Development August 2018

development@lists.ipfire.org

14 participants
56 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

[Fwd: Re: request for info: unbound via https / tls]
by Paul Simmons 13 Dec '18

13 Dec '18

Forgot the list cc :-(.

4 27

[PATCH] Fix hook for static address configuration.
by Stefan Schantl 15 Sep '18

15 Sep '18

Add the required hook_new function and "id" information which have been introduced in earlier commits to make this hook work again. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/hooks/configs/static | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/src/hooks/configs/static b/src/hooks/configs/static index 91bba8a..37f3d32 100644 --- a/src/hooks/configs/static +++ b/src/hooks/configs/static @@ -52,6 +52,8 @@ hook_check_config_settings() { hook_parse_cmdline() { local protocol + local id="${1}" + shift while [ $# -gt 0 ]; do case "${1}" in @@ -153,12 +155,34 @@ hook_parse_cmdline() { fi # Check any conflicts - if zone_config_check_same_setting "${zone}" "static" "ADDRESS" "${ADDRESS}"; then + if zone_config_check_same_setting "${zone}" "static" "${id}" "ADDRESS" "${ADDRESS}"; then error "A static configuration with the same address is already configured" return ${EXIT_CONF_ERROR} fi } +hook_new() { + local zone="${1}" + shift + + if zone_config_hook_is_configured ${zone} "static"; then + log ERROR "You can configure the static hook only once for a zone" + return ${EXIT_ERROR} + fi + + local id=$(zone_config_get_new_id ${zone}) + log DEBUG "ID for the config is: ${id}" + + if ! hook_parse_cmdline "${id}" "$@"; then + # Return an error if the parsing of the cmd line fails + return ${EXIT_ERROR} + fi + + zone_config_settings_write "${zone}" "${HOOK}" "${id}" + + exit ${EXIT_OK} +} + hook_up() { local zone="${1}" local config="${2}" -- 2.17.1

