IPFire-SCM

ipfire-scm@lists.ipfire.org

1 participants
7859 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 063de1600bbad5566764f6bc88f15260e2fe1288
by Michael Tremer 10 Sep '18

10 Sep '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 063de1600bbad5566764f6bc88f15260e2fe1288 (commit) via 05a89532d79d031895dd8dab0193b951f8072934 (commit) from cc3e41cb8b0b7d713ce15a7177d1bbda7778b2ca (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 063de1600bbad5566764f6bc88f15260e2fe1288 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Sep 10 18:23:27 2018 +0100 core124: Ship CA certificates Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 05a89532d79d031895dd8dab0193b951f8072934 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Sep 10 18:25:40 2018 +0200 update ca-certificates CA bundle Update the CA certificates list to what Mozilla NSS ships currently. The original file can be retrieved from: https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/b… Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/ca-certificates/certdata.txt | 422 ++++++++++++++------- .../121 => core/124}/filelists/ca-certificates | 0 lfs/ca-certificates | 4 +- 3 files changed, 289 insertions(+), 137 deletions(-) copy config/rootfiles/{oldcore/121 => core/124}/filelists/ca-certificates (100%) Difference in files: diff --git a/config/ca-certificates/certdata.txt b/config/ca-certificates/certdata.txt index d291f28a5..193cef38f 100644 --- a/config/ca-certificates/certdata.txt +++ b/config/ca-certificates/certdata.txt @@ -7381,136 +7381,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE -# -# Certificate "ComSign CA" -# -# Issuer: C=IL,O=ComSign,CN=ComSign CA -# Serial Number:14:13:96:83:14:55:8c:ea:7b:63:e5:fc:34:87:77:44 -# Subject: C=IL,O=ComSign,CN=ComSign CA -# Not Valid Before: Wed Mar 24 11:32:18 2004 -# Not Valid After : Mon Mar 19 15:02:18 2029 -# Fingerprint (MD5): CD:F4:39:F3:B5:18:50:D7:3E:A4:C5:91:A0:3E:21:4B -# Fingerprint (SHA1): E1:A4:5B:14:1A:21:DA:1A:79:F4:1A:42:A9:61:D6:69:CD:06:34:C1 -CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "ComSign CA" -CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 -CKA_SUBJECT MULTILINE_OCTAL -\060\064\061\023\060\021\006\003\125\004\003\023\012\103\157\155 -\123\151\147\156\040\103\101\061\020\060\016\006\003\125\004\012 -\023\007\103\157\155\123\151\147\156\061\013\060\011\006\003\125 -\004\006\023\002\111\114 -END -CKA_ID UTF8 "0" -CKA_ISSUER MULTILINE_OCTAL -\060\064\061\023\060\021\006\003\125\004\003\023\012\103\157\155 -\123\151\147\156\040\103\101\061\020\060\016\006\003\125\004\012 -\023\007\103\157\155\123\151\147\156\061\013\060\011\006\003\125 -\004\006\023\002\111\114 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\020\024\023\226\203\024\125\214\352\173\143\345\374\064\207 -\167\104 -END -CKA_VALUE MULTILINE_OCTAL -\060\202\003\223\060\202\002\173\240\003\002\001\002\002\020\024 -\023\226\203\024\125\214\352\173\143\345\374\064\207\167\104\060 -\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\064 -\061\023\060\021\006\003\125\004\003\023\012\103\157\155\123\151 -\147\156\040\103\101\061\020\060\016\006\003\125\004\012\023\007 -\103\157\155\123\151\147\156\061\013\060\011\006\003\125\004\006 -\023\002\111\114\060\036\027\015\060\064\060\063\062\064\061\061 -\063\062\061\070\132\027\015\062\071\060\063\061\071\061\065\060 -\062\061\070\132\060\064\061\023\060\021\006\003\125\004\003\023 -\012\103\157\155\123\151\147\156\040\103\101\061\020\060\016\006 -\003\125\004\012\023\007\103\157\155\123\151\147\156\061\013\060 -\011\006\003\125\004\006\023\002\111\114\060\202\001\042\060\015 -\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001 -\017\000\060\202\001\012\002\202\001\001\000\360\344\124\151\053 -\323\307\217\152\104\344\176\130\047\370\013\320\344\224\022\212 -\361\033\070\070\057\037\061\234\006\324\054\247\336\013\052\256 -\032\240\343\236\152\277\237\074\307\156\242\371\213\144\154\072 -\255\205\125\121\124\245\070\125\270\253\203\004\362\077\144\066 -\367\300\215\103\103\152\146\321\367\027\052\325\357\066\372\060 -\020\102\327\123\315\371\372\063\163\114\263\351\204\040\212\326 -\101\047\065\344\070\372\224\233\270\172\344\171\037\063\373\033 -\330\041\011\050\174\115\030\151\136\144\212\172\031\223\312\176 -\354\363\162\347\067\007\130\131\050\254\102\371\305\377\315\077 -\347\245\372\070\261\320\014\307\331\122\032\123\326\201\314\102 -\172\065\133\355\113\072\172\366\265\216\314\377\017\174\344\140 -\066\207\057\255\360\241\045\175\377\322\113\021\210\160\124\246 -\101\250\147\123\122\102\136\344\064\236\344\276\243\354\252\142 -\135\335\303\114\246\202\101\344\063\013\254\311\063\017\144\202 -\127\052\375\014\255\066\341\014\256\113\305\357\073\231\331\043 -\263\133\135\264\127\354\164\160\014\052\117\002\003\001\000\001 -\243\201\240\060\201\235\060\014\006\003\125\035\023\004\005\060 -\003\001\001\377\060\075\006\003\125\035\037\004\066\060\064\060 -\062\240\060\240\056\206\054\150\164\164\160\072\057\057\146\145 -\144\151\162\056\143\157\155\163\151\147\156\056\143\157\056\151 -\154\057\143\162\154\057\103\157\155\123\151\147\156\103\101\056 -\143\162\154\060\016\006\003\125\035\017\001\001\377\004\004\003 -\002\001\206\060\037\006\003\125\035\043\004\030\060\026\200\024 -\113\001\233\076\126\032\145\066\166\313\173\227\252\222\005\356 -\062\347\050\061\060\035\006\003\125\035\016\004\026\004\024\113 -\001\233\076\126\032\145\066\166\313\173\227\252\222\005\356\062 -\347\050\061\060\015\006\011\052\206\110\206\367\015\001\001\005 -\005\000\003\202\001\001\000\320\331\245\176\376\051\140\105\235 -\176\203\317\156\274\107\156\365\032\236\124\166\102\161\264\074 -\130\077\055\100\045\102\366\201\234\361\211\020\310\016\252\170 -\117\070\011\127\260\074\300\010\374\065\216\361\110\121\215\014 -\161\164\272\204\304\327\162\233\204\174\070\116\144\006\047\052 -\341\247\265\354\010\231\264\012\015\324\205\163\310\022\341\065 -\355\361\005\061\035\163\231\014\353\226\312\335\323\346\205\252 -\360\212\373\165\301\362\011\074\145\145\144\363\114\330\255\313 -\210\151\363\344\203\267\014\275\027\132\226\027\312\133\377\255 -\273\034\351\055\204\200\330\041\276\205\122\331\324\164\271\151 -\205\272\115\355\050\062\353\371\141\112\344\304\066\036\031\334 -\157\204\021\037\225\365\203\050\030\250\063\222\103\047\335\135 -\023\004\105\117\207\325\106\315\075\250\272\360\363\270\126\044 -\105\353\067\307\341\166\117\162\071\030\337\176\164\162\307\163 -\055\071\352\140\346\255\021\242\126\207\173\303\150\232\376\370 -\214\160\250\337\145\062\364\244\100\214\241\302\104\003\016\224 -\000\147\240\161\000\202\110 -END -CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE - -# Trust for Certificate "ComSign CA" -# Issuer: C=IL,O=ComSign,CN=ComSign CA -# Serial Number:14:13:96:83:14:55:8c:ea:7b:63:e5:fc:34:87:77:44 -# Subject: C=IL,O=ComSign,CN=ComSign CA -# Not Valid Before: Wed Mar 24 11:32:18 2004 -# Not Valid After : Mon Mar 19 15:02:18 2029 -# Fingerprint (MD5): CD:F4:39:F3:B5:18:50:D7:3E:A4:C5:91:A0:3E:21:4B -# Fingerprint (SHA1): E1:A4:5B:14:1A:21:DA:1A:79:F4:1A:42:A9:61:D6:69:CD:06:34:C1 -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "ComSign CA" -CKA_CERT_SHA1_HASH MULTILINE_OCTAL -\341\244\133\024\032\041\332\032\171\364\032\102\251\141\326\151 -\315\006\064\301 -END -CKA_CERT_MD5_HASH MULTILINE_OCTAL -\315\364\071\363\265\030\120\327\076\244\305\221\240\076\041\113 -END -CKA_ISSUER MULTILINE_OCTAL -\060\064\061\023\060\021\006\003\125\004\003\023\012\103\157\155 -\123\151\147\156\040\103\101\061\020\060\016\006\003\125\004\012 -\023\007\103\157\155\123\151\147\156\061\013\060\011\006\003\125 -\004\006\023\002\111\114 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\020\024\023\226\203\024\125\214\352\173\143\345\374\064\207 -\167\104 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - # # Certificate "Cybertrust Global Root" # @@ -19302,7 +19172,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL \002\022\021\040\125\203\344\055\076\124\126\205\055\203\067\267 \054\334\106\021 END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE @@ -19408,7 +19278,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL \002\022\021\040\331\221\316\256\243\350\305\347\377\351\002\257 \317\163\274\125 END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE @@ -19571,7 +19441,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL \002\022\021\040\263\220\125\071\175\177\066\155\144\302\247\237 \153\143\216\147 END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE @@ -19734,7 +19604,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL \002\022\021\040\241\151\033\277\275\271\275\122\226\217\043\350 \110\277\046\021 END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE @@ -19844,7 +19714,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL \002\022\021\040\346\370\114\374\044\260\276\005\100\254\332\203 \033\064\140\077 END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE @@ -22993,3 +22863,285 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +# +# Certificate "GlobalSign Root CA - R6" +# +# Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6 +# Serial Number:45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51 +# Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6 +# Not Valid Before: Wed Dec 10 00:00:00 2014 +# Not Valid After : Sun Dec 10 00:00:00 2034 +# Fingerprint (SHA-256): 2C:AB:EA:FE:37:D0:6C:A2:2A:BA:73:91:C0:03:3D:25:98:29:52:C4:53:64:73:49:76:3A:3A:B5:AD:6C:CF:69 +# Fingerprint (SHA1): 80:94:64:0E:B5:A7:A1:CA:11:9C:1F:DD:D5:9F:81:02:63:A7:FB:D1 +CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "GlobalSign Root CA - R6" +CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +CKA_SUBJECT MULTILINE_OCTAL +\060\114\061\040\060\036\006\003\125\004\013\023\027\107\154\157 +\142\141\154\123\151\147\156\040\122\157\157\164\040\103\101\040 +\055\040\122\066\061\023\060\021\006\003\125\004\012\023\012\107 +\154\157\142\141\154\123\151\147\156\061\023\060\021\006\003\125 +\004\003\023\012\107\154\157\142\141\154\123\151\147\156 +END +CKA_ID UTF8 "0" +CKA_ISSUER MULTILINE_OCTAL +\060\114\061\040\060\036\006\003\125\004\013\023\027\107\154\157 +\142\141\154\123\151\147\156\040\122\157\157\164\040\103\101\040 +\055\040\122\066\061\023\060\021\006\003\125\004\012\023\012\107 +\154\157\142\141\154\123\151\147\156\061\023\060\021\006\003\125 +\004\003\023\012\107\154\157\142\141\154\123\151\147\156 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\016\105\346\273\003\203\063\303\205\145\110\346\377\105\121 +END +CKA_VALUE MULTILINE_OCTAL +\060\202\005\203\060\202\003\153\240\003\002\001\002\002\016\105 +\346\273\003\203\063\303\205\145\110\346\377\105\121\060\015\006 +\011\052\206\110\206\367\015\001\001\014\005\000\060\114\061\040 +\060\036\006\003\125\004\013\023\027\107\154\157\142\141\154\123 +\151\147\156\040\122\157\157\164\040\103\101\040\055\040\122\066 +\061\023\060\021\006\003\125\004\012\023\012\107\154\157\142\141 +\154\123\151\147\156\061\023\060\021\006\003\125\004\003\023\012 +\107\154\157\142\141\154\123\151\147\156\060\036\027\015\061\064 +\061\062\061\060\060\060\060\060\060\060\132\027\015\063\064\061 +\062\061\060\060\060\060\060\060\060\132\060\114\061\040\060\036 +\006\003\125\004\013\023\027\107\154\157\142\141\154\123\151\147 +\156\040\122\157\157\164\040\103\101\040\055\040\122\066\061\023 +\060\021\006\003\125\004\012\023\012\107\154\157\142\141\154\123 +\151\147\156\061\023\060\021\006\003\125\004\003\023\012\107\154 +\157\142\141\154\123\151\147\156\060\202\002\042\060\015\006\011 +\052\206\110\206\367\015\001\001\001\005\000\003\202\002\017\000 +\060\202\002\012\002\202\002\001\000\225\007\350\163\312\146\371 +\354\024\312\173\074\367\015\010\361\264\105\013\054\202\264\110 +\306\353\133\074\256\203\270\101\222\063\024\244\157\177\351\052 +\314\306\260\210\153\305\266\211\321\306\262\377\024\316\121\024 +\041\354\112\335\033\132\306\326\207\356\115\072\025\006\355\144 +\146\013\222\200\312\104\336\163\224\116\363\247\211\177\117\170 +\143\010\310\022\120\155\102\146\057\115\271\171\050\115\122\032 +\212\032\200\267\031\201\016\176\304\212\274\144\114\041\034\103 +\150\327\075\074\212\305\262\146\325\220\232\267\061\006\305\276 +\342\155\062\006\246\036\371\271\353\252\243\270\277\276\202\143 +\120\320\360\030\211\337\344\017\171\365\352\242\037\052\322\160 +\056\173\347\274\223\273\155\123\342\110\174\214\020\007\070\377 +\146\262\167\141\176\340\352\214\074\252\264\244\366\363\225\112 +\022\007\155\375\214\262\211\317\320\240\141\167\310\130\164\260 +\324\043\072\367\135\072\312\242\333\235\011\336\135\104\055\220 +\361\201\315\127\222\372\176\274\120\004\143\064\337\153\223\030 +\276\153\066\262\071\344\254\044\066\267\360\357\266\034\023\127 +\223\266\336\262\370\342\205\267\163\242\270\065\252\105\362\340 +\235\066\241\157\124\212\361\162\126\156\056\210\305\121\102\104 +\025\224\356\243\305\070\226\233\116\116\132\013\107\363\006\066 +\111\167\060\274\161\067\345\246\354\041\010\165\374\346\141\026 +\077\167\325\331\221\227\204\012\154\324\002\115\164\300\024\355 +\375\071\373\203\362\136\024\241\004\260\013\351\376\356\217\341 +\156\013\262\010\263\141\146\011\152\261\006\072\145\226\131\300 +\360\065\375\311\332\050\215\032\021\207\160\201\012\250\232\165 +\035\236\072\206\005\000\236\333\200\326\045\371\334\005\236\047 +\131\114\166\071\133\352\371\245\241\330\203\017\321\377\337\060 +\021\371\205\317\063\110\365\312\155\144\024\054\172\130\117\323 +\113\010\111\305\225\144\032\143\016\171\075\365\263\214\312\130 +\255\234\102\105\171\156\016\207\031\134\124\261\145\266\277\214 +\233\334\023\351\015\157\270\056\334\147\156\311\213\021\265\204 +\024\212\000\031\160\203\171\221\227\221\324\032\047\277\067\036 +\062\007\330\024\143\074\050\114\257\002\003\001\000\001\243\143 +\060\141\060\016\006\003\125\035\017\001\001\377\004\004\003\002 +\001\006\060\017\006\003\125\035\023\001\001\377\004\005\060\003 +\001\001\377\060\035\006\003\125\035\016\004\026\004\024\256\154 +\005\243\223\023\342\242\347\342\327\034\326\307\360\177\310\147 +\123\240\060\037\006\003\125\035\043\004\030\060\026\200\024\256 +\154\005\243\223\023\342\242\347\342\327\034\326\307\360\177\310 +\147\123\240\060\015\006\011\052\206\110\206\367\015\001\001\014 +\005\000\003\202\002\001\000\203\045\355\350\321\375\225\122\315 +\236\300\004\240\221\151\346\134\320\204\336\334\255\242\117\350 +\107\170\326\145\230\251\133\250\074\207\174\002\212\321\156\267 +\026\163\346\137\300\124\230\325\164\276\301\315\342\021\221\255 +\043\030\075\335\341\162\104\226\264\225\136\300\173\216\231\170 +\026\103\023\126\127\263\242\263\073\265\167\334\100\162\254\243 +\353\233\065\076\261\010\041\241\347\304\103\067\171\062\276\265 +\347\234\054\114\274\103\051\231\216\060\323\254\041\340\343\035 +\372\330\007\063\166\124\000\042\052\271\115\040\056\160\150\332 +\345\123\374\203\134\323\235\362\377\104\014\104\146\362\322\343 +\275\106\000\032\155\002\272\045\135\215\241\061\121\335\124\106 +\034\115\333\231\226\357\032\034\004\134\246\025\357\170\340\171 +\376\135\333\076\252\114\125\375\232\025\251\157\341\246\373\337 +\160\060\351\303\356\102\106\355\302\223\005\211\372\175\143\173 +\077\320\161\201\174\000\350\230\256\016\170\064\303\045\373\257 +\012\237\040\153\335\073\023\217\022\214\342\101\032\110\172\163 +\240\167\151\307\266\134\177\202\310\036\376\130\033\050\053\250 +\154\255\136\155\300\005\322\173\267\353\200\376\045\067\376\002 +\233\150\254\102\135\303\356\365\314\334\360\120\165\322\066\151 +\234\346\173\004\337\156\006\151\266\336\012\011\110\131\207\353 +\173\024\140\172\144\252\151\103\357\221\307\114\354\030\335\154 +\357\123\055\214\231\341\136\362\162\076\317\124\310\275\147\354 +\244\017\114\105\377\323\271\060\043\007\114\217\020\277\206\226 +\331\231\132\264\231\127\034\244\314\273\025\211\123\272\054\005 +\017\344\304\236\031\261\030\064\325\114\235\272\355\367\037\257 +\044\225\004\170\250\003\273\356\201\345\332\137\174\213\112\241 +\220\164\045\247\263\076\113\310\054\126\275\307\310\357\070\342 +\134\222\360\171\367\234\204\272\164\055\141\001\040\176\176\321 +\362\117\007\131\137\213\055\103\122\353\106\014\224\341\365\146 +\107\171\167\325\124\133\037\255\044\067\313\105\132\116\240\104 +\110\310\330\260\231\305\025\204\011\366\326\111\111\300\145\270 +\346\032\161\156\240\250\361\202\350\105\076\154\326\002\327\012 +\147\203\005\132\311\244\020 +END +CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE + +# Trust for "GlobalSign Root CA - R6" +# Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6 +# Serial Number:45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51 +# Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6 +# Not Valid Before: Wed Dec 10 00:00:00 2014 +# Not Valid After : Sun Dec 10 00:00:00 2034 +# Fingerprint (SHA-256): 2C:AB:EA:FE:37:D0:6C:A2:2A:BA:73:91:C0:03:3D:25:98:29:52:C4:53:64:73:49:76:3A:3A:B5:AD:6C:CF:69 +# Fingerprint (SHA1): 80:94:64:0E:B5:A7:A1:CA:11:9C:1F:DD:D5:9F:81:02:63:A7:FB:D1 +CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "GlobalSign Root CA - R6" +CKA_CERT_SHA1_HASH MULTILINE_OCTAL +\200\224\144\016\265\247\241\312\021\234\037\335\325\237\201\002 +\143\247\373\321 +END +CKA_CERT_MD5_HASH MULTILINE_OCTAL +\117\335\007\344\324\042\144\071\036\014\067\102\352\321\306\256 +END +CKA_ISSUER MULTILINE_OCTAL +\060\114\061\040\060\036\006\003\125\004\013\023\027\107\154\157 +\142\141\154\123\151\147\156\040\122\157\157\164\040\103\101\040 +\055\040\122\066\061\023\060\021\006\003\125\004\012\023\012\107 +\154\157\142\141\154\123\151\147\156\061\023\060\021\006\003\125 +\004\003\023\012\107\154\157\142\141\154\123\151\147\156 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\016\105\346\273\003\203\063\303\205\145\110\346\377\105\121 +END +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +# +# Certificate "OISTE WISeKey Global Root GC CA" +# +# Issuer: CN=OISTE WISeKey Global Root GC CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH +# Serial Number:21:2a:56:0c:ae:da:0c:ab:40:45:bf:2b:a2:2d:3a:ea +# Subject: CN=OISTE WISeKey Global Root GC CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH +# Not Valid Before: Tue May 09 09:48:34 2017 +# Not Valid After : Fri May 09 09:58:33 2042 +# Fingerprint (SHA-256): 85:60:F9:1C:36:24:DA:BA:95:70:B5:FE:A0:DB:E3:6F:F1:1A:83:23:BE:94:86:85:4F:B3:F3:4A:55:71:19:8D +# Fingerprint (SHA1): E0:11:84:5E:34:DE:BE:88:81:B9:9C:F6:16:26:D1:96:1F:C3:B9:31 +CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "OISTE WISeKey Global Root GC CA" +CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +CKA_SUBJECT MULTILINE_OCTAL +\060\155\061\013\060\011\006\003\125\004\006\023\002\103\110\061 +\020\060\016\006\003\125\004\012\023\007\127\111\123\145\113\145 +\171\061\042\060\040\006\003\125\004\013\023\031\117\111\123\124 +\105\040\106\157\165\156\144\141\164\151\157\156\040\105\156\144 +\157\162\163\145\144\061\050\060\046\006\003\125\004\003\023\037 +\117\111\123\124\105\040\127\111\123\145\113\145\171\040\107\154 +\157\142\141\154\040\122\157\157\164\040\107\103\040\103\101 +END +CKA_ID UTF8 "0" +CKA_ISSUER MULTILINE_OCTAL +\060\155\061\013\060\011\006\003\125\004\006\023\002\103\110\061 +\020\060\016\006\003\125\004\012\023\007\127\111\123\145\113\145 +\171\061\042\060\040\006\003\125\004\013\023\031\117\111\123\124 +\105\040\106\157\165\156\144\141\164\151\157\156\040\105\156\144 +\157\162\163\145\144\061\050\060\046\006\003\125\004\003\023\037 +\117\111\123\124\105\040\127\111\123\145\113\145\171\040\107\154 +\157\142\141\154\040\122\157\157\164\040\107\103\040\103\101 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\041\052\126\014\256\332\014\253\100\105\277\053\242\055 +\072\352 +END +CKA_VALUE MULTILINE_OCTAL +\060\202\002\151\060\202\001\357\240\003\002\001\002\002\020\041 +\052\126\014\256\332\014\253\100\105\277\053\242\055\072\352\060 +\012\006\010\052\206\110\316\075\004\003\003\060\155\061\013\060 +\011\006\003\125\004\006\023\002\103\110\061\020\060\016\006\003 +\125\004\012\023\007\127\111\123\145\113\145\171\061\042\060\040 +\006\003\125\004\013\023\031\117\111\123\124\105\040\106\157\165 +\156\144\141\164\151\157\156\040\105\156\144\157\162\163\145\144 +\061\050\060\046\006\003\125\004\003\023\037\117\111\123\124\105 +\040\127\111\123\145\113\145\171\040\107\154\157\142\141\154\040 +\122\157\157\164\040\107\103\040\103\101\060\036\027\015\061\067 +\060\065\060\071\060\071\064\070\063\064\132\027\015\064\062\060 +\065\060\071\060\071\065\070\063\063\132\060\155\061\013\060\011 +\006\003\125\004\006\023\002\103\110\061\020\060\016\006\003\125 +\004\012\023\007\127\111\123\145\113\145\171\061\042\060\040\006 +\003\125\004\013\023\031\117\111\123\124\105\040\106\157\165\156 +\144\141\164\151\157\156\040\105\156\144\157\162\163\145\144\061 +\050\060\046\006\003\125\004\003\023\037\117\111\123\124\105\040 +\127\111\123\145\113\145\171\040\107\154\157\142\141\154\040\122 +\157\157\164\040\107\103\040\103\101\060\166\060\020\006\007\052 +\206\110\316\075\002\001\006\005\053\201\004\000\042\003\142\000 +\004\114\351\120\300\306\017\162\030\274\330\361\272\263\211\342 +\171\112\243\026\247\153\124\044\333\121\377\352\364\011\044\303 +\013\042\237\313\152\047\202\201\015\322\300\257\061\344\164\202 +\156\312\045\331\214\165\235\361\333\320\232\242\113\041\176\026 +\247\143\220\322\071\324\261\207\170\137\030\226\017\120\033\065 +\067\017\152\306\334\331\023\115\244\216\220\067\346\275\133\061 +\221\243\124\060\122\060\016\006\003\125\035\017\001\001\377\004 +\004\003\002\001\006\060\017\006\003\125\035\023\001\001\377\004 +\005\060\003\001\001\377\060\035\006\003\125\035\016\004\026\004 +\024\110\207\024\254\343\303\236\220\140\072\327\312\211\356\323 +\255\214\264\120\146\060\020\006\011\053\006\001\004\001\202\067 +\025\001\004\003\002\001\000\060\012\006\010\052\206\110\316\075 +\004\003\003\003\150\000\060\145\002\060\046\307\151\133\334\325 +\347\262\347\310\014\214\214\303\335\171\214\033\143\325\311\122 +\224\116\115\202\112\163\036\262\200\204\251\045\300\114\132\155 +\111\051\140\170\023\342\176\110\353\144\002\061\000\333\064\040 +\062\010\377\232\111\002\266\210\336\024\257\135\154\231\161\215 +\032\077\213\327\340\242\066\206\034\007\202\072\166\123\375\302 +\242\355\357\173\260\200\117\130\017\113\123\071\275 +END +CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE + +# Trust for "OISTE WISeKey Global Root GC CA" +# Issuer: CN=OISTE WISeKey Global Root GC CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH +# Serial Number:21:2a:56:0c:ae:da:0c:ab:40:45:bf:2b:a2:2d:3a:ea +# Subject: CN=OISTE WISeKey Global Root GC CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH +# Not Valid Before: Tue May 09 09:48:34 2017 +# Not Valid After : Fri May 09 09:58:33 2042 +# Fingerprint (SHA-256): 85:60:F9:1C:36:24:DA:BA:95:70:B5:FE:A0:DB:E3:6F:F1:1A:83:23:BE:94:86:85:4F:B3:F3:4A:55:71:19:8D +# Fingerprint (SHA1): E0:11:84:5E:34:DE:BE:88:81:B9:9C:F6:16:26:D1:96:1F:C3:B9:31 +CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "OISTE WISeKey Global Root GC CA" +CKA_CERT_SHA1_HASH MULTILINE_OCTAL +\340\021\204\136\064\336\276\210\201\271\234\366\026\046\321\226 +\037\303\271\061 +END +CKA_CERT_MD5_HASH MULTILINE_OCTAL +\251\326\271\055\057\223\144\370\245\151\312\221\351\150\007\043 +END +CKA_ISSUER MULTILINE_OCTAL +\060\155\061\013\060\011\006\003\125\004\006\023\002\103\110\061 +\020\060\016\006\003\125\004\012\023\007\127\111\123\145\113\145 +\171\061\042\060\040\006\003\125\004\013\023\031\117\111\123\124 +\105\040\106\157\165\156\144\141\164\151\157\156\040\105\156\144 +\157\162\163\145\144\061\050\060\046\006\003\125\004\003\023\037 +\117\111\123\124\105\040\127\111\123\145\113\145\171\040\107\154 +\157\142\141\154\040\122\157\157\164\040\107\103\040\103\101 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\041\052\126\014\256\332\014\253\100\105\277\053\242\055 +\072\352 +END +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE diff --git a/config/rootfiles/core/124/filelists/ca-certificates b/config/rootfiles/core/124/filelists/ca-certificates new file mode 120000 index 000000000..320fea8f4 --- /dev/null +++ b/config/rootfiles/core/124/filelists/ca-certificates @@ -0,0 +1 @@ +../../../common/ca-certificates \ No newline at end of file diff --git a/lfs/ca-certificates b/lfs/ca-certificates index 8b6f71fef..e063b6439 100644 --- a/lfs/ca-certificates +++ b/lfs/ca-certificates @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2015 IPFire Team <info(a)ipfire.de> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 20180429 +VER = 20180910 THISAPP = ca-certificates DIR_APP = $(DIR_SRC)/$(THISAPP) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. cc3e41cb8b0b7d713ce15a7177d1bbda7778b2ca
by Michael Tremer 10 Sep '18

