Development May 2020

development@lists.ipfire.org

16 participants
95 discussions

[PATCH] libseccomp: Update to version 2.4.3
by Erik Kapfer 08 May '20

08 May '20

- Add list of authorized release signatures to README.md - Fix multiplexing issue with s390/s390x shm* syscalls - Remove the static flag from libseccomp tools compilation - Add define for __SNR_ppoll - Update our Travis CI configuration to use Ubuntu 18.04 - Disable live python tests in Travis CI - Use default python, rather than nightly python, in TravisCI - Fix potential memory leak identified by clang in the scmp_bpf_sim too The changelog can be found in here https://github.com/seccomp/libseccomp/blob/master/CHANGELOG . Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- config/rootfiles/packages/libseccomp | 4 ++-- lfs/libseccomp | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/packages/libseccomp b/config/rootfiles/packages/libseccomp index 615c852fb..081103b21 100644 --- a/config/rootfiles/packages/libseccomp +++ b/config/rootfiles/packages/libseccomp @@ -1,10 +1,10 @@ usr/bin/scmp_sys_resolver -#usr/include/seccomp.h #usr/include/seccomp-syscalls.h +#usr/include/seccomp.h #usr/lib/libseccomp.la #usr/lib/libseccomp.so usr/lib/libseccomp.so.2 -usr/lib/libseccomp.so.2.4.2 +usr/lib/libseccomp.so.2.4.3 #usr/lib/pkgconfig/libseccomp.pc #usr/share/man/man1/scmp_sys_resolver.1 #usr/share/man/man3/seccomp_api_get.3 diff --git a/lfs/libseccomp b/lfs/libseccomp index 064fb5896..676b516e9 100644 --- a/lfs/libseccomp +++ b/lfs/libseccomp @@ -24,7 +24,7 @@ include Config -VER = 2.4.2 +VER = 2.4.3 THISAPP = libseccomp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = libseccomp -PAK_VER = 2 +PAK_VER = 3 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = ee87fb68ae293883bde9e042c6bc324f +$(DL_FILE)_MD5 = 3a2c3b7539c1b6a933c20cd1fdcb2252 install : $(TARGET) @@ -77,6 +77,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar vxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./autogen.sh cd $(DIR_APP) && ./configure \ --prefix=/usr \ --disable-static -- 2.20.1

2 1

[PATCH] unbound: make local zone transparent
by Giovanni Aneloni 07 May '20

07 May '20

Fixes: https://bugzilla.ipfire.org/show_bug.cgi?id=12391 Change local zone to "trasnparent" instead of "typetrasnparent" to avoid NXDOMAIN when querying local hosts Signed-off-by: Giovanni Aneloni <giovanni.aneloni(a)live.com> --- diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index acbf6f5b5..825ac74ec 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -81,7 +81,7 @@ write_hosts_conf() { # Skip empty domainnames [ "${domainname}" = "" ] && continue - echo "local-zone: ${domainname} typetransparent" + echo "local-zone: ${domainname} transparent" done < /var/ipfire/main/hosts | sort -u # Add all hosts

4 9

[PATCH] shairport-sync: Update to 3.3.6
by Michael Tremer 07 May '20

07 May '20

This patch also fixes the backup. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/backup/includes/shairport-sync | 2 +- lfs/shairport-sync | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/backup/includes/shairport-sync b/config/backup/includes/shairport-sync index dc92185f9..3f9e36a7b 100644 --- a/config/backup/includes/shairport-sync +++ b/config/backup/includes/shairport-sync @@ -1 +1 @@ -etc/shairport-sync.conf +/etc/shairport-sync.conf diff --git a/lfs/shairport-sync b/lfs/shairport-sync index 6f1ad633b..e3bf9935d 100644 --- a/lfs/shairport-sync +++ b/lfs/shairport-sync @@ -24,7 +24,7 @@ include Config -VER = 3.3.2 +VER = 3.3.6 THISAPP = shairport-sync-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = shairport-sync -PAK_VER = 3 +PAK_VER = 4 DEPS = alac alsa avahi libdaemon soxr @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 80278eed6bb1391bcbafe80c0e566d1b +$(DL_FILE)_MD5 = 769c6d0cc660567e5521467d79ee9939 install : $(TARGET) -- 2.20.1

1 0

[PATCH] sysctl.conf: Turn on hard- and symlink protection
by Peter Müller 06 May '20

