Development September 2022

development@lists.ipfire.org

14 participants
62 discussions

[PATCH] linux: Update to 5.15.68
by Peter Müller 19 Sep '22

19 Sep '22

Please refer to https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.68 for the changelog of this release. Due to the lack of local build hardware, ARM rootfile and configuration changes have been omitted. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.x86_64-ipfire | 11 +++++------ config/rootfiles/common/x86_64/linux | 6 ++++-- lfs/linux | 4 ++-- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index aa1e847dd..54e8a3ec7 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,15 +1,15 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 5.15.59-ipfire Kernel Configuration +# Linux/x86 5.15.68-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.3.0" CONFIG_CC_IS_GCC=y CONFIG_GCC_VERSION=110300 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y -CONFIG_AS_VERSION=23700 +CONFIG_AS_VERSION=23900 CONFIG_LD_IS_BFD=y -CONFIG_LD_VERSION=23700 +CONFIG_LD_VERSION=23900 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y CONFIG_CC_CAN_LINK_STATIC=y @@ -691,6 +691,7 @@ CONFIG_HAVE_KPROBES_ON_FTRACE=y CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y CONFIG_HAVE_NMI=y CONFIG_TRACE_IRQFLAGS_SUPPORT=y +CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y CONFIG_HAVE_ARCH_TRACEHOOK=y CONFIG_HAVE_DMA_CONTIGUOUS=y CONFIG_GENERIC_SMP_IDLE_THREAD=y @@ -7124,8 +7125,7 @@ CONFIG_CRYPTO_CRC32=y CONFIG_CRYPTO_CRC32_PCLMUL=m CONFIG_CRYPTO_XXHASH=m CONFIG_CRYPTO_BLAKE2B=m -# CONFIG_CRYPTO_BLAKE2S is not set -CONFIG_CRYPTO_BLAKE2S_X86=m +CONFIG_CRYPTO_BLAKE2S_X86=y CONFIG_CRYPTO_CRCT10DIF=y CONFIG_CRYPTO_CRCT10DIF_PCLMUL=m CONFIG_CRYPTO_GHASH=m @@ -7652,7 +7652,6 @@ CONFIG_IO_STRICT_DEVMEM=y # # x86 Debugging # -CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y # CONFIG_X86_VERBOSE_BOOTUP is not set CONFIG_EARLY_PRINTK=y # CONFIG_EARLY_PRINTK_DBGP is not set diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index 99fa8ffdc..518230b39 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -10135,7 +10135,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/SKY2 #lib/modules/KVER-ipfire/build/include/config/SLAB_FREELIST_HARDENED #lib/modules/KVER-ipfire/build/include/config/SLAB_FREELIST_RANDOM -#lib/modules/KVER-ipfire/build/include/config/SLAB_MERGE_DEFAULT #lib/modules/KVER-ipfire/build/include/config/SLHC #lib/modules/KVER-ipfire/build/include/config/SLICOSS #lib/modules/KVER-ipfire/build/include/config/SLS @@ -17543,6 +17542,9 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/scripts/dtc/version_gen.h #lib/modules/KVER-ipfire/build/scripts/dtc/yamltree.c #lib/modules/KVER-ipfire/build/scripts/dummy-tools +#lib/modules/KVER-ipfire/build/scripts/dummy-tools/dummy-plugin-dir +#lib/modules/KVER-ipfire/build/scripts/dummy-tools/dummy-plugin-dir/include +#lib/modules/KVER-ipfire/build/scripts/dummy-tools/dummy-plugin-dir/include/plugin-version.h #lib/modules/KVER-ipfire/build/scripts/dummy-tools/gcc #lib/modules/KVER-ipfire/build/scripts/dummy-tools/ld #lib/modules/KVER-ipfire/build/scripts/dummy-tools/nm @@ -17781,6 +17783,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/scripts/package/mkdebian #lib/modules/KVER-ipfire/build/scripts/package/mkspec #lib/modules/KVER-ipfire/build/scripts/package/snapcraft.template +#lib/modules/KVER-ipfire/build/scripts/pahole-flags.sh #lib/modules/KVER-ipfire/build/scripts/parse-maintainers.pl #lib/modules/KVER-ipfire/build/scripts/patch-kernel #lib/modules/KVER-ipfire/build/scripts/profile2linkerlist.pl @@ -18724,7 +18727,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/arch #lib/modules/KVER-ipfire/kernel/arch/x86 #lib/modules/KVER-ipfire/kernel/arch/x86/crypto -#lib/modules/KVER-ipfire/kernel/arch/x86/crypto/blake2s-x86_64.ko.xz #lib/modules/KVER-ipfire/kernel/arch/x86/crypto/blowfish-x86_64.ko.xz #lib/modules/KVER-ipfire/kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko.xz #lib/modules/KVER-ipfire/kernel/arch/x86/crypto/camellia-aesni-avx2.ko.xz diff --git a/lfs/linux b/lfs/linux index e80f99601..a1b32cc25 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 5.15.59 +VER = 5.15.68 ARM_PATCHES = 5.15-ipfire5 THISAPP = linux-$(VER) @@ -78,7 +78,7 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = c601b25663f73438daa40f1a72039a4ca6a027cd356a9cca3f00341a8aab0845893d4ac848a43a34758c0959e38b11ac8857777531cf1472b18f3373ba6c426b +$(DL_FILE)_BLAKE2 = b97474cbe59654ac29a5f514c08a85db9ec330f58e08de53386d4fcedeab3845d6ea5b55e478a49fa94466eda296f80c7835704e2a13d1d56f6e38ed51953ca1 arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 58a70e757a9121a0aac83604a37aa787ec7ac0ee4970c5a3ac3bcb2dbaca32b00089cae6c0da5cf2fe0a2e156427b5165c6a86e0371a3e896f4c7cdd699c34a0 install : $(TARGET) -- 2.35.3

