Development January 2016

development@lists.ipfire.org

17 participants
55 discussions

[PATCH] openssl: security update to 1.0.2f
by Michael Tremer 28 Jan '16

28 Jan '16

From: Arne Fitzenreiter <arne_f(a)ipfire.org> changes: * DH small subgroups - CVE-2016-0701 * SSLv2 doesn't block disabled ciphers - CVE-2015-3197 * Reject DH handshakes with parameters shorter than 1024 bits Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/openssl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/openssl b/lfs/openssl index 1dc24ac2a692..c5b71f79769e 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2016 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.0.2e +VER = 1.0.2f THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -86,7 +86,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2218c1a6f807f7206c11eb3ee3a5ec80 +$(DL_FILE)_MD5 = b3bf73f507172be9292ea2a8c28b659d install : $(TARGET) -- 2.4.3

1 0

Re: [openssl-announce] OpenSSL Security Advisory
by Michael Tremer 28 Jan '16

28 Jan '16

Hi, just wanted to inform you guys that the patches for the latest OpenSSL security vulnerabilities have been published. We have branched a new Core Update with these fixes and are going to release this update for testing later today. Stay tuned. Best, -Michael On Thu, 2016-01-28 at 15:05 +0000, OpenSSL wrote: > OpenSSL Security Advisory [28th Jan 2016] > ========================================= > > NOTE: SUPPORT FOR VERSION 1.0.1 WILL BE ENDING ON 31ST DECEMBER 2016. > NO > SECURITY FIXES WILL BE PROVIDED AFTER THAT DATE. UNTIL THAT TIME > SECURITY FIXES > ONLY ARE BEING APPLIED. > > DH small subgroups (CVE-2016-0701) > ================================== > > Severity: High > > Historically OpenSSL usually only ever generated DH parameters based > on "safe" > primes. More recently (in version 1.0.2) support was provided for > generating > X9.42 style parameter files such as those required for RFC 5114 > support. The > primes used in such files may not be "safe". Where an application is > using DH > configured with parameters based on primes that are not "safe" then > an attacker > could use this fact to find a peer's private DH exponent. This attack > requires > that the attacker complete multiple handshakes in which the peer uses > the same > private DH exponent. For example this could be used to discover a TLS > server's > private DH exponent if it's reusing the private DH exponent or it's > using a > static DH ciphersuite. > > OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH > (DHE) in TLS. > It is not on by default. If the option is not set then the server > reuses the > same private DH exponent for the life of the server process and would > be > vulnerable to this attack. It is believed that many popular > applications do set > this option and would therefore not be at risk. > > OpenSSL before 1.0.2f will reuse the key if: > - SSL_CTX_set_tmp_dh()/SSL_set_tmp_dh() is used and > SSL_OP_SINGLE_DH_USE is not > set. > - SSL_CTX_set_tmp_dh_callback()/SSL_set_tmp_dh_callback() is used, > and both the > parameters and the key are set and SSL_OP_SINGLE_DH_USE is not > used. This is > an undocumted feature and parameter files don't contain the key. > - Static DH ciphersuites are used. The key is part of the certificate > and > so it will always reuse it. This is only supported in 1.0.2. > > It will not reuse the key for DHE ciphers suites if: > - SSL_OP_SINGLE_DH_USE is set > - SSL_CTX_set_tmp_dh_callback()/SSL_set_tmp_dh_callback() is used and > the > callback does not provide the key, only the parameters. The > callback is > almost always used like this. > > Non-safe primes are generated by OpenSSL when using: > - genpkey with the dh_rfc5114 option. This will write an X9.42 style > file > including the prime-order subgroup size "q". This is supported > since the 1.0.2 > version. Older versions can't read files generated in this way. > - dhparam with the -dsaparam option. This has always been documented > as > requiring the single use. > > The fix for this issue adds an additional check where a "q" parameter > is > available (as is the case in X9.42 based parameters). This detects > the > only known attack, and is the only possible defense for static DH > ciphersuites. > This could have some performance impact. > > Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by > default > and cannot be disabled. This could have some performance impact. > > This issue affects OpenSSL version 1.0.2. > > OpenSSL 1.0.2 users should upgrade to 1.0.2f > > OpenSSL 1.0.1 is not affected by this CVE because it does not support > X9.42 > based parameters. It is possible to generate parameters using non > "safe" primes, > but this option has always been documented as requiring single use > and is not > the default or believed to be common. However, as a precaution, the > SSL_OP_SINGLE_DH_USE change has also been backported to 1.0.1r. > > This issue was reported to OpenSSL on 12 January 2016 by Antonio > Sanso (Adobe). > The fix was developed by Matt Caswell of the OpenSSL development team > (incorporating some work originally written by Stephen Henson of the > OpenSSL > core team). > > SSLv2 doesn't block disabled ciphers (CVE-2015-3197) > ==================================================== > > Severity: Low > > A malicious client can negotiate SSLv2 ciphers that have been > disabled on the > server and complete SSLv2 handshakes even if all SSLv2 ciphers have > been > disabled, provided that the SSLv2 protocol was not also disabled via > SSL_OP_NO_SSLv2. > > This issue affects OpenSSL versions 1.0.2 and 1.0.1. > > OpenSSL 1.0.2 users should upgrade to 1.0.2f > OpenSSL 1.0.1 users should upgrade to 1.0.1r > > This issue was reported to OpenSSL on 26th December 2015 by Nimrod > Aviram and > Sebastian Schinzel. The fix was developed by Nimrod Aviram with > further > development by Viktor Dukhovni of the OpenSSL development team. > > > An update on DHE man-in-the-middle protection (Logjam) > ==================================================================== > > A previously published vulnerability in the TLS protocol allows a > man-in-the-middle attacker to downgrade vulnerable TLS connections > using ephemeral Diffie-Hellman key exchange to 512-bit export-grade > cryptography. This vulnerability is known as Logjam > (CVE-2015-4000). OpenSSL added Logjam mitigation for TLS clients by > rejecting handshakes with DH parameters shorter than 768 bits in > releases 1.0.2b and 1.0.1n. > > This limit has been increased to 1024 bits in this release, to offer > stronger cryptographic assurance for all TLS connections using > ephemeral Diffie-Hellman key exchange. > > OpenSSL 1.0.2 users should upgrade to 1.0.2f > OpenSSL 1.0.1 users should upgrade to 1.0.1r > > The fix was developed by Kurt Roeckx of the OpenSSL development team. > > Note > ==== > > As per our previous announcements and our Release Strategy > (https://www.openssl.org/policies/releasestrat.html), support for > OpenSSL > version 1.0.1 will cease on 31st December 2016. No security updates > for that > version will be provided after that date. Users of 1.0.1 are > advised to upgrade. > > Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. > Those versions > are no longer receiving security updates. > > References > ========== > > URL for this Security Advisory: > https://www.openssl.org/news/secadv/20160128.txt > > Note: the online version of the advisory may be updated with > additional > details over time. > > For details of OpenSSL severity classifications please see: > https://www.openssl.org/policies/secpolicy.html > > _______________________________________________ > openssl-announce mailing list > To unsubscribe: > https://mta.openssl.org/mailman/listinfo/openssl-announce

