Tests:
- Without patch, disable bind. Incrementing the app's version number results in
bind getting started.
- With patch, disable bind. Incrementing the app's version number does not
result in bind getting started.
- Without patch, disable bind. Update forwarders. Bind is running again.
- With patch, disable bind. Update forwarders. Bind is not running again.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Before this change, when bind is disabled, dns port is removed from firewall
causing all 'shared' connection to not be able to resolve domains. This was
because no other application was declaring a need for 'dns' port to be kept
open. Declare a firewall component in the networks app needing 'dns' and 'dhcp'
services on the internal networks.
Tests:
- Without the patch, install and disable bind. 'dns' port is removed from
'internal' zone of the firewall.
- Install and disable bind. 'dns' port is not removed from 'internal' zone of
the firewall.
- On a fresh Debian machine. Install the freedombox package. 'http', 'https',
'dns' and 'dhcp' port are opened on the firewall as expected.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- To complete the provisioning process with container script and vagrant.
Tests:
- Start a fresh testing container, it should succeed. systemd-resolved is
running and resolving queries.
- Start a fresh stable container, it should succeed. systemd-resolved is running
and resolving queries.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Tests:
- Without the patch, start the service and dismiss the privacy notification.
With the patch, the restart the service. Privacy app is updated and privacy
notification is shown again. Incrementing the version number of the privacy app
does not result in showing of the notification again.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Using public DNS servers leads to user's domain queries being known to the
servers, violating privacy. However, it is necessary to address many corner
cases when DNS servers are not known to systemd-resolved but internet
connectivity is working. Allow users to disable fallback DNS servers.
Tests:
- After upgrade to latest version of FreedomBox, the setting is on by default.
- Disabling removes the /etc configuration file and resolvectl shows no fallback
DNS entries.
- Enabling add the /etc configuration file and resolvectl shows fallback
entries. After removing existing DNS servers using resolvectl, one can still
query using fallback servers.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- This avoids using fallback DNS servers in systemd-resolved soon after
systemd-resolved takes over /etc/resolv.conf and if network-manager knows some
DNS servers from the connections it has established.
- Version for the names app has already been incremented in this patch series.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Disable mDNS resolution. While we can migrate our DNS-SD service definition
files to systemd-resolved and switch from using avahi to systemd-resolved, many
programs still solely depend on avahi-daemon. Examples include cups and GNOME.
It is not clear if they will work any mDNS daemon or if they interact with
avahi-daemon in other ways that the mDNS protocol. So, for now, disable mDNS in
systemd-resolved and continue to use avahi-daemon for it. This is also Fedora's
default.
- Re-introduce Fallback DNS servers with the value same as the upstream systemd
project. Debian removes the default fallback DNS servers likely because they
could be considered a privacy violation. However, when systemd-resolved package
is first installed, the post install script recommends a reboot instead of
feeding the currently configured nameservers from /etc/resolve.conf into
systemd-resolved. Immediately, this causes the system not be able to connect to
any external servers. While this may be acceptable solution for interactive
systems and pre-built images, FreedomBox has to a) be available for remote
access b) perform upgrades without user intervention (and without reboot until a
day). To mitigate privacy concerns, an option to disable these fallback servers
will be provided in the UI.
- systemd-resolved's stub resolver runs on 127.0.0.53%lo:53 and 127.0.0.54. This
does not conflict either with shared connections which listen on 10.42.x.1 or
with bind which listens on 127.0.0.1 (and other IP addresses). This MR does not
address the existing conflict between bind and shared network connections.
However, it does not cause any further conflicts.
Tests:
* mDNS
- Avahi diagnostics works. daemon is running. mdns port is exposed in the
firewall.
- systemd-resolved does not listen on mDNS ports.
- Running avahi-browse shows freedombox on local network.
- Running avahi-browse shows the services ssh, sftp-ssh, http and ejabberd.
- Machine can be discovered in Gnome Files.
* NetworkManager shared connections
- After install/upgrade to systemd-resolved, 'shared' connections can be
created.
- With a 'shared' connection configured and active, it is possible to upgrade to
using systemd-resolved.
- Resolving domains from a machine on shared network goes via systemd-resolved
on FreedomBox.
* Bind
- Installing, running tests on bind works.
- Programs connecting from outside network can connect to bind as expected.
- Programs connecting from local machine can connect to bind as expected.
* Upgrading works
- Upgrading to new FreedomBox package works
- systemd-resolved is installed and running. 'resolvectl' shows a proper name
server (or fallback nameserver like 1.1.1.1).
