Development September 2019

development@lists.ipfire.org

13 participants
80 discussions

Fw: Extra "Grey" interfaces on IpFire
by Klaus Gimm 24 Sep '19

24 Sep '19

Dear Sir or Madam, as a Long time ipcop user i had installed this add on for a Long time and it worked great for me: http://www.ban-solms.de/t/IPCop-xtiface.html After the Switch to Ipfire as the follow-up Project to ipcop i do miss it dearly. Is it possible to implement this functionality into IpFire? I am unfortunatley not a developer so i cant adjust the package or redesign it. Is there a ticket somewhere to suggest Features for developement? Thanks a lot in advance. Yours sincerely Klaus

2 1

Testing report regarding image: next-suricata-rust/d22217e1-dirty
by peter.mueller＠ipfire.org 24 Sep '19

24 Sep '19

Hello Stefan, sorry for my late reply on this topic. Finally, I was able to test your new ISO, next-suricata-rust/d22217e1-dirty . New connections, regardless of SSH, TLS, DNS or whatever, are now established instantly. No packets are dropped anymore, this issue seems to be solved by the changes included in your ISO. OpenVPN RW performance, however, is worse than before: Now around ~ 400 kB/sec. if Suricata is enabled, and somewhere around 900 kB/sec. if it is not. I am getting the feeling this is an OpenVPN bug or performance issue, but as mentioned several times before, I am not satisfied with OpenVPN anyway. A few minutes after booting, kernel emits these log lines: > Sep 19 22:01:51 maverick kernel: refcount_t: increment on 0; use-after-free. > Sep 19 22:01:51 maverick kernel: ------------[ cut here ]------------ > Sep 19 22:01:51 maverick kernel: WARNING: CPU: 2 PID: 2510 at lib/refcount.c:153 refcount_inc.cold.12+0x13/0x16 > Sep 19 22:01:51 maverick kernel: Modules linked in: xt_IMQ imq xt_length xt_DSCP xt_layer7 cls_fw sch_htb chacha20_x86_64 chacha20_generic poly1305_x86_64 poly1305_generic chacha20poly1305 esp4 xfrm6_mode_tunnel xfrm4_mode_tunnel tun nfnetlink_queue xt_NFQUEUE ipt_MASQUERADE nf_nat_masquerade_ipv4 pppoe pppox ppp_generic slhc xt_geoip(O) xt_connlimit xt_multiport xt_hashlimit xt_mark xt_policy xt_TCPMSS nf_nat_irc nf_conntrack_irc nf_nat_tftp nf_conntrack_tftp nf_nat_ftp nf_conntrack_ftp xt_CT xt_helper nf_nat_h323 nf_conntrack_h323 xt_conntrack xt_comment ipt_REJECT nf_reject_ipv4 nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_raw iptable_mangle iptable_filter vfat fat snd_hda_codec_hdmi sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic intel_powerclamp coretemp kvm_intel i2c_algo_bit fb_sys_fops syscopyarea > Sep 19 22:01:51 maverick kernel: sysfillrect sysimgblt snd_hda_intel kvm snd_hda_codec snd_hda_core iTCO_wdt iTCO_vendor_support irqbypass snd_hwdep crct10dif_pclmul mcs7830 crc32_pclmul snd_pcm ghash_clmulni_intel snd_timer usbnet r8169 pcspkr snd i2c_i801 lpc_ich mfd_core mii soundcore i2c_hid i2c_core pcc_cpufreq rfkill_gpio rfkill intel_int0002_vgpio lp parport_pc parport video > Sep 19 22:01:51 maverick kernel: CPU: 2 PID: 2510 Comm: W-Q3 Tainted: G O 4.14.138-ipfire #1 > Sep 19 22:01:51 maverick kernel: Hardware name: Gigabyte Technology Co., Ltd. Default string/N3150ND3V, BIOS F5a 01/19/2018 > Sep 19 22:01:51 maverick kernel: task: ffffa393374fb200 task.stack: ffffa98f00290000 > Sep 19 22:01:51 maverick kernel: RIP: 0010:refcount_inc.cold.12+0x13/0x16 > Sep 19 22:01:51 maverick kernel: RSP: 0018:ffffa98f00293798 EFLAGS: 00010246 > Sep 19 22:01:51 maverick kernel: RAX: 000000000000002b RBX: ffffa39338e7ed00 RCX: 0000000000000000 > Sep 19 22:01:51 maverick kernel: RDX: 0000000000000000 RSI: ffffa3933fd163f8 RDI: ffffa3933fd163f8 > Sep 19 22:01:51 maverick kernel: RBP: ffffffffb3e9e220 R08: 000000000000003c R09: 000000000000027c > Sep 19 22:01:51 maverick kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffffa39338c81100 > Sep 19 22:01:51 maverick kernel: R13: ffffffffb44c35c0 R14: 0000000000028003 R15: ffffffffc03fc3e0 > Sep 19 22:01:51 maverick kernel: FS: 00007309737fe700(0000) GS:ffffa3933fd00000(0000) knlGS:0000000000000000 > Sep 19 22:01:51 maverick kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > Sep 19 22:01:51 maverick kernel: CR2: 00007eb62b581728 CR3: 0000000177e30000 CR4: 00000000001006e0 > Sep 19 22:01:51 maverick kernel: Call Trace: > Sep 19 22:01:51 maverick kernel: nf_queue_entry_get_refs+0x41/0x90 > Sep 19 22:01:51 maverick kernel: nf_queue+0xf9/0x220 > Sep 19 22:01:51 maverick kernel: nf_hook_slow+0x9f/0xf0 > Sep 19 22:01:51 maverick kernel: __ip_local_out+0xe4/0x150 > Sep 19 22:01:51 maverick kernel: ? ip_forward_options.cold.7+0x27/0x27 > Sep 19 22:01:51 maverick kernel: xfrm_output_resume+0x21e/0x540 > Sep 19 22:01:51 maverick kernel: ? ipv4_confirm+0x3f/0xd0 > Sep 19 22:01:51 maverick kernel: xfrm4_output+0x3a/0xe0 > Sep 19 22:01:51 maverick kernel: ? xfrm4_udp_encap_rcv+0x1a0/0x1a0 > Sep 19 22:01:51 maverick kernel: nf_reinject+0x176/0x190 > Sep 19 22:01:51 maverick kernel: nfqnl_recv_verdict+0x293/0x4a0 [nfnetlink_queue] > Sep 19 22:01:51 maverick kernel: ? nla_parse+0xb5/0xe0 > Sep 19 22:01:51 maverick kernel: nfnetlink_rcv_msg+0x14e/0x260 > Sep 19 22:01:51 maverick kernel: ? nfnetlink_net_exit_batch+0x60/0x60 > Sep 19 22:01:51 maverick kernel: netlink_rcv_skb+0x78/0x150 > Sep 19 22:01:51 maverick kernel: nfnetlink_rcv+0x70/0x760 > Sep 19 22:01:51 maverick kernel: ? lock_timer_base+0x67/0x80 > Sep 19 22:01:51 maverick kernel: ? try_to_del_timer_sync+0x4d/0x80 > Sep 19 22:01:51 maverick kernel: ? __netlink_lookup+0xe1/0x140 > Sep 19 22:01:51 maverick kernel: netlink_unicast+0x183/0x230 > Sep 19 22:01:51 maverick kernel: netlink_sendmsg+0x204/0x3d0 > Sep 19 22:01:51 maverick kernel: sock_sendmsg+0x36/0x40 > Sep 19 22:01:51 maverick kernel: ___sys_sendmsg+0x2a7/0x300 > Sep 19 22:01:51 maverick kernel: ? netlink_recvmsg+0x398/0x460 > Sep 19 22:01:51 maverick kernel: ? __switch_to_asm+0x41/0x70 > Sep 19 22:01:51 maverick kernel: __sys_sendmsg+0x67/0xb0 > Sep 19 22:01:51 maverick kernel: do_syscall_64+0x67/0x100 > Sep 19 22:01:51 maverick kernel: entry_SYSCALL_64_after_hwframe+0x3d/0xa2 > Sep 19 22:01:51 maverick kernel: RIP: 0033:0x73097af4a8c7 > Sep 19 22:01:51 maverick kernel: RSP: 002b:00007309737fbfc0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e > Sep 19 22:01:51 maverick kernel: RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 000073097af4a8c7 > Sep 19 22:01:51 maverick kernel: RDX: 0000000000000000 RSI: 00007309737fc000 RDI: 0000000000000008 > Sep 19 22:01:51 maverick kernel: RBP: 00007309737fc000 R08: 0000000000000000 R09: 0000000000000301 > Sep 19 22:01:51 maverick kernel: R10: 0000730974409e20 R11: 0000000000000293 R12: 0000000000000000 > Sep 19 22:01:51 maverick kernel: R13: 000073096026cd98 R14: 0000000000000070 R15: 0000000000000001 > Sep 19 22:01:51 maverick kernel: Code: 08 90 67 b4 c6 05 5e ca d8 00 01 e8 f7 e5 d7 ff 0f 0b b8 01 00 00 00 c3 48 c7 c7 60 90 67 b4 c6 05 42 ca d8 00 01 e8 dc e5 d7 ff <0f> 0b c3 48 c7 c7 90 90 67 b4 c6 05 2b ca d8 00 01 e8 c6 e5 d7 > Sep 19 22:01:51 maverick kernel: ---[ end trace dc2e33bbb9167d28 ]--- > Sep 19 22:01:51 maverick kernel: refcount_t: underflow; use-after-free. > Sep 19 22:01:51 maverick kernel: ------------[ cut here ]------------ > Sep 19 22:01:51 maverick kernel: WARNING: CPU: 3 PID: 2507 at lib/refcount.c:187 refcount_sub_and_test.cold.13+0x13/0x1a > Sep 19 22:01:51 maverick kernel: Modules linked in: xt_IMQ imq xt_length xt_DSCP xt_layer7 cls_fw sch_htb chacha20_x86_64 chacha20_generic poly1305_x86_64 poly1305_generic chacha20poly1305 esp4 xfrm6_mode_tunnel xfrm4_mode_tunnel tun nfnetlink_queue xt_NFQUEUE ipt_MASQUERADE nf_nat_masquerade_ipv4 pppoe