Development March 2017

development@lists.ipfire.org

7 participants
42 discussions

[PATCH 2/2] xinetd: fix the call of INSTALL_INITSCRIPT
by Jonatan Schlag 10 Mar '17

10 Mar '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- lfs/xinetd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/xinetd b/lfs/xinetd index d3b577b..42d9288 100644 --- a/lfs/xinetd +++ b/lfs/xinetd @@ -83,7 +83,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cp -f $(DIR_SRC)/config/xinetd/xinetd.conf /etc/xinetd.conf #install initscripts - $(call INSTALL_INITSCRIPT,nfs-server) + $(call INSTALL_INITSCRIPT,xinetd) @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.1.4

1 0

merge request: initscript cleanup
by Jonatan Schlag 09 Mar '17

09 Mar '17

Hi, this is the merge request to clean up the handling of initscripts in the build process of ipfire 2. Please pull from git://git.ipfire.org/people/jschlag/ipfire-2.x.git initscripts-cleanup to get these changes: - a new macro to install initscripts for packages ($(call INSTALL_INITSCRIPT,*name of the initscript*)) - the initscripts for packages are now stored in /src/initscripts/packages - the initscript for the system are stored in /src/initscripts/system - the rootfile of the the initscript lfs file contain now only the initscripts for the system, the initscript for each package are located in the rootfile of the package This makes maintainering of the initscript in IPFire a lot easier, because the initscripts for teh system and for the packages are better seperated. The new macro makes the lfs files a little bit more cleaner. Thanks in advance, Jonatan

2 3

[PATCH] Midnight Commander: Update to 4.8.19
by Matthias Fischer 08 Mar '17

08 Mar '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/mc | 10 ++++++++++ lfs/mc | 8 ++++---- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/mc b/config/rootfiles/packages/mc index baf8e06ae..820d23333 100644 --- a/config/rootfiles/packages/mc +++ b/config/rootfiles/packages/mc @@ -121,7 +121,13 @@ usr/share/mc/skins/modarin256root-defbg.ini usr/share/mc/skins/modarin256root.ini usr/share/mc/skins/nicedark.ini usr/share/mc/skins/sand256.ini +usr/share/mc/skins/seasons-autumn16M.ini +usr/share/mc/skins/seasons-spring16M.ini +usr/share/mc/skins/seasons-summer16M.ini +usr/share/mc/skins/seasons-winter16M.ini usr/share/mc/skins/xoria256.ini +usr/share/mc/skins/yadt256-defbg.ini +usr/share/mc/skins/yadt256.ini #usr/share/mc/syntax usr/share/mc/syntax/PKGBUILD.syntax usr/share/mc/syntax/Syntax @@ -176,6 +182,8 @@ usr/share/mc/syntax/named.syntax usr/share/mc/syntax/nemerle.syntax usr/share/mc/syntax/nroff.syntax usr/share/mc/syntax/octave.syntax +usr/share/mc/syntax/opencl.syntax +usr/share/mc/syntax/osl.syntax usr/share/mc/syntax/pascal.syntax usr/share/mc/syntax/perl.syntax usr/share/mc/syntax/php.syntax @@ -185,6 +193,7 @@ usr/share/mc/syntax/procmail.syntax usr/share/mc/syntax/properties.syntax usr/share/mc/syntax/puppet.syntax usr/share/mc/syntax/python.syntax +usr/share/mc/syntax/r.syntax usr/share/mc/syntax/ruby.syntax usr/share/mc/syntax/sh.syntax usr/share/mc/syntax/slang.syntax @@ -201,5 +210,6 @@ usr/share/mc/syntax/unknown.syntax usr/share/mc/syntax/verilog.syntax usr/share/mc/syntax/vhdl.syntax usr/share/mc/syntax/xml.syntax +usr/share/mc/syntax/yaml.syntax usr/share/mc/syntax/yum-repo.syntax usr/share/mc/syntax/yxx.syntax diff --git a/lfs/mc b/lfs/mc index d5d57bf1f..1680a9638 100644 --- a/lfs/mc +++ b/lfs/mc @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2016 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.8.18 +VER = 4.8.19 THISAPP = mc-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = mc -PAK_VER = 14 +PAK_VER = 15 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 85ff9279f912c5482fe9f110f8892c96 +$(DL_FILE)_MD5 = 57209d138c0adcb9ea01dfe6bbb4cb87 install : $(TARGET) -- 2.11.0

