Development March 2018

development@lists.ipfire.org

13 participants
39 discussions

Question regarding package updates, applying patches, and building
by Peter Müller 17 Jun '18

17 Jun '18

Hello, while trying to update entire packages in IPFire (some of them are outdated) and to fix some bugs, I ran into a couple of questions: (a) How to update entire packages? As far as I understood, to every package belongs a file in lfs/[package_name], containing information about how to build, apply patches to it, and so on. It seems like packages are downloaded from https://source.ipfire.org/ , but it did not became clear to me how to upload a new version of a package to this server. Of course, the download URL can be changed manually, but that seems rather ugly to me. Unfortunately, I was unable to find a sort of tutorial in the wiki for this issue. (b) How to apply patches to downloaded packages with changed filenames? As discussed in December (https://wiki.ipfire.org/devel/telco/2017-12-04), I am supposed to have a look at the DEFAULT cipher suite in OpenSSL. To change this value, the .tar.gz file needs to be downloaded and unpacked first. After that, the file "ssl/ssl.h" needs to be changed. The patch at src/patches/openssl-1.0.2h-weak-ciphers.patch does something similar: diff -Naur openssl-1.0.2h.org/ssl/ssl.h openssl-1.0.2h/ssl/ssl.h --- openssl-1.0.2h.org/ssl/ssl.h 2016-05-03 15:44:42.000000000 +0200 +++ openssl-1.0.2h/ssl/ssl.h 2016-05-03 18:49:10.393302264 +0200 @@ -338,7 +338,7 @@ * The following cipher list is used by default. It also is substituted when * an application-defined cipher list string starts with 'DEFAULT'. */ -# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2" +# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2:!RC2:!DES" /* * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always * starts with a reasonable order, and all we have to do for DEFAULT is But where does the file openssl-[...].org came from? (c) How to build the distribution partly? In the past, I handed in some patches to allow remote syslogging via TCP, too. After some struggles (settings are written by a C program, not the CGI file itself), I modified syslogdctrl.c, and the changes were shipped. (See https://bugzilla.ipfire.org/show_bug.cgi?id=11540 for details.) But since this program now crashes with a segfault on my machine (*sigh*), it seems like my patch contained some errors. However, building the entire distribution is somewhat time-consuming and not worth the effort for a probably small error. Is there any way of just building this C program, and omit the rest? Thanks in advance! Best regards, Peter Müller

2 3

Planning out Core Update 117
by Michael Tremer 12 May '18

12 May '18

Hello, so the big Core Update 115 has been shipped last week. Core Update 116 is coming today. So the next one should be a little bit calmer please :) I do not have anything so far except some smaller bug fixes here and there. Does anyone have anything big? It doesn't have to be another big update. We could also just improve IPFire where ever it is needed with loads of smaller changes and start working on 3 and other sub-projects that are floating around... Best, -Michael

