peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,925 Commits 43 Branches 86 Tags
main
Commit Graph
4925 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Joachim WibergandGitHub 8d57337fcf Merge pull request #1567 from kernelkit/kernel-upgrade-c7cf8e8a-c974-4873-a74d-00042e95b98b 
Upgrade to kernel 6.18.39
 2026-07-18 20:16:26 +02:00
ael-bot b29bbc56f9 Upgrade Linux kernel to 6.18.39 2026-07-18 15:42:43 +00:00
Joachim WibergandGitHub 05e34a5441 Merge pull request #1566 from kernelkit/bump-buildroot 2026-07-16 13:09:16 +02:00
Mattias Walström ec52472949 Bump buildroot to 2025.02.16 
2025.02.16, released July 15, 2026

	Important / security related fixes:

	apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
	  CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
	  CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913,
	  CVE-2026-49975
	asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw,
	  GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f,
	  GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6,
	  GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f,
	  GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx,
	  GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959,
	  GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c
	avahi: CVE-2026-34933
	bind: (no CVE assigned), CVE-2026-3593
	cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527
	cups-filters: CVE-2025-64503
	expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
	  CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
	  CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
	  CVE-2026-56412
	ghostscript: (no CVE assigned)
	glibc: CVE-2026-5450, CVE-2026-5928
	icu: CVE-2025-5222
	imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734,
	  CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460,
	  CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464,
	  CVE-2026-53465
	jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979,
	  CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257,
	  CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839,
	  CVE-2026-54679
	libarchive: (no CVE assigned)
	libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
	  CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286,
	  CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926,
	  CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080,
	  CVE-2026-9545, CVE-2026-9546, CVE-2026-9547
	libevent: (no CVE assigned)
	libglib2: CVE-2025-14087
	libgsasl: CVE-2026-48829
	libinput: CVE-2026-50292
	libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182,
	  CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767,
	  CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445,
	  CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
	libssh2: CVE-2026-55199, CVE-2026-55200
	mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261
	mesa3d: CVE-2026-40393
	mongoose: (no CVE assigned yet)
	nginx: CVE-2026-42055, CVE-2026-48142
	openjpeg: CVE-2026-6192
	openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
	  CVE-2026-13117, CVE-2026-13122, CVE-2026-13698
	php: CVE-2026-12184, CVE-2026-14355
	python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587,
	  CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666,
	  CVE-2026-8404
	python3: CVE-2026-11940, CVE-2026-9669
	redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243
	squid: CVE-2026-33515, CVE-2026-33526, CVE-2026-47729, CVE-2026-50012
	sudo: CVE-2026-35535
	swupdate: CVE-2026-28525
	tiff: CVE-2026-36849
	tor: TROVE-2026-025, TROVE-2026-026.
	util-linux: CVE-2025-14104, CVE-2026-27456, CVE-2026-53612,
	  CVE-2026-53613, CVE-2026-53614
	webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
	  CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
	  CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
	  CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
	  CVE-2026-43660
	wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512,
	  CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999,
	  CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961,
	  CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091,
	  CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325,
	  CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412,
	  CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731,
	  CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720

	Toolchain:

	- gcc: bump 14.x series to 14.4.0
	- glibc, localedef: security bump to version 2.41-143-gfc7a48bc9

	Infrastructure updates/fixes:

	- support/testing Improve TestPythonPy3NetworkmanagerGoi
	- generate-cyclonedx: fixup scp-style git sites
	- support/testing: Fix test_gnupg2
	- support/testing: various internal refactorings

	Updated / fixed packages: apache, asterisk, avahi, bind, bind,
	  cpp-httplib, cpp-httplib, cups-filters, expat, gcc:, ghostscript,
	  glibc, hwdata, icu, imagemagick, jq, kodi-screensaver-rsxs,
	  libarchive, libcurl, libepoxy, libevent, libglib2, libglib2,
	  libglib2-bootstrap, libgsasl, libgsasl, libinput, libopenssl,
	  libssh2, libssh2, linux, mariadb, mdnsd, mesa3d, mongoose, mpd,
	  nginx, ntp, openjpeg, openrc, openvpn, php, python-django, python3,
	  python3, qt5, redis, rsync, ruby, shadow, shim, squid, squid, squid,
	  squid, strongswan, sudo, swupdate, tiff, tor, util-linux, util-linux,
	  util-linux, util-linux, util-linux, util-linux, webkitgtk, wolfssl
 2026-07-16 10:53:11 +02:00
Joachim WibergandGitHub 05fe5b5d46 Merge pull request #1563 from kernelkit/misc 
Firewall address-set support
 2026-07-06 09:37:21 +02:00
Joachim Wiberg 17a1b80b83 Namespace Infix Kconfig options under IX_ 
Infix defines its own Kconfig options with unprefixed names (IMAGE_*,
QEMU_*, TRUSTED_KEYS*) and an INFIX_ prefix.  Unprefixed names risk
clashing with Buildroot and with other br2-externals/spins that source
our tree.

