Development October 2023

development@lists.ipfire.org

11 participants
36 discussions

[PATCH] unbound-dhcp-leases-bridge: Reload unbound to import leases
by Michael Tremer 26 Oct '23

26 Oct '23

This changes the old "diff" algorithm that we needed to have before Unbound was able to reload its own configuration. Now, it can do this even without dropping the cache. This should hopefully perform much better and be more reliable than the old way. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/unbound/unbound-dhcp-leases-bridge | 52 ++++------------------- 1 file changed, 8 insertions(+), 44 deletions(-) diff --git a/config/unbound/unbound-dhcp-leases-bridge b/config/unbound/unbound-dhcp-leases-bridge index e89e0446b..e9f022aff 100644 --- a/config/unbound/unbound-dhcp-leases-bridge +++ b/config/unbound/unbound-dhcp-leases-bridge @@ -514,56 +514,19 @@ class UnboundConfigWriter(object): def __init__(self, path): self.path = path - self._cached_leases = [] - def update_dhcp_leases(self, leases): - # Find any leases that have expired or do not exist any more - # but are still in the unbound local data - removed_leases = [l for l in self._cached_leases if not l in leases] - - # Find any leases that have been added - new_leases = [l for l in leases if l not in self._cached_leases] - - # End here if nothing has changed - if not new_leases and not removed_leases: - return - # Write out all leases self.write_dhcp_leases(leases) - # Update unbound about changes - for l in removed_leases: - try: - for name, ttl, type, content in l.rrset: - log.debug("Removing records for %s" % name) - self._control("local_data_remove", name) - - # If the lease cannot be removed we will try the next one - except: - continue - - # If the removal was successful, we will remove it from the cache - else: - self._cached_leases.remove(l) - - for l in new_leases: - try: - for rr in l.rrset: - log.debug("Adding new record %s" % " ".join(rr)) - self._control("local_data", *rr) - - # If the lease cannot be added we will try the next one - except: - continue + log.debug("Reloading Unbound...") - # Add lease to cache when successfully added - else: - self._cached_leases.append(l) + # Reload the configuration without dropping the cache + self._control("reload_keep_cache") def write_dhcp_leases(self, leases): - with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: - filename = f.name + log.debug("Writing DHCP leases...") + with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: for l in leases: for rr in l.rrset: f.write("local-data: \"%s\"\n" % " ".join(rr)) @@ -571,7 +534,8 @@ class UnboundConfigWriter(object): # Make file readable for everyone os.fchmod(f.fileno(), stat.S_IRUSR|stat.S_IWUSR|stat.S_IRGRP|stat.S_IROTH) - os.rename(filename, self.path) + # Move the file to its destination + os.rename(f.name, self.path) def _control(self, *args): command = ["unbound-control"] @@ -585,7 +549,7 @@ class UnboundConfigWriter(object): log.critical("Could not run %s, error code: %s: %s" % ( " ".join(command), e.returncode, e.output)) - raise + raise e if __name__ == "__main__": -- 2.39.2

3 2

Question regarding the forthcoming default firewall rule patch
by Peter Müller 26 Oct '23

26 Oct '23

Hello Michael, hello *, for the forthcoming patch, which introduces a firewall rule for rejecting TCP connections to destination port 25 on RED from all internal networks on new installations only, I'd like to clarify upfront what resource the rules' comment should link to, if any. This could be a blog post by us, which would only go live shortly before the release of the Core Update this patch is merged into, so it will be a dead link at the time of patch submission. Otherwise, linking to our wiki would work as well, or we can refer to the M3AAWG recommendation on this topic (https://www.m3aawg.org/Port25_IPNetworks) straight away. Do you have any preferences? Thanks, and best regards, Peter Müller (crawls back into the sewers)

