Development February 2019

development@lists.ipfire.org

14 participants
55 discussions

[PATCH] python3-llfuse: Fix build on i586
by Matthias Fischer 08 Feb '19

08 Feb '19

Fixes "tar: usr/lib/python3.6/site-packages/llfuse.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory" Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/i586/python3-llfuse | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 config/rootfiles/packages/i586/python3-llfuse diff --git a/config/rootfiles/packages/i586/python3-llfuse b/config/rootfiles/packages/i586/python3-llfuse new file mode 100644 index 000000000..29c59e3aa --- /dev/null +++ b/config/rootfiles/packages/i586/python3-llfuse @@ -0,0 +1,7 @@ +usr/lib/python3.6/site-packages/llfuse-1.3.5-py3.6.egg-info +usr/lib/python3.6/site-packages/llfuse-1.3.5-py3.6.egg-info/PKG-INFO +usr/lib/python3.6/site-packages/llfuse-1.3.5-py3.6.egg-info/SOURCES.txt +usr/lib/python3.6/site-packages/llfuse-1.3.5-py3.6.egg-info/dependency_links.txt +usr/lib/python3.6/site-packages/llfuse-1.3.5-py3.6.egg-info/top_level.txt +usr/lib/python3.6/site-packages/llfuse-1.3.5-py3.6.egg-info/zip-safe +usr/lib/python3.6/site-packages/llfuse.cpython-36m-i386-linux-gnu.so -- 2.18.0

1 0

[PATCH 2/3] Suricata: enable full detection for missing protocols
by Peter Müller 07 Feb '19

07 Feb '19

These are IMAP and MSN, which can be safely enabled. Partially fixes #11808 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/suricata.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index dd7e53584..d7302788c 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -182,9 +182,9 @@ app-layer: content-inspect-min-size: 32768 content-inspect-window: 4096 imap: - enabled: detection-only + enabled: yes msn: - enabled: detection-only + enabled: yes smb: enabled: yes detection-ports: -- 2.16.4

2 1

[PATCH 1/3] Suricata: detect TLS traffic on IMAPS/POP3S/SSMTP ports as, well
by Peter Müller 07 Feb '19

07 Feb '19

Partially fixes #11808 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/suricata.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 48035a67e..dd7e53584 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -140,7 +140,7 @@ app-layer: tls: enabled: yes detection-ports: - dp: 443 + dp: "[443,465,993,995]" # Completely stop processing TLS/SSL session after the handshake # completed. If bypass is enabled this will also trigger flow -- 2.16.4

2 1

New bootstrap/jQuery WUI theme - based on adminlte
by Rachid Groeneveld 06 Feb '19

06 Feb '19

Hi all, I hope I'm doing this right, as it's my first time "posting" to a (development) mailing list. Let me introduce myself first; I'm Rachid (Saiyato on the forums) and I've been working on a new WUI theme, right now it's a bit bloated compared to the other skins, but it also features a lot; especially in terms of icons. I'm not a developer by profession, but I do understand some languages (C#, python, perl, javascript), the only problem is that I lack pattern knowledge, which means my code might not be a neat as I would like it to be. So please do correct my erroneous code when you see it 😉 I do strive to use as little code as possible and combine/re-use portions, as well as google for the best options (if I can find the right keywords). If you have any questions, don't hesitate to contact me, I live in the Netherlands, so Nederlands, English or Deutsch is fine. As for the WUI, I used the bootstrap/adminlte framework, which was fairly easy to implement, I threw in some fonts for icons, so it's quite easy to fancy-up your config pages. As this point I did implement an override script for some parts of the existing UI's, this way I could 'integrate' those pages better, but feel free to provide me with better ways/tip 'n tricks. As you might see I'm struggling with naming... Pascal, camel... all low... What should I do best in the IPFire ecosystem? The attached screenshot give an impression of the UI, I did remove the map though... it caused all sorts of resizing issues and I'm not sure what kind of reporting actually makes sense on the dash. So that's still an open issue. I uploaded the whole lot to github (https://github.com/Saiyato/ipfire-skin-dashboard) and created some issues for known problems, it also features an installation script, which automatically sets the skin (~/main/settings[@THEME]). Since it's bootstrap, it will resize on phones and still remain responsive and modern looking. Most of the values are displaying real info, I used various cgi's to copy code from. The only dummy values are the statistics box (since I'm not sure what makes sense to show there) and guest wifi (maybe someone will make an addon for that, right now it's not supported out-of-the-box, correct me if I'm wrong). Happy holidays to all and a happy new year in advance! Cheers, Rachid PS: something went wrong attaching the images, so one attachment might be corrupt, mea culpa.

