Development June 2015

development@lists.ipfire.org

14 participants
23 discussions

re: IPFire 2.17 - Core Update 91 release schedule
by Paul Simmons 12 Jun '15

12 Jun '15

Michael, there's a problem with hostapd - please see bug 10881 https://bugzilla.ipfire.org/show_bug.cgi?id=10881 Thanks, Paul

1 0

Re: IPFire 2.17 - Core Update 91 release schedule
by Michael Tremer 12 Jun '15

12 Jun '15

Hello, just follow this guide: http://wiki.ipfire.org/en/configuration/ipfire/pakfire/testing -Michael On Thu, 2015-06-11 at 11:44 +0200, Jan Lentfer wrote: > Hi, could you shortly describe (possibly once more) how can follow the testing branch instead of the stable branch? TIA Jan > > Von meinem iPad gesendet > > > Am 11.06.2015 um 10:51 schrieb Michael Tremer <michael.tremer(a)ipfire.org>: > > > > Hello, > > > > I just wanted to update you quickly about the upcoming Core Update 91 > > release plan. > > > > There will be a new OpenSSL release at some time today (Thursday) which > > fixes several security vulnerabilities in this library. We do not know > > much about the severity of those vulnerabilities, yet, but we will > > release a new Core Update any ways. > > > > The changes that have been pushed into the next branch will be released > > as well with an exception of Python. The Python package won't build on > > some systems and due to lack of time to debug this properly the Python > > update has been postponed. > > > > As soon as the OpenSSL update is released we will start the build. We > > expect this to be late at night (as it has been in the past) and > > therefore the will be a build available Friday morning/noon European > > time. The ARM build will take much longer to complete though. > > > > We will push that build to the testing tree so that as many people can > > help testing as possibly can. > > > > If everything goes well we intend to release the final update 24 hours > > after that - which will be Saturday some time after mid day. > > > > Best, > > -Michael > > > > P.S. I was asked to send a short release plan for Core Updates on this > > list because it is not so easy to find out what the current status is > > sometimes. I would like your feedback about if this is a good idea and > > if this is helping. I am hoping that it is helping us to engage more > > testers into the testing procedure of new Core Updates and let you plan > > some time for doing that.