2 1

[PATCH 1/2] kernel: update to 6.1.58
by Arne Fitzenreiter 21 Oct '23

21 Oct '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.riscv64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- lfs/linux | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index c69c13e71..3e9366cd7 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.57-ipfire Kernel Configuration +# Linux/arm64 6.1.58-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index aafcbba7b..c0551f876 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/riscv 6.1.57-ipfire Kernel Configuration +# Linux/riscv 6.1.58-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index da8dcad00..45fd2b76e 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.57-ipfire Kernel Configuration +# Linux/x86 6.1.58-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.2.0" CONFIG_CC_IS_GCC=y diff --git a/lfs/linux b/lfs/linux index 18e55f814..e84fac01b 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 6.1.57 +VER = 6.1.58 ARM_PATCHES = 6.1.y-ipfire2 THISAPP = linux-$(VER) @@ -75,7 +75,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = 9fd3b4ffdc392d2bedf1b9366fdd773e006c7148756420ae621285874bb2ec9461199871579ba713ce5df1831ace7392969a97f2d5b90b08695f632b97655f9d +$(DL_FILE)_BLAKE2 = 64d90b1be8b75385f3019d4f9e1bf807c7e2b0923d3575abe2ccef05a451b5742719ab6c76bcb03765ab7ea0dd15e8dc372d1841dc3132011cf04512c62b0182 arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 7afc460562fb24bcd75784fc79de768f9b60780aedd88d1a847927169e31920bbb475b1ac1466c4a224a7876d16bd8d465b96202de12b74f6e2ccbfcec731ad3 install : $(TARGET) -- 2.42.0

1 1

Correct installation for kernel modules
by ummeegge 20 Oct '23

20 Oct '23

Hi all, wanted to open a testing scenario for the OpenVPN data channel offload (DCO) --> https://github.com/OpenVPN/openvpn/blob/master/README.dco.md kernel module. So far i have been used this LFS --> https://git.ipfire.org/?p=people/ummeegge/ipfire-2.x.git;a=blob;f=lfs/ovpn-… but i wanted to ask for a proper or correct way, in special the installation paths of such modules but in general if i can handle it in such way. Best, Erik

2 4

[PATCH] suricata: Update to 6.0.15
by Matthias Fischer 20 Oct '23

20 Oct '23

Excerpt from changelog: "6.0.15 -- 2023-10-18 Security #6363: mime: quadratic complexity in MimeDecAddEntity (6.0.x backport) Bug #6407: email: disabled fields in suricata.yaml also get logged (6.0.x backport) Bug #6403: detect: multi-level tunneling inspection fails (6.0.x backport) Bug #6377: byte_jump with negative post_offset before start of buffer failure (6.0.x backport) Task #6364: decode: add drop reason for stream reassembly memcap (6.0.x backport)" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/suricata b/lfs/suricata index 5e16d1ac0..2e71ba49d 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 6.0.14 +VER = 6.0.15 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7e14f16f04bdd632d26f4249c328ea918cc4edf96cc07be6a92722d4457353a36662e0041fd2b9669a104deaa010a093cb8195eb2604ed8145ab38f93a8b7124 +$(DL_FILE)_BLAKE2 = cf5c2d5760e52f0b4eb0276feb89e056d74ef5478e3158a047fbdec14022aa6e0ba986b7ee9f9ec49e2ebb3f206c7d71ad8ce8dc4eb9a6b48b4ba38c96c2f1c6 install : $(TARGET) -- 2.34.1

2 1

[PATCH] apache: Update to 2.4.58
by Matthias Fischer 19 Oct '23

19 Oct '23

For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.58 Excerpt from changelog: "Changes with Apache 2.4.58 *) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST (cve.mitre.org) When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue. Credits: Will Dormann of Vul Labs *) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 (cve.mitre.org) An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. Credits: Prof. Sven Dietrich (City University of New York) *) SECURITY: CVE-2023-31122: mod_macro buffer over-read (cve.mitre.org) Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. Credits: David Shoon (github/davidshoon)" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/apache2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index 80462969b..9a0ad38a9 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.4.57 +VER = 2.4.58 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = b33b51a741acd308ef4d4bdd2444d43eca9db68676fa67ec907eeea7384554f3f9a5608fc43dcf5819498264bbe36f176f30be9809474307642b70720036b88c +$(DL_FILE)_BLAKE2 = 2105b8fada99f1dda55201ed89ed5326f0edb078d352cbff44f02cde80d129b65b63e07366a9a744ba474be5687fa8d3d2d8ddc64ac914b47166607f3f4a9de2 install : $(TARGET) -- 2.34.1

