ghostscript/GhostPDL called
tesseract for the OCR devices, which could allow arbitrary code execution.
As as result, we strongly urge anyone including the OCR devices in their
build to update as soon as possible.
As of this release (10.03.1) pdfwrite creates PDF files with XRef streams
and ObjStm streams. This can result in considerably smaller PDF output
files. See Vector Devices for more details.
Ghostscript/pdfwrite now supports passing through PDF "Optional Content".
Our efforts in code hygiene and maintainability continue.
The usual round of bug fixes, compatibility changes, and incremental
improvements.
(9.53.0) We have added the capability to build with the Tesseract OCR
engine. In such a build, new devices are available
(pdfocr8/pdfocr24/pdfocr32) which render the output file to an image, OCR
that image, and output the image "wrapped" up as a PDF file, with the OCR
generated text information included as "invisible" text (in PDF terms, text
rendering mode 3).
Mainly due to time constraints, we only support including Tesseract from
source included in our release packages, and not linking to
Tesseract/Leptonica shared libraries. Whether we add this capability will
be largely dependent on community demand for the feature.
See Enabling OCR for more details.
Incompatible changes
(10.03.1) Almost all the "internal" PostScript procedures defined during the
interpreter startup are now "executeonly", further reducing the attack
surface of the interpreter.
The nature of these procedures means there should be no impact for
legitimate usage, but it is possible it will impact uses which abuse the
previous accessibility (even for legitimate reasons). Such cases may now
require "DELAYBIND", See DELAYBIND
(10.03.1) The "makeimagedevice" non-standard operator has been removed. It
allowed low level access to the graphics library in a way that was,
essentially impossible to secure.
(10.03.1) The "putdeviceprops", "getdeviceprops", "finddevice",
"copydevice", "findprotodevice" non-standard operators have all been
removed. They provided functionality that is either accessible through
standard operators, or should not be used by user PostScript.
(10.03.1) The process of "tidying" the PostScript namespace should have
removed only non-standard and undocumented operators. Nevertheless, it is
possible that any integrations or utilities that rely on those non-standard
and undocumented operators may stop working or may change behaviour.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 14 Aug 2024 19:09:51 +0000 (21:09 +0200)]
fmt: Update to version 11.0.2
- Update from version 11.0.1 to 11.0.2
- Update of rootfile
- Changelog
11.0.2
- Fixed compatibility with non-POSIX systems
(https://github.com/fmtlib/fmt/issues/4054,
https://github.com/fmtlib/fmt/issues/4060).
- Fixed performance regressions when using `std::back_insert_iterator` with
`fmt::format_to` (https://github.com/fmtlib/fmt/issues/4070).
- Fixed handling of `std::generator` and move-only iterators
(https://github.com/fmtlib/fmt/issues/4053,
https://github.com/fmtlib/fmt/pull/4057). Thanks @Arghnews.
- Made `formatter<std::string_view>::parse` work with types convertible to
`std::string_view` (https://github.com/fmtlib/fmt/issues/4036,
https://github.com/fmtlib/fmt/pull/4055). Thanks @Arghnews.
- Made `volatile void*` formattable
(https://github.com/fmtlib/fmt/issues/4049,
https://github.com/fmtlib/fmt/pull/4056). Thanks @Arghnews.
- Made `Glib::ustring` not be confused with `std::string`
(https://github.com/fmtlib/fmt/issues/4052).
- Made `fmt::context` iterator compatible with STL algorithms that rely on
iterator category (https://github.com/fmtlib/fmt/issues/4079).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Wed, 14 Aug 2024 19:09:50 +0000 (21:09 +0200)]
ddrescue: Update to version 1.28
- Update from version 1.26 to 1.28
- Update of rootfile not required
- Changelog
1.28
The option '--verify-on-error' has been renamed to '--check-on-error'.
The option '--verify-input-size' has been renamed to '--check-input-size'.
The option synonym '--exit-on-error' has been removed and is no longer
recognized.
In fill and rescue modes, ddrescue now makes a final fsync call on outfile
to prevent an early exit if the kernel caches all the writes.
Option '-t, --show-status' of ddrescuelog now shows the mapfile names at
verbosity level 0 if more than one mapfile is specified.
The variable MAKEINFO has been added to configure and Makefile.in.
1.27
A deadlock in command mode when stdout is fully buffered has been fixed by
flushing stdout after executing each command. (Reported by Jeffrey Bosboom).
The new option '-W, --compare-before-write' has been added. It omits
superfluous writes in rescue mode.
(Suggested by Kajetan Harald Hinner and Petr Slansky).
Diagnostics caused by invalid arguments to command line options now show the
argument and the name of the option.
The option synonym '--direct' has been removed and is no longer recognized.
'long long' is now used instead of 'long' for time variables.
A missing '#include <cstdlib>' has been added.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 3460000 to 3460100
- Update of rootfile not required
- Changelog 3460100
Improved robustness while parsing the tokenize= arguments in FTS5. Forum post 171bcc2bcd.
Enhancements to covering index prediction in the query planner. Add early
detection of over-prediction of covering indexes so that sqlite3_prepare() will
return an error rather than just generate bad bytecode. Forum post e60e4c295d22f8ce.
Do not let the number of terms on a VALUES clause be limited by
SQLITE_LIMIT_COMPOUND_SELECT, even if the VALUES clause contains elements that
appear to be variables due to double-quoted string literals.
Fix the window function version of group_concat() so that it returns an empty
string if it has one or more empty string inputs.
In FTS5 secure-delete mode, fix false-positive integrity-check reports about
corrupt indexes.
Syntax errors in ALTER TABLE should always return SQLITE_ERROR. In some cases,
they were formerly returning SQLITE_INTERNAL.
JavaScript/WASM:
Fix a corruption-causing bug in the JavaScript "opfs" VFS.
Work around a couple of browser-specific OPFS quirks.
Other minor fixes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 20240531 to 20240813
- Update of rootfile not required
- Changelog 20240813
Security updates for INTEL-SA-01083
Security updates for INTEL-SA-01118
Security updates for INTEL-SA-01100
Security updates for INTEL-SA-01038
Security updates for INTEL-SA-01046
Update for functional issues. Refer to Intel® Core™ Ultra Processor for details.
Update for functional issues. Refer to 3rd Generation Intel® Xeon® Processor Scalable Family Specification Update for details.
Update for functional issues. Refer to 3rd Generation Intel® Xeon® Scalable Processors Specification Update for details.
Update for functional issues. Refer to 2nd Generation Intel® Xeon® Processor Scalable Family Specification Update for details
Update for functional issues. Refer to Intel® Xeon® D-2700 Processor Specification Update for details.
Update for functional issues. Refer to Intel® Xeon® E-2300 Processor Specification Update for details.
Update for functional issues. Refer to 13th Generation Intel® Core™ Processor Specification Update for details.
Update for functional issues. Refer to 12th Generation Intel® Core™ Processor Family for details.
Update for functional issues. Refer to 11th Gen Intel® Core™ Processor Specification Update for details.
Update for functional issues. Refer to 10th Gen Intel® Core™ Processor Families Specification Update for details.
Update for functional issues. Refer to 10th Generation Intel® Core™ Processor Specification Update for details.
Update for functional issues. Refer to 8th and 9th Generation Intel® Core™ Processor Family Spec Update for details.
Update for functional issues. Refer to 8th Generation Intel® Core™ Processor Families Specification Update for details.
Update for functional issues. Refer to 7th and 8th Generation Intel® Core™ Processor Specification Update for details.
Update for functional issues. Refer to Intel® Processors and Intel® Core™ i3 N-Series for details.
Update for functional issues. Refer to Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications for details.
For Updated Platforms see the changelog
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240813
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:25:57 +0000 (18:25 +0200)]
ncdu: Update to version 1.20
- Update from version 1.18.1 to 1.20
- Update of rootfile not required
- Changelog
1.20
- Revert default color scheme back to 'off'
- Rewrite man page in mdoc, drop pod2man dependency
1.19
- Fix typo in --exclude-from argument
- Add --(enable|disable)-natsort options
- Add indicator to apparent size/disk usage selection in the footer
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:48 +0000 (18:19 +0200)]
strace: Update to version 6.10
- Update from version 6.6 to 6.10
- Update of rootfile not required
- Changelog
6.10
* Improvements
* Implemented --decode-fds=eventfd option to retrieve eventfd object details
associated with eventfd file descriptors.
