Development February 2018

development@lists.ipfire.org

14 participants
33 discussions

[PATCH] OpenVPN: Update to version 2.4.4
by Erik Kapfer 15 Feb '18

15 Feb '18

Changed LFS and ROOTFILE for OpenVPN 2.4.4 update. Added CRL updater script to LFS. Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- config/rootfiles/common/openvpn | 5 ++++- lfs/openvpn | 11 ++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index b58e30c..cbfd03e 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -1,3 +1,5 @@ +etc/fcron.daily/ovpn_crl_updater.sh +#usr/include/openvpn-msg.h #usr/include/openvpn-plugin.h #usr/lib/openvpn #usr/lib/openvpn/plugins @@ -10,11 +12,12 @@ usr/sbin/openvpn #usr/share/doc/openvpn #usr/share/doc/openvpn/COPYING #usr/share/doc/openvpn/COPYRIGHT.GPL +#usr/share/doc/openvpn/Changes.rst #usr/share/doc/openvpn/README #usr/share/doc/openvpn/README.IPv6 #usr/share/doc/openvpn/README.auth-pam #usr/share/doc/openvpn/README.down-root -#usr/share/doc/openvpn/README.polarssl +#usr/share/doc/openvpn/README.mbedtls #usr/share/doc/openvpn/management-notes.txt #usr/share/man/man8/openvpn.8 var/ipfire/ovpn/ca diff --git a/lfs/openvpn b/lfs/openvpn index 8307d01..e7f9bc2 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2017 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.3.18 +VER = 2.4.4 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 844ec9c64aae62051478784b8562f881 +$(DL_FILE)_MD5 = 7a2002aad1671b24457bc9432a0c5c52 install : $(TARGET) @@ -96,5 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify + mv -v /var/ipfire/ovpn/ovpn_crl_updater.sh /etc/fcron.daily + chown root:root /etc/fcron.daily/ovpn_crl_updater.sh + chmod 750 /etc/fcron.daily/ovpn_crl_updater.sh + @rm -rf $(DIR_APP) @$(POSTBUILD) + -- 2.7.4

4 28

[PATCH v3 0/4] proxy.cgi fixes for bugzilla #10852
by Bernhard Held 15 Feb '18

15 Feb '18

v2 -> v3 - Network::network2bin: use 'return ();' instead of plain 'return;' - Network::network_qual: fix identation problem - proxy.cgi::writepacfile: use 'chomp(@templist);' once before loop v1 -> v2 - Network::network_qual: Improved check if array is fully defined. Honestly, the testsuite of the unpatched file still fails on my IPFire for an unknown reason. The patches fixe the issue for me using perl v5.12.3 as well as v5.26.1. - Network::network2bin: 'return undef;' doesn't return an empty list causing lots of headaches. Popular sites strongly recommend to use 'return;' instead of 'return undef;'. Maybe 'return undef;' should be avoided everywhere in IPFire. Have fun, Bernhard

3 11

[PATCH] proxy.cgi: remove excessive newlines in generated proxy.pac
by Bernhard Held 14 Feb '18

14 Feb '18

Remove excessive newlines in generated proxy.pac --- html/cgi-bin/proxy.cgi | 2 -- 1 file changed, 2 deletions(-) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index df436595b..c28258902 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -3078,8 +3078,6 @@ END print FILE "\n"; print FILE <<END - - ) return "PROXY $netsettings{'GREEN_ADDRESS'}:$proxysettings{'PROXY_PORT'}"; END -- 2.16.1

2 1

[PATCH v2 0/4] proxy.cgi fixes for bugzilla #10852
by Bernhard Held 13 Feb '18

13 Feb '18

v2 with following changes: Network::network_qual: Improved check if array is fully defined. Honestly, the testsuite of the unpatched file still fails on my IPFire for an unknown reason. The patches fixe the issue for me using perl v5.12.3 as well as v5.26.1. Network::network2bin: 'return undef;' doesn't return an empty list causing lots of headaches. Popular sites strongly recommend to use 'return;' instead of 'return undef;'. Maybe 'return undef;' should be avoided everywhere in IPFire. Have fun, Bernhard

2 6

[PATCH] OpenVPN: Mark unsecure ciphers and DH-parameter as 'weak' in WUI menu
by Erik Kapfer 12 Feb '18

12 Feb '18

64 bit block ciphers like Blowfish, TDEA and CAST5 are vulnerable to the so called 'Birthday attacks' . Infos for 'Sweet32' Birthday attacks can be found in here https://sweet32.info/ . An Overview of 64 bit clock ciphers can also be found in here http://en.citizendium.org/wiki/Block_cipher/Catalogs/Cipher_list#64-bit_blo… 1024 bit Diffie-Hellman parameter has also been marked as weak causing the 'Logjam Attack' . Infos for 'Logjam Attack' can be found in here https://weakdh.org/ . Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 9f5e682..0fa1d04 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2002,7 +2002,7 @@ END </select></td> <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td> <td class='base'><select name='DHLENGHT'> - <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option> + <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'} ($Lang::tr{'vpn weak'}</option> <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option> <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option> <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option> @@ -4713,12 +4713,12 @@ if ($cgiparams{'TYPE'} eq 'net') { <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'}, $Lang::tr{'default'})</option> <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option> <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option> - <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'})</option> - <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'})</option> - <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option> - <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'})</option> - <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'})</option> - <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'})</option> + <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option> + <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> </select> </td> @@ -5210,12 +5210,12 @@ END <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'})</option> <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option> <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option> - <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'})</option> - <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'})</option> <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option> - <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'})</option> - <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'})</option> - <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'})</option> + <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> + <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option> </select> </td> <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td> -- 2.7.4

