Development November 2020

development@lists.ipfire.org

20 participants
71 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

[PATCH] python3-msgpack: update to 1.0.0
by Peter Müller 04 Jun '21

04 Jun '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/packages/python3-msgpack | 14 +++++++------- lfs/python3-msgpack | 10 +++++----- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/packages/python3-msgpack b/config/rootfiles/packages/python3-msgpack index a25f071b8..b82cd4faf 100644 --- a/config/rootfiles/packages/python3-msgpack +++ b/config/rootfiles/packages/python3-msgpack @@ -1,12 +1,12 @@ #usr/lib/python3.8/site-packages/msgpack +#usr/lib/python3.8/site-packages/msgpack-1.0.0-py3.8.egg-info +#usr/lib/python3.8/site-packages/msgpack-1.0.0-py3.8.egg-info/PKG-INFO +#usr/lib/python3.8/site-packages/msgpack-1.0.0-py3.8.egg-info/SOURCES.txt +#usr/lib/python3.8/site-packages/msgpack-1.0.0-py3.8.egg-info/dependency_links.txt +#usr/lib/python3.8/site-packages/msgpack-1.0.0-py3.8.egg-info/top_level.txt usr/lib/python3.8/site-packages/msgpack/__init__.py -usr/lib/python3.8/site-packages/msgpack/_packer.cpython-38-MACHINE-linux-gnu.so -usr/lib/python3.8/site-packages/msgpack/_unpacker.cpython-38-MACHINE-linux-gnu.so +usr/lib/python3.8/site-packages/msgpack/_cmsgpack.cpython-38-MACHINE-linux-gnu.so usr/lib/python3.8/site-packages/msgpack/_version.py usr/lib/python3.8/site-packages/msgpack/exceptions.py +usr/lib/python3.8/site-packages/msgpack/ext.py usr/lib/python3.8/site-packages/msgpack/fallback.py -#usr/lib/python3.8/site-packages/msgpack_python-0.5.6-py3.8.egg-info -#usr/lib/python3.8/site-packages/msgpack_python-0.5.6-py3.8.egg-info/PKG-INFO -#usr/lib/python3.8/site-packages/msgpack_python-0.5.6-py3.8.egg-info/SOURCES.txt -#usr/lib/python3.8/site-packages/msgpack_python-0.5.6-py3.8.egg-info/dependency_links.txt -#usr/lib/python3.8/site-packages/msgpack_python-0.5.6-py3.8.egg-info/top_level.txt diff --git a/lfs/python3-msgpack b/lfs/python3-msgpack index dc764f5b3..5f539eda3 100644 --- a/lfs/python3-msgpack +++ b/lfs/python3-msgpack @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,15 +24,15 @@ include Config -VER = 0.5.6 +VER = 1.0.0 -THISAPP = msgpack-python-$(VER) +THISAPP = msgpack-$(VER) DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = python3-msgpack -PAK_VER = 2 +PAK_VER = 3 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 6d644c06a87a5a111bbbf5b34b4be440 +$(DL_FILE)_MD5 = c35ee8f991dad3969884e9585e56ebba install : $(TARGET) -- 2.26.1

2 2

Question regarding legitimate loading of kernel modules during runtime
by Peter Müller 06 Apr '21

06 Apr '21

Hello development folks, just to make sure I am not about to submit another breaking patch: Is there any legitimate reason why a non-privileged user shall load kernel modules on an IPFire machine during its runtime? Personally, I am only aware of some connection tracking stuff, but these require a reboot, thus being out of scope. Unless I overlooked something else, I would like to file a patch turning dev.tty.ldisc_autoload to 0. :-) (Further information is available at https://lkml.org/lkml/2019/4/15/890) Thanks, and best regards, Peter Müller

2 6

[PATCH] sysctl.conf: Turn on BPF JIT hardening, if the JIT is enabled
by Peter Müller 06 Apr '21