* Implemented decoding of NETLINK_GENERIC nlctrl protocol.
* Implemented decoding of F_DUPFD_QUERY fcntl.
* Implemented decoding of mseal syscall.
* Updated decoding of statx and prctl syscalls.
* Updated decoding of BPF_RAW_TRACEPOINT_OPEN bpf command.
* Updated lists of BPF_*, IORING_*, KEXEC_*, KEY_*, LANDLOCK_*, PR_*, STATX_*,
TCP_*, TEE_*, V4L2_*, and *_MAGIC constants.
* Updated lists of ioctl commands from Linux 6.10.
* Bug fixes
* Worked around a bug introduced in Linux 6.5 that affected system call
tampering on riscv64.
6.9
* Improvements
* Implemented --always-show-pid option.
* The --user|-u option has learned to recognize numeric UID:GID pair, allowing
e.g. statically-built strace to be used without invoking nss plugins.
* Implemented decoding of IORING_REGISTER_SYNC_CANCEL,
IORING_REGISTER_FILE_ALLOC_RANGE, IORING_REGISTER_PBUF_STATUS,
IORING_REGISTER_NAPI, and IORING_UNREGISTER_NAPI opcodes of
io_uring_register syscall.
* Implemented decoding of BPF_TOKEN_CREATE bpf syscall command.
* Updated decoding of io_uring_register and pidfd_send_signal syscalls.
* Updated lists of BPF_*, CAN_*, IORING_*, KEY_*, LSM_*, MPOL_*, NT_*, RWF_*,
PIDFD_*, PTP_*, TCP_*, and *_MAGIC constants.
* Updated lists of ioctl commands from Linux 6.9.
6.8
* Improvements
* Renamed --stack-traces to --stack-trace for consistency.
Old option is retained for backwards compatibility.
* Implemented --stack-trace-frame-limit=N option for configuring the limit
of the number of printed backtrace frames.
* Implemented decoding of statmount, listmount, lsm_get_self_attr,
lsm_set_self_attr, and lsm_list_modules syscalls.
* Implemented decoding of setsockopt(TCP_AO_ADD_KEY).
* Updated decoding of landlock_create_ruleset and landlock_add_rule syscalls.
* Updated decoding of SMC_DIAG_DMBINFO netlink attribute.
* Updated decoding of UBI_IOCATT ioctl command.
* Enhanced decoding of mount attributes of fsmount and mount_setattr syscalls.
* Updated lists of BPF_*, KEXEC_*, KVM_*, PERF_*, SOL_*, STATX_*, UFFD_*,
and V4L2_* constants.
* Updated lists of ioctl commands from Linux 6.8.
6.7
* Improvements
* Implemented -kk/--stack-traces=source option for libdw-based stack tracing.
* Implemented decoding of futex_wake, futex_wait, and sys_futex_requeue
syscalls.
* Updated lists of BPF_*, BTRFS_*, IORING_*, KVM_*, LANDLOCK_*, PR_*,
and TCP_* constants.
* Updated lists of ioctl commands from Linux 6.7.
* Bug fixes
* Fix strace -r during the first second after booting to show correct relative
timestamps.
* Fix strace -f entering deadlock on exit if there are tracee processes
spawned using vfork semantics.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:47 +0000 (18:19 +0200)]
sdl2: Update to version 2.30.6
- Update from version 2.30.1 to 2.30.6
- Update of rootfile
- Changelog
2.30.6
Improved detection of Nintendo Switch Pro controller report mode
Fixed a rare crash when a controller is disconnected
Fixed creating a framebuffer with KMSDRM on some systems
2.30.5
Respect SDL_HINT_RENDER_DRIVER when creating an accelerated window surface
Clean up any accelerated renderer in SDL_DestroyWindowSurface()
Disable low level USB controller support on Android by default (can be
enabled by setting "SDL_ENV.SDL_JOYSTICK_HIDAPI" metadata to "1" in
AndroidManifest.xml)
Fixed USB permissions dialog on Android 14
Fixed controller mapping matching when one entry has a CRC specified and
another doesn't
Enable joystick support on FreeBSD when building using CMake
Reduced input latency when using an fcitx IME on Linux
Fixed graphical corruption on Raspberry Pi
Fixed crash when using an unstable sort function in SDL_qsort (you shouldn't
do this, but at least it won't crash)
2.30.4
Android rotation will respect user rotation lock preferences
Fixed spurious Left-Ctrl key input when the Right Alt key (AltGr) is pressed
on Windows
Added support for the Saitek Cyborg V.3 Rumble Pad in PS3 mode
Added support for the Razer Kitsune in PS5 mode
Added Linux bindings for the Qanba Drone 2 Arcade Joystick
Leave Nintendo Online controllers in simple report mode so they work with
DirectInput games
Enable using libusb for GameCube controllers when available
2.30.3
Fixed Win+V handling (pasting from clipboard history) on Windows
Fixed Caps Lock and Backspace key mapping for the Colemak keyboard layout on
Windows
Fixed mouse warp on XWayland
Reduced startup time when scanning for game controllers on Linux
Fixed building with C89 compilers
Fixed building with the GDK SDK on Windows
2.30.2
Fixed performance regression initializing controllers on Linux
Added support for the 6-button SEGA Mega Drive Control Pad for Nintendo Online
Added support for the MadCatz Saitek Side Panel Control Deck
Added support for the Hori Fighting Stick EX2
Added support for the Yawman Arrow flightstick
Added a gamepad mapping for the Defender Joystick Cobra R4
Fixed the gamepad mapping for the Sanwa Supply JY-P76USV controller
Poll for the initial controller state when using DirectInput
Allow using SDL_RWFromFile() with named pipes
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:46 +0000 (18:19 +0200)]
readline: Update patches to include 11 - 13
- Update patches from 1 - 10 to 1 - 13
- Update of rootfile not required
- Changelog of patches
11 Some systems (e.g., macOS) send signals early on in interactive initialization,
so readline should retry a failed open of the init file.
12 If a user happens to bind do-lowercase-version to something that isn't a
capital letter, so _rl_to_lower doesn't change anything and the result is
still bound to do-lowercase-version, readline can recurse infinitely.
