Development May 2018

development@lists.ipfire.org

10 participants
46 discussions

[PATCH] nano: Update to 2.9.7
by Matthias Fischer 19 May '18

19 May '18

For details see: https://www.nano-editor.org/news.php Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/nano | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/nano b/lfs/nano index 68759ed05..98dec8897 100644 --- a/lfs/nano +++ b/lfs/nano @@ -24,7 +24,7 @@ include Config -VER = 2.9.6 +VER = 2.9.7 THISAPP = nano-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nano -PAK_VER = 21 +PAK_VER = 22 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8b12ca2e4d33794a9c1794c4c7d84623 +$(DL_FILE)_MD5 = 804a0e91cb11f2e8884aee7bfac2d18d install : $(TARGET) -- 2.17.0

1 0

[PATCH 1/7] man: Fix spelling issues, wording and wrong page references in nitsi.1
by Michael Tremer 19 May '18

19 May '18

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- man/nitsi.xml | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/man/nitsi.xml b/man/nitsi.xml index 5310de66a4d6..9e105ae2ac7d 100644 --- a/man/nitsi.xml +++ b/man/nitsi.xml @@ -39,8 +39,9 @@ <title>Description</title> <para> - <command>nitsi</command> is a simple, extensible, Integration Test Suite - for the Network code of IPfire written in Python. + <command>nitsi</command> is a simple and extensible + suite for running integration tests for the network + code of IPFire. It is written in pure Python. </para> </refsect1> @@ -62,21 +63,23 @@ <listitem> <para> - Is the directory where all files of a test are located. - So this dir should contain at least a setting file and a recipe file + The directory where all files of a test are located. + It should contain at least a setting file and a recipe file. </para> <para> - For further details of the setting file layout and the recipe file layout, please consult the + For further details of the setting file layout and the recipe file layout, + please consult the <citerefentry> - <refentrytitle>nitsi.setting</refentrytitle> + <refentrytitle>nitsi.settings</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> + and <citerefentry> <refentrytitle>nitsi.recipe</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> - manual page. + manual pages. </para> </listitem> </varlistentry> @@ -103,7 +106,7 @@ <para> Please report all bugs to the official bugtracker at - http://bugzilla.ipfire.org/. + https://bugzilla.ipfire.org/. </para> </refsect1> @@ -112,7 +115,7 @@ <para> <citerefentry> - <refentrytitle>nitsi.setting</refentrytitle> + <refentrytitle>nitsi.settings</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> <citerefentry> -- 2.17.0

2 7

kernel: Update to 4.14.41
by Matthias Fischer 18 May '18

18 May '18

Hi, => https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=b7a46724970feeb1edd11bc… Please upload missing sources for 'arm-multi-patches-4.14.41-ipfire0.patch.xz'. Linux 4.14.41 was no problem, but I can't find the arm-multi patches. Thanks! Best, Matthias

2 2

[PATCH 3/3] OpenSSH: use safer cryptography defaults
by Peter Müller 18 May '18

18 May '18

By default, OpenSSH uses crypto algorithms such as SHA1, which are considered insecure and should not be used anymore. This patch updates the used ciphers, message-digest algorithms and key exchange algorithms according https://stribika.github.io/2015/01/04/secure-secure-shell.html . For the kex algo "diffie-hellman-group-exchange-sha256", an intact SSH moduli file is required. To make sure we are not falling back to insecure crypto here, its presence is checked at SSH startup. On my machines, this file was already there, but it makes sense to me to double-check this. This patch should not make problems except for very outdated OpenSSH clients (older than 6.x) or PuTTY versions. This partially addresses #11538 and requires patch 2/3. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/core/121/update.sh | 6 +++++- lfs/openssh | 4 ++++ src/initscripts/system/sshd | 12 ++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh index 3ec251292..99c174156 100644 --- a/config/rootfiles/core/121/update.sh +++ b/config/rootfiles/core/121/update.sh @@ -60,7 +60,11 @@ rm -rvf \ sed -i /etc/ssh/sshd_config \ -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ -e 's/^#LogLevel INFO$/LogLevel INFO/' \ - -e 's/^#StrictModes .*$/StrictModes yes/' + -e 's/^#StrictModes .*$/StrictModes yes/' \ + -e 's/^#RekeyLimit default none$/Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\ + MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\ + KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256\ + #RekeyLimit default none/' # Start services /etc/init.d/sshd restart diff --git a/lfs/openssh b/lfs/openssh index 7e8468ac9..3043501a2 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -96,6 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \ -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \ -e 's/^#StrictModes .*$/StrictModes yes/' \ + -e 's/^#RekeyLimit default none$/Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\ + MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\ + KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256\ + #RekeyLimit default none/' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \ diff --git a/src/initscripts/system/sshd b/src/initscripts/system/sshd index 7b4092d38..d7958e800 100644 --- a/src/initscripts/system/sshd +++ b/src/initscripts/system/sshd @@ -23,6 +23,18 @@ case "$1" in evaluate_retval done + # Make sure moduli file is properly present + # (https://stribika.github.io/2015/01/04/secure-secure-shell.html) + modulifile="/etc/ssh/moduli" + if [ ! -e "${modulifile}" ]; then + boot_mesg "Generating SSH moduli file (this may take a while)..." + + ssh-keygen -G /etc/ssh/moduli.all -b 4096 + ssh-keygen -T /etc/ssh/moduli.safe -f /etc/ssh/moduli.all + mv /etc/ssh/moduli.safe /etc/ssh/moduli + rm -f /etc/ssh/moduli.all + fi + [ -e "/var/ipfire/remote/enablessh" ] || exit 0 # SSH is not enabled boot_mesg "Starting SSH Server..." loadproc /usr/sbin/sshd -- 2.13.6