3 5

[PATCH] openssh: Update to 7.8p1
by Matthias Fischer 10 Sep '18

10 Sep '18

For details see: http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog I didn't find an official lfs-patch for openssl-1.1-compatibility, so I used the patch from here: https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.p… Building ran without any errors. I tested with both machines (test on Core 120 - and productive - on Core 122) and found no errors so far: ... [root@ipfiretest ~]# ssh -V OpenSSH_7.8p1, OpenSSL 1.1.0h 27 Mar 2018 ... ... root@ipfire: / # ssh -V OpenSSH_7.8p1, OpenSSL 1.1.0h 27 Mar 2018 ... All ssh-connections ran fine but I'm not REALLY sure if this is sufficient for anyone else. Could someone please check and confirm!? Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/openssh | 6 +- ...ch => openssh-7.8p1-openssl-1.1.0-1.patch} | 210 +++++++++--------- 2 files changed, 103 insertions(+), 113 deletions(-) rename src/patches/{openssh-7.7p1-openssl-1.1.0-1.patch => openssh-7.8p1-openssl-1.1.0-1.patch} (90%) diff --git a/lfs/openssh b/lfs/openssh index a88b2d126..588820e50 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -24,7 +24,7 @@ include Config -VER = 7.7p1 +VER = 7.8p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 68ba883aff6958297432e5877e9a0fe2 +$(DL_FILE)_MD5 = ce1d090fa6239fd38eb989d5e983b074 install : $(TARGET) @@ -70,7 +70,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssh-7.7p1-openssl-1.1.0-1.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssh-7.8p1-openssl-1.1.0-1.patch cd $(DIR_APP) && sed -i "s/lkrb5 -ldes/lkrb5/" configure cd $(DIR_APP) && ./configure \ --prefix=/usr \ diff --git a/src/patches/openssh-7.7p1-openssl-1.1.0-1.patch b/src/patches/openssh-7.8p1-openssl-1.1.0-1.patch similarity index 90% rename from src/patches/openssh-7.7p1-openssl-1.1.0-1.patch rename to src/patches/openssh-7.8p1-openssl-1.1.0-1.patch index cfc9bba91..7f8c7cd4f 100644 --- a/src/patches/openssh-7.7p1-openssl-1.1.0-1.patch +++ b/src/patches/openssh-7.8p1-openssl-1.1.0-1.patch @@ -1,13 +1,6 @@ -Submitted by: Bruce Dubbs (bdubbs(a)linuxfromscratch.org) -Date: 2018-04-07 -Initial Package Version: 7.7p1 -Upstream Status: Pending (Still) -Origin: https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.p… -Description: Fixes build issues with OpenSSL-1.1.0. - diff -aurp old/auth-pam.c new/auth-pam.c ---- old/auth-pam.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/auth-pam.c 2018-03-23 10:05:03.886621278 -1000 +--- old/auth-pam.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/auth-pam.c 2018-08-23 21:31:53.324592767 -0700 @@ -128,6 +128,10 @@ extern u_int utmp_len; typedef pthread_t sp_pthread_t; #else @@ -20,9 +13,9 @@ diff -aurp old/auth-pam.c new/auth-pam.c struct pam_ctxt { diff -aurp old/cipher.c new/cipher.c ---- old/cipher.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/cipher.c 2018-03-23 10:05:03.886621278 -1000 -@@ -297,7 +297,10 @@ cipher_init(struct sshcipher_ctx **ccp, +--- old/cipher.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/cipher.c 2018-08-23 21:31:53.327926112 -0700 +@@ -299,7 +299,10 @@ cipher_init(struct sshcipher_ctx **ccp, goto out; } } @@ -34,7 +27,7 @@ diff -aurp old/cipher.c new/cipher.c ret = SSH_ERR_LIBCRYPTO_ERROR; goto out; } -@@ -483,7 +486,7 @@ cipher_get_keyiv(struct sshcipher_ctx *c +@@ -485,7 +488,7 @@ cipher_get_keyiv(struct sshcipher_ctx *c len, iv)) return SSH_ERR_LIBCRYPTO_ERROR; } else @@ -43,7 +36,7 @@ diff -aurp old/cipher.c new/cipher.c #endif return 0; } -@@ -517,14 +520,19 @@ cipher_set_keyiv(struct sshcipher_ctx *c +@@ -519,14 +522,19 @@ cipher_set_keyiv(struct sshcipher_ctx *c EVP_CTRL_GCM_SET_IV_FIXED, -1, (void *)iv)) return SSH_ERR_LIBCRYPTO_ERROR; } else @@ -67,8 +60,8 @@ diff -aurp old/cipher.c new/cipher.c int diff -aurp old/cipher.h new/cipher.h ---- old/cipher.h 2018-03-22 16:21:14.000000000 -1000 -+++ new/cipher.h 2018-03-23 10:05:03.886621278 -1000 +--- old/cipher.h 2018-08-22 22:41:42.000000000 -0700 ++++ new/cipher.h 2018-08-23 21:31:53.327926112 -0700 @@ -46,7 +46,18 @@ #define CIPHER_DECRYPT 0 @@ -89,9 +82,9 @@ diff -aurp old/cipher.h new/cipher.h const struct sshcipher *cipher_by_name(const char *); const char *cipher_warning_message(const struct sshcipher_ctx *); diff -aurp old/configure new/configure ---- old/configure 2018-03-23 03:30:17.000000000 -1000 -+++ new/configure 2018-03-23 10:05:03.888621444 -1000 -@@ -13076,7 +13076,6 @@ if ac_fn_c_try_run "$LINENO"; then : +--- old/configure 2018-08-23 00:09:30.000000000 -0700 ++++ new/configure 2018-08-23 21:31:53.331259457 -0700 +@@ -13032,7 +13032,6 @@ if ac_fn_c_try_run "$LINENO"; then : 100*) ;; # 1.0.x 200*) ;; # LibreSSL *) @@ -100,9 +93,9 @@ diff -aurp old/configure new/configure esac { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ssl_library_ver" >&5 diff -aurp old/dh.c new/dh.c ---- old/dh.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/dh.c 2018-03-23 10:05:03.888621444 -1000 -@@ -211,14 +211,15 @@ choose_dh(int min, int wantbits, int max +--- old/dh.