Development August 2020

development@lists.ipfire.org

11 participants
55 discussions

Pending German translation patch
by Peter Müller 10 Aug '20

10 Aug '20

Hello Arne, since upcoming Core Update 148 will most probably contain libloc and retire GeoIP, may I ask you to include a small German translation patch (https://patchwork.ipfire.org/patch/3041/) as well? It corrects a misleading translation regarding country based firewall rules, and I thought it might be a good idea to include that as well to reduce confusion. Thanks, and best regards, Peter Müller

2 3

Core Update 148 (testing) report
by Peter Müller 09 Aug '20

09 Aug '20

Hello *, Core Update 148 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-148-is-available-for-t…) is running here for about a week without any major issues so far. Sorry for being late this time. Looking at the ipinfo.cgi, it currently displays the country returned by the location database, which should always be a valid one, as we decided not no override them for "special" IP addresses such as anonymous proxies, satellite providers, or anycast networks. However, we do not display this information to the user. While I have no idea about how to do that for CGIs such as the DNS settings, or the connection tracking table, the ipinfo.cgi should contain such information from my point of view. (I suspect this raising questions in the community as well.) It would be nice to have AS information displayed on ipinfo.cgi as well, but since we do not process them elsewhere, this is definitively not a show-stopper. Thanks to Michael for being the "master of disaster" behind libloc (no offense intended ;-) ) and providing me with answers to it and testing environment. Thanks to Stefan for building the Perl bindings and adjusting CGIs and firewall scripts. Thanks, and best regards, Peter Müller

2 1

[PATCH] hyperscan: Update to 5.3.0
by Stefan Schantl 07 Aug '20

07 Aug '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/common/i586/hyperscan | 4 ++-- config/rootfiles/common/x86_64/hyperscan | 4 ++-- lfs/hyperscan | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/i586/hyperscan b/config/rootfiles/common/i586/hyperscan index 945c2b68c..463166f34 100644 --- a/config/rootfiles/common/i586/hyperscan +++ b/config/rootfiles/common/i586/hyperscan @@ -5,10 +5,10 @@ #usr/include/hs/hs_runtime.h #usr/lib/libhs.so usr/lib/libhs.so.5 -usr/lib/libhs.so.5.2.1 +usr/lib/libhs.so.5.3.1 usr/lib/libhs_runtime.so usr/lib/libhs_runtime.so.5 -usr/lib/libhs_runtime.so.5.2.1 +usr/lib/libhs_runtime.so.5.3.1 #usr/lib/pkgconfig/libhs.pc #usr/share/doc/hyperscan #usr/share/doc/hyperscan/examples diff --git a/config/rootfiles/common/x86_64/hyperscan b/config/rootfiles/common/x86_64/hyperscan index 945c2b68c..463166f34 100644 --- a/config/rootfiles/common/x86_64/hyperscan +++ b/config/rootfiles/common/x86_64/hyperscan @@ -5,10 +5,10 @@ #usr/include/hs/hs_runtime.h #usr/lib/libhs.so usr/lib/libhs.so.5 -usr/lib/libhs.so.5.2.1 +usr/lib/libhs.so.5.3.1 usr/lib/libhs_runtime.so usr/lib/libhs_runtime.so.5 -usr/lib/libhs_runtime.so.5.2.1 +usr/lib/libhs_runtime.so.5.3.1 #usr/lib/pkgconfig/libhs.pc #usr/share/doc/hyperscan #usr/share/doc/hyperscan/examples diff --git a/lfs/hyperscan b/lfs/hyperscan index b63c6ecbe..96979c718 100644 --- a/lfs/hyperscan +++ b/lfs/hyperscan @@ -24,7 +24,7 @@ include Config -VER = 5.2.1 +VER = 5.3.0 THISAPP = hyperscan-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e722ec217282d38b1457cc751f0a4bb6 +$(DL_FILE)_MD5 = 6acab4b242dd81b3cede211d4a9e7101 install : $(TARGET) -- 2.20.1

