Development November 2019

development@lists.ipfire.org

14 participants
49 discussions

[PATCH] bird: Fix path of configuration file in backup
by Michael Tremer 19 Nov '19

19 Nov '19

The backup did not pack the configuration file due to an incorrect path. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/backup/includes/bird | 2 +- lfs/bird | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/backup/includes/bird b/config/backup/includes/bird index 377010bed..b5e25ff87 100644 --- a/config/backup/includes/bird +++ b/config/backup/includes/bird @@ -1 +1 @@ -etc/bird.conf +/etc/bird.conf diff --git a/lfs/bird b/lfs/bird index 7a2763b23..191f2ac04 100644 --- a/lfs/bird +++ b/lfs/bird @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = bird -PAK_VER = 5 +PAK_VER = 6 DEPS = "" -- 2.20.1

1 0

[PATCH] pcre: Add pcregrep to core system
by Erik Kapfer 19 Nov '19

19 Nov '19

Triggered by --> https://community.ipfire.org/t/pcregrep-on-ipfire/259 . This patch adds pcregrep only from the actual package not from pcre-compat. Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- config/rootfiles/common/pcre | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/common/pcre b/config/rootfiles/common/pcre index 6db5724fa..79779fb94 100644 --- a/config/rootfiles/common/pcre +++ b/config/rootfiles/common/pcre @@ -1,5 +1,5 @@ #usr/bin/pcre-config -#usr/bin/pcregrep +usr/bin/pcregrep #usr/bin/pcretest #usr/include/pcre.h #usr/include/pcre_scanner.h -- 2.12.2

1 0

Core Update 138 (testing) report
by Peter Müller 18 Nov '19

18 Nov '19

Hello Arne, hello *, Core Update 138 (testing, see: https://blog.ipfire.org/post/ipfire-2-23-core-update-138-is-available-for-t…) is running here for about 24 hours without any unexpected behaviour so far. Since the CPU of my testing machine (Intel Celeron N3150) is not vulnerable to the attacks recently published, I am unable to confirm mitigations against these: > [root@maverick ~]# grep . /sys/devices/system/cpu/vulnerabilities/* > /sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected > /sys/devices/system/cpu/vulnerabilities/l1tf:Not affected > /sys/devices/system/cpu/vulnerabilities/mds:Mitigation: Clear CPU buffers; SMT disabled > /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI > /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected > /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization > /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling > /sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected The updated vulnerabilities.cgi shows the same situation (I still wonder whether the vulnerability listing follows any sort criterion). @Arne: I observed multiple rootfile and symbolic link patches for the intel-microcode patch of mine (thank you for this). However, they seem to be deleted - are you sure the microcodes were built and shipped the right way? This log output suggests an older version to be in place on my machine: > [root@maverick ~]# grep microcode /var/log/bootlog > [ 0.000000] microcode: microcode updated early to revision 0x368, date = 2019-04-23 > [ 1.966329] microcode: sig=0x406c3, pf=0x1, revision=0x368 > [ 1.966409] microcode: Microcode Update Driver: v2.2. Output of "uname -a" for reference purposes: > [root@maverick ~]# uname -a > Linux maverick 4.14.154-ipfire #1 SMP Fri Nov 15 07:27:41 GMT 2019 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux As far as I am concerned, this emergency Core Update is ready for release if the core developers (Arne et al.) are able to confirm the correct behaviour of the microcodes on affected systems or fix these to be reliably loaded. Thanks, and best regards, Peter Müller

2 3

libusb upgrade 1.0.19 => 1.0.23
by Gerd Hoerst 15 Nov '19

15 Nov '19

Hi ! Ipfire use since a long time libusb 1.0.19 Since i use o*scam on my ipfire i'm behind to have actual usbdrivers regarding my USB Readers. (an also o*scam use it for compilation) So i use long time 1.0.22 (actual 1.0.23 is in preparation) i created a separate packacke to handle this because libusb is ussually shipped with core update How long is cycle in ipfire project to check for actual versions to be integratd ? Are you interested in a "hint" that libusb works that dev team can integrate it ? Please let me know.. Ciao Gerd

