Development July 2023

development@lists.ipfire.org

8 participants
64 discussions

Re: IPFire 2.27 - Core Update 164 is available for testing
by Adolf Belka 28 May '24

28 May '24

Hi All, Just tested out CU164 on my vm testbed system. The update went without any problems. You see the pakfire log status again on the wui page during the update. OpenVPN RW setup ran without any issues. Connection successfully made. IPS has the multiple providers option successfully in place. I eventually found the Force Update of rules button, which was very useful for my vm testbed as it is not running all the time and so the rules were a bit out of date. As far as I can tell everything is working fine on it. No issues detected. I will let it run over the next few days during the daytime and see how things go. Regards, Adolf. On 20/02/2022 18:35, IPFire Project wrote: > IPFire Logo > > there is a new post from Michael Tremer on the IPFire Blog: > > *IPFire 2.27 - Core Update 164 is available for testing* > > It is time to test another release for IPFire: IPFire 2.27 - Core Update 164. It comes with a vastly improved firewall engine, a new kernel and various security and bug fixes. Please help us testing this release and if you would like to support us, please donate. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-164-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

4 8

[PATCH] unbound-dhcp-leases-bridge: Reload unbound to import leases
by Michael Tremer 26 Oct '23

26 Oct '23

This changes the old "diff" algorithm that we needed to have before Unbound was able to reload its own configuration. Now, it can do this even without dropping the cache. This should hopefully perform much better and be more reliable than the old way. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/unbound/unbound-dhcp-leases-bridge | 52 ++++------------------- 1 file changed, 8 insertions(+), 44 deletions(-) diff --git a/config/unbound/unbound-dhcp-leases-bridge b/config/unbound/unbound-dhcp-leases-bridge index e89e0446b..e9f022aff 100644 --- a/config/unbound/unbound-dhcp-leases-bridge +++ b/config/unbound/unbound-dhcp-leases-bridge @@ -514,56 +514,19 @@ class UnboundConfigWriter(object): def __init__(self, path): self.path = path - self._cached_leases = [] - def update_dhcp_leases(self, leases): - # Find any leases that have expired or do not exist any more - # but are still in the unbound local data - removed_leases = [l for l in self._cached_leases if not l in leases] - - # Find any leases that have been added - new_leases = [l for l in leases if l not in self._cached_leases] - - # End here if nothing has changed - if not new_leases and not removed_leases: - return - # Write out all leases self.write_dhcp_leases(leases) - # Update unbound about changes - for l in removed_leases: - try: - for name, ttl, type, content in l.rrset: - log.debug("Removing records for %s" % name) - self._control("local_data_remove", name) - - # If the lease cannot be removed we will try the next one - except: - continue - - # If the removal was successful, we will remove it from the cache - else: - self._cached_leases.remove(l) - - for l in new_leases: - try: - for rr in l.rrset: - log.debug("Adding new record %s" % " ".join(rr)) - self._control("local_data", *rr) - - # If the lease cannot be added we will try the next one - except: - continue + log.debug("Reloading Unbound...") - # Add lease to cache when successfully added - else: - self._cached_leases.append(l) + # Reload the configuration without dropping the cache + self._control("reload_keep_cache") def write_dhcp_leases(self, leases): - with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: - filename = f.name + log.debug("Writing DHCP leases...") + with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: for l in leases: for rr in l.rrset: f.write("local-data: \"%s\"\n" % " ".join(rr)) @@ -571,7 +534,8 @@ class UnboundConfigWriter(object): # Make file readable for everyone os.fchmod(f.fileno(), stat.S_IRUSR|stat.S_IWUSR|stat.S_IRGRP|stat.S_IROTH) - os.rename(filename, self.path) + # Move the file to its destination + os.rename(f.name, self.path) def _control(self, *args): command = ["unbound-control"] @@ -585,7 +549,7 @@ class UnboundConfigWriter(object): log.critical("Could not run %s, error code: %s: %s" % ( " ".join(command), e.returncode, e.output)) - raise + raise e if __name__ == "__main__": -- 2.39.2

