Development November 2021

development@lists.ipfire.org

16 participants
49 discussions

Release Announcement: libloc 0.9.9
by Michael Tremer 22 Nov '21

22 Nov '21

This is the announcement for release of libloc 0.9.9. This release comes with some feature enhancements and various bug fixes. https://git.ipfire.org/?p=location/libloc.git;a=shortlog;h=refs/tags/0.9.9 https://source.ipfire.org/releases/libloc/libloc-0.9.9.tar.gz API Changes: * loc_country_special_code_to_flag has been added and will translate any special country codes (A1, A2, …) into flags if such flags are available. * loc_network_matches_country_code can now handle any special country codes. This is useful when people want to use special country codes (A1, …) and the library will automatically perform a check for the flag. This is useful when integrating libloc into other applications and we add more special country codes which the application no longer needs to be aware of. * loc_database_lookup takes the address as a constified argument * loc_network_match_address/country_code have been renamed to loc_network_matches_address/country code (match -> matches). * loc_network_match_flag has been dropped. Use loc_network_has_flag. * All string pool and network tree functions have been made private. There is no need to export them. Importer: * We now import a feed from JPNIC. * We import Spamhaus DROP and mark such networks/ASes with the DROP flag (or XD). Performance improvements: * The entire library is now being build with -fno-semantic-interposition if the compiler supports it. This prevents users from overlaying any functions, but allows the compiler to inline more functions which will increase performance of all database operations potentially at the cost of a slightly larger size. Misc. * A statically linked version of the database is being generated in order to test internal functions in the test suite. * All country codes beginning with X are now considered invalid. X is reserved for custom country codes and therefore not recognised any more.

1 0

[PATCH 1/2] suricata: Update to 5.0.8
by Matthias Fischer 20 Nov '21

20 Nov '21

For details see: https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942 "Various security, performance, accuracy and stability issues have been fixed, including two TCP evasion issues. CVE 2021-37592 was assigned." Changelog: "5.0.8 -- 2021-11-16 Security #4635: tcp: crafted injected packets cause desync after 3whs Security #4727: Bypass of Payload Detection on TCP RST with options of MD5header Bug #4345: Failed assert in TCPProtoDetectCheckBailConditions size_ts > 1000000UL Bug #4382: fileinfo "stored: false" even if the file is kept on disk Bug #4626: DNP3: intra structure overflow in DNP3DecodeObjectG70V6 Bug #4628: alert count shows up as 0 when stats are disabled Bug #4631: Protocol detection : confusion with SMB in midstream Bug #4639: Failed assertion in SMTP SMTPTransactionComplete Bug #4646: TCP reassembly, failed assert app_progress > last_ack_abs, both sides need to be pruned Bug #4647: rules: Unable to find the sm in any of the sm lists Bug #4674: rules: mix of drop and pass rules issues Bug #4676: rules: drop rules with noalert not fully dropping Bug #4688: detect: too many prefilter engines lead to FNs Bug #4690: nfs: failed assert self.tx_data.files_logged > 1 Bug #4691: IPv6 : decoder event on invalid fragment length Bug #4696: lua: file info callback returns wrong value Bug #4718: protodetect: SEGV due to NULL ptr deref Bug #4729: ipv6 evasions : fragmentation Bug #4788: Memory leak in SNMP with DetectEngineState Bug #4790: af-packet: threads sometimes get stuck in capture Bug #4794: loopback: different AF_INET6 values per OS Bug #4816: flow-manager: cond_t handling in emergency mode is broken Bug #4831: SWF decompression overread Bug #4833: Wrong list_id with transforms for http_client_body and http file_data Optimization #3429: improve err msg for dataset rules parsing Task #4835: libhtp 0.5.39" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/suricata b/lfs/suricata index c7f189bf4..700556dd2 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 5.0.7 +VER = 5.0.8 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f6ff77e4dcf8035853209ceeba9b530c +$(DL_FILE)_MD5 = d48387c2e0b5e502852b077369d947c5 install : $(TARGET) -- 2.18.0

2 4

[PATCH] pakfire.cgi: Bring back old logic for log displaying
by Stefan Schantl 20 Nov '21

