Hello Jörg,

with which kernel did you test this?

-Michael

On Sat, 2018-06-30 at 17:53 +0200, Jörg Thalau wrote:

Hello

I'm new here. I'm not sure if that's the right mailing list. Sometimes the
ipfire hangs up. I researched the problem. The reason is the Intel network
card driver. Could you implement a new version of Intel network card driver?

Thanks!

here the error message:

Jun 27 22:41:33 ipfire kernel: e1000e 0000:00:1f.6 green0: Detected Hardware
Unit Hang:
Jun 27 22:41:33 ipfire kernel:   TDH                  <6a>
Jun 27 22:41:33 ipfire kernel:   TDT                  <7b>
Jun 27 22:41:33 ipfire kernel:   next_to_use          <7b>
Jun 27 22:41:33 ipfire kernel:   next_to_clean        <5f>
Jun 27 22:41:33 ipfire kernel: buffer_info[next_to_clean]:
Jun 27 22:41:33 ipfire kernel:   time_stamp <117031b03>
Jun 27 22:41:33 ipfire kernel:   next_to_watch        <6a>
Jun 27 22:41:33 ipfire kernel:   jiffies <117032408>
Jun 27 22:41:33 ipfire kernel:   next_to_watch.status <0>
Jun 27 22:41:33 ipfire kernel: MAC Status <40080083>
Jun 27 22:41:33 ipfire kernel: PHY Status             <796d>
Jun 27 22:41:33 ipfire kernel: PHY 1000BASE-T Status  <3c00>
Jun 27 22:41:33 ipfire kernel: PHY Extended Status    <3000>
Jun 27 22:41:33 ipfire kernel: PCI Status             <10>
Jun 27 22:41:35 ipfire kernel: e1000e 0000:00:1f.6 green0: Reset adapter
unexpectedly
Jun 27 22:41:37 ipfire ntpd[4079]: Deleting interface #10 green0,
192.168.144.1#123, interface stats: received=117, sent=117, dropped=0,
active_time=1126210 secs
Jun 27 22:41:39 ipfire kernel: e1000e: green0 NIC Link is Up 1000 Mbps Full
Duplex, Flow Control: Rx/Tx

Am 29.06.18 um 22:55 schrieb Peter Müller:
Hello,

while testing some firewall stuff, I stumbled across bug #11777
(https://bugzilla.ipfire.org/show_bug.cgi?id=11777): In some cases,
GeoIP country data in firewall rules and WebUI seem to differ. :-(

Since this makes debugging extremely hard and unreliable, could
someone have a look at this please? Sorry for the noise, but this
is a nasty one...

Thanks and best regards,
Peter Müller

Hello,

just installed IPFire 2.21 - Core Update 122 on a testing machine.

Issues noticed during update:
(a) Update to 122 was not installed automatically, but needs user
interaction.
(b) Machine rebooted properly and came up again without manual action
required.
(c) WebUI shortly displays "local recursor" for DNS status at
the main page - DNSSEC status of nameservers, however, is green.
These were displayed correctly again after ~ 2 minutes.
(d) NRPE addon required reinstallation (probably due to some
configuration changes). The service did not appear in the list at
the WebUI; this needs some bugfixing.
(e) charon displays connection errors "could not write to socket:
operation not permitted" which disappeared after ~ 2 minutes and
everything was properly established.

Summary:
Reboot, basic functions            WORKS
Squid web proxy + URL filter        WORKS
IDS                    WORKS
OpenVPN (N2N only)            WORKS
IPsec (N2N only)            WORKS
SSH                    WORKS
QoS                    WORKS
NRPE                    WORKS (after reinstallation, some bugs left)

CPU load (especially when it comes to HW interrupts) is a bit
(but not significant) lower than it was while running C120.
RAM consumption stays at the same level. Entropy is ~ 400 bits
higher. Kernel reports two interesting log lines on boot:

19:02:35 kernel:  alg: No test for seqiv(rfc4106(gcm(aes)))
(seqiv(rfc4106-gcm-aesni))

18:57:49 kernel:  xt_geoip: loading out-of-tree module taints kernel.

Just for the records. :-)

Systems seems to be safe against Spectre/Meltdown:

/sys/devices/system/cpu/vulnerabilities/meltdown:
Mitigation: PTI
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:
Not affected
/sys/devices/system/cpu/vulnerabilities/spectre_v1:
Mitigation: __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2:
Mitigation: Full generic retpoline

In case any issues occur within the next time, I'll let you know.
Excellent work so far!

Thanks, and best regards,
Peter Müller