2 3

Planning out Core Update 117
by Michael Tremer 12 May '18

12 May '18

Hello, so the big Core Update 115 has been shipped last week. Core Update 116 is coming today. So the next one should be a little bit calmer please :) I do not have anything so far except some smaller bug fixes here and there. Does anyone have anything big? It doesn't have to be another big update. We could also just improve IPFire where ever it is needed with loads of smaller changes and start working on 3 and other sub-projects that are floating around... Best, -Michael

5 31

[PATCH] Add NRPE initscript to rootfile
by Matthias Fischer 12 May '18

12 May '18

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/nagios_nrpe | 1 + 1 file changed, 1 insertion(+) diff --git a/config/rootfiles/packages/nagios_nrpe b/config/rootfiles/packages/nagios_nrpe index 89f74c92d..1da6c3baf 100644 --- a/config/rootfiles/packages/nagios_nrpe +++ b/config/rootfiles/packages/nagios_nrpe @@ -1,5 +1,6 @@ etc/nagios etc/nagios/nrpe.cfg +etc/rc.d/init.d/nrpe #root/.rnd #usr/bin/nrpe-uninstall usr/bin/nrpe -- 2.17.0

1 0

[PATCH 1/5] Makefile: Remove any excessive whitespace
by Michael Tremer 11 May '18

11 May '18

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- Makefile.am | 3 --- 1 file changed, 3 deletions(-) diff --git a/Makefile.am b/Makefile.am index 689b61e39ffd..4370355c34b8 100644 --- a/Makefile.am +++ b/Makefile.am @@ -16,7 +16,6 @@ EXTRA_DIST = INSTALL_DIRS = noinst_DATA = - AM_V_XSLT = $(AM_V_XSLT_$(V)) AM_V_XSLT_ = $(AM_V_XSLT_$(AM_DEFAULT_VERBOSITY)) AM_V_XSLT_0 = @echo " XSLT " $@; @@ -38,7 +37,6 @@ nitsi_PYTHON = \ src/nitsi/test.py \ src/nitsi/virtual_environ.py - nitsidir = $(pythondir)/nitsi # ------------------------------------------------------------------------------ @@ -90,7 +88,6 @@ man/%.5: man/%.xml man/%.html: man/%.xml man/custom-html.xsl $(XSLTPROC_COMMAND_HTML) - endif # ------------------------------------------------------------------------------ -- 2.17.0

1 4

[PATCH] install initscript for NRPE
by Peter Müller 09 May '18

09 May '18

Install an initscript for the NRPE addon (this was missing in the NRPE update patch). Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- lfs/nagios_nrpe | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lfs/nagios_nrpe b/lfs/nagios_nrpe index 369f9335d..aa9a773be 100644 --- a/lfs/nagios_nrpe +++ b/lfs/nagios_nrpe @@ -89,5 +89,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install + + #install initscripts + $(call INSTALL_INITSCRIPT,nrpe) + @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.13.6

