Development August 2018

development@lists.ipfire.org

14 participants
56 discussions

[PATCH] ntp: Update to 4.2.8p12
by Matthias Fischer 24 Aug '18

24 Aug '18

For details see: http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/ntp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/ntp b/lfs/ntp index 9c5e772ac..8f845409c 100644 --- a/lfs/ntp +++ b/lfs/ntp @@ -24,7 +24,7 @@ include Config -VER = 4.2.8p11 +VER = 4.2.8p12 THISAPP = ntp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 00950ca2855579541896513e78295361 +$(DL_FILE)_MD5 = 1522d66574bae14abb2622746dad2bdc install : $(TARGET) -- 2.18.0

2 1

[PATCH] BUG11825: firewall: Renaming a network/host group doesn't update rules
by Alexander Marx 24 Aug '18

24 Aug '18

Code only changed field 6 of hash (target group) and not field 4 (source group). Also if using geoip it was only field 4 of hash (source group) and not field 6 of hash (target group) Added new code that changes both fields to reflect the change in the firewallrules immediately. fixes: #11825 Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> --- html/cgi-bin/fwhosts.cgi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi index 576701ac6..7315e79b6 100644 --- a/html/cgi-bin/fwhosts.cgi +++ b/html/cgi-bin/fwhosts.cgi @@ -1258,6 +1258,7 @@ if ($fwhostsettings{'ACTION'} eq 'changegrpname') } &General::writehasharray("$configgrp", \%customgrp ); #change name in FW Rules + &changenameinfw($fwhostsettings{'oldgrpname'},$fwhostsettings{'grp'},4); &changenameinfw($fwhostsettings{'oldgrpname'},$fwhostsettings{'grp'},6); } } @@ -1282,6 +1283,7 @@ if ($fwhostsettings{'ACTION'} eq 'changegeoipgrpname') &General::writehasharray("$configgeoipgrp", \%customgeoipgrp ); #change name in FW Rules &changenameinfw($fwhostsettings{'oldgrpname'},$fwhostsettings{'grp'},4,"geoip"); + &changenameinfw($fwhostsettings{'oldgrpname'},$fwhostsettings{'grp'},6,"geoip"); } } &addgeoipgrp; -- 2.17.1

2 1

Re: Intel Microcode
by Michael Tremer 24 Aug '18

24 Aug '18

Hi, On Thu, 2018-08-23 at 10:26 -0400, Tom Rymes wrote: > On 08/23/2018 9:34 AM, Michael Tremer wrote: > > On Wed, 2018-08-22 at 19:36 +0200, Peter Müller wrote: > > [snip] > > > It looks like we have to rollback the microcode update. Intel has > > changed the licensing terms in such a way that we won't be able (and no > > third party either) to provide any performance benchmarks. > > > > So if someone says on the forum that IPFire is "a little bit slower > > since the last update", that would violate that license. > > That's a VERY broad reading of the license. What you describe is a > subjective opinion of the performance of one installation from someone > not associated with the project, as opposed to the project itself > posting controlled performance benchmarks with before-and-after numbers. That didn't come from me, but Debian and Gentoo: * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158 * https://bugs.gentoo.org/664134 RedHat and SuSE seem to be shipping the new microcode. Not sure if they saw the change of the license. There is also a number of articles in the German news (at least) who share this opinion: * https://www.golem.de/news/side-channel-angriffe-intel-untersagt-benchmarks-… > [snip] > > > Basically, it isn't an option to ship this. Other distributions think > > the same. > > I see the desire to err on the side of caution, plus the desire to put > pressure on Intel to modify the license, but I'd argue it's overkill. It is just ridiculous from my angle. Their primary sales argument is to be on top of the list of each benchmark out there. They probably forgot about that. But this is more about a slight change to hide that they messed up *massively* here and a very bad attempt to cover it up. Now they got a proper Streisand going. Well done Intel. I am so fed up with spending so much of my time trying to fix something that they got wrong and don't even own up to it. They are a shit company. *Goes and punches a wall now* -Michael > Tom