3 6

Re: [PATCH] Link the IPFire logo to ipfire.org
by Larsen 09 Jun '15

09 Jun '15

>> The final HTML code would look something like this: >> >> <div id="logo"> >> <a href="http://www.ipfire.org"> >> <img src="logo.png" ...> >> </a> >> </div> >> >> The CSS properties should be changed that the background image is >> removed and the content is centered. The final result should like the >> same in the end. Now using HTML instead of JavaScript. Had to use "margin-left: -3px; margin-top: -3px" to get it pixel-perfect. Also changed: Not linking the hostname if displayed, only "IPFire". Signed-off-by: Lars Schuhmacher <larsen007(a)web.de> --- html/html/themes/darkdos/include/functions.pl | 2 +- html/html/themes/ipfire-legacy/include/functions.pl | 2 +- html/html/themes/ipfire/include/css/style.css | 1 - html/html/themes/ipfire/include/functions.pl | 6 ++++-- html/html/themes/maniac/include/functions.pl | 2 +- 5 files changed, 7 insertions(+), 6 deletions(-) diff --git a/html/html/themes/darkdos/include/functions.pl b/html/html/themes/darkdos/include/functions.pl index 737e051..7d803b6 100644 --- a/html/html/themes/darkdos/include/functions.pl +++ b/html/html/themes/darkdos/include/functions.pl @@ -227,7 +227,7 @@ END if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; } else { - print "<h1><span>-= IPFire =-</span></h1><br />"; + print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />"; } print <<END <h2>+ $h2 +</h2> diff --git a/html/html/themes/ipfire-legacy/include/functions.pl b/html/html/themes/ipfire-legacy/include/functions.pl index 1401030..5288253 100644 --- a/html/html/themes/ipfire-legacy/include/functions.pl +++ b/html/html/themes/ipfire-legacy/include/functions.pl @@ -227,7 +227,7 @@ END if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; } else { - print "<h1><span>IPFire</span></h1><br />"; + print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>IPFire</a></span></h1><br />"; } print <<END <h2>$h2</h2> diff --git a/html/html/themes/ipfire/include/css/style.css b/html/html/themes/ipfire/include/css/style.css index e0ac3cd..1cc18f8 100644 --- a/html/html/themes/ipfire/include/css/style.css +++ b/html/html/themes/ipfire/include/css/style.css @@ -115,7 +115,6 @@ iframe { #logo { height: 65px; margin-top: 1em; - background: url('../../images/tux2.png') no-repeat; } #logo h1 { diff --git a/html/html/themes/ipfire/include/functions.pl b/html/html/themes/ipfire/include/functions.pl index 63740d4..eedf069 100644 --- a/html/html/themes/ipfire/include/functions.pl +++ b/html/html/themes/ipfire/include/functions.pl @@ -152,12 +152,14 @@ print <<END <body> <div id="header" class="fixed"> <div id="logo"> + <a href="http://www.ipfire.org" style="text-decoration: none;"> + <img src="/themes/ipfire/images/tux2.png" style="float:left; margin-left: -3px; margin-top: -3px;"/> END ; if ($settings{'WINDOWWITHHOSTNAME'} ne 'off') { - print "<h1>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</h1>"; + print "</a><h1>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</h1>"; } else { - print "<h1>IPFire</h1>"; + print "<h1>IPFire</h1></a>"; } print <<END diff --git a/html/html/themes/maniac/include/functions.pl b/html/html/themes/maniac/include/functions.pl index e8514ad..4866fcd 100644 --- a/html/html/themes/maniac/include/functions.pl +++ b/html/html/themes/maniac/include/functions.pl @@ -227,7 +227,7 @@ END if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; } else { - print "<h1><span>-= IPFire =-</span></h1><br />"; + print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />"; } print <<END <h2>+ $h2 +</h2>

1 0

[PATCH] apache: generating unique prime numbers and forbit use of weak DH cipher suites
by IT Superhack 09 Jun '15

09 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Changes: [1] Forbid the use of weak DH cipher suites in Apache. [2] Tell Apache to use a custom bunch of prime numbers. [3] Updated "httpscert" in order to generate those prime numbers. Those changes are supposed to fix a vulnerability called "logjam" in Apache. "Logjam" is a recently discovered vulnerability in the Diffie-Hellman-Key-Exchange. Affected are TLS/SSL connectiones, VPNs and other services which are relying on DH as well. References: [Bug #10856]: https://bugzilla.ipfire.org/show_bug.cgi?id=10856 [Further Information]: https://weakdh.org/ [Further Information (german)]: http://www.heise.de/security/meldung/Logjam-Attacke-Verschluesselung-von - -zehntausenden-Servern-gefaehrdet-2657502.html Please find the patch here: http://nopaste.ipfire.org/view/r8QWUyQF However, the patch can't applied to IPFire systems without creating unique prime numbers, since the configuration file of Apache expects the presence of a file called "/etc/httpd/dhparams.pem", if this one does not exist, Apache will likely crash. Please make sure to generate prime numbers by Pakfire during a upgrade: /usr/bin/openssl dhparam -out /etc/httpd/dhparams.pem 2048; I'm estimating that other software components of IPFire are still vulnerable to Lojgam (IPSec?). As soon as I have more information about this, I will roll out new patches. Best regards, Timmothy Wilson -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJVay1mAAoJEOyLa1C5EazrDpgIALW/rNZKUbyBrDEtQCOa7xWx CL96hzWnZP+FwKHKIb7/Q0pBA4t3qnc/GijgytiPEXuHOmF9pKt/eZ9T9lFZ+3CX 39ZTyZL/STQMiTUDyAC2oHpA+UtqkiIXLVU0pBoHHRLOqYS7BC9oLQoAxlIE2HSi v9pJ8Fq4IKlBnhdpZv/uMuJ+aJntp0PIx/whfos/I57oSq0cGL8fzWND8JE0OkG6 c5rscYQt76sMnrmf8rx0LNdvRU3XqkKWs3fkketStcIwHxUTYAKpJK/8+LEj71k3 fLxyW6viTCu71VfBm+m1fcRmG/vFi6tts6B6ekyMhBiq3G+FYUVNpDlHQMl99/s= =bm/U -----END PGP SIGNATURE-----