10 Sep '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via cc3e41cb8b0b7d713ce15a7177d1bbda7778b2ca (commit) via edea6ec5a4ee9a75afcf69c65178089f6a928105 (commit) via 0762dcc4e86937ae2f00d09d449563eb12563b9c (commit) via 8a0585837c4f743676a27ad16212a68b8fb4172b (commit) via 4e4128faacab7a25e5845faffefa2b2b2128eff7 (commit) via ffba3c98bac2675f19f32541f5e1ebe61419e7bd (commit) via 4ca0cb33543e780f02142cd70b18bb341d2eabad (commit) via b67e79a4f15bcb8f2e9d525169d9c51611fe6c7e (commit) from a0d612be7ac96cff5dc988f89054db49420c14b8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit cc3e41cb8b0b7d713ce15a7177d1bbda7778b2ca Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Sep 10 16:29:09 2018 +0200 use custom SSH client configuration in LFS file Include OpenSSH client configuration file during build. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit edea6ec5a4ee9a75afcf69c65178089f6a928105 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Sep 10 16:29:08 2018 +0200 add hardened SSH client configuration Introduce a custom OpenSSH client configuration file for IPFire. Some people use it as a jumping host, so applying hardening options system-wide improves security. Cryptography setup is the same as for OpenSSH server configuration. The second version of this patch re-adds some non-AEAD cipher suites which are needed for connecting to older RHEL systems. Partially fixes #11751 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0762dcc4e86937ae2f00d09d449563eb12563b9c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Sep 10 16:35:25 2018 +0100 core124: Ship updated unbound configuration and restart daemon Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 8a0585837c4f743676a27ad16212a68b8fb4172b Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Sep 10 16:21:26 2018 +0200 Unbound: Use aggressive NSEC This avoids some needless lookups to destination domains with a very high NXDOMAIN rate and reduces load on upstream servers. See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for further details. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4e4128faacab7a25e5845faffefa2b2b2128eff7 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Sep 10 16:21:25 2018 +0200 Unbound: Use caps for IDs Attempt to detect DNS spoofing attacks by inserting 0x20-encoded random bits into upstream queries. Upstream documentation claims it to be an experimental implementation, it did not cause any trouble on productive systems here. See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for further details. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ffba3c98bac2675f19f32541f5e1ebe61419e7bd Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Sep 10 16:21:24 2018 +0200 Unbound: Enable DNS cache poisoning mitigation By default, Unbound neither keeps track of the number of unwanted replies nor initiates countermeasures if they become too large (DNS cache poisoning). This sets the maximum number of tolerated unwanted replies to 1M, causing the cache to be flushed afterwards. (Upstream documentation recommends 10M as a threshold, but this turned out to be ineffective against attacks in the wild.) See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for details. This version of the patch uses 1M as threshold instead of 5M and supersedes the first and second version. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4ca0cb33543e780f02142cd70b18bb341d2eabad Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Sep 10 16:30:52 2018 +0100 core124: Ship updated redirect page template Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b67e79a4f15bcb8f2e9d525169d9c51611fe6c7e Author: Peter Müller <peter.mueller(a)link38.eu> Date: Mon Sep 10 16:15:44 2018 +0200 embed background image in redirect template Embed the IPFire background image into the redirect template directly via CSS instead of loading it from somewhere else. This is necessary because of Content Security Policy (CSP). This patch inserts the base64 encoded image during build so nothing needs to be updated twice in case background image changes. It supersedes first to fourth version of this patch and has been successfully tested during a clean build. Fixes #11650 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/124/filelists/files | 2 ++ config/rootfiles/core/124/update.sh | 1 + config/ssh/ssh_config | 33 +++++++++++++++++++++++ config/unbound/unbound.conf | 6 ++++- html/html/redirect-templates/legacy/template.html | 7 ++++- lfs/openssh | 5 ++++ lfs/web-user-interface | 5 ++++ 7 files changed, 57 insertions(+), 2 deletions(-) create mode 100644 config/ssh/ssh_config Difference in files: diff --git a/config/rootfiles/core/124/filelists/files b/config/rootfiles/core/124/filelists/files index 5cc19a8a5..cfd300dce 100644 --- a/config/rootfiles/core/124/filelists/files +++ b/config/rootfiles/core/124/filelists/files @@ -5,6 +5,7 @@ etc/rc.d/init.d/aws etc/rc.d/init.d/localnet etc/rc.d/init.d/partresize etc/sysctl.conf +etc/unbound/unbound.conf opt/pakfire/lib/functions.pl opt/pakfire/pakfire srv/web/ipfire/cgi-bin/firewall.cgi @@ -13,6 +14,7 @@ srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/index.cgi srv/web/ipfire/cgi-bin/pakfire.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi +srv/web/ipfire/html/redirect-templates/legacy/template.html usr/bin/install-bootloader usr/local/bin/backupiso usr/local/bin/rebuild-initrd diff --git a/config/rootfiles/core/124/update.sh b/config/rootfiles/core/124/update.sh index 5a92aa72d..59f1e8f55 100644 --- a/config/rootfiles/core/124/update.sh +++ b/config/rootfiles/core/124/update.sh @@ -50,6 +50,7 @@ ldconfig # Start services /etc/init.d/rngd restart /etc/init.d/ntp restart +/etc/init.d/unbound restart # Reload sysctl.conf sysctl -p diff --git a/config/ssh/ssh_config b/config/ssh/ssh_config new file mode 100644 index 000000000..2abfae6d1 --- /dev/null +++ b/config/ssh/ssh_config @@ -0,0 +1,33 @@ +# OpenSSH client configuration +# +# set some basic hardening options for all connections +Host * + # disable Roaming as it is known to be vulnerable + UseRoaming no + + # only use secure crypto algorithm + KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256 + Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr + MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com + + # always visualise server host keys (has no technical + # effect, but helps to identify key based MITM attacks) + VisualHostKey yes + + # use SSHFP (might work on some up-to-date networks) to look up host keys + VerifyHostKeyDNS yes + + # send keep-alive messages to connected server to avoid broken connections + ServerAliveInterval 10 + ServerAliveCountMax 6 + + # disable X11 forwarding (security risk) + ForwardX11 no + + # always check server IP address + CheckHostIP yes + + # ensure only allowed authentication methods are used + PreferredAuthentications publickey,keyboard-interactive,password + +# EOF diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 3f724d8f7..cda591dab 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -59,7 +59,11 @@ server: harden-below-nxdomain: yes harden-referral-path: yes harden-algo-downgrade: no - use-caps-for-id: no + use-caps-for-id: yes + aggressive-nsec: yes + + # Harden against DNS cache poisoning + unwanted-reply-threshold: 1000000 # Listen on all interfaces interface-automatic: yes diff --git a/html/html/redirect-templates/legacy/template.html b/html/html/redirect-templates/legacy/template.html index b5fb61ebe..297561e3a 100644 --- a/html/html/redirect-templates/legacy/template.html +++ b/html/html/redirect-templates/legacy/template.html @@ -3,11 +3,16 @@ <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ACCESS MESSAGE</title> + <style content="text/css"> + td.image { + background-image: url(data:image/gif;base64,IMAGEDATAPLACEHOLDER); + } + </style> </head> <body> <table width="100%" height='100%' border="0"> <tr> - <td colspan='3' width='100%' height='130' align="center" background="<TMPL_VAR NAME="ADDRESS">/images/background.gif"> + <td colspan='3' width='100%' height='152px' align="center" class="image"> </td> <tr> <td width='10%'> <td align='center' bgcolor='#CC000000' width='80%'> diff --git a/lfs/openssh b/lfs/openssh index a88b2d126..0e6acc227 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -100,5 +100,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_rsa_key$$|HostKey /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey /etc/ssh/ssh_host_rsa_key|' \ /etc/ssh/sshd_config + + # install custom OpenSSH client configuration + install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \ + /etc/ssh/ssh_config + @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/lfs/web-user-interface b/lfs/web-user-interface index 0c5688252..73aec3a8d 100644 --- a/lfs/web-user-interface +++ b/lfs/web-user-interface @@ -55,6 +55,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mkdir -p /var/updatecache/{download,metadata} cp -aR $(DIR_SRC)/html/* /srv/web/ipfire + # Add base64 encoded background image to Squid content access page + basedata="$$( base64 $(DIR_SRC)/html/html/images/background.gif | tr -d '\n' )"; \ + sed -i "s|IMAGEDATAPLACEHOLDER|$${basedata}|g" \ + /srv/web/ipfire/html/redirect-templates/legacy/template.html + # Change CONFIG_ROOT in cgi-scripts for i in /srv/web/ipfire/cgi-bin/{*,logs.cgi/*,vpn.cgi/*}; do \ if [ -f $$i ]; then \ hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a0d612be7ac96cff5dc988f89054db49420c14b8
