Development November 2023

development@lists.ipfire.org

11 participants
45 discussions

The Upcoming Core Update(s)
by Michael Tremer 16 Jan '24

16 Jan '24

Hello everyone, Since this month’s video conference has been canceled, here is a couple of updates from my side: * Core Update 181 has been branched yesterday. I have this running in my office for a little while and it seems to be a solid update. It also has a lot of security fixes, so please give it a good test that we can hopefully release this in two weeks. * For the following update(s): what do we have in the pipeline? Just to coordinate that we don’t have too much in one update :) Best, -Michael

4 8

Proof of concept: Bridge rewrite of unbound-dhcp-leases-bridge
by jon 19 Dec '23

19 Dec '23

Michael & All, I am offering a Proof Of Concept (POC) for a DHCP to DNS bridge. The POC below is written in bash and may not be fast enough for thousands of devices. It uses the On Commit/Release/Expiry (CRE) already included into ISC DHCP. I believe these are known as EVENTS. === NOTE === REFERENCE: EVENTS - There are three kinds of events that can happen regarding a lease, and it is possible to declare statements that occur when any of these events happen. These events are the commit event, when the server has made a commitment of a certain lease to a client, the release event, when the client has released the server from its commitment, and the expiry event, when the commitment expires. To declare a set of statements to execute when an event happens, you must use the on statement, followed by the name of the event, followed by a series of statements to execute when the event happens, enclosed in braces. === If I did this correctly is should simplify the bridge by eliminating some of the parsing though `/var/ipfire/dhcp/fixleases` and searching for new or expired leases. If I understand CRE correctly, it should also simplify the separated Dynamic Leases and Fixed Leases. CRE seems to handle both FIXED and DYNAMIC. The downside (or upside depending on your point of view) is the elimination of the DHCP configuration "Remarks" appearing to unbound as client domain names. See DHCP configuration - Current fixed leases (at menu Network > DHCP Server) This is not complete and it currently does not include the Hostname (static) items at `/etc/unbound/hosts.conf` There are many extra lines included to help me test & debug (i.e., "logger"). Most to be removed. If this helps, please offer ideas or corrections. If not, then I will be :-( File = `/var/ipfire/dhcp/dhcpd.conf.local` File = `dhcpEvent_v6.sh` The bash script currently writes to `/etc/unbound/dhcp-leases2.conf` so I can compare it to `dhcp-leases.conf`. It does NOT provide any data to unbound (yet!) Is this script helpful? Jon Inspiration link: https://jpmens.net/2011/07/06/execute-a-script-when-isc-dhcp-hands-out-a-ne… Reference Link: Still looking!! https://stackoverflow.com/questions/51550326/is-there-any-hook-for-finishin…

3 7

Apache not properly restarting for some people with Core Update 181 Release
by Adolf Belka 09 Dec '23

09 Dec '23

Hi All, There has been a thread in the forum:- https://community.ipfire.org/t/upgrade-to-181-hangs/10634/1 where four people have reported that apache has not restarted during the upgrade so their WUI hangs at the line:- PAKFIRE UPGR: core-upgrade-181: Upgrading files and running post-upgrading scripts… but their pakfire logs showed that the upgrade continued successfully. One person has done the upgrade on 14 systems. 3 went without any problem but 11 hung after the above line. IPFire has continued working fine behind the scenes so no big interruption to their operation but clearly for some systems apache did not properly restart. In future core updates, if apache is being upgraded and needs to be restarted, maybe it would be useful to add a check that apache did actually successfully restart and if not to try to start it again. Any other thoughts on this. Regards, Adolf. -- Sent from my laptop

4 10

[PATCH 1/2] tor.cgi: Fixes deprecated tor option 'ExitNode' to 'ExitNodes'
by Erik Kapfer 01 Dec '23

01 Dec '23

If fingerprints in the Exit Node section are in usage, tor.cgi prints the deprecated option 'ExitNode' into torrc which leads to the following warning "The abbreviation ‘ExitNode’ is deprecated. Please use ‘ExitNodes’ instead". Fix has been found and tested in the community for reference please see --> https://community.ipfire.org/t/the-abbreviation-exitnode-is-deprecated-plea… Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- html/cgi-bin/tor.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index 75fdf0d5d..9aa2bc95a 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -790,7 +790,7 @@ sub BuildConfiguration() { my @nodes = split(",", $settings{'TOR_USE_EXIT_NODES'}); foreach (@nodes) { - print FILE "ExitNode $_\n"; + print FILE "ExitNodes $_\n"; } } -- 2.42.0

3 4

Results from latest test of pakfire-builder
by Adolf Belka 30 Nov '23

30 Nov '23

Hi All, I updated my pakfire branch by doing a git pull with all the latest changes and built everything again. Then tested out by running sudo pakfire-builder build beep/beep.nm Result was again just going to the prompt with nothing happening. Ran the commands with gdb and got following result. sudo gdb pakfire-builder GNU gdb (GDB) 13.2 Copyright (C) 2023 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from pakfire-builder... (gdb) run build beep/beep.nm Starting program: /usr/bin/pakfire-builder build beep/beep.nm [Thread debugging using libthread_db enabled] Using host libthread_db library "/usr/lib/libthread_db.so.1". [New Thread 0x7ffff57dd6c0 (LWP 12756)] [Thread 0x7ffff57dd6c0 (LWP 12756) exited] [Inferior 1 (process 12752) exited with code 0377] (gdb) Regards, Adolf. -- Sent from my laptop

