Development December 2020

development@lists.ipfire.org

18 participants
89 discussions

[PATCH] bird: Update to 2.0.7
by Adolf Belka 17 Dec '20

17 Dec '20

Update bird from 2.0.6 to 2.0.7 Changes from changelog - BGP: Fix reconfiguration with import table *Change of some options requires route refresh, but when import table is active, channel reload is done from it instead of doing full route refresh. So in this case we request it internally. - Doc: Minor documentation fixes - Nest: Handle non-MPLS on MPLS case in recursive route update *When non-MPLS recursive route resolves to MPLS underlying route, then it should get MPLS labels from the the underlying route. - Nest: Handle PtP links in recursive route update *Underlying (IGP) route may lead to PtP link, in this case it does not need gateway. Which is different than direct route without gateway. *When recursive (BGP) route uses PtP route, it should not use recursive next hop as immediate next hop, while for direct routes it should. - Nest: Fix recursive route update *Missing cleanup can lead to dangling pointer to old next hops. Signed-off-by: Adolf Belka <ahb.ipfire(a)gmail.com> --- lfs/bird | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/bird b/lfs/bird index 9b045528f..ee1829907 100644 --- a/lfs/bird +++ b/lfs/bird @@ -24,7 +24,7 @@ include Config -VER = 2.0.6 +VER = 2.0.7 THISAPP = bird-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = bird -PAK_VER = 6 +PAK_VER = 7 DEPS = @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = bc05f225f4fcb365da1dbb308a7e23cc +$(DL_FILE)_MD5 = dc884bbe5905578e452f28158700527c install : $(TARGET) -- 2.29.2

1 0

Problem with no longer getting email from IPFire Community
by Adolf Belka 16 Dec '20

16 Dec '20

Hi all, 14 hours ago I got a system message online from IPFire Community. It said that that the last few emails to my Community email address had been bounced back as undeliverable. I checked the email address and it is still entered as the correct one that has been running for the last year with IPFire Community. I have gmail set with no filters at all. I have checked and there are no emails from IPFire Community in my gmail boxes any more after 14 hours ago. I am still getting emails from other lists and newsletters to the same email address but since 14 hours ago I have received nothing more from IPFire Community. There have been 7 postings that I would have normally received. I have also sent test emails to the email address and they are received. Will the community email system start trying to send emails again or is that email address now permanently blocked. If the latter, then how can I change the IPFire Community email address. There is a change button for the email address I am using but if I enter another one then the system says that I can't carry that operation out. I am still receiving the emails from this list as I used a different gmail address for this list. Thanks for any help that any one can give me. Adolf

2 2

[PATCH] dracut: add hyperv-keyboard module to initrd.
by Arne Fitzenreiter 16 Dec '20

16 Dec '20

the missing module should be the reason for not responding setup on some hyper-v configurations. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/dracut | 2 +- ...patch => dracut-038_add_hyperv-keyboard_and_sdhci-pci.patch} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename src/patches/{dracut-038_add_sdhci-pci.patch => dracut-038_add_hyperv-keyboard_and_sdhci-pci.patch} (92%) diff --git a/lfs/dracut b/lfs/dracut index a6a6f1f23..c4f7231b1 100644 --- a/lfs/dracut +++ b/lfs/dracut @@ -71,7 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dracut-038-always-enable-mdraid.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dracut-038_add_sdhci-pci.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dracut-038_add_hyperv-keyboard_and_sdhci-pci.patch cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install sbindir=/sbin sysconfdir=/etc diff --git a/src/patches/dracut-038_add_sdhci-pci.patch b/src/patches/dracut-038_add_hyperv-keyboard_and_sdhci-pci.patch similarity index 92% rename from src/patches/dracut-038_add_sdhci-pci.patch rename to src/patches/dracut-038_add_hyperv-keyboard_and_sdhci-pci.patch index b002246d4..19ed15fd3 100644 --- a/src/patches/dracut-038_add_sdhci-pci.patch +++ b/src/patches/dracut-038_add_hyperv-keyboard_and_sdhci-pci.patch @@ -6,7 +6,7 @@ diff -Naur dracut-038.org/modules.d/90kernel-modules/module-setup.sh dracut-038/ hid-logitech-dj hid-microsoft firewire-ohci \ pcmcia usb_storage nvme hid-hyperv hv-vmbus \ - sdhci_acpi -+ sdhci_acpi sdhci_pci ++ hyperv-keyboard sdhci_acpi sdhci_pci if [[ "$(uname -p)" == arm* ]]; then # arm specific modules -- 2.17.1