13 When readline is accumulating bytes until it reads a complete multibyte
character, reading a byte that makes the multibyte character invalid can
result in discarding the bytes in the partial character.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:44 +0000 (18:19 +0200)]
lz4: Update to version 1.10.0
- Update from version 1.9.4 to 1.10.0
- Update of rootfile
- Changelog
1.10.0
cli : multithreading compression support: improves speed by X times threads allocated
cli : overlap decompression with i/o, improving speed by ~+60%
cli : support environment variables LZ4_CLEVEL and LZ4_NBWORKERS
cli : license of CLI more clearly labelled GPL-2.0-or-later
cli : fix: refuse to compress directories
cli : fix dictionary compression benchmark on multiple files
cli : change: no more implicit `stdout` (except when input is `stdin`)
lib : new level 2, offering mid-way performance (speed and compression)
lib : Improved lz4frame compression speed for small data (up to +160% at 1KB)
lib : Slightly faster (+5%) HC compression speed (levels 3-9), by @JunHe77
lib : dictionary compression support now in stable status
lib : lz4frame states can be safely reset and reused after a processing error (described by @QrczakMK)
lib : `lz4file` API improvements, by @vsolontsov-volant and @t-mat
lib : new experimental symbol `LZ4_compress_destSize_extState()`
build: cmake minimum version raised to 3.5
build: cmake improvements, by @foxeng, @Ohjurot, @LocalSpook, @teo-tsirpanis, @ur4t and @t-mat
build: meson scripts are now hosted into `build/` directory, by @eli-schwartz
build: meson improvements, by @tristan957
build: Visual Studio solutions generated by `cmake` via scripts
port : support for loongArch, risc-v, m68k, mips and sparc architectures
port : improved Visual Studio compatibility, by @t-mat
port : freestanding support improvements, by @t-mat
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:43 +0000 (18:19 +0200)]
knot: Update to version 3.3.8
- Update from version 3.3.5 to 3.3.8
- Update of rootfile not required
- Changelog
3.3.8
Features:
- libzscanner,libknot: added support for 'dohpath' and 'ohttp' SVCB parameters
- libzscanner,libknot: added support for WALLET rrtype
- keymgr: new commands for keystore testing (see 'keystore-test' and 'keystore-bench')
- knotd: new configuration option for setting default TTL (see 'zone.default-ttl')
Improvements:
- libknot: added error codes to better describe some failures
Bugfixes:
- knotd: DNSSEC signing doesn't remove NSEC records for non-authoritative nodes
- knotd: DNSSEC signing not scheduled on secondary if nothing to be reloaded
- libknot: TCP over XDP doesn't ignore SYN+ACK packets on the server side
3.3.7
Improvements:
- libs: upgraded embedded libngtcp2 to 1.6.0
Bugfixes:
- knotd: insufficient metadata check can cause journal corruption
- knotd: missing zone timers initialization upon purge
- knotd: missing RCU lock in zone flush and refresh
- knotd: defective assert in zone refresh
3.3.6
Features:
- knotd: configurable control socket backlog size (see 'control.backlog')
- knotd: optional configuration of congruency of generated keytags (see 'policy.keytag-modulo')
- knotc: support for exporting configuration schema in JSON (see 'conf-export') #912
- mod-dnstap: configuration of sink allows TCP address specification
Improvements:
- knotd: last-signed serial is stored to KASP even if not a secondary zone
- knotd: allowed catalog role member in a catalog template configuration
- knotd: some references in a zone configuration can be set empty to override a template
- knotd: allowed zone backup during a zone transaction
- knotd: add remote TSIG key name to outgoing event logs
- knotc: zone backup with '+keysonly' silently uses all defaults as 'off'
- kxdpgun: host name can be used for target specification
- libs: upgraded embedded libngtcp2 to 1.5.0
- doc: various fixes and updates
Bugfixes:
- knotd: reset TCP connection not removed from a connection pool
- knotd: server wrongly tries to remove removed ZONEMD
- knotd: failed to parse empty list from a textual configuration
- knotd: blocking zone signing in combination with an open transaction causes a deadlock
- knotd: missing RCU lock when sending NOTIFY
- kdig: QNAME letter case isn't preserved if IDN is enabled
- kdig: failed to parse empty QNAME (do not fill question section)
- kxdpgun: floating point exception on SIGUSR1 #927
- libknot: incorrect handling of regular QUIC tokens in incoming initials
- python: failed to set an empty configuration value
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:42 +0000 (18:19 +0200)]
iproute2: Update to version 6.10.0
- Update from version 6.8.0 to 6.10.0
- Update of rootfile not required
- Changelog is the commits list in the git repo
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:41 +0000 (18:19 +0200)]
hwdata: Update to the latest versions of pci.ids & usb.ids
- pci.ids - update from 2023-09-22 to 2024-06-23
- usb.ids - update from 2023-11-08 to 2024-07-04
- Update of rootfile not required
- Changelog is not available. It is just the latest update of the information
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:40 +0000 (18:19 +0200)]
git: Update to version 2.46.0
- Update from version 2.45.2 to 2.46.0
- Update of rootfile
- Changelog
2.46.0
UI, Workflows & Features
* The "--rfc" option of "git format-patch" learned to take an
optional string value to be used in place of "RFC" to tweak the
"[PATCH]" on the subject header.
* The credential helper protocol, together with the HTTP layer, have
been enhanced to support authentication schemes different from
username & password pair, like Bearer and NTLM.
* Command line completion script (in contrib/) learned to complete
"git symbolic-ref" a bit better (you need to enable plumbing
commands to be completed with GIT_COMPLETION_SHOW_ALL_COMMANDS).
* When the user responds to a prompt given by "git add -p" with an
unsupported command, list of available commands were given, which
was too much if the user knew what they wanted to type but merely
made a typo. Now the user gets a much shorter error message.
* The color parsing code learned to handle 12-bit RGB colors, spelled
as "#RGB" (in addition to "#RRGGBB" that is already supported).
* The operation mode options (like "--get") the "git config" command
uses have been deprecated and replaced with subcommands (like "git
config get").
* "git tag" learned the "--trailer" option to futz with the trailers
in the same way as "git commit" does.
* A new global "--no-advice" option can be used to disable all advice
messages, which is meant to be used only in scripts.
* Updates to symbolic refs can now be made as a part of ref
transaction.
* The trailer API has been reshuffled a bit.
* Terminology to call various ref-like things are getting
straightened out.
* The command line completion script (in contrib/) has been adjusted
to the recent update to "git config" that adopted subcommand based
UI.
* The knobs to tweak how reftable files are written have been made
available as configuration variables.
* When "git push" notices that the commit at the tip of the ref on
the other side it is about to overwrite does not exist locally, it
used to first try fetching it if the local repository is a partial
clone. The command has been taught not to do so and immediately
fail instead.
* The promisor.quiet configuration knob can be set to true to make
lazy fetching from promisor remotes silent.
* The inter/range-diff output has been moved to the end of the patch
when format-patch adds it to a single patch, instead of writing it
before the patch text, to be consistent with what is done for a
cover letter for a multi-patch series.
* A new command has been added to migrate a repository that uses the
files backend for its ref storage to use the reftable backend, with
limitations.
* "git diff --exit-code --ext-diff" learned to take the exit status
of the external diff driver into account when deciding the exit
status of the overall "git diff" invocation when configured to do
so.
* "git update-ref --stdin" learned to handle transactional updates of
symbolic-refs.
* "git format-patch --interdiff" for multi-patch series learned to
turn on cover letters automatically (unless told never to enable
cover letter with "--no-cover-letter" and such).
* The "--heads" option of "ls-remote" and "show-ref" has been been
deprecated; "--branches" replaces "--heads".
* For over a year, setting add.interactive.useBuiltin configuration
variable did nothing but giving a "this does not do anything"
warning. The warning has been removed.
* The http transport can now be told to send request with
authentication material without first getting a 401 response.
* A handful of entries are added to the GitFAQ document.
* "git var GIT_SHELL_PATH" should report the path to the shell used
to spawn external commands, but it didn't do so on Windows, which
has been corrected.
Performance, Internal Implementation, Development Support etc.
* Advertise "git contacts", a tool for newcomers to find people to
ask review for their patches, a bit more in our developer
documentation.
* In addition to building the objects needed, try to link the objects
that are used in fuzzer tests, to make sure at least they build
without bitrot, in Linux CI runs.
* Code to write out reftable has seen some optimization and
simplification.
* Tests to ensure interoperability between reftable written by jgit
and our code have been added and enabled in CI.
* The singleton index_state instance "the_index" has been eliminated
by always instantiating "the_repository" and replacing references
to "the_index" with references to its .index member.
* Git-GUI has a new maintainer, Johannes Sixt.
* The "test-tool" has been taught to run testsuite tests in parallel,
bypassing the need to use the "prove" tool.
* The "whitespace check" task that was enabled for GitHub Actions CI
has been ported to GitLab CI.
* The refs API lost functions that implicitly assumes to work on the
primary ref_store by forcing the callers to pass a ref_store as an
argument.
* Code clean-up to reduce inter-function communication inside
builtin/config.c done via the use of global variables.
* The pack bitmap code saw some clean-up to prepare for a follow-up topic.
* Preliminary code clean-up for "git send-email".
* The default "creation-factor" used by "git format-patch" has been
raised to make it more aggressively find matching commits.
* Before discovering the repository details, We used to assume SHA-1
as the "default" hash function, which has been corrected. Hopefully
this will smoke out codepaths that rely on such an unwarranted
assumptions.
* The project decision making policy has been documented.
* The strcmp-offset tests have been rewritten using the unit test
framework.
* "git add -p" learned to complain when an answer with more than one
letter is given to a prompt that expects a single letter answer.
* The alias-expanded command lines are logged to the trace output.
* A new test was added to ensure git commands that are designed to
run outside repositories do work.
* A few tests in reftable library have been rewritten using the
unit test framework.
* A pair of test helpers that essentially are unit tests on hash
algorithms have been rewritten using the unit-tests framework.
* A test helper that essentially is unit tests on the "decorate"
logic has been rewritten using the unit-tests framework.
* Many memory leaks in the sparse-checkout code paths have been
plugged.
* "make check-docs" noticed problems and reported to its output but
failed to signal its findings with its exit status, which has been
corrected.
* Building with "-Werror -Wwrite-strings" is now supported.
* To help developers, the build procedure now allows builders to use
CFLAGS_APPEND to specify additional CFLAGS.
* "oidtree" tests were rewritten to use the unit test framework.
* The structure of the document that records longer-term project
decisions to deprecate/remove/update various behaviour has been
outlined.
