Development February 2022

development@lists.ipfire.org

16 participants
114 discussions

[PATCH] openssh: Update to version 8.9p1
by Adolf Belka 28 Feb '22

28 Feb '22

- Update from 8.8p1 to 8.9p1 - Update of rootfile not required - Changelog OpenSSH 8.9 was released on 2022-02-23. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Future deprecation notice A near-future release of OpenSSH will switch scp(1) from using the legacy scp/rcp protocol to using SFTP by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. This creates one area of potential incompatibility: scp(1) when using the SFTP protocol no longer requires this finicky and brittle quoting, and attempts to use it may cause transfers to fail. We consider the removal of the need for double-quoting shell characters in file names to be a benefit and do not intend to introduce bug-compatibility for legacy scp/rcp in scp(1) when using the SFTP protocol. Another area of potential incompatibility relates to the use of remote paths relative to other user's home directories, for example - "scp host:~user/file /tmp". The SFTP protocol has no native way to expand a ~user path. However, sftp-server(8) in OpenSSH 8.7 and later support a protocol extension "expand-path(a)openssh.com" to support this. Security Near Miss * sshd(8): fix an integer overflow in the user authentication path that, in conjunction with other logic errors, could have yielded unauthenticated access under difficult to exploit conditions. This situation is not exploitable because of independent checks in the privilege separation monitor. Privilege separation has been enabled by default in since openssh-3.2.2 (released in 2002) and has been mandatory since openssh-7.5 (released in 2017). Moreover, portable OpenSSH has used toolchain features available in most modern compilers to abort on signed integer overflow since openssh-6.5 (released in 2014). Thanks to Malcolm Stagg for finding and reporting this bug. Potentially-incompatible changes * sshd(8), portable OpenSSH only: this release removes in-built support for MD5-hashed passwords. If you require these on your system then we recommend linking against libxcrypt or similar. * This release modifies the FIDO security key middleware interface and increments SSH_SK_VERSION_MAJOR. Changes since OpenSSH 8.8 This release includes a number of new features. New features * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting forwarding and use of keys added to ssh-agent(1) A detailed description of the feature is available at https://www.openssh.com/agent-restrict.html and the protocol extensions are documented in the PROTOCOL and PROTOCOL.agent files in the source release. * ssh(1), sshd(8): add the sntrup761x25519-sha512(a)openssh.com hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method. * ssh-keygen(1): when downloading resident keys from a FIDO token, pass back the user ID that was used when the key was created and append it to the filename the key is written to (if it is not the default). Avoids keys being clobbered if the user created multiple resident keys with the same application string but different user IDs. * ssh-keygen(1), ssh(1), ssh-agent(1): better handling for FIDO keys on tokens that provide user verification (UV) on the device itself, including biometric keys, avoiding unnecessary PIN prompts. * ssh-keygen(1): add "ssh-keygen -Y match-principals" operation to perform matching of principals names against an allowed signers file. To be used towards a TOFU model for SSH signatures in git. * ssh-add(1), ssh-agent(1): allow pin-required FIDO keys to be added to ssh-agent(1). $SSH_ASKPASS will be used to request the PIN at authentication time. * ssh-keygen(1): allow selection of hash at sshsig signing time (either sha512 (default) or sha256). * ssh(1), sshd(8): read network data directly to the packet input buffer instead of indirectly via a small stack buffer. Provides a modest performance improvement. * ssh(1), sshd(8): read data directly to the channel input buffer, providing a similar modest performance improvement. * ssh(1): extend the PubkeyAuthentication configuration directive to accept yes|no|unbound|host-bound to allow control over one of the protocol extensions used to implement agent-restricted keys. Bugfixes * sshd(8): document that CASignatureAlgorithms, ExposeAuthInfo and PubkeyAuthOptions can be used in a Match block. PR277. * sshd(8): fix possible string truncation when constructing paths to .rhosts/.shosts files with very long user home directory names. * ssh-keysign(1): unbreak for KEX algorithms that use SHA384/512 exchange hashes * ssh(1): don't put the TTY into raw mode when SessionType=none, avoids ^C being unable to kill such a session. bz3360 * scp(1): fix some corner-case bugs in SFTP-mode handling of ~-prefixed paths. * ssh(1): unbreak hostbased auth using RSA keys. Allow ssh(1) to select RSA keys when