06 Apr '21

This is recommended by the Kernel Self Protection Project, and although we do not take advantage of the BPF JIT at this time, we should set this nevertheless in order to avoid potential security vulnerabilities. Fixes: #12384 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/etc/sysctl.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 7e7ebee44..3f4c828f9 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -49,6 +49,9 @@ kernel.dmesg_restrict = 1 fs.protected_symlinks = 1 fs.protected_hardlinks = 1 +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 + # Minimal preemption granularity for CPU-bound tasks: # (default: 1 msec# (1 + ilog(ncpus)), units: nanoseconds) kernel.sched_min_granularity_ns = 10000000 -- 2.26.2

2 4

I am taking a little break
by Jon Murphy 12 Jan '21

12 Jan '21

Hi Michael, Sorry for the late reply to your note. I've been sick the past few days and sleeping too much. All is good now. Sorry for what you are going through. It really takes the joy out of working especially when working at something you love. Nobody should ever be subject to this abuse. I completely agree with taking a step aside. Take whatever time is needed. You definitely deserve the time off! I would suggest never fully reading the nasty messages. Find a nasty part - hit the delete key! It won't give you any insight to their problem and it isn't worth your time. And it will definitely bring you down. After the November holiday I'll reach out to the Community moderations. I have a few thoughts and suggestions of ways to make this better: (e.g., watchlist / sh**list of bad apples, flagging sh** messages ). It'll probably take 100 little things that'll make the difference. Side thought: I use Apple Mail and SpamSieve <https://c-command.com/spamsieve/>. Maybe you can set its corpus up with nasty words (e.g., arsehole) from nasty messages. Trash anything nasty before reading it! The delete key is your friend! Hope you are able to get out and do something different! Take care! Jon > > > Message: 2 > Date: Wed, 18 Nov 2020 19:17:32 +0000 > From: Michael Tremer <michael.tremer(a)ipfire.org> > To: "IPFire: Development-List" <development(a)lists.ipfire.org> > Subject: I am taking a little break > Message-ID: <B78EB821-A9F1-4B41-8E18-5A494AAEDD2F(a)ipfire.org> > Content-Type: text/plain; charset=utf-8 > > Hello everyone, > > I would like to announce that I am taking a hiatus from the support forum on community.ipfire.org. > > The main reason is not new, but I thought that it has been enough in the last few weeks: The amount of abuse I receive is unreasonable. It comes in personal messages, emails and on public forums and are often quite personal. > > I do not want to give any examples, because those people do not deserve that their message is being singled out. There is no incident in particular that has caused me frustration, but you all have seen what is being posted publicly and that is good enough to work as a foundation to what I would like to point out... > > We have a bit of a problem with our discourse. People have an entitlement problem, put no work into their posts and expect - or even demand - people to do their job for them. > > I feel that reading those posts and writing a response which is not being read by the original poster (let alone them trying to implement what I suggested) is a waste of time. Of course it is up to them, but why would you ask in the first place? Usually the problem is that it was not understood what I answered. > > Who would have thought that IT security is hard? > > I am tired of trying to educate people about the most basic things that are required to run IPFire. I am sick and tired of seeing IPFire being used wrong and therefore people complaining about things that do not work as they want them. I feel like I am explaining the same things over and over again. > > I am done with having endless debates about the same topics which are done already. Different people bring up the same arguments again but that does not change anything. They complain when not being answered in length when they are just too lazy to search for the answer in a previous post. > > I am being very frustrated and this is not good for neither me or the community. > > Not coming across as my finest recently I believe that I am starting to act unfairly towards people who have not done anything wrong and try to make a difference in this project. It will be better if I invested my time into those things than those outlined above. > > Closing the forum entirely was a thought that crossed my mind many more times than once - and I know that I am not the online one who is thinking that. It was in fact debated on our monthly team meeting before. > > I do not care about the offenders and bullies at all. Trolls are gonna troll. There is only very little chance to point someone into the right direction and help them to help themselves. I would rather prefer to have a smaller user base instead of having these people who are destroying the community - willingly or unwillingly. > > We are an open source project - one community. I do care a lot about that - and I would not allow anyone to destroy what we have all achieved together. It is sad to say, that it only needs very few people to spoil it for the rest of us. > > My personal pride aside, those who know me in person can tell you that I do not care much about any defamation towards me, or accusations, blame or being called an arsehole. But I do know for a fact that others take them less lightly. > > Some things recently have stopped being fun and are now quite the opposite. To avoid ruining mine and other people?s days I have decided to stop reading and replying on the support forum. I am not contributing anything useful for anyone and it has not given me any input that will help me to do my job better. This won?t be a big loss to anyone. > > I would even encourage the rest of you who feel passionate about it help to make that place useful again. It is the only place that we have where our community can be. > > This announcement is just there to let you all know that my perception of the project might vary from yours in the near future. I will of course be around on the development mailing list and get involved in the debates that we have on here and would like to remind everyone to keep development talk on this list for that reason and avoid having that on the support forum. > > If anyone has something to say about this, I would be happy to read your thoughts. If you do not want to disclose them in public, feel free to email me in private, too. > > And now I am going to focus on that massive pile of work I have to do? > > Best, > -Michael >