1 0

[PATCH] DNS: Fall back to permissive mode if recursor mode is unavailable
by Michael Tremer 07 Mar '17

07 Mar '17

The tests when assigning DNS name servers has been extended so that if no working forwarder can be found, we will test if the local recursor mode is an option. If not, we will configure unbound's validator module into permissive mode so that at least some DNS functionality is available. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/core/110/filelists/files | 1 + lfs/unbound | 1 + src/initscripts/init.d/unbound | 67 ++++++++++++++++++++-- ...ting-validator-permissive-mode-at-runtime.patch | 43 ++++++++++++++ 4 files changed, 107 insertions(+), 5 deletions(-) create mode 100644 src/patches/unbound-allow-setting-validator-permissive-mode-at-runtime.patch diff --git a/config/rootfiles/core/110/filelists/files b/config/rootfiles/core/110/filelists/files index 670b9ae..f4ce989 100644 --- a/config/rootfiles/core/110/filelists/files +++ b/config/rootfiles/core/110/filelists/files @@ -1,5 +1,6 @@ etc/system-release etc/issue +etc/rc.d/init.d/unbound srv/web/ipfire/cgi-bin/index.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/libssp.so.0 diff --git a/lfs/unbound b/lfs/unbound index 2b7745c..f361f24 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -70,6 +70,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/unbound-allow-setting-validator-permissive-mode-at-runtime.patch cd $(DIR_APP) && \ ./configure \ --prefix=/usr \ diff --git a/src/initscripts/init.d/unbound b/src/initscripts/init.d/unbound index 8802781..bbf9c00 100644 --- a/src/initscripts/init.d/unbound +++ b/src/initscripts/init.d/unbound @@ -114,17 +114,38 @@ update_forwarders() { echo_warning fi - if [ -n "${broken_forwarders}" -a -z "${forwarders}" ]; then - boot_mesg "Falling back to recursor mode" ${WARNING} - echo_warning - - elif [ -n "${forwarders}" ]; then + if [ -n "${forwarders}" ]; then boot_mesg "Configuring upstream name server(s): ${forwarders:1}" ${INFO} echo_ok + # Make sure DNSSEC is activated + enable_dnssec + echo "${forwarders}" > /var/ipfire/red/dns unbound-control -q forward ${forwarders} return 0 + + # In case we have found no working forwarders + else + # Test if the recursor mode is available + if can_resolve_root +bufsize=${new_edns_buffer_size}; then + # Make sure DNSSEC is activated + enable_dnssec + + boot_mesg "Falling back to recursor mode" ${WARNING} + echo_warning + + # If not, we set DNSSEC in permissive mode and allow using all recursors + elif [ -n "${broken_forwarders}" ]; then + disable_dnssec + + boot_mesg "DNSSEC has been set to permissive mode" ${FAILURE} + echo_failure + + echo "${broken_forwarders}" > /var/ipfire/red/dns + unbound-control -q forward ${broken_forwarders} + return 0 + fi fi fi @@ -370,6 +391,42 @@ ns_determine_edns_buffer_size() { return 1 } +get_root_nameservers() { + while read -r hostname ttl record address; do + # Searching for A records + [ "${record}" = "A" ] || continue + + echo "${address}" + done < /etc/unbound/root.hints +} + +can_resolve_root() { + local ns + for ns in $(get_root_nameservers); do + if dig @${ns} +dnssec SOA . $@ >/dev/null; then + return 0 + fi + done + + # none of the servers was reachable + return 1 +} + +enable_dnssec() { + local status=$(unbound-control get_option val-permissive-mode) + + # Don't do anything if DNSSEC is already activated + [ "${status}" = "no" ] && return 0 + + # Activate DNSSEC and flush cache with any stale and unvalidated data + unbound-control -q set_option val-permissive-mode: no + unbound-control -q flush_zone . +} + +disable_dnssec() { + unbound-control -q set_option val-permissive-mode: yes +} + case "$1" in start) # Print a nicer messagen when unbound is already running diff --git a/src/patches/unbound-allow-setting-validator-permissive-mode-at-runtime.patch b/src/patches/unbound-allow-setting-validator-permissive-mode-at-runtime.patch new file mode 100644 index 0000000..f476d08 --- /dev/null +++ b/src/patches/unbound-allow-setting-validator-permissive-mode-at-runtime.patch @@ -0,0 +1,43 @@ +diff --git a/validator/validator.c b/validator/validator.c +index 676dcdf..7c19f3d 100644 +--- a/validator/validator.c ++++ b/validator/validator.c +@@ -113,7 +113,7 @@ val_apply_cfg(struct module_env* env, struct val_env* val_env, + int c; + val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl; + val_env->clean_additional = cfg->val_clean_additional; +- val_env->permissive_mode = cfg->val_permissive_mode; ++ val_env->permissive_mode = &cfg->val_permissive_mode; + if(!env->anchors) + env->anchors = anchors_create(); + if(!env->anchors) { +@@ -170,7 +170,6 @@ val_init(struct module_env* env, int id) + } + env->modinfo[id] = (void*)val_env; + env->need_to_validate = 1; +- val_env->permissive_mode = 0; + lock_basic_init(&val_env->bogus_lock); + lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus, + sizeof(val_env->num_rrset_bogus)); +@@ -2084,7 +2083,7 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq, + } + } + /* If we are in permissive mode, bogus gets indeterminate */ +- if(ve->permissive_mode) ++ if(*ve->permissive_mode) + vq->orig_msg->rep->security = sec_status_indeterminate; + } + +diff --git a/validator/validator.h b/validator/validator.h +index 23d3072..f8464b8 100644 +--- a/validator/validator.h ++++ b/validator/validator.h +@@ -104,7 +104,7 @@ struct val_env { + * This allows an operator to run validation 'shadow' without + * hurting responses to clients. + */ +- int permissive_mode; ++ int* permissive_mode; + + /** + * Number of entries in the NSEC3 maximum iteration count table. -- 2.9.3

