Development

development@lists.ipfire.org

3 participants
6355 discussions

[Development] Strongswan 5.0.0
by Michael Tremer 07 Aug '12

07 Aug '12

Hello, as Core Update 61 has now been released, it is time to go on with developments for the next one: I have updated strongswan to version 5.0.0 which finally removes the pluto daemon which was responsible for IKEv1 connections. However, pluto has gotten very old and was created in the beginnings of the IPsec for Linux developments back in freeswan times. charon was introduced by strongswan some time ago when IKEv2 connections got supported. It handles IKEv1 connections as well as IKEv2 connections since strongswan version 5.0.0. What are the benefits for IPFire? As mentioned earlier, pluto is very old and got very hard to maintain. There have been problems with VPNs that terminate at hosts with dynamic IP addresses, so we needed to restart the entire IPsec subsystem in intervals of 5 minutes. This caused some trouble in stability terms. charon handles those dynamic endpoints much better without the need to restart anything. Connections may now be added and removed smoothly and in total there should be much more connection stability. There is also some new code for hybrid IPsec VPNs which can be used with Android 4 and maybe Apple iOS. I have not done any investigation on this topic, because I am not interested, but hopefully somebody else gives it a shot. I have now packaged the changes into a small package which wants to be installed on your system. http://people.ipfire.org/~ms/unsupported/core-upgrade-2.11-strongswan.ipfire It should not require any manual interaction at all. Please install and give me feedback about the connection stability and the interoperability with other (proprietary) implementations. I am looking forward to it. Michael P.S. If you reply to this mail make sure to keep both mailing lists.

2 6

SECURITY ADVISORY: outgoing firewall accepts packets unintendedly
by Michael Tremer 07 Aug '12

07 Aug '12

Hello, there is a problem in the outgoing firewall if it is used in mode 1. Packets are accepted from blue even if there is no rule for the MAC address of the sender. This problem has got a medium severity and does not affect any other configuration of the outgoing firewall and does not occur when no blue network interface exists. There is a fix available: http://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=commitdiff;h=78a14abf81… Please install and test. I am not going to repeat this request anymore. Michael

1 0

[Development] Strongswan 5.0.0
by Erik K. 07 Aug '12

07 Aug '12

> Hi all, > i have tried that and after a > > [root@ipfire-server ~]# /etc/init.d/ipsec start > Starting strongSwan 5.0.0 IPsec [starter]... > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/key/af_key.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/ah4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/esp4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/xfrm/xfrm_ipcomp.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/ipcomp.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/tunnel4.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/ipv4/xfrm4_tunnel.ko > insmod /lib/modules/2.6.32.45-ipfire/kernel/net/xfrm/xfrm_user.ko > > there was no output on httpd/error_log > > but my log manager warned me per email with a: > > OSSEC HIDS Notification. > 2012 Aug 07 10:29:16 > > Received From: ipfire-server->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Aug 7 10:29:16 ipfire-server charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL > > > > --END OF NOTIFICATION > > and a look to /var/log/messages gives me the following back: > > > Aug 7 10:34:28 ipfire-server charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.0.0, Linux 2.6.32.45-ipfire, i686) > Aug 7 10:34:28 ipfire-server charon: 00[LIB] Padlock not found, CPU is GenuineIntel > Aug 7 10:34:28 ipfire-server charon: 00[LIB] plugin 'padlock': failed to load - padlock_plugin_create returned NULL > > Also is there a dev list with changes on this new version especially for the WUI so the documentation can start up more quickly ? > > Greetings > > Erik > > Am 06.08.2012 um 23:11 schrieb Michael Tremer: > >> Please try to manually stop strongswan with the helper tool: >> >> ipsecctrl D >> >> Try to start it again with: >> >> ipsecctrl S >> >> On Mon, 2012-08-06 at 21:48 +0200, Stefan Schantl wrote: >>> Hello Michael, >>> >>> I've tested to stop IPSec from shell which worked without problems. But >>> if I try to disable and stop it from the WUI, by >>> unsing the checkbox the service does a restart and no shutdown. >>> >>> I've looked inside the error_log from the httpd, and found the following >>> lines: >>> >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] IPSec >>> enabled on orange but orange interface is invalid or not found, referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] IPSec >>> enabled on blue but blue interface is invalid or not found, referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:08 2012] [error] [client 192.168.xxx.xxx] Stopping >>> strongSwan IPsec..., referer: https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:12 2012] [error] [client 192.168.xxx.xxx] Starting >>> strongSwan 5.0.0 IPsec [starter]..., referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> [Mon Aug 06 21:42:12 2012] [error] [client 192.168.xxx.xxx] , referer: >>> https://gate.xxx:444/cgi-bin/vpnmain.cgi >>> >>> Why are there entries about an orange and blue network, I don't have one >>> of them...... >>> >>> Do you have any idea about that ? >>> >>> Stefan >>> >>>> On Mon, 2012-08-06 at 17:21 +0200, Stefan Schantl wrote: >>>>> The only bad point, I've to report is, that after the update I can't >>>>> disable IPSec over the WUI anymore - may other testers will report the >>>>> same issue. >>>> What is the exact problem? Did you get an internal server error from the >>>> CGI script? Need a more precise error report. >>>> >>>> Michael >>>> >>>> >>> >>> _______________________________________________ >>> SIG-VPN mailing list >>> SIG-VPN(a)lists.ipfire.org >>> http://lists.ipfire.org/mailman/listinfo/sig-vpn >> >> _______________________________________________ >> Development mailing list >> Development(a)lists.ipfire.org >> http://lists.ipfire.org/mailman/listinfo/development >

