Development August 2022

development@lists.ipfire.org

13 participants
74 discussions

Time is running out for 32-bit ARM
by Peter Müller 14 Aug '22

14 Aug '22

Hello *, in January [1], we already discussed the situation of 32-bit ARM, and settled on demoting this architecture as "legacy" on [2], and advising people from buying new 32-bit ARM hardware in the wiki. To some extends, this architecture shares a similar fate than 32-bit Intel did: Security features are not backported to it, maintenance requires a lot of effort due to missing upstream support, hardware base is diminishing, and its IPFire userbase does not justify the resources required for keeping the distribution reasonably maintained on this architecture. The other night, we have therefore agreed on putting an end to IPFire support for 32-bit ARM, and take the question of the anticipated timeframe to this mailing list. [3] At the time of writing, Fireinfo reports 0.94% of all IPFire installations to run on supported 32-bit ARM devices, to give you a figure. [4] Personally, since these devices are unlikely to run in enterprises or other critical environments, I would be fine with announcing EOL for 32-bit ARM at the end of this year. However, as I am not running any affected IPFire installations, my opinion is biased - let's hear yours. :-) Thanks in advance for your reply, and best regards, Peter Müller [1] https://wiki.ipfire.org/devel/telco/2022-01-03 [2] https://www.ipfire.org/download [3] https://wiki.ipfire.org/devel/telco/2022-08-01 [4] https://fireinfo.ipfire.org/

3 7

[PATCH] index.cgi: Show deprecation warning for armv6l
by Michael Tremer 14 Aug '22

14 Aug '22

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- html/cgi-bin/index.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi index 6fecae1ff..5c384fd49 100644 --- a/html/cgi-bin/index.cgi +++ b/html/cgi-bin/index.cgi @@ -543,7 +543,7 @@ if ( ! -e "/var/ipfire/main/send_profile") { # EOL architecture my ($sysname, $nodename, $release, $version, $machine) = &POSIX::uname(); -if ($machine =~ m/^i.86$/) { +if ($machine =~ m/^arm/) { $warnmessage .= "<li><a href='https://wiki.ipfire.org/hardware/requirements' style='color:white;'>$Lang::tr{'eol architecture warning'}</a></li>"; } -- 2.30.2

2 1

[PATCH] go: Fix filename for x86_64
by Michael Tremer 12 Aug '22

12 Aug '22

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/go b/lfs/go index f9b436ce2..991427f3e 100644 --- a/lfs/go +++ b/lfs/go @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) go$(VER).$(GOOS)-arm64.tar.gz_BLAKE2 = ef1708965bcd415fdad498e27729d0259f83e16a542f37dae1fb70f71127dfa0cb8570e4896474e6a94bb461e16ff8000e8072bc731c637fce5f384227359e14 -go$(VER).$(GOOS)-x86_64.tar.gz_BLAKE2 = d200046147e31fac1a754fc34ac4a5043414a1d6e90aa3387c933c395acede0b8d5b797affaa85c2188af4d15566b4fcd08108350fe73ed90b1c305600c655c9 +go$(VER).$(GOOS)-amd64.tar.gz_BLAKE2 = d200046147e31fac1a754fc34ac4a5043414a1d6e90aa3387c933c395acede0b8d5b797affaa85c2188af4d15566b4fcd08108350fe73ed90b1c305600c655c9 install : $(TARGET) -- 2.30.2

2 1

Go for aarch64 broke the nightly builds
by Peter Müller 12 Aug '22

12 Aug '22

Hello Michael, I regret to inform you that https://patchwork.ipfire.org/project/ipfire/patch/20220808202824.1120321-1-… broke the nightly builds on x86_64 and aarch64. Since the checksum of the respective Go tarball is fine, please have a look and fix whatever needs a fix on this end. Thanks in advance, and best regards, Peter Müller

2 2

[PATCH 1/2] mpd: Add fmt as a run time dependency
by Adolf Belka 11 Aug '22

11 Aug '22

Fixes: Bug#12909 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/mpd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/mpd b/lfs/mpd index e4381fc1b..9e664bf41 100644 --- a/lfs/mpd +++ b/lfs/mpd @@ -34,10 +34,10 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/${THISAPP} TARGET = $(DIR_INFO)/$(THISAPP) PROG = mpd -PAK_VER = 25 +PAK_VER = 26 SUP_ARCH = aarch64 armv6l x86_64 -DEPS = alsa avahi faad2 ffmpeg flac lame libmad libshout libogg libid3tag libvorbis opus soxr +DEPS = alsa avahi faad2 ffmpeg flac lame libmad libshout libogg libid3tag libvorbis opus soxr fmt SERVICES = mpd -- 2.37.1