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/dh.c 2018-08-23 21:39:18.863765579 -0700 +@@ -216,14 +216,15 @@ choose_dh(int min, int wantbits, int max /* diffie-hellman-groupN-sha1 */ int @@ -120,7 +113,7 @@ diff -aurp old/dh.c new/dh.c logit("invalid public DH value: negative"); return 0; } -@@ -231,7 +232,8 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub) +@@ -236,7 +237,8 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub) error("%s: BN_new failed", __func__); return 0; } @@ -130,7 +123,7 @@ diff -aurp old/dh.c new/dh.c BN_cmp(dh_pub, tmp) != -1) { /* pub_exp > p-2 */ BN_clear_free(tmp); logit("invalid public DH value: >= p-1"); -@@ -242,14 +244,14 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub) +@@ -247,14 +249,14 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub) for (i = 0; i <= n; i++) if (BN_is_bit_set(dh_pub, i)) bits_set++; @@ -147,7 +140,7 @@ diff -aurp old/dh.c new/dh.c return 0; } return 1; -@@ -259,9 +261,13 @@ int +@@ -264,9 +266,13 @@ int dh_gen_key(DH *dh, int need) { int pbits; @@ -163,7 +156,7 @@ diff -aurp old/dh.c new/dh.c need > INT_MAX / 2 || 2 * need > pbits) return SSH_ERR_INVALID_ARGUMENT; if (need < 256) -@@ -270,10 +276,13 @@ dh_gen_key(DH *dh, int need) +@@ -275,11 +281,13 @@ dh_gen_key(DH *dh, int need) * Pollard Rho, Big step/Little Step attacks are O(sqrt(n)), * so double requested need here. */ @@ -171,6 +164,7 @@ diff -aurp old/dh.c new/dh.c - if (DH_generate_key(dh) == 0 || - !dh_pub_is_valid(dh, dh->pub_key)) { - BN_clear_free(dh->priv_key); +- dh->priv_key = NULL; + DH_set_length(dh, MIN(need * 2, pbits - 1)); + if (DH_generate_key(dh) == 0) { + return SSH_ERR_LIBCRYPTO_ERROR; @@ -181,7 +175,7 @@ diff -aurp old/dh.c new/dh.c return SSH_ERR_LIBCRYPTO_ERROR; } return 0; -@@ -282,16 +291,27 @@ dh_gen_key(DH *dh, int need) +@@ -288,16 +296,27 @@ dh_gen_key(DH *dh, int need) DH * dh_new_group_asc(const char *gen, const char *modulus) { @@ -216,7 +210,7 @@ diff -aurp old/dh.c new/dh.c } /* -@@ -306,8 +326,8 @@ dh_new_group(BIGNUM *gen, BIGNUM *modulu +@@ -312,8 +331,8 @@ dh_new_group(BIGNUM *gen, BIGNUM *modulu if ((dh = DH_new()) == NULL) return NULL; @@ -228,8 +222,8 @@ diff -aurp old/dh.c new/dh.c return (dh); } diff -aurp old/dh.h new/dh.h ---- old/dh.h 2018-03-22 16:21:14.000000000 -1000 -+++ new/dh.h 2018-03-23 10:05:03.889621527 -1000 +--- old/dh.h 2018-08-22 22:41:42.000000000 -0700 ++++ new/dh.h 2018-08-23 21:31:53.331259457 -0700 @@ -42,7 +42,7 @@ DH *dh_new_group18(void); DH *dh_new_group_fallback(int); @@ -240,8 +234,8 @@ diff -aurp old/dh.h new/dh.h u_int dh_estimate(int); diff -aurp old/digest-openssl.c new/digest-openssl.c ---- old/digest-openssl.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/digest-openssl.c 2018-03-23 10:05:03.889621527 -1000 +--- old/digest-openssl.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/digest-openssl.c 2018-08-23 21:31:53.331259457 -0700 @@ -43,7 +43,7 @@ struct ssh_digest_ctx { @@ -314,8 +308,8 @@ diff -aurp old/digest-openssl.c new/digest-openssl.c free(ctx); } diff -aurp old/kexdhc.c new/kexdhc.c ---- old/kexdhc.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/kexdhc.c 2018-03-23 10:05:03.889621527 -1000 +--- old/kexdhc.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/kexdhc.c 2018-08-23 21:31:53.331259457 -0700 @@ -81,11 +81,16 @@ kexdh_client(struct ssh *ssh) goto out; } @@ -363,8 +357,8 @@ diff -aurp old/kexdhc.c new/kexdhc.c if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) != 0) diff -aurp old/kexdhs.c new/kexdhs.c ---- old/kexdhs.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/kexdhs.c 2018-03-23 10:58:58.126733207 -1000 +--- old/kexdhs.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/kexdhs.c 2018-08-23 21:36:50.600564263 -0700 @@ -163,6 +163,9 @@ input_kex_dh_init(int type, u_int32_t se goto out; /* calc H */ @@ -390,10 +384,10 @@ diff -aurp old/kexdhs.c new/kexdhs.c /* save session id := H */ if (kex->session_id == NULL) { -@@ -195,12 +200,17 @@ input_kex_dh_init(int type, u_int32_t se +@@ -195,12 +200,16 @@ input_kex_dh_init(int type, u_int32_t se /* destroy_sensitive_data(); */ - /* send server hostkey, DH pubkey 'f' and singed H */ + /* send server hostkey, DH pubkey 'f' and signed H */ + { + const BIGNUM *pub_key; + DH_get0_key(kex->dh, &pub_key, NULL); @@ -402,17 +396,15 @@ diff -aurp old/kexdhs.c new/kexdhs.c - (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 || /* f */ + (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 || /* f */ (r = sshpkt_put_string(ssh, signature, slen)) != 0 || -- (r = sshpkt_send(ssh)) != 0) -+ (r = sshpkt_send(ssh)) != 0) { + (r = sshpkt_send(ssh)) != 0) goto out; -+ } + } if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0) r = kex_send_newkeys(ssh); diff -aurp old/kexgexc.c new/kexgexc.c ---- old/kexgexc.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/kexgexc.c 2018-03-23 11:00:00.132866201 -1000 +--- old/kexgexc.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/kexgexc.c 2018-08-23 21:31:53.331259457 -0700 @@ -118,11 +118,17 @@ input_kex_dh_gex_group(int type, u_int32 p = g = NULL; /* belong to kex->dh now */ @@ -465,8 +457,8 @@ diff -aurp old/kexgexc.c new/kexgexc.c if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) != 0) diff -aurp old/kexgexs.c new/kexgexs.c ---- old/kexgexs.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/kexgexs.c 2018-03-23 11:03:06.045049721 -1000 +--- old/kexgexs.