2 1

[RFC PATCH] linux: Enable seccomp filter on ARM
by Peter Müller 19 Sep '22

19 Sep '22

Since last time we checked, the kernel's security features on ARM have improved notably (see CONFIG_RANDOMIZE_BASE discussion). This patch therefore proposes to give the seccomp filter on both 32- and 64-bit ARM another try, since it provides significant security benefit to applications using it. Due to operational constraints, rootfile changes have been omitted, and will be conducted, should this patch be approved. Note to future self: Once this patch is approved, applications using seccomp (OpenSSH, Tor) need to be updated/shipped on ARM. Fixes: #12366 Fixes: #12370 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 4 +++- config/kernel/kernel.config.armv6l-ipfire | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index b557f4cf3..62ef1316a 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -683,7 +683,9 @@ CONFIG_HAVE_CMPXCHG_DOUBLE=y CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y CONFIG_HAVE_ARCH_SECCOMP=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y -# CONFIG_SECCOMP is not set +CONFIG_SECCOMP=y +CONFIG_SECCOMP_FILTER=y +# CONFIG_SECCOMP_CACHE_DEBUG is not set CONFIG_HAVE_ARCH_STACKLEAK=y CONFIG_HAVE_STACKPROTECTOR=y CONFIG_STACKPROTECTOR=y diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index b8e0ee70c..47baada15 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -767,7 +767,9 @@ CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y CONFIG_HAVE_ARCH_SECCOMP=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y -# CONFIG_SECCOMP is not set +CONFIG_SECCOMP=y +CONFIG_SECCOMP_FILTER=y +# CONFIG_SECCOMP_CACHE_DEBUG is not set CONFIG_HAVE_STACKPROTECTOR=y CONFIG_STACKPROTECTOR=y CONFIG_STACKPROTECTOR_STRONG=y -- 2.35.3

1 0

[PATCH] backupiso: Update to ISO file naming - bug#12932
by Adolf Belka 18 Sep '22

18 Sep '22

- commit https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=fbd0608c2cb5372fff78570… aligned the ISO file name to the image file name. This change also needed to be added to backupiso as the filename is used to download the iso from the IPFire server when creating an ISO backup. Fixes: Bug#12932 Suggested-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- src/scripts/backupiso | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/scripts/backupiso b/src/scripts/backupiso index ef017e3be..2a016e067 100644 --- a/src/scripts/backupiso +++ b/src/scripts/backupiso @@ -35,7 +35,7 @@ case "${arch}" in esac URL="https://downloads.ipfire.org/releases/ipfire-2.x/$IPFVER-core$COREVER/" -ISO="ipfire-$IPFVER.$arch-full-core$COREVER.iso" +ISO="ipfire-$IPFVER-core$COREVER-$arch.iso" makeiso() { local dir="${1}" -- 2.37.3

