Development March 2021

development@lists.ipfire.org

14 participants
107 discussions

Question regarding legitimate loading of kernel modules during runtime
by Peter Müller 06 Apr '21

06 Apr '21

Hello development folks, just to make sure I am not about to submit another breaking patch: Is there any legitimate reason why a non-privileged user shall load kernel modules on an IPFire machine during its runtime? Personally, I am only aware of some connection tracking stuff, but these require a reboot, thus being out of scope. Unless I overlooked something else, I would like to file a patch turning dev.tty.ldisc_autoload to 0. :-) (Further information is available at https://lkml.org/lkml/2019/4/15/890) Thanks, and best regards, Peter Müller

2 6

[PATCH] sysctl.conf: Turn on BPF JIT hardening, if the JIT is enabled
by Peter Müller 06 Apr '21

06 Apr '21

This is recommended by the Kernel Self Protection Project, and although we do not take advantage of the BPF JIT at this time, we should set this nevertheless in order to avoid potential security vulnerabilities. Fixes: #12384 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/etc/sysctl.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 7e7ebee44..3f4c828f9 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -49,6 +49,9 @@ kernel.dmesg_restrict = 1 fs.protected_symlinks = 1 fs.protected_hardlinks = 1 +# Turn on BPF JIT hardening, if the JIT is enabled. +net.core.bpf_jit_harden = 2 + # Minimal preemption granularity for CPU-bound tasks: # (default: 1 msec# (1 + ilog(ncpus)), units: nanoseconds) kernel.sched_min_granularity_ns = 10000000 -- 2.26.2

2 4

[PATCH] BUG12445: Fix for Hyper-V stuck 8 minutes at boot
by Thomas Cekal 01 Apr '21

01 Apr '21

Fix for Bug 12445: There is no proper way to distinguish between MS Azure and a local Hyper-V installation Procedure: try to get the metadata info from the internal MS metadata service at IP 169.254.169.254 If this fails the system is running on an local Hyper-V instance wget takes too long to exit if the IP is not reachable Added --timeout and --tries param to wget to reduce the duation from 8 minutes to 10 seconds 10 seconds at one try should be enough Signed-off-by: Thomas Cekal <admin(a)cekal.org> --- src/initscripts/helper/azure-setup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/initscripts/helper/azure-setup b/src/initscripts/helper/azure-setup index 5157712fc..a0d547588 100644 --- a/src/initscripts/helper/azure-setup +++ b/src/initscripts/helper/azure-setup @@ -9,7 +9,7 @@ export PATH=/usr/local/sbin:/usr/local/bin:${PATH} get() { local file="${1}" - wget -qO - --header="Metadata:true" "http://169.254.169.254/metadata/instance/${file}?api-version=2019-06-01&for…" + wget --timeout=10 --tries=1 -qO - --header="Metadata:true" "http://169.254.169.254/metadata/instance/${file}?api-version=2019-06-01&for…" } format_mac() { -- 2.17.1

2 2

work in progress: ppp 2.4.9
by Peter Müller 01 Apr '21

01 Apr '21

Hello development folks, for your information: I am currently working on ppp 2.4.9, which turns out to be rather tricky as many of our patches won't apply and/or are not necessary anymore. Thanks, and best regards, Peter Müller

2 4

Fwd: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases
by Michael Tremer 01 Apr '21

