Development November 2017

development@lists.ipfire.org

15 participants
68 discussions

[PATCH v2] disable SSL compression and session tickets in Apache
by Peter Müller 20 Nov '17

20 Nov '17

Ensure that Apache never uses SSL compression, which is vulnerable, and turn off session tickets since the might cause impact to PFS. Based against next, supersedes first version. Reported-by: Wolfgang Apolinarski <wolfgang.apolinarski(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/httpd/vhosts.d/ipfire-interface-ssl.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index c9ccd5be5..dacf6a005 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -11,6 +11,8 @@ SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA SSLHonorCipherOrder on + SSLCompression off + SSLSessionTickets off SSLCertificateFile /etc/httpd/server.crt SSLCertificateKeyFile /etc/httpd/server.key SSLCertificateFile /etc/httpd/server-ecdsa.crt -- 2.13.6

2 1

[PATCH 3/3 v3] add language strings
by Peter Müller 19 Nov '17

19 Nov '17

Add language strings for changed config.dat CGI file. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- langs/de/cgi-bin/de.pl | 6 +++++- langs/en/cgi-bin/en.pl | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 4cf866a3a..67c9aacbd 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1396,6 +1396,7 @@ 'invalid loaded file' => 'Ungültige geladene Datei', 'invalid local-remote id' => 'Local-Id und Remote-Id dürfen nicht gleich sein, und müssen einem "@"-Zeichen beginnen. Dies sind leftid und rightid in der StrongSwan-Terminologie.', 'invalid logserver address' => 'Ungültige syslogd-Server-Adresse', +'invalid logserver protocol' => 'Ungültiges syslogd-Server-Übertragungsprotokoll', 'invalid mac address' => 'Ungültige MAC-Adresse', 'invalid max lease time' => 'Ungültige max. Haltezeit.', 'invalid maximum incoming size' => 'Ungültige max. ankommende Größe.', @@ -1482,7 +1483,8 @@ 'log enabled' => 'Protokoll aktiviert', 'log level' => 'Protokollierungslevel', 'log lines per page' => 'Zeilen pro Seite', -'log server address' => 'Syslog Server', +'log server address' => 'Syslog Server:', +'log server protocol' => 'Übertragungsprotokoll:', 'log settings' => 'Protokolldatei-Einstellungen', 'log summaries' => 'Protokollübersicht', 'log summary' => 'Protokollzusammenfassung', @@ -2189,6 +2191,7 @@ 'system logs' => 'Systemprotokolldateien', 'system status information' => 'System-Statusinformationen', 'ta key' => 'TLS-Authentifizierungsschlüssel', +'tcp more reliable' => 'TCP (zuverlässiger)', 'telephone not set' => 'Telefonnummer nicht angegeben.', 'template' => 'Vorlage', 'template warning' => 'Zur Einrichtung von QoS stehen Ihnen 2 Möglichkeiten zur Auswahl. Entweder Sie wählen speichern und erstellen Klassen und Regeln nach Ihren Wünschen, oder Sie wählen Vorlage, dann werden die Klassen und Regeln durch ein Template generiert.', @@ -2309,6 +2312,7 @@ 'tripwirewarningpolicy' => 'ACHTUNG - Ihr Policy wird neu erzeugt, anschließen wird die Datenbank neu initialisiert. Hierfür wird der Site-Key und Local-Key benötigt.', 'tuesday' => 'Dienstag', 'type' => 'Typ', +'udp less overhead' => 'UDP (geringerer Overhead)', 'umount' => 'Abmelden', 'umount removable media before to unplug' => 'Wechselmedien vor dem Entfernen unbedingt abmelden', 'unable to alter profiles while red is active' => 'Profile können nicht geändert werden, solange ROT aktiv ist.', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 946aba873..1e9754b53 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1428,6 +1428,7 @@ 'invalid loaded file' => 'Invalid loaded file', 'invalid local-remote id' => 'local & remote id must not be equal and begin with a "@" sign. These are leftid and rightid in strongswan terminology.', 'invalid logserver address' => 'Invalid syslogd server address', +'invalid logserver protocol' => 'Invalid syslogd server protocol', 'invalid mac address' => 'Invalid MAC address', 'invalid max lease time' => 'Invalid max lease time.', 'invalid maximum incoming size' => 'Invalid maximum incoming size.', @@ -1515,6 +1516,7 @@ 'log level' => 'Log Level', 'log lines per page' => 'Lines per page', 'log server address' => 'Syslog server:', +'log server protocol' => 'protocol:', 'log settings' => 'Log Settings', 'log summaries' => 'Log summaries', 'log summary' => 'Log Summary', @@ -2231,6 +2233,7 @@ 'system logs' => 'System Logs', 'system status information' => 'System Status Information', 'ta key' => 'TLS-Authentification-Key', +'tcp more reliable' => 'TCP (more reliable)', 'telephone not set' => 'Telephone not set.', 'template' => 'Preset', 'template warning' => 'You have two options to set up Qos. The First, you press the save button and generate the classes and rules on your own. The second, you press the preset button and classes and rules will be set up by a template.', @@ -2354,6 +2357,7 @@ 'tripwirewarningpolicy' => 'WARNING - Your policy will be rebuild, after that your database will be reinitalised. Therefor the site-key and the local-key are neeeded.', 'tuesday' => 'Tuesday', 'type' => 'Type', +'udp less overhead' => 'UDP (less overhead)', 'umount' => 'Umount', 'umount removable media before to unplug' => 'Umount removable media before unplugging the device', 'unable to alter profiles while red is active' => 'Unable to alter profiles while RED is active.', -- 2.13.6

