Development

development@lists.ipfire.org

7 participants
6311 discussions

IPFire2 thirteen won't install
by Daniel Weismüller 31 Aug '12

31 Aug '12

Hi I've tested the new thirteen and can't install it. Wheather in Virtualbox nor on a native machine. The installationprocedure don't find an HDD for installation. In my opinion the error lies in the script /bin/mountdest.sh If I edit the line 26 and remove "-or -name vd*" the script works fine and the installtionprocedure won't crash. - Daniel -- __________________________________________ You need a firewall? Easy to use? Powerful? Modular? For free? www.ipfire.org An Open Source Firewall Solution

2 1

IPFire and FireFilter (aka Copfilter)
by Erik K. 25 Aug '12

25 Aug '12

Hi all, i have found the latest news on the planet from Michael --> http://planet.ipfire.org/post/ipfire-and-firefilter-aka-copfilter and i think this is a great idea. This supplement fills up a gap in IPFire. I hope the Copfilter developers are joining the IPFire project to release their good work also for this platform. Also i have seen in the last time a lot of people coming from IPCop to IPFire Forum and they was asking for additional solutions like Copfilter for IPFire. There is a survey in the Copfilter forum for this idea, so may a similar thread in the IPFire forum can be also a good idea. What do you think about this ? Greetings Erik

1 0

New toolchain release available
by Michael Tremer 24 Aug '12

24 Aug '12

Hey, I just wanted to inform you that the new toolchains with the new compiler and glibc have been uploaded. Content: * GCC 4.4.7 * binutils 2.22 * glibc 2.12 This is for use with the glibc-update2 branch. http://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=shortlog;h=refs/heads/g… 42.6M http://source.ipfire.org/toolchains/ipfire-2.11-toolchain-5-i586.tar.gz 45.1M http://source.ipfire.org/toolchains/ipfire-2.11-toolchain-5-armv5tel.tar.gz Michael

1 0

Dropping versatile kernel
by Michael Tremer 13 Aug '12

13 Aug '12

Hi Arne, you just dropped the Linux kernel which was compiled for ARM Versatile from IPFire 2.x: http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=c94c1fa5574230d9edbe… The reasons are that there is no use for it except virtual environments with QEMU. However, these are very slow and pretty much unusable. Do you think there are any other reasons to keep the versatile kernel in IPFire 3? I guess we could drop it, too. A benefit would be a massive increase in build time of the kernels for ARMv5tel which is more than 8 hours on Pandaboard. Michael

2 2

Re: SECURITY ADVISORY: outgoing firewall accepts packets unintendedly
by Michael Tremer 12 Aug '12

12 Aug '12

Removed that unused variable. http://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=commitdiff;h=4e2bce1804… On Thu, 2012-08-09 at 11:58 +0200, Bernhard Bitsch wrote: > Why are there settings for chain policy? They are not used and cannot be set by > a iptables command, but would be useful.

1 0

Re: Re: [Development] Strongswan 5.0.0
by Mieszko Ślusarczyk 07 Aug '12

07 Aug '12

Here is working config for iOS devices (iPhone, iPod Touch, iPad). refer to the article; http://wiki.ipfire.org/de/configuration/services/ipsec/ios /etc/ipsec.user.conf is little different ("rightsubnet=vhost:%no,%priv" should be replaced with rightsubnet=<normal ip notation for subnet (like 10.0.0.0/24)>) Also "pfs=no" parameter is useless (but harmless to keep) I removed "leftfirewall=yes" as well Complete /etc/ipsec.user.conf (replace stuff in <> brackets): conn <conectionname> keyexchange=ikev1 authby=xauthrsasig xauth=server left=<ipfire fqdn> leftsubnet=0.0.0.0/0 leftcert=/var/ipfire/certs/hostcert.pem right=%any rightsubnet=<subnet for ipsec vpn(different than green, blue, orange or openvpn subnet; for example:10.0.0.0/24)> rightsourceip=<internal ip address(not in green, blue, orange or openvpn subnet; for example: 10.0.0.11/24)> rightcert=/var/ipfire/certs/<conectionname>cert.pem auto=add lefthostaccess=yes compress = yes -- Mieszko Ślusarczyk Sent with Sparrow (http://www.sparrowmailapp.com/?sig)

1 0

[Development] Strongswan 5.0.0
by Michael Tremer 07 Aug '12

07 Aug '12

Hello, as Core Update 61 has now been released, it is time to go on with developments for the next one: I have updated strongswan to version 5.0.0 which finally removes the pluto daemon which was responsible for IKEv1 connections. However, pluto has gotten very old and was created in the beginnings of the IPsec for Linux developments back in freeswan times. charon was introduced by strongswan some time ago when IKEv2 connections got supported. It handles IKEv1 connections as well as IKEv2 connections since strongswan version 5.0.0. What are the benefits for IPFire? As mentioned earlier, pluto is very old and got very hard to maintain. There have been problems with VPNs that terminate at hosts with dynamic IP addresses, so we needed to restart the entire IPsec subsystem in intervals of 5 minutes. This caused some trouble in stability terms. charon handles those dynamic endpoints much better without the need to restart anything. Connections may now be added and removed smoothly and in total there should be much more connection stability. There is also some new code for hybrid IPsec VPNs which can be used with Android 4 and maybe Apple iOS. I have not done any investigation on this topic, because I am not interested, but hopefully somebody else gives it a shot. I have now packaged the changes into a small package which wants to be installed on your system. http://people.ipfire.org/~ms/unsupported/core-upgrade-2.11-strongswan.ipfire It should not require any manual interaction at all. Please install and give me feedback about the connection stability and the interoperability with other (proprietary) implementations. I am looking forward to it. Michael P.S. If you reply to this mail make sure to keep both mailing lists.