2 8

[PATCH] p11-kit: Update to version 0.25.3
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 0.25.0 to 0.25.3 - Changelog 0.25.3 rpc: fix serialization of NULL mechanism pointer [#601] fix meson build failure in macOS (appleframeworks not found) [#603] 0.25.2 fix error code checking of readpassphrase for --login option [#595] build fixes [#594] test fixes [#596] 0.25.1 fix probing of C_GetInterface [#535] p11-kit: add command to list tokens [#581] p11-kit: add command to list mechanisms supported by a token [#576] p11-kit: add command to generate private-public keypair on a token [#551, #582] p11-kit: add commands to import/export certificates and public keys into/from a token [#543, #549, #568, #588] p11-kit: add commands to list and delete objects of a token [#533, #544, #571] p11-kit: add --login option to login into a token with object and profile management commands [#587] p11-kit: adjust behavior of PKCS#11 profile management commands [#558, #560, #583, #591] p11-kit: print PKCS#11 URIs in list-modules [#532] bug and build fixes [#528 #529, #534, #537, #540, #541, #545, #547, #550, #557, #572, #575, #579, #585, #586, #590] test fixes [#553, #580] Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- p11-kit/p11-kit.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/p11-kit/p11-kit.nm b/p11-kit/p11-kit.nm index 00afe62d0..ac39fc572 100644 --- a/p11-kit/p11-kit.nm +++ b/p11-kit/p11-kit.nm @@ -4,7 +4,7 @@ ############################################################################### name = p11-kit -version = 0.25.0 +version = 0.25.3 release = 1 groups = System/Libraries -- 2.42.1

1 0

[PATCH] pango: Update to version 1.51.0
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 1.50.12 to 1.51.0 - Changelog 1.51.0 - itemize: Improve script itemization - build: Check for cairo DWrite dependency - win32: Fix various issues and crashes - layout: Add a missing switch case 1.50.14 - Fix underline thickness in scaled contexts 1.50.13 - win32: Add back fallback for empty fontsets - win32: Improve DirectWrite support - Fix word segmentation for Japanese - Don't set backspace-deletes-char for math symbols - coretext: Fix a crash - cairo: Apply metrics hinting to underlines too - Treat COLRv1 fonts as color fonts Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- pango/pango.nm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pango/pango.nm b/pango/pango.nm index 7498d0f17..9d5a400ff 100644 --- a/pango/pango.nm +++ b/pango/pango.nm @@ -5,8 +5,8 @@ name = pango version = %{ver_major}.%{ver_minor} -ver_major = 1.50 -ver_minor = 12 +ver_major = 1.51 +ver_minor = 0 release = 1 groups = System/Libraries -- 2.42.1

1 0

[PATCH] patchelf: Update to version 0.18.0
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 0.17.2 to 0.18.0 - Changelog 0.18.0 Add options to print, clear and set executable stack state by @cgzones in #456 Modernizations and strictness improvements by @cgzones in #464 Add feature to rename dynamic symbols by @brenoguim in #459 Adjust roundUp for 0 as input by @cgzones in #466 Avoid overlapping program header table with section header table #457 by @brenoguim in #460 Other switches might set changed as true. Use extraStrings size. #416 by @brenoguim in #473 Use the largest segment alignment for libraries requiring non-standard alignments #474 by @brenoguim in #475 Add one extra page to avoid overlapping with next page if its rounded… by @brenoguim in #469 Add zsh completion by @Freed-Wu in #490 Do not let modifyRPath taint shared strings in strtab. Fix #315 by @brenoguim in #481 Resize segment mapping rewritten sections if needed #482 by @brenoguim in #485 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- patchelf/patchelf.nm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/patchelf/patchelf.nm b/patchelf/patchelf.nm index f33c5721f..a86e22ce0 100644 --- a/patchelf/patchelf.nm +++ b/patchelf/patchelf.nm @@ -4,8 +4,8 @@ ############################################################################### name = patchelf -version = 0.17.2 -release = 2 +version = 0.18.0 +release = 1 groups = Development/Tools url = http://nixos.org/patchelf.html -- 2.42.1

1 0

[PATCH] polkit: Update to version 123
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Update from version 122 to 123 - Changelog 123 Highlights: - better safety with deeper resctiction of the configuration files - better safety with restricting the daemon's owner under systemd - better safety with the systemd unit sandboxing - less thread races during upload of the configuration Changes * prevent wrongful termination of runaway thread * Stop installing /usr/share/polkit-1/rules.d as 700/polkitd * set User/Group and don't change uid/gid if already set * general and/or buildsystem fixes * systemd service hardening * Packit service integration * pkcheck: manpage and help sync * general fixes * Packit service integration * change of ownership of custom configs * general fixes * localization Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- polkit/polkit.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/polkit/polkit.nm b/polkit/polkit.nm index c5a585fe9..4698a2c2a 100644 --- a/polkit/polkit.nm +++ b/polkit/polkit.nm @@ -4,7 +4,7 @@ ############################################################################### name = polkit -version = 122 +version = 123 release = 1 groups = System/Libraries -- 2.42.1

