Development April 2019

development@lists.ipfire.org

12 participants
46 discussions

[PATCH] OpenVPN: Fixed certificate generation in french
by Erik Kapfer 26 Apr '19

26 Apr '19

Fixes #12060 Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- langs/fr/cgi-bin/fr.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl index b4ecf32fa..e6376f505 100644 --- a/langs/fr/cgi-bin/fr.pl +++ b/langs/fr/cgi-bin/fr.pl @@ -1284,7 +1284,7 @@ 'generate a certificate' => 'Générer un certificat :', 'generate dh key' => 'Générer paramètres Diffie-Hellman', 'generate iso' => 'Générer ISO', -'generate root/host certificates' => 'Générer des certificats root / hôte ', +'generate root/host certificates' => 'Générer des certificats root / hôte', 'generate tripwire keys and init' => 'Générer des clef Tripwire et init', 'generatekeys' => 'Générer des clefs', 'generatepolicy' => 'Générer une nouvelle politique', -- 2.12.2

2 1

Ipfire 2.23 Core Update 131 - DHCP- Adding fixed leases problems
by Mentalic 25 Apr '19

25 Apr '19

Loaded up latest, reports master/d4f31567. Running: -Red Green Orange Blue -Clam Av When adding a fixed lease the first one goes in ok, click add and update all good. Attempts to add a second lease when you click ADD does move it to the list highlighted in yellow, click UPDATE and it adds the lease but previous added lease disappears from list. After poking it for 30min I randomly had success in adding a couple fixed leases. Wayne

1 0

[PATCH 1/3] firewall: Use seperate firewall chains for passing traffic to the IPS
by Stefan Schantl 25 Apr '19

25 Apr '19

Create and use seperate iptables chain called IPS_INPUT, IPS_FORWARD and IPS_OUTPUT to be more flexible which kind of traffic should be passed to suricata. Reference #12062 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/system/firewall | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index be6c9169f..da89857d8 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -186,10 +186,12 @@ iptables_init() { iptables -A FORWARD -j GUARDIAN # IPS (suricata) chains - iptables -N IPS - iptables -A INPUT -j IPS - iptables -A FORWARD -j IPS - iptables -A OUTPUT -j IPS + iptables -N IPS_INPUT + iptables -N IPS_FORWARD + iptables -N IPS_OUTPUT + iptables -A INPUT -j IPS_INPUT + iptables -A FORWARD -j IPS_FORWARD + iptables -A OUTPUT -j IPS_OUTPUT # Block non-established IPsec networks iptables -N IPSECBLOCK -- 2.20.1

1 2

Ipfire 2.23 - Core Update 131, backup restore fail
by Mentalic 25 Apr '19

25 Apr '19

Loaded up latest, reports master/d4f31567. Running: -Red Green Orange Blue -Clam Av When I restore a backup from 130 the IPS service no longer will run. Attempted 4 different Ipfire configuration order combinations and was able to get it working once, but an ipfire reboot resulted in IPS service failing to run. My configuration has a number of firewall rules and groups and really not looking forward to retyping this in. Don't have any indication of what's breaking the IPS though. Thanks and Regards Wayne

2 2

[PATCH] squid / WPAD: Add exception-files for generation of proxy.pac
by Alexander Koch 24 Apr '19

