File project.diff of Package pihole-ftl

Overview Repositories Revisions Requests Users Attributes Meta

File project.diff of Package pihole-ftl (Revision 7def1b157fb831cc1fe56714e04bbde3)

Currently displaying revision 7def1b157fb831cc1fe56714e04bbde3 , Show latest

--- fix-build-with-libnettle-3.5.patch.orig
+++ fix-build-with-libnettle-3.5.patch
@@ -9,10 +9,10 @@ Signed-off-by: DL6ER <dl6er@dl6er.de>
  dnsmasq/crypto.c | 8 ++++++--
  1 file changed, 6 insertions(+), 2 deletions(-)
 
-diff --git a/dnsmasq/crypto.c b/dnsmasq/crypto.c
+diff --git a/src/dnsmasq/crypto.c b/src/dnsmasq/crypto.c
 index ebb871e..fecc64a 100644
---- a/dnsmasq/crypto.c
-+++ b/dnsmasq/crypto.c
+--- a/src/dnsmasq/crypto.c
++++ b/src/dnsmasq/crypto.c
 @@ -275,6 +275,10 @@ static int dnsmasq_ecdsa_verify(struct blockdata *key_data, unsigned int key_len
    static struct ecc_point *key_256 = NULL, *key_384 = NULL;
    static mpz_t x, y;
--- pihole-ftl.changes.orig
+++ pihole-ftl.changes
@@ -1,3 +1,174 @@
+--------------------------------------------------------------------
+Tue Sep 15 07:40:28 UTC 2020 - pihole-suse-packages@smar.fi
+
+- Update to version v5.2
+  + Move counters definition from memory.c to shmem.c magically clears a lot of (wrong) VSCode errors. Doing this on request of a user as it is harmless.
+  + Import unknown clients from ARP table
+  + Explicitly set prepared statements to NULL when they are finalized.
+  + Explicitly log if we had to make assumptions because the gravity database was not available.
+  + Add DELAY_STARTUP setting to delay startup of the embedded dnsmasq.
+  + Remove option FORCE_LOCAL_RESOLVER as we do not need it.
+  + Add more comments, only print debugging output when DEBUG_DATABASE is enabled.
+  + Simplify SQLite 3 database extension
+  + Convert recently found (at most 1 hour old) mock-devices into "real" when we gather ARP/neigh information about them.
+  + Fix nameserver list in auth mode.
+  + Allow overriding of ubus service name.
+  + CircleCI has an unforseeable number of devices in its ARP cache. Do not check for a strict number of clients during the tests. No changes to the source code.
+  + Ensure blocking also works when the long-term database is not used. This was broken before as we returned too early (the SQLite3 engine was not yet fully initialized) when the long-term database was disabled.
+  + Fix possible memory leak in config.c
+  + Some general tweaks
+  + Explicitly log failures in creating the new sqlite3 function.
+  + Ensure we don't loose memory after ARP cache parsing.
+  + Also return NO MATCH when invoking subnet_match() with non-TEXT arguments.
+  + Add a comment that gethostbyaddr() may leak memory (only once, not seen leakage of more than 110 bytes)
+  + Check arguments are of type SQLITE3_TEXT
+  + Initialize resolver subroutines if trying to resolve for the first time
+  + Only check/set client status when size of the array is not exceeded. Skip otherwise.
+  + Do not import unknown clients from the ARP cache into FTL's memory. It is not our job to care about them if they are not doing any DNS queries.
+  + Ensure ARP strings are NULL-terminated
+  + Exiting instead of aborting may be benefitial in FTL forks.
+  + Print arguments passed to embedded dnsmasq when at least one DEBUG flag is set.
+  + Re-open gravity database (and re-prepare database statements) before accessing the database in case FTL forked.
+  + Memorize PID of this thread to avoid re-opening the gravity database connection multiple times for the same fork
+  + Implement process-private prepared gravity database client statements. This fixes an incompatibility across forks when serving TCP traffic using dedicated workers.
+  + Silently increase size of vector if trying to read out-of-bounds
+  + Explicitly include type definition of int16_t in config.h as needed by the musl-compiler
+  + Remove append and delete instructions as we will always identify clients exactly by their IDs
+  + Musl's realloc() does not zero any memory. Do this manually.
+  + Free allocated memory after ordinary termination of TCP workers (TCP connection closed)
+  + Fix rare problem allocating frec for DNSSEC.
+  + Tweak to DNSSEC logging.
+  + Restored astrisk match for auditlog
+  + Correct, indent and simplify wildcard-compatible auditlog SQL logic.
+  + Modify FTL's internal resolver to work in two phases: First, try to obtain a host name by using the internal resolver (i.e., FTL). In a second step, when FTL didn't know the answer, ask the resolvers as configured by resolv.conf. We've seen that the latter is necessary to get proper name resolution in docker environments.
+  + Convert port from host to network byte order
+  + src/dnsmasq/dnsmasq.c: Labeled a lonely #endif
+  + Update dnsmasq version to pi-hole-v2.81
+  + Don't try setsockopt of non-existing NETLINK_NO_ENOBUFS option (fixes qemu issue).
+  + Revert "Don't try setsockopt of non-existing NETLINK_NO_ENOBUFS option (fixes qemu issue)."
+  + Convert failure of setsockopt(..., SOL_NETLINK, NETLINK_NO_ENOBUFS, ...) into warning.
+  + Make regex matching case-insensitive by default and remove config option to control this.
