Development April 2020

development@lists.ipfire.org

12 participants
133 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

Re: Multimedia Libs
by Matthias Fischer 28 May '20

28 May '20

3 19

[PATCH v2 0/8] ipblacklist: IP Address Blacklists
by Tim FitzGeorge 26 May '20

26 May '20

Implements downloading of IP address blacklists and implementing them as IPSets. A separate IPSet is used for each blacklist; this simplifies handling of overlaps between different lists. Traffic to or from the red0/ppp0 interface is checked against the IPSets. The check is placed before the IPS check as the IPSet check is much lighter on CPU use which means that overall CPU use is reduced. The available lists are defined in a separate file. A WUI page allows the desired lists to be enabled. A minimum update check interval is defined for each blacklist in the definition file. Changes since Version 1: - Changed Dshield download URL to preferred address. - Removed Abuse.ch blacklist (discontinued). - Removed Talos Malicious blacklist (not for production use). - Added Feodo recommended blacklist. - Added blocklist.de all blacklist. - Updated ignored messages in logwatch. - Modified sources file 'rate' to allow unit to be specified. - Updated sources file 'disable' to allow list to be specified. - Removed autoblacklist. - Added WUI log pages. - Removed status from settings WUI page. Tim FitzGeorge (8): ipblacklist: Main script ipblacklist: WUI Settings page ipblacklist: WUI Log page ipblacklist: WUI Log details page ipblacklist: WUI menus, language file etc ipblacklist: Ancillary files ipblacklist: Modifications to system ipblacklist: Build infrastructure config/backup/backup.pl | 1 + config/backup/include | 2 + config/ipblacklist/sources | 138 ++ config/logwatch/ipblacklist | 105 ++ config/logwatch/ipblacklist.conf | 34 + config/menu/50-firewall.menu | 5 + config/menu/70-log.menu | 5 + config/rootfiles/common/aarch64/stage2 | 1 + config/rootfiles/common/configroot | 2 + config/rootfiles/common/ipblacklist-sources | 1 + config/rootfiles/common/logwatch | 2 + config/rootfiles/common/misc-progs | 2 + config/rootfiles/common/stage2 | 1 + config/rootfiles/common/web-user-interface | 3 + config/rootfiles/common/x86_64/stage2 | 1 + html/cgi-bin/ipblacklist.cgi | 463 +++++++ html/cgi-bin/logs.cgi/ipblacklists.dat | 363 +++++ html/cgi-bin/logs.cgi/log.dat | 2 + html/cgi-bin/logs.cgi/showrequestfromblacklist.dat | 415 ++++++ langs/en/cgi-bin/en.pl | 27 +- lfs/configroot | 4 +- lfs/ipblacklist-sources | 53 + lfs/logwatch | 2 + make.sh | 1 + src/initscripts/system/firewall | 12 + src/misc-progs/Makefile | 2 +- src/misc-progs/getipsetstat.c | 25 + src/misc-progs/ipblacklistctrl.c | 48 + src/scripts/ipblacklist | 1382 ++++++++++++++++++++ 29 files changed, 3098 insertions(+), 4 deletions(-) create mode 100644 config/ipblacklist/sources create mode 100644 config/logwatch/ipblacklist create mode 100644 config/logwatch/ipblacklist.conf create mode 100644 config/rootfiles/common/ipblacklist-sources create mode 100644 html/cgi-bin/ipblacklist.cgi create mode 100755 html/cgi-bin/logs.cgi/ipblacklists.dat create mode 100755 html/cgi-bin/logs.cgi/showrequestfromblacklist.dat create mode 100644 lfs/ipblacklist-sources create mode 100644 src/misc-progs/getipsetstat.c create mode 100644 src/misc-progs/ipblacklistctrl.c create mode 100755 src/scripts/ipblacklist -- 2.16.4

