Development February 2020

development@lists.ipfire.org

13 participants
55 discussions

Core Update 140/141 (testing) report
by Peter Müller 09 Feb '20

09 Feb '20

Hello development folks, upcoming Core Update 140/141 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-141-is-available-for-t…) is running here for about 24 hours by now without any unexpected behaviour so far. Due to some connectivity issues, updating Add-Ons after installing Core Update 141 required manual interaction, but should not be a problem for people in general. I noticed these log entries during the upgrade procedure (and am not sure what they mean and/or if we should worry about them): > Feb 8 15:56:58 maverick kernel: <27>udevd[536]: specified group 'input' unknown > Feb 8 15:56:58 maverick kernel: <27>udevd[536]: specified group 'render' unknown > Feb 8 15:56:58 maverick kernel: <27>udevd[536]: specified group 'kvm' unknown Updating Suricata seemed to delay the kernel messages we observed for a while by about two hours, but eventually, this kind of thing continues to happen: > Feb 8 17:20:23 maverick kernel: refcount_t: increment on 0; use-after-free. > Feb 8 17:20:23 maverick kernel: ------------[ cut here ]------------ > Feb 8 17:20:23 maverick kernel: WARNING: CPU: 0 PID: 16125 at lib/refcount.c:153 refcount_inc.cold.12+0x13/0x16 > Feb 8 17:20:23 maverick kernel: Modules linked in: chacha20_x86_64 chacha20_generic poly1305_x86_64 poly1305_generic chacha20poly1305 esp4 xfrm6_mode_tunnel xfrm4_mode_tunnel tun xt_owner xt_connmark act_mirred act_connmark cls_u32 ifb sch_ingress xt_layer7 xt_length cls_fw sch_htb nfnetlink_queue xt_NFQUEUE ipt_MASQUERADE nf_nat_masquerade_ipv4 pppoe pppox ppp_generic slhc 8021q garp cpufreq_conservative cpufreq_ondemand xt_geoip(O) xt_connlimit xt_multiport xt_hashlimit xt_mark xt_policy xt_TCPMSS nf_nat_irc nf_conntrack_irc nf_nat_tftp nf_conntrack_tftp xt_CT xt_helper nf_nat_ftp nf_conntrack_ftp xt_conntrack xt_comment ipt_REJECT nf_reject_ipv4 nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_raw iptable_mangle iptable_filter vfat fat sch_fq_codel snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic intel_powerclamp > Feb 8 17:20:23 maverick kernel: coretemp i2c_algo_bit fb_sys_fops syscopyarea sysfillrect kvm_intel sysimgblt snd_hda_intel snd_hda_codec iTCO_wdt kvm iTCO_vendor_support snd_hda_core snd_hwdep snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_timer mcs7830 lpc_ich pcspkr snd i2c_i801 r8169 mfd_core ghash_clmulni_intel usbnet mii soundcore i2c_hid rfkill_gpio i2c_core rfkill pcc_cpufreq intel_int0002_vgpio lp parport_pc parport video > Feb 8 17:20:23 maverick kernel: CPU: 0 PID: 16125 Comm: W-Q0 Tainted: G O 4.14.154-ipfire #1 > Feb 8 17:20:23 maverick kernel: Hardware name: Gigabyte Technology Co., Ltd. Default string/N3150ND3V, BIOS F5a 01/19/2018 > Feb 8 17:20:23 maverick kernel: task: ffff9f73b92c4b00 task.stack: ffffa5cdc0508000 > Feb 8 17:20:23 maverick kernel: RIP: 0010:refcount_inc.cold.12+0x13/0x16 > Feb 8 17:20:23 maverick kernel: RSP: 