1 0

IPFire 2.23 - Core Update 137 released
by Michael Tremer 15 Nov '19

15 Nov '19

https://blog.ipfire.org/post/ipfire-2-23-core-update-137-released We are happy to announce the release of IPFire 2.23 - Core Update 137. It comes with an updated kernel, a reworked Quality of Service and various bug and security fixes. Development around the Quality of Service and tackling some of the bugs required an exceptional amount of team effort in very short time and I am very happy that we are now able to deliver the result to you to improve your networks. Please help us to keep these things coming to you with your donation [1]! An improved and faster QoS As explained in detail in a separate blog post from the engine room [2], we have been working hard on improving our Quality of Service (QoS). It allows to pass a lot more traffic on smaller systems as well as reduces packet latency on faster ones to create a more responsive and faster network. To take full advantage of these changes, we recommend to reboot the system after installing the update. Linux 4.14.150 The IPFire Kernel has been rebased on Linux 4.14.150 and equipped with our usual hardening and other patches. The kernel has been tuned to deliver more throughput for IP connections as well as reducing latency to a minimum to keep your network as responsive and fast as possible. An especially nasty bug that caused the system to drop DNS packets when the Intrusion Detection System was enabled has been tracked down by a large group of IPFire developers and additional help of the suricata team. Misc. • Downloaded GeoIP databases were not always cleaned up from /tmp when a download was unsuccessful. This can cause that the script is filling up the root partition. You can reboot your system to free up space if this has happened to you, too. The script has now been cleaned up, and catches any errors to cleanup afterwards. • IPsec now supports Curve 448 with 224 bit of security. It is a lightweight and slightly faster alternative to Curve25519 and enabled by default for new connections. • Tim Fitzgeorge contributed a patch that restarts the syslog daemon after a backup is being restored to close old log files and write to the restored ones • /var/log/mail is now being rotated • Updated packages: bind 9.11.12, iptables 1.8.3, iproute2 5.3.0, knot 2.8.4, libhtp 0.5.30, libnetfilter_queue 1.0.4, libpcap 1.9.1, libssh 0.9.0, Net-SSLeay 1.88, pcre 8.43, strongswan 5.8.1, suricata 4.1.5, tzdata 2019c, unbound 1.9.4, wpa_supplicant 2.9 Add-ons New: speedtest-cli This is a handy tool to perform a regular speedtest on the console. It was packaged to test the QoS but is handy to test throughput of the firewall to and from the Internet on the console. Updated Packages • bird 2.0.6 now supports RPKI validation by connecting to a process that holds the key material either via TCP or using SSH • sane has been updated to version 1.0.28 and now supports more hardware • A French translation is now available for the Who is Online? add-on • Others: clamav 0.102.0, hostapd 2.9, ipset 7.3, mtr 0.93, nano 4.5, ncat 7.80, nmap 7.80, shairport-sync 3.3.2, tcpdump 4.9.3, tor 0.4.1.6, tshark 3.0.5 [1] https://www.ipfire.org/donate [2] https://blog.ipfire.org/post/on-quadrupling-throughput-of-our-quality-of-se…

1 0

[PATCH] calamaris: Bug fix for proxy reports staying empty after Core 136 upgrade
by Matthias Fischer 14 Nov '19

14 Nov '19

After upgrading to Core 136, 'calamaris' "Proxy reports" stayed empty. GUI always show "No reports available". Tested manually on console stops and throws an error: ... root@ipfire: ~ # /usr/bin/perl /var/ipfire/proxy/calamaris/bin/mkreport 1 0 2019 8 10 2019 -d 10 -P 30 -t 10 -D 2 -u -r -1 -R 100 -s Can't use 'defined(%hash)' (Maybe you should just omit the defined()?) at /var/ipfire/proxy/calamaris/bin/calamaris line 2609. ... Line 2609 was changed and reports are built again. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/calamaris | 5 ++++- .../01_calamaris_cant_use_defined_hash.patch | 12 ++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 src/patches/calamaris/01_calamaris_cant_use_defined_hash.patch diff --git a/lfs/calamaris b/lfs/calamaris index 2022f84f8..32858526a 100644 --- a/lfs/calamaris +++ b/lfs/calamaris @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -70,6 +70,9 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/calamaris/01_calamaris_cant_use_defined_hash.patch + cd $(DIR_APP) && cp -f calamaris $(DIR_SRC)/config/calamaris/mkreport \ /var/ipfire/proxy/calamaris/bin/ chmod 755 /var/ipfire/proxy/calamaris/bin/{calamaris,mkreport} diff --git a/src/patches/calamaris/01_calamaris_cant_use_defined_hash.patch b/src/patches/calamaris/01_calamaris_cant_use_defined_hash.patch new file mode 100644 index 000000000..64d66276c --- /dev/null +++ b/src/patches/calamaris/01_calamaris_cant_use_defined_hash.patch @@ -0,0 +1,12 @@ +diff U3 a/calamaris b/calamaris +--- a/calamaris Sun Jun 6 18:26:14 2004 ++++ b/calamaris Wed Nov 13 19:59:15 2019 +@@ -2606,7 +2606,7 @@ + 100, 100 * $tcp_hit / $tcp ); + } + outstop(10); +- if ( defined(%tcp_content) ) { ++ if (%tcp_content) { + outstart(11); + if ( $tcp == 0 ) { + outline( 11, 'no matching requests' ); -- 2.18.0