01 Apr '21

Is anyone up for grabbing this? We should not be affected by these security issues, but I do not see any reasons why we should not update - just in case. -Michael > Begin forwarded message: > > From: Karolin Seeger via samba-announce <samba-announce(a)lists.samba.org> > Subject: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases > Date: 24 March 2021 at 12:02:14 GMT > To: samba-announce(a)lists.samba.org, samba(a)lists.samba.org, samba-technical(a)lists.samba.org > Reply-To: kseeger(a)samba.org > > Release Announcements > --------------------- > > These are security releases in order to address the following defects: > > o CVE-2020-27840: Heap corruption via crafted DN strings. > o CVE-2021-20277: Out of bounds read in AD DC LDAP server. > > > ======= > Details > ======= > > o CVE-2020-27840: > An anonymous attacker can crash the Samba AD DC LDAP server by sending easily > crafted DNs as part of a bind request. More serious heap corruption is likely > also possible. > > o CVE-2021-20277: > User-controlled LDAP filter strings against the AD DC LDAP server may crash > the LDAP server. > > For more details, please refer to the security advisories. > > > ####################################### > Reporting bugs & Development Discussion > ####################################### > > Please discuss this release on the samba-technical mailing list or by > joining the #samba-technical IRC channel on irc.freenode.net. > > If you do report problems then please try to send high quality > feedback. If you don't provide vital information to help us track down > the problem then you will probably be ignored. All bug reports should > be filed under the Samba 4.1 and newer product in the project's Bugzilla > database (https://bugzilla.samba.org/). > > > ====================================================================== > == Our Code, Our Bugs, Our Responsibility. > == The Samba Team > ====================================================================== > > > > ================ > Download Details > ================ > > The uncompressed tarballs and patch files have been signed > using GnuPG (ID AA99442FB680B620). The source code can be downloaded > from: > > https://download.samba.org/pub/samba/stable/ > > The release notes are available online at: > > https://www.samba.org/samba/history/samba-4.14.2.html > https://www.samba.org/samba/history/samba-4.13.7.html > https://www.samba.org/samba/history/samba-4.12.14.html > > Our Code, Our Bugs, Our Responsibility. > (https://bugzilla.samba.org/) > > --Enjoy > The Samba Team

2 4

[PATCH 3/3] perl-Net-SMTP-SSL: Update to 1.04
by Adolf Belka 01 Apr '21

01 Apr '21

- Update from 1.02 to 1.04 - Update of rootfile not required - This is a dependency of git addon package - Changelog 1.04 2016-10-09 - mark this library deprecated, suggest newer Net::SMTP instead 1.03 2015-06-20 - $net_smtp_ssl->isa('Net::SMTP') is now true Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/perl-Net-SMTP-SSL | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/perl-Net-SMTP-SSL b/lfs/perl-Net-SMTP-SSL index 90e8a2260..2bb00a808 100644 --- a/lfs/perl-Net-SMTP-SSL +++ b/lfs/perl-Net-SMTP-SSL @@ -24,7 +24,7 @@ include Config -VER = 1.02 +VER = 1.04 THISAPP = Net-SMTP-SSL-$(VER) DL_FILE = ${THISAPP}.tar.gz @@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = perl-Net-SMTP-SSL DEPS = -PAK_VER = 2 +PAK_VER = 3 ############################################################################### # Top-level Rules @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e67b4d842a51b9a453aeeaeed45fb8e1 +$(DL_FILE)_MD5 = 62b49c961043898b43b041dafbc1b389 install : $(TARGET) -- 2.31.0

2 6

[PATCH] Net-DNS: Update to 1.30
by Matthias Fischer 31 Mar '21

31 Mar '21

Short term update - for details see: https://metacpan.org/changes/distribution/Net-DNS Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/Net-DNS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/Net-DNS b/lfs/Net-DNS index 8bd2356c2..e2fabe873 100644 --- a/lfs/Net-DNS +++ b/lfs/Net-DNS @@ -24,7 +24,7 @@ include Config -VER = 1.29_02 +VER = 1.30 THISAPP = Net-DNS-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2bf25bccd13ce2dcc4f10a6bef9cae25 +$(DL_FILE)_MD5 = 2d0751f5f1a92e4cc95835cd4b9a1d8e install : $(TARGET) -- 2.18.0

1 0

[PATCH] strongSwan: update to 5.9.2
by Peter Müller 30 Mar '21

30 Mar '21

This versions' changelog can be retrieved from https://wiki.strongswan.org/versions/80. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/strongswan | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/strongswan b/lfs/strongswan index ace2c5814..0f00b071f 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 5.9.1 +VER = 5.9.2 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 1f4db969d072e120dc12d1c116a0f658 +$(DL_FILE)_MD5 = 8918e6675e1be3784817641f07eadeb8 install : $(TARGET) -- 2.26.2