2 10

[PATCH] OpenVPN: Add to update and exclude
by Erik Kapfer 14 May '20

14 May '20

Since some OpenVPN updates did not apply, the service will be stopped before the update to prevent 'Text file busy' and start up again. Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- config/rootfiles/core/144/exclude | 1 + config/rootfiles/core/144/update.sh | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/config/rootfiles/core/144/exclude b/config/rootfiles/core/144/exclude index b22159878..ba1b646e6 100644 --- a/config/rootfiles/core/144/exclude +++ b/config/rootfiles/core/144/exclude @@ -24,5 +24,6 @@ var/lib/alternatives var/log/cache var/log/dhcpcd.log var/log/messages +var/ipfire/ovpn var/state/dhcp/dhcpd.leases var/updatecache diff --git a/config/rootfiles/core/144/update.sh b/config/rootfiles/core/144/update.sh index 6a9c51931..81a6c626e 100644 --- a/config/rootfiles/core/144/update.sh +++ b/config/rootfiles/core/144/update.sh @@ -47,6 +47,15 @@ done # Remove files # Stop services +# Stop OpenVPN server if it runs +if pgrep openvpn -fl | grep 'server.conf' >/dev/null 2>&1; then + /usr/local/bin/openvpnctrl -k +fi + +# Stop OpenVPN N2N if it runs +if pgrep openvpn -fl | grep 'n2nconf' >/dev/null 2>&1; then + /usr/local/bin/openvpnctrl -kn2n +fi # Extract files extract_files @@ -55,6 +64,9 @@ extract_files ldconfig # Start services +# Start OpenVPN again +/usr/local/bin/openvpnctrl -s +/usr/local/bin/openvpnctrl -sn2n # Update Language cache /usr/local/bin/update-lang-cache -- 2.20.1

3 6

Incoming ESP Packets disappear
by Stephan Mending 13 May '20

13 May '20

Hello, I have a situation. ;) It looks like the following: (SRV-01) ----------- (IPFIRE) -------orange------- (SRV-02) public-IP 192.168.0.100 SRV-01 is hooked up to the ipfire via a roadwarrior IPsec connection. Establishment of the tunnel works as one would expect it. ping from SRV-02 to SRV-01 works fine and passes through the tunnel. So far, so good. ping from SRV-01 to SRV-02 does not. Iptables is blocking ? No, I did check that. Nothing. IPS ? No, neither. So what's the matter ? When watching the interface using tcpdump I can see ESP packets and afterwards its unencrypted icmp echo request content (both on ppp0). That is the end. And the packet has never been seen any after. Anyone an idea? (Yes the SRV-02 accepts incoming icmp type 8 and outgoing type 0) Best regards, Stephan

2 2

[PATCH] unbound: make local zone transparent
by Giovanni Aneloni 07 May '20

07 May '20

Fixes: https://bugzilla.ipfire.org/show_bug.cgi?id=12391 Change local zone to "trasnparent" instead of "typetrasnparent" to avoid NXDOMAIN when querying local hosts Signed-off-by: Giovanni Aneloni <giovanni.aneloni(a)live.com> --- diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index acbf6f5b5..825ac74ec 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -81,7 +81,7 @@ write_hosts_conf() { # Skip empty domainnames [ "${domainname}" = "" ] && continue - echo "local-zone: ${domainname} typetransparent" + echo "local-zone: ${domainname} transparent" done < /var/ipfire/main/hosts | sort -u # Add all hosts

4 9

[PATCH] OpenVPN: Delete RRD dir if connection is deleted
by Erik Kapfer 04 May '20

04 May '20

Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index ce9524df7..00ecd77a0 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2513,7 +2513,7 @@ else # CCD end # Update collectd configuration and delete all RRD files of the removed connection &writecollectdconf(); - system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]"); + system ('/usr/local/bin/openvpnctrl', '-drrd', $confighash{$cgiparams{'KEY'}}[1]); delete $confighash{$cgiparams{'KEY'}}; my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; -- 2.12.2

4 9

[PATCH] pcengines-apu-firmware: update to 4.11.0.6
by Arne Fitzenreiter 30 Apr '20