2 2

[PATCH] apply default firewall policy for ORANGE, too
by Peter Müller 06 Feb '19

06 Feb '19

If firewall default policy is set to DROP, this setting was not applied to outgoing ORANGE traffic as well, which was misleading. Fixes #11973 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> Cc: Oliver Fuhrer <oliver.fuhrer(a)bluewin.ch> --- src/initscripts/system/firewall | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 707209987..b9dd3485e 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -294,7 +294,7 @@ iptables_init() { iptables -N OVPNINPUT iptables -A INPUT -j OVPNINPUT - # TOR + # Tor iptables -N TOR_INPUT iptables -A INPUT -j TOR_INPUT @@ -414,15 +414,6 @@ iptables_red_up() { iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT fi - # Orange pinholes - if [ "$ORANGE_DEV" != "" ]; then - # This rule enables a host on ORANGE network to connect to the outside - # (only if we have a red connection) - if [ "$IFACE" != "" ]; then - iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT - fi - fi - if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then # DHCP if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then @@ -470,7 +461,7 @@ iptables_red_up() { iptables_red_down() { # Prohibit packets to reach the masquerading rule - # while the wan interface is down - this is required to + # while the WAN interface is down - this is required to # circumvent udp related NAT issues # http://forum.ipfire.org/index.php?topic=11127.0 if [ -n "${IFACE}" ]; then -- 2.16.4

1 0

[PATCH] Tor: update to 0.3.5.7
by Peter Müller 06 Feb '19

06 Feb '19

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/packages/tor | 3 +++ lfs/tor | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/tor b/config/rootfiles/packages/tor index 972b20775..c75e86f11 100644 --- a/config/rootfiles/packages/tor +++ b/config/rootfiles/packages/tor @@ -8,15 +8,18 @@ etc/tor/torrc srv/web/ipfire/cgi-bin/tor.cgi usr/bin/tor usr/bin/tor-gencert +usr/bin/tor-print-ed-signing-cert usr/bin/tor-resolve #usr/bin/torify usr/local/bin/torctrl #usr/share/doc/tor #usr/share/doc/tor/tor-gencert.html +#usr/share/doc/tor/tor-print-ed-signing-cert.html #usr/share/doc/tor/tor-resolve.html #usr/share/doc/tor/tor.html #usr/share/doc/tor/torify.html #usr/share/man/man1/tor-gencert.1 +#usr/share/man/man1/tor-print-ed-signing-cert.1 #usr/share/man/man1/tor-resolve.1 #usr/share/man/man1/tor.1 #usr/share/man/man1/torify.1 diff --git a/lfs/tor b/lfs/tor index 2c3940638..e1027c131 100644 --- a/lfs/tor +++ b/lfs/tor @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.3.4.9 +VER = 0.3.5.7 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 31 +PAK_VER = 32 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8a303c7c2491cd27b1646f6efdc4a5d0 +$(DL_FILE)_MD5 = 8076f11045b5a94fd4ef0a0114b845f6 install : $(TARGET) -- 2.16.4