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/kexgexs.c 2018-08-23 21:36:11.493972372 -0700 @@ -101,11 +101,16 @@ input_kex_dh_gex_request(int type, u_int goto out; } @@ -516,10 +508,10 @@ diff -aurp old/kexgexs.c new/kexgexs.c /* save session id := H */ if (kex->session_id == NULL) { -@@ -225,12 +236,17 @@ input_kex_dh_gex_init(int type, u_int32_ +@@ -225,12 +236,16 @@ input_kex_dh_gex_init(int type, u_int32_ /* destroy_sensitive_data(); */ - /* send server hostkey, DH pubkey 'f' and singed H */ + /* send server hostkey, DH pubkey 'f' and signed H */ + { + const BIGNUM *pub_key; + DH_get0_key(kex->dh, &pub_key, NULL); @@ -528,35 +520,33 @@ diff -aurp old/kexgexs.c new/kexgexs.c - (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 || /* f */ + (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 || /* f */ (r = sshpkt_put_string(ssh, signature, slen)) != 0 || -- (r = sshpkt_send(ssh)) != 0) -+ (r = sshpkt_send(ssh)) != 0) { + (r = sshpkt_send(ssh)) != 0) goto out; -+ } + } if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0) r = kex_send_newkeys(ssh); diff -aurp old/monitor.c new/monitor.c ---- old/monitor.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/monitor.c 2018-03-23 10:05:03.890621610 -1000 -@@ -595,10 +595,12 @@ mm_answer_moduli(int sock, Buffer *m) - buffer_put_char(m, 0); +--- old/monitor.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/monitor.c 2018-08-23 21:34:14.594343260 -0700 +@@ -589,10 +589,12 @@ mm_answer_moduli(int sock, struct sshbuf + fatal("%s: buffer error: %s", __func__, ssh_err(r)); return (0); } else { + const BIGNUM *p, *g; + DH_get0_pqg(dh, &p, NULL, &g); /* Send first bignum */ - buffer_put_char(m, 1); -- buffer_put_bignum2(m, dh->p); -- buffer_put_bignum2(m, dh->g); -+ buffer_put_bignum2(m, p); -+ buffer_put_bignum2(m, g); + if ((r = sshbuf_put_u8(m, 1)) != 0 || +- (r = sshbuf_put_bignum2(m, dh->p)) != 0 || +- (r = sshbuf_put_bignum2(m, dh->g)) != 0) ++ (r = sshbuf_put_bignum2(m, p)) != 0 || ++ (r = sshbuf_put_bignum2(m, g)) != 0) + fatal("%s: buffer error: %s", __func__, ssh_err(r)); DH_free(dh); - } diff -aurp old/openbsd-compat/openssl-compat.c new/openbsd-compat/openssl-compat.c ---- old/openbsd-compat/openssl-compat.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/openbsd-compat/openssl-compat.c 2018-03-23 10:05:03.890621610 -1000 +--- old/openbsd-compat/openssl-compat.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/openbsd-compat/openssl-compat.c 2018-08-23 21:31:53.334592801 -0700 @@ -75,7 +75,6 @@ ssh_OpenSSL_add_all_algorithms(void) /* Enable use of crypto hardware */ ENGINE_load_builtin_engines(); @@ -566,8 +556,8 @@ diff -aurp old/openbsd-compat/openssl-compat.c new/openbsd-compat/openssl-compat #endif diff -aurp old/regress/unittests/sshkey/test_file.c new/regress/unittests/sshkey/test_file.c ---- old/regress/unittests/sshkey/test_file.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/regress/unittests/sshkey/test_file.c 2018-03-23 10:05:03.890621610 -1000 +--- old/regress/unittests/sshkey/test_file.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/regress/unittests/sshkey/test_file.c 2018-08-23 21:31:53.334592801 -0700 @@ -60,9 +60,14 @@ sshkey_file_tests(void) a = load_bignum("rsa_1.param.n"); b = load_bignum("rsa_1.param.p"); @@ -605,8 +595,8 @@ diff -aurp old/regress/unittests/sshkey/test_file.c new/regress/unittests/sshkey BN_free(b); BN_free(c); diff -aurp old/regress/unittests/sshkey/test_sshkey.c new/regress/unittests/sshkey/test_sshkey.c ---- old/regress/unittests/sshkey/test_sshkey.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/regress/unittests/sshkey/test_sshkey.c 2018-03-23 10:05:03.890621610 -1000 +--- old/regress/unittests/sshkey/test_sshkey.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/regress/unittests/sshkey/test_sshkey.c 2018-08-23 21:31:53.334592801 -0700 @@ -197,9 +197,14 @@ sshkey_tests(void) k1 = sshkey_new(KEY_RSA); ASSERT_PTR_NE(k1, NULL); @@ -745,8 +735,8 @@ diff -aurp old/regress/unittests/sshkey/test_sshkey.c new/regress/unittests/sshk TEST_START("equal KEY_DSA/demoted KEY_DSA"); diff -aurp old/ssh-dss.c new/ssh-dss.c ---- old/ssh-dss.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/ssh-dss.c 2018-03-23 10:05:03.891621693 -1000 +--- old/ssh-dss.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/ssh-dss.c 2018-08-23 21:31:53.334592801 -0700 @@ -53,6 +53,7 @@ ssh_dss_sign(const struct sshkey *key, u DSA_SIG *sig = NULL; u_char digest[SSH_DIGEST_MAX_LENGTH], sigblob[SIGBLOB_LEN]; @@ -808,8 +798,8 @@ diff -aurp old/ssh-dss.c new/ssh-dss.c /* sha1 the data */ if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen, diff -aurp old/ssh-ecdsa.c new/ssh-ecdsa.c ---- old/ssh-ecdsa.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/ssh-ecdsa.c 2018-03-23 10:05:03.891621693 -1000 +--- old/ssh-ecdsa.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/ssh-ecdsa.c 2018-08-23 21:31:53.334592801 -0700 @@ -80,9 +80,14 @@ ssh_ecdsa_sign(const struct sshkey *key, ret = SSH_ERR_ALLOC_FAIL; goto out; @@ -858,9 +848,9 @@ diff -aurp old/ssh-ecdsa.c new/ssh-ecdsa.c ret = SSH_ERR_UNEXPECTED_TRAILING_DATA; goto out; diff -aurp old/ssh-keygen.c new/ssh-keygen.c ---- old/ssh-keygen.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/ssh-keygen.c 2018-03-23 10:05:03.891621693 -1000 -@@ -493,11 +493,33 @@ do_convert_private_ssh2_from_blob(u_char +--- old/ssh-keygen.