3 2

Start local and uplink network independent
by Jonatan Schlag 21 Aug '23

21 Aug '23

Hi, this is the first try for a patch series which makes the startup of local and uplink networks independent. This resolves in the end #11502. It should further allow us to keep waiting for a DHCP lease, because at least our local networks are all up when we get to the red network. This might have some small quirks, even when my testing so far shows no problems. I still think it is now better to share result, then to wait any longer. As this touches quite important parts of our network stack, I might be a could idea to merge this in two stages. After the patch, titled "network startup: Clean up duplicated Code ", might be a good breaking point. But in the end, this is up to you. Please keep in mind, I only tested the full patch set: Remove ipsec interface creation from network startup Remove Start/Stop links for client175 Use bash as shebang in network initscripts network initscripts: check if the zone in the current config exists network initscripts: Remove code for old zone scheme network scripts: remove check for AUTOCONNECT network startup: Reload routing informations for every interface network startup: Always cleanup before red gets started network startup: check for correct action at start network startup: Refactor how cmd args are processed network startup: Clean up duplicated Code network script: add extra scripts for action that depend on a network network startup: Add scripts for local and uplink network startup: Start local and uplink network independent network startup: Only work with configured zones config/rootfiles/common/aarch64/initscripts | 31 +++-- config/rootfiles/common/riscv64/initscripts | 31 +++-- config/rootfiles/common/x86_64/initscripts | 31 +++-- lfs/initscripts | 36 +++--- src/initscripts/networking/any | 31 ++++- src/initscripts/networking/functions.network | 14 +- src/initscripts/networking/red | 5 +- .../networking/red.up/99-pakfire-update | 2 +- src/initscripts/system/depends-on-network | 40 ++++++ src/initscripts/system/network | 121 ++++++++---------- 10 files changed, 218 insertions(+), 124 deletions(-) create mode 100644 src/initscripts/system/depends-on-network Looking forward to your feedback Greetings Jonatan

2 34

Re: IPFire 2.27 - Core Update 177 is available for testing
by Adolf Belka 11 Aug '23

11 Aug '23

Hi All, When doing a reboot I get a fail message at the stage of remount root readonly. The reboot seems to occur okay in that IPFire works as expected after the reboot. Problem occurs at each reboot and has been shown on two vm machines that were upgraded to CU177 Testing. Bug raised for this. https://bugzilla.ipfire.org/show_bug.cgi?id=13195 Regards, Adolf. On 27/07/2023 15:00, IPFire Project wrote: > IPFire Logo > > there is a new post from Michael Tremer on the IPFire Blog: > > *IPFire 2.27 - Core Update 177 is available for testing* > > The next update for IPFire is available for testing! It contains more hardening features for modern processors and a large number of security fixes in third-party packages. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-177-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

2 6

[PATCH] red: Fixes bug#13164 adjust pppoe plugin name in red initscript
by Adolf Belka 07 Aug '23

07 Aug '23

- This patch goes together with the patch for the ppp update to 2.5.0 - The rp-pppoe.so option is no longer available. There is only the pppoe.so available now Fixes: Bug#13164 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- src/initscripts/networking/red | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/initscripts/networking/red b/src/initscripts/networking/red index 16d48f3ac..75a17bd5a 100644 --- a/src/initscripts/networking/red +++ b/src/initscripts/networking/red @@ -365,7 +365,7 @@ case "${1}" in # if [ "$TYPE" == "pppoe" ]; then [ "${METHOD}" == "PPPOE_PLUGIN" ] && \ - PLUGOPTS="plugin rp-pppoe.so" + PLUGOPTS="plugin pppoe.so" fi ### Synchronous Mode -- 2.41.0

2 6

Request to move the August call to the 14th
by Michael Tremer 07 Aug '23

07 Aug '23

Hello everyone, I would like to ask everyone if it would work for you to move the call from the 7th to the 14th? I am traveling and it will be difficult for me to make the 7th work. All the best, -Michael

2 3

[PATCH] ids-functions.pl: Fixes bug#13203 - snort community rules not extracted
by Adolf Belka 01 Aug '23

01 Aug '23

- The snort top level directory in the archive has been changed from community.rules to snort3-community.rules so the regex no longer finds the tarball to extract. - Modified the regex to include the current snort naming for the top level archive directory Fixes: Bug#13203 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/cfgroot/ids-functions.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index d97431b4a..f2b2ffc58 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -572,7 +572,7 @@ sub extractruleset ($) { # Handle rules files. } elsif ($file =~ m/\.rules$/) { # Skip rule files which are not located in the rules directory or archive root. - next unless(($packed_file =~ /^rules\//) || ($packed_file =~ /^$provider-rules\//) || ($packed_file !~ /\//)); + next unless(($packed_file =~ /^rules\//) || ($packed_file =~ /^$provider-rules\//) || ($packed_file =~ /^snort3-$provider-rules\//) || ($packed_file !~ /\//)); # Skip deleted.rules. # -- 2.41.0