pppox ppp_generic slhc xt_geoip(O) xt_connlimit xt_multiport xt_hashlimit xt_mark xt_policy xt_TCPMSS nf_nat_irc nf_conntrack_irc nf_nat_tftp nf_conntrack_tftp nf_nat_ftp nf_conntrack_ftp xt_CT xt_helper nf_nat_h323 nf_conntrack_h323 xt_conntrack xt_comment ipt_REJECT nf_reject_ipv4 nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_raw iptable_mangle iptable_filter vfat fat snd_hda_codec_hdmi sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic intel_powerclamp coretemp kvm_intel i2c_algo_bit fb_sys_fops syscopyarea > Sep 19 22:01:51 maverick kernel: sysfillrect sysimgblt snd_hda_intel kvm snd_hda_codec snd_hda_core iTCO_wdt iTCO_vendor_support irqbypass snd_hwdep crct10dif_pclmul mcs7830 crc32_pclmul snd_pcm ghash_clmulni_intel snd_timer usbnet r8169 pcspkr snd i2c_i801 lpc_ich mfd_core mii soundcore i2c_hid i2c_core pcc_cpufreq rfkill_gpio rfkill intel_int0002_vgpio lp parport_pc parport video > Sep 19 22:01:51 maverick kernel: CPU: 3 PID: 2507 Comm: W-Q2 Tainted: G W O 4.14.138-ipfire #1 > Sep 19 22:01:51 maverick kernel: Hardware name: Gigabyte Technology Co., Ltd. Default string/N3150ND3V, BIOS F5a 01/19/2018 > Sep 19 22:01:51 maverick kernel: task: ffffa393395ea580 task.stack: ffffa98f00250000 > Sep 19 22:01:51 maverick kernel: RIP: 0010:refcount_sub_and_test.cold.13+0x13/0x1a > Sep 19 22:01:51 maverick kernel: RSP: 0018:ffffa98f00253928 EFLAGS: 00010246 > Sep 19 22:01:51 maverick kernel: RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000000 > Sep 19 22:01:51 maverick kernel: RDX: 0000000000000000 RSI: ffffa3933fd963f8 RDI: ffffa3933fd963f8 > Sep 19 22:01:51 maverick kernel: RBP: ffffa39339bc4400 R08: 0000000000000038 R09: 00000000000002b4 > Sep 19 22:01:51 maverick kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffffa393383ab480 > Sep 19 22:01:51 maverick kernel: R13: ffffa39337f5da00 R14: ffffa39339cd9840 R15: 0000000000000000 > Sep 19 22:01:51 maverick kernel: FS: 0000730973fff700(0000) GS:ffffa3933fd80000(0000) knlGS:0000000000000000 > Sep 19 22:01:51 maverick kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > Sep 19 22:01:51 maverick kernel: CR2: 0000000002218828 CR3: 0000000177e30000 CR4: 00000000001006e0 > Sep 19 22:01:51 maverick kernel: Call Trace: > Sep 19 22:01:51 maverick kernel: nf_queue_entry_release_refs+0x45/0xa0 > Sep 19 22:01:51 maverick kernel: nf_reinject+0x3d/0x190 > Sep 19 22:01:51 maverick kernel: nfqnl_recv_verdict+0x293/0x4a0 [nfnetlink_queue] > Sep 19 22:01:51 maverick kernel: ? nla_parse+0xb5/0xe0 > Sep 19 22:01:51 maverick kernel: nfnetlink_rcv_msg+0x14e/0x260 > Sep 19 22:01:51 maverick kernel: ? nfnetlink_net_exit_batch+0x60/0x60 > Sep 19 22:01:51 maverick kernel: netlink_rcv_skb+0x78/0x150 > Sep 19 22:01:51 maverick kernel: nfnetlink_rcv+0x70/0x760 > Sep 19 22:01:51 maverick kernel: ? lock_timer_base+0x67/0x80 > Sep 19 22:01:51 maverick kernel: ? try_to_del_timer_sync+0x4d/0x80 > Sep 19 22:01:51 maverick kernel: ? __netlink_lookup+0xe1/0x140 > Sep 19 22:01:51 maverick kernel: netlink_unicast+0x183/0x230 > Sep 19 22:01:51 maverick kernel: netlink_sendmsg+0x204/0x3d0 > Sep 19 22:01:51 maverick kernel: sock_sendmsg+0x36/0x40 > Sep 19 22:01:51 maverick kernel: ___sys_sendmsg+0x2a7/0x300 > Sep 19 22:01:51 maverick kernel: ? netlink_recvmsg+0x398/0x460 > Sep 19 22:01:51 maverick kernel: ? __switch_to_asm+0x41/0x70 > Sep 19 22:01:51 maverick kernel: __sys_sendmsg+0x67/0xb0 > Sep 19 22:01:51 maverick kernel: do_syscall_64+0x67/0x100 > Sep 19 22:01:51 maverick kernel: entry_SYSCALL_64_after_hwframe+0x3d/0xa2 > Sep 19 22:01:51 maverick kernel: RIP: 0033:0x73097af4a8c7 > Sep 19 22:01:51 maverick kernel: RSP: 002b:0000730973ffcfc0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e > Sep 19 22:01:51 maverick kernel: RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000073097af4a8c7 > Sep 