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/ssh-keygen.c 2018-08-23 21:31:53.334592801 -0700 +@@ -494,11 +494,33 @@ do_convert_private_ssh2_from_blob(u_char switch (key->type) { case KEY_DSA: @@ -899,7 +889,7 @@ diff -aurp old/ssh-keygen.c new/ssh-keygen.c break; case KEY_RSA: if ((r = sshbuf_get_u8(b, &e1)) != 0 || -@@ -514,16 +536,52 @@ do_convert_private_ssh2_from_blob(u_char +@@ -515,16 +537,52 @@ do_convert_private_ssh2_from_blob(u_char e += e3; debug("e %lx", e); } @@ -958,7 +948,7 @@ diff -aurp old/ssh-keygen.c new/ssh-keygen.c if ((r = ssh_rsa_generate_additional_parameters(key)) != 0) fatal("generate RSA parameters failed: %s", ssh_err(r)); break; -@@ -633,7 +691,7 @@ do_convert_from_pkcs8(struct sshkey **k, +@@ -634,7 +692,7 @@ do_convert_from_pkcs8(struct sshkey **k, identity_file); } fclose(fp); @@ -967,7 +957,7 @@ diff -aurp old/ssh-keygen.c new/ssh-keygen.c case EVP_PKEY_RSA: if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) fatal("sshkey_new failed"); -@@ -657,7 +715,7 @@ do_convert_from_pkcs8(struct sshkey **k, +@@ -658,7 +716,7 @@ do_convert_from_pkcs8(struct sshkey **k, #endif default: fatal("%s: unsupported pubkey type %d", __func__, @@ -977,9 +967,9 @@ diff -aurp old/ssh-keygen.c new/ssh-keygen.c EVP_PKEY_free(pubkey); return; diff -aurp old/ssh-pkcs11-client.c new/ssh-pkcs11-client.c ---- old/ssh-pkcs11-client.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/ssh-pkcs11-client.c 2018-03-23 10:05:03.892621777 -1000 -@@ -144,12 +144,13 @@ pkcs11_rsa_private_encrypt(int flen, con +--- old/ssh-pkcs11-client.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/ssh-pkcs11-client.c 2018-08-23 21:31:53.334592801 -0700 +@@ -156,12 +156,13 @@ pkcs11_rsa_private_encrypt(int flen, con static int wrap_key(RSA *rsa) { @@ -999,8 +989,8 @@ diff -aurp old/ssh-pkcs11-client.c new/ssh-pkcs11-client.c } diff -aurp old/ssh-pkcs11.c new/ssh-pkcs11.c ---- old/ssh-pkcs11.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/ssh-pkcs11.c 2018-03-23 10:05:03.892621777 -1000 +--- old/ssh-pkcs11.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/ssh-pkcs11.c 2018-08-23 21:31:53.334592801 -0700 @@ -67,7 +67,7 @@ struct pkcs11_key { struct pkcs11_provider *provider; CK_ULONG slotidx; @@ -1090,9 +1080,9 @@ diff -aurp old/ssh-pkcs11.c new/ssh-pkcs11.c free(attribs[i].pValue); } diff -aurp old/ssh-rsa.c new/ssh-rsa.c ---- old/ssh-rsa.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/ssh-rsa.c 2018-03-23 10:05:03.892621777 -1000 -@@ -84,7 +84,6 @@ ssh_rsa_generate_additional_parameters(s +--- old/ssh-rsa.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/ssh-rsa.c 2018-08-23 21:31:53.334592801 -0700 +@@ -108,7 +108,6 @@ ssh_rsa_generate_additional_parameters(s { BIGNUM *aux = NULL; BN_CTX *ctx = NULL; @@ -1100,7 +1090,7 @@ diff -aurp old/ssh-rsa.c new/ssh-rsa.c int r; if (key == NULL || key->rsa == NULL || -@@ -99,16 +98,27 @@ ssh_rsa_generate_additional_parameters(s +@@ -123,16 +122,27 @@ ssh_rsa_generate_additional_parameters(s } BN_set_flags(aux, BN_FLG_CONSTTIME); @@ -1135,7 +1125,7 @@ diff -aurp old/ssh-rsa.c new/ssh-rsa.c r = 0; out: BN_clear_free(aux); -@@ -139,7 +149,7 @@ ssh_rsa_sign(const struct sshkey *key, u +@@ -163,7 +173,7 @@ ssh_rsa_sign(const struct sshkey *key, u if (key == NULL || key->rsa == NULL || hash_alg == -1 || sshkey_type_plain(key->type) != KEY_RSA) return SSH_ERR_INVALID_ARGUMENT; @@ -1144,7 +1134,7 @@ diff -aurp old/ssh-rsa.c new/ssh-rsa.c return SSH_ERR_KEY_LENGTH; slen = RSA_size(key->rsa); if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM) -@@ -211,7 +221,7 @@ ssh_rsa_verify(const struct sshkey *key, +@@ -235,7 +245,7 @@ ssh_rsa_verify(const struct sshkey *key, sshkey_type_plain(key->type) != KEY_RSA || sig == NULL || siglen == 0) return SSH_ERR_INVALID_ARGUMENT; @@ -1154,9 +1144,9 @@ diff -aurp old/ssh-rsa.c new/ssh-rsa.c if ((b = sshbuf_from(sig, siglen)) == NULL) diff -aurp old/sshkey.c new/sshkey.c ---- old/sshkey.c 2018-03-22 16:21:14.000000000 -1000 -+++ new/sshkey.c 2018-03-23 10:05:03.893621860 -1000 -@@ -274,10 +274,18 @@ sshkey_size(const struct sshkey *k) +--- old/sshkey.c 2018-08-22 22:41:42.000000000 -0700 ++++ new/sshkey.c 2018-08-23 21:31:53.334592801 -0700 +@@ -292,10 +292,18 @@ sshkey_size(const struct sshkey *k) #ifdef WITH_OPENSSL case KEY_RSA: case KEY_RSA_CERT: @@ -1176,7 +1166,7 @@ diff -aurp old/sshkey.c new/sshkey.c case KEY_ECDSA: case KEY_ECDSA_CERT: return sshkey_curve_nid_to_bits(k->ecdsa_nid); -@@ -482,26 +490,53 @@ sshkey_new(int type) +@@ -500,26 +508,53 @@ sshkey_new(int type) #ifdef WITH_OPENSSL case KEY_RSA: case KEY_RSA_CERT: @@ -1236,7 +1226,7 @@ diff -aurp old/sshkey.c new/sshkey.c k->dsa = dsa; break; case KEY_ECDSA: -@@ -539,6 +574,51 @@ sshkey_add_private(struct sshkey *k) +@@ -557,6 +592,51 @@ sshkey_add_private(struct sshkey *k) #ifdef WITH_OPENSSL case KEY_RSA: case KEY_RSA_CERT: @@ -1288,7 +1278,7 @@ diff -aurp old/sshkey.c new/sshkey.c #define bn_maybe_alloc_failed(p) (p == NULL && (p = BN_new()) == NULL) if (bn_maybe_alloc_failed(k->rsa->d) || bn_maybe_alloc_failed(k->rsa->iqmp) || -@@ -547,13 +627,28 @@ sshkey_add_private(struct sshkey *k) +@@ -565,13 +645,28 @@ sshkey_add_private(struct sshkey *k) bn_maybe_alloc_failed(k->rsa->dmq1) || bn_maybe_alloc_failed(k->rsa->dmp1)) return SSH_ERR_ALLOC_FAIL; @@ -1317,7 +1307,7 @@ diff -aurp old/sshkey.c