1 0

[PATCH 0/4] zabbix_agentd: new maintainer/summary
by Robin Roevens 30 Mar '21

30 Mar '21

Hi all With this my first submission into the IPFire Project and my implicit confirmation that I will now be the new maintainer of the zabbix-agentd addon package. I currently choose to only release LTS versions of the Zabbix agent as those should contain less bugs and/or security issues in the long term. This set of patches does not only update the binaries (well, the first patch only does that) but also fixes some things that I see as problematic in previous version: - /usr/lib/zabbix is created for users to drop custom agent modules in, however that dir was removed and recreated on update as it was not in the backup. I added it to the backup and prevented deletion of the directory if it is not empty upon uninstall, so user-added content would not disapear when the package is removed. - Sometimes a new version of the agent will introduce new configuration parameters. In general the Zabbix Agent config file(s) should remain compatible, but we never know what the future will bring us; and the user may miss out on new features introduced with new parameters in the config file. However we don't want to plain overwrite the configfile as the user may (probably has) have changed it. Currently on upgrade configfiles are backed up, removed, new are installed, then overwritten by the old ones from the backup. Ending with the old config and the new agent. I didn't find an example of another package doing something similar, so I chose to save the new configfile(s) as .ipfirenew-files like RPM-based distro's do with .rpmnew-files. If the original config file is absent the install script will automatically strip the .ipfirenew extension. And if the new config file does not differ from the currently installed one, the .ipfirenew-file is removed. The install-script will also issue warning messages if such .ipfirenew-files are left on the filesystem, requesting the user to manually investigate and possibly merge the configfile. I hope those warnings are visible in the pakfire output. A side effect is that the config files are also not removed when the package is uninstalled. I don't see a problem here for the zabbix own config-files. But it may pose a risk concerning the sudoers-file? - I added a few IPFire specific monitoring items to the agent config which can be used for more in-depth monitoring of the IPFire installation. The user is of course free to use my template available on share.zabbix.com or github to monitor those items, or create their own template. Thanks for considering this patch-set. Please be honest but gentle commenting on it :-). Regards Robin -- Dit bericht is gescanned op virussen en andere gevaarlijke inhoud door MailScanner en lijkt schoon te zijn.

1 4

[PATCH] Net-DNS (V2): Update to 1.29_02
by Matthias Fischer 30 Mar '21

30 Mar '21

For details see: https://metacpan.org/changes/distribution/Net-DNS Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/Net-DNS | 4 ++++ lfs/Net-DNS | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/Net-DNS b/config/rootfiles/common/Net-DNS index 5ccee9949..069105a7c 100644 --- a/config/rootfiles/common/Net-DNS +++ b/config/rootfiles/common/Net-DNS @@ -31,6 +31,7 @@ usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/EUI64.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/GPOS.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/HINFO.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/HIP.pm +usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/HTTPS.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/IPSECKEY.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/ISDN.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/KEY.pm @@ -64,6 +65,7 @@ usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/SOA.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/SPF.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/SRV.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/SSHFP.pm +usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/SVCB.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/TKEY.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/TLSA.pm usr/lib/perl5/site_perl/5.30.0/Net/DNS/RR/TSIG.pm @@ -118,6 +120,7 @@ usr/lib/perl5/site_perl/5.30.0/Net/DNS/ZoneFile.pm #usr/share/man/man3/Net::DNS::RR::GPOS.3 #usr/share/man/man3/Net::DNS::RR::HINFO.3 #usr/share/man/man3/Net::DNS::RR::HIP.3 +#usr/share/man/man3/Net::DNS::RR::HTTPS.3 #usr/share/man/man3/Net::DNS::RR::IPSECKEY.3 #usr/share/man/man3/Net::DNS::RR::ISDN.3 #usr/share/man/man3/Net::DNS::RR::KEY.3 @@ -151,6 +154,7 @@ usr/lib/perl5/site_perl/5.30.0/Net/DNS/ZoneFile.pm #usr/share/man/man3/Net::DNS::RR::SPF.3 #usr/share/man/man3/Net::DNS::RR::SRV.3 #usr/share/man/man3/Net::DNS::RR::SSHFP.3 +#usr/share/man/man3/Net::DNS::RR::SVCB.3 #usr/share/man/man3/Net::DNS::RR::TKEY.3 #usr/share/man/man3/Net::DNS::RR::TLSA.3 #usr/share/man/man3/Net::DNS::RR::TSIG.3 diff --git a/lfs/Net-DNS b/lfs/Net-DNS index 5cdc2155d..8bd2356c2 100644 --- a/lfs/Net-DNS +++ b/lfs/Net-DNS @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2020 Michael Tremer & Christian Schmidt # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.25 +VER = 1.29_02 THISAPP = Net-DNS-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5c0d1a6de317993e146ce6d37c897be5 +$(DL_FILE)_MD5 = 2bf25bccd13ce2dcc4f10a6bef9cae25 install : $(TARGET) -- 2.18.0

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2021