1 0

[PATCH] Captive-Portal: add c-wrapper captivectrl
by Alexander Marx 28 Jan '16

28 Jan '16

This wrapper reads the captive settings and clients and sets the firewall access rules. It is called every time the config changed or everytime that a client changes. Also this wrapper is later called once hourly to flush the chains and rebuild rules for actual clients. Developed by Michael Tremer. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> --- src/misc-progs/captivectrl.c | 317 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 317 insertions(+) create mode 100644 src/misc-progs/captivectrl.c diff --git a/src/misc-progs/captivectrl.c b/src/misc-progs/captivectrl.c new file mode 100644 index 0000000..ed6668c --- /dev/null +++ b/src/misc-progs/captivectrl.c @@ -0,0 +1,317 @@ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include "libsmooth.h" +#include "setuid.h" + +#define CAPTIVE_PORTAL_SETTINGS CONFIG_ROOT "/captive/settings" +#define ETHERNET_SETTINGS CONFIG_ROOT "/ethernet/settings" + +#define CLIENTS CONFIG_ROOT "/captive/clients" +#define IPTABLES "/sbin/iptables --wait" +#define HTTP_PORT 80 +#define REDIRECT_PORT 1013 + +typedef struct client { + char etheraddr[STRING_SIZE]; + char ipaddr[STRING_SIZE]; + int time_start; + int time_end; + + struct client* next; +} client_t; + +static int parse_time(const char* s) { + int hrs = 0; + int min = 0; + + if (sscanf(s, "%d:%d", &hrs, &min) == 2) { + return (hrs * 60) + min; + } + + return -1; +} + +static char* format_time(int t) { + char buffer[STRING_SIZE]; + snprintf(buffer, sizeof(buffer), "%02d:%02d", (t / 60), (t % 60)); + + return strdup(buffer); +} + +static client_t* read_clients(char* filename) { + FILE* f = NULL; + + if (!(f = fopen(filename, "r"))) { + fprintf(stderr, "Could not open configuration file: %s\n", filename); + return NULL;; + } + + char line[STRING_SIZE]; + + client_t* client_first = NULL; + client_t* client_last = NULL; + client_t* client_curr; + + while ((fgets(line, STRING_SIZE, f) != NULL)) { + if (line[strlen(line) - 1] == '\n') + line[strlen(line) - 1] = '\0'; + + client_curr = (client_t*)malloc(sizeof(client_t)); + memset(client_curr, 0, sizeof(client_t)); + + if (client_first == NULL) + client_first = client_curr; + else + client_last->next = client_curr; + client_last = client_curr; + + unsigned int count = 0; + char* lineptr = line; + while (1) { + if (!*lineptr) + break; + + char* word = lineptr; + while (*lineptr != '\0') { + if (*lineptr == ',') { + *lineptr = '\0'; + lineptr++; + break; + } + lineptr++; + } + + switch (count++) { + // Ethernet address + case 1: + strcpy(client_curr->etheraddr, word); + break; + + // IP address + case 2: + strcpy(client_curr->ipaddr, word); + break; + + // Start time + case 3: + client_curr->time_start = parse_time(word); + break; + + // End time + case 4: + client_curr->time_end = parse_time(word); + break; + + default: + break; + } + } + } + + if (f) + fclose(f); + + return client_first; +} + +static void flush_chains() { + // filter + safe_system(IPTABLES " -F CAPTIVE_PORTAL"); + safe_system(IPTABLES " -F CAPTIVE_PORTAL_CLIENTS"); + + // nat + safe_system(IPTABLES " -t nat -F CAPTIVE_PORTAL"); +} + +static int add_client_rules(const client_t* clients) { + char command[STRING_SIZE]; + char match[STRING_SIZE]; + + while (clients) { + char* time_start = format_time(clients->time_start); + char* time_end = format_time(clients->time_end); + + snprintf(match, sizeof(match), "-s %s -m mac --mac-source %s" + " -m time %s --timestart %s --timestop %s", + clients->ipaddr, clients->etheraddr, + (clients->time_start > clients->time_end) ? "--contiguous" : "", + time_start, time_end); + + free(time_start); + free(time_end); + + // filter + snprintf(command, sizeof(command), IPTABLES " -A CAPTIVE_PORTAL_CLIENTS" + " %s -j RETURN", match); + safe_system(command); + + // nat + snprintf(command, sizeof(command), IPTABLES " -t nat -A CAPTIVE_PORTAL" + " %s -j RETURN", match); + safe_system(command); + + // Move on to the next client + clients = clients->next; + } + + return 0; +} + +static char* get_key(struct keyvalue* settings, char* key) { + char value[STRING_SIZE]; + + if (!findkey(settings, key, value)) + return NULL; + + return strdup(value); +} + +static int add_interface_rule(const char* intf, int allow_webif_access) { + int r; + char command[STRING_SIZE]; + + if ((intf == NULL) || (strlen(intf) == 0)) { + fprintf(stderr, "Empty interface given\n"); + return -1; + } + + snprintf(command, sizeof(command), IPTABLES " -A CAPTIVE_PORTAL -i %s" + " -j CAPTIVE_PORTAL_CLIENTS", intf); + r = safe_system(command); + if (r) + return r; + +#if 0 + snprintf(command, sizeof(command), IPTABLES " -A CAPTIVE_PORTAL -o %s" + " -j CAPTIVE_PORTAL_CLIENTS", intf); + r = safe_system(command); + if (r) + return r; +#endif + + if (allow_webif_access) { + snprintf(command, sizeof(command), IPTABLES " -A CAPTIVE_PORTAL_CLIENTS" + " -i %s -p tcp --dport 444 -j RETURN", intf); + r = safe_system(command); + if (r) + return r; + } + + // Redirect all unauthenticated clients + snprintf(command, sizeof(command), IPTABLES " -t nat -A CAPTIVE_PORTAL -i %s" + " -p tcp --dport %d -j REDIRECT --to-ports %d", intf, HTTP_PORT, REDIRECT_PORT); + r = safe_system(command); + if (r) + return r; + + return 0; +} + +static int add_interface_rules(struct keyvalue* captive_portal_settings, struct keyvalue* ethernet_settings) { + const char* intf; + char* setting; + int r = 0; + + setting = get_key(captive_portal_settings, "ENABLE_GREEN"); + if (setting && (strcmp(setting, "on") == 0)) { + free(setting); + + intf = get_key(ethernet_settings, "GREEN_DEV"); + r = add_interface_rule(intf, /* allow webif access from green */ 1); + if (r) + return r; + } + + setting = get_key(captive_portal_settings, "ENABLE_BLUE"); + if (setting && (strcmp(setting, "on") == 0)) { + free(setting); + + intf = get_key(ethernet_settings, "BLUE_DEV"); + r = add_interface_rule(intf, /* do not allow webif access */ 0); + if (r) + return r; + } + + // Always pass DNS packets through all firewall rules + r = safe_system(IPTABLES " -A CAPTIVE_PORTAL_CLIENTS -p udp --dport 53 -j RETURN"); + if (r) + return r; + + r = safe_system(IPTABLES " -A CAPTIVE_PORTAL_CLIENTS -p tcp --dport 53 -j RETURN"); + if (r) + return r; + + char command[STRING_SIZE]; + snprintf(command, sizeof(command), IPTABLES " -A CAPTIVE_PORTAL_CLIENTS" + " -p tcp --dport %d -j RETURN", REDIRECT_PORT); + r = safe_system(command); + if (r) + return r; + + // Add the last rule + r = safe_system(IPTABLES " -A CAPTIVE_PORTAL_CLIENTS -j DROP"); + if (r) + return r; + + return r; +} + +int main(int argc, char** argv) { + int r = 0; + char* intf = NULL; + client_t* clients = NULL; + + if (!(initsetuid())) + exit(2); + + struct keyvalue* ethernet_settings = initkeyvalues(); + if (!readkeyvalues(ethernet_settings, ETHERNET_SETTINGS)) { + fprintf(stderr, "Could not read %s\n", ETHERNET_SETTINGS); + r = 1; + goto END; + } + + struct keyvalue* captive_portal_settings = initkeyvalues(); + if (!readkeyvalues(captive_portal_settings, CAPTIVE_PORTAL_SETTINGS)) { + fprintf(stderr, "Could not read %s\n", CAPTIVE_PORTAL_SETTINGS); + r = 1; + goto END; + } + + clients = read_clients(CLIENTS); + + // Clean up all old rules + flush_chains(); + + // Add all client rules + r = add_client_rules(clients); + if (r) + goto END; + + // Add all interface rules + r = add_interface_rules(captive_portal_settings, ethernet_settings); + if (r) + goto END; + +END: + while (clients) { + client_t* head = clients; + clients = clients->next; + + free(head); + } + + if (ethernet_settings) + freekeyvalues(ethernet_settings); + + if (captive_portal_settings) + freekeyvalues(captive_portal_settings); + + if (intf) + free(intf); + + return r; +} -- 1.9.1

