Development October 2015

development@lists.ipfire.org

11 participants
48 discussions

[PATCH 1/2] Core94: fix update.sh for dma
by Alexander Marx 15 Oct '15

15 Oct '15

--- config/rootfiles/core/94/update.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/config/rootfiles/core/94/update.sh b/config/rootfiles/core/94/update.sh index 6560662..1b9eed7 100644 --- a/config/rootfiles/core/94/update.sh +++ b/config/rootfiles/core/94/update.sh @@ -70,6 +70,11 @@ EOF fcrontab -z &>/dev/null +# dma files +mkdir /etc/alternatives +mkdir /var/lib/alternatives +/usr/sbin/alternatives --install /usr/sbin/sendmail sendmail /usr/sbin/sendmail.dma 20 + # Start services /etc/init.d/dnsmasq start /etc/init.d/sshd start -- 1.9.1

2 3

[PATCH] xorg-x11-util-macros: Update to 0.19.0.
by Stefan Schantl 10 Oct '15

10 Oct '15

This is an update to the latest version of the xorg-x11-util-macros which are required by various X11 tools and wayland. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- xorg-x11-util-macros/xorg-x11-util-macros.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xorg-x11-util-macros/xorg-x11-util-macros.nm b/xorg-x11-util-macros/xorg-x11-util-macros.nm index 478570b..121c2c1 100644 --- a/xorg-x11-util-macros/xorg-x11-util-macros.nm +++ b/xorg-x11-util-macros/xorg-x11-util-macros.nm @@ -4,7 +4,7 @@ ############################################################################### name = xorg-x11-util-macros -version = 1.17 +version = 1.19.0 release = 1 arch = noarch -- 2.4.3

2 1

[PATCH] xcb-proto: Update to 1.11.
by Stefan Schantl 10 Oct '15

10 Oct '15

This is an update to the latest stable release to the xcb development headers. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- xcb-proto/xcb-proto.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xcb-proto/xcb-proto.nm b/xcb-proto/xcb-proto.nm index 787b8a2..bddbaa0 100644 --- a/xcb-proto/xcb-proto.nm +++ b/xcb-proto/xcb-proto.nm @@ -4,7 +4,7 @@ ############################################################################### name = xcb-proto -version = 1.8 +version = 1.11 release = 1 arch = noarch -- 2.4.3

2 1

[PATCH] icu: Update to version 56.1.
by Stefan Schantl 10 Oct '15

10 Oct '15

This is an update to the latest stable release. As a benefit of this, the brocken tests also are fixed. Fixes #10789 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- icu/icu.nm | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/icu/icu.nm b/icu/icu.nm index 116ed14..39b7b83 100644 --- a/icu/icu.nm +++ b/icu/icu.nm @@ -4,11 +4,11 @@ ############################################################################### name = icu -version = %{ver_major}.%{ver_minor}.%{ver_plevel} -ver_major = 50 +version = %{ver_major}.%{ver_minor} +ver_major = 56 ver_minor = 1 -ver_plevel = 2 -release = 3 +ver_plevel = +release = 1 groups = Development/Tools url = http://www.icu-project.org @@ -20,7 +20,7 @@ description end source_dl = http://download.icu-project.org/files/icu4c/%{version}/ -sources = icu4c-%{ver_major}_%{ver_minor}_%{ver_plevel}-src.tgz +sources = icu4c-%{ver_major}_%{ver_minor}-src.tgz build DIR_APP = %{DIR_SRC}/icu/source -- 2.4.3

2 1

[PATCH] tzdata: Update to version 2015g.
by Stefan Schantl 10 Oct '15

10 Oct '15

Fixes #10777. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- tzdata/tzdata.nm | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tzdata/tzdata.nm b/tzdata/tzdata.nm index 8a5abd3..c1554c1 100644 --- a/tzdata/tzdata.nm +++ b/tzdata/tzdata.nm @@ -3,12 +3,12 @@ # Copyright (C) - IPFire Development Team <info(a)ipfire.org> # ############################################################################### -tzdata_version = 2014j -tzcode_version = 2014j +tzdata_version = 2015g +tzcode_version = 2015g name = tzdata version = %{tzdata_version} -release = 2 +release = 1 arch = noarch groups = System/Base -- 2.4.3