+  + Automatically block _esni.* subdomains of blocked domains. This can be disabled by setting BLOCK_ESNI=false in pihole-FTL.conf
+  + Simplify blocking metadata forcing code.
+  + Add full drop-in replacement mode pihole-FTL can use to mimic the dnsmasq binary.
+  + Add a shortcut for dnsmasq syntax test
+  + Do not decide whether we are blocking or not based on the gravity count (pre-v5.0 measure) but use the dedicated blockingstatus variable.
+  + Use /run instead of /var/run for FTL runtime files
+  + Deleted Swag store affiliate link
+  + Invoking free_sqlite3_stmt_vec() on a NULL pointer should be a harmless no-op.
+  + Check for validity of prepared statements before trying to use their get property.
+  + Create "message" table and log regex errors in there.
+  + Fix bit-order in subnet mask generation.
+  + Bump build container version.
+  + Use BLOBs as datatype for the custom columns to keep this feature as generic as possible. We can always append more columns to the end of the table whenever needed.
+  + Store message type as string instead of enum values.
+  + Ensure message table is also flushed on receipt of real-time signals.
+  + Always chose most suitable (= maximum) subnet for clients. This allows to configure specific settings for a whole range of devices but still exclude others. Complain softly (no error) if multiple configured subnets match with the same number of relevant bits.
+  + Ensure to finalize statement before closing the database connection.
+  + Explicitly include limits.h in src/files.c to improve ppc64le support on Alpine. This fixes #751
+  + Store subnet warnings in the message table.
+  + Add User-Agent to macvendor.py
+  + Process cached SRV records
+  + Simple optimizations
+  + Skip CircleCI Upload step on foreign PRs.
+  + Add addr2line output into our self-generated backtraces.
+  + Only compile print_addr2line() when we can actually generate backtraces.
+  + Add comment
+  + Remove unneeded inet_ntop
+  + Fix indentation
+  + Fix indentation
+  + Reload the privacy level when reloading the lists
+  + Bump to v1.2 build images.
+  + Add NAMES_FROM_NETDB option.
+  + Store client group information in shared memory.
+  + Add checks for the compiled binary for all supported CI platforms.
+  + Don't need to call inet_ntop here
+  + Also check result of "file pihole-FTL" to do some further checks on the generated binary. This now includes a check for the minimum supported Linux version.
+  + Add cmake build
+  + Implement install step to be the same as the Makefile build
+  + Default install prefix to /usr
+  + Put runtime output, i.e. pihole-FTL, in the root of the build dir
+  + Move sqlite3-ext to the database target
+  + Fix build of sqlite3. Move sqlite3 defines to the top level so they are on all.
+  + Add "not stripped" to arm-qemu test
+  + Reduce README.md
+  + Fix static build
+  + Really, really fix static build
+  + Add boolean to be able to store if we decided which groups to be used (an empty string can actually mean no groups as a special case)
+  + Fix broken RESOLVE_IPV{4,6} setting.
+  + Fix possible memory issue by obtaining pointer only when it is guaranteed that the pointer will not change.
+  + Remove Makefile
+  + Add license headers to CMake files
+  + Use cmake on CI to generate FTL binaries.
+  + Lower needed cmake version to 2.8.12
+  + Add CI build script.
+  + Add a build script for users. FTL can be build by simply running "./build.sh"
+  + Use cmake ENV{} to actually aquire the env variables
+  + Clarify comment
+  + Also check REVOLCE_IPV{4,6} setting when trying to derive a host name from the FTL database.
+  + Improve build.sh script. Add "install" and "clean" targets. Also ensure successive builds are possible to speed up the entire process.
+  + Allow no/false and yes/true for all config options.
+  + Re-aquire client and upstream pointers after a name resolution. As we're leaving the locked area for the resolve, we cannot control if the shared memory object changed meanwhile. If it did, then the pointers will point into nowhere, leading to a SEGV_MAPERR.
+  + Set nice value of pihole-FTL (configurable) to increase DNS server performance.
+  + Add CAP_SYS_NICE for the tests
+  + Ignore missing CAP_SYS_NICE in the CI tests as we are not allowed to change the nicencess.
+  + Add warning for invalid hostnames to FTL message table.
+  + Only open FTL database for storing a message when there is not already an open connection.
+  + Clarify warning that the check found AT LEAST one invalid character.
+  + Ensure host name errors do not accumulate.
+  + Close database on any erros to ensure nothing stays locked.
+  + Do not listen to real-time signals in helper processes
+  + Ignore real-time signals outside of the main process (such as in TCP forks)
+  + Fix #805. This fixes a buffer overflow when handling TCP requests. Details are on the dnsmasq mailing list.
+  + Ensure main process is terminated orderly when a fork fails miserably.
+  + Send real-time signal 2 from forks to main process to signal it should terminate with EXIT_FAILURE.