24 Apr '19

This patch extends the script /srv/web/ipfire/cgi-bin/proxy.cgi by additional code for reading exceptions for URL's and IP's/Subnets from two new files: - /var/ipfire/proxy/advanced/acls/dst_noproxy_url.acl - /var/ipfire/proxy/advanced/acls/dst_noproxy_ip.acl as described in: https://wiki.ipfire.org/configuration/network/proxy/extend/add_distri These can be used to define additional URL's, IP's and Subnets that should be retrieved "DIRECT" and not via the proxy. The files have to be created by the user, as the WPAD-Feature is not enabled by default anyway. If the files are not present or their size is 0, nothing is done. I'll revise the wiki-page, after the patch is merged and the core update is released. Signed-off-by: Alexander Koch <ipfire(a)starkstromkonsument.de> --- html/cgi-bin/proxy.cgi | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index 6daa7fb..369a5cb 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -124,6 +124,9 @@ my $acl_ports_safe = "$acldir/ports_safe.acl"; my $acl_ports_ssl = "$acldir/ports_ssl.acl"; my $acl_include = "$acldir/include.acl"; +my $acl_dst_noproxy_url = "$acldir/dst_noproxy_url.acl"; +my $acl_dst_noproxy_ip = "$acldir/dst_noproxy_ip.acl"; + my $updaccelversion = 'n/a'; my $urlfilterversion = 'n/a'; @@ -2763,6 +2766,42 @@ END print FILE " (isInNet(host, \"$netsettings{'ORANGE_NETADDRESS'}\", \"$netsettings{'ORANGE_NETMASK'}\")) ||\n"; } + # Additional exceptions for URLs + # The file has to be created by the user and should contain one entry per line + # Line-Format: <URL incl. wildcards> + # e.g. *ipfire.org* + if (-s "$acl_dst_noproxy_url") { + undef @templist; + + open(NOPROXY,"$acl_dst_noproxy_url"); + @templist = <NOPROXY>; + close(NOPROXY); + chomp (@templist); + + foreach (@templist) + { + print FILE " (shExpMatch(url, \"$_\")) ||\n"; + } + } + + # Additional exceptions for Subnets + # The file has to be created by the user and should contain one entry per line + # Line-Format: "<IP>", "<SUBNET MASK>" + # e.g. "192.168.0.0", "255.255.255.0" + if (-s "$acl_dst_noproxy_ip") { + undef @templist; + + open(NOPROXY,"$acl_dst_noproxy_ip"); + @templist = <NOPROXY>; + close(NOPROXY); + chomp (@templist); + + foreach (@templist) + { + print FILE " (isInNet(host, $_)) ||\n"; + } + } + print FILE <<END (isInNet(host, "169.254.0.0", "255.255.0.0")) ) -- 2.7.4

4 17

[PATCH] suricata: Use device ppp0 if PPPoE dialin is used.
by Stefan Schantl 24 Apr '19

24 Apr '19

Fixes #12058 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/system/suricata | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 16548753e..b407afa3c 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -18,6 +18,7 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings) +eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) # Name of the firewall chain. FW_CHAIN="IPS" @@ -65,8 +66,16 @@ function generate_fw_rules { # Check if the IDS is enabled for this network zone. if [ "${!enable_ids_zone}" == "on" ]; then - # Generate name of the network interface. - network_device=$zone + # Check if the current processed zone is "red" and the configured type is PPPoE dialin. + if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then + # Set device name to ppp. + network_device="ppp" + else + # The device name is identical with the zone name. + network_device=$zone + fi + + # Finish generation of the device name. network_device+="0" # Assign NFQ_OPTS -- 2.20.1

2 1

[PATCH] convert-snort: Fix ownership of the generated homenet file.
by Stefan Schantl 24 Apr '19

24 Apr '19

Fixes #12059. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/convert-snort | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort index 0ad2942b1..83931fa5b 100644 --- a/config/suricata/convert-snort +++ b/config/suricata/convert-snort @@ -259,6 +259,9 @@ if (-f $IDS::rulestarball) { # Call subfunction to generate the file. &IDS::generate_home_net_file(); +# Set correct ownership for the homenet file. +&IDS::set_ownership("$IDS::homenet_file"); + # ## Step 9: Setup automatic ruleset updates. # -- 2.20.1

2 1

[PATCH] core132: Bugfix for typo in filelist
by Alexander Koch 24 Apr '19

24 Apr '19

Signed-off-by: Alexander Koch <ipfire(a)starkstromkonsument.de> --- config/rootfiles/core/132/filelists/files | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/core/132/filelists/files b/config/rootfiles/core/132/filelists/files index 52e26c375..cd09f7c93 100644 --- a/config/rootfiles/core/132/filelists/files +++ b/config/rootfiles/core/132/filelists/files @@ -3,4 +3,4 @@ etc/issue etc/suricata/suricata.yaml srv/web/ipfire/cgi-bin/credits.cgi srv/web/ipfire/cgi-bin/proxy.cgi -var/ipfire/lang +var/ipfire/langs -- 2.20.1

2 1

[PATCHv2] suricata: Use device ppp0 if PPPoE dialin is used.
by Stefan Schantl 24 Apr '19