20 Nov '21

Trying to get rid of the system backpipe check if a pakfire is running does not work very well. It simply makes the code more complex and only introduced some new problems. This commit switches back to the old logic which worked well in the past. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/pakfire.cgi | 57 +++++++--------------------------------- 1 file changed, 10 insertions(+), 47 deletions(-) diff --git a/html/cgi-bin/pakfire.cgi b/html/cgi-bin/pakfire.cgi index f2381f031..4d6eee284 100644 --- a/html/cgi-bin/pakfire.cgi +++ b/html/cgi-bin/pakfire.cgi @@ -44,8 +44,6 @@ $cgiparams{'VALID'} = ''; $cgiparams{'INSPAKS'} = ''; $cgiparams{'DELPAKS'} = ''; -my $page_lock; - sub refreshpage{&Header::openbox( 'Waiting', 1, "<meta http-equiv='refresh' content='1;'>" );print "<center><img src='/images/clock.gif' alt='' /><br/><font color='red'>$Lang::tr{'pagerefresh'}</font></center>";&Header::closebox();} &Header::getcgihash(\%cgiparams); @@ -59,9 +57,8 @@ sub refreshpage{&Header::openbox( 'Waiting', 1, "<meta http-equiv='refresh' cont if (($cgiparams{'ACTION'} eq 'install') && (! -e $Pakfire::lockfile)) { my @pkgs = split(/\|/, $cgiparams{'INSPAKS'}); if ("$cgiparams{'FORCE'}" eq "on") { - # Lock the page. - $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "install", "--non-interactive", "--no-colors", @pkgs); + sleep(1); } else { &Header::openbox("100%", "center", $Lang::tr{'request'}); my @output = &General::system_output("/usr/local/bin/pakfire", "resolvedeps", "--no-colors", @pkgs); @@ -98,9 +95,8 @@ END } elsif (($cgiparams{'ACTION'} eq 'remove') && (! -e $Pakfire::lockfile)) { my @pkgs = split(/\|/, $cgiparams{'DELPAKS'}); if ("$cgiparams{'FORCE'}" eq "on") { - # Lock the page. - $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "remove", "--non-interactive", "--no-colors", @pkgs); + sleep(1); } else { &Header::openbox("100%", "center", $Lang::tr{'request'}); my @output = &General::system_output("/usr/local/bin/pakfire", "resolvedeps", "--no-colors", @pkgs); @@ -136,13 +132,11 @@ END } } elsif (($cgiparams{'ACTION'} eq 'update') && (! -e $Pakfire::lockfile)) { - # Set variable to lock the page. - $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "update", "--force", "--no-colors"); + sleep(1); } elsif (($cgiparams{'ACTION'} eq 'upgrade') && (!-e $Pakfire::lockfile)) { - # Lock the page. - $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "upgrade", "-y", "--no-colors"); + sleep(1); } elsif ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}") { $pakfiresettings{"TREE"} = $cgiparams{"TREE"}; @@ -156,6 +150,7 @@ END # Update lists &General::system_background("/usr/local/bin/pakfire", "update", "--force", "--no-colors"); + sleep(1); } } @@ -177,44 +172,12 @@ if ($errormessage) { &Header::closebox(); } -# Check if a page lock is required. -if ($page_lock) { - &Header::openbox('Waiting', 1, ,); - print <<END; - <table> - <tr> - <td> - <img src='/images/indicator.gif' alt='$Lang::tr{'active'}' title='$Lang::tr{'active'}'> - </td> - - <td> - $Lang::tr{'pakfire working'} - </td> - </tr> - </table> -END - &Header::closebox(); - - # Infinite loop to lock the page until pakfire lockfile is present. - while($page_lock) { - unless (-e $Pakfire::lockfile) { - sleep(1); - } else { - # Release page lock. - undef($page_lock); - - # Break loop. - last; - } - } - - # Perform page reload. - print "<meta http-equiv='refresh' content='1;'>\n"; - exit; -} +# Check if pakfire is already running. +# +# The system backpipe command is safe, because no user input is computed. +my $pid = `pidof pakfire`; -# Check if pakfire is already running. In this case a lockfile is present. -if (-e $Pakfire::lockfile) { +if ($pid) { &Header::openbox( 'Waiting', 1, "<meta http-equiv='refresh' content='10;'>" ); print <<END; <table> -- 2.30.2