new/sshkey.c case KEY_ECDSA: case KEY_ECDSA_CERT: /* Cannot do anything until we know the group */ -@@ -677,16 +772,34 @@ sshkey_equal_public(const struct sshkey +@@ -695,16 +790,34 @@ sshkey_equal_public(const struct sshkey #ifdef WITH_OPENSSL case KEY_RSA_CERT: case KEY_RSA: @@ -1360,7 +1350,7 @@ diff -aurp old/sshkey.c new/sshkey.c # ifdef OPENSSL_HAS_ECC case KEY_ECDSA_CERT: case KEY_ECDSA: -@@ -775,12 +888,17 @@ to_blob_buf(const struct sshkey *key, st +@@ -793,12 +906,17 @@ to_blob_buf(const struct sshkey *key, st case KEY_DSA: if (key->dsa == NULL) return SSH_ERR_INVALID_ARGUMENT; @@ -1382,7 +1372,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; # ifdef OPENSSL_HAS_ECC case KEY_ECDSA: -@@ -796,10 +914,14 @@ to_blob_buf(const struct sshkey *key, st +@@ -814,10 +932,14 @@ to_blob_buf(const struct sshkey *key, st case KEY_RSA: if (key->rsa == NULL) return SSH_ERR_INVALID_ARGUMENT; @@ -1399,7 +1389,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; #endif /* WITH_OPENSSL */ case KEY_ED25519: -@@ -1740,13 +1862,32 @@ sshkey_from_private(const struct sshkey +@@ -1758,13 +1880,32 @@ sshkey_from_private(const struct sshkey case KEY_DSA_CERT: if ((n = sshkey_new(k->type)) == NULL) return SSH_ERR_ALLOC_FAIL; @@ -1436,7 +1426,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; # ifdef OPENSSL_HAS_ECC case KEY_ECDSA: -@@ -1770,11 +1911,23 @@ sshkey_from_private(const struct sshkey +@@ -1788,11 +1929,23 @@ sshkey_from_private(const struct sshkey case KEY_RSA_CERT: if ((n = sshkey_new(k->type)) == NULL) return SSH_ERR_ALLOC_FAIL; @@ -1462,7 +1452,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; #endif /* WITH_OPENSSL */ case KEY_ED25519: -@@ -1995,12 +2148,27 @@ sshkey_from_blob_internal(struct sshbuf +@@ -2013,12 +2166,27 @@ sshkey_from_blob_internal(struct sshbuf ret = SSH_ERR_ALLOC_FAIL; goto out; } @@ -1493,7 +1483,7 @@ diff -aurp old/sshkey.c new/sshkey.c ret = SSH_ERR_KEY_LENGTH; goto out; } -@@ -2020,13 +2188,36 @@ sshkey_from_blob_internal(struct sshbuf +@@ -2038,13 +2206,36 @@ sshkey_from_blob_internal(struct sshbuf ret = SSH_ERR_ALLOC_FAIL; goto out; } @@ -1534,7 +1524,7 @@ diff -aurp old/sshkey.c new/sshkey.c #ifdef DEBUG_PK DSA_print_fp(stderr, key->dsa, 8); #endif -@@ -2327,26 +2518,63 @@ sshkey_demote(const struct sshkey *k, st +@@ -2389,26 +2580,63 @@ sshkey_demote(const struct sshkey *k, st goto fail; /* FALLTHROUGH */ case KEY_RSA: @@ -1606,7 +1596,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; case KEY_ECDSA_CERT: if ((ret = sshkey_cert_copy(k, pk)) != 0) -@@ -2496,11 +2724,17 @@ sshkey_certify_custom(struct sshkey *k, +@@ -2558,11 +2786,17 @@ sshkey_certify_custom(struct sshkey *k, switch (k->type) { #ifdef WITH_OPENSSL case KEY_DSA_CERT: @@ -1628,7 +1618,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; # ifdef OPENSSL_HAS_ECC case KEY_ECDSA_CERT: -@@ -2513,9 +2747,15 @@ sshkey_certify_custom(struct sshkey *k, +@@ -2575,9 +2809,15 @@ sshkey_certify_custom(struct sshkey *k, break; # endif /* OPENSSL_HAS_ECC */ case KEY_RSA_CERT: @@ -1646,7 +1636,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; #endif /* WITH_OPENSSL */ case KEY_ED25519_CERT: -@@ -2702,42 +2942,67 @@ sshkey_private_serialize_opt(const struc +@@ -2764,42 +3004,67 @@ sshkey_private_serialize_opt(const struc switch (key->type) { #ifdef WITH_OPENSSL case KEY_RSA: @@ -1730,7 +1720,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; # ifdef OPENSSL_HAS_ECC case KEY_ECDSA: -@@ -2851,18 +3116,61 @@ sshkey_private_deserialize(struct sshbuf +@@ -2913,18 +3178,61 @@ sshkey_private_deserialize(struct sshbuf r = SSH_ERR_ALLOC_FAIL; goto out; } @@ -1799,7 +1789,7 @@ diff -aurp old/sshkey.c new/sshkey.c break; # ifdef OPENSSL_HAS_ECC case KEY_ECDSA: -@@ -2921,29 +3229,104 @@ sshkey_private_deserialize(struct sshbuf +@@ -2983,29 +3291,104 @@ sshkey_private_deserialize(struct sshbuf r = SSH_ERR_ALLOC_FAIL; goto out; } @@ -1918,7 +1908,7 @@ diff -aurp old/sshkey.c new/sshkey.c r = SSH_ERR_KEY_LENGTH; goto out; } -@@ -3707,7 +4090,6 @@ translate_libcrypto_error(unsigned long +@@ -3769,7 +4152,6 @@ translate_libcrypto_error(unsigned long switch (pem_reason) { case EVP_R_BAD_DECRYPT: return SSH_ERR_KEY_WRONG_PASSPHRASE; @@ -1926,7 +1916,7 @@ diff -aurp old/sshkey.c new/sshkey.c case EVP_R_DECODE_ERROR: #ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR case EVP_R_PRIVATE_KEY_DECODE_ERROR: -@@ -3772,7 +4154,7 @@ sshkey_parse_private_pem_fileblob(struct +@@ -3834,7 +4216,7 @@ sshkey_parse_private_pem_fileblob(struct r = convert_libcrypto_error(); goto out; } @@ -1935,7 +1925,7 @@ diff -aurp old/sshkey.c new/sshkey.c (type == KEY_UNSPEC || type == KEY_RSA)) { if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { r = SSH_ERR_ALLOC_FAIL; -@@ -3787,11 +4169,11 @@ sshkey_parse_private_pem_fileblob(struct +@@ -3849,11 +4231,11 @@ sshkey_parse_private_pem_fileblob(struct r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } @@ -1949,7 +1939,7 @@ diff -aurp old/sshkey.c new/sshkey.c (type == KEY_UNSPEC || type == KEY_DSA)) { if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { r = SSH_ERR_ALLOC_FAIL; -@@ -3803,7 +4185,7 @@ sshkey_parse_private_pem_fileblob(struct +@@ -3865,7 +4247,7 @@ sshkey_parse_private_pem_fileblob(struct DSA_print_fp(stderr, prv->dsa, 8); #endif #ifdef OPENSSL_HAS_ECC -- 2.18.0