2 1

[PATCH] samba: Update to 4.19.2
by Matthias Fischer 19 Oct '23

19 Oct '23

For details see: v4.19.1. => https://www.samba.org/samba/history/samba-4.19.1.html " ============================== Release Notes for Samba 4.19.1 October 10, 2023 ============================== This is a security release in order to address the following defects: o CVE-2023-3961: Unsanitized pipe names allow SMB clients to connect as root to existing unix domain sockets on the file system. https://www.samba.org/samba/security/CVE-2023-3961.html o CVE-2023-4091: SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting "acl_xattr:ignore system acls = yes" https://www.samba.org/samba/security/CVE-2023-4091.html o CVE-2023-4154: An RODC and a user with the GET_CHANGES right can view all attributes, including secrets and passwords. Additionally, the access check fails open on error conditions. https://www.samba.org/samba/security/CVE-2023-4154.html o CVE-2023-42669: Calls to the rpcecho server on the AD DC can request that the server block for a user-defined amount of time, denying service. https://www.samba.org/samba/security/CVE-2023-42669.html o CVE-2023-42670: Samba can be made to start multiple incompatible RPC listeners, disrupting service on the AD DC. https://www.samba.org/samba/security/CVE-2023-42670.html" v4.19.2 => https://www.samba.org/samba/history/samba-4.19.2.html "Changes since 4.19.1 -------------------- o Jeremy Allison <jra(a)samba.org> * BUG 15423: Use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE. * BUG 15426: clidfs.c do_connect() missing a "return" after a cli_shutdown() call. o Ralph Boehme <slow(a)samba.org> * BUG 15463: macOS mdfind returns only 50 results. o Volker Lendecke <vl(a)samba.org> * BUG 15481: GETREALFILENAME_CACHE can modify incoming new filename with previous cache entry value. o Stefan Metzmacher <metze(a)samba.org> * BUG 15464: libnss_winbind causes memory corruption since samba-4.18, impacts sendmail, zabbix, potentially more. o Martin Schwenke <mschwenke(a)ddn.com> * BUG 15479: ctdbd: setproctitle not initialized messages flooding logs. o Joseph Sutton <josephsutton(a)catalyst.net.nz> * BUG 15491: CVE-2023-5568 Heap buffer overflow with freshness tokens in the Heimdal KDC in Samba 4.19 * BUG 15477: The heimdal KDC doesn't detect s4u2self correctly when fast is in use." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/x86_64/samba | 1 - lfs/samba | 6 +++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/x86_64/samba b/config/rootfiles/packages/x86_64/samba index 4e5cee3a8..7a44b9cdb 100644 --- a/config/rootfiles/packages/x86_64/samba +++ b/config/rootfiles/packages/x86_64/samba @@ -923,7 +923,6 @@ usr/libexec/samba/rpcd_epmapper usr/libexec/samba/rpcd_fsrvp usr/libexec/samba/rpcd_lsad usr/libexec/samba/rpcd_mdssvc -usr/libexec/samba/rpcd_rpcecho usr/libexec/samba/rpcd_spoolss usr/libexec/samba/rpcd_winreg usr/libexec/samba/samba-bgqd diff --git a/lfs/samba b/lfs/samba index 77bb569cd..2f2184ecc 100644 --- a/lfs/samba +++ b/lfs/samba @@ -24,7 +24,7 @@ include Config -VER = 4.19.0 +VER = 4.19.2 SUMMARY = A SMB/CIFS File, Print, and Authentication Server THISAPP = samba-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 96 +PAK_VER = 97 DEPS = avahi cups perl-Parse-Yapp perl-JSON @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4e0db41d7d06e195cee994c5ec02a37892c1a7dd99ea9defb845fe2fbf96446846c469007218b6b0d6077c0886f0d08b2a4376acba1ed455b641daacd9018f12 +$(DL_FILE)_BLAKE2 = cb3747f1be6e712c6e68f3720e68aee7db2e4dcc48a9210d002337d6690ed8b027919f333dc4a7c1e74b716ebceeff1d8071463899513edfe51da967d71d8148 install : $(TARGET) -- 2.34.1