only RSA/SHA2 signature algorithms are configured (this is the default case). Previously RSA keys were not being considered in the default case. * ssh-keysign(1): make ssh-keysign use the requested signature algorithm and not the default for the key type. Part of unbreaking hostbased auth for RSA/SHA2 keys. * ssh(1): stricter UpdateHostkey signature verification logic on the client- side. Require RSA/SHA2 signatures for RSA hostkeys except when RSA/SHA1 was explicitly negotiated during initial KEX; bz3375 * ssh(1), sshd(8): fix signature algorithm selection logic for UpdateHostkeys on the server side. The previous code tried to prefer RSA/SHA2 for hostkey proofs of RSA keys, but missed some cases. This will use RSA/SHA2 signatures for RSA keys if the client proposed these algorithms in initial KEX. bz3375 * All: convert all uses of select(2)/pselect(2) to poll(2)/ppoll(2). This includes the mainloops in ssh(1), ssh-agent(1), ssh-agent(1) and sftp-server(8), as well as the sshd(8) listen loop and all other FD read/writability checks. On platforms with missing or broken poll(2)/ppoll(2) syscalls a select(2)-based compat shim is available. * ssh-keygen(1): the "-Y find-principals" command was verifying key validity when using ca certs but not with simple key lifetimes within the allowed signers file. * ssh-keygen(1): make sshsig verify-time argument parsing optional * sshd(8): fix truncation in rhosts/shosts path construction. * ssh(1), ssh-agent(1): avoid xmalloc(0) for PKCS#11 keyid for ECDSA keys (we already did this for RSA keys). Avoids fatal errors for PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B "cryptoauthlib"; bz#3364 * ssh(1), ssh-agent(1): improve the testing of credentials against inserted FIDO: ask the token whether a particular key belongs to it in cases where the token supports on-token user-verification (e.g. biometrics) rather than just assuming that it will accept it. Will reduce spurious "Confirm user presence" notifications for key handles that relate to FIDO keys that are not currently inserted in at least some cases. bz3366 * ssh(1), sshd(8): correct value for IPTOS_DSCP_LE. It needs to allow for the preceding two ECN bits. bz#3373 * ssh-keygen(1): add missing -O option to usage() for the "-Y sign" option. * ssh-keygen(1): fix a NULL deref when using the find-principals function, when matching an allowed_signers line that contains a namespace restriction, but no restriction specified on the command-line * ssh-agent(1): fix memleak in process_extension(); oss-fuzz issue #42719 * ssh(1): suppress "Connection to xxx closed" messages when LogLevel is set to "error" or above. bz3378 * ssh(1), sshd(8): use correct zlib flags when inflate(3)-ing compressed packet data. bz3372 * scp(1): when recursively transferring files in SFTP mode, create the destination directory if it doesn't already exist to match scp(1) in legacy RCP mode behaviour. * scp(1): many improvements in error message consistency between scp(1) in SFTP mode vs legacy RCP mode. * sshd(8): fix potential race in SIGTERM handling PR289 * ssh(1), ssh(8): since DSA keys are deprecated, move them to the end of the default list of public keys so that they will be tried last. PR295 * ssh-keygen(1): allow 'ssh-keygen -Y find-principals' to match wildcard principals in allowed_signers files Portability * ssh(1), sshd(8): don't trust closefrom(2) on Linux. glibc's implementation does not work in a chroot when the kernel does not have close_range(2). It tries to read from /proc/self/fd and when that fails dies with an assertion of sorts. Instead, call close_range(2) directly from our compat code and fall back if that fails. bz#3349, * OS X poll(2) is broken; use compat replacement. For character- special devices like /dev/null, Darwin's poll(2) returns POLLNVAL when polled with POLLIN. Apparently this is Apple bug 3710161 - not public but a websearch will find other OSS projects rediscovering it periodically since it was first identified in 2005. * Correct handling of exceptfds/POLLPRI in our select(2)-based poll(2)/ppoll(2) compat implementation. * Cygwin: correct checking of mbstowcs() return value. * Add a basic SECURITY.md that refers people to the openssh.com website. * Enable additional compiler warnings and toolchain hardening flags, including -Wbitwise-instead-of-logical, -Wmisleading-indentation, -fzero-call-used-regs and -ftrivial-auto-var-init. * HP/UX. Use compat getline(3) on HP-UX 10.x, where the libc version is not reliable. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openssh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index 1aea6cba9..bd278960f 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -24,7 +24,7 @@ include Config -VER = 8.8p1 +VER = 8.9p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8ce5f390958baeeab635aafd0ef41453 +$(DL_FILE)_MD5 = f33910174f0af52491277211e2b105bb install : $(TARGET) -- 2.35.1

