Development February 2021

development@lists.ipfire.org

15 participants
89 discussions

[PATCH] tar: Update to 1.34
by Matthias Fischer 19 Feb '21

19 Feb '21

For details see: https://lists.gnu.org/archive/html/info-gnu/2021-02/msg00006.html Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/tar | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/tar b/lfs/tar index f5c280fb2..9ba5e5c88 100644 --- a/lfs/tar +++ b/lfs/tar @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,10 +24,10 @@ include Config -VER = 1.32 +VER = 1.34 THISAPP = tar-$(VER) -DL_FILE = $(THISAPP).tar.bz2 +DL_FILE = $(THISAPP).tar.xz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 17917356fff5cb4bd3cd5a6c3e727b05 +$(DL_FILE)_MD5 = 9a08d29a9ac4727130b5708347c0f5cf install : $(TARGET) @@ -79,7 +79,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/tar/01_extract.c.patch -- 2.18.0

1 0

[PATCH] libgcrypt: Update to 1.9.2
by Matthias Fischer 19 Feb '21

19 Feb '21

For details see: https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000457.html Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/libgcrypt | 2 +- lfs/libgcrypt | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/libgcrypt b/config/rootfiles/common/libgcrypt index 63af7e6b1..756940b40 100644 --- a/config/rootfiles/common/libgcrypt +++ b/config/rootfiles/common/libgcrypt @@ -6,7 +6,7 @@ #usr/lib/libgcrypt.la #usr/lib/libgcrypt.so usr/lib/libgcrypt.so.20 -usr/lib/libgcrypt.so.20.3.1 +usr/lib/libgcrypt.so.20.3.2 #usr/lib/pkgconfig/libgcrypt.pc #usr/share/aclocal/libgcrypt.m4 #usr/share/info/gcrypt.info diff --git a/lfs/libgcrypt b/lfs/libgcrypt index a901c558f..392a21c30 100644 --- a/lfs/libgcrypt +++ b/lfs/libgcrypt @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.9.1 +VER = 1.9.2 THISAPP = libgcrypt-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8805f3e466af315222b6e1864f52b79a +$(DL_FILE)_MD5 = 00121b05e1ff4cc85a4a6503e0a7d9fb install : $(TARGET) -- 2.18.0

1 0

[PATCH] nettle: Update to 3.7.1
by Matthias Fischer 19 Feb '21

19 Feb '21

For details see: Annonce for 3.7.1: http://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009434.html Announce for 3.6: http://lists.lysator.liu.se/pipermail/nettle-bugs/2020/008967.html Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/nettle | 12 ++++++++---- lfs/nettle | 6 +++--- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/common/nettle b/config/rootfiles/common/nettle index 58e3f57a0..bf43e8ad5 100644 --- a/config/rootfiles/common/nettle +++ b/config/rootfiles/common/nettle @@ -23,6 +23,7 @@ #usr/include/nettle/cmac.h #usr/include/nettle/ctr.h #usr/include/nettle/curve25519.h +#usr/include/nettle/curve448.h #usr/include/nettle/des.h #usr/include/nettle/dsa-compat.h #usr/include/nettle/dsa.h @@ -32,6 +33,7 @@ #usr/include/nettle/ecdsa.h #usr/include/nettle/eddsa.h #usr/include/nettle/gcm.h +#usr/include/nettle/gostdsa.h #usr/include/nettle/gosthash94.h #usr/include/nettle/hkdf.h #usr/include/nettle/hmac.h @@ -61,16 +63,18 @@ #usr/include/nettle/sha1.h #usr/include/nettle/sha2.h #usr/include/nettle/sha3.h +#usr/include/nettle/siv-cmac.h +#usr/include/nettle/streebog.h #usr/include/nettle/twofish.h #usr/include/nettle/umac.h #usr/include/nettle/version.h #usr/include/nettle/xts.h #usr/include/nettle/yarrow.h usr/lib/libhogweed.so -usr/lib/libhogweed.so.5 -usr/lib/libhogweed.so.5.0 +usr/lib/libhogweed.so.6 +usr/lib/libhogweed.so.6.2 #usr/lib/libnettle.so -usr/lib/libnettle.so.7 -usr/lib/libnettle.so.7.0 +usr/lib/libnettle.so.8 +usr/lib/libnettle.so.8.2 #usr/lib/pkgconfig/hogweed.pc #usr/lib/pkgconfig/nettle.pc diff --git a/lfs/nettle b/lfs/nettle index cc34b1fad..e2d5df88d 100644 --- a/lfs/nettle +++ b/lfs/nettle @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.5.1 +VER = 3.7.1 THISAPP = nettle-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0e5707b418c3826768d41130fbe4ee86 +$(DL_FILE)_MD5 = 4d23a99df650ee88511653fb9acea3f0 install : $(TARGET) -- 2.18.0