1 0

[PATCH 1/3 v3] allow remote syslog via TCP in syslogdctrl.c
by Peter Müller 19 Nov '17

19 Nov '17

Make syslogctrl.c use TCP as remote logging file if specified so. Thanks to Michael for reviewing this. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- src/misc-progs/syslogdctrl.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/src/misc-progs/syslogdctrl.c b/src/misc-progs/syslogdctrl.c index 52719023e..83727162e 100644 --- a/src/misc-progs/syslogdctrl.c +++ b/src/misc-progs/syslogdctrl.c @@ -27,18 +27,19 @@ #define ERR_ANY 1 #define ERR_SETTINGS 2 /* error in settings file */ #define ERR_ETC 3 /* error with /etc permissions */ -#define ERR_CONFIG 4 /* error updated sshd_config */ +#define ERR_CONFIG 4 /* error updating syslogd config */ #define ERR_SYSLOG 5 /* error restarting syslogd */ int main(void) { - char buffer[STRING_SIZE], command[STRING_SIZE], hostname[STRING_SIZE]; + char buffer[STRING_SIZE], command[STRING_SIZE], hostname[STRING_SIZE], protocol[STRING_SIZE]; char varmessages[STRING_SIZE], asynclog[STRING_SIZE]; int config_fd,rc,fd,pid; struct stat st; struct keyvalue *kv = NULL; memset(buffer, 0, STRING_SIZE); memset(hostname, 0, STRING_SIZE); + memset(protocol, 0, STRING_SIZE); memset(varmessages, 0, STRING_SIZE); memset(asynclog, 0, STRING_SIZE); @@ -67,6 +68,12 @@ int main(void) exit(ERR_SETTINGS); } + if (!findkey(kv, "REMOTELOG_PROTOCOL", protocol)) + { + /* fall back to UDP if no protocol was given */ + protocol = "udp"; + } + if (strspn(hostname, VALID_FQDN) != strlen(hostname)) { fprintf(stderr, "Bad REMOTELOG_ADDR: %s\n", hostname); @@ -106,9 +113,24 @@ int main(void) } if (!strcmp(buffer,"on")) - snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@\$.\\+$/\\1%s/' /etc/syslog.conf >&%d", hostname, config_fd ); + { + /* check which transmission protocol was given */ + if (strcmp(protocol, "tcp") == 0) + { + /* write line for TCP */ + snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@@\$.\\+$/\\1%s/' /etc/syslog.conf >&%d", hostname, config_fd ); + } + else + { + /* write line for UDP */ + snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@\$.\\+$/\\1%s/' /etc/syslog.conf >&%d", hostname, config_fd ); + } + } else + { + /* if remote syslog has been disabled */ snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@.\\+\$$/#\\1/' /etc/syslog.conf >&%d", config_fd ); + } /* if the return code isn't 0 failsafe */ if ((rc = unpriv_system(buffer,99,99)) != 0) -- 2.13.6

