Development March 2024

development@lists.ipfire.org

11 participants
55 discussions

[PATCH 1/2] inotify-tools: New package
by Stefan Schantl 28 Mar '24

28 Mar '24

This package is required for the grub-btrfs daemon Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/common/inotify-tools | 19 ++++++ lfs/inotify-tools | 83 +++++++++++++++++++++++++++ make.sh | 1 + 3 files changed, 103 insertions(+) create mode 100644 config/rootfiles/common/inotify-tools create mode 100644 lfs/inotify-tools diff --git a/config/rootfiles/common/inotify-tools b/config/rootfiles/common/inotify-tools new file mode 100644 index 000000000..f99d64c01 --- /dev/null +++ b/config/rootfiles/common/inotify-tools @@ -0,0 +1,19 @@ +usr/bin/fsnotifywait +usr/bin/fsnotifywatch +usr/bin/inotifywait +usr/bin/inotifywatch +#usr/include/inotifytools +#usr/include/inotifytools/fanotify-dfid-name.h +#usr/include/inotifytools/fanotify.h +#usr/include/inotifytools/inotify-nosys.h +#usr/include/inotifytools/inotify.h +#usr/include/inotifytools/inotifytools.h +#usr/lib/libinotifytools.a +#usr/lib/libinotifytools.la +#usr/lib/libinotifytools.so +usr/lib/libinotifytools.so.0 +usr/lib/libinotifytools.so.0.4.1 +#usr/share/man/man1/fsnotifywait.1 +#usr/share/man/man1/fsnotifywatch.1 +#usr/share/man/man1/inotifywait.1 +#usr/share/man/man1/inotifywatch.1 diff --git a/lfs/inotify-tools b/lfs/inotify-tools new file mode 100644 index 000000000..bb70fbfc6 --- /dev/null +++ b/lfs/inotify-tools @@ -0,0 +1,83 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 4.23.9.0 + +THISAPP = inotify-tools-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_BLAKE2 = eddb0e44721cd8674f2309046998de16a030ed9ad84c49bc5950b9362055db9242dc0de1c615c3bd6c1f2835c83fc55446c9f8e6da52a98870c53f4e6cfa31f9 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +b2 : $(subst %,%_BLAKE2,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, b2sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_BLAKE2,$(objects)) : + @$(B2SUM) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + $(UPDATE_AUTOMAKE) + cd $(DIR_APP) && ./autogen.sh + cd $(DIR_APP) && ./configure \ + --prefix=/usr + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 3c0b9ef27..1834b927a 100755 --- a/make.sh +++ b/make.sh @@ -1713,6 +1713,7 @@ buildipfire() { lfsmake2 mympd lfsmake2 wsdd lfsmake2 btrfs-progs + lfsmake2 inotify-tools # Kernelbuild ... current we have no platform that need # multi kernel builds so KCFG is empty -- 2.39.2

2 11

[PATCHv2 1/4] initscripts: Add generic function to get the filesystem type of a volume
by Stefan Schantl 28 Mar '24

28 Mar '24

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/system/functions | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/initscripts/system/functions b/src/initscripts/system/functions index 5a26aef45..b610143ab 100644 --- a/src/initscripts/system/functions +++ b/src/initscripts/system/functions @@ -883,3 +883,11 @@ running_on_oci() { # We are not running on OCI return 1 } + +volume_fs_type() { + if [ ! -d "${1}" ]; then + return + fi + + stat -f --format="%T" ${1} +} -- 2.39.2