19 22:01:51 maverick kernel: RDX: 0000000000000000 RSI: 0000730973ffd000 RDI: 0000000000000007 > Sep 19 22:01:51 maverick kernel: RBP: 0000730973ffd000 R08: 0000000000000000 R09: 0000000000000301 > Sep 19 22:01:51 maverick kernel: R10: 000073096826c188 R11: 0000000000000293 R12: 0000000000000000 > Sep 19 22:01:51 maverick kernel: R13: 000073096826cd98 R14: 0000000065000070 R15: 0000000000000001 > Sep 19 22:01:51 maverick kernel: Code: 00 c3 48 c7 c7 60 90 67 b4 c6 05 42 ca d8 00 01 e8 dc e5 d7 ff 0f 0b c3 48 c7 c7 90 90 67 b4 c6 05 2b ca d8 00 01 e8 c6 e5 d7 ff <0f> 0b e9 86 fe ff ff 48 c7 c7 b8 90 67 b4 c6 05 10 ca d8 00 01 > Sep 19 22:01:51 maverick kernel: ---[ end trace dc2e33bbb9167d29 ]--- Suricata works correctly and detects attacks as expected. Starting sequence took about 83 seconds on my testing hardware. In my point of view, the ISO includes all necessary fixes for curing our Suricata problems - slow establish of new connections, DNS trouble, et cetera - and I would like them to be included in the next Core Update (testing) so we can give it a bigger and more extensive test. What do you think about this? OpenVPN performance is poor, but I guess that is because of something else. Command outputs for reference: > [root@maverick ~]# uname -a > Linux maverick 4.14.138-ipfire #1 SMP Mon Sep 9 07:55:34 GMT 2019 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux > [root@maverick ~]# suricata -V > This is Suricata version 4.1.4 RELEASE > [root@maverick ~]# suricata --build-info > This is Suricata version 4.1.4 RELEASE > Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_LIBJANSSON TLS MAGIC RUST > SIMD support: none > Atomic intrisics: 1 2 4 8 byte(s) > 64-bits, Little-endian architecture > GCC version 8.3.0, C version 199901 > compiled with _FORTIFY_SOURCE=2 > L1 cache line size (CLS)=64 > thread local storage method: __thread > compiled with LibHTP v0.5.30, linked against LibHTP v0.5.30 > > Suricata Configuration: > AF_PACKET support: yes > eBPF support: no > XDP support: no > PF_RING support: no > NFQueue support: yes > NFLOG support: no > IPFW support: no > Netmap support: no > DAG enabled: no > Napatech enabled: no > WinDivert enabled: no > > Unix socket enabled: yes > Detection enabled: yes > > Libmagic support: yes > libnss support: no > libnspr support: no > libjansson support: yes > liblzma support: yes > hiredis support: no > hiredis async with libevent: no > Prelude support: no > PCRE jit: yes > LUA support: no > libluajit: no > libgeoip: no > Non-bundled htp: yes > Old barnyard2 support: no > Hyperscan support: yes > Libnet support: yes > liblz4 support: no > > Rust support: yes > Rust strict mode: no > Rust debug mode: no > Rust compiler: rustc 1.37.0 (eae3437df 2019-08-13) > Rust cargo: cargo 1.37.0 (9edd08916 2019-08-02) > > Install suricatasc: no > Install suricata-update: no > > Profiling enabled: no > Profiling locks enabled: no > > Development settings: > Coccinelle / spatch: no > Unit tests enabled: no > Debug output enabled: no > Debug validation enabled: no > > Generic build parameters: > Installation prefix: /usr > Configuration directory: /etc/suricata/ > Log directory: /var/log/suricata/ > > --prefix /usr > --sysconfdir /etc > --localstatedir /var > --datarootdir /usr/share > > Host: x86_64-pc-linux-gnu > Compiler: gcc (exec name) / gcc (real) > GCC Protect enabled: yes > GCC march native enabled: no > GCC Profile enabled: no > Position Independent Executable enabled: no > CFLAGS -O2 -pipe -Wall -fexceptions -fPIC -m64 -mindirect-branch=thunk -mfunction-return=thunk -mtune=generic -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -I${srcdir}/../rust/gen/c-headers > PCAP_CFLAGS -I/usr/include > SECCFLAGS -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security Thanks, and best regards, Peter Müller