1 0

[PATCH] privoxy 3.0.24: Bugfixes in config- and lfs-file, enabled compression feature
by Matthias Fischer 24 Jan '16

24 Jan '16

'config'-header was updated to show the new version. Fixed absolutely silly typo in lfs-file. This didn't had any effect yet, nevertheless... Added '--enable_compression' - for testing purposes. This feature can be enabled and disabled now through config. For details see: http://www.privoxy.org/user-manual/config.html#ENABLE-COMPRESSION Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/privoxy/privoxy.config | 4 ++-- lfs/privoxy | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/privoxy/privoxy.config b/config/privoxy/privoxy.config index 32fa1f7..04ddd4f 100644 --- a/config/privoxy/privoxy.config +++ b/config/privoxy/privoxy.config @@ -1,6 +1,6 @@ -# Sample Configuration File for Privoxy 3.0.23 +# Sample Configuration File for Privoxy 3.0.24 # -# $Id: config,v 1.107 2015/01/24 16:44:20 fabiankeil Exp $ +# $Id: config,v 1.108 2016/01/17 14:33:03 fabiankeil Exp $ # # Copyright (C) 2001-2014 Privoxy Developers http://www.privoxy.org/ # diff --git a/lfs/privoxy b/lfs/privoxy index 06516af..b1d58b4 100644 --- a/lfs/privoxy +++ b/lfs/privoxy @@ -87,9 +87,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --prefix=/usr \ --sysconfdir=/etc/privoxy \ --sbindir=/usr/sbin \ - --localstatedir=/var + --localstatedir=/var \ --with-user=privoxy \ --with-group=privoxy \ + --enable-compression \ --disable-dynamic-pcre \ $(CONFIGURE_FLAGS) -- 2.7.0

1 0

[PATCH] privoxy 3.0.24: fixed blank in lfs-file
by Matthias Fischer 24 Jan '16

24 Jan '16

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/privoxy | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/privoxy b/lfs/privoxy index de650a2..06516af 100644 --- a/lfs/privoxy +++ b/lfs/privoxy @@ -53,7 +53,7 @@ download :$(patsubst %,$(DIR_DL)/%,$(objects)) md5 : $(subst %,%_MD5,$(objects)) -dist: +dist: $(PAK) ############################################################################### -- 2.7.0

1 0

[PATCH] dnsmasq 2.75: latest patch from upstream (056)
by Matthias Fischer 23 Jan '16