30 Apr '20

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/packages/pcengines-apu-firmware | 10 +++++----- lfs/pcengines-apu-firmware | 14 +++++++------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/packages/pcengines-apu-firmware b/config/rootfiles/packages/pcengines-apu-firmware index 65759ecdb..21b20ab03 100644 --- a/config/rootfiles/packages/pcengines-apu-firmware +++ b/config/rootfiles/packages/pcengines-apu-firmware @@ -1,7 +1,7 @@ #lib/firmware/pcengines #lib/firmware/pcengines/apu -lib/firmware/pcengines/apu/apu1_v4.11.0.5.rom -lib/firmware/pcengines/apu/apu2_v4.11.0.5.rom -lib/firmware/pcengines/apu/apu3_v4.11.0.5.rom -lib/firmware/pcengines/apu/apu4_v4.11.0.5.rom -lib/firmware/pcengines/apu/apu5_v4.11.0.5.rom +lib/firmware/pcengines/apu/apu1_v4.11.0.6.rom +lib/firmware/pcengines/apu/apu2_v4.11.0.6.rom +lib/firmware/pcengines/apu/apu3_v4.11.0.6.rom +lib/firmware/pcengines/apu/apu4_v4.11.0.6.rom +lib/firmware/pcengines/apu/apu5_v4.11.0.6.rom diff --git a/lfs/pcengines-apu-firmware b/lfs/pcengines-apu-firmware index 0eef1d510..421aa11d5 100644 --- a/lfs/pcengines-apu-firmware +++ b/lfs/pcengines-apu-firmware @@ -24,14 +24,14 @@ include Config -VER = 4.11.0.5 +VER = 4.11.0.6 THISAPP = pcengines-apu-firmware-$(VER) DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = pcengines-apu-firmware -PAK_VER = 5 +PAK_VER = 6 SUP_ARCH = i586 x86_64 DEPS = firmware-update @@ -53,11 +53,11 @@ apu3_v$(VER).rom = $(DL_FROM)/apu3_v$(VER).rom apu4_v$(VER).rom = $(DL_FROM)/apu4_v$(VER).rom apu5_v$(VER).rom = $(DL_FROM)/apu5_v$(VER).rom -apu1_v$(VER).rom_MD5 = eb9513cdb9bb212db524307d71d9f87c -apu2_v$(VER).rom_MD5 = e3ce78e1cbc1eb35b10d97349afabf04 -apu3_v$(VER).rom_MD5 = 42ece2873efc4a4b86bb507df40423c6 -apu4_v$(VER).rom_MD5 = e5eb7a15efbfc1a434d3bd48d1bc5062 -apu5_v$(VER).rom_MD5 = f2924f98bbb1e2816760103ab045a175 +apu1_v$(VER).rom_MD5 = aa135df1cdbdf488a2c623020c9c94b3 +apu2_v$(VER).rom_MD5 = ba861d29bb90491612e92de8d7db3065 +apu3_v$(VER).rom_MD5 = 52d51b4c0ea1d4a7e05f8b48ec57c0d8 +apu4_v$(VER).rom_MD5 = 22eba7cd14d2be3ddfaa4159f5c169af +apu5_v$(VER).rom_MD5 = de4da830a5424028b7492876edb41c86 install : $(TARGET) -- 2.17.1

2 1

[PATCH] clamav: fix database present check
by Arne Fitzenreiter 30 Apr '20

30 Apr '20

the mame of main.cvd has changed to main.cld on my system. Add both types and also ad bytecode.c?d Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/clamav | 4 ++-- src/initscripts/packages/clamav | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/lfs/clamav b/lfs/clamav index be6f5155d..4688f0fb8 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 49 +PAK_VER = 50 DEPS = diff --git a/src/initscripts/packages/clamav b/src/initscripts/packages/clamav index d2f63a910..439c20579 100644 --- a/src/initscripts/packages/clamav +++ b/src/initscripts/packages/clamav @@ -12,9 +12,12 @@ case "$1" in COUNTER=0 while [ "$COUNTER" -lt "61" ]; do + [ -e "/var/lib/clamav/main.cld" ] || \ [ -e "/var/lib/clamav/main.cvd" ] && \ - [ -e "/var/lib/clamav/daily.cvd" ] || \ - [ -e "/var/lib/clamav/daily.cld" ] && \ + [ -e "/var/lib/clamav/bytecode.cld" ] || \ + [ -e "/var/lib/clamav/bytecode.cvd" ] && \ + [ -e "/var/lib/clamav/daily.cld" ] || \ + [ -e "/var/lib/clamav/daily.cvd" ] && \ break if [ "$COUNTER" -lt "1" ]; then boot_mesg -n "Downloading database" -- 2.17.1

1 0

Re: vnstat 2.6 - (was: Re: [PATCH] tmux: Update to 3.1)
by Michael Tremer 30 Apr '20

30 Apr '20

Hi, > On 25 Apr 2020, at 12:26, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote: > > Hi Michael, > > On 25.04.2020 10:07, Michael Tremer wrote: >> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> >> >> Thank you! >> >> -Michael >> >>> ... > > No problem - it just came my way... ;-) > > Besides: I'm thinking about the (8?) update patches for 'vnstatn 2.6'. > > These are quite a few, because - as you know - it took me some time to > get the initscript right. And one commit > (https://patchwork.ipfire.org/patch/2936/) even has the wrong subject. > > Nevertheless, its running without problems since then. Today I deleted > the no longer needed files from '/var/log/vnstat/' ('.blue0', '.green0', > '.red0'). The new file, 'vnstat.db' takes about 250KB at the moment and > is staying there. It is best if you write these things as a response to the original patch, because they will then appear in the history of patchwork. But in general, I would recommend that this is being merged into next and we test it with more users. > But: should I send a new patch series for this update? Why? To clean up the mess? I would leave this for Arne. If he can work it out then not. Otherwise, a new patch series is probably the easier. Best, -Michael > > Best, > > Matthias

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2020