2 2

[Development] Benutzer Feedback
by Michael Liekmeier 01 Aug '12

01 Aug '12

Hallo, ich habe auf der Homepage gelesen, das ihr von Nutzern ein Feedback wünscht. Ich habe einige Dinge die ich Euch mitteilen möchte. Aber erstmals an alle Entwickler ein reisen Dankeschön. *Asterisk / MISDN / LCR * Bei der Version die zur Zeit zur Verfügung steht, hatte ich sporadisch abstürze. Nach langem hin und her habe ich den Fehler bei dem LCR Addon gefunden mit Hilfe von Google. Leider habe ich den genauen Fehler nicht mehr gespeichert. Dann hat mir ein Freund LCR 1.10 erstellt und seit dem stürzt Asterisk nicht mehr ab. *VDR* VDR läuft super, allerdings wäre es schön, wenn es ein Update auf die Version 1.7 geben würde. Denn die Streaming-Clients (EasyVDR / VDR vib1710) sind nicht abwärtskompatibel. *Samba* Samba läuft auch super, bloß SMB2 mit Win7 geht nicht, aber ich glaube das sollte bekannt sein. Um das Problem zu beseitigen, ist ein Update Samba 3.6 erforderlich. Ich hoffe, ich konnte ein wenig helfen mit meinem Feedback. Gruß Michael

2 1

[Development] Dynamic DNS Client for IPFire 3
by Michael Tremer 20 Jul '12

20 Jul '12

Hi, I pushed the first version of a dynamic DNS client for IPFire, yesterday: http://git.ipfire.org/?p=oddments/ddns.git;a=summary git://git.ipfire.org/oddments/ddns.git It is written entirely in Python and offers a class modem for the providers. Every provider gets an own class which updates the specified account. The configuration file syntax is unified and extensible, to support an easy way to add new accounts have the option to add some more configuration variables when needed. A lot of important stuff is already done like support for an upstream proxy server, a generic provider class and a basic command line tool. There are currently two providers supported: No-IP.com and selfhost.de IMPORTANT: I am not planning to add any more providers by myself. But I think there might be interest in having more providers and some more features, so this is an open request for a new maintainer of the tool. If you are a Python programmer and have interest in maintaining this little piece of software, write new features and fix bugs, please mail me. Michael P.S. I will eventually add some licensing information which is missing for now.

