Development April 2020

development@lists.ipfire.org

12 participants
133 discussions

[PATCH] system.cgi: correctly translate CPU frequency
by Peter Müller 11 Apr '20

11 Apr '20

The CPU frequency diagram used the same "translation" as the CPU load, which was confusing. This patch introduces a dedicated translation for "CPU frequency", which makes things a little bit better but still does not solve a Deppenleerzeichen ("CPU-Frequenz Diagramm") in the German translation. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- html/cgi-bin/system.cgi | 2 +- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/system.cgi b/html/cgi-bin/system.cgi index 487ba996c..d7db9406a 100644 --- a/html/cgi-bin/system.cgi +++ b/html/cgi-bin/system.cgi @@ -61,7 +61,7 @@ if ( $querry[0] =~ "cpufreq"){ &Header::closebox(); if ( -e "$mainsettings{'RRDLOG'}/collectd/localhost/cpufreq/cpufreq-0.rrd"){ - &Header::openbox('100%', 'center', "CPU $Lang::tr{'graph'}"); + &Header::openbox('100%', 'center', "$Lang::tr{'cpu frequency'} $Lang::tr{'graph'}"); &Graphs::makegraphbox("system.cgi","cpufreq","day"); &Header::closebox(); } diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index c3702cc09..9f1768e78 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -662,6 +662,7 @@ 'country' => 'Land', 'country codes and flags' => 'Länder und Länderkennungen', 'countrycode' => 'Kennung', +'cpu frequency' => 'CPU-Frequenz', 'cpu frequency per' => 'CPU-Frequenz pro', 'cpu idle usage' => 'Leerlauf CPU-Nutzung', 'cpu interrupt usage' => 'Interrupt CPU-Nutzung', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 3f3e46641..3d8e3ceca 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -678,6 +678,7 @@ 'country' => 'Country', 'country codes and flags' => 'Country Codes and Flags:', 'countrycode' => 'Code', +'cpu frequency' => 'CPU frequency', 'cpu frequency per' => 'CPU frequency per', 'cpu idle usage' => 'Idle CPU Usage', 'cpu interrupt usage' => 'Interrupt CPU Usage', -- 2.16.4

2 1

[PATCH] sqlite: Update to version 3310100
by Erik Kapfer 11 Apr '20

11 Apr '20

Update includes several fixes and enhancements. For a full overview https://www.sqlite(.)org/draft/changes.html . Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- config/rootfiles/common/sqlite | 2 +- lfs/sqlite | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/sqlite b/config/rootfiles/common/sqlite index f3b0b3697..c3863bdb7 100644 --- a/config/rootfiles/common/sqlite +++ b/config/rootfiles/common/sqlite @@ -3,7 +3,7 @@ usr/bin/sqlite3 #usr/include/sqlite3ext.h #usr/lib/libsqlite3.a #usr/lib/libsqlite3.la -usr/lib/libsqlite3.so +#usr/lib/libsqlite3.so usr/lib/libsqlite3.so.0 usr/lib/libsqlite3.so.0.8.6 #usr/lib/pkgconfig/sqlite3.pc diff --git a/lfs/sqlite b/lfs/sqlite index 8f02634cd..000621a0e 100644 --- a/lfs/sqlite +++ b/lfs/sqlite @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3260000 +VER = 3310100 THISAPP = sqlite-autoconf-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = ac2b3b8cd3a97600e36fb8e756e8dda1 +$(DL_FILE)_MD5 = 2d0a553534c521504e3ac3ad3b90f125 install : $(TARGET) @@ -70,8 +70,12 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure --prefix=/usr + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --enable-static=no \ + cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.12.2