1 0

[PATCH] Fix for bug 10743
by Adolf Belka 16 Dec '20

16 Dec '20

This adds in the option to have "deny known clients" in dhcpd.conf This is applied to the range command so applies to the dynamic addresses given. If you have just a range statement say in blue then if you are not using vlans you could have the situation where a known host in green might end up getting a lease from the blue range. Here a deny known-clients makes sense. Your range in this case would be limited to only unknown clients if deny known-clients was selected. dhcp WUI has been modified to add in this command. Error message has been added to check that a range has been specified if the deny unknown clients checkbox has been selected. Language files updated with additional items (English, German & Dutch). For more information on the history of this please see the bugzilla entry Signed-off-by: Adolf Belka <ahb.ipfire(a)gmail.com> --- doc/language_issues.en | 2 ++ doc/language_issues.es | 2 ++ doc/language_issues.fr | 2 ++ doc/language_issues.it | 2 ++ doc/language_issues.pl | 2 ++ doc/language_issues.ru | 2 ++ doc/language_issues.tr | 2 ++ doc/language_missings | 12 ++++++++++++ html/cgi-bin/dhcp.cgi | 19 ++++++++++++++++++- langs/de/cgi-bin/de.pl | 2 ++ langs/en/cgi-bin/en.pl | 2 ++ langs/nl/cgi-bin/nl.pl | 2 ++ 12 files changed, 50 insertions(+), 1 deletion(-) diff --git a/doc/language_issues.en b/doc/language_issues.en index b3c46de5e..3955d3ae7 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -574,6 +574,7 @@ WARNING: untranslated string: dhcp advopt value = Option value WARNING: untranslated string: dhcp allow bootp = Allow bootp clients WARNING: untranslated string: dhcp bootp pxe data = Enter optional bootp pxe data for this fixed lease WARNING: untranslated string: dhcp configuration = DHCP configuration +WARNING: untranslated string: dhcp deny known clients: = Deny known clients: WARNING: untranslated string: dhcp dns enable update = Enable DNS Update (RFC2136): WARNING: untranslated string: dhcp dns key name = Key Name WARNING: untranslated string: dhcp dns update = DNS Update @@ -582,6 +583,7 @@ WARNING: untranslated string: dhcp dns update secret = Secret WARNING: untranslated string: dhcp server = DHCP Server WARNING: untranslated string: dhcp server disabled = DHCP server disabled. Stopped. WARNING: untranslated string: dhcp server enabled = DHCP server enabled. Restarting. +WARNING: untranslated string: dhcp valid range required when deny known clients checked = Valid range required when "Deny known clients:" is checked WARNING: untranslated string: dhcp-options = DHCP push options WARNING: untranslated string: dial = Connect WARNING: untranslated string: dial profile = Connect with profile diff --git a/doc/language_issues.es b/doc/language_issues.es index 9f62f03f2..2cd36a5a1 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -886,11 +886,13 @@ WARNING: untranslated string: dh key move failed = Diffie-Hellman parameters mov WARNING: untranslated string: dh key warn = Creating DH-parameters with a length of 2048 bits takes up to several minutes. Lengths of 3072 or 4096 bits might needs several hours. Please be patient. WARNING: untranslated string: dh key warn1 = For weak systems or systems with little entropy, it is recommended to upload long Diffie-Hellman parameters by usage of the upload function. WARNING: untranslated string: dh parameter = Diffie-Hellman parameters +WARNING: untranslated string: dhcp deny known clients: = Deny known clients: WARNING: untranslated string: dhcp