1 0

[PATCH] samba: Update to version 4.19.3
by Adolf Belka 30 Nov '23

30 Nov '23

- IPFire-3.x - Upfate from version 4.19.0 to 4.19.3 - Changelog 4.19.3 This is the latest stable release of the Samba 4.19 release series. It contains the security-relevant bugfix CVE-2018-14628: Wrong ntSecurityDescriptor values for "CN=Deleted Objects" allow read of object tombstones over LDAP (Administrator action required!) https://www.samba.org/samba/security/CVE-2018-14628.html Description of CVE-2018-14628 All versions of Samba from 4.0.0 onwards are vulnerable to an information leak (compared with the established behaviour of Microsoft's Active Directory) when Samba is an Active Directory Domain Controller. When a domain was provisioned with an unpatched Samba version, the ntSecurityDescriptor is simply inherited from Domain/Partition-HEAD-Object instead of being very strict (as on a Windows provisioned domain). This means also non privileged users can use the LDAP_SERVER_SHOW_DELETED_OID control in order to view, the names and preserved attributes of deleted objects. No information that was hidden before the deletion is visible, but in with the correct ntSecurityDescriptor value in place the whole object is also not visible without administrative rights. There is no further vulnerability associated with this error, merely an information disclosure. Action required in order to resolve CVE-2018-14628! The patched Samba does NOT protect existing domains! The administrator needs to run the following command (on only one domain controller) in order to apply the protection to an existing domain: samba-tool dbcheck --cross-ncs --attrs=nTSecurityDescriptor --fix The above requires manual interaction in order to review the changes before they are applied. Typicall question look like this: Reset nTSecurityDescriptor on CN=Deleted Objects,DC=samba,DC=org back to provision default? Owner mismatch: SY (in ref) DA(in current) Group mismatch: SY (in ref) DA(in current) Part dacl is different between reference and current here is the detail: (A;;LCRPLORC;;;AU) ACE is not present in the reference (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) ACE is not present in the reference (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA) ACE is not present in the reference (A;;CCDCLCSWRPWPSDRCWDWO;;;SY) ACE is not present in the current (A;;LCRP;;;BA) ACE is not present in the current [y/N/all/none] y Fixed attribute 'nTSecurityDescriptor' of 'CN=Deleted Objects,DC=samba,DC=org' The change should be confirmed with 'y' for all objects starting with 'CN=Deleted Objects'. 4.19.2 o Jeremy Allison <jra(a)samba.org> * BUG 15423: Use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE. * BUG 15426: clidfs.c do_connect() missing a "return" after a cli_shutdown() call. o Ralph Boehme <slow(a)samba.org> * BUG 15463: macOS mdfind returns only 50 results. o Volker Lendecke <vl(a)samba.org> * BUG 15481: GETREALFILENAME_CACHE can modify incoming new filename with previous cache entry value. o Stefan Metzmacher <metze(a)samba.org> * BUG 15464: libnss_winbind causes memory corruption since samba-4.18, impacts sendmail, zabbix, potentially more. o Martin Schwenke <mschwenke(a)ddn.com> * BUG 15479: ctdbd: setproctitle not initialized messages flooding logs. o Joseph Sutton <josephsutton(a)catalyst.net.nz> * BUG 15491: CVE-2023-5568 Heap buffer overflow with freshness tokens in the Heimdal KDC in Samba 4.19 * BUG 15477: The heimdal KDC doesn't detect s4u2self correctly when fast is in use. 4.19.1 This is a security release in order to address the following defects: o CVE-2023-3961: Unsanitized pipe names allow SMB clients to connect as root to existing unix domain sockets on the file system. https://www.samba.org/samba/security/CVE-2023-3961.html o CVE-2023-4091: SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting "acl_xattr:ignore system acls = yes" https://www.samba.org/samba/security/CVE-2023-4091.html o CVE-2023-4154: An RODC and a user with the GET_CHANGES right can view all attributes, including secrets and passwords. Additionally, the access check fails open on error conditions. https://www.samba.org/samba/security/CVE-2023-4154.html o CVE-2023-42669: Calls to the rpcecho server on the AD DC can request that the server block for a user-defined amount of time, denying service. https://www.samba.org/samba/security/CVE-2023-42669.html o CVE-2023-42670: Samba can be made to start multiple incompatible RPC listeners, disrupting service on the AD DC. https://www.samba.org/samba/security/CVE-2023-42670.html Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- samba/samba.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba/samba.nm b/samba/samba.nm index 205439fea..a97809d3f 100644 --- a/samba/samba.nm +++ b/samba/samba.nm @@ -4,7 +4,7 @@ ############################################################################### name = samba -version = 4.19.0 +version = 4.19.3 release = 1 groups = Networking/Daemons -- 2.42.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2023