2 7

[PATCH] perl-Archive-Tar: Update to 3.02
by Stefan Schantl 27 Mar '24

27 Mar '24

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- lfs/perl-Archive-Tar | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/perl-Archive-Tar b/lfs/perl-Archive-Tar index f66be599b..e07123a97 100644 --- a/lfs/perl-Archive-Tar +++ b/lfs/perl-Archive-Tar @@ -25,7 +25,7 @@ include Config -VER = 1.29 +VER = 3.02 THISAPP = Archive-Tar-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 31f2e5b6454b2b45ae93f9d7aad9011dffac67eb34399258687916f8e3ab84cf8ced891eb5a40acfdb9594501540442b34dbf230e0fccdbb6d5417329878038e +$(DL_FILE)_BLAKE2 = 424f9565d453e4ed2b84939c4aab16adc3fd0e354e0dc413368d91c7a7272597ea6154ee7d33f4bc7927aac4a749ae9775a2eeb6f189e54a32ba79e13647e7a9 install : $(TARGET) -- 2.39.2

1 0

Re: IPFire 2.29 - Core Update 185 is available for testing
by Adolf Belka 27 Mar '24

27 Mar '24

Hi All, I am having difficulty understanding something that is happening with the Core Update to 185. I added the following code into the update.sh script # Check if the drop hostile in and out logging options need to be added # into the optionsfw settings file and apply to firewall if ! [ $(grep "LOGDROPHOSTILEIN=on" /var/ipfire/optionsfw/settings) ] && \ ! [ $(grep "LOGDROPHOSTILEOUT=on" /var/ipfire/optionsfw/settings) ]; then sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings /usr/local/bin/firewallctrl fi If I do an update with a Core Update 183 version that has the LOGDROPHOSTILEIN and LOGDROPHOSTILEOUT entries in optionsfw/settings missing then the update adds in the two lines shown. So working correctly. However if the Core Update 183 has the two entries already in the optionsfw/settings file then the above code ends up with two more copies of each put into the file as following. FWPOLICY=DROP SHOWTABLES=on DROPPROXY=off LOGDROPHOSTILEIN=on LOGDROPHOSTILEOUT=on LOGDROPHOSTILEIN=on LOGDROPHOSTILEOUT=on However if I take a vm with optionsfw/settings containing the two entries already and run the update code shown above manually via a script on the vm then it does not add any extra lines in. If the vm has the two entries missing and I run the script manually then it adds in one entry for each. So I do not understand at all why the code I put into the update.sh file 1) Does not recognise that the entries already exist in the settings file. 2) Then prints the entries twice. when it is run in the update.sh via an upgrade. Any help with understanding what is going wrong with the code I wrote would be very much appreciated. Regards, Adolf. On 25/03/2024 10:15, IPFire Project wrote: > This update is another testing version for IPFire: It comes with the brand release of the IPFire IPS, a number of bug fixes across the entire system and a good amount of package updates. Test it while it's still hot! > ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ > > > IPFire_ > > > IPFire 2.29 - Core Update 185 is available for testing > > This update is another testing version for IPFire: It comes with the brand release of the IPFire IPS, a number of bug fixes across the entire system and a good amount of package updates. Test it while it's still hot! > > Read The Full Post On Our Blog <https://www.ipfire.org/blog/ipfire-2-29-core-update-185-is-available-for-te…> > > The IPFire Project, c/o Lightning Wire Labs GmbH, Gerhardstraße 8, 45711 Datteln, Germany > > Unsubscribe <https://www.ipfire.org/unsubscribe> >

3 11

Stop unbound-dhcp-leases-bridge from continually restarting unbound
by Nick Howitt 26 Mar '24