+  + Improve logging for forks and thread by including further details to the log ID
+  + Include thread names in crash reports to ease debugging.
+  + Print at least addresses when the addrline conversion wasn't successful.
+  + Bind to socket in thread instead of main process to ensure forks do not inherit sockets they shouldn't.
+  + Show fork created/terminated if any debug mode is enabled. Log reason for TCP worker termination (either client disconnected or connection timeout).
+  + Remove portfile not used by the current web interface any longer.
+  + Add support for additional query types: "A", "AAAA", "ANY", "SRV", "SOA", "PTR", "TXT", "NAPTR", "MX", "DS", "RRSIG", "DNSKEY" and "OTHER" (summing up all other possible DNS types)
+  + Tests: Test for new query types
+  + Don't use fshort-enums as it may make objects files incompatible.
+  + Always re-open gravity database handle when forking
+  + Children inherit file descriptors from their parents. As we don't need the API sockets in the forks, we clean them up after forking
+  + Thorough clean-up following 8270648da1eae77db381b848a47d79b85c206e29.
+  + Be explicit about if we count or query the number of domains. This simplifes the logic and makes it more readable.
+  + Do not assume a query to google.com returns only one fixed AAAA record.
+  + Remove privacy level 4. Systems currently running level 4 will automatically pick up the highest available level (which is now 3). Also tidy up enums into a dedicated file.
+  + Add additional_info column to queries table. We fill it with the domain that caused blocking the entire CNAME chain.
+  + Log CNAME blocking to pihole.log
+  + Include new column in database schema test
+  + Load domain causing the blocking in a CNAME inspection from the database during import. This ensures restarting FTL does not mean we lost this information.
+  + Store + import ID of regex used for blocking in additional_info field
+  + Fix an edge-case where CNAME blocking can be foiled when parts of the CNAME chain are already in the cache
+  + Fix incorrect attribution of the blocked status to the wrong domain. This also simplifies the terminology in the CNAME inspection routine.
+  + Revert "Remove portfile not used by the current web interface any longer."
+  + Tweak revert commit. We should add the port after configuring it and independtly from opening IPv4 and/or IPv6 sockets. Also, we cannot delete the port in close_telnet_port() as this function is called by TCP workers since v5.1 so we'd loose the port file when the first TCP query comes in.
+  + Test: Check port file exists and contains the expected number (4711)
+  + Skip second termiantion if there is already a termination event in progress. This has been observed with clients clsoing their connection exactly at the same time when dnsmasq wants to close the connection itself due to a timeout (it thinks this client is stale).
+  + Include the information for which client we have forked. Examplary message: "TCP worker forked for client 192.168.0.42 on interface enp0s25 (192.168.0.12)"
+  + Double time until TCP worker timeout from 150 seconds to 300 seconds. RFC 1035 says: "If the server needs to close a dormant connection to reclaim resources, it should wait until the connection has been idle for a period on the order of two minutes." We are unlikely to run into a limit here as the total number of allowed TCP workers is fixed as well.
+  + Increase limit for concurrently active TCP workers from 20 to 60. We've seen reports where 20 wasn't sufficient in user networks. Given that TCP workers do not really consume all that much more memory, this limit may even be increased further in case we recognize that 60 still isn't sufficient.
+  + Use atomic_flag_test_and_set to ensure that FTL_TCP_worker_terminating() cannot run two times even when called exactly at the same time.
+  + Wrap gravity reopening in locking to avoid a race collision with API requests (performed from independent threads).
+  + Do not loop over known domains in addition to looping over all FTL-DNS-cache entries.
+  + Factor out FTL sources into a separate object. This slightly enhances compilation speed.
+  + Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in --dhcp-option.
+  + Workaround for reported recvmsg() ignoring MSG_PEEK.
+  + Log listening on new interfaces
+  + Explicitly mark address port not used
+  + Compare address and interface index for allowed interface
+  + Cleanup interfaces no longer available
+  + Handle listening on duplicate addresses
+  + Remove duplicate address family from listener
+  + Suppress logging of listen addresses during startup.
+  + Apply floor of 60s to TTL of DNSKEY and DS records in cache.
+  + Change default lease time for DHCPv6 to one day.
+  + Do not try to bind a value when we should actually read one. This glitch was harmless, however, it prevented regex ID from being loaded from the database.
+  + Create and use a temporary copy of the domain string during the analysis
+
 -------------------------------------------------------------------
 Sun Jan 19 09:12:25 UTC 2020 - Samu Voutilainen <smar@smar.fi>
 