Rename all 86 options to a common IX_ prefix, collapsing the existing
INFIX_ ones, e.g. INFIX_IMAGE_ID becomes IX_IMAGE_ID.  The os-release
INFIX_DESC field is a runtime interface, not a Kconfig option, and is
kept; the qemu Config.in generator's @ARCH@ symbol is updated to match.

Closes #1305

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-06 05:28:11 +02:00
Joachim Wiberg 461c092346 .github: publish .pkg bundle and Raspberry Pi image on release 
Releases exposed the RAUC upgrade bundle only inside the per-arch
tarball, and shipped no ready-to-flash Raspberry Pi image; users had
to unpack the tarball or assemble an image from a separate bootloader.

Upload output/images/*.pkg as its own artifact, and build an rpi64 SD
card image in the aarch64 release leg before rootfs.squashfs is
stripped from the tarball, combining it with the rpi64 bootloader from
the latest-boot release.  Publish both as release assets; the tarball
still carries the .pkg too.

Closes #1084

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-06 05:28:10 +02:00
Joachim Wiberg b2a7c0aac5 board: enable ip_nonlocal_bind for IPv4 and IPv6 
Services could not bind to addresses not yet present on an interface,
e.g. floating VIPs managed by a routing daemon, since nonlocal bind
was left at the kernel default of disabled.

Enable net.ipv4.ip_nonlocal_bind and net.ipv6.ip_nonlocal_bind among
the router defaults in /etc/sysctl.d.

Closes #1022

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-06 05:28:09 +02:00
Joachim Wiberg e3a0426154 board: mark developer U-Boot builds with -DEVEL 
Developer builds report the bare upstream U-Boot version, e.g.
2025.01, and are easily mistaken for release builds.  Nothing stamps
a local version on non-release builds to tell them apart.

Write a .scmversion of -DEVEL from a pre-build hook when INFIX_RELEASE
is unset, so developer builds report 2025.01-DEVEL.  Release builds
are left untouched.

Closes #919

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-06 05:28:09 +02:00
Joachim Wiberg 2a51fc41d7 .github: enable mirror.internal for builders 
Closes #985

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-06 05:28:08 +02:00
Joachim Wiberg b0de6fc89c configs: switch arm and riscv64 to pre-built go toolchain 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-06 05:28:08 +02:00
Joachim Wiberg 52ba6d2ecc utils: mirroring script for download artifacts 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-06 05:23:53 +02:00
Mattias WalströmandGitHub ef9cfafdd9 Merge pull request #1564 from kernelkit/kernel-upgrade-a4683739-6d7e-4d01-a5c8-bebf8cf6fabc 
Upgrade to kernel 6.18.38
 2026-07-05 11:05:38 +02:00
ael-bot dc0519043e Upgrade Linux kernel to 6.18.38 2026-07-05 06:53:18 +00:00
Joachim Wiberg 4c6aa115a3 webui: fix more wrappers decoding keyed GETs as bare nodes 
Three more RESTCONF wrappers assume the response to a keyed GET is the
bare node, when the server nests it under the full parent path: the
container resource-usage stats always read zero, the WireGuard listen
port never populated, and resetting advertised link modes silently
re-enabled auto-negotiation on links where it was forced off.

Same class of bug as the firewall zone reset fix: the decode matches
nothing and the zero value is used as if valid.  Model the full nesting
in all three wrappers, reusing the existing container list wrapper.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-04 09:32:02 +02:00
Joachim Wiberg 7291b812a6 webui: fix firewall zone service resets 
Resetting a zone's services (or interfaces) wiped the entire zone:
action, interfaces, address-sets, everything but the name.

The keyed zone GET decodes into a wrapper expecting the node bare, but
the server nests it under the full parent path:

    {"infix-firewall:firewall": {"zone": [ ... ]}}

The decode silently matched nothing, so the reset handler rebuilt the
zone from an empty struct and PUT only the zone name.  The same
mismatch also broke network preservation when saving a zone.