5 31

[PATCH] Updated Apache 2.4
by Wolfgang Apolinarski 17 Apr '18

17 Apr '18

- Updated Apache from 2.4.29 to 2.4.33 - Updated Apr from 1.6.1 to 1.6.3 - Updated Apr-Util from 1.6.0 to 1.6.1 --- config/rootfiles/common/apache2 | 6 +++++- config/rootfiles/common/apr | 2 +- config/rootfiles/common/aprutil | 2 +- lfs/apache2 | 4 ++-- lfs/apr | 6 +++--- lfs/aprutil | 6 +++--- 6 files changed, 15 insertions(+), 11 deletions(-) diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2 index b7d471fe9..529faf34e 100644 --- a/config/rootfiles/common/apache2 +++ b/config/rootfiles/common/apache2 @@ -89,7 +89,6 @@ etc/httpd/conf/vhosts.d/ipfire-interface.conf #srv/web/ipfire/htdocs #srv/web/ipfire/htdocs/index.html #srv/web/ipfire/html -srv/web/ipfire/html/captive #srv/web/ipfire/icons #srv/web/ipfire/icons/README #srv/web/ipfire/icons/README.html @@ -910,6 +909,8 @@ srv/web/ipfire/html/captive #srv/web/ipfire/manual/mod/mod_macro.html #srv/web/ipfire/manual/mod/mod_macro.html.en #srv/web/ipfire/manual/mod/mod_macro.html.fr +#srv/web/ipfire/manual/mod/mod_md.html +#srv/web/ipfire/manual/mod/mod_md.html.en #srv/web/ipfire/manual/mod/mod_mime.html #srv/web/ipfire/manual/mod/mod_mime.html.en #srv/web/ipfire/manual/mod/mod_mime.html.fr @@ -968,6 +969,8 @@ srv/web/ipfire/html/captive #srv/web/ipfire/manual/mod/mod_proxy_scgi.html #srv/web/ipfire/manual/mod/mod_proxy_scgi.html.en #srv/web/ipfire/manual/mod/mod_proxy_scgi.html.fr +#srv/web/ipfire/manual/mod/mod_proxy_uwsgi.html +#srv/web/ipfire/manual/mod/mod_proxy_uwsgi.html.en #srv/web/ipfire/manual/mod/mod_proxy_wstunnel.html #srv/web/ipfire/manual/mod/mod_proxy_wstunnel.html.en #srv/web/ipfire/manual/mod/mod_ratelimit.html @@ -1609,6 +1612,7 @@ usr/lib/apache/mod_proxy_hcheck.so usr/lib/apache/mod_proxy_html.so usr/lib/apache/mod_proxy_http.so usr/lib/apache/mod_proxy_scgi.so +usr/lib/apache/mod_proxy_uwsgi.so usr/lib/apache/mod_proxy_wstunnel.so usr/lib/apache/mod_ratelimit.so usr/lib/apache/mod_reflector.so diff --git a/config/rootfiles/common/apr b/config/rootfiles/common/apr index c71ee01cc..dfde82400 100644 --- a/config/rootfiles/common/apr +++ b/config/rootfiles/common/apr @@ -44,7 +44,7 @@ usr/bin/apr-1-config #usr/lib/libapr-1.la #usr/lib/libapr-1.so usr/lib/libapr-1.so.0 -usr/lib/libapr-1.so.0.6.2 +usr/lib/libapr-1.so.0.6.3 #usr/lib/pkgconfig/apr-1.pc #usr/share/apr-1 #usr/share/apr-1/build diff --git a/config/rootfiles/common/aprutil b/config/rootfiles/common/aprutil index e9cf3e0da..8bc51ed00 100644 --- a/config/rootfiles/common/aprutil +++ b/config/rootfiles/common/aprutil @@ -43,5 +43,5 @@ usr/lib/apr-util-1/apr_crypto_openssl.so #usr/lib/libaprutil-1.la #usr/lib/libaprutil-1.so usr/lib/libaprutil-1.so.0 -usr/lib/libaprutil-1.so.0.6.0 +usr/lib/libaprutil-1.so.0.6.1 #usr/lib/pkgconfig/apr-util-1.pc diff --git a/lfs/apache2 b/lfs/apache2 index 28855fdc5..69b05341d 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.4.29 +VER = 2.4.33 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0c599404ef6b69eee95bcd9fcd094407 +$(DL_FILE)_MD5 = 6ef469d3f16fffeb688bc6e0346823e5 install : $(TARGET) diff --git a/lfs/apr b/lfs/apr index 6f667cffc..47c21a325 100644 --- a/lfs/apr +++ b/lfs/apr @@ -25,11 +25,11 @@ include Config -VER = 1.6.2 +VER = 1.6.3 THISAPP = apr-$(VER) DL_FILE = $(THISAPP).tar.bz2 -DL_FROM = http://archive.apache.org/dist/apr +DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e81a851967c79b5ce9bfbc909e4bf735 +$(DL_FILE)_MD5 = 12f2a349483ad6f12db49ba01fbfdbfa install : $(TARGET) diff --git a/lfs/aprutil b/lfs/aprutil index c2f808422..29ec5df43 100644 --- a/lfs/aprutil +++ b/lfs/aprutil @@ -25,11 +25,11 @@ include Config -VER = 1.6.0 +VER = 1.6.1 THISAPP = apr-util-$(VER) DL_FILE = $(THISAPP).tar.bz2 -DL_FROM = http://archive.apache.org/dist/apr +DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 069a9a980776acab05212c5f37ef8368 +$(DL_FILE)_MD5 = 8ff5dc36fa39a2a3db1df196d3ed6086 install : $(TARGET) -- 2.13.0

