Development August 2020

development@lists.ipfire.org

11 participants
55 discussions

[PATCH] dnsdist: Update to 1.5.0
by Michael Tremer 04 Aug '20

04 Aug '20

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/dnsdist | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/dnsdist b/lfs/dnsdist index 9f2040f16..2e7c88f93 100644 --- a/lfs/dnsdist +++ b/lfs/dnsdist @@ -24,7 +24,7 @@ include Config -VER = 1.4.0 +VER = 1.5.0 THISAPP = dnsdist-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) SUP_ARCH = x86_64 i586 PROG = dnsdist -PAK_VER = 4 +PAK_VER = 5 DEPS = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0fecd7d600c1c094b9fffffd27c44369 +$(DL_FILE)_MD5 = 86532fd9b0e8f838b16ab1a611f52abb install : $(TARGET) -- 2.20.1

1 0

[PATCH] location: Provide a return code if the database does not need to be updated.
by Stefan Schantl 04 Aug '20

04 Aug '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/python/location.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/python/location.in b/src/python/location.in index 5211b28..8cdd140 100644 --- a/src/python/location.in +++ b/src/python/location.in @@ -416,7 +416,7 @@ class CLI(object): _("The datase has recently be updated recently (%s)") % \ format_timedelta(now - t), ) - return + return 3 # Fetch the timestamp we need from DNS t = location.discover_latest_version() -- 2.20.1

2 1

[PATCH] OpenSSL: remove ciphers without Forward Secrecy from default ciphersuite
by Peter Müller 04 Aug '20

04 Aug '20

Ciphers not supplying (Perfect) Forward Secrecy are considered dangerous since they allow content decryption in retrospect, if an attacker is able to gain access to the servers' private key used for the corresponding TLS session. Since IPFire machines establish very few TLS connections by themselves, and destinations (IPFire.org infrastructure, mirrors, IPS rule sources, etc.) provide support for Forward Secrecy ciphers - some are even enforcing them -, it is safe to drop support for anything else. This patch reduces the OpenSSL default cipher list to: TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(256) Mac=SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(256) Mac=SHA384 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(128) Mac=SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(128) Mac=SHA256 DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 DHE-RSA-CAMELLIA256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA256 DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 DHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA256 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/patches/openssl-1.1.1d-default-cipherlist.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/patches/openssl-1.1.1d-default-cipherlist.patch b/src/patches/openssl-1.1.1d-default-cipherlist.patch index 5ad7829e7..a3a48933e 100644 --- a/src/patches/openssl-1.1.1d-default-cipherlist.patch +++ b/src/patches/openssl-1.1.1d-default-cipherlist.patch @@ -5,7 +5,7 @@ * This applies to ciphersuites for TLSv1.2 and below. */ -# define SSL_DEFAULT_CIPHER_LIST "ALL:!COMPLEMENTOFDEFAULT:!eNULL" -+# define SSL_DEFAULT_CIPHER_LIST "HIGH:+aRSA:+SHA384:+SHA256:+DH:+SHA:+kRSA:!eNULL:!aNULL:!PSK:!SRP:!AESCCM:!DSS" ++# define SSL_DEFAULT_CIPHER_LIST "HIGH:+aRSA:+SHA384:+SHA256:+DH:+SHA:!kRSA:!eNULL:!aNULL:!PSK:!SRP:!AESCCM:!DSS" /* This is the default set of TLSv1.3 ciphersuites */ # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) # define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \ -- 2.26.2

2 1

Hardware Buying Considerations
by Michael Tremer 04 Aug '20

04 Aug '20

I have edited the wiki a bit and removed large parts in the hardware section. Although this email is about documentation, I would like to have the dev’s opinions first before I pass this page on to the doc team. Please read this: https://wiki.ipfire.org/hardware/considerations This is an article that should give people some guidance on what to buy. Or rather what not to buy. I do not want to recommend - at all - any specific hardware here, because that dates very very quickly and still does not work for everyone. What I would rather like to achieve is that everyone is asking themselves the correct questions before they purchase something. I am too tired of people buying - often cheap - stuff that simply does not work and they will end up unhappy with. Hopefully we will make the experience better for them and us by getting fewer questions like these. So what I have changed in the content is this: * I am no longer recommending to have a HWRNG. I consider them pointless and potentially rather harmful than helpful. * I am recommending to think about security first. That means Intel is becoming a difficult buy, but I do not give any solutions either. * People really buy oversized machines. I have seen firewalls with 256G of RAM using about 1. What a waste of resources. * I assume that accelerated AES is now the default. * And finally, I put an emphasis on the network interfaces. It over-simplifies things quite a bit, but I think it is still more important to think about those than having the latest i7 processor. Please let me know your thoughts or where I am absolutely wrong. Best, -Michael

1 0

Testing Core update development build 148
by Mentalic 03 Aug '20

03 Aug '20

Loaded up x64 image to my spare box. Restored backup from core 147, found that DNS is broken with settings from the 147 present. Loaded image twice with same results. Nothing I tried in the DNS gui could get it working. Loaded up Iso for the third try but did not restore a backup. Manually typed in the same settings from 147 and DNS works normally. Regards Wayne

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2020