2 1

[PATCH] less: Update to version 481
by Michael Tremer 10 Oct '15

10 Oct '15

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- less/less.nm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/less/less.nm b/less/less.nm index aa28d8b..8e9d543 100644 --- a/less/less.nm +++ b/less/less.nm @@ -4,7 +4,7 @@ ############################################################################### name = less -version = 458 +version = 481 release = 1 groups = Applications/Text -- 2.4.3

2 1

dhcpcd: Update to 6.9.3 - with or without '10-mtu'?
by Matthias Fischer 10 Oct '15

10 Oct '15

Hi list, I'd like to have a small problem, so I'm asking here before something goes bork...: ;-) I found this update for 'dhcpcd' to 6.9.3. So I decided to test it. Building was ok, but I'm not sure if the result would fit into our current IPFire builds. First, I had to disable a 'sed'-line in lfs-file, the file '10-mtu' is no longer included: ... sed -i -e "s|-ge 576|-gt 576|g" $(CONFIG_ROOT)/dhcpc/dhcpcd-hooks/10-mtu ... This is intentional by the programmer, source says in '/dhcpcd-hooks/Makefile': ... # We need to remove the old MTU change script if we at all can. rm -f ${DESTDIR}${SCRIPTSDIR}/10-mtu ... Accordingly, building stopped with a file-not-found error. After commenting the 'sed'-line, everything went ok, but '/var/ipfire/dhcpc/dhcpcd-hooks/10-mtu' is now missing. My questions: Do we really need this missing '10-mtu' file? Sorry if this is a dumb question, but I'm just not sure about the relationsships. Is a complete reboot required during an eventual upgrade? Or would it be sufficient to disconnect / connect / reboot network, whatever...? Thanks for any hints! Regards Matthias

2 1

[PATCH] ipsec: Add block rules to avoid conntrack entries
by Michael Tremer 04 Oct '15