5 7

Forcing all DNS traffic from the LAN to the firewall
by Matthias Fischer 25 Dec '20

25 Dec '20

Hi, there have been several discussions with several solution attempts in both IPFire forums (old/new), generally starting with (e.g.) "...I am trying to redirect all of my DNS traffic to go thru the IPFire DNS instead of directly to an outside DNS server...". Current discussion => https://community.ipfire.org/t/forcing-all-dns-traffic-from-the-lan-to-the-… But not only in the forums - the oldest Wiki article is dated "May 22, 2015". Long time, but still editing scripts manually... Hoping that there is a chance for a (final) integrated solution which doesn't include editing code, but having a checkbox to switch this functionality ON/OFF on a standardized and more secure base, I would like to open a discussion on the list. For a start and to test how this could probably be done - and to find out if I can do it - I customized '/srv/web/ipfire/cgi-bin/optionsfw.cgi'. Screenshots of the result can be found in the forum thread cited above: => https://community.ipfire.org/t/forcing-all-dns-traffic-from-the-lan-to-the-… But some points are IMHO still unclear and need clarification. And I think I'm not the one to decide where to go... My thoughts until now: - Do we need this? [Hm. ;-) As I heard, some folks do.] - Is the 'optionsfwcgi' the right place for this? [In my opinion: yes. It was easy to add and sits beside other interface "options"] - Do we really want this for all installations? [For someone, who doesn't want or doesn't need it: it can be switched OFF] - Is this function usable under ALL circumstances? [If not: it can be switched OFF] - Where (E.g: firewall init script, rules.pl, wirelessctrl.c, ...) should the necessary iptables rules be processed? [Some ideas how this could be done, but no "breakthrough". Current option-settings are processed in several scripts. Which one to use!?] Before going on and investing more time in this (on the forum), I'd like to know how the developers think about this and would like to collect ideas and suggestions here. Any hints are welcome... Best, Matthias

5 19

OpenVPN-2.5.0 update procedure and idea collector
by ummeegge 14 Dec '20

14 Dec '20

Hi all, i am currently in the update process of the already realeased OpenVPN- 2.5.0 --> https://openvpn.net/community-downloads-2/ . The update has been tested and worked so far also with the old default client configuration (tested with 2.4.9 client). There are two warnings --> 1) DEPRECATED OPTION: ncp-disable. Disabling dynamic cipher negotiation is a deprecated debug feature that will be removed in OpenVPN 2.6 2) WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible. in the server log but it nevertheless works flawlessly. Am working currently on an "Advanced Encryption Settings" page which includes currently four new directives --data-ciphers (data channel encryption), --data-ciphers-fallback (data-channel encryption for clients <= OpenVPN-2.3.9), --tls-ciphers (control channel TLSv2 only) and --tls-ciphersuites (control channel >= TLSv3) all options are explained in here --> https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html , which works here currently and looks like this: Button to belong to this page: https://people.ipfire.org/~ummeegge/OpenVPN-2.5.0/screenshots/ovpn_advanced… And the page itself: https://people.ipfire.org/~ummeegge/OpenVPN-2.5.0/screenshots/ovpn_advanced… You can see also the default settings, were i need also your ideas and comments for may better defaults. On the page itself is also more planned but to not overload this here now, i wanted to go now a two step procedure with this update. 1) Push OpenVPN-2.5.0 update with the new ciphers and HMACs for regukar global settings for RW and N2N. A overview of the new crypto can be found in here --> https://community.ipfire.org/t/openvpn-2-5-development-version/2173 . 2) I would push the "Advanced Encryption settings" development as seen above then as one patch <-- this would also eliminate the first warning causing --ncp-disable since we can delete this option then. Everything else would come detached from this. Some feedback might be nice. Best, Erik