1 0

On demoting i586 to "legacy" status
by Michael Tremer 06 Aug '20

06 Aug '20

Hello, This is me catching up with my very very long TODO list (i.e. book)… We have talked about making it clearer that 32 bit on x86 is no longer a good choice for users at the telephone conference in May: https://wiki.ipfire.org/devel/telco/2020-05-04 I took on the job to make this clearer on the website in the download section which I rolled out yesterday: https://www.ipfire.org/download I am not happy with the whole download section at all, but this is what we have for now. New design is in the works. However, this splits the offered architectures into two sections now: * Primary Architectures (x86_64, arm) * Secondary Architectures (i586, aarch64) i586 will be a primary architecture for all releases that did not have x86_64. Aarch64 is a secondary architecture because Arne wanted it marked as “experimental”. We do not exactly know how well it runs on some boards, although we have been using it for quite a long time in the build infrastructure. I have split the two sections by the “Cloud advert” in the middle which promotes Cloud over the secondary arches and makes it clear that secondary really means secondary because users will have to scroll a lot to find i586 now. That does it for me now. I would prefer to keep images on the download page (even for aarch64), because if we do not make them available like this, what is the point to build them in the first place? The next steps are adding a warning to the web UI that people who are running on i586 are running a legacy system now. We will support it, but we will advice against using it until we have only a few users left. Currently i686 stands at 26.75% in fire info, which means we have to convince 20% of our users to change. Possible, but not within the next few months. A blog article will hopefully help. Best, -Michael

2 5

[PATCH] make.sh: Add cross-building for aarch64
by Michael Tremer 05 Aug '20

05 Aug '20

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- doc/make.sh-usage | 10 +++++----- make.sh | 3 +++ 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/doc/make.sh-usage b/doc/make.sh-usage index 78a73efac..5e1e3dd22 100644 --- a/doc/make.sh-usage +++ b/doc/make.sh-usage @@ -16,8 +16,8 @@ Maintainer / advanced commands Options: - --target=[armv5tel|i586] : Cross-compile for this target architecture. - Uses the QEMU emulator if needed to virtualise - the desired target architecture. - Can be permanently set with TARGET_ARCH= in - .config. + --target=[aarch64|armv5tel|i586] : Cross-compile for this target architecture. + Uses the QEMU emulator if needed to virtualise + the desired target architecture. + Can be permanently set with TARGET_ARCH= in + .config. diff --git a/make.sh b/make.sh index a2e54f233..9f94feddb 100755 --- a/make.sh +++ b/make.sh @@ -862,6 +862,9 @@ qemu_find_build_helper_name() { local magic case "${build_arch}" in + aarch64) + magic="7f454c460201010000000000000000000200b700" + ;; arm*) magic="7f454c4601010100000000000000000002002800" ;; -- 2.20.1

1 0

[PATCH] haproxy: Update to 2.2.2
by Michael Tremer 05 Aug '20

05 Aug '20

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/haproxy | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/haproxy b/lfs/haproxy index bc5ef8021..ce44f8154 100644 --- a/lfs/haproxy +++ b/lfs/haproxy @@ -24,7 +24,7 @@ include Config -VER = 2.1.7 +VER = 2.2.2 THISAPP = haproxy-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = haproxy -PAK_VER = 15 +PAK_VER = 16 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f0ddf67e2be18cfe1b996f9914cfa67e +$(DL_FILE)_MD5 = dfef423ff9f191c401d6b29e7eb9d6e2 install : $(TARGET) -- 2.20.1