2 1

[PATCH] Network::network_equal: fix definition check of array
by Bernhard Held 12 Feb '18

12 Feb '18

--- config/cfgroot/network-functions.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index 2902aabb0..3bf17b092 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -111,7 +111,7 @@ sub network_equal { my @bin1 = &network2bin($network1); my @bin2 = &network2bin($network2); - if (!defined $bin1 || !defined $bin2) { + if (!defined @bin1 || !defined @bin2) { return undef; } -- 2.16.1

2 3

[PATCH 0/2] proxy.cgi fixes for bugzilla #10852
by Bernhard Held 11 Feb '18

11 Feb '18

Hi all, these patches fix the possibility to add more subnets for the proxy, also reported in bugzilla #10852. Have fun, Bernhard

3 6

[PATCH] Update: nut to 2.7.4
by Paul T. Simmons 09 Feb '18

09 Feb '18

--- config/rootfiles/packages/nut | 2 +- lfs/nut | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/packages/nut b/config/rootfiles/packages/nut index 4e6167e0d..b01381d74 100644 --- a/config/rootfiles/packages/nut +++ b/config/rootfiles/packages/nut @@ -5,7 +5,7 @@ etc/nut/upsd.conf.sample etc/nut/upsd.users.sample etc/nut/upsmon.conf.sample etc/nut/upssched.conf.sample -etc/udev/rules.d/52-nut-usbups.rules +etc/udev/rules.d/62-nut-usbups.rules usr/bin/al175 usr/bin/apcsmart usr/bin/apcsmart-old diff --git a/lfs/nut b/lfs/nut index 2045dce6c..c2cb6e973 100644 --- a/lfs/nut +++ b/lfs/nut @@ -24,15 +24,15 @@ include Config -VER = 2.7.2 +VER = 2.7.4 THISAPP = nut-$(VER) DL_FILE = $(THISAPP).tar.gz -DL_FROM = $(URL_IPFIRE) +DL_FROM = http://www.networkupstools.org/source/2.7 DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nut -PAK_VER = 5 +PAK_VER = 6 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c3568b42e058cfc385b46d25140dced4 +$(DL_FILE)_MD5 = 3ba53656933d7471f95140b32a5b8d5c install : $(TARGET) @@ -83,7 +83,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make cd $(DIR_APP) && make install # sed -i -e "s|ATTR{|SYSFS{|g" /etc/udev/rules.d/52-nut-usbups.rules - -mkdir -p /var/state/ups + mkdir -p /var/state/ups #install initscripts $(call INSTALL_INITSCRIPT,nut) -- 2.14.3

3 3

Re: acme.sh
by Michael Tremer 07 Feb '18

07 Feb '18

Hi, On Tue, 2018-02-06 at 21:01 +0100, Marcel Lorenz wrote: > Hi, > > after short testing installation of acme.sh. > > Log: > [root@ipfire acme]# ./acme.sh --install > [Tue Feb 6 20:37:20 CET 2018] It is recommended to install socat first. > [Tue Feb 6 20:37:20 CET 2018] We use socat for standalone server if you > use standalone mode. > [Tue Feb 6 20:37:20 CET 2018] If you don't use standalone mode, just > ignore this warning. > [Tue Feb 6 20:37:20 CET 2018] Installing to /root/.acme.sh > [Tue Feb 6 20:37:20 CET 2018] Installed to /root/.acme.sh/acme.sh > [Tue Feb 6 20:37:20 CET 2018] Installing alias to '/root/.bashrc' > [Tue Feb 6 20:37:20 CET 2018] OK, Close and reopen your terminal to > start using acme.sh > [Tue Feb 6 20:37:20 CET 2018] Installing cron job > 2018-02-06 20:37:20 INFO listing root's fcrontab > 2018-02-06 20:37:20 INFO listing root's fcrontab > 2018-02-06 20:37:20 INFO installing file /tmp/fcr-jYUQke for user root > /tmp/fcr-jYUQke:80: Mismatched quotes: skipping line. > Modifications will be taken into account right now. > [Tue Feb 6 20:37:20 CET 2018] Good, bash is found, so change the > shebang to use bash as preferred. > [Tue Feb 6 20:37:21 CET 2018] OK > > A package named socat is needed for working. I found this download > location: http://www.dest-unreach.org/socat/download/ > > From my side: After droppig PHP, no nice web applications more possible > (roundcube, nextcloud, phpmyadmin). > Sorry, i have no use for acme.sh on IPfire without PHP. This is useful for the reverse proxies that we ship. -Michael > Best, > Marcel > > Am 2018-02-06 20:01, schrieb Michael Tremer: > > Hello, > > > > would anyone like to package acme.sh for IPFire 2? > > > > For some things it might make sense to generate a non-self-signed > > certificate > > and this is a simple shell script that should do the job. > > > > I haven't tested it if it runs, but it would be nice if someone could > > do this, > > package it and send patches. > > > > Best, > > -Michael > >

1 0

acme.sh
by Michael Tremer 06 Feb '18

06 Feb '18

Hello, would anyone like to package acme.sh for IPFire 2? For some things it might make sense to generate a non-self-signed certificate and this is a simple shell script that should do the job. I haven't tested it if it runs, but it would be nice if someone could do this, package it and send patches. Best, -Michael

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2018