2 3

[PATCH] cdrom: Rename ISO file
by Michael Tremer 11 Aug '22

11 Aug '22

This is cosmetic change to have the name of the ISO file similar to the flash image and also have all parts of it in a reasonable order. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/cdrom | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lfs/cdrom b/lfs/cdrom index ff4821fb5..a47faa49e 100644 --- a/lfs/cdrom +++ b/lfs/cdrom @@ -123,6 +123,8 @@ GRUB_EFI_MODULES = \ true \ usb_keyboard +ISO_FILE = /install/images/$(SNAME)-$(VERSION)-core$(CORE)-$(BUILD_ARCH).iso + ############################################################################### # Top-level Rules ############################################################################### @@ -246,9 +248,8 @@ endif xargs md5sum > md5sum.txt mkdir -p /install/images - cd $(DIR_TMP)/cdrom && mkisofs $(ISO_ARGS) \ - -o /install/images/$(SNAME)-$(VERSION).$(BUILD_ARCH)-full-core$(CORE).iso . + cd $(DIR_TMP)/cdrom && mkisofs $(ISO_ARGS) -o $(ISO_FILE) . ifeq "$(HAS_ISOLINUX)" "1" - isohybrid $(ISOHYBRID_ARGS) /install/images/$(SNAME)-$(VERSION).$(BUILD_ARCH)-full-core$(CORE).iso + isohybrid $(ISOHYBRID_ARGS) $(ISO_FILE) endif -- 2.30.2

2 1

[PATCH] vpnmain.cgi: Mark MODP-1536 as broken, phase out MODP-2048
by Peter Müller 11 Aug '22

11 Aug '22

https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf (released in 2015) recommends "to use primes of 2048 bits or larger", to which BSI's techical guideline BSI-TR-02102 (https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Technisch…) concurs. The latter also recommends not to use DH groups comprising of less than 2000 bits after 2022, and shift to 3000 bit DH groups earlier as a precaution. According to RFC 3526, section 8, MODP-1536 provides an estimated security between 90 and 120 bits, a value that can be reasonably considered broken today, as it has been so for other types of cryptographic algorithms already, and per section 2.4 in the aforementioned paper, breaking 1024-bit DH is considered feasible for the NSA in 2015, which does not inspire confidence for MODP-1536 in 2022. Therefore, this patch suggests to mark MODP-1536 as broken, since it de facto is, and tag MODP-2048 as weak. The latter is also removed from the default selection, so newly created VPN connections won't use it anymore, to follow BSI's recommendations of using DH groups >= 3000 bits in 2022 and later. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- html/cgi-bin/vpnmain.cgi | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 3652627e9..9828b2f9e 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -2360,11 +2360,11 @@ END #use default advanced value $cgiparams{'IKE_ENCRYPTION'} = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18]; $cgiparams{'IKE_INTEGRITY'} = 'sha2_512|sha2_256'; #[19]; - $cgiparams{'IKE_GROUPTYPE'} = 'curve448|curve25519|4096|3072|2048'; #[20]; + $cgiparams{'IKE_GROUPTYPE'} = 'curve448|curve25519|4096|3072'; #[20]; $cgiparams{'IKE_LIFETIME'} = '3'; #[16]; $cgiparams{'ESP_ENCRYPTION'} = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21]; $cgiparams{'ESP_INTEGRITY'} = 'sha2_512|sha2_256'; #[22]; - $cgiparams{'ESP_GROUPTYPE'} = 'curve448|curve25519|4096|3072|2048'; #[23]; + $cgiparams{'ESP_GROUPTYPE'} = 'curve448|curve25519|4096|3072'; #[23]; $cgiparams{'ESP_KEYLIFE'} = '1'; #[17]; $cgiparams{'COMPRESSION'} = 'off'; #[13]; $cgiparams{'ONLY_PROPOSED'} = 'on'; #[24]; @@ -3146,8 +3146,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || <option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option> <option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option> <option value='3072' $checked{'IKE_GROUPTYPE'}{'3072'}>MODP-3072</option> - <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option> - <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option> + <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048 ($Lang::tr{'vpn weak'})</option> + <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536 ($Lang::tr{'vpn broken'})</option> <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option> <option value='768' $checked{'IKE_GROUPTYPE'}{'768'}>MODP-768 ($Lang::tr{'vpn broken'})</option> </select> @@ -3169,8 +3169,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || <option value='6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</option> <option value='4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</option> <option value='3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</option> - <option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</option> - <option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</option> + <option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048 ($Lang::tr{'vpn weak'})</option> + <option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536 ($Lang::tr{'vpn broken'})</option> <option value='1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option> <option value='768' $checked{'ESP_GROUPTYPE'}{'768'}>MODP-768 ($Lang::tr{'vpn broken'})</option> <option value='none' $checked{'ESP_GROUPTYPE'}{'none'}>- $Lang::tr{'none'} -</option> -- 2.35.3