1 0

[PATCH 1/2] index.cgi: Drop Reiser4 warning
by Michael Tremer 05 Aug '20

05 Aug '20

We have dropped Reiser4 in 2013. There won't be any systems out there any more running it. We can safely drop this warning. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- doc/language_issues.de | 1 + doc/language_issues.en | 1 - doc/language_issues.es | 1 - doc/language_issues.fr | 1 + doc/language_issues.it | 1 + doc/language_issues.nl | 1 + doc/language_issues.pl | 1 - doc/language_issues.ru | 1 - doc/language_issues.tr | 1 + html/cgi-bin/index.cgi | 7 ------- 10 files changed, 5 insertions(+), 11 deletions(-) diff --git a/doc/language_issues.de b/doc/language_issues.de index df5df895e..f2a7ba8ae 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -180,6 +180,7 @@ WARNING: translation string unused: default networks WARNING: translation string unused: default services WARNING: translation string unused: defaultwarning WARNING: translation string unused: delete cron +WARNING: translation string unused: deprecated fs warn WARNING: translation string unused: description WARNING: translation string unused: destination ip bad WARNING: translation string unused: destination ip or net diff --git a/doc/language_issues.en b/doc/language_issues.en index 6417d5382..ca3b1bbdb 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -551,7 +551,6 @@ WARNING: untranslated string: delete pc = Delete workstation WARNING: untranslated string: delete share = Delete share WARNING: untranslated string: delete user = Delete user WARNING: untranslated string: demon login script = Demon login script -WARNING: untranslated string: deprecated fs warn = Deprecated filesystem! Newer kernel drop the support. Backup and reformat! WARNING: untranslated string: dest ip and port = Dest. IP: Port WARNING: untranslated string: destination = Destination WARNING: untranslated string: destination ip = Destination IP diff --git a/doc/language_issues.es b/doc/language_issues.es index 475db4953..016bcd5e5 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -804,7 +804,6 @@ WARNING: untranslated string: dangerous = Dangerous WARNING: untranslated string: dead peer detection = Dead Peer Detection WARNING: untranslated string: default = Default WARNING: untranslated string: default IP address = Default IP Address -WARNING: untranslated string: deprecated fs warn = Deprecated filesystem! Newer kernel drop the support. Backup and reformat! WARNING: untranslated string: details = Details WARNING: untranslated string: dh = Diffie-Hellman parameters WARNING: untranslated string: dh key move failed = Diffie-Hellman parameters move failed. diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 9470597af..9c7456d71 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -203,6 +203,7 @@ WARNING: translation string unused: default networks WARNING: translation string unused: default services WARNING: translation string unused: defaultwarning WARNING: translation string unused: delete cron +WARNING: translation string unused: deprecated fs warn WARNING: translation string unused: description WARNING: translation string unused: destination ip bad WARNING: translation string unused: destination ip or net diff --git a/doc/language_issues.it b/doc/language_issues.it index 93e4b097f..c3291c0b2 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -178,6 +178,7 @@ WARNING: translation string unused: default networks WARNING: translation string unused: default services WARNING: translation string unused: defaultwarning WARNING: translation string unused: delete cron +WARNING: translation string unused: deprecated fs warn WARNING: translation string unused: description WARNING: translation string unused: destination ip bad WARNING: translation string unused: destination ip or net diff --git a/doc/language_issues.nl b/doc/language_issues.nl index ad76bf228..49a9c6d20 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -177,6 +177,7 @@ WARNING: translation string unused: default networks WARNING: translation string unused: default services WARNING: translation string unused: defaultwarning WARNING: translation string unused: delete cron +WARNING: translation string unused: deprecated fs warn WARNING: translation string unused: description WARNING: translation string unused: destination ip bad WARNING: translation string unused: destination ip or net diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 475db4953..016bcd5e5 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -804,7 +804,6 @@ WARNING: untranslated string: dangerous = Dangerous WARNING: untranslated string: dead peer detection = Dead Peer Detection WARNING: untranslated string: default = Default WARNING: untranslated string: default IP address = Default IP Address -WARNING: untranslated string: deprecated fs warn = Deprecated filesystem! Newer kernel drop the support. Backup and reformat! WARNING: untranslated string: details = Details WARNING: untranslated string: dh = Diffie-Hellman parameters WARNING: untranslated string: dh key move failed = Diffie-Hellman parameters move failed. diff --git a/doc/language_issues.ru b/doc/language_issues.ru index f99fd4d9a..4bf922e62 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -807,7 +807,6 @@ WARNING: untranslated string: dangerous = Dangerous WARNING: untranslated string: dead peer detection = Dead Peer Detection WARNING: untranslated string: default = Default WARNING: untranslated string: default IP address = Default IP Address -WARNING: untranslated string: deprecated fs warn = Deprecated filesystem! Newer kernel drop the support. Backup and reformat! WARNING: untranslated string: details = Details WARNING: untranslated string: dh = Diffie-Hellman parameters WARNING: untranslated string: dh key move failed = Diffie-Hellman parameters move failed. diff --git a/doc/language_issues.tr b/doc/language_issues.tr index b6e3426f3..f02493545 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -200,6 +200,7 @@ WARNING: translation string unused: default networks WARNING: translation string unused: default services WARNING: translation string unused: defaultwarning WARNING: translation string unused: delete cron +WARNING: translation string unused: deprecated fs warn WARNING: translation string unused: description WARNING: translation string unused: destination ip bad WARNING: translation string unused: destination ip or net diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi index bd6a02ef5..945a5b68c 100644 --- a/html/cgi-bin/index.cgi +++ b/html/cgi-bin/index.cgi @@ -593,13 +593,6 @@ foreach my $file (@files) { } } -# Reiser4 warning -my @files = `mount | grep " reiser4 (" 2>/dev/null`; -foreach my $disk (@files) { - chomp ($disk); - $warnmessage .= "<li>$disk - $Lang::tr{'deprecated fs warn'}</li>"; -} - if ($warnmessage) { &Header::openbox('100%','center', ); print "<table class='tbl' style='width:80%;'>"; -- 2.20.1