0018:ffffa5cdc050b798 EFLAGS: 00010246 > Feb 8 17:20:23 maverick kernel: RAX: 000000000000002b RBX: ffff9f73b9f08b00 RCX: 0000000000000000 > Feb 8 17:20:23 maverick kernel: RDX: 0000000000000000 RSI: ffff9f73bfc163f8 RDI: ffff9f73bfc163f8 > Feb 8 17:20:23 maverick kernel: RBP: ffffffffad29f250 R08: 000000000000003c R09: 000000000000040c > Feb 8 17:20:23 maverick kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f73b7fa1500 > Feb 8 17:20:23 maverick kernel: R13: ffffffffad8c3c80 R14: ffffffffc061a3e0 R15: 0000000000008003 > Feb 8 17:20:23 maverick kernel: FS: 0000720182012700(0000) GS:ffff9f73bfc00000(0000) knlGS:0000000000000000 > Feb 8 17:20:23 maverick kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > Feb 8 17:20:23 maverick kernel: CR2: 000073681f301180 CR3: 0000000179c3c000 CR4: 00000000001006f0 > Feb 8 17:20:23 maverick kernel: Call Trace: > Feb 8 17:20:23 maverick kernel: nf_queue_entry_get_refs+0x41/0x90 > Feb 8 17:20:23 maverick kernel: nf_queue+0xef/0x1e0 > Feb 8 17:20:23 maverick kernel: nf_hook_slow+0x69/0xc0 > Feb 8 17:20:23 maverick kernel: __ip_local_out+0xe4/0x150 > Feb 8 17:20:23 maverick kernel: ? ip_forward_options.cold.7+0x27/0x27 > Feb 8 17:20:23 maverick kernel: xfrm_output_resume+0x21e/0x540 > Feb 8 17:20:23 maverick kernel: ? ipv4_confirm+0x3f/0xd0 > Feb 8 17:20:23 maverick kernel: xfrm4_output+0x3a/0xe0 > Feb 8 17:20:23 maverick kernel: ? xfrm4_udp_encap_rcv+0x1a0/0x1a0 > Feb 8 17:20:23 maverick kernel: nf_reinject+0x153/0x190 > Feb 8 17:20:23 maverick kernel: nfqnl_recv_verdict+0x293/0x4a0 [nfnetlink_queue] > Feb 8 17:20:23 maverick kernel: ? nla_parse+0xb5/0xe0 > Feb 8 17:20:23 maverick kernel: nfnetlink_rcv_msg+0x14e/0x260 > Feb 8 17:20:23 maverick kernel: ? nfnetlink_net_exit_batch+0x60/0x60 > Feb 8 17:20:23 maverick kernel: netlink_rcv_skb+0x78/0x150 > Feb 8 17:20:23 maverick kernel: nfnetlink_rcv+0x70/0x760 > Feb 8 17:20:23 maverick kernel: ? __slab_free+0x138/0x2d0 > Feb 8 17:20:23 maverick kernel: ? __netlink_lookup+0xe1/0x140 > Feb 8 17:20:23 maverick kernel: netlink_unicast+0x183/0x230 > Feb 8 17:20:23 maverick kernel: netlink_sendmsg+0x204/0x3d0 > Feb 8 17:20:23 maverick kernel: sock_sendmsg+0x36/0x40 > Feb 8 17:20:23 maverick kernel: ___sys_sendmsg+0x2a7/0x300 > Feb 8 17:20:23 maverick kernel: ? netlink_recvmsg+0x398/0x460 > Feb 8 17:20:23 maverick kernel: __sys_sendmsg+0x67/0xb0 > Feb 8 17:20:23 maverick kernel: do_syscall_64+0x67/0x100 > Feb 8 17:20:23 maverick kernel: entry_SYSCALL_64_after_hwframe+0x3d/0xa2 > Feb 8 17:20:23 maverick kernel: RIP: 0033:0x720183fc25fd > Feb 8 17:20:23 maverick kernel: RSP: 002b:000072018200ff90 EFLAGS: 00000293 ORIG_RAX: 000000000000002e > Feb 8 17:20:23 maverick kernel: RAX: ffffffffffffffda RBX: 0000720182010060 RCX: 0000720183fc25fd > Feb 8 17:20:23 maverick kernel: RDX: 0000000000000000 RSI: 000072018200ffd0 RDI: 0000000000000005 > Feb 8 17:20:23 maverick kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000301 > Feb 8 17:20:23 maverick kernel: R10: 0000000000000001 R11: 0000000000000293 R12: 0000000000000000 > Feb 8 17:20:23 maverick kernel: R13: 000072017c26cd98 R14: 0000000000000070 R15: 0000000000000001 > Feb 8 17:20:23 maverick kernel: Code: c0 9c a7 ad c6 05 ee be d8 00 01 e8 d7 de d7 ff 0f 0b b8 01 00 00 00 c3 48 c7 c7 18 9d a7 ad c6 05 d2 be d8 00 01 e8 bc de d7 ff <0f> 0b c3 48 c7 c7 48 9d a7 ad c6 05 bb be d8 00 01 e8 a6 de d7 > Feb 8 17:20:23 maverick kernel: ---[ end trace 3b943d85354038f6 ]--- > Feb 8 17:20:23 maverick kernel: refcount_t: underflow; use-after-free. > Feb 8 17:20:23 maverick kernel: ------------[ cut here ]------------ > Feb 8 17:20:23 maverick kernel: WARNING: CPU: 0 PID: 16125 at lib/refcount.c:187 refcount_sub_and_test.cold.13+0x13/0x1a > Feb 8 17:20:23 maverick kernel: Modules linked in: chacha20_x86_64 chacha20_generic poly1305_x86_64 poly1305_generic chacha20poly1305 esp4 xfrm6_mode_tunnel xfrm4_mode_tunnel tun xt_owner xt_connmark act_mirred act_connmark cls_u32 ifb sch_ingress xt_layer7 xt_length cls_fw sch_htb nfnetlink_queue xt_NFQUEUE ipt_MASQUERADE nf_nat_masquerade_ipv4 pppoe pppox ppp_generic slhc 8021q garp cpufreq_conservative cpufreq_ondemand xt_geoip(O) xt_connlimit xt_multiport xt_hashlimit xt_mark xt_policy xt_TCPMSS nf_nat_irc nf_conntrack_irc nf_nat_tftp nf_conntrack_tftp xt_CT xt_helper nf_nat_ftp nf_conntrack_ftp xt_conntrack xt_comment ipt_REJECT nf_reject_ipv4 nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_raw iptable_mangle iptable_filter vfat fat sch_fq_codel snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic intel_powerclamp > Feb 8 17:20:23 maverick kernel: coretemp i2c_algo_bit fb_sys_fops syscopyarea sysfillrect kvm_intel sysimgblt snd_hda_intel snd_hda_codec iTCO_wdt kvm iTCO_vendor_support snd_hda_core snd_hwdep snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_timer mcs7830 lpc_ich pcspkr snd i2c_i801 r8169 mfd_core ghash_clmulni_intel usbnet mii soundcore i2c_hid rfkill_gpio i2c_core rfkill pcc_cpufreq intel_int0002_vgpio lp parport_pc parport video > Feb 8 17:20:23 maverick kernel: CPU: 0 PID: 16125 Comm: W-Q0 Tainted: G W O 4.14.154-ipfire #1 > Feb 8 17:20:23 maverick kernel: Hardware name: Gigabyte Technology Co., Ltd. Default string/N3150ND3V, BIOS F5a 01/19/2018 > Feb 8 17:20:23 maverick kernel: task: ffff9f73b92c4b00 task.stack: ffffa5cdc0508000 > Feb 8 17:20:23 maverick kernel: RIP: 0010:refcount_sub_and_test.cold.13+0x13/0x1a > Feb 8 17:20:23 maverick kernel: RSP: 0018:ffffa5cdc050b928 EFLAGS: 00010246 > Feb 8 17:20:23 maverick kernel: RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000006 > Feb 8 17:20:23 maverick kernel: RDX: 0000000000000000 RSI: 0000000000000082 RDI: ffff9f73bfc163f0 > Feb 8 17:20:23 maverick kernel: RBP: ffff9f738c4d4800 R08: 0000000000000038 R09: 0000000000000442 > Feb 8 17:20:23 maverick kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f73b8b9dc80 > Feb 8 17:20:23 maverick kernel: R13: ffff9f73b961c800 R14: ffff9f73babec6c0 R15: 0000000000000000 > Feb 8 17:20:23 maverick kernel: FS: 0000720182012700(0000) GS:ffff9f73bfc00000(0000) knlGS:0000000000000000 > Feb 8 