1 0

Kicking off DNS-over-TLS
by Michael Tremer 06 Feb '19

06 Feb '19

Hello guys, So we have had many many conversations about DNS-over-TLS on this list and on the weekly phone calls, I would like to make a plan now to finally get this into the distribution. We have already ticked some boxes: * Unbound is there and compiled with support for DoT * OpenSSL 1.1.1 is in next - has TLSv1.3 - not essentially necessary but makes this faster * We have TCP Fast Open enabled in next Then there is a CGI from Erik which makes editing the upstream name servers really nice. Last time we talked about how to actually get that integrated into the whole lot of the other things. There is by now at least three different places where DNS servers are being configured. A fourth one will make things even more confusing as they are. I would like to get rid of the old ones and only use the new one then. We also will need some switches for some basic configuration: * DNS-over-TLS enforced? I think everyone who uses DoT wants this enabled * DNSSEC permissive mode - some requested this and I am still opposed to offer this, but hey * QNAME minimisation * Recursor mode?! I guess this can all be on the same CGI with the list of servers to use. Finally, we will have to update the initscript that checks DNS servers right now. It needs to be stripped down as much us possible because it is otherwise unmaintainable. This is my view on things right now. Status is about four weeks old. Maybe more things have happened in the meantime. I would like to coordinate how we are moving forward with this now. Hands up! :) There is basically no pressure on us to deliver this as soon as possible, but it is a nice feature and many have been asking for this. So maybe we can target Core Update 131 or earlier! -Michael

4 8

Re: IPFire meets Suricata - Call for tester
by Stefan Schantl 06 Feb '19

06 Feb '19

Hello Ville, thanks for joining the testing team. There is currently no update from an existing IPFire installation to the suricata containing one. So you have to create backups, do a fresh installation and then restore your backups. If possible and some test hardware is available, please install the image on a different machine than your productive one. Best regards, -Stefan > Hello, > > Thx for bringing this update! > > Is it ok to update my stable version of ipfire core 126 or should I > install this suricata version and then use backups to get my data and > settings back? > > -Ville- > > > > On 6 Feb 2019, at 10.58, Stefan Schantl <stefan.schantl(a)ipfire.org> > > wrote: > > > > Hello list, > > > > today im very happy to announce a new test image with the latest > > snapshot of the process bringing suricata to all of you. > > > > The image is now hosted and provided by the nightly build feature > > (a > > big thanks to Michael for providing this) of IPFire, so if > > development > > goes on, every time a new image will be generated and easily can be > > downloaded. > > > > The latest image always can be grabbed from here: > > > > https://nightly.ipfire.org/next-suricata/latest/x86_64/ > > > > Direct link for downloading the ISO image: > > > > https://nightly.ipfire.org/next-suricata/latest/x86_64/ipfire-2.21.x86_64-f… > > > > There is currently one known issue, that any kind of snort rules > > (sourcefire) currenty can not be downloaded, so you have to use the > > rulesets from emergingthreads for testing. This issue will be fixed > > with the next image provided by the nightly build service. > > > > Thanks for downloading and testing, as usual please file any bugs > > to > > our bugtracker (https://bugzilla.ipfire.org) and share your > > feedback on > > this list. > > > > Best regards, > > > > -Stefan > > > > > > > Hello list followers, > > > > > > some time ago development for the new implementation of the > > > Intrusion > > > Detection functionality in IPFire has been started. > > > > > > The main goal, in a nutshell, was to give IPFire a modern, > > > feature- > > > rich > > > and user-friendly Intrusion Detection Engine. During this > > > progress, > > > the > > > detection framework has been replaced - now suricata is used > > > instead > > > of > > > snort. > > > > > > Suricata uses a very modern and multi-threaded detection engine > > > with > > > support to perform actions on malicious traffic. So it provides > > > the > > > functionality of detecting any kind of intrusion attempts and the > > > ability of guardian to block them under the same hood. > > > > > > It was a lot of work, but finaly I'm happy to announce the first > > > test > > > version. It is almost feature complete and without any kind of > > > bigger > > > issues. > > > > > > Because Intrusion Detection is a key feature of a firewall > > > system, a > > > lot of testing is required until the new implementation can > > > become > > > part > > > of IPFire - therefore we need your help! > > > > > > Download the test image ( > > > https://people.ipfire.org/~stevee/suricata/Images/), do a lot of > > > hard > > > testing and provide your feedback or suggestions on the > > > develoment > > > mailing list ( > > > https://lists.ipfire.org/mailman/listinfo/development). > > > > > > If you find any bugs please file them in the IPFire Bugtracker ( > > > https://bugzilla.ipfire.org/). > > > > > > Many thanks in advance, > > > > > > -Stefan