3 5

[PATCH 1/3 v3] Unbound: Enable DNS cache poisoning mitigation
by Peter Müller 09 Sep '18

09 Sep '18

By default, Unbound neither keeps track of the number of unwanted replies nor initiates countermeasures if they become too large (DNS cache poisoning). This sets the maximum number of tolerated unwanted replies to 1M, causing the cache to be flushed afterwards. (Upstream documentation recommends 10M as a threshold, but this turned out to be ineffective against attacks in the wild.) See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for details. This version of the patch uses 1M as threshold instead of 5M and supersedes the first version. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/unbound/unbound.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 3f724d8f7..fa2ca3fd4 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -61,6 +61,9 @@ server: harden-algo-downgrade: no use-caps-for-id: no + # Harden against DNS cache poisoning + unwanted-reply-threshold: 1000000 + # Listen on all interfaces interface-automatic: yes interface: 0.0.0.0 -- 2.16.4

2 3

[PATCH] OpenVPN: Introduce Negotiable Crypto Parameters for roadwarriors
by Erik Kapfer 09 Sep '18

09 Sep '18

The ncp-ciphers differs to the OpenVPN default value and has been adapted from Fedora. Please see explanations in https://fedoraproject.org/wiki/Changes/New_default_cipher_in_OpenVPN . --- html/cgi-bin/ovpnmain.cgi | 38 +++++++++++++++++++++++++++----------- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + 3 files changed, 29 insertions(+), 11 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 976300f..dc22ba5 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -321,8 +321,13 @@ sub writeserverconf { } print CONF "status-version 1\n"; print CONF "status /var/run/ovpnserver.log 30\n"; - print CONF "ncp-disable\n"; print CONF "cipher $sovpnsettings{DCIPHER}\n"; + # Enable Negotiable Crypto Parameters + if ($sovpnsettings{'NCP'} eq 'on') { + print CONF "ncp-ciphers AES-256-GCM:AES-256-CBC:AES-128-GCM:AES-128-CBC:BF-CBC\n"; + } else { + print CONF "ncp-disable\n"; + } if ($sovpnsettings{'DAUTH'} eq '') { print CONF ""; } else { @@ -789,6 +794,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'}; $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'}; $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'}; + $vpnsettings{'NCP'} = $cgiparams{'NCP'}; my @temp=(); if ($cgiparams{'FRAGMENT'} eq '') { @@ -2685,6 +2691,9 @@ ADV_ERROR: $checked{'TLSAUTH'}{'off'} = ''; $checked{'TLSAUTH'}{'on'} = ''; $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED'; + $checked{'NCP'}{'off'} = ''; + $checked{'NCP'}{'on'} = ''; + $checked{'NCP'}{$cgiparams{'NCP'}} = 'CHECKED'; &Header::showhttpheaders(); &Header::openpage($Lang::tr{'status ovpn'}, 1, ''); @@ -2818,6 +2827,22 @@ print <<END; <tr> <td class'base'><b>$Lang::tr{'ovpn crypt options'}</b></td> </tr> + +<table width='100%'> + <tr> + <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td> + </tr> + + <tr> + <td class='base'>$Lang::tr{'ovpn ncp'}</td> + <td><input type='checkbox' name='NCP' $checked{'NCP'}{'on'} /></td> + </tr> + + <tr> + <td class='base'>HMAC tls-auth</td> + <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td> + </tr> + <tr> <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td> </tr> @@ -2833,17 +2858,8 @@ print <<END; <td>$Lang::tr{'openvpn default'}: <span class="base">SHA1 (160 $Lang::tr{'bit'})</span></td> </tr> </table> +<hr size='1'> -<table width='100%'> - <tr> - <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td> - </tr> - - <tr> - <td class='base'>HMAC tls-auth</td> - <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td> - </tr> - </table><hr> END if ( -e "/var/run/openvpn.pid"){ diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 6e3dba4..9f0de6b 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1833,6 +1833,7 @@ 'ovpn mtu-disc off' => 'Deaktiviert', 'ovpn mtu-disc with mssfix or fragment' => 'Path MTU Discovery kann nicht gemeinsam mit mssfix oder fragment verwendet werden.', 'ovpn mtu-disc yes' => 'Forciert', +'ovpn ncp' => 'Verschlüsselung aushandeln', 'ovpn no connections' => 'Keine aktiven OpenVPN Verbindungen', 'ovpn on blue' => 'OpenVPN auf BLAU:', 'ovpn on orange' => 'OpenVPN auf ORANGE:', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 3ec5af5..5cd47b1 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1866,6 +1866,7 @@ 'ovpn mtu-disc off' => 'Disabled', 'ovpn mtu-disc with mssfix or fragment' => 'Path MTU Discovery cannot be used with mssfix or fragment.', 'ovpn mtu-disc yes' => 'Forced', +'ovpn ncp' => 'Negotiate encryption', 'ovpn no connections' => 'No active OpenVPN connections', 'ovpn on blue' => 'OpenVPN on BLUE:', 'ovpn on orange' => 'OpenVPN on ORANGE:', -- 2.7.4

4 19

Re: Testing core update 123
by Paul Titjen 29 Aug '18

29 Aug '18

Thanks Tom, Makes sense for me to take a note of user settings do a fresh install and recreate manually the setup as I have no idea which .ipf file I used to restore so lots of scripts could be affected.In future I will create backups regularly and keep them downloaded into directories named with the core update value. An improvement suggestion would be for the backup script to also build the core update number as well as the date and timestamp into the backup filename. This would provide a helpful reminder to users of what might need to be followed up on. RegardsPaul Paul Titjen -------- Original message -------- From: Tom Rymes <trymes(a)rymes.com> Date: 29/08/2018 02:16 (GMT+00:00) To: Paul Titjen <paul.titjen(a)ministc.com> Cc: ummeegge <ummeegge(a)ipfire.org>, development(a)lists.ipfire.org Subject: Re: Testing core update 123 I have had this same issue with restoring an old backup to a newer version. A machine dies one core 118, say, so you download 119 because that is the current, and you don’t remeber what core version the backup is from. Then, the changes that were applied as part of the upgrade process haven’t been run against the restored files and you have issues like the php file causing Apache to not run. I have repaired this problem in the past by forcing pakfire to think the system is running the old version still and then making it reapply the updates. Tom On Aug 28, 2018, at 5:29 PM, Paul Titjen <paul.titjen(a)ministc.com> wrote: Hi, Thanks for the feedback. That certainly sorted the issue and the crypto warning has now gone. The root cause was that my original clean install of 2.21 core120 was then amended by an old 2.19 backup .ipf file. This has then put back an old version of /var/ipfire/ovpn/openssl/oven.cnf so adding those extended key usage lines back in and making new certs did the trick. I have been caught out before by this restore of an old backup on a newer version of ipfire. My old restore had an include of a php extension in the Web server conf. After the restore Web interface disappeared on reboot due to apache failing the startup. Using command line soon fixed it once having worked out the cause. This brings me to the backup ISO not working. Looking at the script it seems that it is downloading the ISO from ipfire download website with the core update number used in the source URL - the 123 iso is not yet available to download there and only the stable versions hence the fail. I am sure it works with 122. If all it does is get a clean iso then that still leaves the issue of breaking a clean install by restoring an old backup .ipf or does it build a new distribution based on the iso and the existing configuration files as a unique ISO for instant recreate of a system. No real issues then as explanations found. 123 is running nicely.Thanks for all the good work and help. Paul Titjen -------- Original message -------- From: ummeegge <ummeegge(a)ipfire.org> Date: 28/08/2018 20:00 (GMT+00:00) To: development(a)lists.ipfire.org Subject: Re: Testing core update 123 Hi Paul, an thanks for your feedback. Causing the OpenVPN messages: Am Dienstag, den 28.08.2018, 18:11 +0100 schrieb Paul Titjen: > OpenVPN > Initially had the two crypto warnings so deleted all the cert data > and then generated new DH parameters with 3076 value. Then generated > new certificate data using the 3076 value. This removed the DH size > warning but still leaves the following: > > Cryptographic warning > Your host certificate is not RFC3280 compliant. > Please update to the latest IPFire version and generate as soon as > possible a new root and host certificate. > All OpenVPN clients needs then to be renewed! > > > I looked for any settings that I could apply in web GUI to set > extendkeyusage with TLS Web Server Authentication in the cert > generation to make the warning go away but could not find a way to do > this. The needed changes are already shipped https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=b66b02ab73863bcb9130300… . To get the needed changes to your certificates and configuration, you will need to renew the complete x509 which will also reset all existing clients. You can find in here https://forum.ipfire.org/viewtopic.php?t=18852#p108144 a more detailed discussion about this topic whereby OpenVPN provides some infos also in here https://community.openvpn.net/openvpn/wiki/DeprecatedOptions#a--ns-cert-type . It is time until OpenVPN version 2.5 but ns-cert-type will be dropped then. > > + # Warning if certificate is not compliant to RFC3280 TLS > rules > + if (-f "${General::swroot}/ovpn/certs/servercert.pem") { > + my $extendkeyusage = `/usr/bin/openssl x509 -noout > -text -in ${General::swroot}/ovpn/certs/servercert.pem`; > + if ($extendkeyusage !~ /TLS Web Server > Authentication/) { > + $cryptowarning = "$Lang::tr{'ovpn warning > rfc3280'}"; > + goto CRYPTO_WARNING; > + } > + } > + > + CRYPTO_WARNING: > > Is OpenVPN going to require critical extends on the certs in the > future? Yes, see above. > > Hope this somewhat limited testing information helps. Great, and thanks. > > Regards, > Paul > > >

