Development January 2019

development@lists.ipfire.org

16 participants
57 discussions

[PATCH 1/2] Revert "GeoIP: Drop legacy GeoIP perl module."
by Stefan Schantl 11 Jan '19

11 Jan '19

This reverts commit 9d1708e081d7e7ba490db3620509dcce29cb0ae8. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/common/GeoIP | 12 +++++ lfs/GeoIP | 84 +++++++++++++++++++++++++++++++++++ make.sh | 1 + 3 files changed, 97 insertions(+) create mode 100644 config/rootfiles/common/GeoIP create mode 100644 lfs/GeoIP diff --git a/config/rootfiles/common/GeoIP b/config/rootfiles/common/GeoIP new file mode 100644 index 000000000..d76ba645e --- /dev/null +++ b/config/rootfiles/common/GeoIP @@ -0,0 +1,12 @@ +#usr/bin/geoip-lookup +#usr/lib/perl5/site_perl/5.12.3/Geo +#usr/lib/perl5/site_perl/5.12.3/Geo/IP +usr/lib/perl5/site_perl/5.12.3/Geo/IP/PurePerl.pm +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP/PurePerl +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP/PurePerl/.packlist +#usr/share/GeoIP +usr/share/GeoIP/GeoIP.dat +#usr/share/man/man1/geoip-lookup.1 +#usr/share/man/man3/Geo::IP::PurePerl.3 diff --git a/lfs/GeoIP b/lfs/GeoIP new file mode 100644 index 000000000..ce758d8a5 --- /dev/null +++ b/lfs/GeoIP @@ -0,0 +1,84 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.25 +DATVER = 30062018 + +THISAPP = Geo-IP-PurePerl-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) GeoIP.dat-$(DATVER).gz + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) +GeoIP.dat-$(DATVER).gz = $(DL_FROM)/GeoIP.dat-$(DATVER).gz + +$(DL_FILE)_MD5 = a47a1b71f7cd7c46cca9efcc448e0726 +GeoIP.dat-$(DATVER).gz_MD5 = d538e57ad9268fdc7955c6cf9a37c4a9 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/geoip_1_25_change_database_path.patch + cd $(DIR_APP) && perl Makefile.PL + cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) + cd $(DIR_APP) && make install + cd $(DIR_APP) && mkdir -p /usr/share/GeoIP && \ + zcat $(DIR_DL)/GeoIP.dat-$(DATVER).gz > /usr/share/GeoIP/GeoIP.dat + cd $(DIR_APP) && chmod 777 /srv/web/ipfire/html/images/flags + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 1d9163dce..601f1675b 100755 --- a/make.sh +++ b/make.sh @@ -1305,6 +1305,7 @@ buildipfire() { lfsmake2 python-daemon lfsmake2 python-ipaddress lfsmake2 glib + lfsmake2 GeoIP lfsmake2 ntp lfsmake2 openssh lfsmake2 fontconfig -- 2.19.1

1 1

[PATCH 1/2] geoip-locations.pl: Add get_geoip_locations().
by Stefan Schantl 10 Jan '19

10 Jan '19

This function is used to get all available GeoIP locations. The functions returns them as array, sorted in alphabetical order. Reference #11959 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/cfgroot/geoip-functions.pl | 33 +++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/config/cfgroot/geoip-functions.pl b/config/cfgroot/geoip-functions.pl index e8ce8377f..9f86a09ba 100644 --- a/config/cfgroot/geoip-functions.pl +++ b/config/cfgroot/geoip-functions.pl @@ -178,4 +178,37 @@ sub get_full_country_name($) { return $name; } +# Function to get all available GeoIP locations. +sub get_geoip_locations() { + my @locations; + + # Open the location database. + open(LOCATION, "$geoip_database_dir/$location_database") or die "Could not open $geoip_database_dir/$location_database. $!\n"; + + # Loop through the file. + while(my $line = <LOCATION>) { + # Remove newlines. + chomp($line); + + # Split the line content. + my ($geoname_id, $locale_code, $continent_code, $continent_name, $country_iso_code, $country_name, $is_in_european_union) = split(/\,/, $line); + + # Check if the country_iso_code is upper case. + if($country_iso_code =~ /[A-Z]/) { + # Add the current ISO code. + push(@locations, $country_iso_code); + } + } + + # Close filehandle. + close(LOCATION); + + # Sort locations array in alphabetical order. + my @sorted_locations = sort(@locations); + + # Return the array.. + return @sorted_locations; +} + + 1; -- 2.19.1

1 1

[PATCH 1/6] perl-Net-CIDR-Lite: New package.
by Stefan Schantl 10 Jan '19

10 Jan '19

This is a runtime dependency of the xt_geoip_build perl script shipped by xtables-addons in version 3.2. Reference #11960. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/common/perl-Net-CIDR-Lite | 6 ++ lfs/perl-Net-CIDR-Lite | 79 ++++++++++++++++++++++ make.sh | 1 + 3 files changed, 86 insertions(+) create mode 100644 config/rootfiles/common/perl-Net-CIDR-Lite create mode 100644 lfs/perl-Net-CIDR-Lite diff --git a/config/rootfiles/common/perl-Net-CIDR-Lite b/config/rootfiles/common/perl-Net-CIDR-Lite new file mode 100644 index 000000000..176afa3d2 --- /dev/null +++ b/config/rootfiles/common/perl-Net-CIDR-Lite @@ -0,0 +1,6 @@ +#usr/lib/perl5/site_perl/5.12.3/Net/CIDR +usr/lib/perl5/site_perl/5.12.3/Net/CIDR/Lite.pm +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Net/CIDR +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Net/CIDR/Lite +#usr/lib/perl5/site_perl/5.12.3/x86_64-linux-thread-multi/auto/Net/CIDR/Lite/.packlist +#usr/share/man/man3/Net::CIDR::Lite.3 diff --git a/lfs/perl-Net-CIDR-Lite b/lfs/perl-Net-CIDR-Lite new file mode 100644 index 000000000..66d989111 --- /dev/null +++ b/lfs/perl-Net-CIDR-Lite @@ -0,0 +1,79 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + + +############################################################################### +# Definitions +############################################################################### +include Config +VER = 0.21 + +THISAPP = Net-CIDR-Lite-$(VER) +DL_FILE = ${THISAPP}.tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 12280b3754886b876918f03f53aee4f5 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && perl Makefile.PL + cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index fd626a999..601f1675b 100755 --- a/make.sh +++ b/make.sh @@ -1434,6 +1434,7 @@ buildipfire() { lfsmake2 mpd lfsmake2 libmpdclient lfsmake2 mpc + lfsmake2 perl-Net-CIDR-Lite lfsmake2 perl-Net-SMTP-SSL lfsmake2 perl-MIME-Base64 lfsmake2 perl-Authen-SASL -- 2.19.1

2 6

[PATCH] clamav: Update to 0.101.1
by Matthias Fischer 10 Jan '19

10 Jan '19

For details see: https://blog.clamav.net/2019/01/clamav-01011-patch-has-been-released.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/clamav | 7 ++++--- lfs/clamav | 6 +++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index 3f35f9b17..e95d4dc6e 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -8,11 +8,12 @@ usr/bin/clamscan usr/bin/clamsubmit usr/bin/freshclam usr/bin/sigtool +#usr/include/clamav-types.h #usr/include/clamav.h #usr/lib/libclamav.la usr/lib/libclamav.so usr/lib/libclamav.so.9 -usr/lib/libclamav.so.9.0.0 +usr/lib/libclamav.so.9.0.1 #usr/lib/libclammspack.la usr/lib/libclammspack.so usr/lib/libclammspack.so.0 @@ -20,11 +21,11 @@ usr/lib/libclammspack.so.0.1.0 #usr/lib/libclamunrar.la usr/lib/libclamunrar.so usr/lib/libclamunrar.so.9 -usr/lib/libclamunrar.so.9.0.0 +usr/lib/libclamunrar.so.9.0.1 #usr/lib/libclamunrar_iface.la usr/lib/libclamunrar_iface.so usr/lib/libclamunrar_iface.so.9 -usr/lib/libclamunrar_iface.so.9.0.0 +usr/lib/libclamunrar_iface.so.9.0.1 #usr/lib/pkgconfig/libclamav.pc usr/sbin/clamd #usr/share/man/man1/clambc.1 diff --git a/lfs/clamav b/lfs/clamav index 20ff9ddf3..a6e44ebf2 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.101.0 +VER = 0.101.1 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 42 +PAK_VER = 43 DEPS = "" @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 47c36d13ac814b9e29ed6f5fc1691373 +$(DL_FILE)_MD5 = 9c137d6172f6e132e08e61fe25b636f8 install : $(TARGET) -- 2.18.0

2 1

[PATCH] tar: Update to 1.31, including fix for bug #11958
by Matthias Fischer 10 Jan '19

10 Jan '19

For details see: http://savannah.gnu.org/forum/forum.php?forum_id=9344 "- Fix heap-buffer-overrun with --one-top-level. - Support for zstd compression. - The -K option interacts properly with member names given in the command line. - Fix CVE-2018-20482" This patch was reverted because 'tar 1.31' crashed when installing PakFire packages with the option '--no-overwrite-dir'. See: https://bugzilla.ipfire.org/show_bug.cgi?id=11958 Included is now a patch from https://savannah.gnu.org/bugs/?55413, which seems to fix this issue. The test cases given in https://savannah.gnu.org/bugs/?55413#comment1 ran without problems. As always, please check and confirm. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/tar | 7 +++++-- src/patches/tar/01_extract.c.patch | 12 ++++++++++++ 2 files changed, 17 insertions(+), 2 deletions(-) create mode 100644 src/patches/tar/01_extract.c.patch diff --git a/lfs/tar b/lfs/tar index cbab6c2a9..953613d51 100644 --- a/lfs/tar +++ b/lfs/tar @@ -24,7 +24,7 @@ include Config -VER = 1.30 +VER = 1.31 THISAPP = tar-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8404e4c1fc5a3000228ab2b8ad674a65 +$(DL_FILE)_MD5 = 77afa35b696c8d760331fa0e12c2fac9 install : $(TARGET) @@ -80,6 +80,9 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) + + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/tar/01_extract.c.patch + cd $(DIR_APP) && ./configure $(EXTRA_CONFIG) FORCE_UNSAFE_CONFIGURE=1 cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/tar/01_extract.c.patch b/src/patches/tar/01_extract.c.patch new file mode 100644 index 000000000..21c3cd86f --- /dev/null +++ b/src/patches/tar/01_extract.c.patch @@ -0,0 +1,12 @@ +--- tar-1.31/src/extract.c 2019-01-02 18:07:48.000000000 +0000 ++++ tar-1.31.patched/src/extract.c 2019-01-09 16:17:20.368612005 +0000 +@@ -782,7 +782,8 @@ + case OVERWRITE_OLD_FILES: + if (0 < remove_any_file (file_name, ORDINARY_REMOVE_OPTION)) + return RECOVER_OK; +- break; ++ errno = e; ++ return RECOVER_NO; + + case UNLINK_FIRST_OLD_FILES: + break; -- 2.18.0

1 0

cloud-init solution
by Nux! 09 Jan '19

09 Jan '19

Hello, We are thinking to use Ipfire on a on-premise cloud plaform, these are well supported on Linux by the cloud-init package which can work with all sorts of metadata providers. I understand from twitter that there is something similar in Ipfire which works on AWS. Can anyone shed some more light on this component and perhaps how it could be used with other platforms? Regards, Lucian -- Sent from the Delta quadrant using Borg technology! Nux! www.nux.ro

