Zephyr Lykos [Fri, 8 Mar 2024 04:35:07 +0000 (12:35 +0800)]
golang: Update to 1.22.1
Go 1.22.1 contains the following security fixes:
- CVE-2024-24783:
crypto/x509: Verify panics on certificates with an unknown public key
algorithm
- CVE-2023-45290
net/http: memory exhaustion in Request.ParseMultipartForm
- CVE-2023-45289
net/http, net/http/cookiejar: incorrect forwarding of sensitive headers
and cookies on HTTP redirect
- CVE-2024-24785
html/template: errors returned from MarshalJSON methods may break
template escaping
- CVE-2024-24784
net/mail: comments in display names are incorrectly handled
Til Kaiser [Fri, 26 Jan 2024 17:09:37 +0000 (18:09 +0100)]
mstflint: add new package
This commit adds a new package, including tools for
diagnosing Mellanox Spectrum Switches and ConnectX
NICs and querying and installing firmware.
Package Contents:
mflash lib
This lib provides low level Flash
access through Mellanox HCAs.
mtcr lib (implemented in mtcr.h file)
This lib enables access to HCA hardware registers.
mstregdump
This utility dumps hardware registers from
Mellanox hardware for later analysis by Mellanox.
mstvpd
This utility dumps the on-card VPD.
mstmcra
This debug utility reads/writes a to/from
the device configuration register space.
mstconfig
This tool sets or queries non-volatile
configurable options for Mellanox HCAs.
mstfwmanager
Mellanox firmware update and query utility which scans
the system for available Mellanox devices (only mst
PCI devices) and performs the necessary firmware updates.
mstreg
The mlxreg utility allows users to obtain information
regarding supported access registers, such as their
fields and attributes.
mstfwtrace
The mstfwtrace utility extracts and prints trace messages
generated by the firmware running on 5th generation
devices iRISCs. This tool supports secure FW flow only.
mstlink
The mstlink tool is used to check and debug
link status and issues related to them.
,,_ -*> Snort++ <*-
o" )~ Version 3.1.82.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.14
Using LuaJIT version 2.1.0-beta3
Using OpenSSL 3.0.13 30 Jan 2024
Using libpcap version 1.10.4 (with TPACKET_V3)
Using PCRE version 8.45 2021-06-15
Using ZLIB version 1.3.1
Using Hyperscan version 5.4.2 2024-03-06
Using LZMA version 5.4.6
syslog-ng: enable http module based on zlib support in curl
Since version 4.4.0, syslog-ng added compression to http() destination
using zlib from curl. [1] However, zlib is currently disabled in curl [2]
and it prevented syslog-ng to start.
This commit changes the configuration opinion to enable http module only if
zlib support is enabled for curl and as well it adds dependency for zlib (in that case).
If the zlib is disabled, then it disables http module, so syslog-ng can start
and thus zlib dependency is not required.
[1] https://gitlab.nic.cz/turris/os/packages/-/issues/932
[2] https://github.com/openwrt/packages/blob/93cbaacbfb13048ad378520a7afea7c9027dd1d6/net/curl/Config.in#L134 Fixes: 4dd49d7c3cd571107958154f1ed1ec8d8dba7464 ("syslog-ng: update to version 4.4.0") Signed-off-by: Josef Schlehofer <redacted>
libpfring: backport patch fixing compilation error for sa_data
Backport patch fixing compilation error for sa_data not well defined.
This is triggered only on platform that makes use of fortify string and
cause compilation error due to the fact that sa_data is not well defined
and his size is arbitrary.
Patch has been accepted in the PF_RING project and this is just a
backport.
Hauke Mehrtens [Sun, 17 Mar 2024 19:04:09 +0000 (20:04 +0100)]
minisatip: Fix configure option for openssl
The configure option which depends on openSSL is named --disable-dvbca
and not --disable-dvbaes
This fixes the following warning:
configure: WARNING: unrecognized options: --disable-dependency-tracking, --disable-nls, --disable-dvbaes
When the option is not set configure will check if openssl is available
and compile against openssl if it find openssl. This breaks the build
because openssl is not defined as a package dependency.