* The pseudo-merge reachability bitmap to help more efficient storage
of the reachability bitmap in a repository with too many refs has
been added.
* When "git merge" sees that the index cannot be refreshed (e.g. due
to another process doing the same in the background), it died but
after writing MERGE_HEAD etc. files, which was useless for the
purpose to recover from the failure.
* The output from "git cat-file --batch-check" and "--batch-command
(info)" should not be unbuffered, for which some tests have been
added.
* A CPP macro USE_THE_REPOSITORY_VARIABLE is introduced to help
transition the codebase to rely less on the availability of the
singleton the_repository instance.
* "git version --build-options" reports the version information of
OpenSSL and other libraries (if used) in the build.
* Memory ownership rules for the in-core representation of
remote.*.url configuration values have been straightened out, which
resulted in a few leak fixes and code clarification.
* When bundleURI interface fetches multiple bundles, Git failed to
take full advantage of all bundles and ended up slurping duplicated
objects, which has been corrected.
* The code to deal with modified paths that are out-of-cone in a
sparsely checked out working tree has been optimized.
* An existing test of oidmap API has been rewritten with the
unit-test framework.
* The "ort" merge backend saw one bugfix for a crash that happens
when inner merge gets killed, and assorted code clean-ups.
* A new warning message is issued when a command has to expand a
sparse index to handle working tree cruft that are outside of the
sparse checkout.
* The test framework learned to take the test body not as a single
string but as a here-document.
* "git push '' HEAD:there" used to hit a BUG(); it has been corrected
to die with "fatal: bad repository ''".
* What happens when http.cookieFile gets the special value "" has
been clarified in the documentation.
Bug Fixes
* "git rebase --signoff" used to forget that it needs to add a
sign-off to the resulting commit when told to continue after a
conflict stops its operation.
* The procedure to build multi-pack-index got confused by the
replace-refs mechanism, which has been corrected by disabling the
latter.
* The "-k" and "--rfc" options of "format-patch" will now error out
when used together, as one tells us not to add anything to the
title of the commit, and the other one tells us to add "RFC" in
addition to "PATCH".
* "git stash -S" did not handle binary files correctly, which has
been corrected.
* A scheduled "git maintenance" job is expected to work on all
repositories it knows about, but it stopped at the first one that
errored out. Now it keeps going.
* zsh can pretend to be a normal shell pretty well except for some
glitches that we tickle in some of our scripts. Work them around
so that "vimdiff" and our test suite works well enough with it.
* Command line completion support for zsh (in contrib/) has been
updated to stop exposing internal state to end-user shell
interaction.
* Tests that try to corrupt in-repository files in chunked format did
not work well on macOS due to its broken "mv", which has been
worked around.
* The maximum size of attribute files is enforced more consistently.
* Unbreak CI jobs so that we do not attempt to use Python 2 that has
been removed from the platform.
* Git 2.43 started using the tree of HEAD as the source of attributes
in a bare repository, which has severe performance implications.
For now, revert the change, without ripping out a more explicit
support for the attr.tree configuration variable.
* The "--exit-code" option of "git diff" command learned to work with
the "--ext-diff" option.
* Windows CI running in GitHub Actions started complaining about the
order of arguments given to calloc(); the imported regex code uses
the wrong order almost consistently, which has been corrected.
* Expose "name conflict" error when a ref creation fails due to D/F
conflict in the ref namespace, to improve an error message given by
"git fetch".
(merge 9339fca23e it/refs-name-conflict later to maint).
* The SubmittingPatches document now refers folks to manpages
translation project.
* The documentation for "git diff --name-only" has been clarified
that it is about showing the names in the post-image tree.
* The credential helper that talks with osx keychain learned to avoid
storing back the authentication material it just got received from
the keychain.
(merge e1ab45b2da kn/osxkeychain-skip-idempotent-store later to maint).
* The chainlint script (invoked during "make test") did nothing when
it failed to detect the number of available CPUs. It now falls
back to 1 CPU to avoid the problem.
* Revert overly aggressive "layered defence" that went into 2.45.1
and friends, which broke "git-lfs", "git-annex", and other use
cases, so that we can rebuild necessary counterparts in the open.
* "git init" in an already created directory, when the user
configuration has includeif.onbranch, started to fail recently,
which has been corrected.
* Memory leaks in "git mv" has been plugged.
* The safe.directory configuration knob has been updated to
optionally allow leading path matches.
* An overly large ".gitignore" files are now rejected silently.
* Upon expiration event, the credential subsystem forgot to clear
in-core authentication material other than password (whose support
was added recently), which has been corrected.
* Fix for an embarrassing typo that prevented Python2 tests from running
anywhere.
* Varargs functions that are unannotated as printf-like or execl-like
have been annotated as such.
* "git am" has a safety feature to prevent it from starting a new
session when there already is a session going. It reliably
triggers when a mbox is given on the command line, but it has to
rely on the tty-ness of the standard input. Add an explicit way to
opt out of this safety with a command line option.
(merge 62c71ace44 jk/am-retry later to maint).
* A leak in "git imap-send" that somehow escapes LSan has been
plugged.
* Setting core.abbrev too early before the repository set-up
(typically in "git clone") caused segfault, which as been
corrected.
* When the user adds to "git rebase -i" instruction to "pick" a merge
commit, the error experience is not pleasant. Such an error is now
caught earlier in the process that parses the todo list.
* We forgot to normalize the result of getcwd() to NFC on macOS where
all other paths are normalized, which has been corrected. This still
does not address the case where core.precomposeUnicode configuration
is not defined globally.
* Earlier we stopped using the tree of HEAD as the default source of
attributes in a bare repository, but failed to document it. This
has been corrected.
* "git update-server-info" and "git commit-graph --write" have been
updated to use the tempfile API to avoid leaving cruft after
failing.
* An unused extern declaration for mingw has been removed to prevent
it from causing build failure.
* A helper function shared between two tests had a copy-paste bug,
which has been corrected.
* "git fetch-pack -k -k" without passing "--lock-pack" (which we
never do ourselves) did not work at all, which has been corrected.
* CI job to build minimum fuzzers learned to pass NO_CURL=NoThanks to
the build procedure, as its build environment does not offer, or
the rest of the build needs, anything cURL.
(merge 4e66b5a990 jc/fuzz-sans-curl later to maint).
* "git diff --no-ext-diff" when diff.external is configured ignored
the "--color-moved" option.
(merge 0f4b0d4cf0 rs/diff-color-moved-w-no-ext-diff-fix later to maint).
* "git archive --add-virtual-file=<path>:<contents>" never paid
attention to the --prefix=<prefix> option but the documentation
said it would. The documentation has been corrected.
(merge 72c282098d jc/archive-prefix-with-add-virtual-file later to maint).
* When GIT_PAGER failed to spawn, depending on the code path taken,
we failed immediately (correct) or just spew the payload to the
standard output (incorrect). The code now always fail immediately
when GIT_PAGER fails.
(merge 78f0a5d187 rj/pager-die-upon-exec-failure later to maint).
* date parser updates to be more careful about underflowing epoch
based timestamp.
(merge 9d69789770 db/date-underflow-fix later to maint).
* The Bloom filter used for path limited history traversal was broken
on systems whose "char" is unsigned; update the implementation and
bump the format version to 2.
(merge 9c8a9ec787 tb/path-filter-fix later to maint).
* Typofix.
(merge 231cf7370e as/pathspec-h-typofix later to maint).
* Code clean-up.
(merge 4b837f821e rs/simplify-submodule-helper-super-prefix-invocation later
to maint).
* "git describe --dirty --broken" forgot to refresh the index before
seeing if there is any chang, ("git describe --dirty" correctly did
so), which has been corrected.
(merge b8ae42e292 as/describe-broken-refresh-index-fix later to maint).
* Test suite has been taught not to unnecessarily rely on DNS failing
a bogus external name.
(merge 407cdbd271 jk/tests-without-dns later to maint).
* GitWeb update to use committer date consistently in rss/atom feeds.
(merge cf6ead095b am/gitweb-feed-use-committer-date later to maint).
* Custom control structures we invented more recently have been
taught to the clang-format file.
(merge 1457dff9be rs/clang-format-updates later to maint).
* Developer build procedure fix.
(merge df32729866 tb/dev-build-pedantic-fix later to maint).