3 3

git send-email Undefined subroutine &IO::Socket::SSL
by ummeegge 23 Sep '19

23 Sep '19

Hi all, i wanted to report a porblem with git send-email. I currently get a Send this email? ([y]es|[n]o|[q]uit|[a]ll): y Undefined subroutine &IO::Socket::SSL::set_client_defaults called at /usr/libexec/git-core/git-send-email line 1371. if i try to send patches to the mailinglist. The email setup is configured like explained in the wiki git config --global sendemail.smtpencryption ssl git config --global sendemail.smtpserver submissions.ipfire.org git config --global sendemail.smtpserverport 465 git config --global sendemail.smtpuser USERNAME Best, Erik

3 10

[PATCH 1/2] wpa_supplicant: Update to 2.9
by Matthias Fischer 23 Sep '19

23 Sep '19

For details see: https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/wpa_supplicant | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant index ad7b45fea..549cee152 100644 --- a/lfs/wpa_supplicant +++ b/lfs/wpa_supplicant @@ -24,7 +24,7 @@ include Config -VER = 2.8 +VER = 2.9 THISAPP = wpa_supplicant-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0af5998c5d924e985cab16b9a1c77904 +$(DL_FILE)_MD5 = 2d2958c782576dc9901092fbfecb4190 install : $(TARGET) -- 2.18.0