4 15

[PATCH] Link the IPFire logo to ipfire.org
by Larsen 09 Jun '15

09 Jun '15

Link the IPFire logo and subsequent text to http://www.ipfire.org Signed-off-by: Lars Schuhmacher <larsen007(a)web.de> --- html/html/themes/darkdos/include/functions.pl | 2 +- html/html/themes/ipfire-legacy/include/functions.pl | 2 +- html/html/themes/ipfire/include/functions.pl | 2 +- html/html/themes/maniac/include/functions.pl | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/html/html/themes/darkdos/include/functions.pl b/html/html/themes/darkdos/include/functions.pl index 737e051..4b00b4c 100644 --- a/html/html/themes/darkdos/include/functions.pl +++ b/html/html/themes/darkdos/include/functions.pl @@ -221,7 +221,7 @@ print <<END <div id="header_inner" class="fixed"> - <div id="logo"> + <div id="logo" style="cursor: pointer;" onclick="window.location='http://www.ipfire.org/';"> END ; if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { diff --git a/html/html/themes/ipfire-legacy/include/functions.pl b/html/html/themes/ipfire-legacy/include/functions.pl index 1401030..e1b8cb8 100644 --- a/html/html/themes/ipfire-legacy/include/functions.pl +++ b/html/html/themes/ipfire-legacy/include/functions.pl @@ -221,7 +221,7 @@ print <<END <div id="header_inner" class="fixed"> - <div id="logo"> + <div id="logo" style="cursor: pointer;" onclick="window.location='http://www.ipfire.org/';"> END ; if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { diff --git a/html/html/themes/ipfire/include/functions.pl b/html/html/themes/ipfire/include/functions.pl index 63740d4..39d972d 100644 --- a/html/html/themes/ipfire/include/functions.pl +++ b/html/html/themes/ipfire/include/functions.pl @@ -151,7 +151,7 @@ print <<END </head> <body> <div id="header" class="fixed"> - <div id="logo"> + <div id="logo" style="cursor: pointer;" onclick="window.location='http://www.ipfire.org/';"> END ; if ($settings{'WINDOWWITHHOSTNAME'} ne 'off') { diff --git a/html/html/themes/maniac/include/functions.pl b/html/html/themes/maniac/include/functions.pl index e8514ad..d3d4a73 100644 --- a/html/html/themes/maniac/include/functions.pl +++ b/html/html/themes/maniac/include/functions.pl @@ -221,7 +221,7 @@ print <<END <div id="header_inner" class="fixed"> - <div id="logo"> + <div id="logo" style="cursor: pointer;" onclick="window.location='http://www.ipfire.org/';"> END ; if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') {

2 6

Tmux update to version 2.0 and a new addon called lnav
by ummeegge 08 Jun '15

08 Jun '15

Hi all, i wanted to introduce an update of tmux to version 2.0 --> https://bugzilla.ipfire.org/show_bug.cgi?id=10841 and also a new add-on called lnav (log file navigator) --> https://bugzilla.ipfire.org/show_bug.cgi?id=10441 . Both has been tested and works for me without problems. Greetings, Erik