* "git push" that pushes only deletion gave an unnecessary and
harmless error message when push negotiation is configured, which
has been corrected.
(merge 4d8ee0317f jc/disable-push-nego-for-deletion later to maint).
* Address-looking strings found on the trailer are now placed on the Cc: list after running through sanitize_address by "git send-email".
(merge c852531f45 cb/send-email-sanitize-trailer-addresses later to maint).
* Tests that use GIT_TEST_SANITIZE_LEAK_LOG feature got their exit
status inverted, which has been corrected.
(merge 8c1d6691bc rj/test-sanitize-leak-log-fix later to maint).
* The http.cookieFile and http.saveCookies configuration variables
have a few values that need to be avoided, which are now ignored
with warning messages.
(merge 4f5822076f jc/http-cookiefile later to maint).
* Repacking a repository with multi-pack index started making stupid
pack selections in Git 2.45, which has been corrected.
(merge 8fb6d11fad ds/midx-write-repack-fix later to maint).
* Fix documentation mark-up regression in 2.45.
(merge 6474da0aa4 ja/doc-markup-updates-fix later to maint).
* Work around asciidoctor's css that renders `monospace` material
in the SYNOPSIS section of manual pages as block elements.
(merge d44ce6ddd5 js/doc-markup-updates-fix later to maint).
* Other code cleanup, docfix, build fix, etc.
(merge 493fdae046 ew/object-convert-leakfix later to maint).
(merge 00f3661a0a ss/doc-eol-attr-fix later to maint).
(merge 428c40da61 ri/doc-show-branch-fix later to maint).
(merge 58696bfcaa jc/where-is-bash-for-ci later to maint).
(merge 616e94ca24 tb/doc-max-tree-depth-fix later to maint).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:39 +0000 (18:19 +0200)]
exfatprogs: Update to version 1.2.5
- Update from version 1.1.3 to 1.2.5
- Update of rootfile
- Changelog
1.2.5
CHANGES :
* exfatprogs: remove the limitation that the device
path length cannot exceed 254 bytes.
* exfatprogs: include the test images in the release
package.
NEW FEATURES :
* fsck.exfat: check and repair the filename which has
invalid characters.
BUG FIXES :
* tune.exfat: check whether the volume has invalid
characters correctly.
* fsck.exfat: check whether the filename and volume
has invalid characters correctly.
* fsck.exfat: fix endianess issues which happen
in the big-endian system.
1.2.4
BUG FIXES :
* tune.exfat: Fix "invalid serial number" error when
setting an serial number.
* fsck.exfat: Fix memory leak in an error path
1.2.3
CHANGES :
* dump.exfat: Report sector size in bytes and cluster size in
terms of sectors.
* fsck.exfat: Show checksum value if the SetChecksum of File
directory entry is invalid.
* mkfs.exfat: Improve FAT length calculation to reduce
the FAT size.
NEW FEATURES :
* mkfs.exfat: Add the option "--sector-size".
* fsck.exfat: Support checking and repairing VendorAllcation and
VendorExtension directory entries.
BUG FIXES :
* exfatprogs: Remove unnecessary memory allocations.
* fsck.exfat: Fix corruption that can occur if the cluster size
is 512-byte.
* fsck.exfat: Fix the SecondaryCount of File directory entry
when the count of Name directory entries is 17 or higher.
* tune.exfat: Fix an error that accepts invalid serial numbers.
1.2.2
CHANGES :
* exfat2img: Allow dumps for read-only devices.
* fsck.exfat: Revert Repairing zero size directory.
NEW FEATURES :
* fsck.exfat: Repair duplicated filename.
* mkfs.exfat: Add the option "q" to print only error messages.
* mkfs.exfat: Add the option "U" to set volume GUID.
* tune.exfat: Add the option "U" / "-u" to set or print volume GUID.
BUG FIXES:
* fsck.exfat: Fix some out-of-bounds memory accesses.
* fsck.exfat: Change not to delete volume GUID directory entry.
1.2.1
CHANGES :
* fsck.exfat: Repair zero size directory.
* fsck.exfat: Four small clean-ups.
1.2.0
CHANGES :
* fsck.exfat: Keep traveling files even if there is a corrupted
directory entry set.
* fsck.exfat: Introduce the option "b" to recover a boot sector even
if an exFAT filesystem is not found.
* fsck.exfat: Introduce the option "s" to create files in
"/LOST+FOUND", which have clusters allocated but was not belonged to
any files.
* fsck.exfat: Rename '.' and '..' entry name to the one user want.
NEW FEATURES :
* fsck.exfat: Repair corruptions of an exFAT filesystem. Please refer
to fsck.exfat manpage to see what kind of corruptions can be repaired.
* exfat2img: Dump metadata of an exFAT filesystem. Please refer to
exfat2img manpage to see how to use it.
BUG FIXES:
* fsck.exfat: Fix an infinite loop while traveling files.
* tune.exfat: Fix bitmap entry corruption when adding new volume lablel.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:38 +0000 (18:19 +0200)]
curl: Update to version 8.9.1
- Update from version 8.8.0 to 8.9.1
- Update of rootfile
- Changelog
8.9.1
Bugfixes:
cmake: detect `libssh` via `pkg-config`
cmake: detect `nettle` when building with GnuTLS
cmake: drop `if(PKG_CONFIG_FOUND)` guard for `pkg_check_modules()`
configure: limit `__builtin_available` test to Darwin
connect: fix connection shutdown for event based processing
contrithanks.sh: use -F with -v to match lines as strings
curl: more defensive socket code for --ip-tos
CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
example/multi-uv: remove the use of globals
ftpserver.pl: make POP3 LIST serve content from the test file
GHA/windows: increase timeout for vcpkg build step
lib: survive some NULL input args
macos: fix Apple SDK bug workaround for non-macOS targets
misc: cleanup after removing years from copyright
os400: build cli manual.
os400: workaround an IBM ASCII run-time library bug
RELEASE-PROCEDURE.md: remove the initial build step
runtests: fold timing details with GHA, sync `-r` tflags
tests: provide FTP directory contents in the test file
tidy-up: URL updates
TODO: thread-safe sharing
transfer: speed limiting fix for 32bit systems
vtls: avoid forward declaration in MultiSSL builds
wolfSSL: allow wolfSSL's implementation of kyber to be used
wolfssl: avoid calling get_cached_x509_store if store is uncachable
wolfssl: CA store share fix
x509asn1: unittests and fixes for gtime2str
8.9.0
Changes:
curl: add --ip-tos (IP Type of Service / Traffic Class)
curl: add --mptcp
curl: add --vlan-priority
curl: add -w '%{num_retries}'
gnutls: support CA caching
mbedtls: support CURLOPT_CERTINFO
noproxy: patterns need to be comma separated
socket: support binding to interface *AND* IP
tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
urlapi: add CURLU_NO_GUESS_SCHEME
wolfssl: support CA caching
Bugfixes:
(lib)curl.rc: set debug flag also for `CURLDEBUG` and `UNITTESTS`
asyn-thread: avoid using GetAddrInfoExW with impersonation
aws-sigv4: url encode the canonical path
BINDINGS: update java link to one that exists
build: add Debug, TrackMemory, ECH to feature list
build: add more supported attributes to the IAR compiler
build: fix llvm 16 or older + Xcode 15 or newer, and gcc
build: fix llvm 17 and older + macOS SDK 14.4 and newer
build: sync warning options between autotools, cmake & compilers
build: tidy up `__builtin_available` feature checks (Apple)
build: untangle `CURLDEBUG` and `DEBUGBUILD` macros
build: use `#error` instead of invalid syntax
cd2nroff: convert two warnings to errors
cd2nroff: use an empty "##" to signal end of .IP sequence
cf-socket: improve SO_SNDBUF update for Winsock
cf-socket: optimize curlx_nonblock() and check its return error
cf-socket: remove obsolete recvbuf
cf-socket: remove two "useless" assignments
cfilters: make Curl_conn_connect always assign 'done'
cmake: add CURL_USE_GSASL option with detection + CI test
cmake: allow `ENABLE_CURLDEBUG=OFF` with `ENABLE_DEBUG=ON`
cmake: allow SOVERSION override with `CURL_LIBCURL_SOVERSION`
cmake: alpha-sort feature list
cmake: always build unit tests with the `testdeps` target
cmake: bring `curl-config.cmake` closer to `FindCURL`
cmake: create `configurehelp.pm` like autotools does
cmake: delete unused `HAVE_LIBSSH2`, `HAVE_LIBSOCKET` macros
cmake: detect `libidn2` also via `pkg-config`
cmake: enable SOVERSION for Cygwin and `CMAKE_DLL_NAME_WITH_SOVERSION`
cmake: fix `-Wredundant-decls` in unity/mingw-w64 builds
