Development November 2017

development@lists.ipfire.org

15 participants
68 discussions

[PATCH] change Apache TLS cipher list to "Mozilla Modern"
by Peter Müller 07 Nov '17

07 Nov '17

Change the TLS cipher list of Apache to "Mozilla Modern". ECDSA is preferred over RSA to save CPU time on both server and client. Clients without support for TLS 1.2 and AES will experience connection failures. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/httpd/vhosts.d/ipfire-interface-ssl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index c9ccd5be5..d08d3d2bb 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -9,7 +9,7 @@ TransferLog /var/log/httpd/access_log SSLEngine on SSLProtocol all -SSLv2 -SSLv3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA + SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256 SSLHonorCipherOrder on SSLCertificateFile /etc/httpd/server.crt SSLCertificateKeyFile /etc/httpd/server.key -- 2.13.6

2 1

[PATCH] display GeoIP information on ipinfo.cgi
by Peter Müller 07 Nov '17

07 Nov '17

Display GeoIP flag on ipinfo.cgi in the WebUI. This might make firewall rule debugging easier and fixes bug #10946. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/ipinfo.cgi | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/ipinfo.cgi b/html/cgi-bin/ipinfo.cgi index 16541f126..689d05a0e 100644 --- a/html/cgi-bin/ipinfo.cgi +++ b/html/cgi-bin/ipinfo.cgi @@ -21,6 +21,7 @@ use CGI; use IO::Socket; +use Geo::IP::PurePerl; use strict; # enable only the following on debugging purpose @@ -30,6 +31,7 @@ use strict; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; my %cgiparams=(); @@ -49,6 +51,11 @@ if (&General::validip($addr)) { my $iaddr = inet_aton($addr); my $hostname = gethostbyaddr($iaddr, AF_INET); if (!$hostname) { $hostname = $Lang::tr{'lookup failed'}; } + + my $gi = Geo::IP::PurePerl->new(); + my $ccode = $gi->country_code_by_name($addr); + my $fcode = lc($ccode); + my $flag_icon = &GeoIP::get_flag_icon($fcode); my $sock = new IO::Socket::INET ( PeerAddr => $whoisname, PeerPort => 43, Proto => 'tcp'); if ($sock) @@ -81,7 +88,7 @@ if (&General::validip($addr)) { @lines = ( "$Lang::tr{'unable to contact'} $whoisname" ); } - &Header::openbox('100%', 'left', $addr . ' (' . $hostname . ') : '.$whoisname); + &Header::openbox('100%', 'left', $addr . " <a href='country.cgi#$fcode'><img src='$flag_icon' border='0' align='absmiddle' title='$ccode' /></a> (" . $hostname . ') : '.$whoisname); print "<pre>\n"; foreach my $line (@lines) { print &Header::cleanhtml($line,"y"); -- 2.13.6

1 0

Updated Apache configuration
by Wolfgang Apolinarski 07 Nov '17

07 Nov '17

Hi! This last patch is just a suggestion on how an apache configuration based on the Mozilla suggestion would look like. It includes a 4096-bit DH parameter that is used instead of the one defined in RFC 5144. Generating the DH parameter has been the suggested approach by the weakdh-team. Of course, as already discussed, this would be the standard parameter for IPFire, then, similar as the already chosen EC curve and similar to the standard parameters defined in RFC 5144. Best regards, Wolfgang

3 3

[PATCH] Network-functions: add check if variables are defined
by Alexander Marx 07 Nov '17

07 Nov '17

in function network_equal and network2bin a check for undefined variables were missing. added them. --- config/cfgroot/network-functions.pl | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index 93b8190..9e50d7c 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -108,10 +108,14 @@ sub network_equal { my $network1 = shift; my $network2 = shift; - my $bin1 = &network2bin($network1); - my $bin2 = &network2bin($network2); + my @bin1 = &network2bin($network1); + my @bin2 = &network2bin($network2); - if ($bin1 eq $bin2) { + if(!defined $bin1 || !defined $bin2){ + return undef; + } + + if ($bin1[0] eq $bin2[0] && $bin1[1] eq $bin2[1]){ return 1; } @@ -132,6 +136,10 @@ sub network2bin($) { my $address_bin = &ip2bin($address); my $netmask_bin = &ip2bin($netmask); + + if (!defined $address_bin || !defined $netmask_bin){ + return undef; + } my $network_start = $address_bin & $netmask_bin; @@ -457,7 +465,7 @@ sub testsuite() { assert(!$result); $result = &network_equal("192.168.0.1/24", "192.168.0.XXX/24"); - assert($result); + assert(!$result); $result = &ip_address_in_network("10.0.1.4", "10.0.0.0/8"); assert($result); -- 2.7.4

2 1

[PATCH] BUG11466: Fix network_equal function
by Alexander Marx 07 Nov '17

07 Nov '17

The network_equal function only tested the subnet addresses of two given networks which lead to errormessages saying "This is the green network" The fix tests netwok and subnet IP's to fix this --- config/cfgroot/network-functions.pl | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index 93b8190..25f9af1 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -108,10 +108,10 @@ sub network_equal { my $network1 = shift; my $network2 = shift; - my $bin1 = &network2bin($network1); - my $bin2 = &network2bin($network2); + my @bin1 = &network2bin($network1); + my @bin2 = &network2bin($network2); - if ($bin1 eq $bin2) { + if ($bin1[0] eq $bin2[0] && $bin1[1] eq $bin2[1]) { return 1; } @@ -457,7 +457,7 @@ sub testsuite() { assert(!$result); $result = &network_equal("192.168.0.1/24", "192.168.0.XXX/24"); - assert($result); + assert(!$result); $result = &ip_address_in_network("10.0.1.4", "10.0.0.0/8"); assert($result); -- 2.7.4