- libnss-resolve is installed and configured in /etc/nsswitch.conf
- /etc/resolv.conf has proper link to /run/systemd/resolve/stub-resolv.conf.
- Programs using /etc/resolv.conf directly work. Install python3-pycares.
python3 -m pycares freedombox.org.
- NetworkManager has passed on proper DNS entries. In logs dns=systemd-resolved,
rc-manager=unmanaged, plugin=systemd-resolved
- DNS resolution works after first setup. Installing packages works.
- 'resolvectl query' resolution works.
- Programs using glibc API resolution such as 'ping' work.
* Fresh image
- Building an image with new freedombox package works without error.
- Booting from fresh images works.
- systemd-resolved is installed and running. 'resolvectl' show proper name
server.
- libnss-resolve is installed and configured in /etc/nsswitch.conf
- /etc/resolv.conf has proper link to /run/systemd/resolve/stub-resolv.conf
- Programs using /etc/resolv.conf directly work. Install python3-pycares.
python3 -m pycares wikipedia.org
- NetworkManager has passed on proper DNS entries. In logs dns=systemd-resolved,
rc-manager=unmanaged, plugin=systemd-resolved
- DNS resolution works after first setup. Installing packages works.
* Installing package on Debian
- Installing new freedombox package in Debian machine works.
- systemd-resolved is installed and running.
- libnss-resolve is installed and configured.
- /etc/resolv.conf has proper link to /run
- NetworkManager has passed on proper DNS entries to systemd-resolved using
'nmcli reload dns-rc'.
- Resolution works with fallback DNS servers when network interfaces are
configured with /etc/network/interfaces
* OpenVPNs works
- As a server, we don't push DNS servers to the client. So, a client continues
to use its old DNS servers. With systemd-resolved running on server, the client
is able to connect to OpenVPN server, route traffic to the internet, and resolve
DNS queries.
* WireGuard works
- As a server, we can't push DNS servers to the client. So, a client continues
to use its old DNS servers. With systemd-resolved running on server, the client
is able to connect to WireGuard server, route traffic to the internet, and
resolve DNS queries.
- As a client, server does not push DNS servers to the client. So, a client
continues to use its old DNS servers. With systemd-resolved running on the
client, the client is able to connect to WireGuard server, route traffic to the
internet, and resolve DNS queries.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
On systems where the grub-pc package is not available (e.g. ARM),
dpkg-query will have an exit status of 1. Handle the error that is
raised in this case.
Tests:
- Added unit tests for storage._diagnose_grub_configured.
- Tested on Raspberry Pi 4.
Closes: #2441
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Closes: #2405.
- When Django module is mocked, there are some cases where modules using django
can't be imported due to errors.
- To fix that, don't mock the django module and require django and related
Debian packages to be installed on the system generate developer documentation.
- Initialize django in Sphinx configuration to allow django modules to be
imported without errors.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Fixes#2420.
Tests performed using Debian stable:
- Set user language to espanol. Install, repair and remove gitweb app.
Check that all app operation messages are in spanish.
- All unit tests pass.
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Closes: Debian bug #1069240
Closes: Debian bug #877935
- libnss-gw-name resolves 'gateway.localhost' to the ip address currently
configured as default route. This has been abandoned upstream[2], deprecated in
Debian[1]. Using libnss-myhostname (part of systemd) instead is recommended[2].
- libnss-gw-name has been removed from testing and unstable. Installing
freedombox package in these distributions no longer installs the libnss-gw-name
package but freedombox installation succeeds as this is only a recommends.
Latest images don't contain the libnss-gw-name package either.
- We already recommend libnss-myhostname and this package is typically installed
along with freedombox package.
- libnss-myhostname resolves '_gateway' where as libnss-gw-name resolves
'gateway.localhost'. This is technically a breaking change. However, we have
neither used nor documented gateway resolution on FreedomBox machines. So, any
disruption is likely minimal.
Tests:
- On a FreedomBox container, running 'ping _gateway' shows that it resolves to
the same IP address as default route shown in 'ip route'.
Links:
1) https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#deprecated-components
2) https://github.com/nomeata/libnss-gw-name
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Add a new diagnostic check result for skipped tests.
Tests:
- Put a hold on a package. The diagnostic is failed.
- Remove the hold from the package. The diagnostic is passed.
- Start installing an app, then immediately run the upgrades
diagnostics. The diagnostic is skipped.
Helps: #2347
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Allow i18n for new state 'skipped']
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Closes: Debian bug #961733.
- The version of Linux kernel supported in FreedomBox is from Debian Bookworm
and that is 6.1, released on Sun, 11 Dec 2022[4][5].