7 12

DHCP and Unbound Integration
by paul kairis 20 Nov '21

20 Nov '21

I had an email exchange with Adolf Belka and he suggested I join the DEV list and post my issues there. The way I understand it is that the DHCP table should match the Unbound table *at any given time*. Example I install linux on ssd and move the ssd to a laptop and deploy on the network. I use a fast system i7-7700K to install linux, do post-install configurations, shutdown, move the ssd to a laptop (e6500), and boot. DHCP server gets confused since now I have two different mac, two different ip, and the same host. 10.0.0.33 f4:6d:04:76:60:f8 mx 28/10/2021 06:04:27 <==== i7-7700K mac 10.0.0.50 78:24:af:3e:18:53 mx 28/10/2021 06:10:31 <==== laptop e6500 mac Unbound is confused, it tries to resolve mx to 10.0.0.50 but a reverse lookup shows 10.0.0.33 Even if I run my 3-line script (rst) to restart DHCP and unbound, the cache is not cleared. I have to wait 15 min which is half of the default lease time (30) for .33 to expire in DHCP and then run my script again so that unbound properly (and reverse lookup) resolves the laptop to .50 Is there a way that when a system shuts down, DHCP *immediately* removes that entry from its list and, via the bridge code, unbound is notified as well to forget that (host,ip) pair, *immediately*. I reduced Default Lease time to 5 min, Max Lease time to 10 so I have to wait 2.5 min but then /var/log/messages keeps growing. Example Clients do not implement DHCPRELEASE. Per the RFC, this is optional. I shutdown my laptop (e6500) but when I look at ipfire > Network > DHCP server, the entry is still there for a few min till the lease expires. Example I come to a party, the DHCP server is at the door. Hi, I am e6500 and would like to enter. Sure, DHCP server says, your ip is 10.0.0.33, then the bridge updates Unbound with pair (e6500,10.0.0.33) I walk around the party with a tag (e6500,10.0.0.33) I mingle with people, ping, ssh by name or ip ... all good. I leave the party but DHCP has no knowledge I left till the lease expires. So for the next 5-10 min, I'm still shown in the party even though I left. What I'd like is a complete sync between the DHCP table and the Unbound table. pfSense does that but it is BSD which I don't know much about. Regards, Pavlos Kairis REF: https://community.ipfire.org/t/dhcp-hosts-not-reliably-propagated-to-dns/34… Appendix First script is dns_verify (adjusted for my network 10.0.0.*) This script uses dig to do a lookup for an ip, get the name, then do a reverse lookup using the name to make sure they are the same ip. #### dns_verify see https://calomel.org/dns_verify.html # i=0 ## counter NETS="10.0.0" ## network IPS=$(seq 1 60) ## for Linux DNS="@10.0.0.1" ## DNS to use # echo echo -e "\tip \t-> hostname \t\t-> ip" echo '-----------------------------------------------------------' for NET in $NETS; do for n in $IPS; do A=${NET}.${n} HOST=$(dig $DNS -x $A +short) if test -n "$HOST"; then ADDR=$(dig $DNS $HOST +short) if test "$A" = "$ADDR"; then echo -e "ok\t$A \t-> $HOST \t\t-> $ADDR" ((i++)) elif test -n "$ADDR"; then echo -e "fail\t$A \t-> $HOST \t\t-> $ADDR" else echo -e "fail\t$A \t-> $HOST \t\t-> [unassigned]" fi fi done done echo "" echo $i "hosts DONE." Second script is watchDNS. I’m running watchDNS and every 5 sec, it clears the screen and shows me what Unbound has in its table. I turn on the e6500 laptop. Unbound does not show it since the bridge fails to register that change. But if I look at the ipfire > Network > DHCP server, I see that e6500 got a 10.0.0.33 I run my 3-line script to restart DHCP and unbound, e6500 shows up! Wait a few min, then shutdown the laptop. DHCP will keep the lease until lease time expires (could be in 5, 10, 15 min) even though the laptop is gone from the network. If you run watchDNS, you see the laptop still has 10.0.0.33 and unbound is not notified to remove that entry. while true; do clear echo '+--------------------------------------------------------+' echo '| DNS info every 5 seconds |' echo '+--------------------------------------------------------+' . dns_verify sleep 5 done Third script is rst. It restarts DHCP and Unbound (and the bridge) /etc/init.d/dhcp stop /etc/init.d/dhcp start /etc/init.d/unbound restart END OF DOCUMENT

2 2

[PATCH 1/3] mountkernfs: Mount /sys/firmware/efi/efivars on EFI systems
by Michael Tremer 19 Nov '21

19 Nov '21

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/initscripts/system/mountkernfs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/mountkernfs index 264da24c4..1f1426077 100644 --- a/src/initscripts/system/mountkernfs +++ b/src/initscripts/system/mountkernfs @@ -39,6 +39,11 @@ case "${1}" in mount -t cgroup2 none /sys/fs/cgroup || failed=1 fi + if ! mountpoint /sys/firmware/efi/efivars &>/dev/null && [ -d "/sys/firmware/efi" ]; then + boot_mesg -n " /sys/firmware/efi/efivars" ${NORMAL} + mount -t efivarfs efivarfs /sys/firmware/efi/efivars || failed=1 + fi + # create folder for dhcpcd changeroot mkdir -p /run/dhcpcd/chroot chown dhcpcd:dhcpcd /run/dhcpcd/chroot -- 2.20.1

2 8

[PATCH] QoS: Do not try to unload any kernel modules
by Michael Tremer 19 Nov '21

19 Nov '21

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/qos/makeqosscripts.pl | 2 -- 1 file changed, 2 deletions(-) diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index 0694bb78c..3234ab366 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -510,8 +510,6 @@ print <<END iptables -t mangle --flush QOS-INC >/dev/null 2>&1 iptables -t mangle --delete-chain QOS-INC >/dev/null 2>&1 - rmmod sch_htb >/dev/null 2>&1 - for i in \$(ls \$RRDLOG/class_*.rrd); do rrdtool update \$i \$(date +%s): done -- 2.20.1

2 3

Core Update 161 (testing) report
by Peter Müller 18 Nov '21

18 Nov '21

Hello *, Core Update 161 (testing; no release announcement or changelog has been published, yet) is running here for about 12 hours by now without any major issues known so far. During the upgrade, I noticed the Pakfire CGI still does not display log messages as it used to do, but at least there is now a spinning loading icon displaying the message that an operation is currently in progress. From a UX perspective, this is okay I guess. The reconnection necessary for upgrading pppd went smooth, albeit Pakfire could not download add-on upgrades afterwards since the VPN did not came back in time, so I had to do this manually. To my surprise, some IPsec N2N connections did not reconnect automatically, even after rebooting the testing machine. After manually clicking on one of the "restart" buttons on the IPsec CGI, they came back instantly, and have been stable ever since. This affected N2N connections not being in the "on-demand" mode only. While it is not really a show-stopper if someone is sitting in front of his/her/its IPFire machine, remote upgrades might be tricky. Apart from that, this update looks quite good to me. The IPS changes are really noticeable, and bring a throughput I think I never experienced with IPFire and the IPS turned on. :-) This is certainly worth mentioning, as it finally makes the IPS suitable for everyone, hence massively increasing security without worrying too much of performance impacts. (For the sake of completeness: Unfortunately I did not yet have time do conduct a penetration test against this. Personally, I can imagine the IPS changes permitting some attacks after Suricata decided it cannot analyse a connection further. Switching protocols might be an issue, starting with TLS, while using something completely different afterwards. While I do not really consider this to be a critical attack surface, I wanted to look deeper into this as soon as I have some spare time to do so.) Tested IPFire functionalities in detail: - PPPoE dial-up via a DSL connection - IPsec (N2N connections only) - Squid (authentication enabled, using an upstream proxy) - OpenVPN (RW connections only) - IPS/Suricata (with Emerging Threats community ruleset enabled) - Guardian - Quality of Service - DNS (using DNS over TLS and strict QNAME minimisation) - Dynamic DNS - Tor (relay mode) I am looking forward to the release of Core Update 161. Thanks, and best regards, Peter Müller