26 Mar '24

Hi all, Please bear with me as I am new to IPFire and not at all used to this style of development, so any guidance would be appreciated. There is a bug, https://bugzilla.ipfire.org/show_bug.cgi?id=13254, where unbound-dhcp-leases-bridge restarts unbound a lot when it is totally unnecessary. It appears to be because when a lease is renewed, the script gets triggered, created a new /etc/unbound/dhcp-leases.conf then restarts Unbound to read the file. Generally this seems to be unnecessary as, with a renewed lease, the old and new /etc/unbound/dhcp-leases.conf files are the same. With 5 leases in that file (one for a machine not active) I am getting 3-4 restarts an hour of Unbound when I have a min/max lease time of 60/120min. Looking at the code, it is fairly easy to fix. The current code creates a temp file then copies it into place then restarts unbound. All I am doing is doing a file comparison before the copy and skipping the restart if the files are the same. There were a couple of gotchas because setting the file attributes and copying the file were done inside the "with" block for generating the temporary file. This meant a file comparison always returned False as the temp file was still open and so never the same is the old file. I moved those two statements outside the "with". This forced me to change the fchmod to chmod. It could be argued that the file copy should not be done if the files are not different, but it would take an extra "if" and you'd have to remember to delete the temp file. If required, I can make that change. Also, one small thing I noticed once is that the old and new dhcp-leases.conf files could occasionally contain the same leases but in a different order. I have been unable to reproduce, but to sidestep it, instead of stepping through the leases variable directly, I sort it and step through that. It should make the resulting file completely deterministic and make the file comparison more effective. My patch is: From 73873d4944944a2f02317a73074a6894726f36f7 Mon Sep 17 00:00:00 2001 From: Nick Howitt <nick(a)howitts.co.uk> Date: Sun, 24 Mar 2024 15:17:19 +0000 Subject: [PATCH] Stop unbound-dhcp-leases-bridge from restarting unbound every time it write dhcp-leases.conf as it is very often unchanged and does not require a restart. --- config/unbound/unbound-dhcp-leases-bridge | 28 +++++++++++++++-------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/config/unbound/unbound-dhcp-leases-bridge b/config/unbound/unbound-dhcp-leases-bridge index e9f022aff..d22772066 100644 --- a/config/unbound/unbound-dhcp-leases-bridge +++ b/config/unbound/unbound-dhcp-leases-bridge @@ -22,6 +22,7 @@ import argparse import datetime import daemon +import filecmp import functools import ipaddress import logging @@ -516,26 +517,35 @@ class UnboundConfigWriter(object): def update_dhcp_leases(self, leases): # Write out all leases - self.write_dhcp_leases(leases) + if self.write_dhcp_leases(leases): - log.debug("Reloading Unbound...") + log.debug("Reloading Unbound...") - # Reload the configuration without dropping the cache - self._control("reload_keep_cache") + # Reload the configuration without dropping the cache + self._control("reload_keep_cache") + + else: + + log.debug("Not reloading Unbound. Leases not changed.") def write_dhcp_leases(self, leases): log.debug("Writing DHCP leases...") with tempfile.NamedTemporaryFile(mode="w", delete=False) as f: - for l in leases: + for l in sorted(leases): for rr in l.rrset: f.write("local-data: \"%s\"\n" % " ".join(rr)) - # Make file readable for everyone - os.fchmod(f.fileno(), stat.S_IRUSR|stat.S_IWUSR|stat.S_IRGRP|stat.S_IROTH) + filecmp.clear_cache() + RequireUnboundReload = not filecmp.cmp(f.name, self.path, shallow=False) + + # Make file readable for everyone + os.chmod(f.name, stat.S_IRUSR|stat.S_IWUSR|stat.S_IRGRP|stat.S_IROTH) + + # Move the file to its destination + os.rename(f.name, self.path) - # Move the file to its destination - os.rename(f.name, self.path) + return RequireUnboundReload def _control(self, *args): command = ["unbound-control"] -- 2.43.0 I have this locally on a branch on my firewall. If it is OK, do I need some sort of rights to push my branch and then how I get it merged? Regards, Nick

3 5

[PATCH] shadow: Update login.defs to remove reference to cracklib
by Adolf Belka 26 Mar '24

26 Mar '24

- From shadow-15.0.0 all references to cracklib were removed from shadow. Apparently some functions were no longer accessible and the shadow team decided to remove cracklib references completely. This was not mentioned in the changelkog for 15.0.0 - This resulkts in gettinbg the message configuration error - unknown item 'CRACKKLIB_DICTPATH' ( notify administrator ) when logging in to the console. - The login to the console occurs successfully so the message is only a warning that cracklib is no longer used. - IPfire does not use cracklkib anyway so this patch removes the section referring to cracklib from the login.defs configuration file. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/shadow/login.defs | 5 ----- 1 file changed, 5 deletions(-) diff --git a/config/shadow/login.defs b/config/shadow/login.defs index a9559d6c4..2662a62cc 100644 --- a/config/shadow/login.defs +++ b/config/shadow/login.defs @@ -175,11 +175,6 @@ PASS_WARN_AGE 7 # SU_WHEEL_ONLY no -# -# If compiled with cracklib support, sets the path to the dictionaries -# -CRACKLIB_DICTPATH /var/cache/cracklib/cracklib_dict - # # Min/max values for automatic uid selection in useradd(8) # -- 2.44.0