Clear leaf-lists by deleting each instance instead of rebuilding the
zone with PUT, so a reset cannot touch anything else.  Fix the wrapper
shape, document the nesting convention on the RESTCONF client Get, and
log a warning when a non-empty response decodes to a zero-valued
wrapper.  When saving zones, omit empty leaf-lists and a defaulted
action.  Refresh the firewall page after resets and update the handler
tests to mock the real response shape.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-04 09:32:01 +02:00
Joachim Wiberg 56ea7faa7c Add firewall address-set (ipset) support 
Add firewall address-sets: named sets of IP addresses and networks,
usable as zone sources for per-IP access control, issue #1189.  Static
entries are part of the configuration; dynamic entries are managed at
runtime with new add/remove/flush actions, from the CLI or over
NETCONF/RESTCONF.  Dynamic entries survive firewall configuration
changes but are not saved to the configuration.  Sets with a timeout
expire their entries automatically.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-03 08:59:37 +02:00
Joachim Wiberg ca1d40cf7a package/webui: add missing license hash 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-01 10:34:12 +02:00
Joachim Wiberg 5b370745fd package/netbrowse: add missing license hash 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-01 10:33:59 +02:00
Tobias WaldekranzandGitHub 2a766d7886 Merge pull request #1545 from kernelkit/factory-config-test 
test: add generic boot-from-factory-config test
 2026-07-01 10:14:13 +02:00
Mattias WalströmandGitHub 1bb9f778ff Merge pull request #1559 from kernelkit/releng 
Final release touches
v26.06.0 		2026-07-01 08:53:31 +02:00
Joachim Wiberg d2abdf0f64 Final ChangeLog update for v26.06 
[skip ci]

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-01 08:27:16 +02:00
Joachim Wiberg 5df26b217a utils: link to GNS3 blog instead of GNS3 marketplace 
Friendlier for first-time users, and drives traffic to the blog, hopefully.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-07-01 08:26:15 +02:00
Joachim WibergandGitHub b3ae276a14 Merge pull request #1558 from kernelkit/releng 
Update ChangeLog for v26.06 release
 2026-07-01 08:05:23 +02:00
Joachim Wiberg 5bbb83a3e6 Update ChangeLog for v26.06 release 
[skip ci]

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-30 22:59:50 +02:00
Richard Alpe e233dbc6da test: reboot at end of factory config test to restore 
Reboot at end of factory config test to restore test config.

Signed-off-by: Richard Alpe <richard@bit42.se>
 2026-06-30 17:19:07 +02:00
Mattias WalströmandGitHub d83c708cd1 Merge pull request #1553 from kernelkit/wifi-fixes2 
Some important wifi fixes
v26.06.0-rc1 		2026-06-30 13:31:01 +02:00
Richard Alpe d333c66f9c test: add generic boot-from-factory-config test 
Verify that the device's factory-default configuration boots cleanly and
that the device remains usable afterwards -- i.e. it does not fall back to
the fail-secure failure-config.

The test exercises the device's own first-boot bootstrap path: it clears
the startup-config and reboots with the test-mode startup override set, so
confd initialises running from the factory-config (its first-boot path).
That mirrors a factory-fresh / factory-reset device and avoids applying a
full config swap over the live management session -- confd cannot replace
the whole running datastore from within an RPC without timing out, and a
factory config may reconfigure the very transport we are connected over.

The test is image-generic, using whatever factory-config the running image
was built with, so it covers both the stock Infix factory config and any
spin factory config. A single-node (1x1) topology is used on purpose: a
factory config is not written with a lab full of peers in mind, so booting
it across a multi-node topology could trigger broadcast storms or similar.
NETCONF only, as it is the one management transport present in every
factory config.

Signed-off-by: Richard Alpe <richard@bit42.se>
 2026-06-30 10:32:43 +02:00
Mattias Walström 1b11bae8eb test: static_multicast_filters: Fix indendation 2026-06-30 09:18:52 +02:00
Mattias Walström 2744e6ee85 test: Whitespace 2026-06-30 09:18:52 +02:00
Mattias Walström 9b41139066 test: netns: refactor must_receive 
Parameter was called `timeout` but it was used as a duration,
how long it should fetch packets to match on.
 2026-06-30 09:18:52 +02:00
Mattias Walström d0d95f4098 confd: wifi: Fix issue with reconfigure modes on a wifi radio 
The previous mode was not teardowned correctly
 2026-06-30 09:18:52 +02:00
Mattias Walström 84dfaf7c03 buildroot: Add missing MBO feature in hostapd 2026-06-30 09:18:52 +02:00
Tobias WaldekranzandGitHub afcc40589a Merge pull request #1556 from kernelkit/misc 
Minor fixes
 2026-06-30 09:06:25 +02:00
Joachim Wiberg 208f7c9f08 confd: simplify gen-hostname, defer MAC expansion to confd 
gen-hostname baked the last three MAC octets straight into the generated
hostname, so the actual MAC ended up stored in the configuration.  Copy
that config to another device and its hostname no longer matched the
hardware.