06 May '20

This backports 29a8992b7228771fb2cfc68679596598fb01105a into IPFire 3.x Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- setup/setup.nm | 2 +- setup/sysctl/kernel-hardening.conf | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/setup/setup.nm b/setup/setup.nm index 09d94e23d..cc8454bfa 100644 --- a/setup/setup.nm +++ b/setup/setup.nm @@ -5,7 +5,7 @@ name = setup version = 3.0 -release = 14 +release = 15 arch = noarch groups = Base Build System/Base diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf index 33e096c7c..d92485d61 100644 --- a/setup/sysctl/kernel-hardening.conf +++ b/setup/sysctl/kernel-hardening.conf @@ -7,3 +7,7 @@ kernel.dmesg_restrict = 1 # Improve KASLR effectiveness for mmap. vm.mmap_rnd_bits = 32 vm.mmap_rnd_compat_bits = 16 + +# Turn on hard- and symlink protection +fs.protected_symlinks = 1 +fs.protected_hardlinks = 1 -- 2.26.1

2 1

[PATCH] 70-log.menu: Fix ovpnclients section.
by Stefan Schantl 04 May '20

04 May '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/menu/70-log.menu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/menu/70-log.menu b/config/menu/70-log.menu index 48c23ccc2..2fa0e426e 100644 --- a/config/menu/70-log.menu +++ b/config/menu/70-log.menu @@ -46,7 +46,7 @@ $sublogs->{'55.ovpnclients'} = { 'caption' => $Lang::tr{'ovpn rw connection log'}, 'uri' => '/cgi-bin/logs.cgi/ovpnclients.dat', - 'title' => "$Lang::tr{'ovpn rw connection log'}, + 'title' => "$Lang::tr{'ovpn rw connection log'}", 'enabled' => 1, }; $sublogs->{'60.urlfilter'} = { -- 2.26.1

2 1

[PATCH] kernel: backport "random: try to actively add entropy"
by Arne Fitzenreiter 04 May '20