2 3

[PATCH] Added Mail log file to '/etc/logrotate.conf'
by Matthias Fischer 23 Sep '19

23 Sep '19

Fixes Bug #12155: logrotate wasn't set up to rotate this file. For details see: https://bugzilla.ipfire.org/show_bug.cgi?id=12155 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/etc/logrotate.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/etc/logrotate.conf b/config/etc/logrotate.conf index f15ee92c3..0b6b48573 100644 --- a/config/etc/logrotate.conf +++ b/config/etc/logrotate.conf @@ -68,7 +68,7 @@ include /etc/logrotate.d endscript } -/var/log/messages /var/log/bootlog /var/log/dhcpcd.log { +/var/log/messages /var/log/bootlog /var/log/dhcpcd.log /var/log/mail { create 664 root syslogd sharedscripts ifempty -- 2.18.0

2 1

[PATCH] tzcode / tzdata: Update to 2019c
by Matthias Fischer 23 Sep '19

23 Sep '19

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/tzdata | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tzdata b/lfs/tzdata index 04add8396..a65136b6d 100644 --- a/lfs/tzdata +++ b/lfs/tzdata @@ -24,7 +24,7 @@ include Config -VER = 2019b +VER = 2019c TZDATA_VER = $(VER) TZCODE_VER = $(VER) @@ -45,8 +45,8 @@ objects = tzdata$(TZDATA_VER).tar.gz tzcode$(TZCODE_VER).tar.gz tzdata$(TZDATA_VER).tar.gz = $(DL_FROM)/tzdata$(TZDATA_VER).tar.gz tzcode$(TZCODE_VER).tar.gz = $(DL_FROM)/tzcode$(TZCODE_VER).tar.gz -tzdata$(TZDATA_VER).tar.gz_MD5 = b26b5d7d844cb96c73ed2fb6d588daaf -tzcode$(TZCODE_VER).tar.gz_MD5 = 91e0978d947496fd6aaf46d351f9c41d +tzdata$(TZDATA_VER).tar.gz_MD5 = f6987e6dfdb2eb83a1b5076a50b80894 +tzcode$(TZCODE_VER).tar.gz_MD5 = 195a17454c5db05cab96595380650391 install : $(TARGET) -- 2.18.0

2 1

[PATCH 1/2] libssh: New package
by Michael Tremer 23 Sep '19

23 Sep '19

This is required by Bird to support RPKI. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/common/libssh | 15 +++++++ lfs/libssh | 79 ++++++++++++++++++++++++++++++++++ make.sh | 1 + 3 files changed, 95 insertions(+) create mode 100644 config/rootfiles/common/libssh create mode 100644 lfs/libssh diff --git a/config/rootfiles/common/libssh b/config/rootfiles/common/libssh new file mode 100644 index 000000000..a454f07fb --- /dev/null +++ b/config/rootfiles/common/libssh @@ -0,0 +1,15 @@ +#usr/include/libssh +#usr/include/libssh/callbacks.h +#usr/include/libssh/legacy.h +#usr/include/libssh/libssh.h +#usr/include/libssh/libsshpp.hpp +#usr/include/libssh/server.h +#usr/include/libssh/sftp.h +#usr/include/libssh/ssh2.h +#usr/lib/cmake/libssh +#usr/lib/cmake/libssh/libssh-config-version.cmake +#usr/lib/cmake/libssh/libssh-config.cmake +#usr/lib/libssh.so +usr/lib/libssh.so.4 +usr/lib/libssh.so.4.8.1 +#usr/lib/pkgconfig/libssh.pc diff --git a/lfs/libssh b/lfs/libssh new file mode 100644 index 000000000..d8edca234 --- /dev/null +++ b/lfs/libssh @@ -0,0 +1,79 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 0.9.0 + +THISAPP = libssh-$(VER) +DL_FILE = $(THISAPP).tar.xz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = d2334521d83fe20309ed43a62321e7c2 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + -mkdir -pv $(DIR_APP)/build + cd $(DIR_APP)/build && cmake .. \ + -DCMAKE_INSTALL_PREFIX=/usr + cd $(DIR_APP)/build && make $(MAKETUNING) + cd $(DIR_APP)/build && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 30718c587..a87d33223 100755 --- a/make.sh +++ b/make.sh @@ -1260,6 +1260,7 @@ buildipfire() { lfsmake2 beep lfsmake2 libarchive lfsmake2 cmake + lfsmake2 libssh lfsmake2 cdrkit lfsmake2 dosfstools lfsmake2 reiserfsprogs -- 2.20.1

