Development October 2015

development@lists.ipfire.org

11 participants
48 discussions

[ANNOUNCE] Good First Bugs
by Michael Tremer 16 Oct '15

16 Oct '15

Hello, as discussed at the IPFire Developer Summit 2015, we are now introducing "Good First Bugs". These are bugs tagged with the keyword "GoodFirstBug" and recommended for beginners to solve. They should help us to encourage more people to start development with IPFire and are tasks that should be resolvable in a reasonable amount of time. They usually should not require knowledge in any advanced programming languages. http://wiki.ipfire.org/devel/bugzilla/good-first-bug These bugs can be found by searching for the keyword on Bugzilla: https://bugzilla.ipfire.org/buglist.cgi?keywords=GoodFirstBug This message is to all the developers who should tag appropriate bugs as such, encourage people to take on a bug and mentor them if any help is needed. There will also be a post on the IPFire planet release some time next week to announce this to the people who are following our blog and other social media. http://planet.ipfire.org/post/good-first-bugs Best, -Michael

1 0

[PATCH] BUG10941: fix single ip-addresses when no subnet given
by Alexander Marx 16 Oct '15

16 Oct '15

Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> --- html/cgi-bin/routing.cgi | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/html/cgi-bin/routing.cgi b/html/cgi-bin/routing.cgi index c460a74..3b5a2f7 100644 --- a/html/cgi-bin/routing.cgi +++ b/html/cgi-bin/routing.cgi @@ -118,6 +118,11 @@ if ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) { } if ($settings{'ACTION'} eq $Lang::tr{'add'}) { + + if (!&Network::check_prefix($settings{'IP'})){ + $settings{'IP'} .= '/32'; + } + # Convert subnet masks to CIDR notation. $settings{'IP'} = &General::iporsubtocidr($settings{'IP'}); -- 1.9.1

3 3

RE: [PATCH] snort: Also monitor assigned alias addresses on red.
by Blago Culjak 16 Oct '15

16 Oct '15

Hello Stefan, Do you think if this fix for IDS on green is also possible? There are multiple topics on forum about this issue. IDS on green doesn't work. Poslano s mog Windows Phonea ________________________________ Šalje: Stefan Schantl<mailto:stefan.schantl@ipfire.org> Poslano: ‎16.‎10.‎2015. 18:49 Prima: development(a)lists.ipfire.org<mailto:development@lists.ipfire.org> Predmet: [PATCH] snort: Also monitor assigned alias addresses on red. These changes will allow snort to also inspect the traffic for one or more configured alias addresses, which has not been done in the past. The current situation is, that snort if enabled on red, only inspects the traffic which is desired to the statically configured red address. If some alias addresses have been assigned to the red interface the traffic to these addresses will not be checked by snort and completely bypasses the IDS. There is no user interaction required, nor visible-effects or any backward-compatiblity required, only a restart of snort after the update process to protect all red addresses. To do this we will now check if, the RED interface has been set to STATIC (which is required to use the aliases function) and any aliases have been configured. In case of this, the modified code will add all enabled alias addresses to the HOMENET variable in which snort is storing all the monitored addresses. Fixes #10619. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/init.d/snort | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/initscripts/init.d/snort b/src/initscripts/init.d/snort index e03c80f..58edf1e 100644 --- a/src/initscripts/init.d/snort +++ b/src/initscripts/init.d/snort @@ -20,6 +20,8 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/snort/settings) +ALIASFILE="/var/ipfire/ethernet/aliases" + case "$1" in start) if [ "$BLUE_NETADDRESS" ]; then @@ -59,6 +61,19 @@ case "$1" in if [ "$LOCAL_IP" ]; then HOMENET+="$LOCAL_IP," fi + + # Check if the red device is set to static and + # any aliases have been configured. + if [ "${RED_TYPE}" == "STATIC" ] && [ -s "${ALIASFILE}" ]; then + # Read in aliases file. + while IFS="," read -r address mode remark; do + # Check if the alias is enabled. + [ "${mode}" = "on" ] || continue + + # Add alias to the list of HOMENET addresses. + HOMENET+="${address}," + done < "${ALIASFILE}" + fi fi HOMENET+="127.0.0.1" echo "ipvar HOME_NET [$HOMENET]" > /etc/snort/vars -- 2.4.3

2 1

[PATCH] snort: Also monitor assigned alias addresses on red.
by Stefan Schantl 16 Oct '15