2 1

[PATCH] bind: Update to 9.16.32
by Matthias Fischer 18 Sep '22

18 Sep '22

For details see: https://downloads.isc.org/isc/bind9/9.16.32/doc/arm/html/notes.html#notes-f… Excerpt from changelog: "5934. [func] Improve fetches-per-zone fetch limit logging to log the final allowed and spilled values of the fetch counters before the counter object gets destroyed. [GL #3461] 5933. [port] Automatically disable RSASHA1 and NSEC3RSASHA1 in named on Fedorda 33, Oracle Linux 9 and RHEL9 when they are disabled by the security policy. [GL #3469] 5932. [bug] Fix rndc dumpdb -expired and always include expired RRsets, not just for RBTDB_VIRTUAL time window. [GL #3462] 5929. [bug] The "max-zone-ttl" option in "dnssec-policy" was not fully effective; it was used for timing key rollovers but did not actually place an upper limit on TTLs when loading a zone. This has been corrected, and the documentation has been clarified to indicate that the old "max-zone-ttl" zone option is now ignored when "dnssec-policy" is in use. [GL #2918] 5924. [func] When it's necessary to use AXFR to respond to an IXFR request, a message explaining the reason is now logged at level info. [GL #2683] 5923. [bug] Fix inheritance for dnssec-policy when checking for inline-signing. [GL #3438] 5922. [bug] Forwarding of UPDATE message could fail with the introduction of netmgr. This has been fixed. [GL #3389]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 14 +++++++------- lfs/bind | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index bdb0fb7e4..5aea1853b 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -274,24 +274,24 @@ usr/bin/nsupdate #usr/include/pk11/site.h #usr/include/pkcs11 #usr/include/pkcs11/pkcs11.h -usr/lib/libbind9-9.16.31.so +usr/lib/libbind9-9.16.32.so #usr/lib/libbind9.la #usr/lib/libbind9.so -usr/lib/libdns-9.16.31.so +usr/lib/libdns-9.16.32.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libirs-9.16.31.so +usr/lib/libirs-9.16.32.so #usr/lib/libirs.la #usr/lib/libirs.so -usr/lib/libisc-9.16.31.so +usr/lib/libisc-9.16.32.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.16.31.so +usr/lib/libisccc-9.16.32.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.16.31.so +usr/lib/libisccfg-9.16.32.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.16.31.so +usr/lib/libns-9.16.32.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index 6b2fe87fe..bb5c26e1e 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.16.31 +VER = 9.16.32 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 75c9038c00fe289161a15a8e4fdadaef5a6a7f3ca03068ec24e82aa9f30ac82d0ded9cf73df83219058cd81b198ea8f561211a323e31b41407294f6932dc61d3 +$(DL_FILE)_BLAKE2 = df6f2c878138015da580dfaf0e16b5a97b11ead9f99c1425a09da8484954196ea3dafb828ac3ab386200ce2b180646c7eb1e0e62a84c153162270a4a1e19a5fc install : $(TARGET) -- 2.34.1

2 1

Addon cpufreq: is it a "Service" ?
by Charles Brown 18 Sep '22

18 Sep '22

Hi All, After upgrading to C170, the Addon 'cpufrequtils' shows as a stopped service**on services.cgi page. **See forum post: https://community.ipfire.org/t/cu-170-testing-list-of-services-is-not-compl… Is cpufrequtils incorrectly labeled as a service in the corresponding /opt/pakfire/db/meta/meta-* file? Or do I have something broken (not running) on my system? However cpufrequtils seems to be working okay -- showing the cpufreq info on the Status page, and responding as expected to cpufreq-info and cpufreq-set commands. -cab

2 2

Incorrect naming convention used on the Core Update 170 download file.
by Adolf Belka 18 Sep '22

18 Sep '22

Hi everyone, On the forum there have been a couple of people who tried creating an iso backup and it only showed a 0 byte file. I have confirmed with my vm testbed. The same thing works fine for CU169. After looking through code I have found that Core Update 169 and 170 file name order is different. The arch is placed in a different location https://downloads.ipfire.org/releases/ipfire-2.x/2.27-core169/ipfire-2.27.x… https://downloads.ipfire.org/releases/ipfire-2.x/2.27-core170/ipfire-2.27-c… This means that backup.pl is not able to find the Core Update 170 iso from the downloads site. Regards, Adolf.