1 1

[PATCH] bind: Update to 9.11.11
by Matthias Fischer 20 Sep '19

20 Sep '19

For details see: https://downloads.isc.org/isc/bind9/9.11.11/RELEASE-NOTES-bind-9.11.11.html "Security Fixes A race condition could trigger an assertion failure when a large number of incoming packets were being rejected. This flaw is disclosed in CVE-2019-6471. [GL #942] ... Bug Fixes Glue address records were not being returned in responses to root priming queries; this has been corrected. [GL #1092] Interaction between DNS64 and RPZ No Data rule (CNAME *.) could cause unexpected results; this has been fixed. [GL #1106] named-checkconf now checks DNS64 prefixes to ensure bits 64-71 are zero. [GL #1159] named-checkconf could crash during configuration if configured to use "geoip continent" ACLs with legacy GeoIP. [GL #1163] named-checkconf now correctly reports missing dnstap-output option when dnstap is set. [GL #1136] Handle ETIMEDOUT error on connect() with a non-blocking socket. [GL #1133]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 4 ++-- lfs/bind | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 2b67a039c..6f90b879b 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -272,11 +272,11 @@ usr/lib/libbind9.so.161.0.3 #usr/lib/libdns.la #usr/lib/libdns.so usr/lib/libdns.so.1107 -usr/lib/libdns.so.1107.0.0 +usr/lib/libdns.so.1107.0.1 #usr/lib/libisc.la #usr/lib/libisc.so usr/lib/libisc.so.1100 -usr/lib/libisc.so.1100.3.0 +usr/lib/libisc.so.1100.3.1 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 diff --git a/lfs/bind b/lfs/bind index 46f935903..b90d2da4e 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.10 +VER = 9.11.11 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = d337c24bac0bb0d83470cd0021366bd0 +$(DL_FILE)_MD5 = 5b4a301aa97387db81352f7466bac161 install : $(TARGET) -- 2.18.0

1 0

[PATCH] kernel: Backport patch to fix a netfilter contrack related issue.
by Stefan Schantl 20 Sep '19