1 0

GIT: Cannot assign requested address
by Matthias Fischer 19 Feb '21

19 Feb '21

Hi, ...again...without any warning (*sigh*): "root@Devel32: /home/matz/ipfire-2.x # git pull origin next ssh: connect to host git.ipfire.org port 22: Cannot assign requested address fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists." Could "someone" please take a look? Thanks in advance! Best, Matthias

2 3

[PATCH] krb5: Update to 1.19.1
by Matthias Fischer 19 Feb '21

19 Feb '21

For details see: https://web.mit.edu/kerberos/krb5-1.19/README-1.19.1.txt "This is a bug fix release. * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. krb5-1.19.1 changes by ticket ID -------------------------------- 8984 Load certs when checking pkinit_identities values 8985 Restore krb5_set_default_tgs_ktypes() 8987 Synchronize command-line option documentation" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/krb5 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/krb5 b/lfs/krb5 index c77e4fdfd..a972920e7 100644 --- a/lfs/krb5 +++ b/lfs/krb5 @@ -24,7 +24,7 @@ include Config -VER = 1.19 +VER = 1.19.1 THISAPP = krb5-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP)/src TARGET = $(DIR_INFO)/$(THISAPP) PROG = krb5 -PAK_VER = 5 +PAK_VER = 6 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = aaf18447a5a014aa3b7e81814923f4c9 +$(DL_FILE)_MD5 = 81257292f8243f735654d4fd5d1fef6a install : $(TARGET) -- 2.18.0

1 0

[PATCH] bind: Update to 9.11.28
by Matthias Fischer 19 Feb '21

19 Feb '21

For details see: https://downloads.isc.org/isc/bind9/9.11.28/RELEASE-NOTES-bind-9.11.28.html "Notes for BIND 9.11.28 Security Fixes When tkey-gssapi-keytab or tkey-gssapi-credential was configured, a specially crafted GSS-TSIG query could cause a buffer overflow in the ISC implementation of SPNEGO (a protocol enabling negotiation of the security mechanism to use for GSSAPI authentication). This flaw could be exploited to crash named. Theoretically, it also enabled remote code execution, but achieving the latter is very difficult in real-world conditions. (CVE-2020-8625) This vulnerability was responsibly reported to us as ZDI-CAN-12302 by Trend Micro Zero Day Initiative. [GL #2354]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 6 +++--- lfs/bind | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index d18332bf4..c3235bb8f 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -272,12 +272,12 @@ usr/lib/libbind9.so.161 usr/lib/libbind9.so.161.0.4 #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libdns.so.1112 -usr/lib/libdns.so.1112.0.2 +usr/lib/libdns.so.1113 +usr/lib/libdns.so.1113.0.1 #usr/lib/libisc.la #usr/lib/libisc.so usr/lib/libisc.so.1107 -usr/lib/libisc.so.1107.0.4 +usr/lib/libisc.so.1107.0.5 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 diff --git a/lfs/bind b/lfs/bind index 0069fea59..3047ac83e 100644 --- a/lfs/bind +++ b/lfs/bind @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 9.11.26 +VER = 9.11.28 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 1e5fb81b0ef562d32a19e579c0183f1a +$(DL_FILE)_MD5 = 59aa4d7be438b2c8103811d18f318c82 install : $(TARGET) -- 2.18.0