2 5

[ipfire] Patch notification: 7 patches updated
by Patchwork 30 Mar '18

30 Mar '18

Hello, The following patches (submitted by you) have been updated in Patchwork: * ipfire: OpenVPN: Ship missing OpenSSL configuration file for update - http://patchwork.ipfire.org/patch/1675/ - for: IPFire was: Staged now: Accepted * ipfire: squid: Add RAM-only Proxy functionality - http://patchwork.ipfire.org/patch/1669/ - for: IPFire was: Staged now: Accepted * ipfire: WIO: Update to Version 1.3.2 several changes in many files - http://patchwork.ipfire.org/patch/1670/ - for: IPFire was: Staged now: Accepted * ipfire: WIO: Fix some typos - http://patchwork.ipfire.org/patch/1676/ - for: IPFire was: Staged now: Accepted * ipfire: WIO: Fix a problem with the Network-Table-Button - http://patchwork.ipfire.org/patch/1677/ - for: IPFire was: Staged now: Accepted * ipfire: [v3] OpenVPN: New AES-GCM cipher for N2N and RW - http://patchwork.ipfire.org/patch/1674/ - for: IPFire was: Staged now: Accepted * ipfire: set OpenSSL 1.1.0 DEFAULT cipher list to secure value - http://patchwork.ipfire.org/patch/1678/ - for: IPFire was: Staged now: Accepted This email is a notification only - you do not need to respond. Happy patchworking. -- This is an automated mail sent by the Patchwork system at patchwork.ipfire.org. To stop receiving these notifications, edit your mail settings at: http://patchwork.ipfire.org/mail/

1 0

[PATCH] vnstat: Update to 1.18
by Matthias Fischer 28 Mar '18

28 Mar '18

For details see: https://humdi.net/vnstat/CHANGES Changed "SaveInterval 5" to "SaveInterval 1" in '/etc/vnstat.conf', triggered by https://forum.ipfire.org/viewtopic.php?f=22&t=20448 to avoid data loss with 1Gbit connections and high traffic. Thanks to BeBiMa for the man page link (https://humdi.net/vnstat/man/vnstatd.html). ;-) Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/vnstat | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lfs/vnstat b/lfs/vnstat index 376a1e999..a61bc5ed2 100644 --- a/lfs/vnstat +++ b/lfs/vnstat @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.17 +VER = 1.18 THISAPP = vnstat-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8de1c7e40806509943804bb4b26f5409 +$(DL_FILE)_MD5 = c9abaeb0ce758c16f6cdfa247bd8606c install : $(TARGET) @@ -81,6 +81,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make all $(MAKETUNING) LOCAL_CONFIGURE_OPTIONS="--enable-readline=yes" cd $(DIR_APP) && make install sed -i 's|eth0|green0|g' /etc/vnstat.conf + sed -i 's|SaveInterval 5|SaveInterval 1|g' /etc/vnstat.conf sed -i 's|/var/lib/vnstat|/var/log/vnstat|g' /etc/vnstat.conf sed -i 's|/var/log/vnstat/vnstat.log|/var/log/vnstat.log|g' /etc/vnstat.conf sed -i 's|/var/run/vnstat/vnstat.pid|/var/run/vnstat.pid|g' /etc/vnstat.conf -- 2.16.2

3 8

[PATCH] use protocol defined in server-list.db for mirror communication
by Peter Müller 28 Mar '18