2 1

[PATCH 01/12] location-functions.pl: Rename and set the location for exported databases to "/var/lib/location/ipset/".
by Stefan Schantl 27 Feb '22

27 Feb '22

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/cfgroot/location-functions.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/cfgroot/location-functions.pl b/config/cfgroot/location-functions.pl index 4d44ce24d..f86464933 100644 --- a/config/cfgroot/location-functions.pl +++ b/config/cfgroot/location-functions.pl @@ -53,7 +53,7 @@ our $database = "$location_dir/database.db"; our $keyfile = "$location_dir/signing-key.pem"; # Directory which contains the exported databases. -our $xt_geoip_db_directory = "/usr/share/xt_geoip/"; +our $ipset_db_directory = "$location_dir/ipset"; # Create libloc database handle. my $db_handle = &init(); -- 2.30.2

4 40

[PATCH] wget: Update to 1.21.3
by Matthias Fischer 27 Feb '22

27 Feb '22

For details see: https://lists.gnu.org/archive/html/info-gnu/2022-02/msg00017.html "This is a minor bugfix release. ... * Noteworthy changes in release 1.21.3 (2022-02-26) ** Fix computation of total bytes downloaded during FTP transfers (#61277) ** Add option to select TLS 1.3 on the command line ** Fix HSTS build issues on some 64-bit big-endian systems ** Hide password during status report in --no-verbose ** Remove a spurious print statement that showed up even during --quiet ** Some more cleanups and bug-fixes" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/wget | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/wget b/lfs/wget index fd7a4eb45..ef0c2b080 100644 --- a/lfs/wget +++ b/lfs/wget @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.21.2 +VER = 1.21.3 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 6321d4c2b820394cf2392985d8f8c563 +$(DL_FILE)_MD5 = e89496b15f8bf039d723926fae4d91f5 install : $(TARGET) -- 2.25.1

2 1

[PATCH] u-boot: add OrangePi Zero Plus (Allwinner H5)
by Arne Fitzenreiter 27 Feb '22