dns enable update = Enable DNS Update (RFC2136): WARNING: untranslated string: dhcp dns key name = Key Name WARNING: untranslated string: dhcp dns update = DNS Update WARNING: untranslated string: dhcp dns update algo = Algorithm WARNING: untranslated string: dhcp dns update secret = Secret +WARNING: untranslated string: dhcp valid range required when deny known clients checked = Valid range required when "Deny known clients:" is checked WARNING: untranslated string: disable = Disable WARNING: untranslated string: disconnected = Disconnected WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip) diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 90a745360..279e1ba37 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -879,6 +879,8 @@ WARNING: translation string unused: zoneconf val vlan tag assignment error WARNING: translation string unused: zoneconf val zoneslave amount error WARNING: untranslated string: asn lookup failed = AS lookup failed WARNING: untranslated string: autonomous system = Autonomous System +WARNING: untranslated string: dhcp deny known clients: = Deny known clients: +WARNING: untranslated string: dhcp valid range required when deny known clients checked = Valid range required when "Deny known clients:" is checked WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: fwhost cust locationgrp = unknown string WARNING: untranslated string: fwhost err hostip = unknown string diff --git a/doc/language_issues.it b/doc/language_issues.it index 62e4f9953..4ac4754dc 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -911,11 +911,13 @@ WARNING: untranslated string: crypto warning = Cryptographic warning WARNING: untranslated string: dangerous = Dangerous WARNING: untranslated string: default IP address = Default IP Address WARNING: untranslated string: desired = Desired +WARNING: untranslated string: dhcp deny known clients: = Deny known clients: WARNING: untranslated string: dhcp dns enable update = Enable DNS Update (RFC2136): WARNING: untranslated string: dhcp dns key name = Key Name WARNING: untranslated string: dhcp dns update = DNS Update WARNING: untranslated string: dhcp dns update algo = Algorithm WARNING: untranslated string: dhcp dns update secret = Secret +WARNING: untranslated string: dhcp valid range required when deny known clients checked = Valid range required when "Deny known clients:" is checked WARNING: untranslated string: disable = Disable WARNING: untranslated string: disconnected = Disconnected WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip) diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 9f62f03f2..2cd36a5a1 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -886,11 +886,13 @@ WARNING: untranslated string: dh key move failed = Diffie-Hellman parameters mov WARNING: untranslated string: dh key warn = Creating DH-parameters with a length of 2048 bits takes up to several minutes. Lengths of 3072 or 4096 bits might needs several hours. Please be patient. WARNING: untranslated string: dh key warn1 = For weak systems or systems with little entropy, it is recommended to upload long Diffie-Hellman parameters by usage of the upload function. WARNING: untranslated string: dh parameter = Diffie-Hellman parameters +WARNING: untranslated string: dhcp deny known clients: = Deny known clients: WARNING: untranslated string: dhcp dns enable update = Enable DNS Update (RFC2136): WARNING: untranslated string: dhcp dns key name = Key Name WARNING: untranslated string: dhcp dns update = DNS Update WARNING: untranslated string: dhcp