1 0

IPsec default to rekey=no - tests
by Wolfgang Apolinarski 05 Jun '15

05 Jun '15

Hi! I performed some tests with ipfire and the Windows VPN client (for the rekey=no issue). I usually use short-time VPN connections (<3 hours), so I did not recognize any problems. During the tests, I did not find any configuration that allowed me a stable VPN connection, all connections drop after 3-4 hours (IKE re-negotiation, CHILD_SA re-negotiation works fine). The problem could also be located in one of the used routers... If you have any suggestion on what configuration I should test as well, please let me know. My default configuration (1st try): conn WinAndroidVPN left=%defaultroute leftsubnet=0.0.0.0/0 leftfirewall=yes lefthostaccess=yes leftallowany=yes leftcert=/var/ipfire/certs/hostcert.pem ike=aes256-sha1-modp1024! esp=aes256-sha1! right=%any keyexchange=ikev2 compress=yes dpdaction=clear dpddelay=30s auto=add rightsourceip=%dhcp ikelifetime=4h lifetime=2h keylife=8h rightcert=/var/ipfire/certs/WinAndroidVPNcert.pem The protocol for this config is located here: http://pastebin.com/iXjjp71R 2nd try changes: ikelifetime=4h lifetime=90m The protocol for the 2nd config is located here: http://pastebin.com/xyarBvub 3rd try changes: rekey=no ikelifetime=4h lifetime=2h The protocol for the 3rd config is located here: http://pastebin.com/jmPNzxUX So, sorry, I was not able to find a stable connection and have no suggestion on how to change the default config such that a stable connection with Windows 7/8.1 is possible. Best regards, Wolfgang

2 1

Fix hardcoded strings in pppsetup.cgi
by Larsen 05 Jun '15

05 Jun '15

I noticed that some strings were hardcoded instead of using "$Lang::tr". Patch against next-branch attached. Lars

3 14

[PATCH] ipsec.conf: Include ipsec.user.conf and ipsec.user-post.conf
by Larsen 04 Jun '15

04 Jun '15

Fix bug 10869 as the code has been removed by mistake by the previous commit dfea4f86c22c83e07d0f4a6f2a02166229ecb120. It also includes ipsec.user.conf only when it exists. Signed-off-by: Lars Schuhmacher <larsen007(a)web.de> --- html/cgi-bin/vpnmain.cgi | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 9490076..218dafa 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -253,8 +253,10 @@ sub writeipsecfiles { print CONF "\n"; # Add user includes to config file - print CONF "include /etc/ipsec.user.conf\n"; - print CONF "\n"; + if (-e "/etc/ipsec.user.conf") { + print CONF "include /etc/ipsec.user.conf\n"; + print CONF "\n"; + } print SECRETS "include /etc/ipsec.user.secrets\n"; @@ -407,6 +409,14 @@ sub writeipsecfiles { print CONF "\n"; }#foreach key + + # Add post user includes to config file + # After the GUI-connections allows to patch connections. + if (-e "/etc/ipsec.user-post.conf") { + print CONF "include /etc/ipsec.user-post.conf\n"; + print CONF "\n"; + } + print SECRETS $last_secrets if ($last_secrets); close(CONF); close(SECRETS);

2 3

[PATCH] pakfire: Add information about probable causes when pakfire cannot connect
by Larsen 02 Jun '15

02 Jun '15

Add information about probable causes when pakfire cannot connect. This includes port 11371 TCP and incorrect date/time settings. Signed-off-by: Lars Schuhmacher <larsen007(a)web.de> --- src/pakfire/lib/functions.pl | 1 + 1 file changed, 1 insertion(+) diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index d14e031..127f63b 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -870,6 +870,7 @@ sub checkcryptodb { unless ( "$ret" eq "0" ) { message("CRYPTO WARN: The GnuPG isn't configured corectly. Trying now to fix this."); message("CRYPTO WARN: It's normal to see this on first execution."); + message("CRYPTO WARN: If this message is being shown repeatedly, check if time and date are set correctly, and if IPFire can connect via port 11371 TCP."); my $command = "gpg --keyserver pgp.ipfire.org --always-trust --status-fd 2"; system("$command --recv-key $myid >> $Conf::logdir/gnupg-database.log 2>&1"); system("$command --recv-key $trustid >> $Conf::logdir/gnupg-database.log 2>&1");

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2015