Emit the %h and %m format specifiers and let confd expand them when the
config is applied, so the MAC is resolved per device and never written
to a saved config.  This also drops the /run/system.json lookup.

Closes #1554

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-29 19:35:04 +02:00
Joachim Wiberg f8c68a38af version: derive OS version from git describe, not the release label 
On weekly builds INFIX_RELEASE is "latest", and it fed straight into
INFIX_VERSION, so the keyword showed up as VERSION, VERSION_ID and
PRETTY_NAME in /etc/os-release, in /etc/version (show version), in the
ietf-system os-version operational leaf, and in the mDNS advertisement.
None of those pinned down the source revision; only BUILD_ID did.

Tie INFIX_VERSION to INFIX_BUILD_ID (git describe).  INFIX_RELEASE now
only labels the release channel (IMAGE_VERSION) and names the published
artifacts.

Also exclude the moving 'latest*' tags from git describe, so the build
id can never resolve to "latest" should that tag land on, or nearest to,
the built commit.

Fixes #1524

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-29 18:36:17 +02:00
Mattias WalströmandGitHub 8994879e26 Merge pull request #1551 from kernelkit/kernel-upgrade-953677c4-aa53-4a5e-a399-5b0a5e1482a7 
Upgrade to kernel 6.18.37
 2026-06-29 14:41:30 +02:00
Joachim WibergandGitHub b5a0ea0b1b Merge pull request #1552 from kernelkit/releng 
Update ChangeLog for v26.06.0 release

[skip ci]
 2026-06-28 18:07:05 +02:00
Joachim Wiberg 435406af68 Update ChangeLog for v26.06.0 release 
Add relevant fixes and features that was missed in PRs.

[skip ci]

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-28 06:44:20 +02:00
ael-bot 79107d2548 Upgrade Linux kernel to 6.18.37 2026-06-27 13:24:01 +00:00
Mattias WalströmandGitHub 7a9cece84f Merge pull request #1550 from kernelkit/refactor-misc-operational 2026-06-27 12:58:26 +02:00
Mattias Walström b8ba1a1042 test: spec: Allow to generate test specification without logical topology 2026-06-27 10:57:22 +02:00
Mattias Walström 60676e21be test: operational_all: Harden to catch more 
- Test so the value in operational actually is correct
- Move test to last in suite to see that there are no stray
  data in operational (yangerd)
 2026-06-27 10:57:22 +02:00
Joachim WibergandGitHub 763750b6ed Merge pull request #1549 from kernelkit/coverity-findings 2026-06-27 09:45:11 +02:00
Joachim Wiberg 23c5f16a4f confd: guard NULL forced PMD in fixed-speed ethtool config 
In netdag_gen_ethtool_autoneg() the unmapped and "exactly one entry"
checks already guarantee a forced PMD link mode is selected, but
Coverity cannot see the correlation and flags the later deref. Fold
!forced into the entry-count guard to make the invariant explicit.

Fixes Coverity CID 561388.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-27 07:26:04 +02:00
Joachim Wiberg 5d3fce35c8 confd: guard NULL band/ssid/class in WiFi config generation 
lydx_get_cattr() yields NULL for an absent leaf or a failed radio
component lookup; that NULL was passed straight to strcmp() on several
WiFi paths (wifi_chan_to_freq, the wifi_gen_mesh width branches,
wifi_find_higher_band_twin, dep_radio_components), risking a crash.
Guard each value before use.

Fixes Coverity CID 561387, 561389, 561390, 561391, 561392.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-27 07:25:59 +02:00
Mattias WalströmandGitHub 6d6064f946 Merge pull request #1548 from kernelkit/veth-regression 2026-06-26 18:30:50 +02:00
Joachim WibergandGitHub a4e5c27b9d Merge pull request #1547 from kernelkit/only-start-crond-if-schedule 
Only start crond if there exist at least one schedule configured
 2026-06-26 16:15:39 +02:00
Joachim Wiberg ddc57ed6ae confd: fix veth teardown regression 
When a veth pair has one end in a container and the other in the host
namespace, removing it failed: the container end's teardown deleted the
whole pair, so the host end's own delete then failed ("Cannot find
device") and aborted the teardown, leaving the interface behind.

The host-namespace delete added for the both-ends-in-container case was
emitted for every container veth end.  Restrict it to the primary end,
which for a host/container pair is the host end that already deletes the
pair itself.

Extend the container veth tests to remove the pair and verify it is gone,
covering both the single-end (regression) and both-ends teardown paths.

Fixes: #1546

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-26 16:05:53 +02:00
Joachim Wiberg 2ae1a70bac test: simplify interfaces/veth_delete 
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 2026-06-26 16:04:25 +02:00