dns update algo = Algorithm WARNING: untranslated string: dhcp dns update secret = Secret +WARNING: untranslated string: dhcp valid range required when deny known clients checked = Valid range required when "Deny known clients:" is checked WARNING: untranslated string: disable = Disable WARNING: untranslated string: disconnected = Disconnected WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip) diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 5d16e0b18..a333d9939 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -888,11 +888,13 @@ WARNING: untranslated string: dh key move failed = Diffie-Hellman parameters mov WARNING: untranslated string: dh key warn = Creating DH-parameters with a length of 2048 bits takes up to several minutes. Lengths of 3072 or 4096 bits might needs several hours. Please be patient. WARNING: untranslated string: dh key warn1 = For weak systems or systems with little entropy, it is recommended to upload long Diffie-Hellman parameters by usage of the upload function. WARNING: untranslated string: dh parameter = Diffie-Hellman parameters +WARNING: untranslated string: dhcp deny known clients: = Deny known clients: WARNING: untranslated string: dhcp dns enable update = Enable DNS Update (RFC2136): WARNING: untranslated string: dhcp dns key name = Key Name WARNING: untranslated string: dhcp dns update = DNS Update WARNING: untranslated string: dhcp dns update algo = Algorithm WARNING: untranslated string: dhcp dns update secret = Secret +WARNING: untranslated string: dhcp valid range required when deny known clients checked = Valid range required when "Deny known clients:" is checked WARNING: untranslated string: disable = Disable WARNING: untranslated string: disconnected = Disconnected WARNING: untranslated string: disk access = Disk Access diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 26530a923..a080ee54f 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -894,6 +894,8 @@ WARNING: untranslated string: crypto warning = Cryptographic warning WARNING: untranslated string: dangerous = Dangerous WARNING: untranslated string: default IP address = Default IP Address WARNING: untranslated string: desired = Desired +WARNING: untranslated string: dhcp deny known clients: = Deny known clients: +WARNING: untranslated string: dhcp valid range required when deny known clients checked = Valid range required when "Deny known clients:" is checked WARNING: untranslated string: disable = Disable WARNING: untranslated string: disconnected = Disconnected WARNING: untranslated string: dns check servers = Check DNS Servers diff --git a/doc/language_missings b/doc/language_missings index 12e341402..ad70d5241 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -222,11 +222,13 @@ < desired < details < dh +< dhcp deny known clients: < dhcp dns enable update < dhcp dns key name < dhcp dns update < dhcp dns update algo < dhcp dns update secret +< dhcp valid range required when deny known clients checked < dh key move failed < dh key warn < dh key warn1 @@ -962,6 +964,8 @@ < autonomous system < bewan adsl pci st < bewan adsl usb +< dhcp deny known clients: +< dhcp valid range required when deny known clients checked < dns enable safe-search youtube < g.dtm < g.lite @@ -1061,11 +1065,13 @@ < dangerous < default IP address < desired +< dhcp deny known clients: < dhcp dns enable update < dhcp dns key name < dhcp dns update < dhcp dns update algo < dhcp dns update secret +< dhcp valid range required when deny known clients checked < disable < Disabled < disconnected @@ -1945,11 +1951,13 @@ < desired < details < dh +< dhcp deny known clients: < dhcp dns enable update < dhcp dns key name < dhcp dns update < dhcp dns update algo < dhcp dns update secret +< dhcp valid range required when deny known clients checked < dh key move failed < dh key warn < dh key warn1 @@ -2822,11 +2830,13 @@ < desired < details < dh +< dhcp deny known clients: < dhcp dns enable update < dhcp dns key name < dhcp dns update < dhcp dns update algo < dhcp dns update secret +< dhcp valid range required when deny known clients checked < dh key move failed < dh key warn < dh key warn1 @@ -3568,6 +3578,8 @@ < dangerous < default IP address < desired +< dhcp deny known clients: +< dhcp valid range required when deny known clients checked < disable < Disabled < disconnected diff --git a/html/cgi-bin/dhcp.cgi b/html/cgi-bin/dhcp.cgi index 8c57c675d..2ebdde818 100644 --- a/html/cgi-bin/dhcp.cgi +++ b/html/cgi-bin/dhcp.cgi @@ -74,6 +74,7 @@ foreach my $itf (@ITFs) { $dhcpsettings{"DNS_UPDATE_KEY_NAME_${itf}"} = ''; $dhcpsettings{"DNS_UPDATE_KEY_SECRET_${itf}"} = ''; $dhcpsettings{"DNS_UPDATE_KEY_ALGO_${itf}"} = ''; + $dhcpsettings{"DENY_KNOWN_CLIENTS_${itf}"} = 'off'; } $dhcpsettings{'SORT_FLEASELIST'} = 'FIPADDR'; @@ -175,9 +176,16 @@ if ($dhcpsettings{'ACTION'} eq $Lang::tr{'save'}) { } } + if ($dhcpsettings{"DENY_KNOWN_CLIENTS_${itf}"} eq 'on') { + if (($dhcpsettings{"START_ADDR_${itf}"}) eq '' && ($dhcpsettings{"END_ADDR_${itf}"}) eq '') { + $errormessage = "DHCP on ${itf}: " . $Lang::tr{'dhcp valid range required when deny known clients checked'}; + goto ERROR; + } + if (!($dhcpsettings{"DEFAULT_LEASE_TIME_${itf}"} =~ /^\d+$/)) { $errormessage = "DHCP on ${itf}: " . $Lang::tr{'invalid default lease time'} . $dhcpsettings{'DEFAULT_LEASE_TIME_${itf}'}; goto ERROR; + } } if (!($dhcpsettings{"MAX_LEASE_TIME_${itf}"} =~ /^\d+$/)) { @@ -548,6 +556,7 @@ foreach my $itf (@ITFs) { my %checked=(); $checked{'ENABLE'}{'on'} = ( $dhcpsettings{"ENABLE_${itf}"} ne 'on') ? '' : "checked='checked'"; $checked{'ENABLEBOOTP'}{'on'} = ( $dhcpsettings{"ENABLEBOOTP_${itf}"} ne 'on') ? '' : "checked='checked'"; + $checked{'DENY_KNOWN_CLIENTS'}{'on'} = ( $dhcpsettings{"DENY_KNOWN_CLIENTS_${itf}"} ne 'on') ? '' : "checked='checked'"; if ($netsettings{"${itf}_DEV"} ne '' ) { # Show only defined interface my $lc_itf=lc($itf); @@ -563,6 +572,9 @@ print <<END <td width='25%'><input type='text' name='START_ADDR_${itf}' value='$dhcpsettings{"START_ADDR_${itf}"}' /></td> <td width='25%' class='base'>$Lang::tr{'end address'} <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='END_ADDR_${itf}' value='$dhcpsettings{"END_ADDR_${itf}"}' /></td> +</tr><tr> + <td class='base'>$Lang::tr{'dhcp deny known clients:'}</td> + <td><input type='checkbox' name='DENY_KNOWN_CLIENTS_${itf}' $checked{'DENY_KNOWN_CLIENTS'}{'on'} /></td> </tr><tr> <td class='base'>$Lang::tr{'default lease time'} <img src='/blob.gif' alt='*' /></td> <td><input type='text' name='DEFAULT_LEASE_TIME_${itf}' value='$dhcpsettings{"DEFAULT_LEASE_TIME_${itf}"}' /></td> @@ -1264,7 +1276,12 @@ sub buildconf { if ($dhcpsettings{"ENABLE_${itf}"} eq 'on' ){ print FILE "subnet " . $netsettings{"${itf}_NETADDRESS"} . " netmask ". $netsettings{"${itf}_NETMASK"} . " #$itf\n"; print FILE "{\n"; - print FILE "\trange " . $dhcpsettings{"START_ADDR_${itf}"} . ' ' . $dhcpsettings{"END_ADDR_${itf}"}.";\n" if ($dhcpsettings{"START_ADDR_${itf}"}); + if ($dhcpsettings{"START_ADDR_${itf}"}) { + print FILE "pool {\n"; + print FILE "\trange " . $dhcpsettings{"START_ADDR_${itf}"} . ' ' . $dhcpsettings{"END_ADDR_${itf}"}.";\n"; + print FILE "\tdeny known-clients;\n" if ($dhcpsettings{"DENY_KNOWN_CLIENTS_${itf}"} eq 'on'); + print FILE " }\n"; # pool + } print FILE "\toption subnet-mask " . $netsettings{"${itf}_NETMASK"} . ";\n"; print FILE "\toption domain-name \"" . $dhcpsettings{"DOMAIN_NAME_${itf}"} . "\";\n"; print FILE "\toption routers " . $netsettings{"${itf}_ADDRESS"} . ";\n"; diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 2fb46e741..38c9783f8 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -781,6 +781,7 @@ 'dhcp bootp pxe data' => 'Geben Sie optionale BOOTP-PXE-Daten für diese feste Zuordnung ein', 'dhcp configuration' => 'DHCP-Konfiguration', 'dhcp create fixed leases' => 'Feste Zuordnungen erzeugen', +'dhcp deny known clients:' => 'Bekannte Clients verweigern:', 'dhcp dns enable update' => 'DNS-Update nach RFC 2136 aktivieren:', 'dhcp dns key name' => 'Schlüsselname', 'dhcp dns update' => 'DNS-Update', @@ -792,6 +793,7 @@ 'dhcp server' => 'DHCP-Server', 'dhcp server disabled' => 'DHCP-Server deaktiviert. Angehalten.', 'dhcp server enabled' => 'DHCP-Server aktiviert. Starte neu.', +'dhcp valid range required when deny known clients checked' => 'Gültiger Bereich erforderlich, wenn "Bekannte Clients verweigern:" aktiviert ist', 'dhcp-options' => 'DHCP push Optionen', 'dial' => 'Verbinden', 'dial profile' => 'Verbinde mit Profil', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index b5284effa..500913240 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -800,6 +800,7 @@ 'dhcp bootp pxe data' => 'Enter optional bootp pxe data for this fixed lease', 'dhcp configuration' => 'DHCP configuration', 'dhcp create fixed leases' => 'Create fixed leases', +'dhcp deny known clients:' => 'Deny known clients:', 'dhcp dns enable update' => 'Enable DNS Update (RFC2136):', 'dhcp dns key name' => 'Key Name', 'dhcp dns update' => 'DNS Update', @@ -813,6 +814,7 @@ 'dhcp server disabled on blue interface' => 'DHCP server disabled on BLUE interface', 'dhcp server enabled' => 'DHCP server enabled. Restarting.', 'dhcp server enabled on blue interface' => 'DHCP server enabled on BLUE interface', +'dhcp valid range required when deny known clients checked' => 'Valid range required when "Deny known clients:" is checked', 'dhcp-options' => 'DHCP push options', 'dial' => 'Connect', 'dial profile' => 'Connect with profile', diff --git a/langs/nl/cgi-bin/nl.pl b/langs/nl/cgi-bin/nl.pl index 53341a6f8..191a16927 100644 --- a/langs/nl/cgi-bin/nl.pl +++ b/langs/nl/cgi-bin/nl.pl @@ -702,6 +702,7 @@ 'dhcp bootp pxe data' => 'Voer optionele bootp pxe data in voor deze vaste lease', 'dhcp configuration' => 'DHCP configuratie', 'dhcp create fixed leases' => 'Aanmaken vaste leases', +'dhcp deny known clients:' => 'Bekende clients weigeren:', 'dhcp fixed lease err1' => 'Voor een vaste lease moet u het MAC-adres of de hostnaam invoeren, of beide.', 'dhcp fixed lease help1' => 'IP-adressen mogen ook als FQDN worden ingevoerd', 'dhcp mode' => 'DHCP', @@ -710,6 +711,7 @@ 'dhcp server disabled on blue interface' => 'DHCP server uitgeschakeld op de BLAUWE interface', 'dhcp server enabled' => 'DHCP server ingeschakeld. Herstarten.', 'dhcp server enabled on blue interface' => 'DHCP server ingeschakeld op de BLAUWE interface', +'dhcp valid range required when deny known clients checked' => 'Geldig bereik wanneer "Bekende clients weigeren:" is aangevinkt', 'dhcp-options' => 'DHCP push opties', 'dial' => 'Verbind', 'dial profile' => 'Verbind met profile', -- 2.29.2

