Development January 2018

development@lists.ipfire.org

12 participants
52 discussions

Re: [PATCH v2] [PATCH] OpenVPN: Update to version 2.4.4 .
by ummeegge 26 Jan '18

26 Jan '18

Hi, forgot the CRL updater please ignore v1, PATCH v2 should include all. Best, Erik Am 26.01.2018 um 12:16 schrieb Erik Kapfer: > ovpnmain.cgi includes new directive '--ncp-disable' to disable for the first the cipher negotiation. > script-security flag 'system' has been dropped cause of security concerns. > Directive changes/explanations can be found in here https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage . > > Update script for OpenVPN CRL has been integrated since OpenVPN refactors the CRL handling since v.2.4.0 . > Script checks the next update field from the CRL and preforms an update two days before it expires. > Script is placed under fcron.daily for daily checks. > Changes can be found in here https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c0323452929e07… . > > update.sh for Core 118 includes needed server.conf changes but also an update of the CRL to prevent connection problems > if systems have already an expired CRL. > Server stop and start if active will be also executed. > > Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> > --- > config/ovpn/ovpn_crl_updater.sh | 53 +++++++++++++++++++++++++++++++++++++ > config/rootfiles/common/openvpn | 5 +++- > config/rootfiles/core/118/update.sh | 13 +++++++++ > html/cgi-bin/ovpnmain.cgi | 3 ++- > lfs/openvpn | 11 +++++--- > src/misc-progs/openvpnctrl.c | 2 +- > 6 files changed, 81 insertions(+), 6 deletions(-) > create mode 100644 config/ovpn/ovpn_crl_updater.sh > > diff --git a/config/ovpn/ovpn_crl_updater.sh b/config/ovpn/ovpn_crl_updater.sh > new file mode 100644 > index 0000000..309edc2 > --- /dev/null > +++ b/config/ovpn/ovpn_crl_updater.sh > @@ -0,0 +1,53 @@ > +#!/bin/bash > + > +# > +# Script Name: ovpn_crl_updater.sh > +# Description: This script checks the "Next Update:" field of the CRL and renews it if needed, > +# which prevents the expiration of OpenVPNs CRL. > +# With OpenVPN 2.4.x the CRL handling has been refactored, > +# whereby the verification logic has been removed from ssl_verify_<backend>.c . > +# See for more infos: > +# https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c0323452929e07… > +# > +# Run Information: If OpenVPNs CRL is presant, > +# this script provides a cronjob which checks daily if an update of the CRL is needed. > +# If the expiring date reaches the value (defined in the 'UPDATE' variable in days) > +# before the CRL expiration, an openssl command will be executed to renew the CRL. > +# The renewing of the CRL will be logged into /var/log/messages. > +# > +# Author: Erik Kapfer > +# > +# Date: 17.01.2018 > +# > +############################################################################################### > + > +# Check if OpenVPN is active or if the CRL is presant > +if [ ! -e "/var/ipfire/ovpn/crls/cacrl.pem" ]; then > + exit 0; > +fi > + > +## Paths > +OVPN="/var/ipfire/ovpn"; > +CRL="${OVPN}/crls/cacrl.pem"; > +CAKEY="${OVPN}/ca/cakey.pem"; > +CACERT="${OVPN}/ca/cacert.pem"; > +OPENSSLCONF="${OVPN}/openssl/ovpn.cnf"; > +## Values > +# CRL check for the the 'Next Update:' in seconds > +EXPIRINGDATEINSEC="$(( $(date -d "$(openssl crl -in "${CRL}" -text | grep -oP 'Next Update: *\K.*')" +%s) - $(date +%s) ))"; > +# Day in seconds to calculate > +DAYINSEC="86400"; > +# Convert seconds to days > +NEXTUPDATE="$((EXPIRINGDATEINSEC / DAYINSEC))"; > +# Update of the CRL in days before CRL expiring date > +UPDATE="2"; > + > +# Check if OpenVPNs CRL needs to be renewed > +if [ "${NEXTUPDATE}" -le "${UPDATE}" ]; then > + openssl ca -gencrl -keyfile "${CAKEY}" -cert "${CACERT}" -out "${CRL}" -config "${OPENSSLCONF}"; > + logger -t openssl "OpenVPN CRL has been renewed"; > +fi > + > +exit 0 > + > +# EOF > diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn > index b58e30c..cbfd03e 100644 > --- a/config/rootfiles/common/openvpn > +++ b/config/rootfiles/common/openvpn > @@ -1,3 +1,5 @@ > +etc/fcron.daily/ovpn_crl_updater.sh > +#usr/include/openvpn-msg.h > #usr/include/openvpn-plugin.h > #usr/lib/openvpn > #usr/lib/openvpn/plugins > @@ -10,11 +12,12 @@ usr/sbin/openvpn > #usr/share/doc/openvpn > #usr/share/doc/openvpn/COPYING > #usr/share/doc/openvpn/COPYRIGHT.GPL > +#usr/share/doc/openvpn/Changes.rst > #usr/share/doc/openvpn/README > #usr/share/doc/openvpn/README.IPv6 > #usr/share/doc/openvpn/README.auth-pam > #usr/share/doc/openvpn/README.down-root > -#usr/share/doc/openvpn/README.polarssl > +#usr/share/doc/openvpn/README.mbedtls > #usr/share/doc/openvpn/management-notes.txt > #usr/share/man/man8/openvpn.8 > var/ipfire/ovpn/ca > diff --git a/config/rootfiles/core/118/update.sh b/config/rootfiles/core/118/update.sh > index 545c8ef..ea56832 100644 > --- a/config/rootfiles/core/118/update.sh > +++ b/config/rootfiles/core/118/update.sh > @@ -58,6 +58,19 @@ ldconfig > /etc/init.d/apache restart > /etc/init.d/snort start > > +# Add changed and new OpenVPN-2.4 directives to server.conf and renew CRL > +if [ -e /var/ipfire/ovpn/server.conf ]; then > + if pgrep openvpn >/dev/null; then > + openvpnctrl -k > + sed -i -e 's/script-security 3 system/script-security 3/' -e '/status .*/ a ncp-disable' /var/ipfire/ovpn/server.conf > + openssl ca -gencrl -keyfile /var/ipfire/ovpn/ca/cakey.pem -cert /var/ipfire/ovpn/ca/cacert.pem -out /var/ipfire/ovpn/crls/cacrl.pem -config /var/ipfire/ovpn/openssl/ovpn.cnf > + openvpnctrl -s > + else > + sed -i -e 's/script-security 3 system/script-security 3/' -e '/status .*/ a ncp-disable' /var/ipfire/ovpn/server.conf > + openssl ca -gencrl -keyfile /var/ipfire/ovpn/ca/cakey.pem -cert /var/ipfire/ovpn/ca/cacert.pem -out /var/ipfire/ovpn/crls/cacrl.pem -config /var/ipfire/ovpn/openssl/ovpn.cnf > + fi > +fi > + > # This update need a reboot... > touch /var/run/need_reboot > > diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi > index 9f5e682..424a5c9 100644 > --- a/html/cgi-bin/ovpnmain.cgi > +++ b/html/cgi-bin/ovpnmain.cgi > @@ -216,7 +216,7 @@ sub writeserverconf { > print CONF "dev tun\n"; > print CONF "proto $sovpnsettings{'DPROTOCOL'}\n"; > print CONF "port $sovpnsettings{'DDEST_PORT'}\n"; > - print CONF "script-security 3 system\n"; > + print CONF "script-security 3\n"; > print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n"; > print CONF "client-config-dir /var/ipfire/ovpn/ccd\n"; > print CONF "tls-server\n"; > @@ -289,6 +289,7 @@ sub writeserverconf { > } > print CONF "status-version 1\n"; > print CONF "status /var/run/ovpnserver.log 30\n"; > + print CONF "ncp-disable\n"; > print CONF "cipher $sovpnsettings{DCIPHER}\n"; > if ($sovpnsettings{'DAUTH'} eq '') { > print CONF ""; > diff --git a/lfs/openvpn b/lfs/openvpn > index 8307d01..e7f9bc2 100644 > --- a/lfs/openvpn > +++ b/lfs/openvpn > @@ -1,7 +1,7 @@ > ############################################################################### > # # > # IPFire.org - A linux based firewall # > -# Copyright (C) 2017 IPFire Team <info(a)ipfire.org> # > +# Copyright (C) 2018 IPFire Team <info(a)ipfire.org> # > # # > # This program is free software: you can redistribute it and/or modify # > # it under the terms of the GNU General Public License as published by # > @@ -24,7 +24,7 @@ > > include Config > > -VER = 2.3.18 > +VER = 2.4.4 > > THISAPP = openvpn-$(VER) > DL_FILE = $(THISAPP).tar.xz > @@ -40,7 +40,7 @@ objects = $(DL_FILE) > > $(DL_FILE) = $(DL_FROM)/$(DL_FILE) > > -$(DL_FILE)_MD5 = 844ec9c64aae62051478784b8562f881 > +$(DL_FILE)_MD5 = 7a2002aad1671b24457bc9432a0c5c52 > > install : $(TARGET) > > @@ -96,5 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify > chown root:root /usr/lib/openvpn/verify > chmod 755 /usr/lib/openvpn/verify > + mv -v /var/ipfire/ovpn/ovpn_crl_updater.sh /etc/fcron.daily > + chown root:root /etc/fcron.daily/ovpn_crl_updater.sh > + chmod 750 /etc/fcron.daily/ovpn_crl_updater.sh > + > @rm -rf $(DIR_APP) > @$(POSTBUILD) > + > diff --git a/src/misc-progs/openvpnctrl.c b/src/misc-progs/openvpnctrl.c > index 20967e4..39e8f58 100644 > --- a/src/misc-progs/openvpnctrl.c > +++ b/src/misc-progs/openvpnctrl.c > @@ -485,7 +485,7 @@ void startDaemon(void) { > executeCommand(command); > snprintf(command, STRING_SIZE-1, "/bin/chown root.nobody /var/run/ovpnserver.log"); > executeCommand(command); > - snprintf(command, STRING_SIZE-1, "/bin/chmod 644 /var/run/ovpnserver.log"); > + snprintf(command, STRING_SIZE-1, "/bin/chmod 664 /var/run/ovpnserver.log"); > executeCommand(command); > } > } > -- > 2.7.4 >