--- pihole-ftl.spec.orig
+++ pihole-ftl.spec
@@ -21,8 +21,8 @@
 %define         ftl_system_name pihole-%{ftl_name}
 
 Name:           pihole-ftl
-Version:        v4.3.1
-%define         real_version 4.3.1
+Version:        v5.2
+%define         real_version 5.2
 Release:        0
 Summary:        Network-wide ad blocking via your own Linux hardware
 License:        EUPL-1.1
@@ -35,17 +35,17 @@ Source2:        %{ftl_system_name}.conf.
 Source3:        permissions
 Source4:        rpmlintrc
 Source5:        SUSE.readme
-Patch1:         %{name}-makefile-changes.patch
+#Patch1:         %{name}-makefile-changes.patch
 # Ignores unsafe loop optimization errors.
 # TODO: A proper patch should be done that can be contributed to upstream.
-Patch2:         ignore_error_caused_by_upstream.patch
-Patch3:         fix-build-after-y2038-changes-in-glib.patch
+#Patch2:         ignore_error_caused_by_upstream.patch
 # TODO: contribute to upstream
 # The error is not a problem, as the code actually adds null byte to the end.
 # TODO: find out why the null byte addition was removed in development branch...
 Patch4:         ignore-shmem.c-strncpy-error.patch
-Patch5:         fix-build-with-libnettle-3.5.patch
+#Patch5:         fix-build-with-libnettle-3.5.patch
 BuildRequires:  libnettle-devel
+BuildRequires:  cmake
 Requires:       pi-hole
 Requires:       libnettle6
 Requires:       libhogweed4
@@ -63,14 +63,13 @@ FTLDNS™ (pihole-FTL) provides an inter
 
 %prep
 %setup -q -n %{ftl_name}-%{real_version}
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
+#%patch1 -p1
+#%patch2 -p1
 # Only need to patch for Tumbleweed for now.
 %if 0%{?suse_version} > 1500
 %patch4 -p1
 %endif
-%patch5 -p1
+#%patch5 -p1
 
 # Generate own version.h; the Makefile wants to use Git to generate this data...
 cat > %{_builddir}/%{ftl_name}-%{real_version}/version.h <<EOL
@@ -85,14 +84,16 @@ EOL
 sed "/^;/d" %{S:2} > pihole-FTL.conf
 
 %build
-%make_build
+%cmake_build
 
 %install
-install -Dm0755 %{ftl_system_name} %{buildroot}%{_bindir}/%{ftl_system_name}
-install -D -m 644 %{S:1} %{buildroot}%{_unitdir}/%{name}.service
-install -Dm0644 %{ftl_system_name}.conf %{buildroot}%{_sysconfdir}/pihole/%{ftl_system_name}.conf
-install -D -m 0644 %{S:3} %{buildroot}%{_sysconfdir}/permissions.d/%{name}
-install -D -m 0644 %{S:5} %{buildroot}%{_docdir}/%{name}/SUSE.readme
+%cmake_install
+
+#install -Dm0755 %{ftl_system_name} %{buildroot}%{_bindir}/%{ftl_system_name}
+#install -D -m 644 %{S:1} %{buildroot}%{_unitdir}/%{name}.service
+#install -Dm0644 %{ftl_system_name}.conf %{buildroot}%{_sysconfdir}/pihole/%{ftl_system_name}.conf
+#install -D -m 0644 %{S:3} %{buildroot}%{_sysconfdir}/permissions.d/%{name}
+#install -D -m 0644 %{S:5} %{buildroot}%{_docdir}/%{name}/SUSE.readme
 
 mkdir -p %{buildroot}/var/log/pihole

Places

File project.diff of Package pihole-ftl (Revision 7def1b157fb831cc1fe56714e04bbde3)

Places