1 0

[PATCH] kernel: update to 4.14.212
by Arne Fitzenreiter 16 Dec '20

16 Dec '20

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/linux | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/linux b/lfs/linux index e4467c477..5abc6f93a 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,8 +24,8 @@ include Config -VER = 4.14.211 -ARM_PATCHES = 4.14.211-ipfire0 +VER = 4.14.212 +ARM_PATCHES = 4.14.212-ipfire0 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.xz @@ -79,7 +79,7 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_MD5 = 41241e9508acc9183540db785f78ec78 +$(DL_FILE)_MD5 = 645d5256adf72569e14edcf80c3757dc arm-multi-patches-$(ARM_PATCHES).patch.xz_MD5 = 2b0e8e3ebe9827b2bfed7397b043dbc5 install : $(TARGET) -- 2.17.1

2 1

[PATCH] suricata: 'Downdate' to 5.0.5
by Matthias Fischer 15 Dec '20

15 Dec '20

Triggered by https://lists.ipfire.org/pipermail/development/2020-December/008868.html Workaround for https://bugzilla.ipfire.org/show_bug.cgi?id=12548 Downgrading to 'suricata 5.0.5' bypasses Bug #12548 for now, but its only a temporary workaround... Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/suricata b/lfs/suricata index 2871d8e7b..c5dc46af4 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 6.0.0 +VER = 5.0.5 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = bbddcf2f209930206ef21977d40120d2 +$(DL_FILE)_MD5 = fe039cc4571eb56828874ddc0b71dc51 install : $(TARGET) -- 2.18.0

2 3

Core Update 153 (testing) report
by Peter Müller 14 Dec '20

14 Dec '20

Hello development folks, hello location folks (CC'ed), Core Update 153 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-153-available-for-test…) is running here for a few days by now without any known issues so far. After downloading a recent (Saturday or later) location database, I can confirm its data to be less inaccurate by now. The output of the following commands are an ideal measurement for Q&A purposes since they differ from older location databases which used the (crappy) delegated-extended-latest files, which we now only need for regions covered by ARIN and LACNINC, as they do not publish better data: > [root@maverick ~]# location lookup 51.15.0.1 > 51.15.0.1: > Network : 51.15.0.0/17 > Country : Netherlands > Autonomous System : AS12876 - ONLINE S.A.S. > [root@maverick ~]# location lookup 51.15.129.1 > 51.15.129.1: > Network : 51.15.0.0/16 > Country : France > Autonomous System : AS12876 - ONLINE S.A.S. > [root@maverick ~]# location lookup 95.216.0.1 > 95.216.0.1: > Network : 95.216.0.0/17 > Country : Finland > Autonomous System : AS24940 - Hetzner Online GmbH Location filter has not been tested, but since we built safeguards into it in Core Update 152 and implemented additional checks to exclude bogus RIR data as best as we can - not to mention Michael spending weeks on re- implementing a fast (!) algorithm for dumping libloc's tree planar for xt_geoip module, which cannot reliably handle overlapping networks -, I do not expect any issues here. As mentioned earlier, I am unable to reproduce Suricata 6.0 eating up an unreasonable amount of CPU time on my testing machine, which runs on an Intel N3150, thus apparently not being affected by the problem especially virtualised users seem to experience. Actually, CPU load is a bit lower than it was in Core Update 152, while usual network load and system resources remained unchanged. OpenVPN road-warrior connections were reported to be notably faster, but I could not test them by myself for technical reasons. Thanks to Michael again for cleaning up this mess (as explained in commit https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=d6989b4b0b42937485f5008…). :-) Tested IPFire functionalities in detail: - IPsec (N2N connections only) - Squid (authentication enabled, using an upstream proxy) - OpenVPN (RW connections only) - IPS/Suricata (with Emerging Threats community ruleset enabled) - Guardian - Quality of Service - DNS (using DNS over TLS and strict QNAME minimisation) - Dynamic DNS - Tor (relay mode) I look forward to the release of this Core Update, as it finally comes with an location database as less inaccurate (given the rather patchy RIR data, I try to avoid the term "accuracy" here) as we could do with the data we have at hand. Thanks, and best regards, Peter Müller P.S.: Reading Unbound's latest release note, I stumbled across re-using TCP and TLS connections. In case this works as I expect it to do, this should make DNS over TCP (rather dull) and TLS (more interesting in terms of privacy) significantly faster in Core Update 154.