2 10

[PATCH] nettle: Update to 3.3
by Matthias Fischer 05 Mar '17

05 Mar '17

Added '--disable-documentation' because we don't need this. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/nettle | 7 +++---- lfs/nettle | 12 +++++++----- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/config/rootfiles/common/nettle b/config/rootfiles/common/nettle index 5d5777b18..3f23cb70a 100644 --- a/config/rootfiles/common/nettle +++ b/config/rootfiles/common/nettle @@ -39,6 +39,7 @@ #usr/include/nettle/md4.h #usr/include/nettle/md5-compat.h #usr/include/nettle/md5.h +#usr/include/nettle/memops.h #usr/include/nettle/memxor.h #usr/include/nettle/nettle-meta.h #usr/include/nettle/nettle-stdint.h @@ -63,11 +64,9 @@ #usr/include/nettle/yarrow.h usr/lib/libhogweed.so usr/lib/libhogweed.so.4 -usr/lib/libhogweed.so.4.2 +usr/lib/libhogweed.so.4.3 #usr/lib/libnettle.so usr/lib/libnettle.so.6 -usr/lib/libnettle.so.6.2 +usr/lib/libnettle.so.6.3 #usr/lib/pkgconfig/hogweed.pc #usr/lib/pkgconfig/nettle.pc -usr/share/doc/nettle-3.2 -#usr/share/info/nettle.info diff --git a/lfs/nettle b/lfs/nettle index d0a3e5a2b..96f0e32ab 100644 --- a/lfs/nettle +++ b/lfs/nettle @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2015 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.2 +VER = 3.3 THISAPP = nettle-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = afb15b4764ebf1b4e6d06c62bd4d29e4 +$(DL_FILE)_MD5 = 10f969f78a463704ae73529978148dbe install : $(TARGET) @@ -70,10 +70,12 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure --prefix=/usr --disable-static + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --disable-documentation \ + --disable-static cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install chmod -v 755 /usr/lib/lib{hogweed,nettle}.so - install -v -m755 -d /usr/share/doc/nettle-3.2 @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.11.0