28 Mar '18

For each mirror server, a protocol can be specified in the server-list.db database. However, it was not used for the actual URL query to a mirror before. This might be useful for deploy HTTPS pinning for Pakfire. If a mirror is known to support HTTPS, all queries to it will be made with this protocol. This saves some overhead if HTTPS is enforced on a mirror via 301 redirects. To enable this, the server-list.db needs to be adjusted. Partially fixes #11661. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- src/pakfire/lib/functions.pl | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index c97d4254d..94f9f1826 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -171,8 +171,11 @@ sub fetchfile { } } + # Use specified protocol for mirror communication (allows HTTPS pinning) + my $urlproto = lc $proto; + $final_data = undef; - my $url = "http://$host/$file"; + my $url = "$urlproto://$host/$file"; my $response; unless ($bfile =~ /^counter.py\?.*/) { -- 2.13.6

2 4

Re: [openssl-announce] Forthcoming OpenSSL releases
by Michael Tremer 27 Mar '18

27 Mar '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, so as you can see, we can expect a security issue in OpenSSL which will be made public next Tuesday. The current release branch and next will be affected by what ever this problem is. We might (or might not) need to roll out an emergency Core Update before we can release Core Update 120. So we will wait with uploading that into testing until we know how to proceed. Best, - -Michael On Tue, 2018-03-20 at 17:18 +0000, Matt Caswell wrote: > Forthcoming OpenSSL releases > ============================ > > The OpenSSL project team would like to announce the forthcoming release > of OpenSSL versions 1.1.0h and 1.0.2o. > > These releases will be made available on 27th March 2018 between > approximately 1300-1700 UTC. > > These are security-fix releases. The highest severity issue fixed in > these releases is MODERATE. > > Yours > > The OpenSSL Project Team > -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE5/rW5l3GGe2ypktxgHnw/2+QCQcFAlqxcecACgkQgHnw/2+Q CQfiZRAAqRLmjco4V2rxJTjNaYRM7o+YbHG9gvW5xjHdMAJURDyDaxc+DTkMJyoq woLrf86RDylKT4SdilGDS+3AXtZuy3H/qRsKr+HjNgpgdP9Hh+bzuu9buml4n3F9 wvxOdmOuAhQKWJpwJIifuqAMjJrI6wzUhAsR13ttXX+YHr6B+dcQ0r1zZI5xmolc YKFVF0BQBtABXnc4mjqeiQcPm1NbbIoHF0kuqD43ljz5I0C5Mc9E3LS/VSeQgQ8M tw9BvZNyA+ul3GZ3pL98L40ORPcL3UJ6sC0YmCpVkZ6I1F1WHXs+2DKqiKOifi5x PPBK9Q23K1gbD9fAkdvzlbjeQFOVb3eCglmZ4Jc07oeC398qXA85EOeCFqnu1fhQ 2sRa4HXT4llJS3m0HddvdHKCz4HEpc8YwQ+hGkH9t0eCVqul1u/wNujMtoZSyWqv 9/IQjxaDGVzL5kG+UqrxYIYllQ0qqfcwgx9uDZy/3u3JYdnQ+pVIMFI+fZx29F2T gSV3McuSHBBtwZvgBBVNHCv/djNbwmhv69RBZQWQuriqxmTCTvgFMRltoDecFv8A MkTfGwZNWaP5NjdYiV5O8fE4N4gir6ISCZUqDpe3NGoq/tE6ziPKOupJvSNjWq/a Vt1YOx1O2uqlSStEqjtykTdS2uZ0G58kML26BY/wlDNL+1yDd/A= =wVcZ -----END PGP SIGNATURE-----

1 1

[PATCH v2] show RNGD status at WebUI service page, too
by Peter Müller 27 Mar '18