23 Jan '16

One latecomer... Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dnsmasq | 1 + ...q-Add-support-to-read-ISC-DHCP-lease-file.patch | 6 +- .../dnsmasq/056-Add_--max-port_config_option.patch | 166 +++++++++++++++++++++ 3 files changed, 170 insertions(+), 3 deletions(-) create mode 100644 src/patches/dnsmasq/056-Add_--max-port_config_option.patch diff --git a/lfs/dnsmasq b/lfs/dnsmasq index 5134c13..95da5d7 100644 --- a/lfs/dnsmasq +++ b/lfs/dnsmasq @@ -128,6 +128,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/053-Complete_DNSSEC_server-selection_code_and_set_conntrack_on_DNSSEC_queries.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/054-Fix_problems_in_last_commit_when_DNSSEC_not_enabled.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/055-Fix_wrong_reply_to_simple_name_when_--domain-needed_set_and_no_servers_configured.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/056-Add_--max-port_config_option.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch cd $(DIR_APP) && sed -i src/config.h \ diff --git a/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch b/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch index f13dbcd..e49366a 100644 --- a/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch +++ b/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch @@ -42,7 +42,7 @@ --- a/src/dnsmasq.c Thu Jul 30 20:59:06 2015 +++ b/src/dnsmasq.c Wed Dec 16 19:38:32 2015 -@@ -996,6 +996,11 @@ +@@ -1010,6 +1010,11 @@ poll_resolv(0, daemon->last_resolv != 0, now); daemon->last_resolv = now; @@ -56,7 +56,7 @@ --- a/src/dnsmasq.h Wed Dec 16 19:24:12 2015 +++ b/src/dnsmasq.h Wed Dec 16 19:40:11 2015 -@@ -1509,6 +1509,11 @@ +@@ -1510,6 +1510,11 @@ void poll_listen(int fd, short event); int do_poll(int timeout); @@ -326,7 +326,7 @@ +#endif --- a/src/option.c Wed Dec 16 19:24:12 2015 +++ b/src/option.c Wed Dec 16 19:42:48 2015 -@@ -1757,7 +1757,7 @@ +@@ -1760,7 +1760,7 @@ ret_err(_("bad MX target")); break; diff --git a/src/patches/dnsmasq/056-Add_--max-port_config_option.patch b/src/patches/dnsmasq/056-Add_--max-port_config_option.patch new file mode 100644 index 0000000..7457be8 --- /dev/null +++ b/src/patches/dnsmasq/056-Add_--max-port_config_option.patch @@ -0,0 +1,166 @@ +From 926332a76454c7621f569d6c76d2697a83074d99 Mon Sep 17 00:00:00 2001 +From: Hans Dedecker <dedeckeh(a)gmail.com> +Date: Sat, 23 Jan 2016 10:48:12 +0000 +Subject: [PATCH] Add --max-port config option. + +--- + CHANGELOG | 3 +++ + man/dnsmasq.8 | 7 +++++++ + src/dns-protocol.h | 1 + + src/dnsmasq.c | 8 +++++++- + src/dnsmasq.h | 2 +- + src/network.c | 6 +++--- + src/option.c | 9 +++++++++ + 7 files changed, 31 insertions(+), 5 deletions(-) + +diff --git a/CHANGELOG b/CHANGELOG +index d3cf909..bc1e930 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -31,6 +31,9 @@ version 2.76 + Return REFUSED when running out of forwarding table slots, + not SERVFAIL. + ++ Add --max-port configuration. Thanks to Hans Dedecker for ++ the patch. ++ + + version 2.75 + Fix reversion on 2.74 which caused 100% CPU use when a +diff --git a/man/dnsmasq.8 b/man/dnsmasq.8 +index 69acdae..103a813 100644 +--- a/man/dnsmasq.8 ++++ b/man/dnsmasq.8 +@@ -174,6 +174,13 @@ queries. Dnsmasq picks random ports as source for outbound queries: + when this option is given, the ports used will always to larger + than that specified. Useful for systems behind firewalls. + .TP ++.B --max-port=<port> ++Use ports lower than that given as source for outbound DNS queries. ++Dnsmasq picks random ports as source for outbound queries: ++when this option is given, the ports used will always be lower ++than that specified. Useful for systems behind firewalls. ++.TP ++ + .B \-i, --interface=<interface name> + Listen only on the specified interface(s). Dnsmasq automatically adds + the loopback (local) interface to the list of interfaces to use when +diff --git a/src/dns-protocol.h b/src/dns-protocol.h +index 95c55f2..75d8ffb 100644 +--- a/src/dns-protocol.h ++++ b/src/dns-protocol.h +@@ -16,6 +16,7 @@ + + #define NAMESERVER_PORT 53 + #define TFTP_PORT 69 ++#define MAX_PORT 65535u + + #define IN6ADDRSZ 16 + #define INADDRSZ 4 +diff --git a/src/dnsmasq.c b/src/dnsmasq.c +index e993629..0bb3e03 100644 +--- a/src/dnsmasq.c ++++ b/src/dnsmasq.c +@@ -219,7 +219,13 @@ int main (int argc, char **argv) + if (option_bool(OPT_LOOP_DETECT)) + die(_("loop detection not available: set HAVE_LOOP in src/config.h"), NULL, EC_BADCONF); + #endif +- ++ ++ if (daemon->max_port != MAX_PORT && daemon->min_port == 0) ++ daemon->min_port = 1024u; ++ ++ if (daemon->max_port < daemon->min_port) ++ die(_("max_port cannot be smaller than min_port"), NULL, EC_BADCONF); ++ + now = dnsmasq_time(); + + /* Create a serial at startup if not configured. */ +diff --git a/src/dnsmasq.h b/src/dnsmasq.h +index 543481c..fd483a6 100644 +--- a/src/dnsmasq.h ++++ b/src/dnsmasq.h +@@ -950,7 +950,7 @@ extern struct daemon { + char *log_file; /* optional log file */ + int max_logs; /* queue limit */ + int cachesize, ftabsize; +- int port, query_port, min_port; ++ int port, query_port, min_port, max_port; + unsigned long local_ttl, neg_ttl, max_ttl, min_cache_ttl, max_cache_ttl, auth_ttl; + char *dns_client_id; + struct hostsfile *addn_hosts; +diff --git a/src/network.c b/src/network.c +index 5451c6c..91ac40a 100644 +--- a/src/network.c ++++ b/src/network.c +@@ -1119,7 +1119,7 @@ int random_sock(int family) + if ((fd = socket(family, SOCK_DGRAM, 0)) != -1) + { + union mysockaddr addr; +- unsigned int ports_avail = 65536u - (unsigned short)daemon->min_port; ++ unsigned int ports_avail = ((unsigned short)daemon->max_port - (unsigned short)daemon->min_port) + 1; + int tries = ports_avail < 30 ? 3 * ports_avail : 100; + + memset(&addr, 0, sizeof(addr)); +@@ -1132,8 +1132,8 @@ int random_sock(int family) + { + unsigned short port = rand16(); + +- if (daemon->min_port != 0) +- port = htons(daemon->min_port + (port % ((unsigned short)ports_avail))); ++ if (daemon->min_port != 0 || daemon->max_port != MAX_PORT) ++ port = htons(daemon->min_port + (port % ((unsigned short)ports_avail))); + + if (family == AF_INET) + { +diff --git a/src/option.c b/src/option.c +index 0e126f2..f40e9e2 100644 +--- a/src/option.c ++++ b/src/option.c +@@ -154,6 +154,7 @@ struct myoption { + #define LOPT_HOST_INOTIFY 342 + #define LOPT_DNSSEC_STAMP 343 + #define LOPT_TFTP_NO_FAIL 344 ++#define LOPT_MAXPORT 345 + #define LOPT_DNS_CLIENT_ID 355 + + #ifdef HAVE_GETOPT_LONG +@@ -271,6 +272,7 @@ static const struct myoption opts[] = + { "dhcp-alternate-port", 2, 0, LOPT_ALTPORT }, + { "dhcp-scriptuser", 1, 0, LOPT_SCRIPTUSR }, + { "min-port", 1, 0, LOPT_MINPORT }, ++ { "max-port", 1, 0, LOPT_MAXPORT }, + { "dhcp-fqdn", 0, 0, LOPT_DHCP_FQDN }, + { "cname", 1, 0, LOPT_CNAME }, + { "pxe-prompt", 1, 0, LOPT_PXE_PROMT }, +@@ -438,6 +440,7 @@ static struct { + { LOPT_ALTPORT, ARG_ONE, "[=<ports>]", gettext_noop("Use alternative ports for DHCP."), NULL }, + { LOPT_NAPTR, ARG_DUP, "<name>,<naptr>", gettext_noop("Specify NAPTR DNS record."), NULL }, + { LOPT_MINPORT, ARG_ONE, "<port>", gettext_noop("Specify lowest port available for DNS query transmission."), NULL }, ++ { LOPT_MAXPORT, ARG_ONE, "<port>", gettext_noop("Specify highest port available for DNS query transmission."), NULL }, + { LOPT_DHCP_FQDN, OPT_DHCP_FQDN, NULL, gettext_noop("Use only fully qualified domain names for DHCP clients."), NULL }, + { LOPT_GEN_NAMES, ARG_DUP, "[=tag:<tag>]", gettext_noop("Generate hostnames based on MAC address for nameless clients."), NULL}, + { LOPT_PROXY, ARG_DUP, "[=<ipaddr>]...", gettext_noop("Use these DHCP relays as full proxies."), NULL }, +@@ -2512,6 +2515,11 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma + ret_err(gen_err); + break; + ++ case LOPT_MAXPORT: /* --max-port */ ++ if (!atoi_check16(arg, &daemon->max_port)) ++ ret_err(gen_err); ++ break; ++ + case '0': /* --dns-forward-max */ + if (!atoi_check(arg, &daemon->ftabsize)) + ret_err(gen_err); +@@ -4462,6 +4470,7 @@ void read_opts(int argc, char **argv, char *compile_opts) + daemon->soa_refresh = SOA_REFRESH; + daemon->soa_retry = SOA_RETRY; + daemon->soa_expiry = SOA_EXPIRY; ++ daemon->max_port = MAX_PORT; + + add_txt("version.bind", "dnsmasq-" VERSION, 0 ); + add_txt("authors.bind", "Simon Kelley", 0); +-- +1.7.10.4 + -- 2.7.0