1 0

Pending patches for upcoming Core Update(s)
by Matthias Fischer 19 Feb '21

19 Feb '21

Hi, FYI and to avoid redundancies, I got one of the 64bit-'Devels' working on: tar => 1.34 bind => 9.11.28 nettle => 3.7.1 libgcrypt => 1.9.2 krb5 => 1.19.1 And, because it "just came my way": rust => 1.50 (under x86-64, this is huge - about ~1.2GB sources) Opinions for this update(s)? I'm just not so sure with the latter - do we want this? As I see it, 'suricata' must then also be at least shipped or even updated. Besides, 'suricata 6.0.1' is still running here with the 'usleep (5000)'-patch. So far, without - seen! - problems. Any news on this? If wanted, I could provide a patchset so "someone" else could test this!? Best, Matthias

2 2

[RFC PATCH 1/2] Add a cgi page to show a vpn certificate
by Jonatan Schlag 18 Feb '21

18 Feb '21

This page has the only usage to show a certificate of the ipsec vpn. It should decrease complexity of the vpnmain.cgi. This decrease might not be huge but at least there. This also should introduce usage of templates. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- html/cgi-bin/vpn-show-cert.cgi | 132 ++++++++++++++++++++++++++++++ html/html/templates/vpn-cert.html | 14 ++++ 2 files changed, 146 insertions(+) create mode 100644 html/cgi-bin/vpn-show-cert.cgi create mode 100644 html/html/templates/vpn-cert.html diff --git a/html/cgi-bin/vpn-show-cert.cgi b/html/cgi-bin/vpn-show-cert.cgi new file mode 100644 index 000000000..4c3f99c5f --- /dev/null +++ b/html/cgi-bin/vpn-show-cert.cgi @@ -0,0 +1,132 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; +use HTML::Entities(); +use HTML::Template; + +# enable only the following on debugging purpose +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + +# Functions + +sub is_valid_cert_key { + my $key = $_[0]; + return 1; +} + +sub is_valid_ca_cert_key { + my $key = $_[0]; + return 1; +} + +my %color = (); +my %mainsettings = (); +my %cgiparams=(); +my %confighash=(); +my %cahash=(); + +# Initialize template +my $tmpl = HTML::Template->new( + filename => "/srv/web/ipfire/html/html/templates/vpn-cert.html", + die_on_bad_params => 0 +); + + +# Read-in main settings, for language, theme and colors. +&General::readhash("${General::swroot}/main/settings", \%mainsettings); +&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color); + + +#Get GUI values +&Header::getcgihash(\%cgiparams); + + +if (($cgiparams{'ACTION'} eq "showCert" || + $cgiparams{'ACTION'} eq "showCaCert" || + $cgiparams{'ACTION'} eq "showRootCert" || + $cgiparams{'ACTION'} eq "showHostCert" )) { + + my $action = $cgiparams{'ACTION'}; + my $file = ""; + + if ($action eq "showRootCert"){ + $file = "${General::swroot}/ca/cacert.pem"; + } elsif ($action eq "showHostCert"){ + $file = "${General::swroot}/ca/cacert.pem"; + } elsif ($action eq "showCert" ){ + my $key = $cgiparams{'KEY'}; + if (is_valid_cert_key($key)){ + &General::readhasharray("${General::swroot}/vpn/config", \%confighash); + $file = "${General::swroot}/certs/$confighash{$key}[1]cert.pem"; + } else { + $tmpl->param(ERRORMESSAGE => $Lang::tr{'invalid key'}); + } + } elsif ($action eq "showCaCert"){ + my $key = $cgiparams{'KEY'}; + if (is_valid_ca_cert_key($key)){ + &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); + $file = "${General::swroot}/ca/$cahash{$key}[0]cert.pem"; + } else { + $tmpl->param(ERRORMESSAGE => $Lang::tr{'invalid key'}); + } + } + + if (not "$file" eq "" && -f $file){ + my $output = `/usr/bin/openssl x509 -text -in $file`; + $output = &Header::cleanhtml($output,"y"); + + + + $tmpl->param(OUTPUT => $output); + + # Some translated strings + if ($action eq "showRootCert") { + $tmpl->param(L_TITLE => $Lang::tr{'root certificate'}); + } elsif ($action eq "showHostCert"){ + $tmpl->param(L_TITLE => $Lang::tr{'host certificate'}); + } elsif ($action eq "showCert"){ + $tmpl->param(L_TITLE => $Lang::tr{'cert'}); + } elsif ($action eq "showCaCert"){ + $tmpl->param(L_TITLE => $Lang::tr{'ca certificate'}); + } + + $tmpl->param(L_BACK => $Lang::tr{'back'}); + } + +} else { + + my $keys = join "\n", keys %cgiparams; + $tmpl->param(ERRORMESSAGE => "Invalid Paramter: \n $keys"); +} + +&Header::showhttpheaders(); +&Header::openpage($Lang::tr{'ipsec'}, 1, ''); + +# Print rendered template +print $tmpl->output(); + +&Header::closepage(); diff --git a/html/html/templates/vpn-cert.html b/html/html/templates/vpn-cert.html new file mode 100644 index 000000000..43ec759f1 --- /dev/null +++ b/html/html/templates/vpn-cert.html @@ -0,0 +1,14 @@ +<div class="post"> + <TMPL_IF NAME="ERRORMESSAGE"> + <TMPL_VAR NAME="ERRORMESSAGE"> + <TMPL_ELSE> + <h2><TMPL_VAR NAME="L_TITLE"></h2> + <pre> + <TMPL_VAR NAME="OUTPUT"> + </pre> + </TMPL_IF> +</div> + +<div align="center"> + <a href="/cgi-bin/vpnmain.cgi"><TMPL_VAR NAME="L_BACK"></a> +</div> \ No newline at end of file -- 2.20.1