2 1

[PATCH v2] CU185-update.sh: Add drop hostile in & out logging entries if not already present
by Adolf Belka 25 Mar '24

25 Mar '24

- This v2 patch corrects that the previous script was looking for =on. If a user had modified the preferences to change it to =off then the script would have resulted in both =on and =off versions being in the settings file. - This patch ensures that those people who updated to CU184 before the CU184-update.sh patch fix to add the logging entries was added will get their optionsfw settings file correctly updated with CU185 - This only adds the LOGDROPHOSTILEIN & LOGDROPHOSTILEOUT entries if they do not already exist in the optionsfw settings file. - This change also does the check for LOGDROPHOSTILEIN and LOGDROPHOSTILEOUT as two separate checks and then runs the firewall update command Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/core/185/update.sh | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/core/185/update.sh b/config/rootfiles/core/185/update.sh index ec4d8ab82..002f92bbb 100644 --- a/config/rootfiles/core/185/update.sh +++ b/config/rootfiles/core/185/update.sh @@ -117,11 +117,17 @@ chown nobody:nobody /var/ipfire/ovpn/ovpnconfig # Check if the drop hostile in and out logging options need to be added # into the optionsfw settings file and apply to firewall -if ! [ $(grep "LOGDROPHOSTILEIN=on" /var/ipfire/optionsfw/settings) ] && \ - ! [ $(grep "LOGDROPHOSTILEOUT=on" /var/ipfire/optionsfw/settings) ]; then - sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings - sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings - /usr/local/bin/firewallctrl +optionsfw="" +if ! [ $(grep "^LOGDROPHOSTILEIN=" /var/ipfire/optionsfw/settings) ]; then + sed -i '$ a\LOGDROPHOSTILEIN=on' /var/ipfire/optionsfw/settings + optionsfw="updated" +fi +if ! [ $(grep "^LOGDROPHOSTILEOUT=" /var/ipfire/optionsfw/settings) ]; then + sed -i '$ a\LOGDROPHOSTILEOUT=on' /var/ipfire/optionsfw/settings + optionsfw="updated" +fi +if ! [ -z "$optionsfw" ]; then + /usr/local/bin/firewallctrl fi # Rebuild initial ramdisks -- 2.44.0

1 0

Re: IPFire 2.29 - Core Update 185 is available for testing
by Adolf Belka 25 Mar '24

25 Mar '24

Hi Michael, First issue found. Due to a boo-boo made by me related to wsdd. I had submitted what I thought was a patch set for the samba initscript together with an update of the samba lfs file to add wsdd as a dependency. Unfortunately it turned out I had provided a single patch with both changes in the same patch You raised the question about not having the samba initscript calling the wsdd initscript. I updated that script and submitted it but thought the change of adding the wsdd as a dependency had been merged so did not send a v2 of that change. So wsdd is not getting installed when samba is being updated. I will submit a new patch for the samba lfs update to add wsdd as a dependency. Regards, Adolf. On 25/03/2024 10:15, IPFire Project wrote: > This update is another testing version for IPFire: It comes with the brand release of the IPFire IPS, a number of bug fixes across the entire system and a good amount of package updates. Test it while it's still hot! > ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ > > > IPFire_ > > > IPFire 2.29 - Core Update 185 is available for testing > > This update is another testing version for IPFire: It comes with the brand release of the IPFire IPS, a number of bug fixes across the entire system and a good amount of package updates. Test it while it's still hot! > > Read The Full Post On Our Blog <https://www.ipfire.org/blog/ipfire-2-29-core-update-185-is-available-for-te…> > > The IPFire Project, c/o Lightning Wire Labs GmbH, Gerhardstraße 8, 45711 Datteln, Germany > > Unsubscribe <https://www.ipfire.org/unsubscribe> >