Jan Klos [Mon, 19 Feb 2024 13:27:05 +0000 (14:27 +0100)]
unbound: add file parameter to service instance
that way, procd does not needlessly restart unbound on triggers when
everything remains the same - changes in non-default included
configuration files will not be registered, however
Jonas Jelonek [Wed, 6 Mar 2024 13:44:40 +0000 (14:44 +0100)]
gping: new package
gping is ping but with a graph. It graphically plots ping results
over time in terminal, allows multiple hosts to ping in parallel,
uses coloured output and can also plot the execution time of
arbitrary commands.
Paul Spooren [Thu, 14 Mar 2024 13:46:15 +0000 (14:46 +0100)]
ci: set correct arch for rootfs tests
With the commit 01e5cfc "CI: Add target/arch tags (no suffix) for
snapshot images"[1] the os/platform is set for all images, which is usually
different from what the GitHub action runner uses (x86). The Docker
deamon still tries to fetch the x86 version and fails.
Daniel Golle [Fri, 8 Mar 2024 23:26:56 +0000 (23:26 +0000)]
gnunet: update to version v0.21.0
This release marks a noteworthy milestone in that it includes a
completely new transport layer. It lays the groundwork for fixing some
major design issues and may also already alleviate a variety of issues
seen in previous releases related to connectivity. This change also
deprecates our testbed and ATS subsystem.
This is a new major release. It breaks protocol compatibility with the
0.20.x versions. Please be aware that Git master is thus henceforth
(and has been for a while) INCOMPATIBLE with the 0.20.x GNUnet
network, and interactions between old and new peers will result in
issues. In terms of usability, users should be aware that there are
still a number of known open issues in particular with respect to ease
of use, but also some critical privacy issues especially for mobile
users. Also, the nascent network is tiny and thus unlikely to provide
good anonymity or extensive amounts of interesting information. As a
result, the 0.21.0 release is still only suitable for early adopters
with some reasonable pain tolerance.
v0.21.0:
- Reworked PEERSTORE API
- Added record flag for maintenance records
- ensure traits can be generated with subsystem-specific prefixes for
the symbols
- libgnunettesting first major testing NG refactor towards getting
dependency structure streamlined
- Remove single-use API macro GNUNET_VA_ARG_ENUM
- major revision of blind signature API
- Introduced closure to hold store context when caling function to add
hello in peerstore.
- Added DDLs for handling GNUNET_PEERSTORE_StoreHelloContext
- Removed old hello functionality.
- Refactoring components under src/ into lib/, plugin/, cli/ and
service/
- add support for encoding/decoding double values as part of JSON to
libgnunetjson
- Changed method GNUNET_HELLO_builder_get_expiration_time to not need
parameter GNUNET_HELLO_Builder.
- Code moved to the core package to get rid of circular dependencies.
- Moved code to testing to have more generic test setup, which can be
used not only from within transport.
- The old hello design replaced by the new hello design.
- Added api to get notified when hellos are stored with peerstore
service.
- Added api to store hellos with peerstore service.
- Changed new hello uri api to allow to change the expiration time
- Moved start peer command to testing subsystem.
- Removed all usage of old transport api, beside peerinfo tool,
gnunet-transport cli and usage in transport layer itself.
- Added __attribute__((deprecated)) to the old transport API
krant [Wed, 28 Feb 2024 11:50:10 +0000 (13:50 +0200)]
irqbalance Update init script to remove duplicate spaces
I have some strange issues with irqbalance sometimes overwritin
smp_affinity values for banned/ignored IRQs. The issue is reproduceable
and is mitigated when I change theway how the irqbalance command line is
built. The only difference between the resulting command is that there
is only one space between the -t parameter and the first -i parameter
value.