2 1

Currently working on new intel-microcode package version...
by Peter Müller 14 Nov '19

14 Nov '19

Hello *, there were some rumors about new CPU vulnerabilites affecting Intel processors coming up since a few days. Since the security advisory was published today, I am currently working on a package update of intel-microcode and will hand in a patch as soon this is done. Just for your information, so we do not do things twice. By the way: Did I mention I stared to hate Intel? Thanks, and best regards, Peter Müller

2 2

Re: Core 136: Calamaris proxy reports stay empty
by Michael Tremer 13 Nov '19

13 Nov '19

Matthias, you are not copying the list any more in most of your emails... > On 12 Nov 2019, at 19:05, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote: > > Hi, > > On 12.11.2019 13:53, Michael Tremer wrote: >> Hi, >> >>> On 11 Nov 2019, at 17:17, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote: >>> >>> On 11.11.2019 14:14, Michael Tremer wrote: >>>> ... >>>> Did you try changing this line as suggested? >>> >>> No, because I'm not that familiar with Perl. How would I do this? >>> >>> Line 2609ff reads: >>> >>> ... >>> if ( defined(%tcp_content) ) { >> >> I think this line should just be: >> >> if (%tcp_content) { > > Done. > > Tested. > > Worked on both machines. > > Thanks. ;-) Cool. Please submit a patch which we can release as a quick bug fix. >> You might have more of those in the file, but I am sure the interpreter will tell you when you try to run it. >> >> As far as I know this whole calamaris thing is not maintained upstream any more. If this isn’t easily fixable we will just have to remove the feature. Not sure how many users this has. > > The last version is 2.99.4.5 (V3-beta) from 2015. I took a quick look > and there are a *lot* of changes. Hm! > > Demo-Screenshots: > https://cord.de/files/calamaris/calamaris-3/ > https://cord.de/files/calamaris/calamaris-3-frame/ This is the HTML report. I am not sure if our version could generate those, but text is obviously easier. > But I don't know if I can handle this - looks complicated - and I'd like > to make a possible update dependent on the number of seriously > interested users. Yeah, I suppose if a drop-in replacement works we can ship it. Otherwise it is not worth the effort. We have so many other things that are more important and more people would benefit from. > Or I just send a patch with the above change. Yes, please do. > > Anyone? Opinions? > > Best, > Matthias

2 1

[PATCH 1/2] Tor: fix permissions of /var/ipfire/tor/torrc after installation
by Stephan Feddersen 13 Nov '19

13 Nov '19

From: "peter.mueller(a)ipfire.org" <peter.mueller(a)ipfire.org> Fixes #12220 Reported-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/tor | 2 +- src/paks/tor/install.sh | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/tor b/lfs/tor index ea07f6ce2..178f84be9 100644 --- a/lfs/tor +++ b/lfs/tor @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 43 +PAK_VER = 44 DEPS = "libseccomp" diff --git a/src/paks/tor/install.sh b/src/paks/tor/install.sh index 4d0353155..369b65f71 100644 --- a/src/paks/tor/install.sh +++ b/src/paks/tor/install.sh @@ -36,10 +36,10 @@ extract_files restore_backup ${NAME} # Adjust some folder permission for new UID/GID -chown -R tor:tor /var/lib/tor /var/ipfire/tor +chown -R tor:tor /var/lib/tor +chown -R tor:nobody /var/ipfire/tor -# Tor settings file needs to be writeable by nobody group for WebUI -chown tor:nobody /var/ipfire/tor/settings -chmod 664 /var/ipfire/tor/settings +# Tor settings files needs to be writeable by nobody group for WebUI +chmod 664 /var/ipfire/tor/{settings,torrc} start_service --background ${NAME} -- 2.17.1