2 5

[PATCH] wget 1.19.5: latest patches (01-03)
by Matthias Fischer 09 May '18

09 May '18

For details see: http://git.savannah.gnu.org/cgit/wget.git Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/wget | 4 +++ ...1-src_hosts_c_remove_void_assignment.patch | 13 +++++++++ .../02-src_version_h_add_header_guard.patch | 20 +++++++++++++ .../wget/03-src_hsts_h_fix_header_guard.patch | 29 +++++++++++++++++++ 4 files changed, 66 insertions(+) create mode 100644 src/patches/wget/01-src_hosts_c_remove_void_assignment.patch create mode 100644 src/patches/wget/02-src_version_h_add_header_guard.patch create mode 100644 src/patches/wget/03-src_hsts_h_fix_header_guard.patch diff --git a/lfs/wget b/lfs/wget index 39f59ba80..f753bef1a 100644 --- a/lfs/wget +++ b/lfs/wget @@ -71,6 +71,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/01-src_hosts_c_remove_void_assignment.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/02-src_version_h_add_header_guard.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/03-src_hsts_h_fix_header_guard.patch + cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc \ diff --git a/src/patches/wget/01-src_hosts_c_remove_void_assignment.patch b/src/patches/wget/01-src_hosts_c_remove_void_assignment.patch new file mode 100644 index 000000000..ba488571c --- /dev/null +++ b/src/patches/wget/01-src_hosts_c_remove_void_assignment.patch @@ -0,0 +1,13 @@ +diff --git a/src/host.c b/src/host.c +index 4597f46..b42cd6e 100644 +--- a/src/host.c ++++ b/src/host.c +@@ -732,7 +732,7 @@ wait_ares (ares_channel channel) + ares_process (channel, &read_fds, &write_fds); + } + if (timer) +- timer = ptimer_destroy (timer); ++ ptimer_destroy (timer); + } + + static void diff --git a/src/patches/wget/02-src_version_h_add_header_guard.patch b/src/patches/wget/02-src_version_h_add_header_guard.patch new file mode 100644 index 000000000..5fd75b975 --- /dev/null +++ b/src/patches/wget/02-src_version_h_add_header_guard.patch @@ -0,0 +1,20 @@ +diff --git a/src/version.h b/src/version.h +index aeae086..ee40bb1 100644 +--- a/src/version.h ++++ b/src/version.h +@@ -27,6 +27,9 @@ Corresponding Source for a non-source form of such a combination + shall include the source code for the parts of OpenSSL used as well + as that of the covered work. */ + ++#ifndef WGET_VERSION_H ++#define WGET_VERSION_H ++ + /* Extern declarations for strings in version.c */ + extern const char *version_string; + extern const char *compilation_string; +@@ -34,3 +37,5 @@ extern const char *link_string; + + /* Extern declaration for string in build_info.c */ + extern const char *compiled_features[]; ++ ++#endif /* WGET_VERSION_H */ diff --git a/src/patches/wget/03-src_hsts_h_fix_header_guard.patch b/src/patches/wget/03-src_hsts_h_fix_header_guard.patch new file mode 100644 index 000000000..786d28851 --- /dev/null +++ b/src/patches/wget/03-src_hsts_h_fix_header_guard.patch @@ -0,0 +1,29 @@ +diff --git a/src/hsts.h b/src/hsts.h +index 257f0b0..0065d9f 100644 +--- a/src/hsts.h ++++ b/src/hsts.h +@@ -26,13 +26,13 @@ grants you additional permission to convey the resulting work. + Corresponding Source for a non-source form of such a combination + shall include the source code for the parts of OpenSSL used as well + as that of the covered work. */ +-#include "wget.h" + +-#ifdef HAVE_HSTS ++#ifndef WGET_HSTS_H ++#define WGET_HSTS_H + +-#ifndef HSTS_H +-#define HSTS_H ++#ifdef HAVE_HSTS + ++#include "wget.h" + #include "url.h" + + typedef struct hsts_store *hsts_store_t; +@@ -48,5 +48,5 @@ bool hsts_store_entry (hsts_store_t, + time_t, bool); + bool hsts_match (hsts_store_t, struct url *); + +-#endif /* HSTS_H */ + #endif /* HAVE_HSTS */ ++#endif /* WGET_HSTS_H */ -- 2.17.0

2 3

[PATCH 1/4] BUG11559: Languagefiles
by Alexander Marx 07 May '18

07 May '18

When creating firewallrules or using firewall groups, it should be possible to select a single IpSec subnet if there is more than one. This patch adds a new languagefileword "fwdfw all subnets" which is used in firewall.cgi and fwhosts.cgi --- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + 2 files changed, 2 insertions(+) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 07bef90..9cc345a 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1065,6 +1065,7 @@ 'fwdfw additional' => 'Weitere Einstellungen', 'fwdfw addrule' => 'Regel hinzufügen/ändern:', 'fwdfw all icmp' => 'Alle ICMP-Typen', +'fwdfw all subnets' => 'Alle Subnetze', 'fwdfw change' => 'Aktualisieren', 'fwdfw copy' => 'Kopieren', 'fwdfw delete' => 'Löschen', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index a343b3b..60747f7 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1092,6 +1092,7 @@ 'fwdfw additional' => 'Additional settings', 'fwdfw addrule' => 'Add/Edit rule:', 'fwdfw all icmp' => 'All ICMP types', +'fwdfw all subnets' => 'All subnets', 'fwdfw change' => 'Update', 'fwdfw copy' => 'Copy', 'fwdfw delete' => 'Delete', -- 2.7.4

3 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development May 2018