27 Feb '22

this u-boot should also work with NanoPi R1S H5 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/common/aarch64/u-boot | 2 ++ lfs/u-boot | 17 +++++++++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/aarch64/u-boot b/config/rootfiles/common/aarch64/u-boot index ab22769e3..2b60c7802 100644 --- a/config/rootfiles/common/aarch64/u-boot +++ b/config/rootfiles/common/aarch64/u-boot @@ -10,6 +10,8 @@ boot/uboot.env usr/share/u-boot/nanopi_r2s/u-boot-rockchip.bin #usr/share/u-boot/nanopi_r4s usr/share/u-boot/nanopi_r4s/u-boot-rockchip.bin +#usr/share/u-boot/orangepi_zero_plus +usr/share/u-boot/orangepi_zero_plus/u-boot-sunxi-with-spl.bin #usr/share/u-boot/rpi usr/share/u-boot/rpi/u-boot-rpi3.bin usr/share/u-boot/rpi/u-boot-rpi4.bin diff --git a/lfs/u-boot b/lfs/u-boot index b68cd6faf..2018a8a5f 100644 --- a/lfs/u-boot +++ b/lfs/u-boot @@ -186,8 +186,22 @@ else cd $(DIR_APP) && install u-boot.bin /boot/u-boot-rpi4.bin cd $(DIR_APP) && make distclean + # OrangePi Zero Plus + cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) + cd $(DIR_APP) && tar axf $(DIR_DL)/arm-trusted-firmware-$(ATF_VER).tar.gz + cd $(DIR_APP)/arm-trusted-firmware-$(ATF_VER) && make PLAT=sun50i_a64 DEBUG=0 bl31 + cd $(DIR_APP) && cp arm-trusted-firmware-$(ATF_VER)/build/sun50i_a64/release/bl31.bin bl31.bin + cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) + -mkdir -pv /usr/share/u-boot/orangepi_zero_plus + cd $(DIR_APP) && make CROSS_COMPILE="" orangepi_zero_plus_config + cd $(DIR_APP) && sed -i -e 's!^CONFIG_IDENT_STRING=.*!CONFIG_IDENT_STRING=" OrangePi Zero+ - IPFire.org"!' .config + cd $(DIR_APP) && make CROSS_COMPILE="" HOSTCC="gcc $(CFLAGS)" + cd $(DIR_APP) && install -v -m 644 u-boot-sunxi-with-spl.bin \ + /usr/share/u-boot/orangepi_zero_plus + cd $(DIR_APP) && make distclean + cd $(DIR_APP) && rm -f bl31.bin + # Nanopi R2S -# cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/u-boot/rockchip/generate-2-ethaddr.diff cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) cd $(DIR_APP) && tar axf $(DIR_DL)/arm-trusted-firmware-$(ATF_VER).tar.gz cd $(DIR_APP)/arm-trusted-firmware-$(ATF_VER) && make PLAT=rk3328 ARCH=aarch64 DEBUG=0 bl31 @@ -212,7 +226,6 @@ else cd $(DIR_APP) && sed -i -e 's!^CONFIG_IDENT_STRING=.*!CONFIG_IDENT_STRING=" Nanopi R4S - IPFire.org"!' .config cd $(DIR_APP) && sed -i -e 's!^CONFIG_BOOTCOMMAND=.*!CONFIG_BOOTCOMMAND="console=ttyS2,115200n8;run distro_bootcmd"!' .config cd $(DIR_APP) && sed -i -e 's!^CONFIG_BAUDRATE=.*!CONFIG_BAUDRATE=115200!' .config -# cd $(DIR_APP) && sed -i -e 's!.*CONFIG_MISC_INIT_R.*!CONFIG_MISC_INIT_R=y!' .config cd $(DIR_APP) && make CROSS_COMPILE="" HOSTCC="gcc $(CFLAGS)" cd $(DIR_APP) && install -v -m 644 u-boot-rockchip.bin \ /usr/share/u-boot/nanopi_r4s/u-boot-rockchip.bin -- 2.25.1

1 0

[PATCH] u-boot: add OrangePi Zero Plus (Allwinner H5)
by Arne Fitzenreiter 27 Feb '22

