Core Update 146 (testing) report

["Peter Müller" <peter.mueller@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2449 bytes --]

Hello *,

upcoming Core Update 146 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-146-is-available-for-testing)
is running here for about 24 hours without any unexpected behaviour so far.

Tested IPFire functionalities in detail:
- IPsec (N2N connections only)
- Squid (authentication enabled, using an upstream proxy)
- OpenVPN (RW connections only)
- IPS/Suricata (with Emerging Threats ruleset enabled)
- Guardian
- Quality of Service
- DNS (with DNS over TLS and strict QNAME minimisation)
- Tor (relay mode)

Compared to Core Update 145, this update uses a little bit less RAM than it did
before, but this is merely academic and probably not noticeable on most systems.

Looking at /var/log/boot.log, this line looks strange to me, but was already present
before this update - just for your information:

> [    5.763783] udevd[572]: ignoring invalid mode '@DEV_KVM_MODE@'

I would like to take this opportunity to apologise to Arne for the poor quality
of most of the Kernel hardening patches. They were written in a hurry to get them
ready for this update, and I am sorry about their quality in retrospective.

Anyway, some security improvements made it into Core Update 146, and adding them
one at a time seems to make sense more to me. I look forward to the release of this
Core Update.

Technical details for the records:

> [root(a)maverick ~]# uname -a
> Linux maverick 4.14.184-ipfire #1 SMP Thu Jun 18 14:30:42 GMT 2020 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux

> [root(a)maverick ~]# grep . /sys/devices/system/cpu/vulnerabilities/*
> /sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
> /sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
> /sys/devices/system/cpu/vulnerabilities/mds:Mitigation: Clear CPU buffers; SMT disabled
> /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
> /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected
> /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
> /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling
> /sys/devices/system/cpu/vulnerabilities/srbds:Not affected
> /sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected

Thanks, and best regards,
Peter Müller