- Around 2014, in Linux kernel version 5.4, a way to extract entropy from CPU
execution jitter every second was implemented. This is similar to
HAVAGE/havaged's approach[1][2]. This ensures that user space applications never
hang indefinitely when entropy is not available.
- Since 2020, /dev/random only blocks until it is initialized and after that
never blocks. It provides cryptographically secure psuedo-random numbers after
initialization (which is believed to be as good as blocking pool even for
security sensitive applications). This the same behavior as getrandom() call[6].
This means that even on embedded systems, haveged is not necessary once the
initialization of the random pool has been completed.
- Since Feb/Mar 2022, /dev/urandom no longer provides insecure random
numbers[3]. Earlier, if it was used before full initialization, it provided
insecure random numbers. Now it blocks the caller until initialization and then
provides cryptographically secure pseudo-random numbers. The initialization
itself won't take too much time due to the "Jitter Dance" technique of
extracting entropy from CPU execution jitter. The only way to request for
insecure random number (without even blocking for 1 second) is to use
getrandom(GRND_INSECURE) which systemd uses to initialize hash tables. This
change was reverted because Jitter Dance did not work on several architectures
including arm[3]. Later it was added back as an opportunistic approach, where
secure random numbers would be provided by urandom if Jitter Dance worked.
- Git repository for haveged mentions that it is less relevant now[7]. It also
lists circumstances where haveged might still help (old kernels, user-space RNG,
additional source of entry and early boot). Of these, only early boot scenario is
of interest for us.
- In summary, the understanding of relevance of haveged is as follows:
Request Random Number
---------------------
Is this during initialization of the random pool?
No:
- Linux never blocks after initialization. It uses CSPRNG now instead of
blocking for entropy.
Yes:
Is this for secure purposes?
No:
- It does not block and provides insecure (or secure in most practical
cases) numbers with getrandom(GRND_INSECURE), used by systemd hash tables,
etc.
Yes:
Does the architecture provide hardware random numbers?
Yes:
- Use RDSEED (Intel/AMD) CPU instruction or HWRNG (SOCs) to initialize the
random pool.
- If on virtual machine, use virtio-rng, ACPI VM ID, etc. to initialize the
random pool.
No:
Is this on architectures with time stamp counter?
Yes:
- The system will block for 1-2 seconds and provide secure random numbers
using "Jitter Dance" (similar to haveged).
- ARMv7 (Allwinner A20, etc.) the lowest ARM architecture we support,
seems to have time stamp counters but we not sure kernel uses it and
implements "Jitter Dance".
No:
- On urandom, The system will not block and provide insecure random
numbers. This is as per the original definition of /dev/urandom.
- The system will block until entropy is available through interrupts,
etc.
- haveged will likely not help here because it also requires time stamp
counter provided by CPU.
Links:
1) https://lwn.net/Articles/802360/
2) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=50ee7529ec45
3) https://www.zx2c4.com/projects/linux-rng-5.17-5.18/
4) https://lkml.org/lkml/2022/12/11/206
5) https://packages.debian.org/search?searchon=names&keywords=linux-image-6.1.0
6) https://lwn.net/Articles/808575/
7) https://github.com/jirka-h/haveged
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
- Create new policy that allows forwarding between zones.
See: https://bugzilla.redhat.com/show_bug.cgi?id=2016864#c8
- Increment version to perform setup on upgrade.
Closes: #2355
Tests:
- Build freedombox package, and install on top of Bookworm VM The
firewall setup is performed. firewall-cmd lists the fbx_int_to_ext_fwd
policy, masquerade on external zone, and forward on internal zone.
Not tested:
- I did not test forwarding traffic from external to internal zone.
However, several users have reported following these instructions on
the forum, and that it solved the issue for them.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Minor refactors for readability]
[sunil: Ensure that operation is idempotent]
[sunil: Reload instead of restarting firewalld]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
If the GRUB install device has not been selected, then grub package
configuration will fail during upgrades.
Tests:
- Install freedombox package with this change in a VM. Check that the
diagnostic is passed.
- Re-install the grub-pc package with DEBIAN_FRONTEND set to
noninteractive, so that it fails to be configured. Check that the
diagnostic is failed.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- All forms are rendered using django-bootstrap-form excep the
app enable/disable form. Render this one too using django-boostrap-form so that
the default.html is not used for rendering. Using default.html is deprecated in
Django 4.0 and in 5.0 will default to using div.html.
Tests:
- No change in HTML output, appearance or functionality for the enable/disable
button.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