1 0

suricata 6.0.0 / 6.0.1 - cpu load (idle) rising compared to 5.0.4
by Matthias Fischer 14 Dec '20

14 Dec '20

Hi, I'd like to have a little problem... ;-) The other day I saw 'suricata 6.0.0' had its coming out - yesterday it was '6.0.1'. At that time I thought it might be a good idea to test the current version. So I built and tested these two one after another under Core 152/64bit. I tested 6.0.0 some days ago, 6.0.1 yesterday. 'libhtp' was updated and installed too, yesterday to 0.5.36. Both built without problems, both installed without problems, both showed a strange behavior while running. Under *each* 6.0.X-version, the cpu load for '/usr/bin/suricata -c /etc/suricata/suricata.yaml -D -y 0:1' increased in *idle* mode from ~0.5%-2.0% to ~12% compared to 'suricata 5.0.4'. And I mean it. Idle. Nothing was going on. Hardware: https://fireinfo.ipfire.org/profile/5f68a6360ffbecb6877dcac75f5b8c8030f43ce8 Can anyone confirm - or did I miss something? Best, Matthias

5 16

OpenVPN-2.5.0 update procedure and idea collector
by ummeegge 14 Dec '20

14 Dec '20

Hi all, i am currently in the update process of the already realeased OpenVPN- 2.5.0 --> https://openvpn.net/community-downloads-2/ . The update has been tested and worked so far also with the old default client configuration (tested with 2.4.9 client). There are two warnings --> 1) DEPRECATED OPTION: ncp-disable. Disabling dynamic cipher negotiation is a deprecated debug feature that will be removed in OpenVPN 2.6 2) WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible. in the server log but it nevertheless works flawlessly. Am working currently on an "Advanced Encryption Settings" page which includes currently four new directives --data-ciphers (data channel encryption), --data-ciphers-fallback (data-channel encryption for clients <= OpenVPN-2.3.9), --tls-ciphers (control channel TLSv2 only) and --tls-ciphersuites (control channel >= TLSv3) all options are explained in here --> https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html , which works here currently and looks like this: Button to belong to this page: https://people.ipfire.org/~ummeegge/OpenVPN-2.5.0/screenshots/ovpn_advanced… And the page itself: https://people.ipfire.org/~ummeegge/OpenVPN-2.5.0/screenshots/ovpn_advanced… You can see also the default settings, were i need also your ideas and comments for may better defaults. On the page itself is also more planned but to not overload this here now, i wanted to go now a two step procedure with this update. 1) Push OpenVPN-2.5.0 update with the new ciphers and HMACs for regukar global settings for RW and N2N. A overview of the new crypto can be found in here --> https://community.ipfire.org/t/openvpn-2-5-development-version/2173 . 2) I would push the "Advanced Encryption settings" development as seen above then as one patch <-- this would also eliminate the first warning causing --ncp-disable since we can delete this option then. Everything else would come detached from this. Some feedback might be nice. Best, Erik

4 35

[PATCH] libhtp: Update to 0.5.36
by Matthias Fischer 14 Dec '20

14 Dec '20

For details see: https://github.com/OISF/libhtp/releases Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/libhtp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/libhtp b/lfs/libhtp index 29f90b0b3..90a55112c 100644 --- a/lfs/libhtp +++ b/lfs/libhtp @@ -24,7 +24,7 @@ include Config -VER = 0.5.35 +VER = 0.5.36 THISAPP = libhtp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 188ebe7e1804f8bfaf00db007736f3f6 +$(DL_FILE)_MD5 = 15f567527e437b38b9b1d6b86adb6a54 install : $(TARGET) -- 2.18.0

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development December 2020