16 Oct '15

These changes will allow snort to also inspect the traffic for one or more configured alias addresses, which has not been done in the past. To do this we will now check if, the RED interface has been set to STATIC (which is required to use the aliases function) and any aliases have been configured. In case of this, the modified code will add all enabled alias addresses to the HOMENET variable in which snort is storing all the monitored addresses. Fixes #10619. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/init.d/snort | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/initscripts/init.d/snort b/src/initscripts/init.d/snort index e03c80f..47e7998 100644 --- a/src/initscripts/init.d/snort +++ b/src/initscripts/init.d/snort @@ -20,6 +20,8 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/snort/settings) +ALIASFILE="/var/ipfire/ethernet/aliases" + case "$1" in start) if [ "$BLUE_NETADDRESS" ]; then @@ -59,6 +61,19 @@ case "$1" in if [ "$LOCAL_IP" ]; then HOMENET+="$LOCAL_IP," fi + + # Check if the red device is set to static and + # any aliases have been configured. + if [ "$RED_TYPE" == "STATIC" ] && [ -s "${ALIASFILE}" ]; then + # Read in aliases file. + while IFS="," read -r address mode remark; do + # Check if the alias is enabled. + [ "${mode}" = "on" ] || continue + + # Add alias to the list of HOMENET addresses. + HOMENET+="${address}," + done < "${ALIASFILE}" + fi fi HOMENET+="127.0.0.1" echo "ipvar HOME_NET [$HOMENET]" > /etc/snort/vars -- 2.4.3

3 5

[PATCH] systemd: Enable build of compat libs.
by Stefan Schantl 16 Oct '15

16 Oct '15

Some software out there is still linking against the old systemd libraries which now are shipped in an own package. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- systemd/systemd.nm | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/systemd/systemd.nm b/systemd/systemd.nm index 7112a3c..7346c09 100644 --- a/systemd/systemd.nm +++ b/systemd/systemd.nm @@ -5,7 +5,7 @@ name = systemd version = 221 -release = 1 +release = 2 maintainer = Stefan Schantl <stefan.schantl(a)ipfire.org> groups = System/Base @@ -60,6 +60,7 @@ build --with-sysvrcnd-path= \ --enable-introspection \ --enable-zlib \ + --enable-compat-libs \ --disable-smack \ --disable-backlight \ --disable-firstboot \ @@ -358,9 +359,30 @@ packages end end + package %{name}-compat-libs + summary = systemd compatibility libraries. + description + Compatibility libraries for systemd. If your package requires this + package, you need to update your link options and build. + end + + requires + %{name}-libs = %{thisver} + end + + files + %{libdir}/libsystemd-daemon.so.* + %{libdir}/libsystemd-login.so.* + %{libdir}/libsystemd-journal.so.* + %{libdir}/libsystemd-id128.so.* + end + end + package %{name}-devel template DEVEL + requires += %{name}-compat-libs = %{thisver} + files += %{prefix}/lib/pakfire/macros/ end -- 2.4.3

2 3

[PATCH] IPSec VPN: Add "required" marker for "organization name"
by Lars Schuhmacher 16 Oct '15

16 Oct '15

IPSec VPN: Add "required" marker for "organization name" Fixes https://bugzilla.ipfire.org/show_bug.cgi?id=10846 Signed-off-by: Lars Schuhmacher <larsen007(a)web.de> --- html/cgi-bin/vpnmain.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index b697b0a..f1cffb8 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -2077,7 +2077,7 @@ END <td class='base'>$Lang::tr{'users department'}:</td> <td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' size='32' $cakeydisabled /></td></tr> <tr><td> </td> - <td class='base'>$Lang::tr{'organization name'}:</td> + <td class='base'>$Lang::tr{'organization name'}: <img src='/blob.gif' alt='*' /></td> <td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' size='32' $cakeydisabled /></td></tr> <tr><td> </td> <td class='base'>$Lang::tr{'city'}:</td>

3 2

Re: [PATCH] ipsec: Add block rules to avoid conntrack entries
by Michael Tremer 15 Oct '15

15 Oct '15

On Sun, 2015-10-04 at 12:25 -0400, Tom Rymes wrote: > On 10/03/2015 5:31 PM, Michael Tremer wrote: > > If an IPsec VPN connections is not established, there are > > rare cases when packets are supposed to be sent through > > that said tunnel and incorrectly handled. > > Michael, et. al.: > > I just posted a comment on the bug before I realized that e-mail > would > be more appropriate. > > My apologies for not being up to speed on this, but can you hold my > hand > on implementing this? I am simply not confident enough to apply these > changes without a better understanding of what I am doing. You got this already applied (at least the bare essence of that). I think we should wait for someone else to confirm that this is not crashing anything :) Since I emailed this patch I am still wondering if we should not limit this rule to the RED interface. We didn't do that when we tried all this on one of your machines ( https://bugzilla.ipfire.org/show_bug.cgi?id=10908#c16). It is an easier solution, but I am wondering if that does not have any side-effects... @Timo: You should use the Reviewed-by: tag then. Best, -Michael > > Thank you, > > Tom

