The forthcoming update, IPFire 2.27 - Core Update 175, is available for testing! Most noteworthy, it updates OpenSSL to the 3.1.0 branch, features a kernel update as well as other package updates and a variety of bug fixes are also included in this update.
IPFire makes heavy use of this cryptography library, which is why keeping it up to date (without causing any interference to existing installations) is an important task for the development team. Core Update 175 updates OpenSSL to version 3.1.1, for which some work under the hood was necessary, such as ensuring all dependent packages were ready for using OpenSSL's API, which has changed from the 1.1.x series.
To avoid breaking any custom software IPFire users may run on their installations, OpenSSL 1.1.1's files remain untouched on existing installations until the release of Core Update 176. However, please note that OpenSSL 1.1.1 is scheduled for end of life on September 11, 2023, and ensure any custom changes are made compatible to OpenSSL 3.1.x as soon as possible.
This Core Update also features an update of the Linux kernel. Aside from the usual heap of hardware support improvements, bug fixes, and other improvements, this fixes CVE-2023-32233, a flaw in Linux' Netfilter subsystem permitting local privilege escalation; IPFire installations properly kept up-to-date are thus not considered to be affected. Nevertheless, IPFire users are advised to install Core Update 175 as soon as possible once released, and reboot their system afterwards.
The kernel now also supports the Armada 38X RTC (#12856) and Intel's XHCI USB Role Switch feature. In addition, IPFire now supports both the OrangePi R1 Plus LTS and NanoPi R2C (plus) SoC.
hostapdadd-on now enables QCA vendor extensions to
nl80211, improving performance and stability of WiFi networks provided by an IPFire system with Qualcomm and Atheros cards considerably.
- Legacy firewall rules for PPPoE/PPTP have been dropped, since they are no longer needed, and pose a security risk to IPFire installations with QMI enabled.
- In addition, any bogon filtering has been adjusted to no longer interfere with
184.108.40.206/4, used for multicasting services, such as IPTV.
rsnapshothas been contributed by Gerd Hoerst and Jon Murphy as a new add-on.
- Downloading large backup files will no longer trigger the OOM killer (#13096).
- The size of the boot partition has been extended to 512 MBytes, which is XFS' minimum requirement.
- Firmware files for APU1 boards are now provided again, to ensure
firmware-updatecan update even very outdated APU boards properly.
powertopadd-on has been removed, since it requires kernel functionalities which have been disabled due to security concerns in Core Update 171.
- CUPS' HTTPS websites are now properly accessible again (#12924).
dbusadd-on is now properly terminated after uninstallation (#13094).
- Robin Roevens contributed a patch for displaying the logs crated by Zabbix Agent in IPFire's web interface.
- Installation and removal procedure of the
alsaadd-on have seen notable improvements (#13087).
- FUSE mounts in BorgBackup are now working properly again (#13076).
- Updated packages:
bash5.2 (with patches 1 to 15),
newt0.52.23, OpenSSH 9.3p1,
sqlite3410200, Squid 5.9, Suricata 6.0.12,
- Updated add-ons:
bird2.0.12, ClamAV 1.1.0,
pmacct1.7.8, Postfix 3.8.0,
As always, we thank all people contributing to this release in whatever shape and form. Please help testing this update, especially if you are using exotic hardware, uncommon network setups, or add-ons, and provide feedback - which is absolutely essential to us.