1 0

No connection to repo
by Matthias Fischer 05 Mar '17

05 Mar '17

Hi, Devel is running without problems, but all of a sudden, he can't "pull": ;-) ... root@Devel: /home/matz/ipfire-2.x # git pull origin next ssh: connect to host git.ipfire.org port 22: No route to host fatal: Konnte nicht vom Remote-Repository lesen. Bitte stellen Sie sicher, dass die korrekten Zugriffsberechtigungen bestehen und das Repository existiert. ... ... root@Devel: /home/matz/ipfire-2.x # ping git.ipfire.org PING git.ipfire.org (81.3.27.45) 56(84) bytes of data. 64 bytes from 81.3.27.45: icmp_seq=1 ttl=57 time=20.6 ms 64 bytes from 81.3.27.45: icmp_seq=2 ttl=57 time=20.1 ms 64 bytes from 81.3.27.45: icmp_seq=3 ttl=57 time=20.4 ms 64 bytes from 81.3.27.45: icmp_seq=4 ttl=57 time=20.0 ms 64 bytes from 81.3.27.45: icmp_seq=5 ttl=57 time=20.1 ms 64 bytes from 81.3.27.45: icmp_seq=6 ttl=57 time=20.7 ms 64 bytes from 81.3.27.45: icmp_seq=7 ttl=57 time=20.1 ms ^C --- git.ipfire.org ping statistics --- 7 packets transmitted, 7 received, 0% packet loss, time 6008ms rtt min/avg/max/mdev = 20.006/20.330/20.718/0.290 ms ... Nothing was changed, nothing is blocked, but SSH-connections won't work. Bug or Feature or my fault!? Best, Matthias

2 1

Empty doc-dir for nettle - needful thing?
by Matthias Fischer 05 Mar '17

05 Mar '17

Hi, This just came to my view: Do we really need the (empty) '/usr/share/doc'-directory for nettle? Its installed through lfs: ... install -v -m755 -d /usr/share/doc/nettle-3.3 ... And its ~active in nettle-rootfile which leads to an empty directory: '/usr/share/doc/nettle[VERSION]. Is this needed/intentional? Or could it be built with '--disable-documentation' and perhaps save some time and ~space? ;-) Best, Matthias

2 1

[PATCH] conntrack-tools: Update to 1.4.4
by Matthias Fischer 04 Mar '17

04 Mar '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/conntrack-tools | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/conntrack-tools b/lfs/conntrack-tools index d9a60bcfc..d8a1099a7 100644 --- a/lfs/conntrack-tools +++ b/lfs/conntrack-tools @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2013 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.4.2 +VER = 1.4.4 THISAPP = conntrack-tools-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b1f9d006e7bf000a77395ff7cd3fac16 +$(DL_FILE)_MD5 = acd9e0b27cf16ae3092ba900e4d7560e install : $(TARGET) -- 2.11.0

1 0

回复：[PATCH] BUG11296: Fix build on EFI systems
by 認小默 03 Mar '17

03 Mar '17

Hi, All When i visit "http://www.ipfire.org/ " ,the connection will be reset by server. If visit "https://www.ipfire.org/ " ,the browser shows that the SSL certificate is incorrect ， why not use the letsencrypt project to get SSL certificate ,the browsers stop user to visit website.

1 0

[PATCH] BUG11296: Fix build on EFI systems
by Alexander Marx 03 Mar '17

03 Mar '17

fixes: #11296 Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> --- lfs/flash-images | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/flash-images b/lfs/flash-images index d10fc9b..4a1a4d6 100644 --- a/lfs/flash-images +++ b/lfs/flash-images @@ -193,7 +193,7 @@ endif -e "s/root=[A-Za-z0-9\/=-]*/root=UUID=$$(blkid -o value -s UUID $(PART_ROOT))/g" # Install GRUB - grub-install --force --recheck --no-floppy \ + grub-install --force --recheck --no-floppy --target=i386-pc \ --root-directory=$(MNThdd) $(DEVICE) endif -- 2.7.4

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2017