2 2

[PATCH] Translation improvements
by Lars Schuhmacher 15 Oct '15

15 Oct '15

Translation improvements Signed-off-by: Lars Schuhmacher <larsen007(a)web.de> --- langs/de/cgi-bin/de.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index a3c8228..e952de2 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -2569,11 +2569,11 @@ 'urlfilter whitelist always allowed' => 'Erlaube angepasste Whitelist für gesperrte Clients', 'urlfilter wrong filetype' => 'Die Datei hat nicht die Erweiterung .tar.gz', 'use' => 'Einsatz', -'use a pre-shared key' => 'Verwenden Sie einen Pre-Shared Schlüssel:', +'use a pre-shared key' => 'Pre-Shared-Key verwenden:', 'use dov' => 'DOV (Data Over Voice) benutzen:', 'use ibod' => 'Bandwidth on Demand (iBOD) benutzen:', 'use ipfire red ip' => 'Die klassische ROTE IP, welche von IPFire während der Verbindung verwendet wird', -'use only proposed settings' => 'Verwenden Sie nur die vorgeschlagenen Einstellungen.', +'use only proposed settings' => 'Nur die vorgeschlagenen Einstellungen verwenden', 'used' => 'Benutzt', 'used memory' => 'Genutzter Speicher', 'used swap' => 'Genutzter Swap',

2 1

[PATCH] tor.cgi: Fix missing country flag icons.
by Stefan Schantl 15 Oct '15

15 Oct '15

The CGI now is using the GeoIP::get_flag_icon function provided by the geoip-functions.pl, which takes care of the changed flag icons shipped by core update 90. Fixes #10919. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Tested-by: Jan Paul Tuecking <jan.paul.tuecking(a)ipfire.org> --- html/cgi-bin/tor.cgi | 11 ++++++++--- lfs/tor | 2 +- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index 91f4b45..193e405 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -27,6 +27,7 @@ use warnings; use CGI::Carp 'fatalsToBrowser'; require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/geoip-functions.pl"; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; @@ -619,10 +620,14 @@ END END if (exists($node->{'country_code'})) { - if (!$node->{'country_code'} or $node->{'country_code'} eq '??') { - print "<img src='/images/flags/blank.png' border='0' align='absmiddle'/>"; + # Get the flag icon of the country. + my $flag_icon = &GeoIP::get_flag_icon($node->{'country_code'}); + + # Check if a flag for the given country is available. + if ($flag_icon) { + print "<a href='country.cgi#$node->{'country_code'}'><img src='$flag_icon' border='0' align='absmiddle' alt='$node->{'country_code'}'></a>"; } else { - print "<a href='country.cgi#$node->{'country_code'}'><img src='/images/flags/$node->{'country_code'}.png' border='0' align='absmiddle' alt='$node->{'country_code'}'></a>"; + print "<img src='/images/flags/blank.png' border='0' align='absmiddle'/>"; } } diff --git a/lfs/tor b/lfs/tor index c21e4b4..91eab09 100644 --- a/lfs/tor +++ b/lfs/tor @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 14 +PAK_VER = 15 DEPS = "" -- 2.4.3

2 1

[PATCH] snort: Update to 2.9.7.6
by Matthias Fischer 15 Oct '15

15 Oct '15

snort: Update to 2.9.7.6 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/ids.cgi | 4 ++-- lfs/snort | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index c7fc6c9..f17b16a 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -263,9 +263,9 @@ if (-e "/etc/snort/snort.conf") { ####################### End added for snort rules control ################################# if ($snortsettings{'RULES'} eq 'subscripted') { - $url=" https://www.snort.org/rules/snortrules-snapshot-2975.tar.gz?oinkcode=$snort…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-2976.tar.gz?oinkcode=$snort…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url=" https://www.snort.org/rules/snortrules-snapshot-2975.tar.gz?oinkcode=$snort…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-2976.tar.gz?oinkcode=$snort…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'community') { $url=" https://www.snort.org/rules/community"; } else { diff --git a/lfs/snort b/lfs/snort index e65cd63..a8318db 100644 --- a/lfs/snort +++ b/lfs/snort @@ -24,7 +24,7 @@ include Config -VER = 2.9.7.5 +VER = 2.9.7.6 THISAPP = snort-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = fd271788c0f8876be87a858a9142f202 +$(DL_FILE)_MD5 = 65349f3272c4de5b3210f77f1f7ab0e6 install : $(TARGET) -- 2.6.0

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development October 2015