3 3

[PATCH] langs: Add translation for fixed lease in dynamic range warning
by Michael Tremer 01 Aug '23

01 Aug '23

Reported-by: Peer Dietzmann <dietzmann(a)brecht-schule.hamburg> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- doc/language_issues.de | 1 - doc/language_missings | 1 - langs/de/cgi-bin/de.pl | 1 + 3 files changed, 1 insertion(+), 2 deletions(-) diff --git a/doc/language_issues.de b/doc/language_issues.de index 392416192..5fb4fc7a0 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -883,7 +883,6 @@ WARNING: untranslated string: cake profile pppoe-ptm 27 = PPPoE PTM (27 bytes) WARNING: untranslated string: cake profile pppoe-vcmux 32 = PPPoE VC-MUX (32 bytes) WARNING: untranslated string: cake profile raw 0 = Raw (no overhead compensation) WARNING: untranslated string: desired = Desired -WARNING: untranslated string: dhcp fixed ip address in dynamic range = Fixed IP Address in dynamic range WARNING: untranslated string: disable = Disable WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: enable = Enable diff --git a/doc/language_missings b/doc/language_missings index 1b4e231e2..b0d60d9a4 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -47,7 +47,6 @@ < could not connect to www ipfire org < cryptographic settings < desired -< dhcp fixed ip address in dynamic range < dhcp server disabled on blue interface < dhcp server enabled on blue interface < disable diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 33730f0c3..229d58360 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -788,6 +788,7 @@ 'dhcp dns update' => 'DNS-Update', 'dhcp dns update algo' => 'Algorithmus', 'dhcp dns update secret' => 'Schlüssel', +'dhcp fixed ip address in dynamic range' => 'Die feste Zuordnung befindet sich im dynamischen Bereich', 'dhcp fixed lease err1' => 'Für eine feste Zuordnung müssen entweder die Hardware Adresse (MAC-Adresse) oder der Hostname oder beide eingetragen werden.', 'dhcp fixed lease help1' => 'IP Adressen können als FQDN angegeben werden.', 'dhcp make fixed lease' => 'Feste Zuordnung erzeugen', -- 2.39.2

2 1

[PATCH 1/2] fmt: Update to version 10.0.0
by Adolf Belka 31 Jul '23

31 Jul '23

- Update from version 9.1.0 to 10.0.0 - Update of rootfile - sobump so ran ./make find dependencies. This highlighted mpd but that needs to be updated anyway as the existing version does not build with fmt-10.0.0 - Changelog is too large to include here. See the file ChangeLog.rst in the source tarball Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/fmt | 4 ++-- lfs/fmt | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/packages/fmt b/config/rootfiles/packages/fmt index 49601ca2b..a1dffc8d6 100644 --- a/config/rootfiles/packages/fmt +++ b/config/rootfiles/packages/fmt @@ -18,6 +18,6 @@ #usr/lib/cmake/fmt/fmt-targets-release.cmake #usr/lib/cmake/fmt/fmt-targets.cmake #usr/lib/libfmt.so -usr/lib/libfmt.so.9 -usr/lib/libfmt.so.9.1.0 +usr/lib/libfmt.so.10 +usr/lib/libfmt.so.10.0.0 #usr/lib/pkgconfig/fmt.pc diff --git a/lfs/fmt b/lfs/fmt index 73da2cab5..21b481863 100644 --- a/lfs/fmt +++ b/lfs/fmt @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Open-source formatting library for C++ -VER = 9.1.0 +VER = 10.0.0 THISAPP = fmt-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = fmt -PAK_VER = 2 +PAK_VER = 3 SUP_ARCH = aarch64 x86_64 DEPS = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ff1daa43140615b63aeb1ecd0aa1c32d24decfd5006805080293ef3db04d544c0445a30e8da0d985a6f5a25ad48ce4f6ae61e52da5ea4a4d3b031c212da38b18 +$(DL_FILE)_BLAKE2 = 4e778fd352ed084b9790b59b4875fc6ed04b7a58a40b3673854dd00763f492cc838970e8faef77b5f9db5e912a2fc77943aedb4ca4afb64a3736129cc4611809 install : $(TARGET) -- 2.41.0

1 1

Two lfs PAK_VER increments for pmacct
by jon 31 Jul '23

31 Jul '23

Michael, I am not sure how much this matters but there are two PAK_VER increments for PROG pmacct. From July 6: https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=525e575e0463d9275904ec1… From July 31: https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=b1110eb1bd0d1ed0f40da0d… Jon Murphy jon.murphy(a)ipfire.org

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2023