2 2

fireperf results
by Adolf Belka (ipfire-dev) 17 Feb '21

17 Feb '21

Hi All, Following are the fireperf results I obtained:- server: IPFire 2.25 - Core Update 153; Intel Celeron CPU J1900 @ 1.99GHz x4; I211 Gigabit Network Connection client: Arch Linux; Intel Core i5-8400 CPU @ 2.80GHz 6 core; 1GBit nic Server: fireperf -s -P 10000 -p 63000:630010 Client: fireperf -c <IP address> -P 1 -x -p 63000:63010 -> 100 - 3000 cps strongly fluctuating. After a couple of minutes the client cps went down to 0 and stayed there. I had to stop fireperf and restart the terminal to get it working again. fireperf -c <IP address> -P 10 -x -p 63000:63010 ->250 - 500 cps fluctuating fireperf -c <IP address> -P 100 -x -p 63000:63010 -> 220 - 1000 cps fluctuating fireperf -c <IP address> -P 1000 -x -p 63000:63010 -> 1200 - 2500 cps fluctuating fireperf -c <IP address> -P 10000 -x -p 63000:63010 -> 0 - 7000 cps hugely fluctuating In all cases the cpu utilisation was quite low on both IPFire and the Arch Linux desktop. I then repeated the above tests removing the -x option so I could see the data bandwidth. fireperf -c <IP address> -P 1 -p 63000:63010 -> 225Mb/s - 1 core at 100%, rest around 30% to 40% fireperf -c <IP address> -P 10 -p 63000:63010 -> 185Mb/s - similar as above fireperf -c <IP address> -P 100 -p 63000:63010 -> 210Mb/s - similar to above fireperf -c <IP address> -P 1000 -p 63000:63010 -> 370 - 450Mb/s - 2 cores at 100%, rest at 30% to 40% fireperf -c <IP address> -P 10000 -p 63000:63010 -> 400Mb/s - 1Gb/s - 2 cores at 100%, rest at 40% to 50% I recently got my Glass Fibre Gigabit connection connected. The supplier hooked his laptop directly to the media converter and got around 950Mb/s Using the same speed test as he used but going through my IPFire hardware I get around 225Mb/s. Although my hardware has four Intel I211 Gigabit NIC's, I have suspected that their performance is limited by the processor. Regards, Adolf.

3 6

Feedback on Core Update 154 testing
by Adolf Belka (ipfire-dev) 17 Feb '21

17 Feb '21

Hi All, After working on a new bug (#10628), my code was not working as I expected it to. After investigating I realised that when I provided https://patchwork.ipfire.org/patch/3724/ to add Deny Known Client capability to dhcp.cgi I had placed a curly bracket in the wrong place. It is not syntactically wrong so there is no Internal Error message coming up but if the Deny Known Clients is not checked then there is no check made for a valid Default Lease Time. I made an error when I inserted my code into dhcp.cgi for the Deny Known Clients fix. I will raise a patch to correct this. Regards, Adolf.

2 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2021