1 0

[PATCH] disable SSL compression and session tickets in Apache
by Peter Müller 19 Nov '17

19 Nov '17

Ensure that Apache never uses SSL compression, which is vulnerable, and turn off session tickets since the might cause impact to PFS. Reported-by: Wolfgang Apolinarski <wolfgang.apolinarski(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/httpd/vhosts.d/ipfire-interface-ssl.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index d08d3d2bb..53115cfd4 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -11,6 +11,8 @@ SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256 SSLHonorCipherOrder on + SSLCompression off + SSLSessionTickets off SSLCertificateFile /etc/httpd/server.crt SSLCertificateKeyFile /etc/httpd/server.key SSLCertificateFile /etc/httpd/server-ecdsa.crt -- 2.13.6

2 3

[PATCH 1/3 v2] allow remote syslog via TCP in syslogdctrl.c
by Peter Müller 19 Nov '17

19 Nov '17

Make syslogctrl.c use TCP as remote logging file if specified so. Thanks to Michael for going through the first version of this. Patches 2 and 3 of this series are still valid. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- src/misc-progs/syslogdctrl.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/src/misc-progs/syslogdctrl.c b/src/misc-progs/syslogdctrl.c index 52719023e..589b6d009 100644 --- a/src/misc-progs/syslogdctrl.c +++ b/src/misc-progs/syslogdctrl.c @@ -27,18 +27,19 @@ #define ERR_ANY 1 #define ERR_SETTINGS 2 /* error in settings file */ #define ERR_ETC 3 /* error with /etc permissions */ -#define ERR_CONFIG 4 /* error updated sshd_config */ +#define ERR_CONFIG 4 /* error updated rsyslogd config */ #define ERR_SYSLOG 5 /* error restarting syslogd */ int main(void) { - char buffer[STRING_SIZE], command[STRING_SIZE], hostname[STRING_SIZE]; + char buffer[STRING_SIZE], command[STRING_SIZE], hostname[STRING_SIZE]; protocol[STRING_SIZE]; char varmessages[STRING_SIZE], asynclog[STRING_SIZE]; int config_fd,rc,fd,pid; struct stat st; struct keyvalue *kv = NULL; memset(buffer, 0, STRING_SIZE); memset(hostname, 0, STRING_SIZE); + memset(protocol, 0, STRING_SIZE); memset(varmessages, 0, STRING_SIZE); memset(asynclog, 0, STRING_SIZE); @@ -67,6 +68,12 @@ int main(void) exit(ERR_SETTINGS); } + if (!findkey(kv, "REMOTELOG_PROTOCOL", protocol)) + { + /* fall back to UDP if no protocol was given */ + protocol = "udp"; + } + if (strspn(hostname, VALID_FQDN) != strlen(hostname)) { fprintf(stderr, "Bad REMOTELOG_ADDR: %s\n", hostname); @@ -106,8 +113,19 @@ int main(void) } if (!strcmp(buffer,"on")) - snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@\$.\\+$/\\1%s/' /etc/syslog.conf >&%d", hostname, config_fd ); + /* check which transmission protocol was given */ + if (strcmp(protocol, "udp")) + { + /* write line for UDP */ + snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@\$.\\+$/\\1%s/' /etc/syslog.conf >&%d", hostname, config_fd ); + } + if (strcmp(protocol, "tcp")) + { + /* write line for TCP */ + snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@@\$.\\+$/\\1%s/' /etc/syslog.conf >&%d", hostname, config_fd ); + } else + /* if remote syslog has been disabled */ snprintf(buffer, STRING_SIZE - 1, "/bin/sed -e 's/^#\\?\$\\*\\.\\*[[:blank:]]\\+@.\\+\$$/#\\1/' /etc/syslog.conf >&%d", config_fd ); /* if the return code isn't 0 failsafe */ -- 2.13.6

2 1

[PATCH 0/1] fontconfig: update to 2.12.6
by Marcel Lorenz 19 Nov '17

19 Nov '17

This patch updates fontconfig to 2.12.6 and add a local.conf file to reactivate the font auto hinter used for font drawing on the rrdtool graphs. This is necessary after freetype 2.7 update. The text are now correct aligned on the pixel grid. This is based on: https://wiki.archlinux.org/index.php/Font_configuration/Examples Greetings, Marcel -- 2.14.2