cmake: fix brotli lib order
cmake: fix building `unit1600` due to missing `ssl/openssl.h`
cmake: fix building in unity mode
cmake: fix building with both md4 and md5 in unity mode
cmake: fix builds with detected libidn2 lib but undetected header
cmake: fix feature and protocol lists for SecureTransport
cmake: fix quotes when appending multiple options (SecureTransport)
cmake: fix test 1013 with websockets enabled and no TLS
cmake: improve wolfSSL detection
cmake: show protocols, then features
cmake: stop setting SOVERSION for the static lib target
cmake: sync CA bundle/path detection with autotools
cmake: sync protocol/feature list with `curl -V` output
cmake: use `APPLE` instead of `CMAKE_SYSTEM_NAME` string
cmake: whitespace, formatting/tidy-up in comments
cmdline-docs: "added in" cleanups
cmdline-docs: fix `--proxy-ca-native` example + tidy-ups
cmdline-opts/_PROTOCOLS.md: mention WS(S)
cmdline-opts/ech.md: shorten the help text
cmdline-opts/fail.md: expand and clarify
cmdline-opts/interface.md: expand the documentation
cmdline-opts: category cleanup
cmdline-opts: expand the parallel explanations
cmdline-opts: shorten six help texts
cmdline: expand proxy option explanations
code: language cleanup in comments
configure: CA bundle/path detection fixes
configure: fix `SystemConfiguration` detection
configure: fix pkg-config library name 'libnghttp3'
configure: fix pkg-config names (zstd, ngtcp2*)
configure: limit `SystemConfiguration` test to non-c-ares, IPv6 builds
configure: remove 'deeper' checks for `AC_CHECK_FUNCS`
configure: require a QUIC library if nghttp3 is used
configure: sort feature list, lowercase protocols, use backticks
configure: use `$EGREP` in place of `grep -E`
configure: use AC_MSG_WARN for TLS/experimental warning texts
connect-to.md: expand with examples
connection: shutdown TLS (for FTP) better
cookie-jar.md: see also --junk-session-cookies
curl-config: revert to backticks to support old target envs
curl: allow etag and content-disposition for 3xx reply
curl: bsearch the --write-out variable name
curl: check for --disable case *sensitively*
curl: list categories in --help
curl: make warnings and other messages aware of terminal width
curl: output "flying saucers" with leading carriage return
curl_easy_escape: elaborate a little on encoding a URL
curl_mprintf.md: add missing comma
curl_multi_poll.md: expand the example with an custom file descriptor
curl_str[n]equal.md: tidy up text to make them stand-alone
curl_url_set.md: libcurl only parses :// URLs
curl_url_set: elaborate on scheme guessing
curldown: make 'added-in:' a mandatory header field
CURLOPT_CONNECTTIMEOUT*: clarify, document the milliseond version
CURLOPT_ECH.md: remove repeated 'if'
CURLOPT_NETRC.md: clarify what it does on Windows
CURLOPT_RESOLVE.md: mention hostname can be wildcard ('*')
CURLOPT_SSL_VERIFYHOST.md: refresh
CURLOPT_TLSAUTH_PASSWORD/USERNAME.md: language fixups
DISTROS: add a link to the list archive
DISTROS: add AlmaLinux package source link
DISTROS: add MSYS2 (native) links
docs/cmdline-opts: fix mail-auth example TLD typo
docs/cmdline-opts: remove two superfluous "Added in" mentions
docs/libcurl: polish the single-line descriptions
docs/Makefile.am: make curl-config.1 install
docs: reference non deprecated libcurl options
docs: start markdown headers with capital letter where applicable
doh-insecure.md: expand
doh: fix cleanup
doh: fix leak and zero-length HTTPS RR crash
dump-header.md: mention minus for stdout
examples/threaded-ssl: remove locking callback code
examples: add missing binaries to .gitignore
examples: delete unused includes
examples: fix compiling with MSVC
examples: suppress deprecation warnings locally
FEATURES.md: refresh
file: separate fake headers and body with a stand-alone CRLF
ftp: remove redundant null pointer check in loop condition
get.d: clarify the explanation
GHA/windows: add MSVC wolfSSL job with test
GHA/windows: ignore FTP test results for old-mingw-w64
GHA: add MSVC UWP job, expand jobs with more options
GHA: detect and warn for more English contractions
GHA: disable MQTT and WebSocket tests in Windows jobs
GHA: disable TFTP tests in Windows jobs
GHA: enable tests 1139, 1177, 1477 on Windows
GHA: improve vcpkg cache, add BoringSSL ECH and LibreSSL MSVC jobs
GHA: unify http3 workflows into one
GHA: use vcpkg to install packages for MSVC jobs
GIT-INFO.md: remove version requirements
gnutls: improve TLS shutdown
gnutls: pass in SNI name, not hostname when checking cert
help: add flags to output and ssh categories
hostip: skip error check for infallible function call
http/3: add shutdown support
http/3: resume upload on ack if we have more data to send
http: remove "struct HTTP"
http: write last header line late
idn: fix ß with AppleIDN
idn: make macidn fail before trying conversion if name too long
idn: tweak buffer use when converting with macidn
lib/v*: tidy up types and casts
lib: add a few DEBUGASSERT(data) to aid code analyzers
lib: add failure reason on bind errors
lib: fix gcc warning in certain debug builds
lib: fix thread entry point to return `DWORD` on WinCE
lib: graceful connection shutdown
lib: prefer `var = time(NULL)` over `time(&var)`
lib: tidy up types and casts
lib: xfer_setup and non-blocking shutdown
libcurl-docs: make option lists alpha-sorted
libcurl-easy.md: now *more* than 300 options
libcurl.pc: add `Requires.private`, `Requires` for static linking
libcurl.pc: add more `Requires.private`/`Requires` dependencies
libssh: remove CURLOPT_SSL_VERIFYHOST check
macos: add workaround for gcc, non-c-ares, IPv6, compile error
macos: undo `availability` macro enabled by Homebrew gcc
managen: "added in" fixes
managen: cleanups to generate nicer-looking output
managen: error on trailing blank lines in input files
managen: fix removing backticks from subtitles
managen: insert final .fi for files ending with a quote
managen: introduce "Multi: per-URL"
managen: only output .RE for manpage output
managen: output tabs for each 8 leading spaces
managen: warn on excessively long help texts
MANUAL.md: wrap two example urls that overrun styling
mbedtls: check version before getting tls version
mbedtls: check version for cipher id
mbedtls: correct the error message for cert blob parsing failure
mbedtls: send close-notify on close
mbedtls: v3.6.0 workarounds
md4: fix compilation with OpenSSL 1.x with md4 disabled
misc: fix typos
mk-ca-bundle.pl: delay 'curl -V' execution until it is needed
multi: add multi->proto_hash, a key-value store for protocol data
multi: do a final progress update on connect failure
multi: fix multi_wait() timeout handling
multi: fix pollset during RESOLVING phase
multi: multi_getsock(), check correct socket
ngtcp2+quictls: fix cert-status use
noproxy: test bad ipv6 net size first
openssl/gnutls: rectify the TLS version checks for QUIC
openssl: fix %-specifier in infof() call
openssl: fix hostname handling when using ECH
openssl: stop duplicate ssl key logging for legacy OpenSSL
os400: make it compilable again
pytest: add ftp upload tests
pytest: include testenv/vsftpd.py in dist tarball
quic: enable UDP GRO
quic: openssl quic, cmake and doc version update to 3.3.0
quic: require at least OpenSSL 3.3 for QUIC
quic: update to quiche 0.22.0
quiche: fix operand of ‘?:’ changes signedness
request.md: language fix
request: change the struct field bodywrites to a bool, only for hyper
reuse: switch to REUSE 3.2 and REUSE.toml
runtests: show name and keywords for failed tests in summary
runtests: sort test IDs in summary lines
runtests: support %DATEfor YYYY-MM-DD of right now
runtests: support %VERNUM
runtests: support crlf="yes" for the <stderr> section
sectransp: fix `HAVE_BUILTIN_AVAILABLE` checks to not emit warnings
sectransp: fix clang compiler warnings, stop silencing them
sectransp: remove large cipher table
sectransp: use common code for cipher suite lookup
sendf: fix CRLF conversion of input
smtp: for starttls, do full upgrade
socket: change TCP keepalive from ms to seconds on DragonFly BSD
socket: use SOCK_NONBLOCK to eliminate extra system call
socketpair: add `eventfd` and use `SOCK_NONBLOCK` for `socketpair()`
src/Makefile.am: remove SUBDIRS assignment
system_win32: add missing curl.h include
tcpkeepalive: support TCP keep-alive parameters on Solaris <11.4
test1119: adapt for `.md` input
test1139: scan .md files instead of .3 ones
test1175: scan libcurl-errors.md, not the generated .3 version
test1486: verify that write-out.md and tool_writeout.c are in sync
test2600: disable on win32
test: add test1484, for HEAD with content
test: add test1546, chunked not last transfer encoding
tests/scripts: call it 'manpage' (single word)
tests: add pytest for --ciphers and --tls13-ciphers options
tests: delete `CharConv` remains
tests: delete redundant `!MSDOS` guard
tests: extend user/password parsing test1620
tests: fix sshd IdentityFile path for MinGW/Cygwin
tests: fix sshd UserKnownHostsFile path for MinGW/Cygwin
tests: include current directory when running test Perl commands
tests: log "Throwing away" messages before throwing away
tests: run with "--trace-config all" to provide even more info
tests: sync feature names with `curl -V`
tests: test_17_ssl_use.py clarify mbedTLS TLSv1.3 support
tests: use exec when spawning nghttpx
tidy-up: use consistent casing for Windows directories
TODO: remove some old, clarify, add something
tool_cb_hdr: return error for failed header writes
tool_operate: avoid explicitly setting verifypeer to 1
tool_operate: simplify return code handling from url_proto()
tool_writeout: get certinfo only when needing it
trace-ascii.md: mention "%" for stderr
transfer: avoid polling socket every transfer loop
transfer: conn close on paused upload
transfer: do not use EXPIRE_NOW while blocked
transfer: remove curl_upload_refill_watermark, no longer used
transfer: set CSELECT_IN if there is data pending
unit2604: use 'unitfail' instead of 'error' variable
url: allow DoH transfers to override max connection limit
urlapi: remove unused definition of HOST_BAD
variable.md: make example use expand
verify-synopsis.pl: work with .md files
vms: fixed language in comment
vtls: deprioritize Secure Transport
vtls: replace addsessionid with set_sessionid
winbuild: fix PE version info debug flag
winbuild: MS-DOS batch tidy-ups
winbuild: remove outdated WIN32 defines
windows: fix UWP builds, add GHA job
winsock: move SO_SNDBUF update into cf-socket
wolfssl: assume key_file equal to clientcert if no key_file
wolfssl: use larger error buffer when formatting errors
x509asn1: add some common ECDSA OIDs
x509asn1: ASN1tostr() should fail when 'constructed' is set
x509asn1: fallback to dotted OID representation
x509asn1: make Curl_extract_certinfo store error message
x509asn1: prevent NULL dereference
x509asn1: remove superfluous free()
x509asn1: remove two static variables
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:36 +0000 (18:19 +0200)]
bash: Update to include patches 27 to 32
- Update from patches 1-26 to 1-32
- Update of rootfile not required
- Changelog of patches
27 The configure test for the presence of strtoimax(3) is inverted.
28 A DEBUG trap in an asynchronous process can steal the controlling terminal
away from the calling shell, causing it to exit.
29 There are problems with recovery after parser errors when parsing compound
assignments. For instance, the `local' builtin reports an error but never
cleans up the function context.
30 `wait -n' can fail to return some jobs if they exit due to signals the shell
does not report to the user.
31 There is a memory leak in the code that implements the optimized $(<file)
expansion for some code paths.
32 When printing functions containing coprocesses, the displayed coproc command
has the word COPROC inserted unconditionally, resulting in function bodies
that cannot be re-read as input.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 13 Aug 2024 16:19:16 +0000 (18:19 +0200)]
poppler: Update to version 24.08.0
- Update from version 24.03.0 to 24.08.0
- Update of rootfile
- sobump has dependency of cups-filters
- Changelog
24.08.0
core:
* Add support for modifying the appearance stream text in form field choice
* Fix buffer overflow in Windows specific font selection code
* Fix crashes in malformed files
* Internal code improvements
qt5:
* Add support for modifying the appearance stream text in form field choice
qt6:
* Add support for modifying the appearance stream text in form field choice
utils:
* pdfinfo: Fix crash in malformed documents
24.07.0
core:
* Fix crashes in broken files
* Internal code improvements
qt6:
* Add getters for document additional actions
* Implement reset forms link
qt5:
* Add getters for document additional actions
* Implement reset forms link
utils:
* pdfinfo: Fix crash in broken documents when using -dests
build system:
* Mark glib-mkenums as required
24.06.0
core:
* Performance improvements in some files
* Fix some issues with files bigger than 2^31 bytes
* Remove all cairo include guards for cairo < 1.16
* Fix MSVC build
* Internal code improvements
qt6:
* Update Qt6 doc example
* Use the non deprecated version of QString::fromUcs4
glib:
* properly document return value from poppler_font_info_scan
24.05.0
core:
* Fix signing not being totally correct in some kind of PDF files
* Assume "Adobe-Identity" for character collection. Issue #1465
* Small improvements in annotation font rendering
* Remove some GooString methods, use std::string ones instead
* Move some GooString methods to UTF.h
* Fix crash in broken files
cpp:
* cpp: Fix crash extracting text and font in some files. Issue #1477
* Change base class of ustring to char16_t
qt6:
* Add async API for certificate validation
* Fix text extraction for Landscape/Seascape pages
qt5:
* Add async API for certificate validation
* Fix text extraction for Landscape/Seascape pages
utils:
* pdfdetach: Small code improvements
* pdftops: Write compliant ps header
build system:
* Increase minimum supported base to that provided by Ubuntu 22.04
24.04.0
core:
* Optimize page text extraction speed
* Fix clipping path handling in some files. Issue #739
* Fix regression in text selection
* Fix text search across lines between paragraphs
qt6:
* Fix crash in SoundObject::data
utils:
* pdfsig: Add Catalan translation
build system:
* Build code as C++20
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Mon, 12 Aug 2024 15:38:08 +0000 (17:38 +0200)]
stunnel: Update to version 5.72
- Update from version 5.71 to 5.72
- Update of rootfile not required
- Changelog
5.72
* Security bugfixes
- OpenSSL DLLs updated to version 3.2.1.
* Bugfixes
- Fixed SSL_CTX_new() errors handling.
- Fixed OPENSSL_NO_PSK builds.
- Android build updated for NDK r23c.
- stunnel.nsi updated for Debian 12.
- Fixed tests with OpenSSL older than 1.0.2.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Mon, 12 Aug 2024 15:38:07 +0000 (17:38 +0200)]
pmacct: Update to version 1.7.9
- Update from version commit 5a5e272 to 1.7.9
- Update of rootfile not required
- Changelog
The keys used are:
!: fixed/modified feature, -: deleted feature, +: new feature
1.7.9
+ pmtelemetryd: gRPC data collection functionalities were added to
the daemon. https://github.com/scuzzilla/mdt-dialout-collector is
the library linked to add the functions required to collect data
via gRPC dialout. Thanks to Salvatore Cuzzilla ( @scuzzilla ) for
this contribution, along with the ninja support of Marc Sune
( @msune ).
+ BMP daemon: HA support introduced: in order to add redundancy at
data collection, let multiple collectors to establish indentical
BMP session, while only one is sending data to the backend. Thanks
to Zhuoyao Lin ( @Zephyre777 ) and Leonardo Rodoni ( @rodonile )
for this contribution.
+ nfacctd: developed a more robust and streamlined NetFlow v9/
IPFIX template handling framework based on libcdada structures,
hence dropping the previous ad-hoc home-grown memory structures.
+ nfacctd: introduced support for sampling rate calculation based
on IANA entities IE309 (samplingSize), IE310 (samplingPopulation),
which are being exported in IPFIX sampling options for a random-n-
out-of-N sampler. Also, support for 16-bit and 32-bit selectorID
is added as well. Thanks to Leonardo Rodoni ( @rodonile ) for this
contribution.
