Development November 2023

development@lists.ipfire.org

11 participants
46 discussions

Re: IPFire 2.27 - Core Update 164 is available for testing
by Adolf Belka 28 May '24

28 May '24

Hi All, Just tested out CU164 on my vm testbed system. The update went without any problems. You see the pakfire log status again on the wui page during the update. OpenVPN RW setup ran without any issues. Connection successfully made. IPS has the multiple providers option successfully in place. I eventually found the Force Update of rules button, which was very useful for my vm testbed as it is not running all the time and so the rules were a bit out of date. As far as I can tell everything is working fine on it. No issues detected. I will let it run over the next few days during the daytime and see how things go. Regards, Adolf. On 20/02/2022 18:35, IPFire Project wrote: > IPFire Logo > > there is a new post from Michael Tremer on the IPFire Blog: > > *IPFire 2.27 - Core Update 164 is available for testing* > > It is time to test another release for IPFire: IPFire 2.27 - Core Update 164. It comes with a vastly improved firewall engine, a new kernel and various security and bug fixes. Please help us testing this release and if you would like to support us, please donate. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-164-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

4 8

The Upcoming Core Update(s)
by Michael Tremer 16 Jan '24

16 Jan '24

Hello everyone, Since this month’s video conference has been canceled, here is a couple of updates from my side: * Core Update 181 has been branched yesterday. I have this running in my office for a little while and it seems to be a solid update. It also has a lot of security fixes, so please give it a good test that we can hopefully release this in two weeks. * For the following update(s): what do we have in the pipeline? Just to coordinate that we don’t have too much in one update :) Best, -Michael

4 8

Proof of concept: Bridge rewrite of unbound-dhcp-leases-bridge
by jon 19 Dec '23

19 Dec '23

Michael & All, I am offering a Proof Of Concept (POC) for a DHCP to DNS bridge. The POC below is written in bash and may not be fast enough for thousands of devices. It uses the On Commit/Release/Expiry (CRE) already included into ISC DHCP. I believe these are known as EVENTS. === NOTE === REFERENCE: EVENTS - There are three kinds of events that can happen regarding a lease, and it is possible to declare statements that occur when any of these events happen. These events are the commit event, when the server has made a commitment of a certain lease to a client, the release event, when the client has released the server from its commitment, and the expiry event, when the commitment expires. To declare a set of statements to execute when an event happens, you must use the on statement, followed by the name of the event, followed by a series of statements to execute when the event happens, enclosed in braces. === If I did this correctly is should simplify the bridge by eliminating some of the parsing though `/var/ipfire/dhcp/fixleases` and searching for new or expired leases. If I understand CRE correctly, it should also simplify the separated Dynamic Leases and Fixed Leases. CRE seems to handle both FIXED and DYNAMIC. The downside (or upside depending on your point of view) is the elimination of the DHCP configuration "Remarks" appearing to unbound as client domain names. See DHCP configuration - Current fixed leases (at menu Network > DHCP Server) This is not complete and it currently does not include the Hostname (static) items at `/etc/unbound/hosts.conf` There are many extra lines included to help me test & debug (i.e., "logger"). Most to be removed. If this helps, please offer ideas or corrections. If not, then I will be :-( File = `/var/ipfire/dhcp/dhcpd.conf.local` File = `dhcpEvent_v6.sh` The bash script currently writes to `/etc/unbound/dhcp-leases2.conf` so I can compare it to `dhcp-leases.conf`. It does NOT provide any data to unbound (yet!) Is this script helpful? Jon Inspiration link: https://jpmens.net/2011/07/06/execute-a-script-when-isc-dhcp-hands-out-a-ne… Reference Link: Still looking!! https://stackoverflow.com/questions/51550326/is-there-any-hook-for-finishin…

3 7

Apache not properly restarting for some people with Core Update 181 Release
by Adolf Belka 09 Dec '23