1 0

Re: AW: Re: [PATCH 1/5] Enable correct display of ipv6 entries in Firewall log pages of web UI
by Matthias Fischer 23 Jan '16

23 Jan '16

On 22.01.2016 19:00, Michael Eitelwein wrote: > > > > Hi > The patch itself is working on my machine without issues. If Matthias did not observe any issues as well, than I would propose to merge it into the next release. Please let me know if there is anything I have to do to get them merged. > The problems of applying the patch were not further examined, as Matthias was able to apply them in the end. Also they are now available in git.ipfire.org, so they can be applied directly from there. > Michael Hi, I just clicked through all '.dat'-files: I saw no problems. Playing chicken: did anyone *else* test this? ;-) Best, Matthias P.S.: ME, while replying to "ALL", there is something weird with your email-address: it just says "michael", not "michael(a)eitelwein.net". I had to add your address manually from my addressbook. Bug or feature- mine or yours? > -------- Ursprüngliche Nachricht -------- > Von: Michael Tremer <michael.tremer(a)ipfire.org> > Datum: 22.01.2016 01:59 (GMT+01:00) > An: Michael Eitelwein <michael(a)eitelwein.net>, IPFire Development List <development(a)lists.ipfire.org> > Cc: Matthias Fischer <matthias.fischer(a)ipfire.org> > Betreff: Re: [PATCH 1/5] Enable correct display of ipv6 entries in Firewall log pages of web UI > > Hi, > > did you work out what the issue was with these emails? > > Best, > -Michael > > On Sun, 2016-01-10 at 18:34 +0100, Michael Eitelwein wrote: >> 3 main changes: >> - Fill $iface and $out from PHYSIN and PHYSOUT when looking at >> bridged packets, othewerwise fill from IN and OUT >> - Recognize ipv4 and ipv6 address style for $srcaddr and $dstaddr >> - Match color coding of tables to pie charts >> >> I am using the bridged ipv6 setup as proposed in the wiki. I do not >> think this breaks anything when not using ipv6. So it would be nice >> to include this even if ipv6 is not officially supported yet. It is >> quite useful when using the ipv6 setup. >> >> Signed-off-by: Michael Eitelwein <michael(a)eitelwein.net> >> >> --- >> html/cgi-bin/logs.cgi/firewalllog.dat | 14 ++-- >> html/cgi-bin/logs.cgi/firewalllogcountry.dat | 43 ++++++++----- >> html/cgi-bin/logs.cgi/firewalllogip.dat | 15 ++--- >> html/cgi-bin/logs.cgi/firewalllogport.dat | 12 ++-- >> html/cgi-bin/logs.cgi/showrequestfromcountry.dat | 81 >> +++++++++++++++++------- >> html/cgi-bin/logs.cgi/showrequestfromip.dat | 27 ++++---- >> html/cgi-bin/logs.cgi/showrequestfromport.dat | 14 ++-- >> 7 files changed, 131 insertions(+), 75 deletions(-) >> >> diff --git a/html/cgi-bin/logs.cgi/firewalllog.dat b/html/cgi >> -bin/logs.cgi/firewalllog.dat >> index 5a584d6..42c9612 100644 >> --- a/html/cgi-bin/logs.cgi/firewalllog.dat >> +++ b/html/cgi-bin/logs.cgi/firewalllog.dat >> @@ -328,7 +328,10 @@ END >> $lines = 0; >> foreach $_ (@log) >> { >> - /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; >> + # If ipv6 uses a bridge, PHYSIN= contains the relevant iface >> information >> + # otherwise use IN= >> + if ($_ =~ /^... (..) (..:..:..) [\w\-]+ >> kernel:(.*)(PHYSIN=.*)$/) {} >> + elsif ($_ =~ /^... (..) (..:..:..) [\w\-]+ >> kernel:(.*)(IN=.*)$/) {} >> my $day = $1; >> $day =~ tr / /0/; >> my $time = $cgiparams{'DAY'} ? "$2" : "$day/$2" ; >> @@ -336,9 +339,12 @@ foreach $_ (@log) >> my $packet = $4; >> >> my ($iface, $srcaddr, $dstaddr, $macaddr, $proto, $srcport, >> $dstport); >> - $iface=$1 if $packet =~ /IN=(\w+)/; >> - $srcaddr=$1 if $packet =~ /SRC=([\d\.]+)/; >> - $dstaddr=$1 if $packet =~ /DST=([\d\.]+)/; >> + if ($packet =~ /PHYSIN=(\w+)/) { $iface=$1 } elsif ($packet >> =~ /IN=(\w+)/) { $iface = $1} >> + # Identify whether ipv4 or ipv6. Both are mutally exclusive. >> + if ($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) { >> $srcaddr=$1 } >> + if ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA >> -F]{0,4})){2,7})/) { $srcaddr=$1 } >> + if ($packet =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) { >> $dstaddr=$1 } >> + if ($packet =~ /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA >> -F]{0,4})){2,7})/) { $dstaddr=$1 } >> $macaddr=$1 if $packet =~ /MAC=([\w+\:]+)/; >> $proto=$1 if $packet =~ /PROTO=(\w+)/; >> $srcport=$1 if $packet =~ /SPT=(\d+)/; >> diff --git a/html/cgi-bin/logs.cgi/firewalllogcountry.dat b/html/cgi >> -bin/logs.cgi/firewalllogcountry.dat >> index f998a62..2661ddd 100644 >> --- a/html/cgi-bin/logs.cgi/firewalllogcountry.dat >> +++ b/html/cgi-bin/logs.cgi/firewalllogcountry.dat >> @@ -261,7 +261,6 @@ if( $cgiparams{'pienumber'} != >> 0){$pienumber=$cgiparams{'pienumber'};} >> if( $cgiparams{'otherspie'} != >> 0){$otherspie=$cgiparams{'otherspie'};} >> if( $cgiparams{'showpie'} != 0){$showpie=$cgiparams{'showpie'};} >> if( $cgiparams{'sortcolumn'} != >> 0){$sortcolumn=$cgiparams{'sortcolumn'};} >> - >> print <<END >> </select> >> </td> >> @@ -294,15 +293,24 @@ $lines = 0; >> >> foreach $_ (@log) >> { >> - /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; >> + # If ipv6 uses bridge, use PHYSIN for iface, otherwise IN >> + if (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} >> + elsif (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} >> my $packet = $4; >> - $packet =~ /IN=(\w+)/; my $iface=$1; if ( $1 =~ /2./ ){ >> $iface="";} >> - $packet =~ /SRC=([\d\.]+)/; my $srcaddr=$1; >> + my $iface = ''; >> + if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($packet =~ >> /IN=(\w+)/) { $iface = $1 } >> + if ( $1 =~ /2./ ) { $iface=''; } >> + my $srcaddr = ''; >> + # Find ipv4 and ipv6 addresses >> + if ($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) { $srcaddr >> = $1 } >> + elsif ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA >> -F]{0,4})){2,7})/) { $srcaddr = $1 } >> >> if($iface eq $red_interface) { >> + # Traffic from red >> if($srcaddr ne '') { >> + # srcaddr is set >> my $ccode = $gi->country_code_by_name($srcaddr); >> - if( $ccode eq '') { >> + if ($ccode eq '') { >> $ccode = 'unknown'; >> } >> $tabjc{$ccode} = $tabjc{$ccode} + 1 ; >> @@ -311,11 +319,16 @@ foreach $_ (@log) >> } >> } >> else { >> + # Traffic not from red >> if($iface ne '') { >> $tabjc{$iface} = $tabjc{$iface} + 1 ; >> if(($tabjc{$iface} == 1) && ($lines < $pienumber)) { $lines >> = $lines + 1; } >> $linesjc++; >> } >> + else { >> + # What to do with empty iface lines? >> + # This probably is traffic from ipfire itself (IN= OUT=XY)? >> + } >> } >> } >> >> @@ -423,7 +436,6 @@ if ($showpie != 2 && $pienumber <= 50 && >> $pienumber != 0) { >> print "<img src='/graphs/fwlog-country$imagerandom.png'>"; >> print "</div>"; >> } >> - >> print <<END >> <table width='100%' class='tbl'> >> <tr> >> @@ -448,10 +460,8 @@ for($s=0;$s<$lines;$s++) >> $percent = $value[$s] * 100 / $linesjc; >> $percent = sprintf("%.f", $percent); >> $total = $total + $value[$s]; >> - my $colorIndex = $color % 10; >> - if($colorIndex == 0) { >> - $colorIndex = 10; >> - } >> + # colors are numbered 1 to 10 >> + my $colorIndex = ($color % 10) + 1; >> $col="bgcolor='$color{\"color$colorIndex\"}'"; >> $color++; >> print "<tr>"; >> @@ -466,8 +476,11 @@ for($s=0;$s<$lines;$s++) >> print"<input type='hidden' name='country' value='$key[$s]'>"; >> print"<input type='submit' value='details'></form>"; >> } >> - >> - if($key[$s] eq 'blue0' || $key[$s] eq 'green0' || $key[$s] eq >> 'orange0') { >> + elsif ($key[$s] eq 'unknown') { >> + print "unknown"; >> + } >> + # Looks dangerous to use hardcoded interface names here. Probably >> needs fixing. >> + if ($key[$s] eq 'blue0' || $key[$s] eq 'green0' || $key[$s] eq >> 'orange0' ) { >> print "<td align='center' $col>$key[$s]</td>"; >> } >> else { >> @@ -489,10 +502,8 @@ for($s=0;$s<$lines;$s++) >> >> if($cgiparams{'otherspie'} == 2 ){} >> else{ >> - my $colorIndex = $color % 10; >> - if($colorIndex == 0) { >> - $colorIndex = 10; >> - } >> + # colors are numbered 1 to 10 >> + my $colorIndex = ($color % 10) + 1; >> $col="bgcolor='$color{\"color$colorIndex\"}'"; >> print "<tr>"; >> >> diff --git a/html/cgi-bin/logs.cgi/firewalllogip.dat b/html/cgi >> -bin/logs.cgi/firewalllogip.dat >> index 7d82d20..6fc3422 100644 >> --- a/html/cgi-bin/logs.cgi/firewalllogip.dat >> +++ b/html/cgi-bin/logs.cgi/firewalllogip.dat >> @@ -291,7 +291,8 @@ if ($pienumber == -1 || $pienumber > $lines || >> $sortcolumn == 2) { $pienumber = >> $lines = 0; >> foreach $_ (@log) >> { >> - if($_ =~ /SRC\=([\d\.]+)/){ >> + # Extract ipv4 or ipv6 address >> + if (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ >> /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { >> $tabjc{$1} = $tabjc{$1} + 1 ; >> if(($tabjc{$1} == 1) && ($lines < $pienumber)) { $lines = >> $lines + 1; } >> $linesjc++; >> @@ -428,10 +429,8 @@ for($s=0;$s<$lines;$s++) >> $percent = $value[$s] * 100 / $linesjc; >> $percent = sprintf("%.f", $percent); >> $total = $total + $value[$s]; >> - my $colorIndex = $color % 10; >> - if($colorIndex == 0) { >> - $colorIndex = 10; >> - } >> + # colors are numbered 1 to 10 >> + my $colorIndex = ($color % 10) + 1; >> $col="bgcolor='$color{\"color$colorIndex\"}'"; >> print "<tr>"; >> >> @@ -459,10 +458,8 @@ for($s=0;$s<$lines;$s++) >> >> if($cgiparams{'otherspie'} == 2 ){} >> else{ >> - my $colorIndex = $color % 10; >> - if($colorIndex == 0) { >> - $colorIndex = 10; >> - } >> + # colors are numbered 1 to 10 >> + my $colorIndex = ($color % 10) + 1; >> $col="bgcolor='$color{\"color$colorIndex\"}'"; >> print "<tr>"; >> >> diff --git a/html/cgi-bin/logs.cgi/firewalllogport.dat b/html/cgi >> -bin/logs.cgi/firewalllogport.dat >> index 5b0db62..583c1b3 100644 >> --- a/html/cgi-bin/logs.cgi/firewalllogport.dat >> +++ b/html/cgi-bin/logs.cgi/firewalllogport.dat >> @@ -429,10 +429,8 @@ for($s=0;$s<$lines;$s++) >> $percent = $value[$s] * 100 / $linesjc; >> $percent = sprintf("%.f", $percent); >> $total = $total + $value[$s]; >> - my $colorIndex = $color % 10; >> - if($colorIndex == 0) { >> - $colorIndex = 10; >> - } >> + # colors are numbered 1 to 10 >> + my $colorIndex = ($color % 10) + 1; >> $col="bgcolor='$color{\"color$colorIndex\"}'"; >> print "<tr>"; >> >> @@ -446,10 +444,8 @@ for($s=0;$s<$lines;$s++) >> >> if($cgiparams{'otherspie'} == 2 ){} >> else{ >> - my $colorIndex = $color % 10; >> - if($colorIndex == 0) { >> - $colorIndex = 10; >> - } >> + # colors are numbered 1 to 10 >> + my $colorIndex = ($color % 10) + 1; >> $col="bgcolor='$color{\"color$colorIndex\"}'"; >> print "<tr>"; >> >> diff --git a/html/cgi-bin/logs.cgi/showrequestfromcountry.dat >> b/html/cgi-bin/logs.cgi/showrequestfromcountry.dat >> index 5283c42..0784ab9 100644 >> --- a/html/cgi-bin/logs.cgi/showrequestfromcountry.dat >> +++ b/html/cgi-bin/logs.cgi/showrequestfromcountry.dat >> @@ -158,23 +158,35 @@ if (!$skip) >> { >> while (<FILE>) >> { >> - if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(IN=.*)$/) { >> - my $packet = $2; >> - $packet =~ /IN=(\w+)/; my $iface=$1; if ( $1 =~ >> /2./ ){ $iface="";} >> - $packet =~ /SRC=([\d\.]+)/; my $srcaddr=$1; >> + # First check whether valid log line (date, day) >> + if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(IN=.*)$/) { >> + # If ipv6 uses bridge, then use PHYSIN otherwise use IN >> + if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(PHYSIN=.*)$/) {} >> + elsif (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(IN=.*)$/) {} >> + my $packet = $2; >> + my $iface = ''; >> + my $srcaddr = ''; >> + # If ipv6 uses bridge, use PHYSIN otherwise IN >> + if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif >> ($packet =~ /IN=(\w+)/) { $iface = $1 } >> + # Extract ipv4 and ipv6 addresses >> + if (($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) >> or ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA >> -F]{0,4})){2,7})/)) { >> + $srcaddr = $1 >> + }; >> >> if($iface eq $country) { >> + # iface matches country code >> $log[$lines] = $_; >> $lines++; >> } >> elsif($srcaddr ne '') { >> + # or srcaddr matches country code >> my $ccode = $gi->country_code_by_name($srcaddr); >> if($ccode eq $country){ >> $log[$lines] = $_; >> $lines++; >> } >> } >> - } >> + } >> } >> close (FILE); >> } >> @@ -194,16 +206,28 @@ if ($multifile) { >> } >> if (!$skip) { >> while (<FILE>) { >> - if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(IN=.*)$/) { >> - if($_ =~ /SRC\=([\d\.]+)/){ >> - my $srcaddr=$1; >> - my $ccode = $gi->country_code_by_name($srcaddr); >> - if($ccode eq $country){ >> + # Check if valid log line (date, day) >> + if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(IN=.*)$/) { >> + my $iface = ''; >> + # If ipv6 uses bridge, then use PHYSIN otherwise >> IN >> + if ($_ =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif >> ($_ =~ /IN=(\w+)/) { $iface = $1 } >> + >> + if($iface eq $country) { >> + # iface matches country code >> + $log[$lines] = $_; >> + $lines++; >> + } >> + # extract ipv4 and ipv6 address >> + elsif (($_ =~ >> /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA >> -F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { >> + my $srcaddr=$1; >> + my $ccode = $gi >> ->country_code_by_name($srcaddr); >> + if($ccode eq $country){ >> + # or srcaddr matches country code >> $log[$lines] = $_; >> $lines++; >> + } >> } >> - } >> - } >> + } >> } >> close (FILE); >> } >> @@ -308,32 +332,45 @@ $lines = 0; >> foreach $_ (@slice) >> { >> $a = $_; >> - /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; >> + # If ipv6 uses bridge, use PHYSIN otherwise use IN >> + if (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} >> + elsif (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {}; >> my $packet = $4; >> - $packet =~ /IN=(\w+)/; my $iface=$1; if ( $1 =~ /2./ ){ >> $iface="";} >> - $packet =~ /SRC=([\d\.]