2 2

[PATCH 00/17] BTRFS support on IPFire 2.x (experimental)
by Stefan Schantl 25 Mar '24

25 Mar '24

Hello mailinglist followers, this first patchset will introduce basic BTRFS support in IPFire 2.x. It allows to choose BTRFS during installation as filesystem, will install IPFire and bring it up as usual. The main difference to the other file system will be displayed when showing the current mounted filesystems. When using BTRFS a lot of so called subvolumes will be created. They act as some kind of logical partition and are needed in two cases. This kind of fragmentation allows to create snapshots of such a subvolume and only the stored data on it. The more important reason of using subvolumes is, that while creating a snapshot any files which are located on a different subvolume will not be part of it. So, when creating a snaphot of the filesystem root and restoring it back later, no files which are part of a subvolume (logfile, database files etc) are rolled-back. This helps us debugging because the old logs are still there and mostly important prevents from data lost of altered databases or newly created files! Currently there is still some work to do see: Wiki-Roadmap: https://www.ipfire.org/docs/roadmap/btrfs Bugzilla: https://bugzilla.ipfire.org/show_bug.cgi?id=13606 Stefan Schantl (17): btrfs-progs: New package installer: Allow to install IPFire on BTRFS installer: Ensure to always create the /boot directory. installer: Disable seperate boot partition installer: Add code to create a BTRFS subvolume layout. installer: Correctly umount main BTRFS partition. installer: Add recurisve mkdir function installer: Mount BTRFS layout before installing the system installer: Add /var/tmp to the BTRFS layout installer: Fix using BTRFS mount options when mounting the layout installer: Add code to proper unmount the BTRFS layout installer: Add code to correctly write the fstab when installing on BTRFS installer: Define common mount options for BTRFS volumes inotify-tools: New package grub-btrfs: New package installer: Mark BTRFS support as experimental installer: Adjust BTRFS layout config/rootfiles/common/btrfs-progs | 33 +++ config/rootfiles/common/grub-btrfs | 14 ++ config/rootfiles/common/inotify-tools | 19 ++ config/rootfiles/common/x86_64/initscripts | 4 + lfs/btrfs-progs | 85 ++++++++ lfs/grub-btrfs | 79 +++++++ lfs/initscripts | 3 + lfs/inotify-tools | 83 ++++++++ make.sh | 3 + src/initscripts/system/grub-btrfsd | 61 ++++++ src/installer/dracut-module/module-setup.sh | 4 +- src/installer/hw.c | 221 +++++++++++++++++++- src/installer/hw.h | 8 + src/installer/main.c | 1 + 14 files changed, 606 insertions(+), 12 deletions(-) create mode 100644 config/rootfiles/common/btrfs-progs create mode 100644 config/rootfiles/common/grub-btrfs create mode 100644 config/rootfiles/common/inotify-tools create mode 100644 lfs/btrfs-progs create mode 100644 lfs/grub-btrfs create mode 100644 lfs/inotify-tools create mode 100644 src/initscripts/system/grub-btrfsd -- 2.39.2

2 35

[PATCH] samba: Add wsdd as a dependency to samba
by Adolf Belka 25 Mar '24

25 Mar '24

- Add wsdd as a dependency to samba so it will be installed together with samba Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/samba | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/samba b/lfs/samba index 76088abfa..df7811313 100644 --- a/lfs/samba +++ b/lfs/samba @@ -33,9 +33,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 99 +PAK_VER = 100 -DEPS = avahi cups perl-Parse-Yapp perl-JSON +DEPS = avahi cups perl-Parse-Yapp perl-JSON wsdd SERVICES = samba -- 2.44.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2024