04 Oct '15

If an IPsec VPN connections is not established, there are rare cases when packets are supposed to be sent through that said tunnel and incorrectly handled. Those packets are sent to the default gateway an entry for this connection is created in the connection tracking table (usually only happens to UDP). All following packets are sent the same route even after the tunnel has been brought up. That leads to SIP phones not being able to register among other things. This patch adds firewall rules that these packets are rejected. That will sent a notification to the client that the tunnel is not up and avoid the connection to be added to the connection tracking table. Apart from a small performance penalty there should be no other side-effects. Fixes: #10908 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Cc: tomvend(a)rymes.com Cc: daniel.weismueller(a)ipfire.org Cc: morlix(a)morlix.de --- config/firewall/ipsec-block | 59 +++++++++++++++++++++++++++++++++++ config/rootfiles/common/stage2 | 1 + config/rootfiles/common/x86_64/stage2 | 1 + lfs/stage2 | 2 ++ src/initscripts/init.d/firewall | 8 +++++ src/misc-progs/ipsecctrl.c | 4 +++ 6 files changed, 75 insertions(+) create mode 100644 config/firewall/ipsec-block diff --git a/config/firewall/ipsec-block b/config/firewall/ipsec-block new file mode 100644 index 0000000..9fa8e1a --- /dev/null +++ b/config/firewall/ipsec-block @@ -0,0 +1,59 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2015 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +VPN_CONFIG="/var/ipfire/vpn/config" + +block_subnet() { + local subnet="${1}" + + # Don't block a wildcard subnet + if [ "${subnet}" = "0.0.0.0/0" ] || [ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then + return 0 + fi + + iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable +} + +block_ipsec() { + # Flush all exists rules + iptables -F IPSECBLOCK + + local id status name lefthost type ctype unknown1 unknown2 unknown3 + local leftsubnets unknown4 righthost rightsubnets rest + while IFS="," read -r id status name lefthost type ctype unkown1 unknown2 unknown3 \ + leftsubnets unknown4 righthost rightsubnets rest; do + # Check if the connection is enabled + [ "${status}" = "on" ] || continue + + # Check if this a net-to-net connection + [ "${type}" = "net" ] || continue + + # Split multiple subnets + rightsubnets="${rightsubnets//\|/ }" + + local rightsubnet + for rightsubnet in ${rightsubnets}; do + block_subnet "${rightsubnet}" + done + done < "${VPN_CONFIG}" +} + +block_ipsec || exit $? diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index 90e28d9..4021caf 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -73,6 +73,7 @@ run #usr/lib usr/lib/firewall usr/lib/firewall/firewall-lib.pl +usr/lib/firewall/ipsec-block usr/lib/firewall/rules.pl #usr/lib/libgcc_s.so usr/lib/libgcc_s.so.1 diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index 0ac9ab5..531daaa 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -74,6 +74,7 @@ run #usr/lib usr/lib/firewall usr/lib/firewall/firewall-lib.pl +usr/lib/firewall/ipsec-block usr/lib/firewall/rules.pl #usr/lib/libgcc_s.so usr/lib/libgcc_s.so.1 diff --git a/lfs/stage2 b/lfs/stage2 index 3244fa3..ec5d117 100644 --- a/lfs/stage2 +++ b/lfs/stage2 @@ -114,6 +114,8 @@ endif /usr/lib/firewall/rules.pl install -m 644 $(DIR_SRC)/config/firewall/firewall-lib.pl \ /usr/lib/firewall/firewall-lib.pl + install -m 755 $(DIR_SRC)/config/firewall/ipsec-block \ + /usr/lib/firewall/ipsec-block # Nobody user -mkdir -p /home/nobody diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index 8ca02bc..2d462d7 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -115,6 +115,11 @@ iptables_init() { iptables -A INPUT -j GUARDIAN iptables -A FORWARD -j GUARDIAN + # Block non-established IPsec networks + iptables -N IPSECBLOCK + iptables -A FORWARD -m policy --dir out --pol none -j IPSECBLOCK + iptables -A OUTPUT -m policy --dir out --pol none -j IPSECBLOCK + # Block OpenVPN transfer networks iptables -N OVPNBLOCK iptables -A INPUT -i tun+ -j OVPNBLOCK @@ -270,6 +275,9 @@ iptables_init() { iptables -t nat -N REDNAT iptables -t nat -A POSTROUTING -j REDNAT + # Populate IPsec block chain + /usr/lib/firewall/ipsec-block + # Apply OpenVPN firewall rules /usr/local/bin/openvpnctrl --firewall-rules diff --git a/src/misc-progs/ipsecctrl.c b/src/misc-progs/ipsecctrl.c index e99202d..7499e94 100644 --- a/src/misc-progs/ipsecctrl.c +++ b/src/misc-progs/ipsecctrl.c @@ -144,6 +144,9 @@ void turn_connection_on(char *name, char *type) { "/usr/sbin/ipsec down %s >/dev/null", name); safe_system(command); + // Reload the IPsec block chain + safe_system("/usr/lib/firewall/ipsec-block >/dev/null"); + // Reload the configuration into the daemon (#10339). ipsec_reload(); @@ -302,6 +305,7 @@ int main(int argc, char *argv[]) { // start the system if ((argc == 2) && strcmp(argv[1], "S") == 0) { + safe_system("/usr/lib/firewall/ipsec-block >/dev/null"); safe_system("/usr/sbin/ipsec restart >/dev/null"); exit(0); } -- 2.4.4

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development October 2015