27 Feb '22

this u-boot should also work with NanoPi R1S H5 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/common/aarch64/u-boot | 2 ++ lfs/u-boot | 17 +++++++++++++++-- make.sh | 1 + 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/aarch64/u-boot b/config/rootfiles/common/aarch64/u-boot index ab22769e3..2b60c7802 100644 --- a/config/rootfiles/common/aarch64/u-boot +++ b/config/rootfiles/common/aarch64/u-boot @@ -10,6 +10,8 @@ boot/uboot.env usr/share/u-boot/nanopi_r2s/u-boot-rockchip.bin #usr/share/u-boot/nanopi_r4s usr/share/u-boot/nanopi_r4s/u-boot-rockchip.bin +#usr/share/u-boot/orangepi_zero_plus +usr/share/u-boot/orangepi_zero_plus/u-boot-sunxi-with-spl.bin #usr/share/u-boot/rpi usr/share/u-boot/rpi/u-boot-rpi3.bin usr/share/u-boot/rpi/u-boot-rpi4.bin diff --git a/lfs/u-boot b/lfs/u-boot index b68cd6faf..2018a8a5f 100644 --- a/lfs/u-boot +++ b/lfs/u-boot @@ -186,8 +186,22 @@ else cd $(DIR_APP) && install u-boot.bin /boot/u-boot-rpi4.bin cd $(DIR_APP) && make distclean + # OrangePi Zero Plus + cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) + cd $(DIR_APP) && tar axf $(DIR_DL)/arm-trusted-firmware-$(ATF_VER).tar.gz + cd $(DIR_APP)/arm-trusted-firmware-$(ATF_VER) && make PLAT=sun50i_a64 DEBUG=0 bl31 + cd $(DIR_APP) && cp arm-trusted-firmware-$(ATF_VER)/build/sun50i_a64/release/bl31.bin bl31.bin + cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) + -mkdir -pv /usr/share/u-boot/orangepi_zero_plus + cd $(DIR_APP) && make CROSS_COMPILE="" orangepi_zero_plus_config + cd $(DIR_APP) && sed -i -e 's!^CONFIG_IDENT_STRING=.*!CONFIG_IDENT_STRING=" OrangePi Zero+ - IPFire.org"!' .config + cd $(DIR_APP) && make CROSS_COMPILE="" HOSTCC="gcc $(CFLAGS)" + cd $(DIR_APP) && install -v -m 644 u-boot-sunxi-with-spl.bin \ + /usr/share/u-boot/orangepi_zero_plus + cd $(DIR_APP) && make distclean + cd $(DIR_APP) && rm -f bl31.bin + # Nanopi R2S -# cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/u-boot/rockchip/generate-2-ethaddr.diff cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) cd $(DIR_APP) && tar axf $(DIR_DL)/arm-trusted-firmware-$(ATF_VER).tar.gz cd $(DIR_APP)/arm-trusted-firmware-$(ATF_VER) && make PLAT=rk3328 ARCH=aarch64 DEBUG=0 bl31 @@ -212,7 +226,6 @@ else cd $(DIR_APP) && sed -i -e 's!^CONFIG_IDENT_STRING=.*!CONFIG_IDENT_STRING=" Nanopi R4S - IPFire.org"!' .config cd $(DIR_APP) && sed -i -e 's!^CONFIG_BOOTCOMMAND=.*!CONFIG_BOOTCOMMAND="console=ttyS2,115200n8;run distro_bootcmd"!' .config cd $(DIR_APP) && sed -i -e 's!^CONFIG_BAUDRATE=.*!CONFIG_BAUDRATE=115200!' .config -# cd $(DIR_APP) && sed -i -e 's!.*CONFIG_MISC_INIT_R.*!CONFIG_MISC_INIT_R=y!' .config cd $(DIR_APP) && make CROSS_COMPILE="" HOSTCC="gcc $(CFLAGS)" cd $(DIR_APP) && install -v -m 644 u-boot-rockchip.bin \ /usr/share/u-boot/nanopi_r4s/u-boot-rockchip.bin diff --git a/make.sh b/make.sh index 79798834a..6e84d8d1b 100755 --- a/make.sh +++ b/make.sh @@ -1181,6 +1181,7 @@ buildipfire() { # multi kernel builds so KCFG is empty lfsmake2 linux KCFG="" lfsmake2 rtl8189es KCFG="" + lfsmake2 rtl8189fs KCFG="" lfsmake2 rtl8812au KCFG="" lfsmake2 rtl8822bu KCFG="" lfsmake2 xradio KCFG="" -- 2.25.1

1 0

[PATCH] export: Remove prefix when exporting countries.
by Stefan Schantl 24 Feb '22

24 Feb '22

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/python/export.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/python/export.py b/src/python/export.py index a9774e8..be33847 100644 --- a/src/python/export.py +++ b/src/python/export.py @@ -149,7 +149,7 @@ class Exporter(object): directory, prefix=country_code, suffix=self.writer.suffix, family=family, ) - writers[country_code] = self.writer.open(filename, prefix="CC_%s" % country_code) + writers[country_code] = self.writer.open(filename, prefix="%s" % country_code) # Create writers for ASNs for asn in asns: -- 2.30.2

1 0

Re: IPFire 2.27 - Core Update 164 is available for testing
by Adolf Belka 23 Feb '22