04 May '20

this backports https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… to gather enough entropy for initialise the crng faster. Of some machines like the APU it will need forever if the machine only wait for entropy without doing anything else. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/linux | 4 + ...inux-4.14.x-add_timer_setup_on_stack.patch | 18 +++ ...x-random_try_to_actively_add_entropy.patch | 146 ++++++++++++++++++ 3 files changed, 168 insertions(+) create mode 100644 src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch create mode 100644 src/patches/linux/linux-random_try_to_actively_add_entropy.patch diff --git a/lfs/linux b/lfs/linux index 3651e120c..847abcbae 100644 --- a/lfs/linux +++ b/lfs/linux @@ -143,6 +143,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Fix uevent PHYSDEVDRIVER cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-2.6.32.27_mcs7830-fix-driver-name.patch + # Active try to add entropy if the kernel wait for it + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-random_try_to_actively_add_entropy.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch + ifeq "$(KCFG)" "-kirkwood" cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14.40-kirkwood-dtb.patch endif diff --git a/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch b/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch new file mode 100644 index 000000000..744dbe570 --- /dev/null +++ b/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch @@ -0,0 +1,18 @@ +diff -Naur linux-4.14.173.org/include/linux/timer.h linux-4.14.173/include/linux/timer.h +--- linux-4.14.173.org/include/linux/timer.h 2020-03-11 18:03:09.000000000 +0100 ++++ linux-4.14.173/include/linux/timer.h 2020-04-30 19:30:13.956596003 +0200 +@@ -180,6 +180,14 @@ + (TIMER_DATA_TYPE)timer, flags); + } + ++static inline void timer_setup_on_stack(struct timer_list *timer, ++ void (*callback)(struct timer_list *), ++ unsigned int flags) ++{ ++ __setup_timer_on_stack(timer, (TIMER_FUNC_TYPE)callback, ++ (TIMER_DATA_TYPE)timer, flags); ++} ++ + #define from_timer(var, callback_timer, timer_fieldname) \ + container_of(callback_timer, typeof(*var), timer_fieldname) + diff --git a/src/patches/linux/linux-random_try_to_actively_add_entropy.patch b/src/patches/linux/linux-random_try_to_actively_add_entropy.patch new file mode 100644 index 000000000..15d4319db --- /dev/null +++ b/src/patches/linux/linux-random_try_to_actively_add_entropy.patch @@ -0,0 +1,146 @@ +From 50ee7529ec4500c88f8664560770a7a1b65db72b Mon Sep 17 00:00:00 2001 +From: Linus Torvalds <torvalds(a)linux-foundation.org> +Date: Sat, 28 Sep 2019 16:53:52 -0700 +Subject: random: try to actively add entropy rather than passively wait for it + +For 5.3 we had to revert a nice ext4 IO pattern improvement, because it +caused a bootup regression due to lack of entropy at bootup together +with arguably broken user space that was asking for secure random +numbers when it really didn't need to. + +See commit 72dbcf721566 (Revert "ext4: make __ext4_get_inode_loc plug"). + +This aims to solve the issue by actively generating entropy noise using +the CPU cycle counter when waiting for the random number generator to +initialize. This only works when you have a high-frequency time stamp +counter available, but that's the case on all modern x86 CPU's, and on +most other modern CPU's too. + +What we do is to generate jitter entropy from the CPU cycle counter +under a somewhat complex load: calling the scheduler while also +guaranteeing a certain amount of timing noise by also triggering a +timer. + +I'm sure we can tweak this, and that people will want to look at other +alternatives, but there's been a number of papers written on jitter +entropy, and this should really be fairly conservative by crediting one +bit of entropy for every timer-induced jump in the cycle counter. Not +because the timer itself would be all that unpredictable, but because +the interaction between the timer and the loop is going to be. + +Even if (and perhaps particularly if) the timer actually happens on +another CPU, the cacheline interaction between the loop that reads the +cycle counter and the timer itself firing is going to add perturbations +to the cycle counter values that get mixed into the entropy pool. + +As Thomas pointed out, with a modern out-of-order CPU, even quite simple +loops show a fair amount of hard-to-predict timing variability even in +the absense of external interrupts. But this tries to take that further +by actually having a fairly complex interaction. + +This is not going to solve the entropy issue for architectures that have +no CPU cycle counter, but it's not clear how (and if) that is solvable, +and the hardware in question is largely starting to be irrelevant. And +by doing this we can at least avoid some of the even more contentious +approaches (like making the entropy waiting time out in order to avoid +the possibly unbounded waiting). + +Cc: Ahmed Darwish <darwish.07(a)gmail.com> +Cc: Thomas Gleixner <tglx(a)linutronix.de> +Cc: Theodore Ts'o <tytso(a)mit.edu> +Cc: Nicholas Mc Guire <hofrat(a)opentech.at> +Cc: Andy Lutomirski <luto(a)kernel.org> +Cc: Kees Cook <keescook(a)chromium.org> +Cc: Willy Tarreau <w(a)1wt.eu> +Cc: Alexander E. Patrakov <patrakov(a)gmail.com> +Cc: Lennart Poettering <mzxreary(a)0pointer.de> +Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> +--- + drivers/char/random.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 61 insertions(+), 1 deletion(-) + +(limited to 'drivers/char/random.c') + +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 5d5ea4ce1442..2fda6166c1dd 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1731,6 +1731,56 @@ void get_random_bytes(void *buf, int nbytes) + } + EXPORT_SYMBOL(get_random_bytes); + ++ ++/* ++ * Each time the timer fires, we expect that we got an unpredictable ++ * jump in the cycle counter. Even if the timer is running on another ++ * CPU, the timer activity will be touching the stack of the CPU that is ++ * generating entropy.. ++ * ++ * Note that we don't re-arm the timer in the timer itself - we are ++ * happy to be scheduled away, since that just makes the load more ++ * complex, but we do not want the timer to keep ticking unless the ++ * entropy loop is running. ++ * ++ * So the re-arming always happens in the entropy loop itself. ++ */ ++static void entropy_timer(struct timer_list *t) ++{ ++ credit_entropy_bits(&input_pool, 1); ++} ++ ++/* ++ * If we have an actual cycle counter, see if we can ++ * generate enough entropy with timing noise ++ */ ++static void try_to_generate_entropy(void) ++{ ++ struct { ++ unsigned long now; ++ struct timer_list timer; ++ } stack; ++ ++ stack.now = random_get_entropy(); ++ ++ /* Slow counter - or none. Don't even bother */ ++ if (stack.now == random_get_entropy()) ++ return; ++ ++ timer_setup_on_stack(&stack.timer, entropy_timer, 0); ++ while (!crng_ready()) { ++ if (!timer_pending(&stack.timer)) ++ mod_timer(&stack.timer, jiffies+1); ++ mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now)); ++ schedule(); ++ stack.now = random_get_entropy(); ++ } ++ ++ del_timer_sync(&stack.timer); ++ destroy_timer_on_stack(&stack.timer); ++ mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now)); ++} ++ + /* + * Wait for the urandom pool to be seeded and thus guaranteed to supply + * cryptographically secure random numbers. This applies to: the /dev/urandom +@@ -1745,7 +1795,17 @@ int wait_for_random_bytes(void) + { + if (likely(crng_ready())) + return 0; +- return wait_event_interruptible(crng_init_wait, crng_ready()); ++ ++ do { ++ int ret; ++ ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ); ++ if (ret) ++ return ret > 0 ? 0 : ret; ++ ++ try_to_generate_entropy(); ++ } while (!crng_ready()); ++ ++ return 0; + } + EXPORT_SYMBOL(wait_for_random_bytes); + +-- +cgit 1.2-0.3.lf.el7 + -- 2.17.1