24 Apr '19

Fixes #12058. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/system/suricata | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 16548753e..ecd693054 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -18,6 +18,7 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings) +eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) # Name of the firewall chain. FW_CHAIN="IPS" @@ -65,9 +66,18 @@ function generate_fw_rules { # Check if the IDS is enabled for this network zone. if [ "${!enable_ids_zone}" == "on" ]; then - # Generate name of the network interface. - network_device=$zone - network_device+="0" + # Check if the current processed zone is "red" and the configured type is PPPoE dialin. + if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then + # Set device name to ppp0. + network_device="ppp0" + else + # Generate variable name which contains the device name. + zone_name="$zone_upper" + zone_name+="_DEV" + + # Grab device name. + network_device=${!zone_name} + fi # Assign NFQ_OPTS NFQ_OPTIONS=$NFQ_OPTS -- 2.20.1

2 1

[PATCH 1/2] Add new package libseccomp
by Jonatan Schlag 22 Apr '19

22 Apr '19

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- config/rootfiles/packages/libseccomp | 34 ++++++++++++++ lfs/libseccomp | 87 ++++++++++++++++++++++++++++++++++++ make.sh | 1 + 3 files changed, 122 insertions(+) create mode 100644 config/rootfiles/packages/libseccomp create mode 100644 lfs/libseccomp diff --git a/config/rootfiles/packages/libseccomp b/config/rootfiles/packages/libseccomp new file mode 100644 index 0000000..3e68549 --- /dev/null +++ b/config/rootfiles/packages/libseccomp @@ -0,0 +1,34 @@ +usr/bin/scmp_sys_resolver +#usr/include/seccomp.h +#usr/lib/libseccomp.la +usr/lib/libseccomp.so +usr/lib/libseccomp.so.2 +usr/lib/libseccomp.so.2.4.0 +#usr/lib/pkgconfig/libseccomp.pc +#usr/share/man/man1/scmp_sys_resolver.1 +#usr/share/man/man3/seccomp_api_get.3 +#usr/share/man/man3/seccomp_api_set.3 +#usr/share/man/man3/seccomp_arch_add.3 +#usr/share/man/man3/seccomp_arch_exist.3 +#usr/share/man/man3/seccomp_arch_native.3 +#usr/share/man/man3/seccomp_arch_remove.3 +#usr/share/man/man3/seccomp_arch_resolve_name.3 +#usr/share/man/man3/seccomp_attr_get.3 +#usr/share/man/man3/seccomp_attr_set.3 +#usr/share/man/man3/seccomp_export_bpf.3 +#usr/share/man/man3/seccomp_export_pfc.3 +#usr/share/man/man3/seccomp_init.3 +#usr/share/man/man3/seccomp_load.3 +#usr/share/man/man3/seccomp_merge.3 +#usr/share/man/man3/seccomp_release.3 +#usr/share/man/man3/seccomp_reset.3 +#usr/share/man/man3/seccomp_rule_add.3 +#usr/share/man/man3/seccomp_rule_add_array.3 +#usr/share/man/man3/seccomp_rule_add_exact.3 +#usr/share/man/man3/seccomp_rule_add_exact_array.3 +#usr/share/man/man3/seccomp_syscall_priority.3 +#usr/share/man/man3/seccomp_syscall_resolve_name.3 +#usr/share/man/man3/seccomp_syscall_resolve_name_arch.3 +#usr/share/man/man3/seccomp_syscall_resolve_name_rewrite.3 +#usr/share/man/man3/seccomp_syscall_resolve_num_arch.3 +#usr/share/man/man3/seccomp_version.3 diff --git a/lfs/libseccomp b/lfs/libseccomp new file mode 100644 index 0000000..d577793 --- /dev/null +++ b/lfs/libseccomp @@ -0,0 +1,87 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 2.4.0 + +THISAPP = libseccomp-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = libseccomp +PAK_VER = 1 + +DEPS = "" + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 91625d78af26c646b03be3de58e71988 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar vxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --disable-static + + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index de973c6..fd85b03 100755 --- a/make.sh +++ b/make.sh @@ -1410,6 +1410,7 @@ buildipfire() { lfsmake2 spice lfsmake2 sdl lfsmake2 libusbredir + lfsmake2 libseccomp lfsmake2 qemu lfsmake2 sane lfsmake2 netpbm -- 1.8.3.1

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2019