4 6

Testing report for IPFire 2.21 - Core Update 123
by Peter Müller 23 Aug '18

23 Aug '18

Hello, since yesterday Core Update 123 is running on one of my firewall systems. After a reboot, I noticed average load has decreased a little bit (RAM consumption stays the same). Further, CPU frequency graphs are now working again (Thanks to Arne) and show some flapping freqs between 1.2kHz and 2.0kHz for each core. Before Core Update 121/122, idle frequencies were about 700MHz - not sure what this means. IDS, squid proxy (with URL filter and upstream proxy enabled), fireinfo and IPsec (N2N connections only) work fine. The OpenVPN WebUI page now displays a warning about a host certificate being not compliant to RFC3280, saying all host and root certificates should be replaced as soon as possible. This is probably related to https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=400c8afd9841bed350c1920… . GeoIP database results in WebUI are now as expected. A check script for CPU vulnerabilities (Spectre, Meltdown, ...) claims system is still vulnerable against CVE-2018-3640 (Spectre v3a), which requires up-to-date µ-codes. The overall results do not differ from a system running 121/122, which surprises me as new microcodes are shipped with this update. > [root@firewall ~]# grep "." /sys/devices/system/cpu/vulnerabilities/* > /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI > /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected > /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user pointer sanitization > /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, IBPB, IBRS_FW Besides of the microcode issue, I did not notice any issues. Output of "uname -a" is: > Linux firewall 4.14.50-ipfire #1 SMP Fri Jun 29 16:40:29 GMT 2018 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux Thanks, and best regards, Peter Müller -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

2 1

[PATCH] BUG11805: Firewallrule with source orange and target firewall-interface-orange not possible
by Alexander Marx 22 Aug '18

22 Aug '18

From: Alexander Marx <amarx(a)ipfire.org> Now its possible to create a rule with orange source and target orange interface of the firewall. fixes: #11805 Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> --- html/cgi-bin/firewall.cgi | 4 ---- lfs/apcupsd | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279d1..fb1c25dfd 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -241,10 +241,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') $checkorange='on'; } } - #check useless rules - if( ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && $fwdfwsettings{'grp2'} eq 'ipfire'){ - $errormessage.=$Lang::tr{'fwdfw useless rule'}."<br>"; - } #check if we try to break rules if( $fwdfwsettings{'grp1'} eq 'ipfire_src' && $fwdfwsettings{'grp2'} eq 'ipfire'){ $errormessage=$Lang::tr{'fwdfw err same'}; diff --git a/lfs/apcupsd b/lfs/apcupsd index ce36c3c6f..773dace74 100644 --- a/lfs/apcupsd +++ b/lfs/apcupsd @@ -78,7 +78,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./configure --prefix=/usr --enable-usb --enable-cgi \ - --with-cgi-bin=/srv/web/ipfire/cgi-bin + --with-cgi-bin=/srv/web/ipfire/cgi-bin --sysconfdir=/var/ipfire/ups cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install -- 2.17.1

2 3

[PATCH] nano: Update to 2.9.8
by Matthias Fischer 21 Aug '18

21 Aug '18

For details see: https://www.nano-editor.org/news.php Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/nano | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/nano b/lfs/nano index 98dec8897..9783c2917 100644 --- a/lfs/nano +++ b/lfs/nano @@ -24,7 +24,7 @@ include Config -VER = 2.9.7 +VER = 2.9.8 THISAPP = nano-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nano -PAK_VER = 22 +PAK_VER = 23 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 804a0e91cb11f2e8884aee7bfac2d18d +$(DL_FILE)_MD5 = fd58e87c20abbf029e5c4b153c89232a install : $(TARGET) -- 2.18.0

2 1

git push => "id: cannot find name for group ID 1000"
by Matthias Fischer 21 Aug '18

21 Aug '18

Hi! During pushing 'nano 2.9.8' today I got the following: ... root@Devel: /home/matz/ipfire-2.x # git push mfischer nano mfischer(a)git.ipfire.org's password: id: cannot find name for group ID 1000 Enumerating objects: 70, done. Counting objects: 100% (67/67), done. Delta compression using up to 8 threads. Compressing objects: 100% (40/40), done. Writing objects: 100% (41/41), 4.18 KiB | 713.00 KiB/s, done. Total 41 (delta 28), reused 0 (delta 0) error: remote unpack failed: unable to create temporary object directory To ssh://git.ipfire.org/pub/git/people/mfischer/ipfire-2.x.git ! [remote rejected] nano -> nano (unpacker error) error: failed to push some refs to 'ssh://mfischer@git.ipfire.org/pub/git/people/mfischer/ipfire-2.x.git' ... Upload failed - looks like someone up there doesn't like me. ;-) Anyone else? Best, Matthias

2 1

[PATCH] disable runtime kernel replacement via kexec
by Peter Müller 20 Aug '18

20 Aug '18

Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/etc/sysctl.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 011c4287e..5735dd42e 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -48,3 +48,7 @@ kernel.kptr_restrict = 1 # Avoid kernel memory address exposures via dmesg. kernel.dmesg_restrict = 1 + +# Turn off kexec, even if it's built in (dangerous because +# it can replace the running kernel). +kernel.kexec_load_disabled = 1 -- 2.16.4