by Michael Tremer 09 Sep '18

09 Sep '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a0d612be7ac96cff5dc988f89054db49420c14b8 (commit) from 505b886d0d8cbe5448a9998ff88c6636b8e50245 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a0d612be7ac96cff5dc988f89054db49420c14b8 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 9 18:27:56 2018 +0100 core124: Rebuild initrd This script was missing in the last update and therefore no microcodes were included. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/124/filelists/files | 1 + config/rootfiles/core/124/update.sh | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) Difference in files: diff --git a/config/rootfiles/core/124/filelists/files b/config/rootfiles/core/124/filelists/files index 823355f2b..5cc19a8a5 100644 --- a/config/rootfiles/core/124/filelists/files +++ b/config/rootfiles/core/124/filelists/files @@ -15,6 +15,7 @@ srv/web/ipfire/cgi-bin/pakfire.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/bin/install-bootloader usr/local/bin/backupiso +usr/local/bin/rebuild-initrd var/ipfire/backup/exclude var/ipfire/backup/include var/ipfire/langs diff --git a/config/rootfiles/core/124/update.sh b/config/rootfiles/core/124/update.sh index 80eca4ceb..5a92aa72d 100644 --- a/config/rootfiles/core/124/update.sh +++ b/config/rootfiles/core/124/update.sh @@ -54,6 +54,9 @@ ldconfig # Reload sysctl.conf sysctl -p +# rebuild initrd to add early microcode updates +rebuild-initrd + # Remove deprecated GRUB configuration option if [ -e "/etc/default/grub" ]; then sed -e "/^GRUB_FONT/d" -i /etc/default/grub @@ -78,4 +81,3 @@ sync # Don't report the exitcode last command exit 0 - hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 505b886d0d8cbe5448a9998ff88c6636b8e50245
by Michael Tremer 09 Sep '18

09 Sep '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 505b886d0d8cbe5448a9998ff88c6636b8e50245 (commit) via d5fe33228311d47490536bee370297a7c735f9d6 (commit) via 65ae069c213a7fcd36d7857b15d863804984948d (commit) via fd0a0384f07b399e9cb4cf46b4c5722b809ffe6a (commit) from 3da2a66193ce8e3f92d3c29be95a4076a4fa0274 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 505b886d0d8cbe5448a9998ff88c6636b8e50245 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 9 17:48:14 2018 +0100 core124: Apply changed sysctl.conf Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d5fe33228311d47490536bee370297a7c735f9d6 Author: Peter Müller <peter.mueller(a)link38.eu> Date: Thu Aug 16 17:29:58 2018 +0200 do not expose kernel address spaces even to privileged users Change this setting from 1 to 2 so kernel addresses are not displayed even if a user has CAPS_SYSLOG privileges. See also: - https://lwn.net/Articles/420403/ - https://tails.boum.org/contribute/design/kernel_hardening/ Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 65ae069c213a7fcd36d7857b15d863804984948d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 9 17:43:53 2018 +0100 core124: Ship updated rng-tools Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit fd0a0384f07b399e9cb4cf46b4c5722b809ffe6a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Sep 9 17:42:17 2018 +0100 rng-tools: Update to 6.4 Also add a patch that keeps RDRAND enabled on i586 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Fixes: #11853 ----------------------------------------------------------------------- Summary of changes: config/etc/sysctl.conf | 2 +- config/rootfiles/core/124/filelists/files | 1 + .../{oldcore/121 => core/124}/filelists/rng-tools | 0 config/rootfiles/core/124/update.sh | 4 +++ lfs/rng-tools | 5 ++-- .../rng-tools-6-Enable-RDRAND-for-i586-too.patch | 35 ++++++++++++++++++++++ 6 files changed, 44 insertions(+), 3 deletions(-) copy config/rootfiles/{oldcore/121 => core/124}/filelists/rng-tools (100%) create mode 100644 src/patches/rng-tools-6-Enable-RDRAND-for-i586-too.patch Difference in files: diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 011c4287e..345f8f52a 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -44,7 +44,7 @@ net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0 # Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). -kernel.kptr_restrict = 1 +kernel.kptr_restrict = 2 # Avoid kernel memory address exposures via dmesg. kernel.dmesg_restrict = 1 diff --git a/config/rootfiles/core/124/filelists/files b/config/rootfiles/core/124/filelists/files index 320d2808d..823355f2b 100644 --- a/config/rootfiles/core/124/filelists/files +++ b/config/rootfiles/core/124/filelists/files @@ -4,6 +4,7 @@ etc/rc.d/helper/aws-setup etc/rc.d/init.d/aws etc/rc.d/init.d/localnet etc/rc.d/init.d/partresize +etc/sysctl.conf opt/pakfire/lib/functions.pl opt/pakfire/pakfire srv/web/ipfire/cgi-bin/firewall.cgi diff --git a/config/rootfiles/core/124/filelists/rng-tools b/config/rootfiles/core/124/filelists/rng-tools new file mode 120000 index 000000000..a7853e41b --- /dev/null +++ b/config/rootfiles/core/124/filelists/rng-tools @@ -0,0 +1 @@ +../../../common/rng-tools \ No newline at end of file diff --git a/config/rootfiles/core/124/update.sh b/config/rootfiles/core/124/update.sh index 471667a12..80eca4ceb 100644 --- a/config/rootfiles/core/124/update.sh +++ b/config/rootfiles/core/124/update.sh @@ -48,8 +48,12 @@ ldconfig /usr/local/bin/update-lang-cache # Start services +/etc/init.d/rngd restart /etc/init.d/ntp restart +# Reload sysctl.conf +sysctl -p + # Remove deprecated GRUB configuration option if [ -e "/etc/default/grub" ]; then sed -e "/^GRUB_FONT/d" -i /etc/default/grub diff --git a/lfs/rng-tools b/lfs/rng-tools index c7a358e56..dc87a3406 100644 --- a/lfs/rng-tools +++ b/lfs/rng-tools @@ -24,7 +24,7 @@ include Config -VER = 6.3.1 +VER = 6.4 THISAPP = rng-tools-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = fe2d38e39ff02d0c7b3585407d51dc64 +$(DL_FILE)_MD5 = 52a8243858503f94eecd4ae0983a9818 install : $(TARGET) @@ -70,6 +70,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/rng-tools-6-Enable-RDRAND-for-i586-too.patch cd $(DIR_APP) && ./autogen.sh cd $(DIR_APP) && ./configure --prefix=/usr cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) diff --git a/src/patches/rng-tools-6-Enable-RDRAND-for-i586-too.patch b/src/patches/rng-tools-6-Enable-RDRAND-for-i586-too.patch new file mode 100644 index 000000000..7d45bd0b8 --- /dev/null +++ b/src/patches/rng-tools-6-Enable-RDRAND-for-i586-too.patch @@ -0,0 +1,35 @@ +From 1f023b49959aa58246e6bb7091ba7710116f6915 Mon Sep 17 00:00:00 2001 +From: Michael Tremer <michael.tremer(a)ipfire.org> +Date: Sun, 9 Sep 2018 17:29:15 +0100 +Subject: [PATCH] Enable RDRAND for i586, too + +IPFire is being compiled for i586 omitting some instructions +for i686. However, RDRAND is available on some systems and +can of course be used. + +Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> + +Pull request sent: https://github.com/nhorman/rng-tools/pull/31 + +--- + configure.ac | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/configure.ac b/configure.ac +index faba7cc9857e..716175328ff6 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -53,8 +53,8 @@ AC_CHECK_TOOLS([AR], [ar gar], :) + + AX_PTHREAD + +-AM_CONDITIONAL([RDRAND], [test $target_cpu = x86_64 -o $target_cpu = i686]) +-AS_IF([test $target_cpu = x86_64 -o $target_cpu = i686], [AC_DEFINE([HAVE_RDRAND],1,[Enable RDRAND])],[]) ++AM_CONDITIONAL([RDRAND], [test $target_cpu = x86_64 -o $target_cpu = i686 -o $target_cpu = i586]) ++AS_IF([test $target_cpu = x86_64 -o $target_cpu = i686 -o $target_cpu = i586], [AC_DEFINE([HAVE_RDRAND],1,[Enable RDRAND])],[]) + + AM_CONDITIONAL([DARN], [test $target_cpu = powerpc64le]) + AS_IF([test $target_cpu = powerpc64le], [AC_DEFINE([HAVE_DARN],1,[Enable DARN])],[]) +-- +2.17.1 + hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 3da2a66193ce8e3f92d3c29be95a4076a4fa0274