1 0

[Development] Recent networking changes
by Michael Tremer 01 Jul '12

01 Jul '12

Good morning, I would like to update you about the recent changes on the networking code. I reckon nobody already noticed. Right at the beginning I would like to say, that I really need help to test my patches. I have done as much as I could possibly do, but this kind of code should be running very well and it's a pain in the ass when you have a box without any network connectivity. ---- * Support for DHCP, which has been requested several times at the summit, has been added and is currently working for me. I'll probably need more testers to verify the functionality, so please join. You'll need to checkout the network git and make sure you have installed the dhcp package from unstable: http://git.ipfire.org/?p=network.git;a=summary dhcp-4.2.2-3.ip3: https://pakfire.ipfire.org/build/df9a43e6-8d99-4ac7-973a-239a9120211b To enable the DHCP client on a zone type: network zone upl0 config create ipv4-dhcp ---- * Basic (!) firewalling support, which has no option to be configured, yet has been added. That means that I have been porting some of my old testing code I have written in 2009 to the network package. It can be enabled by running "firewall start" and disabled by typing "firewall stop". Don't expect to reach the internet anymore. The interesting part here is the structure of the chains. Have a look at "iptables -L -n -v". ---- * Hotplugging for USB devices. There has been some code, but due changes in udev and systemd it was not working anymore. This has been fixed and there has been support added for wireless devices. Example #1: If you now plug in a USB-LAN adapter, you will automatically create a port configuration for that device which is called p0, p1, ..., pN. If you unplug the adapter, the device will disappear automatically and will be removed from the zone where it has been in. If you plug it in again and there is a zone configuration for that port, the port will automatically added to the zone (if the zone is already running). Example #2: A wireless device is treated somewhat differently. When plugged in, there won't show up any interface (like wlan0). The reason for that is, that wireless devices can have multiple interfaces at the same time (think of multiple SSID access points). Those interfaces will be created when they are needed and automatically created when the USB device is plugged in. When you are building a wireless access point please make sure you have at least hostapd-0.7.3-2.ip3 and iw installed: https://pakfire.ipfire.org/build/08e1b509-2198-459f-9de2-2a9c8aa5a38e Please set up some testing hardware and check if this is working on your box as well. ---- * systemd is controlling the zones. Which enables us to them in parallel and access their status via dbus. ---- To not ask too much from you in a single email, I will stop here and we will see in about a week with what I am coming up then :D Again my request: Please test and file bug reports against: https://bugzilla.ipfire.org/enter_bug.cgi?product=IPFire&component=network Michael

2 5

[Development] New repository for current IPFire content
by Michael Tremer 21 Jun '12

21 Jun '12

Hello mirror admins, some people from Indonesia asked me if we could try to decrease the size of the data we have on the mirrors and therefore I created a new repository that is called "current". "current" contains the latest two releases from each series that is currently maintained (this is IPFire 2 at the moment) and all the other releases won't be up. Supposedly they don't get downloaded that often anyway, it is okay for us to have them mirrored only on a couple of servers. "current" also holds the complete package tree of the current stable release (which is IPFire 2 only right now). We need to mirror that too. If we didn't the whole mirror thing would not make very much sense. So these are the current repositories: full : 24G current: 3.3GB So, we would like you to switch to the current repository if you are still using the older "pakfire2" repository that comes only with the packages for IPFire 2. If you have the possibility to mirror the whole content, please choose that one. Thank for mirroring our small project. We appreciate it very much. Michael

2 2

[Development] Kernel 3.3
by Michael Tremer 17 May '12

17 May '12

Hey, I have been working on the update to Linux 3.3 in the last weeks. Unfortunately, I am running out if time in most things I do. So my request is, that some of you test the kernel that I already compiled. Scratch build: https://pakfire.ipfire.org/build/a740cfc3-1996-442b-87d7-a3432a6561f7 I don't expect anything weird, but I have not been able to test if it boots up at all. Make sure you check that the initrd has been generated after the installation, reboot and then run a couple of things. That's all. The reason for this kind of hurry is, that the release of Linux 3.4 is imminent (probably this week) and I don't like to get stuck on a too old kernel. Michael

2 2

[Development] Network / Systemd integration
by Stefan Schantl 10 May '12

10 May '12

Hello, On the Developer Summit we have spoken about network and systemd - how our implemention works and how we can improve it. I've written a roadmap which contains all changes and new features. http://wiki.ipfire.org/devel/network/systemd Please read through and perform any feedback or any new idea's you have. Thanks, Stefan

2 2

[Development] Support for multiple certificates in Pound
by Michael Tremer 09 Apr '12

09 Apr '12

Hello, I just checked in a patch for pound which is supposed to enhance its functionality to support more than one certificate and select the right one by the Subject Alternative Name. http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=343740678ab5617d1010… I would like some of you to test that release as soon as it is available on the repository. It would be important that this works very well because I want to use that on the IPFire instance at Hetzner to redirect SSL requests to the right web services. Please help me with that. Michael

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development