Michael Tremer [Tue, 11 Aug 2020 15:56:43 +0000 (15:56 +0000)]
spandsp: Update to 0.0.6
This package - for some reason - does not build on i586 with
the latest version of glibc. The reason is that MMX instructions
are being used which are not allowed on i586.
However, since the assembler has not been changed, this should
have been caught before. Weird.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 2 May 2020 09:52:25 +0000 (11:52 +0200)]
de.pl: fix misleading translation
The 'geoip' key is being used in the firewall.cgi for configuring GeoIP
as a source or destination. "konfigurieren" is misleading in this
context.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Peter Müller [Sat, 25 Jul 2020 19:08:37 +0000 (19:08 +0000)]
network-functions.pl: add missing unit tests for changed, network membership procedure
Cc: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk> Cc: Alexander Marx <alexander.marx@ipfire.org> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Peter Müller [Sat, 25 Jul 2020 19:08:07 +0000 (19:08 +0000)]
network-functions.pl: fix network membership test
This is based on an orphaned patch provided by Tim FitzGeorge and
_finally_ fixes incorrect network membership calculations. Those were
are usability pain in the ass deluxe, as they rendered some combinations
of configuring OpenVPN and IPsec services unusable.
Fixes: #11235 Fixes: #12263 Cc: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk> Cc: Michael Tremer <michael.tremer@ipfire.org> Cc: Alexander Marx <alexander.marx@ipfire.org> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Adolf Belka [Tue, 28 Jul 2020 18:17:43 +0000 (18:17 +0000)]
bacula: Correction to 9.6.5
- Corrected Download URL to remove filename from the end of it. This is defined separately.
- Corrected to include install command for backup file which was missed in previous patch.
- Added backup file to rootfiles list. Signed-off-by: Adolf Belka<ahb.ipfire@gmail.com> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Tue, 28 Jul 2020 17:18:19 +0000 (17:18 +0000)]
core148: Do not update the location database straight away
This process takes a long time and stalls the update process.
Since the cronjob is being called once an hour, all systems will
very quickly pull a recent database which will then be extracted
in the background not disrupting the Core Update process.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Stefan Schantl [Sat, 11 Jul 2020 10:11:02 +0000 (12:11 +0200)]
convert-to-location: Regenerate firewall chains.
The firewall chain for location based rules has been renamed to
LOCATIONBLOCK and therefore the fiewall needs to be restarted and
the chains regenerated.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Rationale: "authenticate_ip_ttl" can be safely used as it does not
introduces an authentication bypass, but saves relationships between
successfully authenticated users and their IP addresses.
"max_user_ip" depends on such an authentication cache, so credential
sharing between several IPs (on purpose or by chance) can be detected
properly. This is useful in case of crompromised machines and/or
attackers in internal networks having stolen proxy authentication
credentials.
Quoted from squid.conf.documented or man 5 squid.conf:
> acl aclname max_user_ip [-s] number
> # This will be matched when the user attempts to log in from more
> # than <number> different ip addresses. The authenticate_ip_ttl
> # parameter controls the timeout on the ip entries. [fast]
> # If -s is specified the limit is strict, denying browsing
> # from any further IP addresses until the ttl has expired. Without
> # -s Squid will just annoy the user by "randomly" denying requests.
> # (the counter is reset each time the limit is reached and a
> # request is denied)
> # NOTE: in acceleration mode or where there is mesh of child proxies,
> # clients may appear to come from multiple addresses if they are
> # going through proxy farms, so a limit of 1 may cause user problems.
Fixes: #11994 Cc: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Peter Müller [Sat, 20 Jun 2020 09:37:22 +0000 (09:37 +0000)]
update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.
The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Matthias Fischer [Fri, 19 Jun 2020 17:18:21 +0000 (19:18 +0200)]
bind: Update to 9.11.20
For details see:
https://downloads.isc.org/isc/bind9/9.11.20/RELEASE-NOTES-bind-9.11.20.html
"Security Fixes
It was possible to trigger an INSIST failure when a zone with
an interior wildcard label was queried in a certain pattern. This
was disclosed in CVE-2020-8619. [GL #1111] [GL #1718]
New Features
dig and other tools can now print the Extended DNS Error (EDE)
option when it appears in a request or a response. [GL #1835]
Bug Fixes
When fully updating the NSEC3 chain for a large zone via IXFR,
a temporary loss of performance could be experienced on the
secondary server when answering queries for nonexistent data that
required DNSSEC proof of non-existence (in other words, queries that
required the server to find and to return NSEC3 data). The
unnecessary processing step that was causing this delay has now been
removed. [GL #1834]
A data race in lib/dns/resolver.c:log_formerr() that could lead
to an assertion failure was fixed. [GL #1808]
Previously, provide-ixfr no; failed to return up-to-date responses
when the serial number was greater than or equal to the current
serial number. [GL #1714]
named-checkconf -p could include spurious text in server-addresses
statements due to an uninitialized DSCP value. This has been fixed.
[GL #1812]
The ARM has been updated to indicate that the TSIG session key is
generated when named starts, regardless of whether it is needed. [GL
#1842]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Adolf Belka [Tue, 16 Jun 2020 18:43:52 +0000 (20:43 +0200)]
bacula: Update to 9.6.5
- Update bacula from version 9.0.6 to 9.6.5
Version 9.0.6 is over two and a half years old.
- Update config options in lfs to include bacula recommended smartalloc option.
"This enables the inclusion of the Smartalloc orphaned buffer detection
code. This option is highly recommended. Because we never build without this option,
you may experience problems if it is not enabled. In this case, simply re-enable the
option. We strongly recommend keeping this option enabled as it helps detect memory
leaks. This configuration parameter is used while building Bacula"
- Add install, uninstall and update files in src/paks/bacula
- Updated backup/includes to backup the config file and the File Daemon state file.
Signed-off-by: Adolf Belka <ahb.ipfire@gmail.com> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Tue, 16 Jun 2020 17:48:35 +0000 (19:48 +0200)]
dhcpcd: Update to 9.1.2
For details see:
https://roy.marples.name/blog/dhcpcd-9-1-2-released.html
"Fix installing dhcpcd-definitions.conf rather than embedding it
NetBSD: free ARP state once IPv4LL address announced
Linux: fix compile for older distros
udev: disable plugin for non Linux OS's
BSD: Mark RA dervied addresses as AUTOCONF on NetBSD-current
BSD: Only mark static routes from dhcpcd.conf as static
DHCP6: Ensure requested addresses are requested
DHCP6: Fix prefix length calculation when no prefix specified
privsep: Implement a resource limited sandbox [1]
privsep: Remove inet and dns pledges from master process
privsep: call getifaddrs when the BSD lacks SIOCGIFALIAS
privsep: free getifaddrs the right way if from privsep or not
[1] You will see a control proxy process now. This is for the resource
limited sandbox so that we can isolate requests over the control socket.
For NetBSD, FreeBSD and derivatives such as DragonFlyBSD this is
a massive win as these OS now enjoy a similar level of protection
as Capsicum or Pledge, but without the syscall filtering."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 16 Jun 2020 15:40:44 +0000 (15:40 +0000)]
firewall: Always enable connection tracking for GRE
If this module is not being loaded, the kernel will mark any
GRE connection as INVALID in connection tracking, which will
be then silently dropped by a firewall rule.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
projects / ipfire-2.x.git / log