1 0

Re: Testing core update 123
by Paul Titjen 29 Aug '18

29 Aug '18

Hi, Thanks for the feedback. That certainly sorted the issue and the crypto warning has now gone. The root cause was that my original clean install of 2.21 core120 was then amended by an old 2.19 backup .ipf file. This has then put back an old version of /var/ipfire/ovpn/openssl/oven.cnf so adding those extended key usage lines back in and making new certs did the trick. I have been caught out before by this restore of an old backup on a newer version of ipfire. My old restore had an include of a php extension in the Web server conf. After the restore Web interface disappeared on reboot due to apache failing the startup. Using command line soon fixed it once having worked out the cause. This brings me to the backup ISO not working. Looking at the script it seems that it is downloading the ISO from ipfire download website with the core update number used in the source URL - the 123 iso is not yet available to download there and only the stable versions hence the fail. I am sure it works with 122. If all it does is get a clean iso then that still leaves the issue of breaking a clean install by restoring an old backup .ipf or does it build a new distribution based on the iso and the existing configuration files as a unique ISO for instant recreate of a system. No real issues then as explanations found. 123 is running nicely.Thanks for all the good work and help. Paul Titjen -------- Original message -------- From: ummeegge <ummeegge(a)ipfire.org> Date: 28/08/2018 20:00 (GMT+00:00) To: development(a)lists.ipfire.org Subject: Re: Testing core update 123 Hi Paul, an thanks for your feedback. Causing the OpenVPN messages: Am Dienstag, den 28.08.2018, 18:11 +0100 schrieb Paul Titjen: > OpenVPN > Initially had the two crypto warnings so deleted all the cert data > and then generated new DH parameters with 3076 value. Then generated > new certificate data using the 3076 value. This removed the DH size > warning but still leaves the following: > > Cryptographic warning > Your host certificate is not RFC3280 compliant. > Please update to the latest IPFire version and generate as soon as > possible a new root and host certificate. > All OpenVPN clients needs then to be renewed! > > > I looked for any settings that I could apply in web GUI to set > extendkeyusage with TLS Web Server Authentication in the cert > generation to make the warning go away but could not find a way to do > this. The needed changes are already shipped https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=b66b02ab73863bcb9130300… . To get the needed changes to your certificates and configuration, you will need to renew the complete x509 which will also reset all existing clients. You can find in here https://forum.ipfire.org/viewtopic.php?t=18852#p108144 a more detailed discussion about this topic whereby OpenVPN provides some infos also in here https://community.openvpn.net/openvpn/wiki/DeprecatedOptions#a--ns-cert-type . It is time until OpenVPN version 2.5 but ns-cert-type will be dropped then. > > + # Warning if certificate is not compliant to RFC3280 TLS > rules > + if (-f "${General::swroot}/ovpn/certs/servercert.pem") { > + my $extendkeyusage = `/usr/bin/openssl x509 -noout > -text -in ${General::swroot}/ovpn/certs/servercert.pem`; > + if ($extendkeyusage !~ /TLS Web Server > Authentication/) { > + $cryptowarning = "$Lang::tr{'ovpn warning > rfc3280'}"; > + goto CRYPTO_WARNING; > + } > + } > + > + CRYPTO_WARNING: > > Is OpenVPN going to require critical extends on the certs in the > future? Yes, see above. > > Hope this somewhat limited testing information helps. Great, and thanks. > > Regards, > Paul > > >

3 2

Testing core update 123
by Paul Titjen 28 Aug '18

28 Aug '18

Hi all, I too am testing core update 123. My version of ipfire was a new install of 2.21 core update 122 followed by a restore of an .ipf backup from last 2.19. This was then moved up to Core Update 123. So far stable and have only two issues unresolved so far. Backup. Generate ISO is still not working for me. I still have a size of 0.00 MB. Web gui shows "Backup from ipfire-2.21.x86_64-full-core123.iso Size 0.00 MB" The normal backup to generate an ".ipf" file does work. Web gui shows "Backup from 20180823-1150.ipf Size 14.38 MB" Downloading these backups confirms the sizes shown. OpenVPN Initially had the two crypto warnings so deleted all the cert data and then generated new DH parameters with 3076 value. Then generated new certificate data using the 3076 value. This removed the DH size warning but still leaves the following: Cryptographic warning Your host certificate is not RFC3280 compliant. Please update to the latest IPFire version and generate as soon as possible a new root and host certificate. All OpenVPN clients needs then to be renewed! I looked for any settings that I could apply in web GUI to set extendkeyusage with TLS Web Server Authentication in the cert generation to make the warning go away but could not find a way to do this. + # Warning if certificate is not compliant to RFC3280 TLS rules + if (-f "${General::swroot}/ovpn/certs/servercert.pem") { + my $extendkeyusage = `/usr/bin/openssl x509 -noout -text -in ${General::swroot}/ovpn/certs/servercert.pem`; + if ($extendkeyusage !~ /TLS Web Server Authentication/) { + $cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}"; + goto CRYPTO_WARNING; + } + } + + CRYPTO_WARNING: Is OpenVPN going to require critical extends on the certs in the future? Hope this somewhat limited testing information helps. Regards, Paul

3 2

Core 123 testing
by Kienker, Fred 28 Aug '18

28 Aug '18

We have updated 2 of our test systems to the Testing 123 Core update. No issues were encountered during the update. During the 10 days of testing, we have seen no issues with either of the firewall systems. This looks to be a very clean update. Congrats to all! Best regards, Fred

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2018