2 9

Some packages in need of an update
by Peter Müller 10 Aug '22

10 Aug '22

Hello Adolf, hello * (to keep anybody else working on package updates in the loop), for good measure, I just wanted to let you know that ... (a) Michael is working on a glibc update, which includes binutils, so please do not worry about these, should they already have appeared on your radar. (b) if you have time and capacity, curl, elfutils and udev are in need of an update. As for the latter, its source code can be retrieved from https://github.com/eudev-project/eudev/releases/tag/v3.2.11, which is more straight-forward than extracting udev from systemd (which is a bit of a mess). None of these are pressing though, so there is no rush whatsoever. :-) Thanks to a plethora of non-IPFire commitments I have in the following weeks, I won't have time to work on package updates, and would rather focus on fixing some bugs that have been assigned to me quite a while ago. Feel free to coordinate package updates with the usual suspects (Matthias?), however. As always, thanks for all the work, and have a nice rest of the weekend! All the best, Peter Müller P.S.: The only exception to my promise above is probably linux-firmware, but I am not sure if it will fit into Core Update 171, given that this update comes with a new toolchain and something larger such as Perl, so there probably won't be sufficient space left.

2 1

[PATCH] flash-images: Drop 2gb-ext4 from image filename
by Michael Tremer 10 Aug '22

10 Aug '22

This is now being dropped since the image won't fit onto a 2GB device any more and since there is only one type of image, we don't need to state the filesystem type. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/flash-images | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/flash-images b/lfs/flash-images index b4fde8dd9..af78f5de9 100644 --- a/lfs/flash-images +++ b/lfs/flash-images @@ -36,7 +36,7 @@ ifeq "$(EFI)" "1" endif PART_ROOT = /dev/mapper/$(patsubst /dev/%,%,$(DEVICE))p3 -IMAGE_FILE = /install/images/$(SNAME)-$(VERSION).2gb-ext4.$(BUILD_ARCH)-full-core$(CORE).img.xz +IMAGE_FILE = /install/images/$(SNAME)-$(VERSION)-core$(CORE)-$(BUILD_ARCH).img.xz FSTAB_FMT = UUID=%s %-8s %-4s %-10s %d %d\n -- 2.30.2

3 2

Core Update 170 testing report - "next/06b4164d" crashes on my x86_64 testing machine
by Peter Müller 09 Aug '22

09 Aug '22

Hello all, especially Arne, today, I upgraded to "IPFire 2.27 - Core Update 170 Development Build: next/06b4164d", which primarily comes with Linux 5.15.59 and the slab cache merging disabled. On my physical testing hardware, the boot process stalled after several kernel trace message blocks being displayed. Unfortunately, I was unable to recover them in detail, but they occurred fairly early, roughly around the mounting of the root file system. Since the machine is semi-productive (we all test in production, don't we? ;-) ), I went back to C169 and will now investigate further which change broke the update. An earlier version of Core Update 170 (commit 668cf4c0d0c2dbbc607716956daace413837a8da, I believe, but it was definitely after the randstruct changes) ran fine for days here, so it must be a pretty recent change. Will keep you updated. Thanks, and best regards, Peter Müller

3 12

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2022