2 1

[PATCH] en.pl: Correction of typo
by Adolf Belka 16 Oct '23

16 Oct '23

- This error means that a section in extrahd.cgi about the mount path being incorrect does not get shown for users with english language selected. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- doc/language_issues.en | 4 ++-- doc/language_issues.es | 2 +- doc/language_issues.fr | 2 +- doc/language_issues.it | 2 +- doc/language_issues.nl | 3 +-- doc/language_issues.pl | 2 +- doc/language_issues.ru | 2 +- doc/language_issues.tr | 2 +- doc/language_missings | 16 +++++++--------- langs/en/cgi-bin/en.pl | 2 +- 10 files changed, 17 insertions(+), 20 deletions(-) diff --git a/doc/language_issues.en b/doc/language_issues.en index 70eb9fbe8..c9d1117ef 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -617,7 +617,7 @@ WARNING: untranslated string: disk access = Disk Access WARNING: untranslated string: disk usage = Disk usage WARNING: untranslated string: display = Display WARNING: untranslated string: display hostname in window title = Display hostname in window title -WARNING: untranslated string: dl client arch = Download Client Package (zip) +WARNING: untranslated string: dl client arch = Download Encrypted Client Package (zip) WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip) WARNING: untranslated string: dmz = DMZ WARNING: untranslated string: dnat address = Firewall Interface @@ -752,7 +752,7 @@ WARNING: untranslated string: exclude logfiles = Exclude logfiles WARNING: untranslated string: expires = Expires WARNING: untranslated string: export = Export WARNING: untranslated string: external aliases configuration = External aliases configuration -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd because there is already a device mounted = , because there is already a device mounted WARNING: untranslated string: extrahd cant umount = Can't umount WARNING: untranslated string: extrahd detected drives = detected drives diff --git a/doc/language_issues.es b/doc/language_issues.es index 45ffdf5d7..8bb0b56fb 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -952,7 +952,7 @@ WARNING: untranslated string: downfall gather data sampling = Downfall/Gather Da WARNING: untranslated string: enable disable client = unknown string WARNING: untranslated string: enable disable dyndns = unknown string WARNING: untranslated string: error message = unknown string -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd mounted = Mounted WARNING: untranslated string: extrahd no mount point given = No mount point given WARNING: untranslated string: extrahd not configured = Not configured diff --git a/doc/language_issues.fr b/doc/language_issues.fr index cacfb1ec6..6805c1eb9 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -911,7 +911,7 @@ WARNING: untranslated string: downfall gather data sampling = Downfall/Gather Da WARNING: untranslated string: enable disable client = unknown string WARNING: untranslated string: enable disable dyndns = unknown string WARNING: untranslated string: error message = unknown string -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd mounted = Mounted WARNING: untranslated string: extrahd no mount point given = No mount point given WARNING: untranslated string: extrahd not configured = Not configured diff --git a/doc/language_issues.it b/doc/language_issues.it index 68ff12c86..bb1d5db96 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -1004,7 +1004,7 @@ WARNING: untranslated string: eol architecture warning = You are running an arch WARNING: untranslated string: error = Error WARNING: untranslated string: error message = unknown string WARNING: untranslated string: error the to date has to be later than the from date = The to date has to be later than the from date! -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd mounted = Mounted WARNING: untranslated string: extrahd no mount point given = No mount point given WARNING: untranslated string: extrahd not configured = Not configured diff --git a/doc/language_issues.nl b/doc/language_issues.nl index ea0abc74c..b85619977 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -953,7 +953,6 @@ WARNING: untranslated string: dhcp fixed ip address in dynamic range = Fixed IP WARNING: untranslated string: dhcp make fixed lease = Add to fix leases WARNING: untranslated string: disable = Disable WARNING: untranslated string: disconnected = Disconnected -WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip) WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search @@ -1010,7 +1009,7 @@ WARNING: untranslated string: eol architecture warning = You are running an arch WARNING: untranslated string: error = Error WARNING: untranslated string: error message = unknown string WARNING: untranslated string: error the to date has to be later than the from date = The to date has to be later than the from date! -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd mounted = Mounted WARNING: untranslated string: extrahd no mount point given = No mount point given WARNING: untranslated string: extrahd not configured = Not configured diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 893f73211..d88e3fb8e 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -997,7 +997,7 @@ WARNING: untranslated string: eol architecture warning = You are running an arch WARNING: untranslated string: error = Error WARNING: untranslated string: error message = unknown string WARNING: untranslated string: error the to date has to be later than the from date = The to date has to be later than the from date! -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd because there is already a device mounted = , because there is already a device mounted WARNING: untranslated string: extrahd cant umount = Can't umount WARNING: untranslated string: extrahd install or load driver = If your device isn't listed here, you need to install or load the driver.