+)/; my $srcaddr=$1; >> + my $iface = ''; >> + # If ipv6 uses bridge, use PHYSIN otherwise use IN >> + if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($packet =~ >> /IN=(\w+)/) { $iface = $1 } >> + if ( $1 =~ /2./ ){ $iface="";} >> + my $srcaddr = ''; >> + # Extract ipv4 and ipv6 addresses >> + if (($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or >> ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) >> { >> + $srcaddr = $1 >> + }; >> >> if($iface eq $country || $srcaddr ne '') { >> - my $ccode; >> + my $ccode=''; >> if($iface ne $country) { >> $ccode = $gi->country_code_by_name($srcaddr); >> } >> if($iface eq $country || $ccode eq $country) { >> - my $chain = ''; >> + my $chain = ''; >> my $in = '-'; my $out = '-'; >> my $srcaddr = ''; my $dstaddr = ''; >> my $protostr = ''; >> my $srcport = ''; my $dstport = ''; >> >> - $_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; >> + # If ipv6 uses bridge, the use PHYSIN otherwise use IN >> + if ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} >> + elsif ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} >> my $timestamp = $1; my $chain = $2; my $packet = $3; >> $timestamp =~ /(...) (..) (..:..:..)/; >> my $month = $1; my $day = $2; my $time = $3; >> >> - if ($a =~ /IN\=(\w+)/) { $iface = $1; } >> - if ($a =~ /OUT\=(\w+)/) { $out = $1; } >> - if ($a =~ /SRC\=([\d\.]+)/) { $srcaddr = $1; } >> - if ($a =~ /DST\=([\d\.]+)/) { $dstaddr = $1; } >> + # If ipv6 uses bridge, use PHYSIN and PHYSOUT, otherwise use >> IN and OUT >> + if ($a =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($a =~ >> /IN=(\w+)/) { $iface = $1 } >> + if ($a =~ /PHYSOUT=(\w+)/) { $out = $1 } elsif ($a =~ >> /OUT=(\w+)/) { $out = $1 } >> + # Extract ipv4 and ipv6 addresses >> + if (($a =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ >> /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr = >> $1; } >> + if (($a =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ >> /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr = >> $1; } >> if ($a =~ /PROTO\=(\w+)/) { $protostr = $1; } >> my $protostrlc = lc($protostr); >> if ($a =~ /SPT\=([\d\.]+)/){ $srcport = $1; } >> diff --git a/html/cgi-bin/logs.cgi/showrequestfromip.dat b/html/cgi >> -bin/logs.cgi/showrequestfromip.dat >> index 09a60b5..94e795c 100644 >> --- a/html/cgi-bin/logs.cgi/showrequestfromip.dat >> +++ b/html/cgi-bin/logs.cgi/showrequestfromip.dat >> @@ -155,7 +155,7 @@ if (!$skip) >> while (<FILE>) >> { >> if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(IN=.*)$/) { >> - if($_ =~ /SRC\=([\d\.]+)/){ >> + if (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) >> or ($_ =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { >> if($1 eq $ip){ >> $log[$lines] = $_; >> $lines++; >> @@ -182,12 +182,12 @@ if ($multifile) { >> if (!$skip) { >> while (<FILE>) { >> if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ >> kernel:.*(IN=.*)$/) { >> - if($_ =~ /SRC\=([\d\.]+)/){ >> - if($1 eq $ip){ >> + if (($_ =~ >> /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA >> -F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { >> + if($1 eq $ip){ >> $log[$lines] = $_; >> $lines++; >> - } >> - } >> + } >> + } >> } >> } >> close (FILE); >> @@ -293,7 +293,8 @@ $lines = 0; >> foreach $_ (@slice) >> { >> $a = $_; >> - if($_ =~ /SRC\=([\d\.]+)/){ >> + # Check whether valid ipv4 or ipv6 address >> + if (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ >> /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { >> if($1 eq $ip){ >> my $chain = ''; >> my $in = '-'; my $out = '-'; >> @@ -301,15 +302,19 @@ foreach $_ (@slice) >> my $protostr = ''; >> my $srcport = ''; my $dstport = ''; >> >> - $_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; >> + # If ipv6 uses bridge, the use PHYSIN, otherwise use IN >> + if ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) >> {} >> + elsif ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) >> {} >> my $timestamp = $1; my $chain = $2; my $packet = $3; >> $timestamp =~ /(...) (..) (..:..:..)/; >> my $month = $1; my $day = $2; my $time = $3; >> >> - if ($a =~ /IN\=(\w+)/) { $iface = $1; } >> - if ($a =~ /OUT\=(\w+)/) { $out = $1; } >> - if ($a =~ /SRC\=([\d\.]+)/) { $srcaddr = $1; } >> - if ($a =~ /DST\=([\d\.]+)/) { $dstaddr = $1; } >> + # If ipv6 uses bridge, the use PHYSIN and PHYSOUT, otherwise >> use IN and OUT >> + if ($a =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($a =~ >> /IN=(\w+)/) { $iface = $1 } >> + if ($a =~ /PHYSOUT=(\w+)/) { $out = $1 } elsif ($a =~ >> /OUT=(\w+)/) { $out = $1 } >> + # Detect ipv4 and ipv6 addresses >> + if (($a =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ >> /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr = >> $1; } >> + if (($a =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ >> /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr = >> $1; } >> if ($a =~ /PROTO\=(\w+)/) { $protostr = $1; } >> my $protostrlc = lc($protostr); >> if ($a =~ /SPT\=([\d\.]+)/){ $srcport = $1; } >> diff --git a/html/cgi-bin/logs.cgi/showrequestfromport.dat b/html/cgi >> -bin/logs.cgi/showrequestfromport.dat >> index ad9823c..af7779a 100644 >> --- a/html/cgi-bin/logs.cgi/showrequestfromport.dat >> +++ b/html/cgi-bin/logs.cgi/showrequestfromport.dat >> @@ -307,15 +307,19 @@ foreach $_ (@slice) >> my $protostr = ''; >> my $srcport = ''; my $dstport = ''; >> >> - $_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; >> + # If ipv6 uses bridge, the use PHYSIN, otherwise use IN >> + if ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} >> + elsif ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) >> {} >> my $timestamp = $1; my $chain = $2; my $packet = $3; >> $timestamp =~ /(...) (..) (..:..:..)/; >> my $month = $1; my $day = $2; my $time = $3; my $iface; >> >> - if ($a =~ /IN\=(\w+)/) { $iface = $1; } >> - if ($a =~ /OUT\=(\w+)/) { $out = $1; } >> - if ($a =~ /SRC\=([\d\.]+)/) { $srcaddr = $1; } >> - if ($a =~ /DST\=([\d\.]+)/) { $dstaddr = $1; } >> + # If ipv6 uses bridge, the use PHYSIN and PHYSOUT, otherwise >> use IN and OUT >> + if ($a =~ /PHYSIN\=(\w+)/) { $iface = $1; } elsif ($a =~ >> /IN\=(\w+)/) { $iface = $1; } >> + if ($a =~ /PHYSOUT\=(\w+)/) { $out = $1; } elsif ($a =~ >> /OUT\=(\w+)/) { $out = $1; } >> + # Detect ipv4 and ipv6 addresses >> + if (($a =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ >> /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr = >> $1; } >> + if (($a =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ >> /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr = >> $1; } >> if ($a =~ /PROTO\=(\w+)/) { $protostr = $1; } >> my $protostrlc = lc($protostr); >> if ($a =~ /SPT\=([\d\.]+)/){ $srcport = $1; } >