3 3

[PATCH] vnstat 2.6: Fix for rootfile
by Matthias Fischer 11 Apr '20

11 Apr '20

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/vnstat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/common/vnstat b/config/rootfiles/common/vnstat index 963b64bf7..83a79414f 100644 --- a/config/rootfiles/common/vnstat +++ b/config/rootfiles/common/vnstat @@ -6,4 +6,4 @@ usr/sbin/vnstatd #usr/share/man/man1/vnstati.1 #usr/share/man/man5/vnstat.conf.5 #usr/share/man/man8/vnstatd.8 -#var/log/vnstat +var/log/vnstat -- 2.18.0

2 1

[PATCH] OpenSSH: fix login on i?86
by Arne Fitzenreiter 11 Apr '20

11 Apr '20

glibc calls clock_nanosleep_time64 syscall even if it not defined in the headers for this arch and the seccomp filter kills the process with because an unknown syscall. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/openssh | 1 + ...SH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch | 13 +++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch diff --git a/lfs/openssh b/lfs/openssh index 68a7d63cd..2f3eda74f 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -71,6 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && sed -i "s/lkrb5 -ldes/lkrb5/" configure + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc/ssh \ diff --git a/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch b/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch new file mode 100644 index 000000000..5199872d9 --- /dev/null +++ b/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch @@ -0,0 +1,13 @@ +diff -Naur openssh-8.2p1.org/sandbox-seccomp-filter.c openssh-8.2p1/sandbox-seccomp-filter.c +--- openssh-8.2p1.org/sandbox-seccomp-filter.c 2020-04-10 18:14:56.152309584 +0200 ++++ openssh-8.2p1/sandbox-seccomp-filter.c 2020-04-10 21:05:45.827921765 +0200 +@@ -253,6 +253,9 @@ + #endif + #ifdef __NR_clock_nanosleep_time64 + SC_ALLOW(__NR_clock_nanosleep_time64), ++#else ++ /* on i586 glibc call syscall 407 which is not defined */ ++ SC_ALLOW(407), + #endif + #ifdef __NR_clock_gettime64 + SC_ALLOW(__NR_clock_gettime64), -- 2.17.1

2 1

[PATCH] lang: fix typo (MacVTtap != MacVTap)
by Peter Müller 11 Apr '20

11 Apr '20

Fixes: #12339 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- langs/en/cgi-bin/en.pl | 2 +- langs/fr/cgi-bin/fr.pl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 3f3e46641..e14c7d825 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2984,7 +2984,7 @@ 'zoneconf nic assignment' => 'NIC Assignment', 'zoneconf nicmode bridge' => 'Bridge', 'zoneconf nicmode default' => 'Default', -'zoneconf nicmode macvtap' => 'MacVTtap', +'zoneconf nicmode macvtap' => 'MacVTap', 'zoneconf notice reboot' => 'Please reboot to apply your changes.', 'zoneconf title' => 'Zone Configuration', 'zoneconf val native assignment error' => 'A NIC cannot be accessed natively by more than one zone.', diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl index ec81e3e36..cc3d601a2 100644 --- a/langs/fr/cgi-bin/fr.pl +++ b/langs/fr/cgi-bin/fr.pl @@ -2976,7 +2976,7 @@ 'zoneconf nic assignment' => 'Affectation de carte réseau', 'zoneconf nicmode bridge' => 'Pont', 'zoneconf nicmode default' => 'Défaut', -'zoneconf nicmode macvtap' => 'MacVTtap', +'zoneconf nicmode macvtap' => 'MacVTap', 'zoneconf notice reboot' => 'Veuillez redémarrer pour appliquer vos changements.', 'zoneconf title' => 'Configuration de zones', 'zoneconf val native assignment error' => 'Une carte réseau ne peut pas être atteinte nativement par davantage qu\'une zone.', -- 2.16.4

2 1

Initscripts in 'src/system' with 0755 permissions!?
by Matthias Fischer 11 Apr '20

11 Apr '20

Hi, I just noticed that some initscripts in 'src/system', 'src/packages' have '0755' permissions. conntrackd lvmetad vnstat ... avahi bird frr guardian shairport-sync Is there a specific reason for this? Otherwise I'd like to change them to '0644' - like all the others. Best, Matthias