+ nfacctd: extended the support of IE130 (exporterIPv4Address) and
IE131 (exporterIPv6Address) for when this info is contained in
data packets. Thanks to Leonardo Rodoni ( @rodonile ) for this
contribution.
+ nfacctd: added nfacctd_ignore_exporter_address config knob to
not honour IE130 (exporterIPv4Address), IE131 (exporterIPv6Address)
and use the socket address instead.
+ nfacctd: improved support for Route Distinguisher (RD): added the
case where the RD information has finer-grained scope in Option
packets; also RD in IPFIX Options can now be used for correlating
data against BGP/BMP. Finally priority of supplied RD info is
streamlined as: RD in flow_to_rd.map > RD in IPFIX/NFv9 data
packet > RD in IPFIX/NFv9 option packets. Thanks to Leonardo
Rodoni ( @rodonile ) for these contributions.
+ nfacctd: added IEs 44 (sourceIPv4Prefix), 170 (sourceIPv6Prefix),
45 (destinationIPv4Prefix), and 169 (destinationIPv6Prefix) to
flow heuristics.
+ nfacctd: as part of src_mac, dst_mac primitives, added support
for IEs 365 (staMacAddress) and 366 (staIPv4Address).
+ nfacctd: introduced support for IE497 (srhSegmentIPv6ListSection),
The SRv6 Segment List as defined in Section 2 of [RFC8754] as a
series of octets in IPFIX. Also added Path Delay measurements
PathDelay{Mean,Min,Max,Sum}DeltaUsecs.
+ nfacctd: tunnel primitives (tunnel_src_host, tunnel_dst_host,
tunnel_proto, tunnel_tos, tunnel_src_port, tunnel_dst_port and
tunnel_tcpflags) were linked to SRv6 code. Also, in this context,
support for repeating IEs has been added. Thanks to Uwe Storbeck
( @ustorbeck ) for this contribution.
+ nfacctd: extended IE89 (forwardingStatus) support to be 2 or 4
bytes long. Also introduced support for IE31 (flowLabelIPv6).
Thanks to Uwe Storbeck ( @ustorbeck ) for these contributions.
+ nfacctd: a new primitive 'nvgre' is defined representing the
Tenant Network Identifier (TNI) for NVGRE L2 tunnels, which is
encoded in IANA IE351 (layer2SegmentId) with MSB 0x02. Thanks to
Leonardo Rodoni ( @rodonile ) for this contribution.
+ sfacctd: added support for accounting for ARP packets via a new
aggregate_unknown_etype config knob.
+ nfacctd, sfacctd, pmacctd: added new 'in_cvlan' and 'out_cvlan'
primitives. It identifies the VLAN to which the frame belongs to
when it is transmitted in the customer network.
+ BGP daemon: added support for "Only to Customer" OTC attribute,
RFC9234.
+ BGP daemon: extend MP nexthop length to support 48 bytes to fit
the BGP VPNv6 nexthop length. Thanks to @FRIDM636 for this
contribution.
+ BGP daemon: as specified by RFC8950, routers cannot advertise
IPv4 or VPNV4 routes with an IPv6 next hop without an extra
capability advertisement (Extended Next Hop Encoding). This has
been added so that the daemon can reply with this capability to
the remote peer. Thanks to Leonardo Rodoni ( @rodonile ) for
this contribution.
+ BGP, BMP daemons: Two new configuration keys are introduced:
bgp_comms_encode_as_array and as_path_encode_as_array to allow
to specify that BGP communities and AS_PATH are encoded as an
array in JSON or AVRO encodings.
+ BMP daemon: a new bmp_dump_exclude_stats config knob has been
added: if enabled, BMP Stats messages are not going to be cached
and thus not being included in the regular dump.
+ All daemons: added a -T / dry_run config knob. With the 'config'
argument only configuration is validated; with the 'setup' one
the daemon and its plugins are also instantiated and validated.
+ Kafka plugin: allowing to configure sub-minute historical time
bins (ie. kafka_history, etc.).
+ pre_tag_map: introduced pre_tag_map_dont_recirculate config knob
to explicitely disable v4/v6 recirculation of entries without an
'ip' key specified. Also if 'ip' key is not defined, still define
the address family (AF) so to be memory-savvy and avoid creating
duplicate entries in case of v4/v6 recirculation.
+ nDPI support: updated API calls to compile against nDPI 4.6. Also
dropped support for previous versions of the library.
! fix, nfacctd: treat the result of (SysUptime - fstime) as signed
to avoid a underflow in the case where fstime > SysUptime in
NetFlow v9. Thanks to Jim Westfall ( @jwestfall69 ) for this
contribution.
! fix, nfacctd: addressed a memory leak in handling NetFlow/IPFIX
templates. Also performed code re-factoring to better encapsulate
the template functionality, add a template header file, separate
the module interface from local functions and reduce the scope of
local functions. Thanks to Uwe Storbeck ( @ustorbeck ) for these
contributions.
! fix, nfacctd: parsing of IPFIX/NetFlow data when a template does
contain multiple padding octet fields IE 210 (paddingOctets) with
different length. Thanks to Uwe Storbeck ( @ustorbeck ) for this
contribution.
! fix, nfacctd: 4 bytes long IE95 (applicationID) is now supported;
as part of this work the setup of nDPI and NBAR classifiers have
been harmonized.
! fix, sfacctd: mispelled daemon type in sampling_direction handler
was causing counters not to print.
! fix, pmacctd: restored packet data pointer for correct collection
of ICMPv6 data.
! fix, uacctd: the daemon was crashing upon receipt an ICMP Echo
Request packet (as a result, for example, of a ping). Thanks to
Alexei A Smekalkine ( @ikle ) for this contribution.
! fix, pmtelemetryd: when no backend dump method is configured (and
telemetry_dump_time_slots is not set) pmtelemetryd was crashing
with SIGFPE. Also fixed the dump interval calculation when time
slots are used. Thanks to Uwe Storbeck ( @ustorbeck ) for these
contributions.
! fix, pmtelemetryd: restored ability of the daemon re-loading maps
via SIGUSR2 signal. Thanks to Salvatore Cuzzilla ( @scuzzilla )
for this contribution.
! fix, BGP, BMP daemons: the hash function used to distribute per-
peer information attached to RIB entries was enriched with the
addition of Route Distinguisher (RD) data in order to minimize
collisions. It is in fact crucial to have an efficient hash-table
to perform data correlation between BGP/BMP & IPFIX. Thanks to
Salvatore Cuzzilla ( @scuzzilla ), Leonardo Rodoni ( @rodonile )
for this contribution.
! fix, BMP daemon: finer grained control on support of ADD-PATH
capability as part of the Peer Up message in order to support
the case of remote peer receive-only scenario.
! fix, SQL plugins: 'in_vlan' primitive is not muxed anymore on
'vlan' keyword at configure time. Also, 'out_vlan' primitive is
now properly handled if sql_optimize_clauses left false.
! fix, MySQL plugin: if timestamps_utc is set to true, enforce UTC
for the current session.
! fix, tee plugin: missing variable definition when BSD definition
is on was preventing the code to compile correctly.
! fix, pre_tag_map: check added to avoid daemon hanging if 'next'
label was mentioned as part of the last map entry.
! fix, Redis: avoid to create a new file descriptor for every
reconnect. Use redisReconnect instead of redisConnect. Thanks to
Uwe Storbeck ( @ustorbeck ) for this contribution.
! fix, util.c: weekly time roundoff has been made consistent by
correctly including the first day of the week.
! fix, util.c: when pidfile is specified, use mkdir_multilevel() to
build dir structure if needed.
! fix, plugins_hook.c: when processing a pcap_savefile, perform an
inter-buffer sleep of 1ms only if using home-grown buffering as
ZeroMQ (plugin_pipe_zmq) would instead do fine absorbing the data
burst.
! fix, rpki_msg.c: missing json_decref() in rpki_roas_file_load()
was leaking memory on map reload. Also, solved a SEGV observed at
times when reloading rpki_roas_file. Finally free'd the output of
aspath_make_str_count() in rpki_roas_file_load().
- pmtelemetryd: removed legacy Python decoders and associated utils,
also removed support for Kafka and ZeroMQ telemetry collection.
- pre_tag_map: obsoleted 'fwdstatus' key.
- GeoIP support: removed support for Maxmind API v1.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
projects / ipfire-2.x.git / log