by Michael Tremer 31 Aug '18

31 Aug '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 3da2a66193ce8e3f92d3c29be95a4076a4fa0274 (commit) from fd313a1ae690ce95d91802fea0d94d85da084fd8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3da2a66193ce8e3f92d3c29be95a4076a4fa0274 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Aug 31 11:08:53 2018 +0100 aws: Don't update the system on first boot This will violate AWS policy and therefore had to be removed. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: src/initscripts/helper/aws-setup | 12 ------------ 1 file changed, 12 deletions(-) Difference in files: diff --git a/src/initscripts/helper/aws-setup b/src/initscripts/helper/aws-setup index b2bb5a966..e3f1d0a9f 100644 --- a/src/initscripts/helper/aws-setup +++ b/src/initscripts/helper/aws-setup @@ -98,18 +98,6 @@ import_aws_configuration() { # Download the user-data script only on the first boot if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then - # Initialize pakfire - /etc/init.d/pakfire start &>/dev/null - - # Install all available updates - ( pakfire update && pakfire upgrade -y ) &>/dev/null - - # If an update requires a reboot, we will do it - if [ -e "/var/run/need_reboot" ]; then - reboot - exit 1 - fi - # Download user-data local user_data="$(get user-data)" hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. fd313a1ae690ce95d91802fea0d94d85da084fd8
by Arne Fitzenreiter 29 Aug '18

29 Aug '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via fd313a1ae690ce95d91802fea0d94d85da084fd8 (commit) via 574a71177b9c209fb8ebcbe4528b37fe1cf0dc8f (commit) via e5eedea01de6e70c0440f0c97e418ca053382424 (commit) via 1ce35de5cc9c35a7deb95733e161b248a5cf0a64 (commit) via a019c963a2bc232a381aefbafc260b3ea3bf4f2b (commit) via 66c449c053c9e059f04e28d0ccad74840f1a528e (commit) via b38239f90715974b7744499cb65c97b961fb6ff4 (commit) via ee84b26a271139cd37fb361db9fbed21b894ffec (commit) from aa61d769b7f5eca23c7744590dfa18c1ef1d7c36 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fd313a1ae690ce95d91802fea0d94d85da084fd8 Merge: aa61d769b 574a71177 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed Aug 29 07:43:06 2018 +0200 Merge branch 'master' into next ----------------------------------------------------------------------- Summary of changes: config/rootfiles/oldcore/123/filelists/files | 2 ++ config/rootfiles/oldcore/{100 => 123}/filelists/i586/openssl-sse2 | 0 config/rootfiles/oldcore/{121 => 123}/filelists/xtables-addons | 0 config/rootfiles/oldcore/123/update.sh | 3 +++ lfs/intel-microcode | 6 +++--- lfs/linux | 2 +- 6 files changed, 9 insertions(+), 4 deletions(-) copy config/rootfiles/oldcore/{100 => 123}/filelists/i586/openssl-sse2 (100%) copy config/rootfiles/oldcore/{121 => 123}/filelists/xtables-addons (100%) Difference in files: diff --git a/config/rootfiles/oldcore/123/filelists/files b/config/rootfiles/oldcore/123/filelists/files index 3ff006fe5..e2be472f6 100644 --- a/config/rootfiles/oldcore/123/filelists/files +++ b/config/rootfiles/oldcore/123/filelists/files @@ -13,6 +13,8 @@ srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/local/bin/backupiso +usr/lib/libssp.so.0 +usr/lib/libssp.so.0.0.0 usr/sbin/dhclient usr/share/GeoIP/GeoIP.dat var/ipfire/backup/bin/backup.pl diff --git a/config/rootfiles/oldcore/123/filelists/i586/openssl-sse2 b/config/rootfiles/oldcore/123/filelists/i586/openssl-sse2 new file mode 120000 index 000000000..f424713d6 --- /dev/null +++ b/config/rootfiles/oldcore/123/filelists/i586/openssl-sse2 @@ -0,0 +1 @@ +../../../../common/i586/openssl-sse2 \ No newline at end of file diff --git a/config/rootfiles/oldcore/123/filelists/xtables-addons b/config/rootfiles/oldcore/123/filelists/xtables-addons new file mode 120000 index 000000000..2e24c4298 --- /dev/null +++ b/config/rootfiles/oldcore/123/filelists/xtables-addons @@ -0,0 +1 @@ +../../../common/xtables-addons \ No newline at end of file diff --git a/config/rootfiles/oldcore/123/update.sh b/config/rootfiles/oldcore/123/update.sh index 76eff74bb..964a23862 100644 --- a/config/rootfiles/oldcore/123/update.sh +++ b/config/rootfiles/oldcore/123/update.sh @@ -34,6 +34,9 @@ done # Stop services /etc/init.d/squid stop +# remove old xtables modules / some are renamend +rm -rf /lib/xtables + # Extract files extract_files diff --git a/lfs/intel-microcode b/lfs/intel-microcode index 349f3667c..217bc9850 100644 --- a/lfs/intel-microcode +++ b/lfs/intel-microcode @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2016 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 20180807 +VER = 20180807a THISAPP = microcode-$(VER) DL_FILE = $(THISAPP).tgz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 49f534f1079d3c5bc178a150c1c105aa +$(DL_FILE)_MD5 = b12f8680d87c81a302e8c85712ed1a80 install : $(TARGET) diff --git a/lfs/linux b/lfs/linux index 5e7b334cd..003c477f6 100644 --- a/lfs/linux +++ b/lfs/linux @@ -194,7 +194,7 @@ else ifeq "$(BUILD_PLATFORM)" "arm" cd $(DIR_APP) && make $(MAKETUNING) dtbs mkdir -p /boot/dtb-$(VER)-$(VERSUFIX) - cd $(DIR_APP)/arch/$(HEADERS_ARCH)/boot/dts && for f in $$(find -name *.dtb); do \ + cd $(DIR_APP)/arch/$(KERNEL_ARCH)/boot/dts && for f in $$(find -name "*.dtb"); do \ cp -v --parents $$f /boot/dtb-$(VER)-$(VERSUFIX)/ ; \ chmod 644 /boot/dtb-$(VER)-$(VERSUFIX)/$$f ; \ done hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 574a71177b9c209fb8ebcbe4528b37fe1cf0dc8f
by Arne Fitzenreiter 29 Aug '18

29 Aug '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 574a71177b9c209fb8ebcbe4528b37fe1cf0dc8f (commit) from e5eedea01de6e70c0440f0c97e418ca053382424 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 574a71177b9c209fb8ebcbe4528b37fe1cf0dc8f Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Aug 28 12:39:08 2018 +0200 kernel: fix dtb handling Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/linux | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/lfs/linux b/lfs/linux index 5e7b334cd..003c477f6 100644 --- a/lfs/linux +++ b/lfs/linux @@ -194,7 +194,7 @@ else ifeq "$(BUILD_PLATFORM)" "arm" cd $(DIR_APP) && make $(MAKETUNING) dtbs mkdir -p /boot/dtb-$(VER)-$(VERSUFIX) - cd $(DIR_APP)/arch/$(HEADERS_ARCH)/boot/dts && for f in $$(find -name *.dtb); do \ + cd $(DIR_APP)/arch/$(KERNEL_ARCH)/boot/dts && for f in $$(find -name "*.dtb"); do \ cp -v --parents $$f /boot/dtb-$(VER)-$(VERSUFIX)/ ; \ chmod 644 /boot/dtb-$(VER)-$(VERSUFIX)/$$f ; \ done hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core123, updated. 574a71177b9c209fb8ebcbe4528b37fe1cf0dc8f
by Arne Fitzenreiter 29 Aug '18

29 Aug '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core123 has been updated via 574a71177b9c209fb8ebcbe4528b37fe1cf0dc8f (commit) from e5eedea01de6e70c0440f0c97e418ca053382424 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 574a71177b9c209fb8ebcbe4528b37fe1cf0dc8f Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Aug 28 12:39:08 2018 +0200 kernel: fix dtb handling Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/linux | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/lfs/linux b/lfs/linux index 5e7b334cd..003c477f6 100644 --- a/lfs/linux +++ b/lfs/linux @@ -194,7 +194,7 @@ else ifeq "$(BUILD_PLATFORM)" "arm" cd $(DIR_APP) && make $(MAKETUNING) dtbs mkdir -p /boot/dtb-$(VER)-$(VERSUFIX) - cd $(DIR_APP)/arch/$(HEADERS_ARCH)/boot/dts && for f in $$(find -name *.dtb); do \ + cd $(DIR_APP)/arch/$(KERNEL_ARCH)/boot/dts && for f in $$(find -name "*.dtb"); do \ cp -v --parents $$f /boot/dtb-$(VER)-$(VERSUFIX)/ ; \ chmod 644 /boot/dtb-$(VER)-$(VERSUFIX)/$$f ; \ done hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. aa61d769b7f5eca23c7744590dfa18c1ef1d7c36
by Michael Tremer 27 Aug '18