17:20:23 maverick kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > Feb 8 17:20:23 maverick kernel: CR2: 000073681f301180 CR3: 0000000179c3c000 CR4: 00000000001006f0 > Feb 8 17:20:23 maverick kernel: Call Trace: > Feb 8 17:20:23 maverick kernel: nf_queue_entry_release_refs+0x45/0xa0 > Feb 8 17:20:23 maverick kernel: nf_reinject+0x3d/0x190 > Feb 8 17:20:23 maverick kernel: nfqnl_recv_verdict+0x293/0x4a0 [nfnetlink_queue] > Feb 8 17:20:23 maverick kernel: ? nla_parse+0xb5/0xe0 > Feb 8 17:20:23 maverick kernel: nfnetlink_rcv_msg+0x14e/0x260 > Feb 8 17:20:23 maverick kernel: ? nfnetlink_net_exit_batch+0x60/0x60 > Feb 8 17:20:23 maverick kernel: netlink_rcv_skb+0x78/0x150 > Feb 8 17:20:23 maverick kernel: nfnetlink_rcv+0x70/0x760 > Feb 8 17:20:23 maverick kernel: ? __slab_free+0x138/0x2d0 > Feb 8 17:20:23 maverick kernel: ? __netlink_lookup+0xe1/0x140 > Feb 8 17:20:23 maverick kernel: netlink_unicast+0x183/0x230 > Feb 8 17:20:23 maverick kernel: netlink_sendmsg+0x204/0x3d0 > Feb 8 17:20:23 maverick kernel: sock_sendmsg+0x36/0x40 > Feb 8 17:20:23 maverick kernel: ___sys_sendmsg+0x2a7/0x300 > Feb 8 17:20:23 maverick kernel: ? netlink_recvmsg+0x398/0x460 > Feb 8 17:20:23 maverick kernel: __sys_sendmsg+0x67/0xb0 > Feb 8 17:20:23 maverick kernel: do_syscall_64+0x67/0x100 > Feb 8 17:20:23 maverick kernel: entry_SYSCALL_64_after_hwframe+0x3d/0xa2 > Feb 8 17:20:23 maverick kernel: RIP: 0033:0x720183fc25fd > Feb 8 17:20:23 maverick kernel: RSP: 002b:000072018200ff90 EFLAGS: 00000293 ORIG_RAX: 000000000000002e > Feb 8 17:20:23 maverick kernel: RAX: ffffffffffffffda RBX: 0000720182010060 RCX: 0000720183fc25fd > Feb 8 17:20:23 maverick kernel: RDX: 0000000000000000 RSI: 000072018200ffd0 RDI: 0000000000000005 > Feb 8 17:20:23 maverick kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000301 > Feb 8 17:20:23 maverick kernel: R10: 000072017c26cdf4 R11: 0000000000000293 R12: 0000000000000000 > Feb 8 17:20:23 maverick kernel: R13: 000072017c26cd98 R14: 0000000065000070 R15: 0000000000000001 > Feb 8 17:20:23 maverick kernel: Code: 00 c3 48 c7 c7 18 9d a7 ad c6 05 d2 be d8 00 01 e8 bc de d7 ff 0f 0b c3 48 c7 c7 48 9d a7 ad c6 05 bb be d8 00 01 e8 a6 de d7 ff <0f> 0b e9 86 fe ff ff 48 c7 c7 70 9d a7 ad c6 05 a0 be d8 00 01 > Feb 8 17:20:23 maverick kernel: ---[ end trace 3b943d85354038f7 ]--- The machine boots up a little bit faster, as pledged by the release note (I love it when a plan comes together... ;-) ) and seems to be under less but not significantly lower IRQ load during operation. Newly introduced DNS CGI works fine with and without DNS over TLS - let's hope the Unbound development team will improve response times on the first mode soon. Tested IPFire functionalities in detail: - IPsec (N2N connections only) - Squid (authentication enabled, using an upstream proxy) - OpenVPN (RW connections only) - IPS/Suricata (with Emerging Threats ruleset enabled) - Quality of Service - DNS (with and without DNS over TLS) I look forward to the release of Core Update 140/141. Thanks, and best regards, Peter Müller