3 3

[PATCH] wio-1.3.2-7: fixed bug with arp client import
by Stephan Feddersen 12 Nov '19

12 Nov '19

--- lfs/wio | 4 ++-- src/wio/wio.cgi | 61 ++++++++++++++++++++++++++++++------------------- 2 files changed, 40 insertions(+), 25 deletions(-) diff --git a/lfs/wio b/lfs/wio index 58ab16620..5ed954676 100644 --- a/lfs/wio +++ b/lfs/wio @@ -1,6 +1,6 @@ ############################################################################### # IPFire.org - An Open Source Firewall Solution # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # ############################################################################### ############################################################################### @@ -15,7 +15,7 @@ THISAPP = wio-$(VER) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = wio -PAK_VER = 6 +PAK_VER = 7 ############################################################################### # Top-level Rules diff --git a/src/wio/wio.cgi b/src/wio/wio.cgi index 1645aa54e..1c380b1a5 100644 --- a/src/wio/wio.cgi +++ b/src/wio/wio.cgi @@ -3,7 +3,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2017-2018 Stephan Feddersen <sfeddersen(a)ipfire.org> # +# Copyright (C) 2017-2019 Stephan Feddersen <sfeddersen(a)ipfire.org> # # All Rights Reserved. # # # # This program is free software: you can redistribute it and/or modify # @@ -21,14 +21,14 @@ # # ############################################################################### # -# Version: 2018/02/27 16:54:23 +# Version: 2019/11/08 14:35:23 # # This wio.cgi is based on the Code from the IPCop WIO Addon # and is extremly adapted to work with IPFire. # # Autor: Stephan Feddersen # Co-Autor: Alexander Marx -# Co-Autor: Frank Mainz +# Co-Autor: Frank Mainz (for some Code for the IPCop WIO Addon) # use strict; @@ -215,7 +215,7 @@ if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_save'}.'2' ) { unless ( `ps -A | grep wio.pl` ) { while ( $count < $wiosettings{'COUNT'} ) { if ( defined($wiosettings{"USE$count"}) && $wiosettings{"USE$count"} eq 'on' ) { - $wiosettings{'CLIENTID'} = $wiosettings{'CLIENTID$count'}; + $wiosettings{'CLIENTID'} = $wiosettings{"CLIENTID$count"}; $wiosettings{'TIMESTAMP'} = $wiosettings{"TIMESTAMP$count"}; $wiosettings{'IPADR'} = $wiosettings{"IPADR$count"}; $wiosettings{'HOST'} = $wiosettings{"HOST$count"}; @@ -226,6 +226,7 @@ if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_save'}.'2' ) { $wiosettings{'SENDEMAILOFF'} = $wiosettings{"SENDEMAILOFF$count"}; $wiosettings{'PINGMETHODE'} = $wiosettings{"PINGMETHODE$count"}; $wiosettings{'ONLINE'} = $wiosettings{"ONLINE$count"}; + $wiosettings{'WEBINTERFACE'} = $wiosettings{"WEBINTERFACE$count"}; &validSave(); @@ -281,39 +282,54 @@ if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_client_add'} ) { ## show / hide arptable if ( $wiosettings{'WIOGUISHOWARPTABLE'} eq 'arptable' ) { - if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_show_table_off'} ) { - $wiosettings{'WIOGUISHOWARPTABLE'} = 'off'; - $arpbuttontext = "$Lang::tr{'wio_show_table_on'}"; + unless ( `ps -A | grep wio.pl` ) { + if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_show_table_off'} ) { + $wiosettings{'WIOGUISHOWARPTABLE'} = 'off'; + $arpbuttontext = "$Lang::tr{'wio_show_table_on'}"; + } + else { + $wiosettings{'WIOGUISHOWARPTABLE'} = 'on'; + $arpbuttontext = "$Lang::tr{'wio_show_table_off'}"; + } } else { - $wiosettings{'WIOGUISHOWARPTABLE'} = 'on'; - $arpbuttontext = "$Lang::tr{'wio_show_table_off'}"; + $infomessage = "$Lang::tr{'wio_error_function'}"; } } ## show / hide clientimporttable if ( $wiosettings{'WIOGUISHOWCLIENTIMPORTTABLE'} eq 'clientimport' ) { - if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_show_table_off'} ) { - $wiosettings{'WIOGUISHOWCLIENTIMPORTTABLE'} = 'off'; - $clientimportbuttontext = "$Lang::tr{'wio_show_table_on'}"; + unless ( `ps -A | grep wio.pl` ) { + if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_show_table_off'} ) { + $wiosettings{'WIOGUISHOWCLIENTIMPORTTABLE'} = 'off'; + $clientimportbuttontext = "$Lang::tr{'wio_show_table_on'}"; + } + else { + $wiosettings{'WIOGUISHOWCLIENTIMPORTTABLE'} = 'on'; + $clientimportbuttontext = "$Lang::tr{'wio_show_table_off'}"; + } } else { - $wiosettings{'WIOGUISHOWCLIENTIMPORTTABLE'} = 'on'; - $clientimportbuttontext = "$Lang::tr{'wio_show_table_off'}"; + $infomessage = "$Lang::tr{'wio_error_function'}"; } } ## show / hide networksearchtable if ( $wiosettings{'WIOGUISHOWNETWORKSEARCHTABLE'} eq 'networksearch' ) { - if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_show_table_off'} ) { - $wiosettings{'WIOGUISHOWNETWORKSEARCHTABLE'} = 'off'; - $networksearchbuttontext = "$Lang::tr{'wio_show_table_on'}"; + unless ( `ps -A | grep wio.pl` ) { + if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_show_table_off'} ) { + $wiosettings{'WIOGUISHOWNETWORKSEARCHTABLE'} = 'off'; + $networksearchbuttontext = "$Lang::tr{'wio_show_table_on'}"; + } + else { + $wiosettings{'WIOGUISHOWNETWORKSEARCHTABLE'} = 'on'; + $networksearchbuttontext = "$Lang::tr{'wio_show_table_off'}"; + } } else { - $wiosettings{'WIOGUISHOWNETWORKSEARCHTABLE'} = 'on'; - $networksearchbuttontext = "$Lang::tr{'wio_show_table_off'}"; + $infomessage = "$Lang::tr{'wio_error_function'}"; } } @@ -388,6 +404,8 @@ if ( defined($edc) || defined($edd) || defined($wmon) || defined($wmoff) || defi if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_refresh'} || $wiosettings{'ACTION'} eq $Lang::tr{'wio_sc_refresh'} ) { +unless ( `ps -A | grep wio.pl` ) { + if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_sc_refresh'} ) { open(FILE, "> $onoffip"); print FILE @current[$wiosettings{'ID'}]; @@ -396,8 +414,6 @@ if ( $wiosettings{'ACTION'} eq $Lang::tr{'wio_refresh'} || $wiosettings{'ACTION' undef($wiosettings{'ID'}); } -unless ( `ps -A | grep wio.pl` ) { - &Header::showhttpheaders(); &Header::openpage($Lang::tr{'wio'}, 1, $refreshbox); &Header::openbigbox('100%', 'left', ''); @@ -417,7 +433,7 @@ print" while ( system("/usr/local/bin/wiohelper", "&") ) {} -exit 0; +exit 0; } else { $infomessage = "$Lang::tr{'wio_already_running'}"; @@ -662,7 +678,6 @@ foreach (@hosts) { $wiosettings{'HOST$count'} = gethostbyaddr(inet_aton($line[1]), AF_INET); if ($wiosettings{'HOST$count'} eq '') { $wiosettings{'HOST$count'} = $line[1]; } $wiosettings{'REMARK$count'} = ''; - $wiosettings{'WEBINTERFACE$count'} = ''; } else { $wiosettings{'HOST$count'} = $line[7]; -- 2.17.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2019