2 1

[PATCH] python3-msgpack: Fix build on i586
by Jonatan Schlag 05 Feb '19

05 Feb '19

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- config/rootfiles/packages/i586/python3-msgpack | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 config/rootfiles/packages/i586/python3-msgpack diff --git a/config/rootfiles/packages/i586/python3-msgpack b/config/rootfiles/packages/i586/python3-msgpack new file mode 100644 index 0000000..5580b25 --- /dev/null +++ b/config/rootfiles/packages/i586/python3-msgpack @@ -0,0 +1,17 @@ +#usr/lib/python3.6/site-packages/msgpack +usr/lib/python3.6/site-packages/msgpack/__init__.py +usr/lib/python3.6/site-packages/msgpack/__pycache__ +usr/lib/python3.6/site-packages/msgpack/__pycache__/__init__.cpython-36.pyc +usr/lib/python3.6/site-packages/msgpack/__pycache__/_version.cpython-36.pyc +usr/lib/python3.6/site-packages/msgpack/__pycache__/exceptions.cpython-36.pyc +usr/lib/python3.6/site-packages/msgpack/__pycache__/fallback.cpython-36.pyc +usr/lib/python3.6/site-packages/msgpack/_packer.cpython-36m-i386-linux-gnu.so +usr/lib/python3.6/site-packages/msgpack/_unpacker.cpython-36m-i386-linux-gnu.so +usr/lib/python3.6/site-packages/msgpack/_version.py +usr/lib/python3.6/site-packages/msgpack/exceptions.py +usr/lib/python3.6/site-packages/msgpack/fallback.py +usr/lib/python3.6/site-packages/msgpack_python-0.5.6-py3.6.egg-info +usr/lib/python3.6/site-packages/msgpack_python-0.5.6-py3.6.egg-info/PKG-INFO +usr/lib/python3.6/site-packages/msgpack_python-0.5.6-py3.6.egg-info/SOURCES.txt +usr/lib/python3.6/site-packages/msgpack_python-0.5.6-py3.6.egg-info/dependency_links.txt +usr/lib/python3.6/site-packages/msgpack_python-0.5.6-py3.6.egg-info/top_level.txt -- 1.8.3.1

2 1

[PATCH] dhcpcd: Update to 7.1.0
by Matthias Fischer 05 Feb '19

05 Feb '19

For some informations about this update see: https://roy.marples.name/blog/dhcpcd-7-1-0-released "dhcpcd-7.1.0 has been released with the following changes: - OpenBSD: works alongside slaacd(8) - NetBSD: sets SO_RERROR on to detect receive socket overflow - BSD: route improvements to avoid listening for own changes - Linux: use NETLINK_BROADCAST_ERROR - BSD: avoid late address deletion messages by testing address existance - IP6: implement IP6 address sharing - BSD: catch UP/DOWN events when interfaces does support media changes - IPv4LL: remember old address when carrier is lost Many other minor fixes and documenation updates have been submitted by various community members for this release..." Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dhcpcd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index 9f3f5fbb6..cd940ae8b 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -24,7 +24,7 @@ include Config -VER = 7.0.8 +VER = 7.1.0 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 77bbb1d73b6f30d6ddcc8b0fd3eae266 +$(DL_FILE)_MD5 = 918520b171f32f0da97316f3bcf3edc1 install : $(TARGET) -- 2.18.0

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2019