2 1

Thank you for commit 831ff05d898cbf3484922d33573ee067782eb663 ("kernel: enable and enforce signed kernel modules")
by Peter Müller 09 Feb '20

09 Feb '20

Hello Arne, having a look at https://git.ipfire.org/ every now and then, I just stumbled across commit 831ff05d898cbf3484922d33573ee067782eb663 ("kernel: enable and enforce signed kernel modules", see: https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=831ff05d898cbf3484922d3… ). In my opinion, this makes post-exploitation activities like installing kernel rootkits much harder, as most of them appear as kernel modules. We talked about this quite a while ago, and I did not expect this change to be made in IPFire 2.x anymore. Anyway: Thank you very much for providing it. :-) Since it already has been commited, adding an Reviewed-by tag does not make sense anymore, but it's the willingness that counts! Thanks, and best regards, Peter Müller

1 0

Testing core141
by Mentalic 08 Feb '20

08 Feb '20

Loaded core141/831ff0fd from iso . Had DNS over TLS working until I loaded backup from my core139 system. Tried it twice same results where after backup restore DNS is broken no matter how I try the various configuration options on DNS page. Regards Wayne

2 4

IPFire 2.25 core141 build and put into new 2.25 pakfire trees
by Arne Fitzenreiter 07 Feb '20

07 Feb '20

Hi i have build IPFire core141 after some late changes and put the images in my people folder and the updates to pakfire 2.25 trees for testing. Because the critical dns changes i have not put into the 2.23.1 testing trees yet. I hope i can do this after some feedback. So please help testing. Make sure your installations are on core139 before change the tree from 2.23(.1) to 2.25 for updater testing! Arne

5 11

[PATCH] ddns: Import latest upstream patches for ddns-013
by Stefan Schantl 07 Feb '20

07 Feb '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- lfs/ddns | 3 +++ src/patches/ddns-013-dyfi-use-https.patch | 22 ++++++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 src/patches/ddns-013-dyfi-use-https.patch diff --git a/lfs/ddns b/lfs/ddns index 89ab02e96..0e045ddc4 100644 --- a/lfs/ddns +++ b/lfs/ddns @@ -71,6 +71,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + # Apply upstream patches. + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/ddns-013-dyfi-use-https.patch + cd $(DIR_APP) && [ -x "configure" ] || sh ./autogen.sh cd $(DIR_APP) && ./configure \ --prefix=/usr \ diff --git a/src/patches/ddns-013-dyfi-use-https.patch b/src/patches/ddns-013-dyfi-use-https.patch new file mode 100644 index 000000000..f131c5b24 --- /dev/null +++ b/src/patches/ddns-013-dyfi-use-https.patch @@ -0,0 +1,22 @@ +commit ce6e977f0ace7fe468411270ad07f1824a3aeaec +Author: Mauno Pirnes <mauno.pirnes(a)hotmail.com> +Date: Fri Feb 7 12:25:00 2020 +0100 + + dy.fi: Use HTTPS to perform updates. + + Signed-off-by: Mauno Pirnes <mauno.pirnes(a)hotmail.com> + Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> + +diff --git a/src/ddns/providers.py b/src/ddns/providers.py +index dcdc5da..f1fed22 100644 +--- a/src/ddns/providers.py ++++ b/src/ddns/providers.py +@@ -826,7 +826,7 @@ class DDNSProviderDyFi(DDNSProtocolDynDNS2, DDNSProvider): + # https://www.dy.fi/page/clients?lang=en + # https://www.dy.fi/page/specification?lang=en + +- url = "http://www.dy.fi/nic/update" ++ url = "https://www.dy.fi/nic/update" + + # Please only send automatic updates when your IP address changes, + # or once per 5 to 6 days to refresh the address mapping (they will -- 2.25.0

2 1

[PATCH] proxy.cgi: Switch to MD5 hashed passwords for local user auth.
by Stefan Schantl 07 Feb '20

07 Feb '20

The former used default Crypt algorithmus only supports passwords up to eight signs wheater MD5 does not have any limitation here. Fixes 12290. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/proxy.cgi | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index b63964081..06aca579b 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -3945,7 +3945,13 @@ sub adduser } else { &deluser($str_user); - my $htpasswd = new Apache::Htpasswd("$userdb"); + my %htpasswd_options = ( + passwdFile => "$userdb", + UseMD5 => 1, + ); + + my $htpasswd = new Apache::Htpasswd(\%htpasswd_options); + $htpasswd->htpasswd($str_user, $str_pass); } -- 2.25.0

