Development May 2024

development@lists.ipfire.org

11 participants
32 discussions

Re: IPFire 2.27 - Core Update 164 is available for testing
by Adolf Belka 28 May '24

28 May '24

Hi All, Just tested out CU164 on my vm testbed system. The update went without any problems. You see the pakfire log status again on the wui page during the update. OpenVPN RW setup ran without any issues. Connection successfully made. IPS has the multiple providers option successfully in place. I eventually found the Force Update of rules button, which was very useful for my vm testbed as it is not running all the time and so the rules were a bit out of date. As far as I can tell everything is working fine on it. No issues detected. I will let it run over the next few days during the daytime and see how things go. Regards, Adolf. On 20/02/2022 18:35, IPFire Project wrote: > IPFire Logo > > there is a new post from Michael Tremer on the IPFire Blog: > > *IPFire 2.27 - Core Update 164 is available for testing* > > It is time to test another release for IPFire: IPFire 2.27 - Core Update 164. It comes with a vastly improved firewall engine, a new kernel and various security and bug fixes. Please help us testing this release and if you would like to support us, please donate. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-164-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

4 8

[PATCH] ntp: Update to 4.2.8p18
by Matthias Fischer 27 May '24

27 May '24

Changelog is too long to be published here, for details see: https://downloads.nwtime.org/ntp/ChangeLog-stable Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/ntp | 3 +-- lfs/ntp | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/ntp b/config/rootfiles/common/ntp index fd1262e9b..7ca3ed1e7 100644 --- a/config/rootfiles/common/ntp +++ b/config/rootfiles/common/ntp @@ -10,7 +10,6 @@ usr/bin/ntpd usr/bin/ntpdate usr/bin/ntpdc usr/bin/ntpq -#usr/bin/ntpsnmpd usr/bin/ntptime usr/bin/ntptrace usr/bin/sntp @@ -18,6 +17,7 @@ usr/bin/tickadj usr/bin/update-leap #usr/share/doc/ntp #usr/share/doc/ntp/html +#usr/share/doc/ntp/html/.datecheck #usr/share/doc/ntp/html/access.html #usr/share/doc/ntp/html/accopt.html #usr/share/doc/ntp/html/assoc.html @@ -277,7 +277,6 @@ usr/bin/update-leap #usr/share/man/man1/ntpdc.1 #usr/share/man/man1/ntpq.1 #usr/share/man/man1/ntptrace.1 -#usr/share/man/man1/ntpsnmpd.1 #usr/share/man/man1/sntp.1 #usr/share/man/man1/update-leap.1 #usr/share/man/man5/ntp.conf.5 diff --git a/lfs/ntp b/lfs/ntp index aadfbd0c1..2d746c78f 100644 --- a/lfs/ntp +++ b/lfs/ntp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.2.8p17 +VER = 4.2.8p18 THISAPP = ntp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5c0e90a234cdeab76e7443b42dfd5a0c3c78693a11bdb0fa21c8def91adbdf9b9871498df9d211509632812a9107501da3470104122e9621577541ffd6cd1ab6 +$(DL_FILE)_BLAKE2 = 9a7bb767d2d8ae3a7224542df7978f8289cbdf28488c5e4dce4c549cdd1063259f69548898a352c0463ce83c4725bfd7c7dbf673ee3b74e490d7b1275760497c install : $(TARGET) -- 2.34.1

2 1

[PATCH 1/2] make.sh: Bump the toolchain version
by Michael Tremer 23 May '24

23 May '24

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- make.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make.sh b/make.sh index a4ba09326..490d376eb 100755 --- a/make.sh +++ b/make.sh @@ -35,7 +35,7 @@ GIT_BRANCH="$(git rev-parse --abbrev-ref HEAD)" # Git Branch GIT_TAG="$(git tag | tail -1)" # Git Tag GIT_LASTCOMMIT="$(git rev-parse --verify HEAD)" # Last commit -TOOLCHAINVER=20240210 +TOOLCHAINVER=20240521 # use multicore and max compression ZSTD_OPT="-T0 --ultra -22" -- 2.39.2

