Development November 2021

development@lists.ipfire.org

16 participants
49 discussions

File's list of web interface
by Sébastien GISLAIN 10 Nov '21

10 Nov '21

Hi, Can I found file's list of web GUI and description for each files? This files are in /srv/web/ipfire/ … I have tried to report a part of files. Do you have this kind of list and dependencies between files? Regards Sébastien GISLAIN

2 1

[PATCH] pakfire.cgi: Implement logic to lock the page until pakfire has been fully launched.
by Stefan Schantl 10 Nov '21

10 Nov '21

When performing any action which requires pakfire, the page gets locked with an message informing the user that pakfire is working. The page will be reloaded when pakfire has been launched and is doing the requested operation - showing the well known log output. This also happens when pakfire has been launched via any kind of terminal or SSH session and the CGI gets accessed. Internally before pakfire gets started a variable called page_lock will be set to lock the page. An while loop will keep the page locked until pakfire is launched fully and has written it's lock_file. This approach will prevent us from any kind of required time intervall or race conditions. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/pakfire.cgi | 49 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 47 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/pakfire.cgi b/html/cgi-bin/pakfire.cgi index 0cf522ba1..f2381f031 100644 --- a/html/cgi-bin/pakfire.cgi +++ b/html/cgi-bin/pakfire.cgi @@ -44,6 +44,8 @@ $cgiparams{'VALID'} = ''; $cgiparams{'INSPAKS'} = ''; $cgiparams{'DELPAKS'} = ''; +my $page_lock; + sub refreshpage{&Header::openbox( 'Waiting', 1, "<meta http-equiv='refresh' content='1;'>" );print "<center><img src='/images/clock.gif' alt='' /><br/><font color='red'>$Lang::tr{'pagerefresh'}</font></center>";&Header::closebox();} &Header::getcgihash(\%cgiparams); @@ -57,8 +59,9 @@ sub refreshpage{&Header::openbox( 'Waiting', 1, "<meta http-equiv='refresh' cont if (($cgiparams{'ACTION'} eq 'install') && (! -e $Pakfire::lockfile)) { my @pkgs = split(/\|/, $cgiparams{'INSPAKS'}); if ("$cgiparams{'FORCE'}" eq "on") { + # Lock the page. + $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "install", "--non-interactive", "--no-colors", @pkgs); - sleep(2); } else { &Header::openbox("100%", "center", $Lang::tr{'request'}); my @output = &General::system_output("/usr/local/bin/pakfire", "resolvedeps", "--no-colors", @pkgs); @@ -95,8 +98,9 @@ END } elsif (($cgiparams{'ACTION'} eq 'remove') && (! -e $Pakfire::lockfile)) { my @pkgs = split(/\|/, $cgiparams{'DELPAKS'}); if ("$cgiparams{'FORCE'}" eq "on") { + # Lock the page. + $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "remove", "--non-interactive", "--no-colors", @pkgs); - sleep(2); } else { &Header::openbox("100%", "center", $Lang::tr{'request'}); my @output = &General::system_output("/usr/local/bin/pakfire", "resolvedeps", "--no-colors", @pkgs); @@ -132,8 +136,12 @@ END } } elsif (($cgiparams{'ACTION'} eq 'update') && (! -e $Pakfire::lockfile)) { + # Set variable to lock the page. + $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "update", "--force", "--no-colors"); } elsif (($cgiparams{'ACTION'} eq 'upgrade') && (!-e $Pakfire::lockfile)) { + # Lock the page. + $page_lock = "1"; &General::system_background("/usr/local/bin/pakfire", "upgrade", "-y", "--no-colors"); } elsif ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}") { $pakfiresettings{"TREE"} = $cgiparams{"TREE"}; @@ -169,6 +177,43 @@ if ($errormessage) { &Header::closebox(); } +# Check if a page lock is required. +if ($page_lock) { + &Header::openbox('Waiting', 1, ,); + print <<END; + <table> + <tr> + <td> + <img src='/images/indicator.gif' alt='$Lang::tr{'active'}' title='$Lang::tr{'active'}'> + </td> + + <td> + $Lang::tr{'pakfire working'} + </td> + </tr> + </table> +END + &Header::closebox(); + + # Infinite loop to lock the page until pakfire lockfile is present. + while($page_lock) { + unless (-e $Pakfire::lockfile) { + sleep(1); + } else { + # Release page lock. + undef($page_lock); + + # Break loop. + last; + } + } + + # Perform page reload. + print "<meta http-equiv='refresh' content='1;'>\n"; + exit; +} + +# Check if pakfire is already running. In this case a lockfile is present. if (-e $Pakfire::lockfile) { &Header::openbox( 'Waiting', 1, "<meta http-equiv='refresh' content='10;'>" ); print <<END; -- 2.30.2