09 Dec '23

Hi All, There has been a thread in the forum:- https://community.ipfire.org/t/upgrade-to-181-hangs/10634/1 where four people have reported that apache has not restarted during the upgrade so their WUI hangs at the line:- PAKFIRE UPGR: core-upgrade-181: Upgrading files and running post-upgrading scripts… but their pakfire logs showed that the upgrade continued successfully. One person has done the upgrade on 14 systems. 3 went without any problem but 11 hung after the above line. IPFire has continued working fine behind the scenes so no big interruption to their operation but clearly for some systems apache did not properly restart. In future core updates, if apache is being upgraded and needs to be restarted, maybe it would be useful to add a check that apache did actually successfully restart and if not to try to start it again. Any other thoughts on this. Regards, Adolf. -- Sent from my laptop

4 10

[PATCH 1/2] tor.cgi: Fixes deprecated tor option 'ExitNode' to 'ExitNodes'
by Erik Kapfer 01 Dec '23

01 Dec '23

If fingerprints in the Exit Node section are in usage, tor.cgi prints the deprecated option 'ExitNode' into torrc which leads to the following warning "The abbreviation ‘ExitNode’ is deprecated. Please use ‘ExitNodes’ instead". Fix has been found and tested in the community for reference please see --> https://community.ipfire.org/t/the-abbreviation-exitnode-is-deprecated-plea… Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- html/cgi-bin/tor.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index 75fdf0d5d..9aa2bc95a 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -790,7 +790,7 @@ sub BuildConfiguration() { my @nodes = split(",", $settings{'TOR_USE_EXIT_NODES'}); foreach (@nodes) { - print FILE "ExitNode $_\n"; + print FILE "ExitNodes $_\n"; } } -- 2.42.0

3 4

Results from latest test of pakfire-builder
by Adolf Belka 30 Nov '23

30 Nov '23

Hi All, I updated my pakfire branch by doing a git pull with all the latest changes and built everything again. Then tested out by running sudo pakfire-builder build beep/beep.nm Result was again just going to the prompt with nothing happening. Ran the commands with gdb and got following result. sudo gdb pakfire-builder GNU gdb (GDB) 13.2 Copyright (C) 2023 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from pakfire-builder... (gdb) run build beep/beep.nm Starting program: /usr/bin/pakfire-builder build beep/beep.nm [Thread debugging using libthread_db enabled] Using host libthread_db library "/usr/lib/libthread_db.so.1". [New Thread 0x7ffff57dd6c0 (LWP 12756)] [Thread 0x7ffff57dd6c0 (LWP 12756) exited] [Inferior 1 (process 12752) exited with code 0377] (gdb) Regards, Adolf. -- Sent from my laptop

2 8

[PATCH] p11-kit: Update to version 0.25.3
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 0.25.0 to 0.25.3 - Changelog 0.25.3 rpc: fix serialization of NULL mechanism pointer [#601] fix meson build failure in macOS (appleframeworks not found) [#603] 0.25.2 fix error code checking of readpassphrase for --login option [#595] build fixes [#594] test fixes [#596] 0.25.1 fix probing of C_GetInterface [#535] p11-kit: add command to list tokens [#581] p11-kit: add command to list mechanisms supported by a token [#576] p11-kit: add command to generate private-public keypair on a token [#551, #582] p11-kit: add commands to import/export certificates and public keys into/from a token [#543, #549, #568, #588] p11-kit: add commands to list and delete objects of a token [#533, #544, #571] p11-kit: add --login option to login into a token with object and profile management commands [#587] p11-kit: adjust behavior of PKCS#11 profile management commands [#558, #560, #583, #591] p11-kit: print PKCS#11 URIs in list-modules [#532] bug and build fixes [#528 #529, #534, #537, #540, #541, #545, #547, #550, #557, #572, #575, #579, #585, #586, #590] test fixes [#553, #580] Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- p11-kit/p11-kit.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/p11-kit/p11-kit.nm b/p11-kit/p11-kit.nm index 00afe62d0..ac39fc572 100644 --- a/p11-kit/p11-kit.nm +++ b/p11-kit/p11-kit.nm @@ -4,7 +4,7 @@ ############################################################################### name = p11-kit -version = 0.25.0 +version = 0.25.3 release = 1 groups = System/Libraries -- 2.42.1