27 Aug '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via aa61d769b7f5eca23c7744590dfa18c1ef1d7c36 (commit) via 06d55142e51b270d3f7f4e8ee69cc6260e87b3f7 (commit) via e32591e7bfa07c5d72688cf37d86df0bea6740f6 (commit) from 973ffc2987afd070c95974bbebfd5c3973ca3db0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit aa61d769b7f5eca23c7744590dfa18c1ef1d7c36 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Aug 27 07:34:28 2018 +0100 core124: Ship latest pakfire changes Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 06d55142e51b270d3f7f4e8ee69cc6260e87b3f7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Aug 27 07:29:19 2018 +0100 pakfire: Remove any reference to counter.py The concept has been retired a very log time ago and the web service only responds with 200 what ever it is being sent. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e32591e7bfa07c5d72688cf37d86df0bea6740f6 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Aug 27 07:23:03 2018 +0100 pakfire: Remove mirror health check This is not really necessary because pakfire will automatically failover to the next mirror anyways and that a mirror responds to an ICMP echo request doesn't necessarily mean that it can deliver the requested file. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/124/filelists/files | 3 + html/cgi-bin/pakfire.cgi | 11 --- src/pakfire/lib/functions.pl | 122 ++++++++---------------------- src/pakfire/pakfire | 1 - 4 files changed, 33 insertions(+), 104 deletions(-) Difference in files: diff --git a/config/rootfiles/core/124/filelists/files b/config/rootfiles/core/124/filelists/files index 7093d0de8..320d2808d 100644 --- a/config/rootfiles/core/124/filelists/files +++ b/config/rootfiles/core/124/filelists/files @@ -4,10 +4,13 @@ etc/rc.d/helper/aws-setup etc/rc.d/init.d/aws etc/rc.d/init.d/localnet etc/rc.d/init.d/partresize +opt/pakfire/lib/functions.pl +opt/pakfire/pakfire srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/fwhosts.cgi srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/index.cgi +srv/web/ipfire/cgi-bin/pakfire.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/bin/install-bootloader usr/local/bin/backupiso diff --git a/html/cgi-bin/pakfire.cgi b/html/cgi-bin/pakfire.cgi index 143f123b7..79ff636c8 100644 --- a/html/cgi-bin/pakfire.cgi +++ b/html/cgi-bin/pakfire.cgi @@ -43,7 +43,6 @@ $pakfiresettings{'VALID'} = ''; $pakfiresettings{'INSPAKS'} = ''; $pakfiresettings{'DELPAKS'} = ''; $pakfiresettings{'AUTOUPDATE'} = 'off'; -$pakfiresettings{'HEALTHCHECK'} = 'on'; $pakfiresettings{'UUID'} = 'on'; sub refreshpage{&Header::openbox( 'Waiting', 1, "<meta http-equiv='refresh' content='1;'>" );print "<center><img src='/images/clock.gif' alt='' /><br/><font color='red'>$Lang::tr{'pagerefresh'}</font></center>";&Header::closebox();} @@ -163,9 +162,6 @@ my %checked=(); $checked{'AUTOUPDATE'}{'off'} = ''; $checked{'AUTOUPDATE'}{'on'} = ''; $checked{'AUTOUPDATE'}{$pakfiresettings{'AUTOUPDATE'}} = "checked='checked'"; -$checked{'HEALTHCHECK'}{'off'} = ''; -$checked{'HEALTHCHECK'}{'on'} = ''; -$checked{'HEALTHCHECK'}{$pakfiresettings{'HEALTHCHECK'}} = "checked='checked'"; $checked{'UUID'}{'off'} = ''; $checked{'UUID'}{'on'} = ''; $checked{'UUID'}{$pakfiresettings{'UUID'}} = "checked='checked'"; @@ -292,13 +288,6 @@ print <<END; <tr><td align='left' width='45%'>$Lang::tr{'pakfire update daily'}</td><td width="55%" align="left"> on <input type='radio' name='AUTOUPDATE' value='on' $checked{'AUTOUPDATE'}{'on'} /> | <input type='radio' name='AUTOUPDATE' value='off' $checked{'AUTOUPDATE'}{'off'} /> off </td></tr> - <tr><td align='left' width='45%'>$Lang::tr{'pakfire health check'}</td><td align="left"> - on <input type='radio' name='HEALTHCHECK' value='on' $checked{'HEALTHCHECK'}{'on'} /> | - <input type='radio' name='HEALTHCHECK' value='off' $checked{'HEALTHCHECK'}{'off'} /> off </td></tr> - <tr><td align='left' width='45%'>$Lang::tr{'pakfire register'}</td><td align="left"> - on <input type='radio' name='UUID' value='on' $checked{'UUID'}{'on'} /> | - <input type='radio' name='UUID' value='off' $checked{'UUID'}{'off'} /> off </td></tr> - <tr><td colspan="2" align="center"><input type="submit" name="ACTION" value="$Lang::tr{'save'}" /></td></tr> </table> </form> END diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index dd4007a44..12a405bd7 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -118,20 +118,6 @@ sub usage { exit 1; } -sub pinghost { - my $host = shift; - - $p = Net::Ping->new("icmp"); - if ($p->ping($host)) { - logger("PING INFO: $host is alive"); - return 1; - } else { - logger("PING INFO: $host is unreachable"); - return 0; - } - $p->close(); -} - sub fetchfile { my $getfile = shift; my $gethost = shift; @@ -141,7 +127,7 @@ sub fetchfile { use File::Basename; $bfile = basename("$getfile"); - logger("DOWNLOAD STARTED: $getfile") unless ($bfile =~ /^counter\?.*/); + logger("DOWNLOAD STARTED: $getfile"); $i = 0; while (($allok == 0) && $i < 5) { @@ -159,9 +145,7 @@ sub fetchfile { $proto = "HTTP" unless $proto; - unless ($bfile =~ /^counter\?.*/) { - logger("DOWNLOAD INFO: Host: $host ($proto) - File: $file"); - } + logger("DOWNLOAD INFO: Host: $host ($proto) - File: $file"); my $ua = LWP::UserAgent->new; $ua->agent("Pakfire/$Conf::version"); @@ -171,10 +155,10 @@ sub fetchfile { &General::readhash("${General::swroot}/proxy/advanced/settings", \%proxysettings); if ($proxysettings{'UPSTREAM_PROXY'}) { - logger("DOWNLOAD INFO: Upstream proxy: \"$proxysettings{'UPSTREAM_PROXY'}\"") unless ($bfile =~ /^counter.py\?.*/); + logger("DOWNLOAD INFO: Upstream proxy: \"$proxysettings{'UPSTREAM_PROXY'}\""); if ($proxysettings{'UPSTREAM_USER'}) { $ua->proxy([["http", "https"] => "http://$proxysettings{'UPSTREAM_USER'}:$proxysettings{'UPSTREAM_PASSWORD'}@"."$proxysettings{'UPSTREAM_PROXY'}/"]); - logger("DOWNLOAD INFO: Logging in with: \"$proxysettings{'UPSTREAM_USER'}\" - \"$proxysettings{'UPSTREAM_PASSWORD'}\"") unless ($bfile =~ /^counter.py\?.*/); + logger("DOWNLOAD INFO: Logging in with: \"$proxysettings{'UPSTREAM_USER'}\" - \"$proxysettings{'UPSTREAM_PASSWORD'}\""); } else { $ua->proxy([["http", "https"] => "http://$proxysettings{'UPSTREAM_PROXY'}/"]); } @@ -193,19 +177,13 @@ sub fetchfile { } } - my $response; + my $result = $ua->head($url); + my $remote_headers = $result->headers; + $total_size = $remote_headers->content_length; + logger("DOWNLOAD INFO: $file has size of $total_size bytes"); - unless ($bfile =~ /^counter.py\?.*/) { - my $result = $ua->head($url); - my $remote_headers = $result->headers; - $total_size = $remote_headers->content_length; - logger("DOWNLOAD INFO: $file has size of $total_size bytes"); - - $response = $ua->get($url, ':content_cb' => \&callback ); - message(""); - } else { - $response = $ua->get($url); - } + my $response = $ua->get($url, ':content_cb' => \&callback ); + message(""); my $code = $response->code(); my $log = $response->status_line; @@ -217,31 +195,27 @@ sub fetchfile { } if ($response->is_success) { - unless ($bfile =~ /^counter.py\?.*/) { - if (open(FILE, ">$Conf::tmpdir/$bfile")) { - print FILE $final_data; - close(FILE); - logger("DOWNLOAD INFO: File received. Start checking signature..."); - if (&valid_signature("$Conf::tmpdir/$bfile")) { - logger("DOWNLOAD INFO: Signature of $bfile is fine."); - move("$Conf::tmpdir/$bfile","$Conf::cachedir/$bfile"); - } else { - message("DOWNLOAD ERROR: The downloaded file ($file) wasn't verified by IPFire.org. Sorry - Exiting..."); - my $ntp = `ntpdate -q -t 10 pool.ntp.org 2>/dev/null | tail -1`; - if ( $ntp !~ /time\ server(.*)offset(.*)/ ){message("TIME ERROR: Unable to get the nettime, this may lead to the verification error.");} - else { $ntp =~ /time\ server(.*)offset(.*)/; message("TIME INFO: Time Server$1has$2 offset to localtime.");} - exit 1; - } - logger("DOWNLOAD FINISHED: $file"); - $allok = 1; - return 0; + if (open(FILE, ">$Conf::tmpdir/$bfile")) { + print FILE $final_data; + close(FILE); + logger("DOWNLOAD INFO: File received. Start checking signature..."); + if (&valid_signature("$Conf::tmpdir/$bfile")) { + logger("DOWNLOAD INFO: Signature of $bfile is fine."); + move("$Conf::tmpdir/$bfile","$Conf::cachedir/$bfile"); } else { - logger("DOWNLOAD ERROR: Could not open $Conf::tmpdir/$bfile for writing."); + message("DOWNLOAD ERROR: The downloaded file ($file) wasn't verified by IPFire.org. Sorry - Exiting..."); + my $ntp = `ntpdate -q -t 10 pool.ntp.org 2>/dev/null | tail -1`; + if ( $ntp !~ /time\ server(.*)offset(.*)/ ){message("TIME ERROR: Unable to get the nettime, this may lead to the verification error.");} + else { $ntp =~ /time\ server(.*)offset(.