5 5

CVE issue flagged in OpenVPN
by Adolf Belka 10 Nov '21

10 Nov '21

Hallo all, I had thought, from checks I had made, that there were no security related issues with OpenVPN after the release of 2.5.0 that is currently in IPFire. However it has been highlighted in the forum that there is CVE-2020-15078. I have had a look at this and very specific conditions have to be in place for this to be feasible. So I believe that for the majority of IPFire users this will not be an issue but it could occur if someone is also using one of the OpenVPN plug-ins that are highlighted in the wiki and is also using "--auth-gen-token" or a user-specific token auth solution. While the above is unlikely it is not impossible. A fix for this CVE was put into 2.5.2 I have looked through this release and 2.5.1 to see if there are any changes that might cause a problem for people using earlier features. I don't believe so from first glance but I am not 100% sure. I would want to very thoroughly test it to be sure there would be no unexpected impact. Therefore what I am doing is an update that leaves the 2.5.0 source file being used but where I will apply the patches from the commits in 2.5.2 that fix this CVE. This will give us a quick fix to the CVE in IPFire so even any small chance is closed and then I will look more closely at the later/latest versions and build them and test them to see if I can find any issue, similarly to how Erik and I tested out that 2.5.0 would not break anything. This way we can take time to make sure everything is really working as expected. If there is any disagreement to my outlined approach above, please let me know. PS:- I have also found why I missed the the existence of the CVE. I was only reading the headlines of the changes from 2.4 to 2.5.4 and the CVE's were only mentioned in the detailed change notes from the involved versions. I know better now how to keep a correct eye on the changes. Regards, Adolf.

2 4

[PATCH] clamav: Update to 0.104.1
by Matthias Fischer 08 Nov '21

08 Nov '21

For details see: https://blog.clamav.net/2021/11/clamav-01034-and-01041-patch-releases.html "ClamAV 0.104.1 is a critical patch release..." [Changelog is too long to include here.] Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/clamav | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lfs/clamav b/lfs/clamav index 9076d0f71..69e5d8c0f 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.104.0 +VER = 0.104.1 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 57 +PAK_VER = 58 DEPS = @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3f4789c09f5a35e9ea580edd5c3e54b6 +$(DL_FILE)_MD5 = 49b9bb94d5b2cafc761f8fbe660d3bfa install : $(TARGET) @@ -94,6 +94,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -DENABLE_EXTERNAL_MSPACK=OFF \ -DENABLE_FRESHCLAM_DNS_FIX=ON \ -DAPP_CONFIG_DIRECTORY=/var/ipfire/clamav \ + -DCURSES_LIBRARY=/usr/lib/libncurses.so \ -DDATABASE_DIRECTORY=$(DATABASE_DIR) cd $(DIR_APP)/build && ninja $(MAKETUNING) && ninja install -- 2.18.0

2 1

[PATCH] ovpnmain.cgi: Do not interpret $? as error code of move()
by Stefan Schantl 04 Nov '21

04 Nov '21

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 41 +++++++++++++++------------------------ 1 file changed, 16 insertions(+), 25 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 2ebf384ed..f99bfdef7 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -1432,18 +1432,17 @@ END unlink ($filename); goto UPLOADCA_ERROR; } else { - # Delete if old key exists - if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") { - unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}"; + # Delete if old key exists + if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") { + unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}"; } - move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}"); - if ($? ne 0) { + + unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}")) { $errormessage = "$Lang::tr{'dh key move failed'}: $!"; unlink ($filename); goto UPLOADCA_ERROR; - } + } } - ### ### Upload CA Certificate ### @@ -1489,8 +1488,7 @@ END unlink ($filename); goto UPLOADCA_ERROR; } else { - move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem"); - if ($? ne 0) { + unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem")) { $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; unlink ($filename); goto UPLOADCA_ERROR; @@ -1814,8 +1812,7 @@ END } } - move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem"); - if ($? ne 0) { + unless(move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem")) { $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; unlink ($filename); unlink ("${General::swroot}/ovpn/ca/cacert.pem"); @@ -1824,8 +1821,7 @@ END goto ROOTCERT_ERROR; } - move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem"); - if ($? ne 0) { + unless(move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem")) { $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; unlink ($filename); unlink ("${General::swroot}/ovpn/ca/cacert.pem"); @@ -1834,8 +1830,7 @@ END goto ROOTCERT_ERROR; } - move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem"); - if ($? ne 0) { + unless(move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem")) { $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; unlink ($filename); unlink ("${General::swroot}/ovpn/ca/cacert.pem"); @@ -3395,22 +3390,19 @@ END print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n"; close FILE; - move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2"); - - if ($? ne 0) { + unless(move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2")) { $errormessage = "*.conf move failed: $!"; unlink ($filename); goto N2N_ERROR; } - move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2"); - chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name"; - - if ($? ne 0) { + unless(move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2")) { $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; unlink ($filename); goto N2N_ERROR; - } + } + + chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name"; my $complzoactive; my $mssfixactive; @@ -4175,8 +4167,7 @@ if ($cgiparams{'TYPE'} eq 'net') { unlink ($filename); goto VPNCONF_ERROR; } else { - move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem"); - if ($? ne 0) { + unless(move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem")) { $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; unlink ($filename); goto VPNCONF_ERROR; -- 2.30.2

2 1

Is "patchwork" down?
by Paul Simmons 03 Nov '21

03 Nov '21

FYI Greetings.. am receiving "Server error (500) from "https://patchwork.ipfire.org/project/ipfire/list/" Paul -- In the West, whisky is for drinking and water is for fighting.