1 0

Wiki: Broken Photos
by Tom Rymes 24 Jan '18

24 Jan '18

While working in the wiki today, I noticed that all of the photos I had added in a previous effort were broken links. Digging a little farther, it seems that the old links are: "{{ :en:configuration:services:ipsecglobalcore95.png }}" To make them work, I can just delete the leading ":en": "{{ :configuration:services:ipsecglobalcore95.png }} Before I go an make a bunch of edits to fix this issue, I wanted to make sure that there isn't an easier way to, perhaps, change a system setting and fix them all at the same time. Any advice appreciated, Tom

2 1

[PATCH] test if nameservers with DNSSEC support return "ad"-flagged data
by Peter Müller 24 Jan '18

24 Jan '18

DNSSEC-validating nameservers return an "ad" (Authenticated Data) flag in the DNS response header. This can be used as a negative indicator for DNSSEC validation: In case a nameserver does not return the flag, but failes to look up a domain with an invalid signature, it does not support DNSSEC validation. This makes it easier to detect nameservers which do not fully comply to the RFCs or try to tamper DNS queries. See bug #11595 (https://bugzilla.ipfire.org/show_bug.cgi?id=11595) for further details. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- src/initscripts/system/unbound | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index 4e7e63e5f..410631f86 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -364,7 +364,12 @@ ns_is_validating() { local ns=${1} shift - dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL + if ! dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then + return 1 + else + # Determine if NS replies with "ad" data flag if DNSSEC enabled + dig @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | grep "\;\;\ flags:" | awk -F\: '{ print $2 }' | awk -F\; '{ print $1 }' | grep -q "\ ad" + fi } # Checks if we can retrieve the DNSKEY for this domain. -- 2.13.6

2 2

[PATCH] set OpenSSL DEFAULT cipher list to secure value
by Peter Müller 24 Jan '18

