From 16c4d42b2fe26697e96a46286ba396b0df32709d Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Thu, 24 Sep 2026 23:13:10 +0000 Subject: [PATCH] Update the changelog for the packaging, FreeBSD log and Windows directory fixes --- CHANGELOG.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7db20493..a6e6a245 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -385,11 +385,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 built. It picked the most recently modified `fips_*.deb` in the output directory that sorted last by name, so a package with a higher version left there by an earlier run was returned instead. +- Purging the `.deb`, or running `uninstall.sh` from the tarball, now removes + the `.fips` DNS routing when `fips-dns` was not running at the time. The + cleanup removed the dns-delegate file from the wrong directory, never removed + the systemd-resolved global drop-in, and restarted no resolver, so the host + kept sending `.fips` queries to `[::1]:5354`, where nothing listens any more, + and `.fips` lookups timed out. Both scripts now remove all four files + `fips-dns-setup` can write, and restart systemd-resolved or reload dnsmasq or + NetworkManager when they removed that resolver's file and it is running. A + failed restart is reported and does not fail the removal. +- The `.deb` now recommends `nftables`. `fips-firewall.service` runs + `/usr/sbin/nft`, so enabling it on a host without nftables failed at start. + It is a recommendation rather than a dependency because the firewall unit is + opt-in and the daemon itself does not need `nft`. #### Packaging (AUR) - The release `PKGBUILD` now lists `dbus` as a runtime dependency. The `fips` binary links `libdbus-1`, and the `fips-git` package already declared it. +- Both `PKGBUILD` files list `nftables` as an optional dependency, for + `fips-firewall.service`. + +#### Packaging (FreeBSD) + +- The daemon's log, `/var/log/fips.log`, is now rotated. The package ships a + newsyslog entry that keeps five compressed generations of 1000 KB, and the rc + script starts `daemon(8)` with `-H` so it reopens the log after a rotation. + The log used to grow without bound. + +#### Windows + +- Windows now keeps its config, key, hosts and peer ACL files in + `C:\ProgramData\fips`, the directory the service installer writes to. The + config search, the key directory and the peer ACL defaults disagreed: the + service found none of the installed files after a reboot and ran on + defaults, `fipsctl keygen` wrote to the per-user `%APPDATA%\fips`, and a + `peers.deny` placed beside the hosts file was never read, so the ACL failed + open. A key left in `%APPDATA%\fips` is still used when the new directory + has none, with a note to move it. For one release, a `peers.allow` or + `peers.deny` left at the old `\etc\fips` location is still read when the + new directory has no such file, with a warning naming both paths. +- The Windows service now writes its log to `C:\ProgramData\fips\fips.log`, + rolled at 10 MiB with four old files kept. A service has no standard output, + so everything the daemon logged in service mode was lost, including + config-load failures and panic messages. A foreground run still logs to the + console. +- The Windows service installer now restricts `C:\ProgramData\fips` to + SYSTEM and Administrators. The directory inherited `C:\ProgramData`'s + default ACL, which lets any local user read the files in it and create new + ones, so any local account could read the node's key, or create a missing + `fips.key`, `fips.yaml` or `hosts` that the service then used. The installer + creates the directory with the restricted ACL, or replaces the ACL of an + existing one, resets the files already in it to inherit it, and refuses to + continue if the directory or anything in it is a link or a folder, or if the + directory is owned by another account. Rerun the installer after moving files + into the directory. A foreground run from an unelevated prompt can no longer + read the files there. ## [0.5.1] - 2026-09-06