4 35

[PATCH] Core 152: the script "network-hotplug-bridges" now reads the variable ${ZONE}_STP from /var/ipfire/ethernet/settings so that STP can be turned on and off for each bridge
by Daniel Weismüller 11 Dec '20

11 Dec '20

Signed-off-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> --- config/udev/network-hotplug-bridges | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/udev/network-hotplug-bridges b/config/udev/network-hotplug-bridges index 33d6d65ba..7431377bb 100644 --- a/config/udev/network-hotplug-bridges +++ b/config/udev/network-hotplug-bridges @@ -81,6 +81,7 @@ MODE="$(get_value "${ZONE}_MODE")" # The name of the virtual bridge BRIDGE="$(get_value "${ZONE}_DEV")" +STP="$(get_value "${ZONE}_STP")" case "${MODE}" in bridge) @@ -89,7 +90,8 @@ case "${MODE}" in # We need to create the bridge if it doesn't exist, yet if [ ! -d "/sys/class/net/${BRIDGE}" ]; then - ip link add "${BRIDGE}" address "${ADDRESS}" type bridge + ip link add "${BRIDGE}" address "${ADDRESS}" type bridge \ + $([ "${STP}" = "on" ] && echo "stp_state 1") #ip link set "${BRIDGE}" up fi -- 2.28.0

7 28

Next steps of IPFire Location
by Michael Tremer 07 Dec '20

07 Dec '20

Hello, Since there are now so many people involved in this project, I would like to send a little email to report what has happened and what the next steps are going to be… I have spent (unfortunately) a lot of time to add the ability that we can “flatten the tree” when we export it. That means that no network will overlap with another one and we do not need to care about any orders of iptables rules being added. That was quite a slow process in Python and since IPFire has to run on small hardware it needed to be ported into C. The tree can now be exported in about 10 seconds on my development box which is running an Intel Xeon E5-2630 processor. I hope that we can reach acceptable times of only a few minutes on the slowest systems and way under a minute on an average system. To find out about that, I need you help: I just pushed all changes into the next tree and would everyone who can to install that and report how long this command runs: mkdir tmp time location export --directory=tmp --format=xt_geoip It would also be great if you could all check the output if this is still correct. I have done what I could, but I want to have an extra pair of eyes if possible. If this works well, and no more regressions are being found, I will tag this release and we will close Core Update 153. We will then roll out all recent changes that make the database better, but had to be held back because the tree needs to be flattened for most use-cases now. All older clients will then no longer receive an updated database any more. Happy testing. Best, -Michael

5 18

[PATCH] OpenVPN: Update to version 2.5.0
by ummeegge 03 Dec '20

03 Dec '20

Signed-off-by: ummeegge <erik.kapfer(a)ipfire.org> --- config/rootfiles/common/openvpn | 1 - lfs/openvpn | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index 547842db3..41ccc885e 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -19,7 +19,6 @@ usr/sbin/openvpn #usr/share/doc/openvpn/README.down-root #usr/share/doc/openvpn/README.mbedtls #usr/share/doc/openvpn/management-notes.txt -#usr/share/man/man8/openvpn.8 var/ipfire/ovpn/ca var/ipfire/ovpn/caconfig var/ipfire/ovpn/ccd diff --git a/lfs/openvpn b/lfs/openvpn index 779bf5520..b026d515b 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,7 +24,7 @@ include Config -VER = 2.4.9 +VER = 2.5.0 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 446df6dc29364d00929ea9c725412cb8 +$(DL_FILE)_MD5 = ba426e2217833b522810d6c06f7cc8f7 install : $(TARGET) -- 2.20.1

4 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2020