<br />If you can see your device but no partitions you have to create them first. diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 64c9b5095..22e06460c 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -994,7 +994,7 @@ WARNING: untranslated string: eol architecture warning = You are running an arch WARNING: untranslated string: error = Error WARNING: untranslated string: error message = unknown string WARNING: untranslated string: error the to date has to be later than the from date = The to date has to be later than the from date! -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd because there is already a device mounted = , because there is already a device mounted WARNING: untranslated string: extrahd cant umount = Can't umount WARNING: untranslated string: extrahd install or load driver = If your device isn't listed here, you need to install or load the driver.<br />If you can see your device but no partitions you have to create them first. diff --git a/doc/language_issues.tr b/doc/language_issues.tr index eadbd33c7..0d9514083 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -967,7 +967,7 @@ WARNING: untranslated string: eol architecture warning = You are running an arch WARNING: untranslated string: error = Error WARNING: untranslated string: error message = unknown string WARNING: untranslated string: error the to date has to be later than the from date = The to date has to be later than the from date! -WARNING: untranslated string: extrahd because it is outside the allowed mount path = unknown string +WARNING: untranslated string: extrahd because it is outside the allowed mount path = , because it is outside the allowed mount path WARNING: untranslated string: extrahd mounted = Mounted WARNING: untranslated string: extrahd no mount point given = No mount point given WARNING: untranslated string: extrahd not configured = Not configured diff --git a/doc/language_missings b/doc/language_missings index 6eb960f62..4d8f4a2a9 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -55,7 +55,6 @@ < download apple profile < enable < error the to date has to be later than the from date -< extrahd because it it outside the allowed mount path < g.dtm < g.lite < ids automatic rules update @@ -108,7 +107,7 @@ < dhcp fixed ip address in dynamic range < dns servers < downfall gather data sampling -< extrahd because it it outside the allowed mount path +< extrahd because it is outside the allowed mount path < extrahd mounted < extrahd no mount point given < extrahd not configured @@ -131,7 +130,7 @@ < bewan adsl pci st < bewan adsl usb < downfall gather data sampling -< extrahd because it it outside the allowed mount path +< extrahd because it is outside the allowed mount path < extrahd mounted < extrahd no mount point given < extrahd not configured @@ -327,7 +326,7 @@ < eol architecture warning < error < error the to date has to be later than the from date -< extrahd because it it outside the allowed mount path +< extrahd because it is outside the allowed mount path < extrahd mounted < extrahd no mount point given < extrahd not configured @@ -785,7 +784,6 @@ < disable < Disabled < disconnected -< dl client arch insecure < dns check servers < dns configuration < dns could not add server @@ -847,7 +845,7 @@ < eol architecture warning < error < error the to date has to be later than the from date -< extrahd because it it outside the allowed mount path +< extrahd because it is outside the allowed mount path < extrahd mounted < extrahd no mount point given < extrahd not configured @@ -1474,7 +1472,7 @@ < eol architecture warning < error < error the to date has to be later than the from date -< extrahd because it it outside the allowed mount path +< extrahd because it is outside the allowed mount path < extrahd because there is already a device mounted < extrahd cant umount < extrahd install or load driver @@ -2464,7 +2462,7 @@ < eol architecture warning < error < error the to date has to be later than the from date -< extrahd because it it outside the allowed mount path +< extrahd because it is outside the allowed mount path < extrahd because there is already a device mounted < extrahd cant umount < extrahd install or load driver @@ -3269,7 +3267,7 @@ < eol architecture warning < error < error the to date has to be later than the from date -< extrahd because it it outside the allowed mount path +< extrahd because it is outside the allowed mount path < extrahd mounted < extrahd no mount point given < extrahd not configured diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 7bbf7cd32..02cf1bf4b 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1073,7 +1073,7 @@ 'external access rule removed' => ' External access rule removed; restarting access controller', 'external aliases configuration' => 'External aliases configuration', 'extrahd' => 'ExtraHD', -'extrahd because it it outside the allowed mount path' => ', because it is outside the allowed mount path', +'extrahd because it is outside the allowed mount path' => ', because it is outside the allowed mount path', 'extrahd because there is already a device mounted' => ', because there is already a device mounted', 'extrahd cant umount' => 'Can\'t umount', 'extrahd detected drives' => 'detected drives', -- 2.42.0