2 1

Proposed firewall initscript changes
by Peter Müller 10 Apr '20

10 Apr '20

Hello *, in order to improve security and following best current practices, I would like to propose these changes to the firewall initscript: (a) Accept packets on lo interface only if source and destinations are within 127.0.0.0/8 As far as I am concerned, no other traffic should every appear on the loopback interface, which is why I consider dropping it to be a safe measure. This would probably look like: > iptables -A LOOPBACK -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT (b) Do not limit conntrack RELATED rule to ICMP Provided the conntrack people know what they are doing (if they were not, we'd have bigger problems anyway :-) ), I do not think limiting conntrack RELATED rule to ICMP traffic only makes sense: If conntrack decides a TCP/UDP/... packet is related to a connection already established, it has a good reason to do so. This would probably look like: > iptables -A CONNTRACK -m conntrack --ctstate RELATED -j ACCEPT @Jonatan, Arne, Michael: Perhaps this also allows us to filter DHCP traffic less insecure. https://serverfault.com/questions/191390/iptables-and-dhcp-questions/810655… might be of interest, but unfortunately I am unable to test it against my ISP. (A few days ago I bumped into https://blog.cloudflare.com/conntrack-tales-one-thousand-and-one-flows/, which might be interesting as well.) (c) Introduce "Martians" and block them on RED If an IPFire machine obtained a public IPv4 address on its RED interface, there is no legitimate reason for packets from RFC 1918 and other special use or private space to show up (refer to #12031). These are called "Martians" (proposal for the German translation: "Marsianer"). Since some systems will have private IP addresses in use for RED, we cannot enable this feature by default, but suggest it for PPPoE dialin and similar. To my knowledge, these IP networks are Martians: 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4 I therefore propose to (c.1) implement a switch on the firewall options page for logging Martians since some users will see quite a lot of them (c.2) implement a switch on the firewall options page that drops traffic from or to these networks on RED, (c.3) refer to it on the RED dialin page and (c.4) update the firewall hit graph code so it shows Martian traffic in a different colour. Opinions/objections/comments/...? Thanks, and best regards, Peter Müller

2 1

[PATCH] ipset: Update to version 7.6
by Erik Kapfer 10 Apr '20

10 Apr '20

Update includes several userspace and kernel part changes. For an overview, take a look into the changelog http://ipset.netfilter.org/changelog.html Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- lfs/ipset | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/ipset b/lfs/ipset index fb6a2f38f..1f6f47d2a 100644 --- a/lfs/ipset +++ b/lfs/ipset @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 7.3 +VER = 7.6 THISAPP = ipset-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = a041d186097a23f1f87208f11144907e +$(DL_FILE)_MD5 = e107b679c3256af795261cece864d6d9 install : $(TARGET) -- 2.12.2