27 Mar '18

Also show the status of the hardware random number generator ("RNGD") at the services.cgi page in the WebUI. Before, this was only shown at the entropy.cgi page, which was a bit inconsistent. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/services.cgi | 4 +++- src/initscripts/system/rngd | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/services.cgi b/html/cgi-bin/services.cgi index 64fdbba05..eaaa5298a 100644 --- a/html/cgi-bin/services.cgi +++ b/html/cgi-bin/services.cgi @@ -56,6 +56,7 @@ my %servicenames =( $Lang::tr{'secure shell server'} => 'sshd', $Lang::tr{'vpn'} => 'charon', $Lang::tr{'web proxy'} => 'squid', + $Lang::tr{'random number generator daemon'} => 'rngd', 'OpenVPN' => 'openvpn' ); @@ -74,7 +75,8 @@ my %link =( "$Lang::tr{'intrusion detection system'} (GREEN)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (GREEN)</a>", "$Lang::tr{'intrusion detection system'} (RED)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (RED)</a>", "$Lang::tr{'intrusion detection system'} (ORANGE)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (ORANGE)</a>", - "$Lang::tr{'intrusion detection system'} (BLUE)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (BLUE)</a>" + "$Lang::tr{'intrusion detection system'} (BLUE)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (BLUE)</a>", + "$Lang::tr{'random number generator daemon'}" => "<a href=\'entropy.cgi\'>$Lang::tr{'random number generator daemon'}</a>" ); my $lines=0; # Used to count the outputlines to make different bgcolor diff --git a/src/initscripts/system/rngd b/src/initscripts/system/rngd index df4aa7da2..9abcf6a79 100644 --- a/src/initscripts/system/rngd +++ b/src/initscripts/system/rngd @@ -30,10 +30,16 @@ case "${1}" in boot_mesg "Starting Random Number Generator Daemon..." if pidofproc /usr/sbin/rngd &>/dev/null; then + # Make sure PID file is readable. + test -f /run/rngd.pid && chmod 755 /run/rngd.pid + # Is already running. echo_ok else loadproc /usr/sbin/rngd --no-tpm=1 + + # Make sure PID file is readable. + test -f /run/rngd.pid && chmod 755 /run/rngd.pid fi ;; -- 2.13.6

2 1

[PATCH] delete obsolete patch for OpenSSL 1.0.x
by Peter Müller 26 Mar '18

26 Mar '18

This patch became obsolete since we use OpenSSL 1.1.x in Core Update 120 and onward, where a similar patch already exists. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- src/patches/openssl-1.0.2h-weak-ciphers.patch | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 src/patches/openssl-1.0.2h-weak-ciphers.patch diff --git a/src/patches/openssl-1.0.2h-weak-ciphers.patch b/src/patches/openssl-1.0.2h-weak-ciphers.patch deleted file mode 100644 index d1ec6a2af..000000000 --- a/src/patches/openssl-1.0.2h-weak-ciphers.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur openssl-1.0.2h.org/ssl/ssl.h openssl-1.0.2h/ssl/ssl.h ---- openssl-1.0.2h.org/ssl/ssl.h 2016-05-03 15:44:42.000000000 +0200 -+++ openssl-1.0.2h/ssl/ssl.h 2016-05-03 18:49:10.393302264 +0200 -@@ -338,7 +338,7 @@ - * The following cipher list is used by default. It also is substituted when - * an application-defined cipher list string starts with 'DEFAULT'. - */ --# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2" -+# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2:!RC2:!DES" - /* - * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always - * starts with a reasonable order, and all we have to do for DEFAULT is -- 2.13.6

2 2

Core 119 - libtinfo.so.5 missing?
by Horace Michael 26 Mar '18

26 Mar '18

Hi everybody, When libtinfo.so.5.9 got erased? (lfs/ncurses contains rm -vf $(PREFIX)/lib/libtinfo.*) Nano, htop (and perhaps other apps) need it: # htop htop: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory nano nano: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: No such file or directory I am running a fresh install of core 119 3.14.79-ipfire #1 SMP Sun Feb 25 19:02:14 GMT 2018 x86_64 AMD GX-412TC SOC AuthenticAMD GNU/Linux Thank you, Horace

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2018