1 0

[PATCH] pango: Update to version 1.51.0
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 1.50.12 to 1.51.0 - Changelog 1.51.0 - itemize: Improve script itemization - build: Check for cairo DWrite dependency - win32: Fix various issues and crashes - layout: Add a missing switch case 1.50.14 - Fix underline thickness in scaled contexts 1.50.13 - win32: Add back fallback for empty fontsets - win32: Improve DirectWrite support - Fix word segmentation for Japanese - Don't set backspace-deletes-char for math symbols - coretext: Fix a crash - cairo: Apply metrics hinting to underlines too - Treat COLRv1 fonts as color fonts Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- pango/pango.nm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pango/pango.nm b/pango/pango.nm index 7498d0f17..9d5a400ff 100644 --- a/pango/pango.nm +++ b/pango/pango.nm @@ -5,8 +5,8 @@ name = pango version = %{ver_major}.%{ver_minor} -ver_major = 1.50 -ver_minor = 12 +ver_major = 1.51 +ver_minor = 0 release = 1 groups = System/Libraries -- 2.42.1

1 0

[PATCH] patchelf: Update to version 0.18.0
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 0.17.2 to 0.18.0 - Changelog 0.18.0 Add options to print, clear and set executable stack state by @cgzones in #456 Modernizations and strictness improvements by @cgzones in #464 Add feature to rename dynamic symbols by @brenoguim in #459 Adjust roundUp for 0 as input by @cgzones in #466 Avoid overlapping program header table with section header table #457 by @brenoguim in #460 Other switches might set changed as true. Use extraStrings size. #416 by @brenoguim in #473 Use the largest segment alignment for libraries requiring non-standard alignments #474 by @brenoguim in #475 Add one extra page to avoid overlapping with next page if its rounded… by @brenoguim in #469 Add zsh completion by @Freed-Wu in #490 Do not let modifyRPath taint shared strings in strtab. Fix #315 by @brenoguim in #481 Resize segment mapping rewritten sections if needed #482 by @brenoguim in #485 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- patchelf/patchelf.nm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/patchelf/patchelf.nm b/patchelf/patchelf.nm index f33c5721f..a86e22ce0 100644 --- a/patchelf/patchelf.nm +++ b/patchelf/patchelf.nm @@ -4,8 +4,8 @@ ############################################################################### name = patchelf -version = 0.17.2 -release = 2 +version = 0.18.0 +release = 1 groups = Development/Tools url = http://nixos.org/patchelf.html -- 2.42.1

1 0

[PATCH] polkit: Update to version 123
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 122 to 123 - Changelog 123 Highlights: - better safety with deeper resctiction of the configuration files - better safety with restricting the daemon's owner under systemd - better safety with the systemd unit sandboxing - less thread races during upload of the configuration Changes * prevent wrongful termination of runaway thread * Stop installing /usr/share/polkit-1/rules.d as 700/polkitd * set User/Group and don't change uid/gid if already set * general and/or buildsystem fixes * systemd service hardening * Packit service integration * pkcheck: manpage and help sync * general fixes * Packit service integration * change of ownership of custom configs * general fixes * localization Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- polkit/polkit.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/polkit/polkit.nm b/polkit/polkit.nm index c5a585fe9..4698a2c2a 100644 --- a/polkit/polkit.nm +++ b/polkit/polkit.nm @@ -4,7 +4,7 @@ ############################################################################### name = polkit -version = 122 +version = 123 release = 1 groups = System/Libraries -- 2.42.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2023