1 1

[PATCH] lzip: Update to version 1.24.1
by Adolf Belka 23 May '24

23 May '24

- Update from version 1.24 to 1.24.1 - Update of rootfile not required - Changelog 1.24.1 main.cc: Fix compilation failure on MinGW because of mkdir. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/lzip | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/lzip b/lfs/lzip index 5e7da457f..5d67be6f5 100644 --- a/lfs/lzip +++ b/lfs/lzip @@ -24,7 +24,7 @@ include Config -VER = 1.24 +VER = 1.24.1 THISAPP = lzip-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ef6b7b51e7369b7b07ca2d5bbdd57a287f3a96866f50b327237a35ce9a4d19b2e3f7586a099ff4191c3c793de2dfe59120a42b8d744e220c4f7652d049df87f5 +$(DL_FILE)_BLAKE2 = b387577087af5596ea49af16c44e1dfc11f78cbcc1031fc480a4e7ef1a01f4d8fb35c03d8cbeb7f6feb51e427708b1ed0f9a160e80ff938555ea3cf34f28be7c install : $(TARGET) -- 2.44.0

2 17

[PATCH] cpio: Update to version 2.15
by Adolf Belka 23 May '24

23 May '24

- Updatre from version 2.14 to 2.15 - Update of rootfile - Changelog 2.15 * Fix operation of --no-absolute-filenames --make-directories * Restore access and modification times of symlinks in copy-in and copy-pass modes. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/cpio | 1 + lfs/cpio | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/cpio b/config/rootfiles/common/cpio index 7b9bae045..0f3403c7b 100644 --- a/config/rootfiles/common/cpio +++ b/config/rootfiles/common/cpio @@ -1,5 +1,6 @@ bin/cpio #usr/share/info/cpio.info +#usr/share/locale/bg/LC_MESSAGES/cpio.mo #usr/share/locale/da/LC_MESSAGES/cpio.mo #usr/share/locale/de/LC_MESSAGES/cpio.mo #usr/share/locale/es/LC_MESSAGES/cpio.mo diff --git a/lfs/cpio b/lfs/cpio index f44fe1d2c..b8b6e12fe 100644 --- a/lfs/cpio +++ b/lfs/cpio @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.14 +VER = 2.15 THISAPP = cpio-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = ddfecf7e3ff59cb15fa0856d374a8b1ff5aaf9143a940202c6c0eb84f0347b940a40e31258035e1d217fe210ef7ffdedb41e40f3a9d47ba51f44626378090f8a +$(DL_FILE)_BLAKE2 = e678111682335f4218d6d0e27d7e3a81b1e9c87ad5963402f73e735265480f296a8ce4fd00a4e7f591bbc7affcb3d433675c1df2d59c23e5d4ed6ba03e2964b8 install : $(TARGET) -- 2.44.0

2 13

Re-shipping binaries due to _FORTIFY_SOURCE=3
by Peter Müller 21 May '24

21 May '24

Hello *, while trying to figure out the odd Suricata and kernel behavior with Core Update 186 I encountered the other day, I noted that cecad543cb59d0e052cea437cc064bb0924cdbd2 mentions that having properly applied the _FORTIFY_SOURCE=3 change entails that we re-ship "everything" (I assume that means every executable binary :-) ). It seems like we didn't do so ever since this commit was merged into next, and while doing so in one go is not possible, I was wondering if we perhaps want to re-ship the most critical parts, such as binaries of services directly exposed to the network, the glibc, and similar components. Just a thought that occurred to me. Thanks, and best regards, Peter Müller

2 1

[PATCH] header.pl: Fix parsing BOOTP leases
by Michael Tremer 20 May '24

20 May '24

If the lease has been handed out over BOOTP, it will never expire. However, the parser did not account for this case at all which is fixed in this patch. Fixes: #13689 - BOOTP breaks the list of DHCP leases due to erroneous parsing Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/cfgroot/header.pl | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl index 5164e9731..a67ff92ee 100644 --- a/config/cfgroot/header.pl +++ b/config/cfgroot/header.pl @@ -454,12 +454,16 @@ END $hostname = ""; } - if ($line =~ /^\s*ends/) { - $line =~ /(\d+)\/(\d+)\/(\d+) (\d+):(\d+):(\d+)/; + if ($line =~ /^\s*ends \d (\d+)\/(\d+)\/(\d+) (\d+):(\d+):(\d+)/) { $endtime = timegm($6, $5, $4, $3, $2 - 1, $1 - 1900); ($sec, $min, $hour, $mday, $mon, $year, $wday, $yday, $dst) = localtime($endtime); $endtime_print = sprintf ("%02d/%02d/%d %02d:%02d:%02d",$mday,$mon+1,$year+1900,$hour,$min,$sec); $expired = $endtime < time(); + + } elsif ($line =~ /^\s*ends never/) { + $endtime = 0; + $endtime_print = $Lang::tr{'never'}; + $expired = 0; } if ($line =~ /^\s*hardware ethernet/) { -- 2.39.2