1 0

Question regarding patch ee328f16bfceacd30361ad0f562929ebe88b9363
by Peter Müller 06 Nov '17

06 Nov '17

Hello Arne, sorry for dropping in here. Looking at the ipfire-2.x git repository (and the planet note for the Core Update 116 testing), I assume commit ee328f16bfceacd30361ad0f562929ebe88b9363 should read "openssl" instead of "openssh". Or am I missing something? Just curious. :-) Best regards, Peter Müller

2 1

[PATCH] link to HTTPS version of www.ipfire.org in WebUI
by Peter Müller 06 Nov '17

06 Nov '17

Change links to www.ipfire.org in WebUI themes since the website now uses HTTPS. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/html/themes/darkdos/include/functions.pl | 2 +- html/html/themes/ipfire-legacy/include/functions.pl | 2 +- html/html/themes/ipfire/include/functions.pl | 6 +++--- html/html/themes/maniac/include/functions.pl | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/html/html/themes/darkdos/include/functions.pl b/html/html/themes/darkdos/include/functions.pl index 7d803b6ad..ed3f546b0 100644 --- a/html/html/themes/darkdos/include/functions.pl +++ b/html/html/themes/darkdos/include/functions.pl @@ -227,7 +227,7 @@ END if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; } else { - print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />"; + print "<h1><span><a href='https://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />"; } print <<END <h2>+ $h2 +</h2> diff --git a/html/html/themes/ipfire-legacy/include/functions.pl b/html/html/themes/ipfire-legacy/include/functions.pl index 528825329..26a8763c1 100644 --- a/html/html/themes/ipfire-legacy/include/functions.pl +++ b/html/html/themes/ipfire-legacy/include/functions.pl @@ -227,7 +227,7 @@ END if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; } else { - print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>IPFire</a></span></h1><br />"; + print "<h1><span><a href='https://www.ipfire.org' style='text-decoration: none;'>IPFire</a></span></h1><br />"; } print <<END <h2>$h2</h2> diff --git a/html/html/themes/ipfire/include/functions.pl b/html/html/themes/ipfire/include/functions.pl index 7f6000a46..9aec77497 100644 --- a/html/html/themes/ipfire/include/functions.pl +++ b/html/html/themes/ipfire/include/functions.pl @@ -152,7 +152,7 @@ print <<END <body> <div id="header" class="fixed"> <div id="logo"> - <a href="http://www.ipfire.org" style="text-decoration: none;"> + <a href="https://www.ipfire.org" style="text-decoration: none;"> <img src="/themes/ipfire/images/tux2.png" style="float:left; margin-left: -3px; margin-top: -3px;"/> END ; @@ -205,8 +205,8 @@ print <<END; <div id="footer" class='bigbox fixed'> <span class="pull-right"> - <a href="http://www.ipfire.org/" target="_blank"><strong>IPFire.org</strong></a> • - <a href="http://www.ipfire.org/donate" target="_blank">$Lang::tr{'support donation'}</a> + <a href="https://www.ipfire.org/" target="_blank"><strong>IPFire.org</strong></a> • + <a href="https://www.ipfire.org/donate" target="_blank">$Lang::tr{'support donation'}</a> </span> <strong>$system_release</strong> diff --git a/html/html/themes/maniac/include/functions.pl b/html/html/themes/maniac/include/functions.pl index 4866fcd0c..1c0aea1c4 100644 --- a/html/html/themes/maniac/include/functions.pl +++ b/html/html/themes/maniac/include/functions.pl @@ -227,7 +227,7 @@ END if ($settings{'WINDOWWITHHOSTNAME'} eq 'on') { print "<h1><span>$settings{'HOSTNAME'}.$settings{'DOMAINNAME'}</span></h1><br />"; } else { - print "<h1><span><a href='http://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />"; + print "<h1><span><a href='https://www.ipfire.org' style='text-decoration: none;'>-= IPFire =-</a></span></h1><br />"; } print <<END <h2>+ $h2 +</h2> -- 2.13.6

2 1

[PATCH] Tor: Use relay mode as default setting
by Peter Müller 06 Nov '17

06 Nov '17

Set the default operating mode to "relay" in the Tor WebUI configuration page. Running a Tor exit relay may cause legal trouble in some countries and should not be the default setting to prevent users from accidentally running an exit router. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/tor.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index fbad2d4d9..0d235c949 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -106,7 +106,7 @@ if (&Header::blue_used()) { } $settings{'TOR_RELAY_ENABLED'} = 'off'; -$settings{'TOR_RELAY_MODE'} = 'exit'; +$settings{'TOR_RELAY_MODE'} = 'relay'; $settings{'TOR_RELAY_ADDRESS'} = ''; $settings{'TOR_RELAY_PORT'} = 9001; $settings{'TOR_RELAY_DIRPORT'} = 0; -- 2.13.6

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2017