2 3

Re: ARM 64?
by Mathew McBride 20 Aug '18

20 Aug '18

Hi Michael, >From the software side, the support in the kernel is fairly good, mainline 4.15 and later works. We (Traverse) only maintain a patchset for some small drivers (such as hwmon sensors not yet in the kernel - not required to boot) and other minor fixes not yet applied upstream. If you build an image that uses UEFI boot it will work on both our hardware (bare metal), as a VM and on the ARM64 server platforms (Ampere/XGene, Centriq, ThunderX), or even our competitors (MacchiatoBin etc.) The big difference is that we use u-boot and it's EFI implementation - and that is improving at a rate that we don't feel it necessary to port TianoCore to our board. The board Guy linked (LS1043-S) is our OEM/volume product, and he can brief you on the pricing off-list. We also have a 'hacker' oriented product in the pipeline (Five64 - https://traverse.com.au/products/five64-arm64-platform/ ) - which is currently in the PCB layout phase. This one has a wider feature set (NVMe SSD, ATX PSU on/off, ability to 'debrick' the flash and control via a separate BMC board). This is one we intend to be available to everyone (through CrowdSupply - via the campaign and beyond), which addresses the channel 'accessibility' issue (in terms of individuals and small operators being able to buy them). It's pricing will be similar to the other boards (Omnia, Novena, Atom C2000/C3000). Regards, Matt -------- Forwarded Message -------- Subject: Re: ARM 64? Date: Wed, 23 May 2018 10:58:00 +0100 From: Michael Tremer mailto:michael.tremer@ipfire.org To: mailto:guy@traverse.com.au, mailto:development@lists.ipfire.org Hello Guy, thank you very much for getting in touch. Yes, we are working on an ARM 64 port, but so far we have not seen any hardware that was worth doing the port for. All those small and cheap single-board computers lack power, the bigger systems are basically unavailable and way too expensive. This board is way different though. CPU, Memory and especially the NICs are something that are way better sized and make a nice small appliance for bigger SOHOs or small to medium-sized offices. Not entirely sure why there is only one 10G port. Usually where 10G goes in, it has to go out somewhere else again... The big question is what software support is like in the Linux kernel for this. I have seen the patches linked on the product page and can only defer to Arne to have a look at it. My question would now be: What is the desired RRP for this or wholesale? I am just curious to find out if it is competitive or if people would find it too expensive and buy Intel again. Then we shouldn't really bother with putting the time into a port. If you are not comfortable sharing prices on the list, please feel free to email me in private about this. About the sponsorship. Thank you very much for considering us. I would be happy to have a closer look. Would you be able to ship this into the UK or Germany? Best, -Michael On Wed, 2018-05-23 at 12:46 +1000, Guy Ellis wrote: > Dear list, > > Just wondering if there is any interest in supporting ARM 64 hardware > moving forward? > > We can assist with donated hardware and support if there is interest. > https://traverse.com.au/products/ls1043s-router-board/ > > Regards, > - Guy. > >

3 15

[PATCH 2/2] use custom SSH configuration in LFS file
by Peter Müller 19 Aug '18

19 Aug '18

Use custom OpenSSH server configuration file (see first patch of this series) instead of upstream one. Partially fixes #11538 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- lfs/openssh | 21 ++++----------------- 1 file changed, 4 insertions(+), 17 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index a88b2d126..d60ec7ce5 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -82,23 +82,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install - sed -i -e 's/^#\?Port .*$$/Port 22/' \ - -e 's/^#\?Protocol .*$$/Protocol 2/' \ - -e 's/^#\?LoginGraceTime .*$$/LoginGraceTime 30s/' \ - -e 's/^#\?PubkeyAuthentication .*$$/PubkeyAuthentication yes/' \ - -e 's/^#\?PasswordAuthentication .*$$/PasswordAuthentication no/' \ - -e 's/^#\?MaxStartups .*$$/MaxStartups 5/' \ - -e 's/^#\?IgnoreUserKnownHosts .*$$/IgnoreUserKnownHosts yes/' \ - -e 's/^#\?UsePAM .*$$//' \ - -e 's/^#\?X11Forwarding .*$$/X11Forwarding no/' \ - -e 's/^#\?SyslogFacility AUTH .*$$/SyslogFacility AUTH/' \ - -e 's/^#\?LogLevel INFO .*$$/LogLevel INFO/' \ - -e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \ - -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \ - -e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \ - -e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \ - -e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \ - -e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey /etc/ssh/ssh_host_rsa_key|' \ + + # install custom OpenSSH server configuration + install -v -m 644 $(DIR_SRC)/config/ssh/sshd_config \ /etc/ssh/sshd_config + @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.16.4

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2018