2 1

Updates to u-boot script for Raspberry Pi 4b devices
by Craig Setera 17 May '24

17 May '24

Updates to u-boot script for Raspberry Pi 4b devices to properly configure the serial console and to choose the proper boot address to be used on newer board revisions. With these changes in place, I'm able to fully boot into a serial console in u-boot. The serial console configuration was derived from the Grub configuration, while the boot address changes were taken from the IPFire Raspberry 4b documentation page: https://www.ipfire.org/docs/hardware/arm/rpi/four Per the conversation in the forums, I don't know why the boot address changes are required. I was simply trying to automate those changes such that downloaded builds will work out of the box. https://community.ipfire.org/t/hang-with-kernel-starting-on-raspberry-pi/11… NOTE: The use of the different parameter options to the test command to minimize the need for deeply nested conditionals. I did try more bash-shell like syntax, but u-boot didn't seem to like that. The operators used here were found in the u-boot source. Tested-by: Craig Setera <craigjunk(a)setera.org> Signed-off-by: Craig Setera <craigjunk(a)setera.org> --- config/u-boot/boot.cmd | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/config/u-boot/boot.cmd b/config/u-boot/boot.cmd index a27996780..eedd5776d 100644 --- a/config/u-boot/boot.cmd +++ b/config/u-boot/boot.cmd @@-51,7 +51,11 @@if test "${SERIAL-CONSOLE}" = "ON"; then if test "${fdtfile}" = "broadcom/bcm2837-rpi-3-b.dtb"; then setenv console ttyS1,115200n8; else -setenv console ttyAMA0,115200n8; +if test "${fdtfile}" = "broadcom/bcm2711-rpi-4-b.dtb"; then +setenv console ttyS0,115200n8; +else +setenv console ttyAMA0,115200n8; +fi; fi; fi; else @@-95,11 +99,28 @@else setenv ramdisk_addr -; fi; +# +# Handle Raspberry Pi 4 address differences +# https://www.ipfire.org/docs/hardware/arm/rpi/four +# +setenv booti_fdt_addr ${fdt_addr_r}; +if test "${board}" -eq "rpi" -a ${cpu} -eq "armv8" -a "${fdtfile}" -eq "broadcom/bcm2711-rpi-4-b.dtb"; then +# Hardware revision 1.4 +if test ${board_revision} -eq 0xB03114 -o ${board_revision} -eq 0xC03114 -o ${board_revision} -eq 0xD03114; then +setenv booti_fdt_addr ${fdt_addr}; +fi + +# Hardware revision 1.5 +if test ${board_revision} -eq 0xB03115 -o ${board_revision} -eq 0xC03115 -o ${board_revision} -eq 0xD03115; then +setenv booti_fdt_addr ${fdt_addr}; +fi +fi; + bootz ${kernel_addr_r} ${ramdisk_addr} ${fdt_addr_r}; -booti ${kernel_addr_r} ${ramdisk_addr} ${fdt_addr_r}; +booti ${kernel_addr_r} ${ramdisk_addr} ${booti_fdt_addr}; bootz ${kernel_addr_r} - ${fdt_addr_r}; -booti ${kernel_addr_r} - ${fdt_addr_r}; +booti ${kernel_addr_r} - ${booti_fdt_addr}; # Recompile with: # mkimage -C none -A arm -T script -d /boot/boot.cmd /boot/boot.scr -- 2.40.1

3 5

[PATCH] intel-microcode: Update to version 20240514
by Adolf Belka 16 May '24

16 May '24

- Update from version 20240312 to 20240514 - Update of rootfile not required. - For the changelog details see the releasenote.md file in the source tarball. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/intel-microcode | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/intel-microcode b/lfs/intel-microcode index 785b2303b..a1f7d6737 100644 --- a/lfs/intel-microcode +++ b/lfs/intel-microcode @@ -24,7 +24,7 @@ include Config -VER = 20240312 +VER = 20240514 THISAPP = Intel-Linux-Processor-Microcode-Data-Files-microcode-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 43c771becef0f6dbfd41bf78a9a3cc8f6679a43ea48765d0e7f555c138dca6e3db42a4d33f743d8d51f38b0b6aa69322bba0c00ae9f1ff4c533b52166ee54747 +$(DL_FILE)_BLAKE2 = 2a3a357ecf8d9f17fd20cd651386e5687fbbca8a3a323caf846e7c84d440241c3c99cadd00016642c8d11f297c1d2ab63c54ea062644839b74f84d66b04c703e install : $(TARGET) -- 2.44.0