1 1

[PATCH] expat: update to 2.2.5
by Marcel Lorenz 19 Nov '17

19 Nov '17

Signed-off-by: Marcel Lorenz <marcel.lorenz(a)ipfire.org> --- config/rootfiles/common/expat | 15 +++++++++------ lfs/expat | 8 ++++---- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat index 81a8ba7a0..9de1a0c4b 100644 --- a/config/rootfiles/common/expat +++ b/config/rootfiles/common/expat @@ -6,11 +6,14 @@ #usr/lib/libexpat.la usr/lib/libexpat.so usr/lib/libexpat.so.1 -usr/lib/libexpat.so.1.6.2 +usr/lib/libexpat.so.1.6.7 #usr/lib/pkgconfig/expat.pc -#usr/share/doc/expat-2.2.0 -#usr/share/doc/expat-2.2.0/expat.png -#usr/share/doc/expat-2.2.0/reference.html -#usr/share/doc/expat-2.2.0/style.css -#usr/share/doc/expat-2.2.0/valid-xhtml10.png +#usr/share/doc/expat +#usr/share/doc/expat-2.2.5 +#usr/share/doc/expat-2.2.5/expat.png +#usr/share/doc/expat-2.2.5/reference.html +#usr/share/doc/expat-2.2.5/style.css +#usr/share/doc/expat-2.2.5/valid-xhtml10.png +#usr/share/doc/expat/AUTHORS +#usr/share/doc/expat/changelog #usr/share/man/man1/xmlwf.1 diff --git a/lfs/expat b/lfs/expat index aa9759094..57ecd12f4 100644 --- a/lfs/expat +++ b/lfs/expat @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2016 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.2.0 +VER = 2.2.5 THISAPP = expat-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2f47841c829facb346eb6e3fab5212e2 +$(DL_FILE)_MD5 = 789e297f547980fc9ecc036f9a070d49 install : $(TARGET) @@ -70,7 +70,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure --prefix=/usr --disable-nls + cd $(DIR_APP) && ./configure --prefix=/usr cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install cd $(DIR_APP) && install -v -m755 -d /usr/share/doc/$(THISAPP) -- 2.14.2

1 0

[PATCH] openssh: update to 7.6p1
by Marcel Lorenz 19 Nov '17

19 Nov '17

Signed-off-by: Marcel Lorenz <marcel.lorenz(a)ipfire.org> --- lfs/openssh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index 56ac55a96..ff75a65f9 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -24,7 +24,7 @@ include Config -VER = 7.4p1 +VER = 7.6p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b2db2a83caf66a208bb78d6d287cdaa3 +$(DL_FILE)_MD5 = 06a88699018e5fef13d4655abfed1f63 install : $(TARGET) -- 2.14.2

1 0

[PATCH] less: remove deprecated --disable-nls configure option
by Marcel Lorenz 19 Nov '17

19 Nov '17

Signed-off-by: Marcel Lorenz <marcel.lorenz(a)ipfire.org> --- lfs/less | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/less b/lfs/less index 3a3548338..55944bc1a 100644 --- a/lfs/less +++ b/lfs/less @@ -70,7 +70,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc --disable-nls + cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install @rm -rf $(DIR_APP) -- 2.14.2

1 0

[PATCH] patch: remove deprecated --disable-nls configure option
by Marcel Lorenz 19 Nov '17

19 Nov '17

Signed-off-by: Marcel Lorenz <marcel.lorenz(a)ipfire.org> --- lfs/patch | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/patch b/lfs/patch index 88adf25f4..7ed35a7bb 100644 --- a/lfs/patch +++ b/lfs/patch @@ -35,12 +35,12 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) # ifeq "$(ROOT)" "" TARGET = $(DIR_INFO)/$(THISAPP) - EXTRA_CONFIG = --prefix=/usr --disable-nls + EXTRA_CONFIG = --prefix=/usr EXTRA_MAKE = EXTRA_INSTALL = else TARGET = $(DIR_INFO)/$(THISAPP)-tools - EXTRA_CONFIG = --prefix=/tools --disable-nls + EXTRA_CONFIG = --prefix=/tools EXTRA_MAKE = EXTRA_INSTALL = endif -- 2.14.2

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2017