5 14

[PATCH] openvpn: Update to version 2.5.4
by Adolf Belka 17 Nov '21

17 Nov '21

- Update from 2.5.0 to 2.5.4 - Update rootfile - Tested new version in vm testbed. Openvpn server successfully started. Client connections working with 2.5.0 also successfully worked with 2.5.4 - Changelog Overview of changes in 2.5.4 Bugfixes - fix prompting for password on windows console if stderr redirection is in use - this breaks 2.5.x on Win11/ARM, and might also break on Win11/adm64 when released. - fix setting MAC address on TAP adapters (--lladdr) to use sitnl (was overlooked, and still used "ifconfig" calls) - various improvements for man page building (rst2man/rst2html etc) - minor bugfix with IN6_IS_ADDR_UNSPECIFIED() use (breaks build on at least one platform strictly checking this) - fix minor memory leak under certain conditions in add_route() and add_route_ipv6() User-visible Changes - documentation improvements - copyright updates where needed - better error reporting when win32 console access fails New features - also build man page on Windows builds Overview of changes in 2.5.3 Bugfixes - CVE-2121-3606 see https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements OpenVPN windows builds could possibly load OpenSSL Config files from world writeable locations, thus posing a security risk to OpenVPN. As a fix, disable OpenSSL config loading completely on Windows. - disable connect-retry backoff for p2p (--secret) instances (Trac #1010, #1384) - fix build with mbedtls w/o SSL renegotiation support - Fix SIGSEGV (NULL deref) receiving push "echo" (Trac #1409) - MSI installers: properly schedule reboot in the end of installation - fix small memory leak in free_key_ctx for auth_token User-visible Changes - update copyright messages in files and --version output New features - add --auth-token-user option (for --auth-token deployments without --auth-user-pass in client config) - improve MSVC building for Windows - official MSI installers will now contain arm64 drivers and binaries (x86, amd64, arm64) Overview of changes in 2.5.2 Bugfixes - CVE-2020-15078 see https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements This bug allows - under very specific circumstances - to trick a server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. In combination with "--auth-gen-token" or an user-specific token auth solution it can be possible to get access to a VPN with an otherwise-invalid account. - restore pushed "ping" settings correctly on a SIGUSR1 restart - avoid generating unecessary mbed debug messages - this is actually a workaround for an mbedTLS 2.25 bug when using Curve25519 and Curve448 ED curves - mbedTLS crashes on preparing debug infos that we do not actually need unless running with "--verb 8" - do not print inlined (<dh>...</dh>) Diffie Hellman parameters to log file - fix Linux/SITNL default route lookup in case of multiple routing tables with more than one default route present (always use "main table" for now) - Fix CRL file handling in combination with chroot User-visible Changes - OpenVPN will now refuse to start if CRL file is not present at startup time. At "reload time" absense of the CRL file is still OK (and the in memory copy is used) but at startup it is now considered an error. New features - printing of the TLS ciphers negotiated has been extended, especially displaying TLS 1.3 and EC certificates more correctly. Overview of changes in 2.5.1 New features - "echo msg" support, to enable the server to pushed messages that are then displayed by the client-side GUI. See doc/gui-notes.txt and doc/management-notes.txt. Supported by the Windows GUI shipped in 2.5.1, not yet supported by Tunnelblick and the Android GUI. User-visible Changes - make OPENVPN_PLUGIN_ENABLE_PF plugin failures FATAL - if a plugin offers to set the "openvpn packet filter", and returns a failure when requested to, OpenVPN 2.5.0 would crash trying to clean up not-yet-initialized structure members. Since PF is going away in 2.6.0, this is just turning the crash into a well-defined program abort, and no further effort has been spent in rewriting the PF plugin error handling (see trac #1377). Documentation - rework sample-plugins/defer/simple.c - this is an extensive rewrite of the plugin to bring code quality to acceptable standards and add documentation on the various plugin API aspects. Since it's just example code, filed under "Documentation", not under "Bugfix". - various man page improvements. - clarify ``--block-ipv6`` intent and direction Bugfixes - fix installation of openvpn.8 manpage on systems without docutils. - Windows: fix DNS search list setup for domains with "-" chars. - Fix tls-auth mismatch OCC message when tls-cryptv2 is used. - Windows: Skip DHCP renew with Wintun adapter (Wintun does not support DHCP, so this was just causing an - harmless - error and needless delay). - Windows: Remove 1 second delay before running netsh - speeds up interface init for wintun setups not using the interactive service. - Windows: Fix too early argv freeing when registering DNS - this would cause a client side crash on Windows if ``register-dns`` is used, and the interactive service is not used. - Android: Zero initialise msghdr prior to calling sendmesg. - Fix line number reporting on config file errors after <inline> segments (see Trac #1325). - Fix port-share option with TLS-Crypt v2. - tls-crypt-v2: also preload tls-crypt-v2 keys (if --persist-key), otherwise dropping privs on the server would fail. - tls-crypt-v2: fix server memory leak (about 600 bytes per connecting client with tls-crypt-v2) - rework handling of server-pushed ``--auth-token`` in combination with ``--auth-nocache`` on reconnection / TLS renegotiation events. This used to "forget" to update new incoming token after a reconnection event (leading to failure to reauth some time later) and now works in all tested cases. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/openvpn | 5 +++++ lfs/openvpn | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index 41ccc885e..6c3457d01 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -18,7 +18,12 @@ usr/sbin/openvpn #usr/share/doc/openvpn/README.auth-pam #usr/share/doc/openvpn/README.down-root #usr/share/doc/openvpn/README.mbedtls +#usr/share/doc/openvpn/gui-notes.txt #usr/share/doc/openvpn/management-notes.txt +#usr/share/doc/openvpn/openvpn-examples.5.html +#usr/share/doc/openvpn/openvpn.8.html +#usr/share/man/man5/openvpn-examples.5 +#usr/share/man/man8/openvpn.8 var/ipfire/ovpn/ca var/ipfire/ovpn/caconfig var/ipfire/ovpn/ccd diff --git a/lfs/openvpn b/lfs/openvpn index 81ccc52bf..82e819bfe 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,7 +24,7 @@ include Config -VER = 2.5.0 +VER = 2.5.4 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = ba426e2217833b522810d6c06f7cc8f7 +$(DL_FILE)_MD5 = 336be3b2388cdc65dd8c81f22b1c2836 install : $(TARGET) -- 2.33.1