*)/; message("TIME INFO: Time Server$1has$2 offset to localtime.");} + exit 1; } - } else { + logger("DOWNLOAD FINISHED: $file"); + $allok = 1; return 0; + } else { + logger("DOWNLOAD ERROR: Could not open $Conf::tmpdir/$bfile for writing."); } - } else { + } else { logger("DOWNLOAD ERROR: $log"); } } @@ -349,10 +323,8 @@ sub selectmirror { ### Choose a random server and test if it is online # If the check fails try a new server. # This will never give up. - my $found = 0; my $servers = 0; - my $pingdelay = 1; - while ($found == 0) { + while (1) { $server = int(rand($scount) + 1); $servers = 0; my ($line, $proto, $path, $host); @@ -364,22 +336,8 @@ sub selectmirror { $proto = $templine[0]; $host = $templine[1]; $path = $templine[2]; - if ($pakfiresettings{'HEALTHCHECK'} eq "off") { - logger("PING INFO: Healthcheck is disabled"); - $found = 1; - return ($proto, $host, $path); - } - elsif (pinghost("$host")) { - $found = 1; - return ($proto, $host, $path); - } - if ($found == 0) { - sleep($pingdelay); - $pingdelay=$pingdelay*2; - if ($pingdelay>1200) { - $pingdelay=1200; - } - } + + return ($proto, $host, $path); } } } @@ -789,9 +747,6 @@ sub setuppak { message("PAKFIRE INST: $pak: Copying files and running post-installation scripts..."); my $return = system("cd $Conf::tmpdir && NAME=$pak ./install.sh >> $Conf::logdir/install-$pak.log 2>&1"); $return %= 255; - if ($pakfiresettings{'UUID'} ne "off") { - fetchfile("counter.py?ver=$Conf::version&uuid=$Conf::uuid&ipak=$pak&return=$return", "$Conf::mainserver"); - } if ($return == 0) { move("$Conf::tmpdir/ROOTFILES", "$Conf::dbdir/rootfiles/$pak"); cleanup("tmp"); @@ -850,9 +805,6 @@ sub upgradepak { message("PAKFIRE UPGR: $pak: Upgrading files and running post-upgrading scripts..."); my $return = system("cd $Conf::tmpdir && NAME=$pak ./update.sh >> $Conf::logdir/update-$pak.log 2>&1"); $return %= 255; - if ($pakfiresettings{'UUID'} ne "off") { - fetchfile("counter.py?ver=$Conf::version&uuid=$Conf::uuid&upak=$pak&return=$return", "$Conf::mainserver"); - } if ($return == 0) { move("$Conf::tmpdir/ROOTFILES", "$Conf::dbdir/rootfiles/$pak"); cleanup("tmp"); @@ -875,9 +827,6 @@ sub removepak { message("PAKFIRE REMV: $pak: Removing files and running post-removing scripts..."); my $return = system("cd $Conf::tmpdir && NAME=$pak ./uninstall.sh >> $Conf::logdir/uninstall-$pak.log 2>&1"); $return %= 255; - if ($pakfiresettings{'UUID'} ne "off") { - fetchfile("counter.py?ver=$Conf::version&uuid=$Conf::uuid&dpak=$pak&return=$return", "$Conf::mainserver"); - } if ($return == 0) { unlink("$Conf::dbdir/rootfiles/$pak"); unlink("$Conf::dbdir/installed/meta-$pak"); @@ -924,17 +873,6 @@ sub makeuuid { } } -sub senduuid { - if ($pakfiresettings{'UUID'} ne "off") { - unless("$Conf::uuid") { - $Conf::uuid = `cat $Conf::dbdir/uuid`; - } - logger("Sending my uuid: $Conf::uuid"); - fetchfile("counter.py?ver=$Conf::version&uuid=$Conf::uuid", "$Conf::mainserver"); - system("rm -f $Conf::tmpdir/counter* 2>/dev/null"); - } -} - sub callback { my ($data, $response, $protocol) = @_; $final_data .= $data; diff --git a/src/pakfire/pakfire b/src/pakfire/pakfire index dfba91556..041ba669a 100644 --- a/src/pakfire/pakfire +++ b/src/pakfire/pakfire @@ -249,7 +249,6 @@ } elsif ("$ARGV[0]" eq "update") { &Pakfire::makeuuid(); - &Pakfire::senduuid(); &Pakfire::getmirrors("$force"); &Pakfire::dbgetlist("$force"); &Pakfire::getcoredb("$force"); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. e5eedea01de6e70c0440f0c97e418ca053382424
by Arne Fitzenreiter 24 Aug '18

24 Aug '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via e5eedea01de6e70c0440f0c97e418ca053382424 (commit) via 1ce35de5cc9c35a7deb95733e161b248a5cf0a64 (commit) via a019c963a2bc232a381aefbafc260b3ea3bf4f2b (commit) via 66c449c053c9e059f04e28d0ccad74840f1a528e (commit) via b38239f90715974b7744499cb65c97b961fb6ff4 (commit) via ee84b26a271139cd37fb361db9fbed21b894ffec (commit) from b211357dae62b44f53c88ded9de6d601c6a8acb8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e5eedea01de6e70c0440f0c97e418ca053382424 Merge: 1ce35de5c a019c963a Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Aug 24 20:22:05 2018 +0200 Merge branch 'core123' of git.ipfire.org:/pub/git/ipfire-2.x into core123 commit 1ce35de5cc9c35a7deb95733e161b248a5cf0a64 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Aug 24 20:19:29 2018 +0200 intel-microcode: update to 20180807a Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit a019c963a2bc232a381aefbafc260b3ea3bf4f2b Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Aug 20 16:23:49 2018 +0200 core123: ship libssp (was missing on x86_64) Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 66c449c053c9e059f04e28d0ccad74840f1a528e Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Aug 20 16:22:20 2018 +0200 gcc: x86_64 add libspp to rootfile Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit b38239f90715974b7744499cb65c97b961fb6ff4 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Aug 17 20:30:17 2018 +0200 core123: ship xtables-addons. xtables are build for installed iptables version so we need to ship it even if it was not updated. Also clean /lib/xtables because some modules are renamed. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit ee84b26a271139cd37fb361db9fbed21b894ffec Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Aug 17 07:06:45 2018 +0200 core123: ship openssl sse2 version on i586 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/x86_64/gcc | 4 ++-- config/rootfiles/core/123/filelists/files | 2 ++ .../rootfiles/{oldcore/100 => core/123}/filelists/i586/openssl-sse2 | 0 config/rootfiles/{oldcore/121 => core/123}/filelists/xtables-addons | 0 config/rootfiles/core/123/update.sh | 3 +++ lfs/intel-microcode | 6 +++--- 6 files changed, 10 insertions(+), 5 deletions(-) copy config/rootfiles/{oldcore/100 => core/123}/filelists/i586/openssl-sse2 (100%) copy config/rootfiles/{oldcore/121 => core/123}/filelists/xtables-addons (100%) Difference in files: diff --git a/config/rootfiles/common/x86_64/gcc b/config/rootfiles/common/x86_64/gcc index b461f6532..667ec9e49 100644 --- a/config/rootfiles/common/x86_64/gcc +++ b/config/rootfiles/common/x86_64/gcc @@ -1434,8 +1434,8 @@ usr/lib/libquadmath.so.0.0.0 #usr/lib/libssp.a #usr/lib/libssp.la #usr/lib/libssp.so -#usr/lib/libssp.so.0 -#usr/lib/libssp.so.0.0.0 +usr/lib/libssp.so.0 +usr/lib/libssp.so.0.0.0 #usr/lib/libssp_nonshared.a #usr/lib/libssp_nonshared.la #usr/lib/libstdc++.a diff --git a/config/rootfiles/core/123/filelists/files b/config/rootfiles/core/123/filelists/files index 3ff006fe5..e2be472f6 100644 --- a/config/rootfiles/core/123/filelists/files +++ b/config/rootfiles/core/123/filelists/files @@ -13,6 +13,8 @@ srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/local/bin/backupiso +usr/lib/libssp.so.0 +usr/lib/libssp.so.0.0.0 usr/sbin/dhclient usr/share/GeoIP/GeoIP.dat var/ipfire/backup/bin/backup.pl diff --git a/config/rootfiles/core/123/filelists/i586/openssl-sse2 b/config/rootfiles/core/123/filelists/i586/openssl-sse2 new file mode 120000 index 000000000..f424713d6 --- /dev/null +++ b/config/rootfiles/core/123/filelists/i586/openssl-sse2 @@ -0,0 +1 @@ +../../../../common/i586/openssl-sse2 \ No newline at end of file diff --git a/config/rootfiles/core/123/filelists/xtables-addons b/config/rootfiles/core/123/filelists/xtables-addons new file mode 120000 index 000000000..2e24c4298 --- /dev/null +++ b/config/rootfiles/core/123/filelists/xtables-addons @@ -0,0 +1 @@ +../../../common/xtables-addons \ No newline at end of file diff --git a/config/rootfiles/core/123/update.sh b/config/rootfiles/core/123/update.sh index 76eff74bb..964a23862 100644 --- a/config/rootfiles/core/123/update.sh +++ b/config/rootfiles/core/123/update.sh @@ -34,6 +34,9 @@ done # Stop services /etc/init.d/squid stop +# remove old xtables modules / some are renamend +rm -rf /lib/xtables + # Extract files extract_files diff --git a/lfs/intel-microcode b/lfs/intel-microcode index 349f3667c..217bc9850 100644 --- a/lfs/intel-microcode +++ b/lfs/intel-microcode @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2016 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 20180807 +VER = 20180807a THISAPP = microcode-$(VER) DL_FILE = $(THISAPP).tgz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 49f534f1079d3c5bc178a150c1c105aa +$(DL_FILE)_MD5 = b12f8680d87c81a302e8c85712ed1a80 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM