Development December 2018

development@lists.ipfire.org

16 participants
39 discussions

[PATCH v2] fireinfo: support upstream proxy with authentication
by Peter Müller 11 Dec '18

11 Dec '18

Fireinfo could not send its profile to https://fireinfo.ipfire.org/ if the machine is behind an upstream proxy which requires username and password. This is fixed by tweaking urllib2's opening handler. To apply this on existing installations, the fireinfo package needs to be shipped during an update. The second version of this patch fixes bogus indention, assembles proxy authentication string more readable and preserves HTTP proxy handler. Fixes #11905 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- src/sendprofile | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) mode change 100644 => 100755 src/sendprofile diff --git a/src/sendprofile b/src/sendprofile old mode 100644 new mode 100755 index b836567..1f32440 --- a/src/sendprofile +++ b/src/sendprofile @@ -73,10 +73,21 @@ def send_profile(profile): request.add_header("User-Agent", "fireinfo/%s" % fireinfo.__version__) # Set upstream proxy if we have one. - # XXX this cannot handle authentication proxy = get_upstream_proxy() + if proxy["host"]: - request.set_proxy(proxy["host"], "http") + # handling upstream proxies with authentication is more tricky... + if proxy["user"] and proxy["pass"]: + prx_auth_string = "http://%s:%s@%s/" % (proxy["user"], proxy["pass"], proxy["host"]) + + proxy_handler = urllib2.ProxyHandler({'http': prx_auth_string}) + proxy_handler = urllib2.ProxyHandler({'https': prx_auth_string}) + auth = urllib2.HTTPBasicAuthHandler() + opener = urllib2.build_opener(proxy_handler, auth, urllib2.HTTPHandler) + urllib2.install_opener(opener) + else: + request.set_proxy(proxy["host"], "http") + request.set_proxy(proxy["host"], "https") try: urllib2.urlopen(request, timeout=60) -- 2.16.4

2 5

[PATCH] wget: Update to 1.20
by Matthias Fischer 11 Dec '18

11 Dec '18

For details see: https://savannah.gnu.org/forum/forum.php?forum_id=9310 Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/wget | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/lfs/wget b/lfs/wget index baa70a476..5ccb0029f 100644 --- a/lfs/wget +++ b/lfs/wget @@ -24,7 +24,7 @@ include Config -VER = 1.19.5 +VER = 1.20 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2db6f03d655041f82eb64b8c8a1fa7da +$(DL_FILE)_MD5 = 9f1515d083b769e9ff7642ce6016518e install : $(TARGET) @@ -71,19 +71,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/01-src_hosts_c_remove_void_assignment.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/02-src_version_h_add_header_guard.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/03-src_hsts_h_fix_header_guard.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/04-fix_unrecognized_command_line_option.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/05-Fix-RESOURCE-LEAK-in-ftp.c-found-by-Coverity.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/06-Fix-RESOURCE-LEAK-in-http.c-found-by-Coverity.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/07-Fix-RESOURCE-LEAK-in-http.c-found-by-Coverity.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/08-Fix-RESOURCE-LEAK-found-by-Coverity.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/09-Fix-potential-RESOURCE-LEAK-in-warc.c.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/wget/10-Fix-RESOURCE-LEAK-found-by-Coverity.patch - - cd $(DIR_APP) && autoreconf -fi - cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc \ -- 2.18.0

2 2

[PATCH] unbound: Update to 1.8.2
by Matthias Fischer 11 Dec '18

11 Dec '18

For details see: https://nlnetlabs.nl/projects/unbound/download/ Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 2232c6889..e02860487 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.0.1 +usr/lib/libunbound.so.8.0.2 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 8dfcfa3a0..3c876b79a 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ include Config -VER = 1.8.1 +VER = 1.8.2 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 00ce66e357fd2f969acf69008aa82a40 +$(DL_FILE)_MD5 = 3b2f1024df47ccc59a8100c3b40c6dc1 install : $(TARGET) -- 2.18.0

2 4

[PATCH] clamav: Update to 101.0
by Matthias Fischer 11 Dec '18

11 Dec '18

For details see: https://blog.clamav.net/ Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/clamav | 14 ++++++-------- lfs/clamav | 6 +++--- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index 2be31d5db..3f35f9b17 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -11,23 +11,21 @@ usr/bin/sigtool #usr/include/clamav.h #usr/lib/libclamav.la usr/lib/libclamav.so -usr/lib/libclamav.so.7 -usr/lib/libclamav.so.7.1.1 -#usr/lib/libclammspack.a +usr/lib/libclamav.so.9 +usr/lib/libclamav.so.9.0.0 #usr/lib/libclammspack.la usr/lib/libclammspack.so usr/lib/libclammspack.so.0 usr/lib/libclammspack.so.0.1.0 #usr/lib/libclamunrar.la usr/lib/libclamunrar.so -usr/lib/libclamunrar.so.7 -usr/lib/libclamunrar.so.7.1.1 +usr/lib/libclamunrar.so.9 +usr/lib/libclamunrar.so.9.0.0 #usr/lib/libclamunrar_iface.la usr/lib/libclamunrar_iface.so -usr/lib/libclamunrar_iface.so.7 -usr/lib/libclamunrar_iface.so.7.1.1 +usr/lib/libclamunrar_iface.so.9 +usr/lib/libclamunrar_iface.so.9.0.0 #usr/lib/pkgconfig/libclamav.pc -#usr/lib/pkgconfig/libclammspack.pc usr/sbin/clamd #usr/share/man/man1/clambc.1 #usr/share/man/man1/clamconf.1 diff --git a/lfs/clamav b/lfs/clamav index 420ee82b3..20ff9ddf3 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.100.2 +VER = 0.101.0 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 41 +PAK_VER = 42 DEPS = "" @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 253dd79dd57da759567e42543a569c5c +$(DL_FILE)_MD5 = 47c36d13ac814b9e29ed6f5fc1691373 install : $(TARGET) -- 2.18.0

2 1

[PATCH] OpenVPN: Calculate CIDR to DDN notation for RW
by Erik Kapfer 11 Dec '18

11 Dec '18

Fixes #11823 Patches enables CIDR and dotted-decimal notation for "OpenVPN subnet:" entries in "Global settings". --- html/cgi-bin/ovpnmain.cgi | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 976300fc7..7fd3e1d67 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -245,6 +245,7 @@ sub pkiconfigcheck sub writeserverconf { my %sovpnsettings = (); my @temp = (); + my @tempovpnsubnet = (); &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings); &read_routepushfile; @@ -267,8 +268,16 @@ sub writeserverconf { print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n"; print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n"; print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n"; - my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'}); - print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n"; + # ovpn subnet calculate prefix to netmask if needed + if ($sovpnsettings{'DOVPN_SUBNET'} ne '') { + my ($ip,$subnet) = split(/\//,"$vpnsettings{'DOVPN_SUBNET'}"); + if (&Network::check_prefix($subnet)) { + $subnet = &Network::convert_prefix2netmask($subnet); + print CONF "server $ip $subnet\n"; + } else { + print CONF "server $ip $subnet\n"; + } + } #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n"; # Check if we are using mssfix, fragment and set the corretct mtu of 1500. -- 2.12.2

2 2

Roadwarrior IPSec Revisitec
by Tom Rymes 10 Dec '18

10 Dec '18

Folks, I just revisited the IPSec roadwarrior configuration mess today, and I am hoping that I might be able to help in getting things squared away on that front. Configuring tunnels is a complete PITA for modern clients, and it pushes a lot of people over to OpenVPN because “IPSec is too complicated.” To summarize the current status, the Roadwarrior configs written by IPFire do not work with modern clients, and include outdated and deprecated IPSec settings. Combine that with the fact that each client seems to need its own unique combination of settings, and you get a big mess. So, my thought was to modify the vpnmain.cgi script such that it provides multiple options when creating tunnels. Currently, it asks if you want to create: - Host-to-Net Tunnel (Roadwarrior) - Net-to-Net Tunnel To replace this, I am envisioning: - Host-to-Net Tunnel - Windows Client - Host-to-Net Tunnel - MacOS Client - Host-to-Net Tunnel - iOS Client - Host-to-Net Tunnel - Android Client - Net-To Net Tunnel This would be a good start, but I am hoping to eventually be able to have the WUI write out the config such that one tunnel could service all clients (which is not easily achieved just yet). This would eliminate the need to have multiple types of roadwarrior setups. Checkboxes in the configuration page could be used to enable and disable different client OSes, as doing so can improve security (by disabling weaker ciphers, mostly). Once the WUi is modified to actually write out a config that works with modern clients, then I was thinking that creation of Windows install scripts and Apple Configuration Profiles would be a really nice feature if possible. Does anyone have any input? Tom

2 2

''backup.cgi' - new icons - new order - query for delete / translation strings
by Matthias Fischer 04 Dec '18

04 Dec '18

Hi, Something similar has been posted before ([PATCH] Cosmetics: New icons for backup.cgi), but unfortunately the discussion was not continued for very long. Triggered by: https://forum.ipfire.org/viewtopic.php?f=17&t=21372 and https://forum.ipfire.org/viewtopic.php?f=17&t=21882 I'd like to know whether there is any interest in developing this any further. In the meantime, patches were built for 'backup.cgi' which not only update the icons and their order of precedence for better readability and usability. In an additional step, the 'delete' icons got 'onclick'-confirmation boxes (by Erik!) to prevent accidental deletions. Another step could be to add this confirmation to other CGIs. This additional query could prevent some trouble in the future as it happened to the original poster of the second link above. He accidentally deleted an OVPN client. No query... I'm already testing this functionality in other contexts (e.g., firewall rules, dhcp, hosts) and it works. And the last question: each current lang file contains up to ~600 unused translation strings. These are summing up to about 5000 strings which are not used or duplicates and could be deleted. Current size of all lang files is 1.2MB - we actually need about 900KB. A current patch can be found here: https://git.ipfire.org/?p=people/ummeegge/ipfire-2.x.git;a=commit;h=acbf320… At the beginning of this year I built some patches for these unused strings and some other corrections (https://patchwork.ipfire.org/patch/1605/) but sadly got no reaction at all. Is there any interest, should we re-edit the unused translations? What do you think? Opinions and comments are welcome... Best, Matthias

3 2

Status emails and IP Blocklists
by Tim FitzGeorge 02 Dec '18

02 Dec '18

I've written a couple of addons for my installations of IPFire. They're available on github and some other people have tried them; they seem to be fairly well received and it's been suggested that it may be worth making them available through pakfire as official addons. The first addon provides the ability to send status emails. You can define multiple schedules and the items to be included in each email. By choosing parameters carefully it's possible to get it to send emails on some error conditions. The emails can be encrypted with GPG. The architecture makes it easy to add further items to be reported on. The second addon handles the setting up and updating of IP Address Blocklists in the firewall. It includes options to select which lists to use, and some control over how frequently to check for updates. Both include WUI pages for configuration and language files. They're fully functional, but would require some checking and minor updates. The source can be seen at https://github.com/timfprogs . I'm aware that there other people have made addons for both these purposes, which maybe suggests that it's functionality that is worth adding.

3 5

xiala.net announced shutdown
by Peter Müller 02 Dec '18

02 Dec '18

Hello, xiala.net has announced shutdown for all of its services, including public DNS resolvers. They have already been removed from https://wiki.ipfire.org/dns/public-servers ; please check any existing configuration and adjust it if necessary. Thanks, and best regards, Peter Müller -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development December 2018