1 1

Re: Hardware Buying Considerations
by Jon Murphy 05 Aug '20

05 Aug '20

> Please let me know your thoughts or where I am absolutely wrong. You know I am more than happy to tell you that you are wrong! ;-) From the Doc side… (sorry I know this is before the Devs weigh in) All looks good to me except for one item - recommendation > I am too tired of people buying - often cheap - stuff that simply does not work and they will end up unhappy with. Hopefully we will make the experience better for them and us by getting fewer questions like these. > I do not want to recommend - at all - any specific hardware here, because that dates very very quickly and still does not work for everyone. What I would rather like to achieve is that everyone is asking themselves the correct questions before they purchase something. I believe recommendations must happen to help keep users from buying the wrong stuff. It probably won’t be an exact part number or link to Amazon, but it should be something along the lines of buy this Intel i5 xyz or Intel i7 xyz or AMD xyz. Buy this network chip and avoid that network chip. Recommendations can come from users (via thus the IPFire Community or the Wiki) if there is no "official" recommendation. (In my mind an "official" recommendation would come from Michael or a senior Dev. And yes I realize this does not/may not really exist today) Yes, hardware dates quickly, but so does software. And so does everything else. I realize the hardware I bought new was discontinued by Intel 7+ years old but it works perfectly for my use-case (home use, internet 200 Mb by 10 Mb, 2-4 users, 3 computers, 15 other devices, less than 1 hour per month VPN in). To buy my current device I ended up reviewing the pfSense website for suggestions and recommendations. How crazy is that?!? Just my 2 cents worth. Hope everyone is healthy! Jon > Message: 2 > Date: Tue, 4 Aug 2020 09:55:04 +0100 > From: Michael Tremer <michael.tremer(a)ipfire.org> > To: "IPFire: Development-List" <development(a)lists.ipfire.org> > Subject: Hardware Buying Considerations > Message-ID: <26741AC9-EA07-4684-A864-89745DCC2479(a)ipfire.org> > Content-Type: text/plain; charset=utf-8 > > I have edited the wiki a bit and removed large parts in the hardware section. > > Although this email is about documentation, I would like to have the dev?s opinions first before I pass this page on to the doc team. > > Please read this: > > https://wiki.ipfire.org/hardware/considerations > > This is an article that should give people some guidance on what to buy. Or rather what not to buy. > > I do not want to recommend - at all - any specific hardware here, because that dates very very quickly and still does not work for everyone. What I would rather like to achieve is that everyone is asking themselves the correct questions before they purchase something. > > I am too tired of people buying - often cheap - stuff that simply does not work and they will end up unhappy with. Hopefully we will make the experience better for them and us by getting fewer questions like these. > > So what I have changed in the content is this: > > * I am no longer recommending to have a HWRNG. I consider them pointless and potentially rather harmful than helpful. > > * I am recommending to think about security first. That means Intel is becoming a difficult buy, but I do not give any solutions either. > > * People really buy oversized machines. I have seen firewalls with 256G of RAM using about 1. What a waste of resources. > > * I assume that accelerated AES is now the default. > > * And finally, I put an emphasis on the network interfaces. It over-simplifies things quite a bit, but I think it is still more important to think about those than having the latest i7 processor. > > Please let me know your thoughts or where I am absolutely wrong. > > Best, > -Michael