3 2

[PATCH] ovpnmain.cgi: Bug 12574 - OpenVPN Internal server error when returning after generating root/host certificates
by Adolf Belka 17 Nov '21

17 Nov '21

- Option "--secret" was deprecated in OpenVPN 2.4 and removed in OpenVPN 2.5 It was replaced by "secret". If "--secret" is used with genkey then a user warning is printed and this is what gives the Internal server error. - Patch was defined by Erik Kapfer but currently he does not have a build environment so I have submitted the patch on his behalf. - Patch tested on a vm testbed running Core Update 160. Confirmed that without patch the error still occurs and with patch everything runs smoothly. Fixes: Bug #12574 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by : Erik Kapfer <ummeegge(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index f99bfdef7..7e274b36a 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -1209,7 +1209,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg if ($cgiparams{'TLSAUTH'} eq 'on') { if ( ! -e "${General::swroot}/ovpn/certs/ta.key") { # This system call is safe, because all arguements are passed as an array. - system("/usr/sbin/openvpn", "--genkey", "--secret", "${General::swroot}/ovpn/certs/ta.key"); + system("/usr/sbin/openvpn", "--genkey", "secret", "${General::swroot}/ovpn/certs/ta.key"); if ($?) { $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; goto SETTINGS_ERROR; @@ -2012,7 +2012,7 @@ END } # Create ta.key for tls-auth # This system call is safe, because all arguments are passed as an array. - system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key"); + system('/usr/sbin/openvpn', '--genkey', 'secret', "${General::swroot}/ovpn/certs/ta.key"); if ($?) { $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; &cleanssldatabase(); -- 2.33.1