2 1

IPCop Banish Addon for IPFire
by Bob Brewer 08 Jan '19

08 Jan '19

Hi, I have ported a version of the old IPCop addon 'Banish' to IPFire and use it to maintain my local blacklist. Banish was one of my favorite IPCop addons but it ceased to be maintained about 10 years ago and for later versions of IPCop I installed a locally written text version of Banish to maintain the Blacklist. This new IPFire version restores all the original GUI functionality and is currently running on an PC Engines ‐ apu2 with IPFire 2.21 (i586) - Core Update 125. If you would like to try this addon, I have uploaded it to https://github.com/Grantura/Banish-IPFire grab the self installing file banish-ipfire.tar-1.0.1.gz and extract it to /tmp. The install also contains an uninstall script should you want to back out at any time. Regards Rob Brewer

3 11

[PATCH] Fix typo in 'html/cgi-bin/logs.cgi/log.dat'
by Matthias Fischer 08 Jan '19

08 Jan '19

Translation string uses capital letter: 'Captive' => 'Captive Portal', Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/logs.cgi/log.dat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/logs.cgi/log.dat b/html/cgi-bin/logs.cgi/log.dat index f241365a1..153ffb5f0 100644 --- a/html/cgi-bin/logs.cgi/log.dat +++ b/html/cgi-bin/logs.cgi/log.dat @@ -78,7 +78,7 @@ my %sections = ( my %trsections = ( 'auth' => "$Lang::tr{'loginlogout'}", 'wio' => 'Who Is Online?', - 'captive' => $Lang::tr{'captive'}, + 'captive' => $Lang::tr{'Captive'}, 'clamav' => 'ClamAV', 'collectd' => 'Collectd', 'cron' => 'Cron', -- 2.18.0

2 1

[PATCH] dmidecode: update to 3.2
by Peter Müller 07 Jan '19

07 Jan '19

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- dmidecode/dmidecode.nm | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dmidecode/dmidecode.nm b/dmidecode/dmidecode.nm index 828924367..05f9537bb 100644 --- a/dmidecode/dmidecode.nm +++ b/dmidecode/dmidecode.nm @@ -4,11 +4,11 @@ ############################################################################### name = dmidecode -version = 3.0 -release = 1 +version = 3.2 +release = 2 groups = Applications/System -url = http://www.nongnu.org/dmidecode/ +url = https://www.nongnu.org/dmidecode/ license = GPLv2+ summary = Tool to analyse BIOS DMI data. @@ -21,7 +21,7 @@ description manufacturer. end -source_dl = http://download.savannah.gnu.org/releases/dmidecode/ +source_dl = https://download.savannah.gnu.org/releases/dmidecode/ build make_build_targets += CFLAGS="%{CFLAGS}" LDFLAGS="%{LDFLAGS}" -- 2.16.4

2 3

[PATCH] prevent kernel address space leak via dmesg or /proc files
by Peter Müller 07 Jan '19

07 Jan '19

Enable runtime sysctl hardening in order to avoid kernel addresses being disclosed via dmesg (in case it was built in without restrictions) or various /proc files. See https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommend… for further information. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- setup/setup.nm | 2 ++ setup/sysctl/kernel-hardening.conf | 6 ++++++ 2 files changed, 8 insertions(+) create mode 100644 setup/sysctl/kernel-hardening.conf diff --git a/setup/setup.nm b/setup/setup.nm index 78d1a5df3..f1dd3c177 100644 --- a/setup/setup.nm +++ b/setup/setup.nm @@ -53,6 +53,8 @@ build %{BUILDROOT}%{sysconfdir}/sysctl.d/printk.conf install -m 644 %{DIR_APP}/sysctl/swappiness.conf \ %{BUILDROOT}%{sysconfdir}/sysctl.d/swappiness.conf + install -m 644 %{DIR_APP}/sysctl/kernel-hardening.conf \ + %{BUILDROOT}%{sysconfdir}/sysctl.d/kernel-hardening.conf end end diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf new file mode 100644 index 000000000..6751bbef6 --- /dev/null +++ b/setup/sysctl/kernel-hardening.conf @@ -0,0 +1,6 @@ +# Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). +kernel.kptr_restrict = 1 + +# Avoid kernel memory address exposures via dmesg. +kernel.dmesg_restrict = 1 + -- 2.16.4

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2019