23 Feb '22

Hi All, Just tested out CU164 on my vm testbed system. The update went without any problems. You see the pakfire log status again on the wui page during the update. OpenVPN RW setup ran without any issues. Connection successfully made. IPS has the multiple providers option successfully in place. I eventually found the Force Update of rules button, which was very useful for my vm testbed as it is not running all the time and so the rules were a bit out of date. As far as I can tell everything is working fine on it. No issues detected. I will let it run over the next few days during the daytime and see how things go. Regards, Adolf. On 20/02/2022 18:35, IPFire Project wrote: > IPFire Logo > > there is a new post from Michael Tremer on the IPFire Blog: > > *IPFire 2.27 - Core Update 164 is available for testing* > > It is time to test another release for IPFire: IPFire 2.27 - Core Update 164. It comes with a vastly improved firewall engine, a new kernel and various security and bug fixes. Please help us testing this release and if you would like to support us, please donate. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-164-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

3 5

Release schedule for Core Update 165 and 166
by Peter Müller 23 Feb '22

23 Feb '22

Hello development folks, to make it more clear which patch goes into which release, at which point in time a Core Update will be closed, and to ideally release stuff ready to go faster, Michael and myself just had a phone call over the IPFire 2.x release schedule (see: https://wiki.ipfire.org/devel/release-schedule), and we decided to give that another try. Having extended the "merge window" phase to 14 days, this means: - I will push my personal testing branch for Core Update 165 into "next" shortly, closing the "merge window" (in which I pick up patches from https://patchwork.ipfire.org/) by the end of this week. - Afterwards, Core Update 165 will go into the bugfixing phase for 20 days, until March 12nd. - It will then be released for the public testing phase for 10 days, being released as stable at approximately March 22nd. At the same time, I will start working on Core Update 166. For personal reasons, I currently lack oversight over my available for the project in March, and will assign Core Update 166 to somebody else if I cannot take properly care of it. While this sounds a bit rush and complex (to myself as well), I think it is worth a try. After all, I consider these dates being rough deadlines, and anything major will (have to) be an exception to this schedule. Just let's see how it works this time... :-) As always, feel free to drop me a line in case of any questions/trouble/etc. Also, it would be great if there could be some more people on this list reviewing patches; some of the 203 patches currently tracked in https://patchwork.ipfire.org/project/ipfire/list/ have not been reviewed yet. Thanks, and best regards, Peter Müller

3 3

Make IPFire 2 build on riscv64
by Michael Tremer 23 Feb '22

23 Feb '22

Hello everyone, this is as promised the patchset that makes IPFire build on (an emulated) riscv64 platform. As stated in my previous email, this is not ready for primetime since we do not have any hardware, nor are we expecting any in the very near future. For that reason, I was toying around with this and wanted to know whether this builds and get a feeling for this architecture. Rootfiles for some packages - including the kernel - are missing, which is why the generated won't boot at all. This is not a problem since we don't have any hardware, but I wanted to note this. Please merge this. There is very little chance this would break anything. -Michael

2 53

[PATCH] vpnmain.cgi: Select Curve 25519 as default
by Michael Tremer 23 Feb '22

23 Feb '22

This was supposed to be enabled by default. Due to a copy-and-paste error, it was, however, not selected for IKE, but only for ESP. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- html/cgi-bin/vpnmain.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index fb0af104f..3652627e9 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -2360,7 +2360,7 @@ END #use default advanced value $cgiparams{'IKE_ENCRYPTION'} = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18]; $cgiparams{'IKE_INTEGRITY'} = 'sha2_512|sha2_256'; #[19]; - $cgiparams{'IKE_GROUPTYPE'} = 'curve448|curve448|4096|3072|2048'; #[20]; + $cgiparams{'IKE_GROUPTYPE'} = 'curve448|curve25519|4096|3072|2048'; #[20]; $cgiparams{'IKE_LIFETIME'} = '3'; #[16]; $cgiparams{'ESP_ENCRYPTION'} = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21]; $cgiparams{'ESP_INTEGRITY'} = 'sha2_512|sha2_256'; #[22]; -- 2.30.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2022