2 6

SECURITY ADVISORY: outgoing firewall accepts packets unintendedly
by Michael Tremer 07 Aug '12

07 Aug '12

Hello, there is a problem in the outgoing firewall if it is used in mode 1. Packets are accepted from blue even if there is no rule for the MAC address of the sender. This problem has got a medium severity and does not affect any other configuration of the outgoing firewall and does not occur when no blue network interface exists. There is a fix available: http://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=commitdiff;h=78a14abf81… Please install and test. I am not going to repeat this request anymore. Michael

1 0

[Development] Strongswan 5.0.0
by Erik K. 07 Aug '12

07 Aug '12

> Hi all, > i have tried that and after a > > [root@ipfire-server ~]# /etc/init.d/ipsec start > Starting strongSwan 5.0.0 IPsec [starter]... > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/key/af_key.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/ah4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/esp4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/xfrm/xfrm_ipcomp.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/ipcomp.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/tunnel4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/xfrm4_tunnel.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/xfrm/xfrm_user.ko > > there was no output on httpd/error_log > > but my log manager warned me per email with a: > > OSSEC HIDS Notification. > 2012 Aug 07 10:29:16 > > Received From: ipfire-server->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Aug 7 10:29:16 ipfire-server charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL > > > > --END OF NOTIFICATION > > and a look to /var/log/messages gives me the following back: > > > Aug 7 10:34:28 ipfire-server charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.0.0, Linux 2.6.32.45-ipfire, i686) > Aug 7 10:34:28 ipfire-server charon: 00[LIB] Padlock not found, CPU is GenuineIntel > Aug 7 10:34:28 ipfire-server charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL > > Also is there a dev list with changes on this new version especially for the WUI so the documentation can start up more quickly ? > > Greetings > > Erik > > Am 06.08.2012 um 23:11 schrieb Michael Tremer: > >> Please try to manually stop strongswan with the helper tool: >> >> ipsecctrl D >> >> Try to start it again with: >> >> ipsecctrl S >> >> On Mon, 2012-08-06 at 21:48 +0200, Stefan Schantl wrote: >>> Hello Michael, >>> >>> I've tested to stop IPSec from shell which worked without problems. But >>> if I try to disable and stop it from the WUI, by >>> unsing the checkbox the service does a restart and no shutdown. >>> >>> I've looked inside the error_log from the httpd, and found the following >>> lines: >>> >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] IPSec >>> enabled on orange but orange interface is invalid or not found, referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] IPSec >>> enabled on blue but blue interface is invalid or not found, referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] Stopping >>> strongSwan IPsec..., referer: https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:12 2012] [error] [client 192.168.xxx.xxx] Starting >>> strongSwan 5.0.0 IPsec [starter]..., referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:12 2012] [error] [client 192.168.xxx.xxx] , referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> >>> Why are there entries about an orange and blue network, I don't have one >>> of them...... >>> >>> Do you have any idea about that ? >>> >>> Stefan >>> >>>> On Mon, 2012-08-06 at 17:21 +0200, Stefan Schantl wrote: >>>>> The only bad point, I've to report is, that after the update I can't >>>>> disable IPSec over the WUI anymore - may other testers will report the >>>>> same issue. >>>> What is the exact problem? Did you get an internal server error from the >>>> CGI script? Need a more precise error report. >>>> >>>> Michael >>>> >>>> >>> >>> _______________________________________________ >>> SIG-VPN mailing list >>> SIG-VPN(a)lists.ipfire.org >>> http://lists.ipfire.org/mailman/listinfo/sig-vpn >> >> _______________________________________________ >> Development mailing list >> Development(a)lists.ipfire.org >> http://lists.ipfire.org/mailman/listinfo/development >

2 2

[Development] Benutzer Feedback
by Michael Liekmeier 01 Aug '12

01 Aug '12

Hallo, ich habe auf der Homepage gelesen, das ihr von Nutzern ein Feedback wünscht. Ich habe einige Dinge die ich Euch mitteilen möchte. Aber erstmals an alle Entwickler ein reisen Dankeschön. *Asterisk / MISDN / LCR * Bei der Version die zur Zeit zur Verfügung steht, hatte ich sporadisch abstürze. Nach langem hin und her habe ich den Fehler bei dem LCR Addon gefunden mit Hilfe von Google. Leider habe ich den genauen Fehler nicht mehr gespeichert. Dann hat mir ein Freund LCR 1.10 erstellt und seit dem stürzt Asterisk nicht mehr ab. *VDR* VDR läuft super, allerdings wäre es schön, wenn es ein Update auf die Version 1.7 geben würde. Denn die Streaming-Clients (EasyVDR / VDR vib1710) sind nicht abwärtskompatibel. *Samba* Samba läuft auch super, bloß SMB2 mit Win7 geht nicht, aber ich glaube das sollte bekannt sein. Um das Problem zu beseitigen, ist ein Update Samba 3.6 erforderlich. Ich hoffe, ich konnte ein wenig helfen mit meinem Feedback. Gruß Michael

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development