2 3

[PATCH] Python3: update to 3.8.2
by Peter Müller 04 May '20

04 May '20

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/python3 | 4 ++-- lfs/python3 | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/python3 b/config/rootfiles/common/python3 index ed8a370cf..665dc8443 100644 --- a/config/rootfiles/common/python3 +++ b/config/rootfiles/common/python3 @@ -842,9 +842,9 @@ usr/lib/python3.8/lib-dynload/xxlimited.cpython-38-MACHINE-linux-gnu.so usr/lib/python3.8/lib-dynload/zlib.cpython-38-MACHINE-linux-gnu.so #usr/lib/python3.8/lib2to3 usr/lib/python3.8/lib2to3/Grammar.txt -usr/lib/python3.8/lib2to3/Grammar3.8.1.final.0.pickle +usr/lib/python3.8/lib2to3/Grammar3.8.2.final.0.pickle usr/lib/python3.8/lib2to3/PatternGrammar.txt -usr/lib/python3.8/lib2to3/PatternGrammar3.8.1.final.0.pickle +usr/lib/python3.8/lib2to3/PatternGrammar3.8.2.final.0.pickle usr/lib/python3.8/lib2to3/__init__.py usr/lib/python3.8/lib2to3/__main__.py usr/lib/python3.8/lib2to3/btm_matcher.py diff --git a/lfs/python3 b/lfs/python3 index 3d3a27861..14bdfa584 100644 --- a/lfs/python3 +++ b/lfs/python3 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.8.1 +VER = 3.8.2 THISAPP = Python-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -60,7 +60,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b3fb85fd479c0bf950c626ef80cacb57 +$(DL_FILE)_MD5 = e9d6ebc92183a177b8e8a58cad5b8d67 install : $(TARGET) -- 2.26.1

2 1

[PATCH] de.pl: fix misleading translation
by Peter Müller 04 May '20

04 May '20

The 'geoip' key is being used in the firewall.cgi for configuring GeoIP as a source or destination. "konfigurieren" is misleading in this context. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- langs/de/cgi-bin/de.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 9f1768e78..a3338147d 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1310,7 +1310,7 @@ 'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient' => 'Die Erzeugung der Root- und Host-Zertifikate kann eine Weile dauern. Auf älterer Hardware kann dies mehrere Minuten in Anspruch nehmen. Bitte haben Sie etwas Geduld.', 'genkey' => 'PSK erzeugen', 'genre' => 'Genre', -'geoip' => 'Länderfilter konfigurieren', +'geoip' => 'Länderfilter', 'geoipblock' => 'GeoIP-Filter', 'geoipblock block countries' => 'Länderfilter', 'geoipblock configuration' => 'GeoIP-Konfiguration', -- 2.26.1

2 1

[PATCH 0/1] hostapd: clean up shell script
by Peter Müller 04 May '20

04 May '20

Hello development folks, the following patch is the first attempt of cleaning the all shell scripts we use in and around IPFire 2.x, which is necessary as they contain quite some glitches (most of them are aesthetic or balancing ones, but some might be more severe, especially when it comes to malfunctions due to unexpected input) and IPFire 3.x probably will not be arriving that fast. In other words, there is no sense in delaying the inevitable. There is an umbrealla bug for this task (#12398) assigned to my humble self, but to make sure my changes are welcomed by the development community, I start with the hostapd initscript and wait for comments. If they are positive, I plan to clean up all the 132 shell scripts one by one. Please refer to #12398 for further information about the progress and what I am going to do. Patches and commits will be tracked there. Looking forward to your opinions. Thanks, and best regards, Peter Müller

2 2

[PATCH] OpenVPN: Delete RRD dir if connection is deleted
by Erik Kapfer 04 May '20

04 May '20

Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index ce9524df7..00ecd77a0 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2513,7 +2513,7 @@ else # CCD end # Update collectd configuration and delete all RRD files of the removed connection &writecollectdconf(); - system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]"); + system ('/usr/local/bin/openvpnctrl', '-drrd', $confighash{$cgiparams{'KEY'}}[1]); delete $confighash{$cgiparams{'KEY'}}; my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; -- 2.12.2

4 9

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development May 2020