2 1

[PATCH 1/2] ipsec: Add script to ensure VPNs are always on
by Michael Tremer 06 Feb '20

06 Feb '20

With an IPFire box behind NAT it is difficult to keep an IPsec VPN up all of the time. On-demand mode does not work when one side cannot initiate the connection. This patch adds a script which will check every 5 minutes or when RED comes up if all VPNs are up and launch those which are not. This should ensure that we are constantly attempting to establish the connection. Additionally this patch changes that "always-on" VPNs will be "routed" like "on-demand" connections. When we see traffic, we will now automatically try to bring up the tunnel. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/cron/crontab | 3 ++ config/rootfiles/common/aarch64/stage2 | 1 + config/rootfiles/common/stage2 | 1 + config/rootfiles/common/x86_64/stage2 | 1 + html/cgi-bin/vpnmain.cgi | 10 ++++-- src/misc-progs/ipsecctrl.c | 1 + src/scripts/ipsec-always-on | 65 ++++++++++++++++++++++++++++++++++ 7 files changed, 79 insertions(+), 3 deletions(-) create mode 100644 src/scripts/ipsec-always-on diff --git a/config/cron/crontab b/config/cron/crontab index 56801394e..46cbe6ece 100644 --- a/config/cron/crontab +++ b/config/cron/crontab @@ -30,6 +30,9 @@ HOME=/ # Update dynamic DNS records every five minutes. */5 * * * * [ -f "/var/ipfire/red/active" ] && /usr/bin/ddns update-all +# Make sure VPNs are up +*/5 * * * * /usr/local/bin/ipsec-always-on + # Logwatch 05 0 * * * /usr/local/bin/logwatch > /var/log/logwatch/`date -I -d yesterday`; \ LOGWATCH_KEEP=$(sed -ne 's/^LOGWATCH_KEEP=$[0-9]\+$$/\1/p' /var/ipfire/logging/settings); \ diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2 index f4169a44e..eda34f743 100644 --- a/config/rootfiles/common/aarch64/stage2 +++ b/config/rootfiles/common/aarch64/stage2 @@ -95,6 +95,7 @@ usr/local/bin/convert-dns-settings usr/local/bin/convert-ovpn usr/local/bin/filesystem-cleanup usr/local/bin/hddshutdown +usr/local/bin/ipsec-always-on usr/local/bin/ipsec-interfaces usr/local/bin/makegraphs usr/local/bin/qosd diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index fca540431..cc0e1dea5 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -94,6 +94,7 @@ usr/local/bin/convert-dns-settings usr/local/bin/convert-ovpn usr/local/bin/filesystem-cleanup usr/local/bin/hddshutdown +usr/local/bin/ipsec-always-on usr/local/bin/ipsec-interfaces usr/local/bin/makegraphs usr/local/bin/qosd diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index cc67837e5..28a99ceec 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -96,6 +96,7 @@ usr/local/bin/convert-dns-settings usr/local/bin/convert-ovpn usr/local/bin/filesystem-cleanup usr/local/bin/hddshutdown +usr/local/bin/ipsec-always-on usr/local/bin/ipsec-interfaces usr/local/bin/makegraphs usr/local/bin/qosd diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 43cdc5aa0..b3cd3e51e 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -453,7 +453,7 @@ sub writeipsecfiles { my $start_action = $lconfighash{$key}[33]; if (!$start_action) { - $start_action = "start"; + $start_action = "route"; } my $inactivity_timeout = $lconfighash{$key}[34]; @@ -466,13 +466,17 @@ sub writeipsecfiles { print CONF "\tauto=add\n"; print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n"; } else { - print CONF "\tauto=$start_action\n"; - # If in on-demand mode, we terminate the tunnel # after 15 min of no traffic if ($start_action eq 'route' && $inactivity_timeout > 0) { print CONF "\tinactivity=$inactivity_timeout\n"; } + + # Always route connections so that we have the triggers + if ($start_action eq "start") { + $start_action = "route"; + } + print CONF "\tauto=$start_action\n"; } # Fragmentation diff --git a/src/misc-progs/ipsecctrl.c b/src/misc-progs/ipsecctrl.c index 2a64775f0..54e3b3410 100644 --- a/src/misc-progs/ipsecctrl.c +++ b/src/misc-progs/ipsecctrl.c @@ -216,6 +216,7 @@ int main(int argc, char *argv[]) { safe_system("/usr/lib/firewall/ipsec-policy >/dev/null"); safe_system("/usr/local/bin/ipsec-interfaces >/dev/null"); safe_system("/usr/sbin/ipsec restart >/dev/null"); + safe_system("/usr/local/bin/ipsec-always-on >/dev/null"); exit(0); } diff --git a/src/scripts/ipsec-always-on b/src/scripts/ipsec-always-on new file mode 100644 index 000000000..34cae169d --- /dev/null +++ b/src/scripts/ipsec-always-on @@ -0,0 +1,65 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2020 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +VPN_CONFIG="/var/ipfire/vpn/config" + +VARS=( + id status name lefthost type ctype psk local local_id leftsubnets + remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 + x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22 + route x23 mode interface_mode interface_address interface_mtu rest +) + +# Load IPsec configuration +eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings) + +log() { + logger -t ipsec "$@" +} + +main() { + # Do nothing if IPsec is disabled + if [ "${ENABLED}" != "on" ]; then + return 0 + fi + + # Do nothing if we are not online + if [ ! -e "/var/ipfire/red/active" ]; then + return 0 + fi + + local "${VARS[@]}" + while IFS="," read -r "${VARS[@]}"; do + # Skip disabled connections + [ "${status}" = "on" ] || continue + + # Skip all connections that are not in always-on mode + [ "${route}" = "start" ] || continue + + # If the connection is not up, try bringing it up + if ! ipsec status "${name}" | grep -q "INSTALLED"; then + log "Trying to start ${name}..." + ipsec stroke up-nb "${name}" &>/dev/null + fi + done < "${VPN_CONFIG}" +} + +main "$@" || exit $? -- 2.12.2