2 1

[PATCH] backup.pl: Fix for bug#11048 - add script for adding pass/no pass to ovpnconfig from backup
by Adolf Belka 15 Oct '23

15 Oct '23

- A script was added to the update.sh script to add pass/no pass to the ovpnconfig entries but I forgot that this was also needed in the backup.pl file to add those statuses into any ovpnconfig file restored from a backup before the pass/no pass entries were added. - This patch corrects that oversight. - Confirmed by testing on my vm. Before the script added to backup.pl a restore of older ovpnconfig ended up not showing any icons or status elements. With the script in backup.pl confirmed that the restored ovpnconfig showed up in the WUI page correctly with the right icons and with the status elements correctly displayed. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/backup/backup.pl | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/config/backup/backup.pl b/config/backup/backup.pl index 8d990c0f1..75a0e4f60 100644 --- a/config/backup/backup.pl +++ b/config/backup/backup.pl @@ -205,6 +205,30 @@ restore_backup() { done fi + #Update ovpnconfig to include pass or no-pass for old backup versions missing the entry + # Check if ovpnconfig exists and is not empty + if [ -s /var/ipfire/ovpn/ovpnconfig ]; then + # Add blank line at top of ovpnconfig otherwise the first roadwarrior entry is treated like a blank line and missed out from update + awk 'NR==1{print ""}1' /var/ipfire/ovpn/ovpnconfig > /var/ipfire/ovpn/tmp_file && mv /var/ipfire/ovpn/tmp_file /var/ipfire/ovpn/ovpnconfig + # Make all N2N connections 'no-pass' since they do not use encryption + awk '{FS=OFS=","} {if($5=="net") {$43="no-pass"; print $0}}' /var/ipfire/ovpn/ovpnconfig >> /var/ipfire/ovpn/ovpnconfig.new + # Evaluate roadwarrior connection names for *.p12 files + for y in $(awk -F',' '/host/ { print $3 }' /var/ipfire/ovpn/ovpnconfig); do + # Sort all unencrypted roadwarriors out and set 'no-pass' in [43] index + if [[ -n $(openssl pkcs12 -info -in /var/ipfire/ovpn/certs/${y}.p12 -noout -password pass:'' 2>&1 | grep 'Encrypted data') ]]; then + awk -v var="$y" '{FS=OFS=","} {if($3==var) {$43="no-pass"; print $0}}' /var/ipfire/ovpn/ovpnconfig >> /var/ipfire/ovpn/ovpnconfig.new + fi + # Sort all encrypted roadwarriors out and set 'pass' in [43] index + if [[ -n $(openssl pkcs12 -info -in /var/ipfire/ovpn/certs/${y}.p12 -noout -password pass:'' 2>&1 | grep 'verify error') ]]; then + awk -v var="$y" '{FS=OFS=","} {if($3==var) {$43="pass"; print $0}}' /var/ipfire/ovpn/ovpnconfig >> /var/ipfire/ovpn/ovpnconfig.new + fi + done + fi + # Replace existing ovpnconfig with updated index + mv /var/ipfire/ovpn/ovpnconfig.new /var/ipfire/ovpn/ovpnconfig + # Set correct ownership + chown nobody:nobody /var/ipfire/ovpn/ovpnconfig + return 0 } -- 2.42.0

1 0

[PATCH 1/2] linux: Disable io_uring
by Peter Müller 14 Oct '23

14 Oct '23

This subsystem has been a frequent source of security vulnerabilities affecting the Linux kernel; as a result, Google announced on June 14, 2023, that they would disable it in their environment as widely as possible. IPFire does not depend on the availability of io_uring. Therefore, disable this subsystem as well in order to preemptively cut attack surface. See also: https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.h… Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 3 +-- config/kernel/kernel.config.x86_64-ipfire | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 96944c3d5..0d7c1ba8a 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -229,7 +229,7 @@ CONFIG_TIMERFD=y CONFIG_EVENTFD=y CONFIG_SHMEM=y CONFIG_AIO=y -CONFIG_IO_URING=y +# CONFIG_IO_URING is not set CONFIG_ADVISE_SYSCALLS=y CONFIG_MEMBARRIER=y CONFIG_KALLSYMS=y @@ -7824,7 +7824,6 @@ CONFIG_NLS_MAC_TURKISH=m CONFIG_NLS_UTF8=m # CONFIG_DLM is not set # CONFIG_UNICODE is not set -CONFIG_IO_WQ=y # end of File systems # diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 129e0d209..48fdbd8ff 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -249,7 +249,7 @@ CONFIG_TIMERFD=y CONFIG_EVENTFD=y CONFIG_SHMEM=y CONFIG_AIO=y -CONFIG_IO_URING=y +# CONFIG_IO_URING is not set CONFIG_ADVISE_SYSCALLS=y CONFIG_MEMBARRIER=y CONFIG_KALLSYMS=y @@ -7047,7 +7047,6 @@ CONFIG_DLM=m # CONFIG_DLM_DEPRECATED_API is not set # CONFIG_DLM_DEBUG is not set # CONFIG_UNICODE is not set -CONFIG_IO_WQ=y # end of File systems # -- 2.35.3

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development October 2023