24 Jan '18

Only use secure cipher list for the OpenSSL DEFAULT list: * ECDSA is preferred over RSA since it is faster and more scalable * TLS 1.2 suites are preferred over anything older * weak ciphers such as RC4 and 3DES have been eliminated * AES-GCM is preferred over AES-CBC (known as "mac-then-encrypt" problem) * ciphers without PFS are moved to the end of the cipher list The DEFAULT cipher list is now ("openssl ciphers -v"): ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1 AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256 AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 CAMELLIA256-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 CAMELLIA128-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA1 This has been discussed at 2017-12-04 (https://wiki.ipfire.org/devel/telco/2017-12-04). Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/openssl | 2 +- src/patches/openssl-1.0.2n-weak-ciphers.patch | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 src/patches/openssl-1.0.2n-weak-ciphers.patch diff --git a/lfs/openssl b/lfs/openssl index 6050768ec..65d738d0f 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -126,7 +126,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.0-beta5-enginesdir.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2a-rpmbuild.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2h-weak-ciphers.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2n-weak-ciphers.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2g-disable-sslv2v3.patch # i586 specific patches diff --git a/src/patches/openssl-1.0.2n-weak-ciphers.patch b/src/patches/openssl-1.0.2n-weak-ciphers.patch new file mode 100644 index 000000000..9fb4051e3 --- /dev/null +++ b/src/patches/openssl-1.0.2n-weak-ciphers.patch @@ -0,0 +1,12 @@ +diff -Naur openssl-1.0.2n-orig/ssl/ssl.h openssl-1.0.2n/ssl/ssl.h +--- openssl-1.0.2n-orig/ssl/ssl.h 2017-12-07 14:16:42.000000000 +0100 ++++ openssl-1.0.2n/ssl/ssl.h 2018-01-20 11:56:02.477927590 +0100 +@@ -338,7 +338,7 @@ + * The following cipher list is used by default. It also is substituted when + * an application-defined cipher list string starts with 'DEFAULT'. + */ +-# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2" ++# define SSL_DEFAULT_CIPHER_LIST "kEECDH+ECDSA:kEECDH:kEDH:HIGH:+SHA:+kRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!kECDH:!IDEA:!SEED:!RC4:!kDH:!DSS" + /* + * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always + * starts with a reasonable order, and all we have to do for DEFAULT is -- 2.13.6

4 7

[PATCH 1/7] pyparsing: update to version 2.2.0
by Jonatan Schlag 24 Jan '18

24 Jan '18

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- config/rootfiles/common/python-pyparsing | 10 +--------- lfs/python-pyparsing | 6 +++--- 2 files changed, 4 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/common/python-pyparsing b/config/rootfiles/common/python-pyparsing index f75b88e7b..9babda975 100644 --- a/config/rootfiles/common/python-pyparsing +++ b/config/rootfiles/common/python-pyparsing @@ -1,9 +1 @@ -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/EGG-INFO -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/EGG-INFO/PKG-INFO -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/EGG-INFO/SOURCES.txt -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/EGG-INFO/dependency_links.txt -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/EGG-INFO/not-zip-safe -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/EGG-INFO/top_level.txt -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/pyparsing.py -#usr/lib/python2.7/site-packages/pyparsing-2.0.7-py2.7.egg/pyparsing.pyc +#usr/lib/python2.7/site-packages/pyparsing-2.2.0-py2.7.egg diff --git a/lfs/python-pyparsing b/lfs/python-pyparsing index f84253b3b..a4a8c552b 100644 --- a/lfs/python-pyparsing +++ b/lfs/python-pyparsing @@ -24,7 +24,7 @@ include Config -VER = 2.0.7 +VER = 2.2.0 THISAPP = pyparsing-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = python-pyparsing -PAK_VER = 1 +PAK_VER = 2 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 1c8bed7530642ca19197f3caa05fd28b +$(DL_FILE)_MD5 = 0214e42d63af850256962b6744c948d9 install : $(TARGET) -- 2.11.0

2 7

Questions regarding IPsec deployment
by Peter Müller 24 Jan '18

24 Jan '18

Hello, I am currently experiencing several issues trying to deploy IPsec. Since I am not sure weather hey are real bugs, or just mistakes of mine, or questions left because of missing documentation, I'll ask here. :-) (a) IPsec with multiple networks announced causes source address mismatch In case an IPsec connection is set up between two IPFire machines, with two networks (i.e. GREEN and ORANGE) announced at each side, the source address of a remote firewall is sometimes changing: In my scenario, there is a firewall rule set up allowing traffic from the GREEN IP of the remote firewall to a local server. However, traffic is blocked because the ORANGE IP of the remote firewall appears as the source address. Technically, this is correct since both networks - GREEN and ORANGE - are announced via the IPsec connection (/24 each). Thereof, I do not consider this being a bug, or is it? (b) differ between multiple networks announced via the same IPsec connection A firewall rule may use an IPsec connection as source or destination. In case multiple networks are announced over this connection, such as described above, the rule will match against all of them. But how do you differ between multiple networks? Say, you want to allow traffic coming from the remote GREEN network, but not from the remote ORANGE one. I currently see two possibilities: (i) Set up an IPsec tunnel for every (remote) network type: One for GREEN networks only, one for ORANGE ones... Might cause some network overhead, but well. (ii) Set up custom networks at "firewall groups|networks" for each of the IPsec networks announced. However, this fails because the networks are already in use - which is technically correct again. Am I missing something here? What is the best practise for this? In case it is really a bug, it is filed at: https://bugzilla.ipfire.org/show_bug.cgi?id=11559 (c) using SubjectAlternativeName in IPsec certificates Some IPsec programs (such as "iked" on OpenBSD) seem to ignore the "Common Name" (CN) field of certificates and use SubjectAlternativeName instead. I've read something similar for HTTP certificates, and according to RFC 3280, SubjectAlternativeName must be used always. Please refer to bug #11594 (https://bugzilla.ipfire.org/show_bug.cgi?id=11594). Should we implement this as default setting or just require that value when creating new certificates? Thanks and best regards, Peter Müller