2 1

[PATCH 1/2] bind: Update to version 9.16.22
by Adolf Belka 11 Nov '21

11 Nov '21

- Update from 9.11.32 to 9.16.22 - 9.11 is an ESV (Extended Support Version) that will go EOL in December 2021 9.16 is the replacement ESV whose EOL is not yet defined but will be at least 4 years so should be supported until at least March 2024 as the 9.16 branch was started in 2020 - Update rootfile - libuv is now required both to build the bind libraries and for the running of the utilities. - Changelog is difficult to define here as this is a change of branch from 9.11 to 9.16 both of which have been running in parallel. However all the changes from the start of 9.16.0 can be found in the CHANGES file in the source tarball. - nslookup, host and dig utilities tested out by installing this on a vm testbed. All these utilities worked as the previous version nsupdate was not able to be tested other than confirming that running nsupdate opened an interactive session. This utility would be good to be tested by someone familiar with how to run it. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/bind | 196 ++++++++++------------------------- lfs/bind | 23 ++-- 2 files changed, 69 insertions(+), 150 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 6fb228a5a..a89af5bcb 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -8,7 +8,6 @@ usr/bin/nsupdate #usr/include/bind9/getaddresses.h #usr/include/bind9/version.h #usr/include/dns -#usr/include/dns/acache.h #usr/include/dns/acl.h #usr/include/dns/adb.h #usr/include/dns/badcache.h @@ -29,12 +28,14 @@ usr/bin/nsupdate #usr/include/dns/dlz.h #usr/include/dns/dlz_dlopen.h #usr/include/dns/dns64.h +#usr/include/dns/dnsrps.h #usr/include/dns/dnssec.h #usr/include/dns/dnstap.h #usr/include/dns/ds.h #usr/include/dns/dsdigest.h #usr/include/dns/dyndb.h #usr/include/dns/ecdb.h +#usr/include/dns/ecs.h #usr/include/dns/edns.h #usr/include/dns/enumclass.h #usr/include/dns/enumtype.h @@ -45,11 +46,15 @@ usr/bin/nsupdate #usr/include/dns/ipkeylist.h #usr/include/dns/iptable.h #usr/include/dns/journal.h +#usr/include/dns/kasp.h #usr/include/dns/keydata.h #usr/include/dns/keyflags.h +#usr/include/dns/keymgr.h #usr/include/dns/keytable.h #usr/include/dns/keyvalues.h #usr/include/dns/lib.h +#usr/include/dns/librpz.h +#usr/include/dns/lmdb.h #usr/include/dns/log.h #usr/include/dns/lookup.h #usr/include/dns/master.h @@ -104,22 +109,32 @@ usr/bin/nsupdate #usr/include/dns/xfrin.h #usr/include/dns/zone.h #usr/include/dns/zonekey.h +#usr/include/dns/zoneverify.h #usr/include/dns/zt.h #usr/include/dst #usr/include/dst/dst.h #usr/include/dst/gssapi.h -#usr/include/dst/lib.h #usr/include/dst/result.h +#usr/include/irs +#usr/include/irs/context.h +#usr/include/irs/dnsconf.h +#usr/include/irs/netdb.h +#usr/include/irs/platform.h +#usr/include/irs/resconf.h +#usr/include/irs/types.h +#usr/include/irs/version.h #usr/include/isc #usr/include/isc/aes.h +#usr/include/isc/align.h #usr/include/isc/app.h #usr/include/isc/assertions.h +#usr/include/isc/astack.h #usr/include/isc/atomic.h #usr/include/isc/backtrace.h +#usr/include/isc/barrier.h #usr/include/isc/base32.h #usr/include/isc/base64.h #usr/include/isc/bind9.h -#usr/include/isc/boolean.h #usr/include/isc/buffer.h #usr/include/isc/bufferlist.h #usr/include/isc/cmocka.h @@ -130,7 +145,6 @@ usr/bin/nsupdate #usr/include/isc/deprecated.h #usr/include/isc/dir.h #usr/include/isc/endian.h -#usr/include/isc/entropy.h #usr/include/isc/errno.h #usr/include/isc/error.h #usr/include/isc/event.h @@ -138,18 +152,16 @@ usr/bin/nsupdate #usr/include/isc/file.h #usr/include/isc/formatcheck.h #usr/include/isc/fsaccess.h +#usr/include/isc/fuzz.h #usr/include/isc/hash.h #usr/include/isc/heap.h #usr/include/isc/hex.h -#usr/include/isc/hmacmd5.h -#usr/include/isc/hmacsha.h +#usr/include/isc/hmac.h +#usr/include/isc/hp.h #usr/include/isc/ht.h #usr/include/isc/httpd.h -#usr/include/isc/int.h #usr/include/isc/interfaceiter.h #usr/include/isc/iterated_hash.h -#usr/include/isc/json.h -#usr/include/isc/keyboard.h #usr/include/isc/lang.h #usr/include/isc/lex.h #usr/include/isc/lfsr.h @@ -158,20 +170,21 @@ usr/bin/nsupdate #usr/include/isc/list.h #usr/include/isc/log.h #usr/include/isc/magic.h -#usr/include/isc/md5.h +#usr/include/isc/managers.h +#usr/include/isc/md.h #usr/include/isc/mem.h #usr/include/isc/meminfo.h -#usr/include/isc/msgcat.h -#usr/include/isc/msgs.h #usr/include/isc/mutex.h +#usr/include/isc/mutexatomic.h #usr/include/isc/mutexblock.h #usr/include/isc/net.h #usr/include/isc/netaddr.h #usr/include/isc/netdb.h +#usr/include/isc/netmgr.h #usr/include/isc/netscope.h +#usr/include/isc/nonce.h #usr/include/isc/offset.h #usr/include/isc/once.h -#usr/include/isc/ondestroy.h #usr/include/isc/os.h #usr/include/isc/parseint.h #usr/include/isc/platform.h @@ -192,8 +205,6 @@ usr/bin/nsupdate #usr/include/isc/rwlock.h #usr/include/isc/safe.h #usr/include/isc/serial.h -#usr/include/isc/sha1.h -#usr/include/isc/sha2.h #usr/include/isc/siphash.h #usr/include/isc/sockaddr.h #usr/include/isc/socket.h @@ -201,9 +212,8 @@ usr/bin/nsupdate #usr/include/isc/stats.h #usr/include/isc/stdatomic.h #usr/include/isc/stdio.h -#usr/include/isc/stdlib.h #usr/include/isc/stdtime.h -#usr/include/isc/strerror.h +#usr/include/isc/strerr.h #usr/include/isc/string.h #usr/include/isc/symtab.h #usr/include/isc/syslog.h @@ -214,17 +224,16 @@ usr/bin/nsupdate #usr/include/isc/timer.h #usr/include/isc/tm.h #usr/include/isc/types.h +#usr/include/isc/url.h #usr/include/isc/utf8.h #usr/include/isc/util.h #usr/include/isc/version.h -#usr/include/isc/xml.h #usr/include/isccc #usr/include/isccc/alist.h #usr/include/isccc/base64.h #usr/include/isccc/cc.h #usr/include/isccc/ccmsg.h #usr/include/isccc/events.h -#usr/include/isccc/lib.h #usr/include/isccc/result.h #usr/include/isccc/sexpr.h #usr/include/isccc/symtab.h @@ -237,25 +246,26 @@ usr/bin/nsupdate #usr/include/isccfg/cfg.h #usr/include/isccfg/dnsconf.h #usr/include/isccfg/grammar.h +#usr/include/isccfg/kaspconf.h #usr/include/isccfg/log.h #usr/include/isccfg/namedconf.h #usr/include/isccfg/version.h -#usr/include/lwres -#usr/include/lwres/context.h -#usr/include/lwres/int.h -#usr/include/lwres/ipv6.h -#usr/include/lwres/lang.h -#usr/include/lwres/list.h -#usr/include/lwres/lwbuffer.h -#usr/include/lwres/lwpacket.h -#usr/include/lwres/lwres.h -#usr/include/lwres/net.h -#usr/include/lwres/netdb.h -#usr/include/lwres/platform.h -#usr/include/lwres/result.h -#usr/include/lwres/stdlib.h -#usr/include/lwres/string.h -#usr/include/lwres/version.h +#usr/include/ns +#usr/include/ns/client.h +#usr/include/ns/hooks.h +#usr/include/ns/interfacemgr.h +#usr/include/ns/lib.h +#usr/include/ns/listenlist.h +#usr/include/ns/log.h +#usr/include/ns/notify.h +#usr/include/ns/query.h +#usr/include/ns/server.h +#usr/include/ns/sortlist.h +#usr/include/ns/stats.h +#usr/include/ns/types.h +#usr/include/ns/update.h +#usr/include/ns/version.h +#usr/include/ns/xfrout.h #usr/include/pk11 #usr/include/pk11/constants.h #usr/include/pk11/internal.h @@ -263,119 +273,25 @@ usr/bin/nsupdate #usr/include/pk11/result.h #usr/include/pk11/site.h #usr/include/pkcs11 -#usr/include/pkcs11/cryptoki.h -#usr/include/pkcs11/eddsa.h #usr/include/pkcs11/pkcs11.h +usr/lib/libbind9-9.16.22.so #usr/lib/libbind9.la #usr/lib/libbind9.so -usr/lib/libbind9.so.161 -usr/lib/libbind9.so.161.0.4 +usr/lib/libdns-9.16.22.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libdns.so.1115 -usr/lib/libdns.so.1115.0.0 +usr/lib/libirs-9.16.22.so +#usr/lib/libirs.la +#usr/lib/libirs.so +usr/lib/libisc-9.16.22.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisc.so.1107 -usr/lib/libisc.so.1107.0.5 +usr/lib/libisccc-9.16.22.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccc.so.161 -usr/lib/libisccc.so.161.0.1 +usr/lib/libisccfg-9.16.22.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libisccfg.so.163 -usr/lib/libisccfg.so.163.0.8 -#usr/lib/liblwres.la -#usr/lib/liblwres.so -usr/lib/liblwres.so.161 -usr/lib/liblwres.so.161.0.4 -#usr/share/man/man1/dig.1 -#usr/share/man/man1/host.1 -#usr/share/man/man1/nslookup.1 -#usr/share/man/man1/nsupdate.1 -#usr/share/man/man3/lwres.3 -#usr/share/man/man3/lwres_addr_parse.3 -#usr/share/man/man3/lwres_buffer.3 -#usr/share/man/man3/lwres_buffer_add.3 -#usr/share/man/man3/lwres_buffer_back.3 -#usr/share/man/man3/lwres_buffer_clear.3 -#usr/share/man/man3/lwres_buffer_first.3 -#usr/share/man/man3/lwres_buffer_forward.3 -#usr/share/man/man3/lwres_buffer_getmem.3 -#usr/share/man/man3/lwres_buffer_getuint16.3 -#usr/share/man/man3/lwres_buffer_getuint32.3 -#usr/share/man/man3/lwres_buffer_getuint8.3 -#usr/share/man/man3/lwres_buffer_init.3 -#usr/share/man/man3/lwres_buffer_invalidate.3 -#usr/share/man/man3/lwres_buffer_putmem.3 -#usr/share/man/man3/lwres_buffer_putuint16.3 -#usr/share/man/man3/lwres_buffer_putuint32.3 -#usr/share/man/man3/lwres_buffer_putuint8.3 -#usr/share/man/man3/lwres_buffer_subtract.3 -#usr/share/man/man3/lwres_conf_clear.3 -#usr/share/man/man3/lwres_conf_get.3 -#usr/share/man/man3/lwres_conf_init.3 -#usr/share/man/man3/lwres_conf_parse.3 -#usr/share/man/man3/lwres_conf_print.3 -#usr/share/man/man3/lwres_config.3 -#usr/share/man/man3/lwres_context.3 -#usr/share/man/man3/lwres_context_allocmem.3 -#usr/share/man/man3/lwres_context_create.3 -#usr/share/man/man3/lwres_context_destroy.3 -#usr/share/man/man3/lwres_context_freemem.3 -#usr/share/man/man3/lwres_context_initserial.3 -#usr/share/man/man3/lwres_context_nextserial.3 -#usr/share/man/man3/lwres_context_sendrecv.3 -#usr/share/man/man3/lwres_endhostent.3 -#usr/share/man/man3/lwres_endhostent_r.3 -#usr/share/man/man3/lwres_freeaddrinfo.3 -#usr/share/man/man3/lwres_freehostent.3 -#usr/share/man/man3/lwres_gabn.3 -#usr/share/man/man3/lwres_gabnrequest_free.3 -#usr/share/man/man3/lwres_gabnrequest_parse.3 -#usr/share/man/man3/lwres_gabnrequest_render.3 -#usr/share/man/man3/lwres_gabnresponse_free.3 -#usr/share/man/man3/lwres_gabnresponse_parse.3 -#usr/share/man/man3/lwres_gabnresponse_render.3 -#usr/share/man/man3/lwres_gai_strerror.3 -#usr/share/man/man3/lwres_getaddrinfo.3 -#usr/share/man/man3/lwres_getaddrsbyname.3 -#usr/share/man/man3/lwres_gethostbyaddr.3 -#usr/share/man/man3/lwres_gethostbyaddr_r.3 -#usr/share/man/man3/lwres_gethostbyname.3 -#usr/share/man/man3/lwres_gethostbyname2.3 -#usr/share/man/man3/lwres_gethostbyname_r.3 -#usr/share/man/man3/lwres_gethostent.3 -#usr/share/man/man3/lwres_gethostent_r.3 -#usr/share/man/man3/lwres_getipnode.3 -#usr/share/man/man3/lwres_getipnodebyaddr.3 -#usr/share/man/man3/lwres_getipnodebyname.3 -#usr/share/man/man3/lwres_getnamebyaddr.3 -#usr/share/man/man3/lwres_getnameinfo.3 -#usr/share/man/man3/lwres_getrrsetbyname.3 -#usr/share/man/man3/lwres_gnba.3 -#usr/share/man/man3/lwres_gnbarequest_free.3 -#usr/share/man/man3/lwres_gnbarequest_parse.3 -#usr/share/man/man3/lwres_gnbarequest_render.3 -#usr/share/man/man3/lwres_gnbaresponse_free.3 -#usr/share/man/man3/lwres_gnbaresponse_parse.3 -#usr/share/man/man3/lwres_gnbaresponse_render.3 -#usr/share/man/man3/lwres_herror.3 -#usr/share/man/man3/lwres_hstrerror.3 -#usr/share/man/man3/lwres_inetntop.3 -#usr/share/man/man3/lwres_lwpacket_parseheader.3 -#usr/share/man/man3/lwres_lwpacket_renderheader.3 -#usr/share/man/man3/lwres_net_ntop.3 -#usr/share/man/man3/lwres_noop.3 -#usr/share/man/man3/lwres_nooprequest_free.3 -#usr/share/man/man3/lwres_nooprequest_parse.3 -#usr/share/man/man3/lwres_nooprequest_render.3 -#usr/share/man/man3/lwres_noopresponse_free.3 -#usr/share/man/man3/lwres_noopresponse_parse.3 -#usr/share/man/man3/lwres_noopresponse_render.3 -#usr/share/man/man3/lwres_packet.3 -#usr/share/man/man3/lwres_resutil.3 -#usr/share/man/man3/lwres_sethostent.3 -#usr/share/man/man3/lwres_sethostent_r.3 -#usr/share/man/man3/lwres_string_parse.3 +usr/lib/libns-9.16.22.so +#usr/lib/libns.la +#usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index 0545066b7..8544f0f1f 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,10 +25,10 @@ include Config -VER = 9.11.32 +VER = 9.16.22 THISAPP = bind-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.xz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0d029dd06ca60c6739c3189c999ef757 +$(DL_FILE)_MD5 = 6a45478b33c04c830d4263635d8cd137 install : $(TARGET) @@ -72,7 +72,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) $(UPDATE_AUTOMAKE) cd $(DIR_APP) && STD_CDEFINES="$(CPPFLAGS)" \ ./configure \ @@ -80,25 +80,28 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --enable-threads \ --with-libtool \ --without-python \ + --disable-linux-caps \ --disable-static - # Build everything + # Build required libraries cd $(DIR_APP) && make -C lib/isc $(MAKETUNING) - cd $(DIR_APP) && make -C lib/dns $(MAKETUNING) cd $(DIR_APP) && make -C lib/isccc $(MAKETUNING) + cd $(DIR_APP) && make -C lib/dns $(MAKETUNING) + cd $(DIR_APP) && make -C lib/ns $(MAKETUNING) cd $(DIR_APP) && make -C lib/isccfg $(MAKETUNING) cd $(DIR_APP) && make -C lib/bind9 $(MAKETUNING) - cd $(DIR_APP) && make -C lib/lwres $(MAKETUNING) + cd $(DIR_APP) && make -C lib/irs $(MAKETUNING) cd $(DIR_APP) && make -C bin/dig $(MAKETUNING) cd $(DIR_APP) && make -C bin/nsupdate $(MAKETUNING) - # Install everything + # Install utility programs cd $(DIR_APP) && make -C lib/isc install - cd $(DIR_APP) && make -C lib/dns install cd $(DIR_APP) && make -C lib/isccc install + cd $(DIR_APP) && make -C lib/dns install + cd $(DIR_APP) && make -C lib/ns install cd $(DIR_APP) && make -C lib/isccfg install cd $(DIR_APP) && make -C lib/bind9 install - cd $(DIR_APP) && make -C lib/lwres install + cd $(DIR_APP) && make -C lib/irs install cd $(DIR_APP) && make -C bin/dig install cd $(DIR_APP) && make -C bin/nsupdate install -- 2.33.1

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2021