2 1

[PATCH] iproute2: Update to version 5.6.0
by Erik Kapfer 10 Apr '20

10 Apr '20

Several fixes and new enhancements, including new binaries (devlink, rdma, tipc) has been added. For all commits, take a look in here --> https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/ . Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- config/rootfiles/common/iproute2 | 26 ++++++-------------------- lfs/iproute2 | 6 +++--- 2 files changed, 9 insertions(+), 23 deletions(-) diff --git a/config/rootfiles/common/iproute2 b/config/rootfiles/common/iproute2 index 802803bdd..83a483155 100644 --- a/config/rootfiles/common/iproute2 +++ b/config/rootfiles/common/iproute2 @@ -10,12 +10,14 @@ etc/iproute2/rt_scopes etc/iproute2/rt_tables sbin/bridge sbin/ctstat +sbin/devlink sbin/genl sbin/ifcfg sbin/ifstat sbin/ip sbin/lnstat sbin/nstat +sbin/rdma sbin/routef sbin/routel sbin/rtacct @@ -24,6 +26,7 @@ sbin/rtpr sbin/rtstat sbin/ss sbin/tc +sbin/tipc #usr/include/iproute2 #usr/include/iproute2/bpf_elf.h #usr/lib/tc @@ -35,26 +38,6 @@ sbin/tc #usr/share/bash-completion #usr/share/bash-completion/completions usr/share/bash-completion/completions/tc -#usr/share/doc/iproute2 -#usr/share/doc/iproute2/examples -#usr/share/doc/iproute2/examples/README.cbq -#usr/share/doc/iproute2/examples/README.iproute2+tc -#usr/share/doc/iproute2/examples/SYN-DoS.rate.limit -#usr/share/doc/iproute2/examples/cbqinit.eth1 -#usr/share/doc/iproute2/examples/diffserv -#usr/share/doc/iproute2/examples/diffserv/Edge1 -#usr/share/doc/iproute2/examples/diffserv/Edge2 -#usr/share/doc/iproute2/examples/diffserv/Edge31-ca-u32 -#usr/share/doc/iproute2/examples/diffserv/Edge31-cb-chains -#usr/share/doc/iproute2/examples/diffserv/Edge32-ca-u32 -#usr/share/doc/iproute2/examples/diffserv/Edge32-cb-chains -#usr/share/doc/iproute2/examples/diffserv/Edge32-cb-u32 -#usr/share/doc/iproute2/examples/diffserv/README -#usr/share/doc/iproute2/examples/diffserv/afcbq -#usr/share/doc/iproute2/examples/diffserv/ef-prio -#usr/share/doc/iproute2/examples/diffserv/efcbq -#usr/share/doc/iproute2/examples/diffserv/regression-testing -#usr/share/doc/iproute2/examples/gaiconf #usr/share/man/man3/libnetlink.3 #usr/share/man/man7/tc-hfsc.7 #usr/share/man/man8/arpd.8 @@ -67,6 +50,7 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/devlink-region.8 #usr/share/man/man8/devlink-resource.8 #usr/share/man/man8/devlink-sb.8 +#usr/share/man/man8/devlink-trap.8 #usr/share/man/man8/devlink.8 #usr/share/man/man8/genl.8 #usr/share/man/man8/ifcfg.8 @@ -127,10 +111,12 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/tc-drr.8 #usr/share/man/man8/tc-ematch.8 #usr/share/man/man8/tc-etf.8 +#usr/share/man/man8/tc-ets.8 #usr/share/man/man8/tc-flow.8 #usr/share/man/man8/tc-flower.8 #usr/share/man/man8/tc-fq.8 #usr/share/man/man8/tc-fq_codel.8 +#usr/share/man/man8/tc-fq_pie.8 #usr/share/man/man8/tc-fw.8 #usr/share/man/man8/tc-hfsc.8 #usr/share/man/man8/tc-htb.8 diff --git a/lfs/iproute2 b/lfs/iproute2 index 820303f35..2e8822902 100644 --- a/lfs/iproute2 +++ b/lfs/iproute2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 5.3.0 +VER = 5.6.0 THISAPP = iproute2-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 227404413c8d6db649d6188ead1e5a6e +$(DL_FILE)_MD5 = 9da0c352707c34b8b1fec3bf42fcfd09 install : $(TARGET) -- 2.12.2

2 1

TODO list for IPFire 3 ?
by Stephan Mending 10 Apr '20

10 Apr '20

Hi everybody, I was wondering if there was any kind of todo list for IPFirev3 ? For people like me who would like to get started ? I've found such a list neither in the wiki nor in bugzilla. (Though I found a few unrelated bugs). Do those tasks come naturally to you as soon as you've configured your 3 ? Do you have any kind of definition when version 3 is good for release ? Which features have to be available? Which functionalities are required ? Anything in that direction ? I'd guess there is.. I'm just overlooking something again. Best regards, Stephan

2 1

← Newer
1
...
5
6
7
8
9
10
11
...
14
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2020