Also see https://github.com/Irqbalance/irqbalance/issues/297
Tony Ambardar [Wed, 6 Mar 2024 09:18:34 +0000 (01:18 -0800)]
zabbix: zabbix_helper_mac80211.c: use POSIX <libgen.h> header
The musl libc only implements POSIX basename() but provided a GNU header
kludge in <string.h>, which was removed in musl 1.2.5 [1]. Use the standard
<libgen.h> header to avoid compilation warnings like:
zabbix-6.4.7/zabbix-extra-mac80211/zabbix_helper_mac80211.c:37:11: warning:
implicit declaration of function 'basename' [-Wimplicit-function-declaration]
37 | phy = basename(phy);
| ^~~~~~~~
zabbix-6.4.7/zabbix-extra-mac80211/zabbix_helper_mac80211.c:37:9: warning:
assignment to 'char *' from 'int' makes pointer from integer without a cast
[-Wint-conversion]
37 | phy = basename(phy);
| ^
zabbix-6.4.7/zabbix-extra-mac80211/zabbix_helper_mac80211.c:38:10: warning:
assignment to 'char *' from 'int' makes pointer from integer without a cast
[-Wint-conversion]
38 | stat = basename(stat);
| ^
Link 1: https://git.musl-libc.org/cgit/musl/log/?qt=grep&q=basename
Florian Eckert [Tue, 5 Mar 2024 13:58:33 +0000 (14:58 +0100)]
modemmanager: reconnect interface if the modemmanager detects a disconnect
There are situation for mobile routers, that the modemmanager can not
stay connected to the mobile network. There can have various reasons.
In order for the system to reconnect automatically, the netifd must be
informed that it must re-establish the connection.
The modem manager already does have a script callback handling which is
already used by the modemmanager in openwrt. Currently the modem is marked
as not unavailable when a disconnected event is detected.
The behavior was changed with this commit, so that a reconnect of the
interface is now triggerd via the netifd if the modem disconnects.
1. Bump version config to 4.6
2. Updated to 4.6.0 version
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.6.0
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.5.0
Florian Eckert [Wed, 21 Feb 2024 15:41:32 +0000 (16:41 +0100)]
modemmanager: start a 3gpp network regsistration
If a 'plmn' is set in the configuration, a registration attempt should be
established before the simple-connect command. If the plmn is set during
the simple-connect, a network change may occur during the connection setup.
To prevent this, the registration is started before the simple-connect with
a separate mmcli command. So that we can be sure that the modem is already
registered in the correct network before the simple-connect command.
Florian Eckert [Wed, 21 Feb 2024 15:03:07 +0000 (16:03 +0100)]
modemmanager: move cleanup and enable to the top
Before a new connection attempt is made, the previous connection must be
cleaned up before further connection attempts are made. This is now done
by moving the cleanup and enable sequence to the beginning of the
conection setup.
Florian Eckert [Tue, 5 Mar 2024 11:59:23 +0000 (12:59 +0100)]
modemmanager: moving the openwrt related files to subdirectories
Moving the openwrt related files to subdirectories as they are installed
on the system. This change makes it immediately apparent during development
where the file is to be installed in the running system.
Dirk Brenken [Sat, 2 Mar 2024 08:28:39 +0000 (09:28 +0100)]
banip: release 0.9.4-1
* add support for destination port & protocol limitations for external feeds (see readme for details),
useful for lan-forward ad- or DoH-blocking, e.g. only tcp ports 80 and 443
* add turris sentinel blocklist feed
* update readme
Stan Grishin [Sat, 2 Mar 2024 00:13:49 +0000 (00:13 +0000)]
https-dns-proxy: update to upstream 2023-11-19
* update to upstream 2023-11-19
(changes: https://github.com/aarond10/https_dns_proxy/commit/489c57efd46983e688579974a2ab7aeaa7df8d83)
* bugfix: include resolveip dependency in Makefile
(fixes https://github.com/openwrt/packages/issues/23567)
* minor update for failed healthcheck logging
Sergey Ponomarev [Wed, 28 Feb 2024 20:13:47 +0000 (22:13 +0200)]
acme-acmesh: use validation_method option instead of guessing
The new validation_method option can be: dns, webroot or standalone.
Previously we guessed the challenge type:
1. if the DNS provider is specified then it's dns
2. if standalone=1
3. fallback to webroot
The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner.
Sergey Ponomarev [Wed, 28 Feb 2024 19:59:27 +0000 (21:59 +0200)]
acme-common: use validation_method option instead of guessing
The new validation_method option can be: dns, webroot or standalone.
Previously we guessed the challenge type:
1. if the DNS provider is specified then it's dns
2. if standalone=1
3. fallback to webroot
The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner.
git.99rst.org / openwrt-packages.git / log