3 12

Question about IPFire mail server
by Adolf Belka 18 Sep '22

18 Sep '22

Hi Peter, I have recently got my home mail server to use postfix sender dependent relayhost maps so specific emails get sent to specific ISP or other smtp servers. I then tried to add my IPFire mails to the same system but have run into problems and am wondering if you can help me with any advice. My ISP and gmail servers are using opportunistic TLS with port 587 and STARTTLS. However the IPFire smtp server (submissions.ipfire.org) uses implicit TLS with port 465 and this requires smtp_tls_wrappermode=yes and smtp_tls_security_level=encrypt. Those settings don't work with opportunistic TLS. smtp_tls_security_level=may has to be used but this doesn't work with implicit TLS. It looks like sender dependent relayhost maps doesn't work when a combination of opportunistic TLS and implicit TLS servers are being sent to, at lease as far as I have been able to figure out. On the wiki page https://wiki.ipfire.org/postmaster It mentions that the IPFire mail server mail01.ipfire.org uses opportunistic TLS, so I tried that one but that gave me the error message connect to mail01.ipfire.org[81.3.27.42]:587: No route to host Is that mail server no longer running? If it is still running, what have I missed out in my postfix setup. I presumed that my username and password for the submissions.ipfire.org mail server would be the same for the mail01.ipfire.org server but it looks like it doesn't even find the server. ping and dig still get responses back from the server. At the moment all my emails except for the IPFire ones are being sent out via my postfix server. The IPFire ones I have set up Thunderbird to send direct to the submissions.ipfire.org server and not via my mail server. That works okay but it would be nice if I could get everything working with the one system. Regards, Adolf.

1 0

Core Update 171
by Peter Müller 18 Sep '22

18 Sep '22

Hello development folks, on the given occasion, I'd like to share my thoughts regarding Core Update 171. Currently, it contains a new toolchain, updated Perl (thanks again, Adolf!), as well as updated linux-firmware, some bug fixes and package updates. The Core Update itself currently has 39 MBytes in size. Unless someone objects, I would like to squeeze a kernel into Core Update 171, since the one we released in 170 contains a bug rendering apparently popular ASIX USB3-to-LAN adapters unusable, which affects several users (none of them tested, of course :-/ ). Aside from that, there are a few bugs I'd like to see fixed before releasing Core Update 171, such as repairing the creation of full ISO backups (no Bugzilla ID assigned yet, AFAIK), as well as me finally fixing #12489. To release a testing version of C171 more timely, I propose to close the update in roughly a week, on September 25. As always, comments/critics/thoughts are appreciated. Thanks, and best regards, Peter Müller

4 3

[RFC PATCH] backup: Set owner of /var/ipfire/backup/{in,ex}clude to "root"
by Peter Müller 18 Sep '22

18 Sep '22

Since these files are static, there is no legitimate reason why they should be owned (hence writable) by "nobody". Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/backup | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/backup b/lfs/backup index 6f686bf22..adbf16e65 100644 --- a/lfs/backup +++ b/lfs/backup @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -61,8 +61,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) -mkdir -p /var/ipfire/backup/bin install -v -m 755 -o root $(DIR_SRC)/config/backup/backup.pl /var/ipfire/backup/bin - install -v -m 644 $(DIR_SRC)/config/backup/include /var/ipfire/backup/ - install -v -m 644 $(DIR_SRC)/config/backup/exclude /var/ipfire/backup/ + install -v -m 644 -o root $(DIR_SRC)/config/backup/include /var/ipfire/backup/ + install -v -m 644 -o root $(DIR_SRC)/config/backup/exclude /var/ipfire/backup/ chown nobody:nobody -R /var/ipfire/backup/ chown root:root -R /var/ipfire/backup/bin/ -mkdir -p /var/ipfire/backup/addons -- 2.35.3

2 3

[PATCH] strongSwan: Update to 5.9.7
by Peter Müller 18 Sep '22

18 Sep '22

Please refer to https://github.com/strongswan/strongswan/releases/tag/5.9.7 for the release notes of this version. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/strongswan | 1 - lfs/strongswan | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan index e9d84808a..dd0fd233a 100644 --- a/config/rootfiles/common/strongswan +++ b/config/rootfiles/common/strongswan @@ -168,7 +168,6 @@ usr/lib/ipsec/plugins/libstrongswan-xauth-generic.so usr/lib/ipsec/plugins/libstrongswan-xauth-noauth.so usr/lib/ipsec/plugins/libstrongswan-xcbc.so #usr/libexec/ipsec -usr/libexec/ipsec/_copyright usr/libexec/ipsec/_updown usr/libexec/ipsec/charon usr/libexec/ipsec/scepclient diff --git a/lfs/strongswan b/lfs/strongswan index a32c103d7..01b15f152 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -24,7 +24,7 @@ include Config -VER = 5.9.6 +VER = 5.9.7 THISAPP = strongswan-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4021a10611e66f9e2e4e432bdfb9de0f94d27ba1be1b7d4e4b8bf3cd797c123658993e60eb3d49c424b479558e9581bb069a345a70f55850d1faf5abaa401246 +$(DL_FILE)_BLAKE2 = 062f80431aefabfa4ba03454c3ab80e278772ebbd2bdeb69de98796f6e1bd7fc17d161e23b74bb238378eedc005079ff14e64e9a8967e2bf4f159a076e9f6384 install : $(TARGET) -- 2.35.3

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2022