20 Sep '19

This fixes the packet drop issue when using suricata on IPFire. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- lfs/linux | 3 + ....0-netfilter-conntrack-resolve-clash.patch | 75 +++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100644 src/patches/linux/linux-5.0-netfilter-conntrack-resolve-clash.patch diff --git a/lfs/linux b/lfs/linux index a9e30714f..a0b28652d 100644 --- a/lfs/linux +++ b/lfs/linux @@ -146,6 +146,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Fix uevent PHYSDEVDRIVER cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-2.6.32.27_mcs7830-fix-driver-name.patch + # Fix for netfilter nf_conntrack: resolve clash for matching conntracks + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.0-netfilter-conntrack-resolve-clash.patch + ifeq "$(KCFG)" "-kirkwood" cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14.40-kirkwood-dtb.patch endif diff --git a/src/patches/linux/linux-5.0-netfilter-conntrack-resolve-clash.patch b/src/patches/linux/linux-5.0-netfilter-conntrack-resolve-clash.patch new file mode 100644 index 000000000..914cd0675 --- /dev/null +++ b/src/patches/linux/linux-5.0-netfilter-conntrack-resolve-clash.patch @@ -0,0 +1,75 @@ +commit ed07d9a021df6da53456663a76999189badc432a +Author: Martynas Pumputis <martynas(a)weave.works> +Date: Mon Jul 2 16:52:14 2018 +0200 + + netfilter: nf_conntrack: resolve clash for matching conntracks + + This patch enables the clash resolution for NAT (disabled in + "590b52e10d41") if clashing conntracks match (i.e. both tuples are equal) + and a protocol allows it. + + The clash might happen for a connections-less protocol (e.g. UDP) when + two threads in parallel writes to the same socket and consequent calls + to "get_unique_tuple" return the same tuples (incl. reply tuples). + + In this case it is safe to perform the resolution, as the losing CT + describes the same mangling as the winning CT, so no modifications to + the packet are needed, and the result of rules traversal for the loser's + packet stays valid. + + Signed-off-by: Martynas Pumputis <martynas(a)weave.works> + Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 5123e91b1982..4ced7c7102b6 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -632,6 +632,18 @@ nf_ct_key_equal(struct nf_conntrack_tuple_hash *h, + net_eq(net, nf_ct_net(ct)); + } + ++static inline bool ++nf_ct_match(const struct nf_conn *ct1, const struct nf_conn *ct2) ++{ ++ return nf_ct_tuple_equal(&ct1->tuplehash[IP_CT_DIR_ORIGINAL].tuple, ++ &ct2->tuplehash[IP_CT_DIR_ORIGINAL].tuple) && ++ nf_ct_tuple_equal(&ct1->tuplehash[IP_CT_DIR_REPLY].tuple, ++ &ct2->tuplehash[IP_CT_DIR_REPLY].tuple) && ++ nf_ct_zone_equal(ct1, nf_ct_zone(ct2), IP_CT_DIR_ORIGINAL) && ++ nf_ct_zone_equal(ct1, nf_ct_zone(ct2), IP_CT_DIR_REPLY) && ++ net_eq(nf_ct_net(ct1), nf_ct_net(ct2)); ++} ++ + /* caller must hold rcu readlock and none of the nf_conntrack_locks */ + static void nf_ct_gc_expired(struct nf_conn *ct) + { +@@ -825,19 +837,21 @@ static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb, + /* This is the conntrack entry already in hashes that won race. */ + struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); + const struct nf_conntrack_l4proto *l4proto; ++ enum ip_conntrack_info oldinfo; ++ struct nf_conn *loser_ct = nf_ct_get(skb, &oldinfo); + + l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); + if (l4proto->allow_clash && +- ((ct->status & IPS_NAT_DONE_MASK) == 0) && + !nf_ct_is_dying(ct) && + atomic_inc_not_zero(&ct->ct_general.use)) { +- enum ip_conntrack_info oldinfo; +- struct nf_conn *loser_ct = nf_ct_get(skb, &oldinfo); +- +- nf_ct_acct_merge(ct, ctinfo, loser_ct); +- nf_conntrack_put(&loser_ct->ct_general); +- nf_ct_set(skb, ct, oldinfo); +- return NF_ACCEPT; ++ if (((ct->status & IPS_NAT_DONE_MASK) == 0) || ++ nf_ct_match(ct, loser_ct)) { ++ nf_ct_acct_merge(ct, ctinfo, loser_ct); ++ nf_conntrack_put(&loser_ct->ct_general); ++ nf_ct_set(skb, ct, oldinfo); ++ return NF_ACCEPT; ++ } ++ nf_ct_put(ct); + } + NF_CT_STAT_INC(net, drop); + return NF_DROP; -- 2.20.1

1 0

[PATCH 1/2] ovpn: Generate ta.key before dh-parameter
by Erik Kapfer 19 Sep '19

19 Sep '19

Fixes: #11964 and #12157 If slow boards or/and boards with low entropy needs too long to generate the DH-parameter, ovpnmain.cgi can get into a "Script timed out before returning headers" and no further OpenSSl commands will be executed after dhparam is finished. Since the ta.key are created after the DH-parameter, it won´t be produced in that case. To prevent this, the DH-parameter will now be generated at the end. Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 439390228..5de80b269 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -1947,6 +1947,13 @@ END # } else { # &cleanssldatabase(); } + # Create ta.key for tls-auth + system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key"); + if ($?) { + $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; + &cleanssldatabase(); + goto ROOTCERT_ERROR; + } # Create Diffie Hellmann Parameter system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}"); if ($?) { @@ -1961,13 +1968,6 @@ END # } else { # &cleanssldatabase(); } - # Create ta.key for tls-auth - system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key"); - if ($?) { - $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; - &cleanssldatabase(); - goto ROOTCERT_ERROR; - } goto ROOTCERT_SUCCESS; } ROOTCERT_ERROR: -- 2.12.2

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2019