2 2

bind 9.12.0
by Matthias Fischer 24 Jan '18

24 Jan '18

Hi, About a week ago I uploaded 'bind 9.11.2-p1', today version '9.12.0' was released. Hm. For details see: http://ftp.isc.org/isc/bind9/9.12.0/RELEASE-NOTES-bind-9.12.0.html "BIND 9.12.0 is a new feature release of BIND. This document summarizes new features and functional changes that have been introduced on this branch, as well as features that have been deprecated or removed." Could someone please take a look at these new/removed features and changes? I'm not sure whether we can and want to implement this update in view of the extensive changes. Best, Matthias

2 2

[PATCH] wget: Update to 1.9.4
by Matthias Fischer 24 Jan '18

24 Jan '18

Excerpts from changelog (Details => http://git.savannah.gnu.org/cgit/wget.git): "Switch off compression by default Gzip compression has a number of bugs which need to be ironed out before we can support it by default. Some of these stem from a misunderstanding of the HTTP spec, but a lot of them are also due to many web servers not being compliant with RFC 7231. With this commit, I am marking GZip compression support as experimental in GNU Wget pending further investigation and the addition of tests. * src/http.c (gethttp): Fix bug that prevented all files from being decompressed * src/host.c (sufmatch): Fix to domain matching Replace HTTP urls with HTTPS where valid Avoid redirecting output to file when tcgetpgrp fails * src/log.c (check_redirect_output): tcgetpgrp can return -1 (ENOTTY), be sure to check whether a valid controlling terminal exists before redirecting. (Fixes: #51181) Fix heap overflow in HTTP protocol handling (CVE-2017-13090) Fix stack overflow in HTTP protocol handling (CVE-2017-13089)" Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/wget | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/wget b/lfs/wget index 774928bdc..7a5cdbb11 100644 --- a/lfs/wget +++ b/lfs/wget @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.19.2 +VER = 1.19.4 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = caabf9727fa429626316619a6369fffa +$(DL_FILE)_MD5 = a2a2c1dc4ac5003fc25a8e60b4a9464e install : $(TARGET) -- 2.15.1

1 0

[PATCH] nano: Update to 2.9.2
by Matthias Fischer 24 Jan '18

24 Jan '18

For details see: https://www.nano-editor.org/news.php Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/nano | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/nano b/lfs/nano index 3935a8b09..e567d2c09 100644 --- a/lfs/nano +++ b/lfs/nano @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.9.1 +VER = 2.9.2 THISAPP = nano-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nano -PAK_VER = 17 +PAK_VER = 18 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0e2c5d7ae5378fe42b7166e7fe268736 +$(DL_FILE)_MD5 = 40ac792d28641969ce0be0a4a37df6a0 install : $(TARGET) -- 2.15.1

1 0

[PATCH] sed: Update to 4.4
by Matthias Fischer 23 Jan '18

23 Jan '18

Hi, 'sed' hasn't been updated in IPFire for a few years - I thought it could be worthy an update: Excerpt from 'NEWS': "* Noteworthy changes in release 4.4 (2017-02-03) [stable] sed could segfault when invoked with specific combination of newlines in the input and regex pattern. [Bug introduced in sed-4.3]" "Noteworthy changes" from release 4.2.2 to 4.3 can be found in 'NEWS' file, too much to list them all... Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/sed | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/sed b/lfs/sed index 3ac39a71c..9123183e3 100644 --- a/lfs/sed +++ b/lfs/sed @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2016 Michael Tremer & Christian Schmidt # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,10 +24,10 @@ include Config -VER = 4.2.2 +VER = 4.4 THISAPP = sed-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.xz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) @@ -53,7 +53,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4111de4faa3b9848a0686b2f260c5056 +$(DL_FILE)_MD5 = e0c583d4c380059abd818cd540fe6938 install : $(TARGET) @@ -82,7 +82,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./configure $(EXTRA_CONFIG) cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && make $(EXTRA_INSTALL) install -- 2.15.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2018