2 11

[PATCH] clamav: Update to 0.102.2
by Matthias Fischer 06 Feb '20

06 Feb '20

For details see: https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html "ClamAV 0.102.2 is a security patch release..." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/clamav | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/clamav b/lfs/clamav index 9c0aab55f..debba0a7e 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.102.1 +VER = 0.102.2 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 48 +PAK_VER = 49 DEPS = "" @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3d5f5f10a1bea212823050286c8c5b96 +$(DL_FILE)_MD5 = ecf5dd2c5c43aeed1c4b458b2e689847 install : $(TARGET) -- 2.18.0

2 1

Re: IPFire 2.25 core141 build and put into new 2.25 pakfire trees
by Michael Tremer 06 Feb '20

06 Feb '20

Hi Arne, You forgot to CC the list. > On 6 Feb 2020, at 09:38, Arne Fitzenreiter <arne_f(a)ipfire.org> wrote: > > I have finished built for aarch64 now and created next (2.25.1) testing trees. > The mirrors need some time to sync. > > But i think now we can put the update to 2.23.1 to get more testers. Cool. Please go ahead with this. I can publish the release announcement for testing if you let me know. Best, -Michael >

2 2

[PATCH] libpciaccess: Update to 0.16
by Michael Tremer 06 Feb '20

06 Feb '20

There are not rootfile changes. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/libpciaccess | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/libpciaccess b/lfs/libpciaccess index 571a71d6f..dd109220c 100644 --- a/lfs/libpciaccess +++ b/lfs/libpciaccess @@ -24,15 +24,15 @@ include Config -VER = 0.13.4 +VER = 0.16 THISAPP = libpciaccess-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.bz2 DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = libpciaccess -PAK_VER = 1 +PAK_VER = 2 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = cc1fad87da60682af1d5fa43a5da45a4 +$(DL_FILE)_MD5 = b34e2cbdd6aa8f9cc3fa613fd401a6d6 install : $(TARGET) check : $(patsubst %,$(DIR_CHK)/%,$(objects)) @@ -75,7 +75,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./configure --prefix=/usr cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && make install -- 2.20.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2020