2 1

[PATCH 1/3] WIO: code cleanup
by Stephan Feddersen 04 Aug '20

04 Aug '20

--- src/wio/wio.cgi | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/wio/wio.cgi b/src/wio/wio.cgi index a92a44473..a5d3d149e 100644 --- a/src/wio/wio.cgi +++ b/src/wio/wio.cgi @@ -21,7 +21,7 @@ # # ############################################################################### # -# Version: 2020/06/01 13:29:23 +# Version: 2020/08/04 21:12:23 # # This wio.cgi is based on the code from the IPCop WIO Addon # and is extremly adapted to work with IPFire. @@ -1152,7 +1152,7 @@ close (FILE); foreach (@ddns) { chomp; - + @temp = split (/\,/, $_); if ( $temp[7] eq "on" ) { @@ -1161,7 +1161,7 @@ close (FILE); else { $bgcolor = "blue"; } - + print"<font color='$bgcolor'>$temp[1].$temp[2]</font>"; if ( $iddyndns++ ne (@ddns-1) ) { print"<br />\n"; } } @@ -1334,7 +1334,7 @@ foreach $key (keys %ovpnconfighash) { if (-e "/var/run/$ovpnconfighash{$key}[1]n2n.pid") { my ( @output, @tustate ) = ''; my $tport = $ovpnconfighash{$key}[22]; - my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport); + my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport); if ($tport ne '') { $tnet->open('127.0.0.1'); @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/'); @@ -1535,7 +1535,6 @@ my $dotip = length($ipaddresses[$a]) - rindex($ipaddresses[$a],'.'); } else { print"<td align='center' height='20'><img src='$imgstatic/$devs_img[$in]' alt='$Lang::tr{$devs_alt[$in]}' title='$Lang::tr{$devs_alt[$in]}' /></td>"; - } last SWITCH; } -- 2.17.1

1 2

[PATCH] First Patch from me. Hope this Ok so. Socat, filan and procan.
by smooky＠v16.de 04 Aug '20

04 Aug '20

Signed-off-by: Marcel Follert (Smooky) <smooky(a)v16.de> --- config/rootfiles/packages/socat | 4 ++ lfs/socat | 85 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 89 insertions(+) create mode 100644 config/rootfiles/packages/socat create mode 100644 lfs/socat diff --git a/config/rootfiles/packages/socat b/config/rootfiles/packages/socat new file mode 100644 index 000000000..6a984e892 --- /dev/null +++ b/config/rootfiles/packages/socat @@ -0,0 +1,4 @@ +usr/bin/filan +usr/bin/procan +usr/bin/socat +#usr/share/man/man1/socat.1 diff --git a/lfs/socat b/lfs/socat new file mode 100644 index 000000000..6c3ffd5c1 --- /dev/null +++ b/lfs/socat @@ -0,0 +1,85 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.7.3.4 + +THISAPP = socat-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = socat +PAK_VER = 1 + +DEPS = + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = c9e71d0136c88a01d6fd30a13a3936ed + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xzf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./configure --prefix=/usr + cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) -- 2.12.2

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2020