2 1

Re: New Mirror in Singapore - 10GBPS
by Karibu - Freedif.org 15 May '24

15 May '24

Thank you I have changed to sync current only instead of all. For the routing, I'll explore again with them. Thank you Kari -- Sent with Tutanota 14 May 2024, 23:59 by michael.tremer(a)ipfire.org: > Hello, > > I have added the mirror: https://www.ipfire.org/downloads/mirrors > >> On 14 May 2024, at 14:24, Karibu - Freedif.org <karibu(a)freedif.org> wrote: >> >> Hello Michael, >> >> I could do the needed. >> 1) freedif.org is now having a simple page to present the server and redirect to github that I've started to use to ease the interactions with the community >> 2) The server is synced with rsync.ipfire.org::full and is up and running >> > > It is totally sufficient to mirror the “current” repository as the other data is not going to be downloaded by any clients. > >> 3) I could contact my ISP and as I have static IP / pro option, they are able to adjust some routing. >> Traceroute is giving me a more direct route now (Singapore, then Netherland, then Germany) and I'm asking them to better tweak for Germany. >> >> traceroute to rsync.ipfire.org (81.3.27.38), 30 hops max, 60 byte packets >> SG 1 _gateway (192.168.0.1) 0.474 ms 0.496 ms 0.536 ms >> SG 2 * * * >> SG 3 103-6-148-37.myrepublic.com.sg (103.6.148.37) 2.289 ms 2.268 ms 1.747 ms >> SG 4 103-6-148-13.myrepublic.com.sg (103.6.148.13) 2.268 ms 2.280 ms 2.212 ms >> SG 5 203.116.31.145 (203.116.31.145) 3.169 ms 3.152 ms 3.145 ms >> SG 6 203.118.6.125 (203.118.6.125) 3.613 ms 2.516 ms 203.116.3-77.unknown.starhub.net.sg (203.116.3.77) 3.073 ms >> SG 7 203.118.6.254 (203.118.6.254) 4.046 ms 203.118.6.190 (203.118.6.190) 3.515 ms 203.118.6.254 (203.118.6.254) 3.985 ms >> SG 8 203.118.3.74 (203.118.3.74) 2.982 ms 2.943 ms 2.924 ms >> 9 * * * >> NL 10 ae1.irt1.ams01.nl.as13237.net (82.197.136.22) 635.604 ms 644.607 ms 635.077 ms >> DE 11 * * ae1.irt1.dus03.de.as13237.net (82.197.128.21) 298.806 ms >> DE 12 ae9.irt1.han87.de.as13237.net (217.71.105.158) 444.250 ms 420.868 ms 430.338 ms >> DE 13 217.71.99.93 (217.71.99.93) 400.743 ms 408.245 ms * >> DE 14 fr4a.h.as24679.net (195.47.229.54) 304.510 ms 304.819 ms 312.792 ms >> > > Nothing has changed for me. > >> Do let me know if you require any other information >> Thank you >> Kari >> -- >> Sent with Tutanota >> >> >> >> May 8, 2024, 04:58 by michael.tremer(a)ipfire.org: >> Hello Kari, >> >> Thank you for offering a mirror, but as far as I can see, this is not entirely fit for our purposes: >> >> * First of all, there is no page that describes who is hosting this mirror. There is only a default page of Apache running on Debian on http://freedif.org/. Who is Karibu? >> >> * This mirror seems to be hosted on a residential internet connection at https://myrepublic.net/sg/. It seems to have rather poor peering as traffic from Europe is being routed all the way through the US, Japan and Hong Kong. Some other IP addresses that I have tested go a more direct route so that I am assuming that routing from other places in the world isn’t great either. >> >> Are these things that you can fix? >> >> -Michael >> On 3 May 2024, at 15:25, Karibu - Freedif.org <karibu(a)freedif.org> wrote: >> >> >> Hello, >> I’m the admin of the mirror freedif.org 5 and we would like to support ipfire project. >> I’ve synced and ready to support the project. >> >> Will it be possible to be added to the pool of mirror please? >> >> Location: Singapore >> Bandwidth: 10GBPS >> Admin: Karibu >> URL: https://mirror.freedif.org/ipfire/ (or HTTP) >> >> Let me know if you need further information >> Thanks >> Kari >> -- >> Sent with Tutanota >>

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development May 2024