5 6

[PATCH] gawk: Update to version 5.1.1
by Adolf Belka 02 Nov '21

02 Nov '21

- Update from 5.1.0 to 5.1.1 - Update rootfile - Changelog is quite long and detailed so the following are the high level descriptions of the changes from the NEWS file in the source tarball. More details can be found in the ChangeLog file in the source tarball. Changes from 5.1.0 to 5.1.1 1. Infrastructure upgrades: Bison 3.8, Gettext 0.20.2, Automake 1.16.4, and (will wonders never cease) Autoconf 2.71. 2. asort and asorti now allow FUNCTAB and SYMTAB as the first argument if a second destination array is supplied. Similarly, using either array as the second argument is now a fatal error. Additionally, using either array as the destination for split(), match(), etc. also causes a fatal error. 3. The new -I/--trace option prints a trace of the byte codes as they are executed. 4. A number of subtle bugs relating to MPFR mode that caused differences between regular operation and MPFR mode have been fixed. 5. The API now handles MPFR/GMP values slightly differently, requiring different memory management for those values. See the manual for the details if you have an extension using those values. As a result, the minor version was incremented. 6. $0 and the fields are now cleared before starting a BEGINFILE rule. 7. The duplication of m4 and build-aux directories between the main directory and the extension directory has been removed. This simplifies the distribution. 8. The test suite has been improved, making it easier to run the entire suite with -M. Use `GAWK_TEST_ARGS=-M make check' to do so. 9. Profiling and pretty-printing output has been modified slightly so that functions are presented in a reasonable order with respect to the namespaces that contain them. 10. Several example programs in the manual have been updated to their modern POSIX equivalents. 11. A number of examples in doc/gawkinet.texi have been updated for current times. Thanks to Juergen Kahrs for the work. 12. Handling of Infinity and NaN values has been improved. 13. There has been a general tightening up of the use of const and of types. 14. The "no effect" lint warnings have been fixed up and now behave more sanely. 15. The manual has been updated with much more information about what is and is not a bug, and the changes in the gawk mailing lists. 16. The behavior of strongly-typed regexp constants when passed as the third argument to sub() or gsub() has been clarified in the code and in the manual. 17. Similar to item #4 above, division by zero is now fatal in MPFR mode, as it is in regular mode. 18. There have been numerous minor code cleanups and bug fixes. See the ChangeLog for details. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/gawk | 3 ++- lfs/gawk | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/gawk b/config/rootfiles/common/gawk index 61778f408..3972311e0 100644 --- a/config/rootfiles/common/gawk +++ b/config/rootfiles/common/gawk @@ -1,6 +1,6 @@ usr/bin/awk usr/bin/gawk -usr/bin/gawk-5.1.0 +usr/bin/gawk-5.1.1 usr/etc/profile.d usr/etc/profile.d/gawk.csh usr/etc/profile.d/gawk.sh @@ -33,6 +33,7 @@ usr/lib/gawk/time.so #usr/share/awk/have_mpfr.awk #usr/share/awk/inplace.awk #usr/share/awk/intdiv0.awk +#usr/share/awk/isnumeric.awk #usr/share/awk/join.awk #usr/share/awk/libintl.awk #usr/share/awk/noassign.awk diff --git a/lfs/gawk b/lfs/gawk index 2e32f3bea..87d877323 100644 --- a/lfs/gawk +++ b/lfs/gawk @@ -25,7 +25,7 @@ include Config -VER = 5.1.0 +VER = 5.1.1 THISAPP = gawk-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8470c34eeecc41c1aa0c5d89e630df50 +$(DL_FILE)_MD5 = 83650aa943ff2fd519b2abedf8506ace install : $(TARGET) -- 2.33.1

1 0

[PATCH] dhcpcd: Update to 9.4.1
by Matthias Fischer 01 Nov '21

01 Nov '21

For details see: https://roy.marples.name/git/dhcpcd/shortlog/refs/heads/dhcpcd-9 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dhcpcd | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index 352308692..8c4a593ad 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 9.4.0 +VER = 9.4.1 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c36715fc629bc40aa94aae06fa1724c2 +$(DL_FILE)_MD5 = 2b2f46648bc96979f96127f0e0e07d9b install : $(TARGET) @@ -70,7 +70,9 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure --prefix="" --sysconfdir=/var/ipfire/dhcpc \ + cd $(DIR_APP) && ./configure \ + --prefix="" \ + --sysconfdir=/var/ipfire/dhcpc \ --dbdir=/var/ipfire/dhcpc \ --libexecdir=/var/ipfire/dhcpc \ --mandir=/usr/share/man -- 2.18.0

1 0

Can't login to GIT
by Matthias Fischer 01 Nov '21

01 Nov '21

Hi, GIT doesn't like me anymore!? Tried to pull 'origin next', but: ***SNIP*** mfischer(a)git.ipfire.org's password: Permission denied, please try again. mfischer(a)git.ipfire.org's password: Connection closed by 81.3.27.38 port 22 fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. ***SNAP*** Can anyone confirm? Best, Matthias

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2021