3 5

IPFire 3 and IPv6
by Michael Tremer 23 Jan '16

23 Jan '16

Hi, because this topic came up a few times in the last days I would like to post an update to keep us all on the same page. So years ago we made the decision to get rid of most of the unmaintainable code in IPFire 2, rewrite it and by doing that adding support for IPv6. IPv6 is really difficult because many things do not work like they do with IPv4. So just adding that wasn't very well possible either in our opinion. So far we have pretty much completed a lot of the work of the network stack. That is what I call everything that is in the "network" package. http://git.ipfire.org/?p=network.git;a=summary https://pakfire.ipfire.org/package/network Please have a look around. I also held a talk about this at the last summit. It is really not the best, but should give you a brief introduction about how things work, are supposed to work, and what some of the thoughts behind that are. https://www.youtube.com/watch?v=xzLmUvNrAik As mentioned in there, this is pretty much at an alpha state and needs more work to get stable. This is why I am writing this email. If you are interested in working on IPFire 3, maybe install the latest image and set up networking on it. That might run either very well, or you might run into some bugs. In the latter case, please open bug reports. The network component is the core of the IPFire functionality. It should be rock solid hence we need to test it well and make it as robust as we possibly can. It is working for me and some others have been playing around with it, but every new user will run into new bugs :) When we have this working properly, we can move on to the next big things that are still to do in IPFire 3. The latest image can be downloaded here: http://people.ipfire.org/~stevee/IPFire_3.x/VM-Images/20151101/x86_64/ Documentation is available here: http://source.ipfire.org/releases/network/man-pages/ Pay special attention to the quick start guide: http://source.ipfire.org/releases/network/man-pages/network-quick-start.html There is also more on this in the talk. Best, -Michael

1 0

Re: Apache 2.4 and php 5.6 test branch
by Daniel Weismüller 23 Jan '16

23 Jan '16

Hi Marcel Sorry for the late answer. I've taken a look on your new branch. I'm really saddened to have to say that we still can't use it. We can't use update packs like you build them. We need every single thing in his own branch. I know it is much more effort but at least it is much better because they won't collide with other updates. Another advantage is that each part is individually maintainable. So it would be really great if you could split your work into cutie little pieces. :-) Thanks a lot. - Daniel Am 04.12.2015 um 19:22 schrieb Marcel Lorenz: > > Hi Daniel > > I have created a test branch new-apache-php. > > With berekeley 6.1.26 and ICU 56.1 for apache. > > mcrypt is a prerequisite for php. > > Apache ./configure log : > > checking db6/db.h usability... yes > > checking db6/db.h presence... yes > > checking for db6/db.h... yes > > checking for -ldb-6.1... yes > > checking for Berkeley DB... found db6 > > checking for default DBM... sdbm (default) > > setting LDADD_dbm_db to "-ldb-6.1" > > Commit text: > > Update to new Apache 2.4 and PHP 5.6 > > Apache 2.4.17 > > PHP 5.6.16 > > mcrypt 2.6.8 (new) > > Comments: > > Apache works in event mode and uses Berkeley DB6 > > PHP is multithreaded > > Apache config folder is changed from /etc/httpd/conf/ to /etc/httpd/ > > Apache 2.4.x need this change. The sysconfdir layout entry has no > effekt more. > > All relevant lfs and rootfiles are updated (owncloud, naigos(sql), > phpSANE, icniga, cacti) > > http://git.ipfire.org/?p=people/mlorenz/ipfire-2.x.git;a=shortlog;h=refs/he… > > I have testet the iso from this branch. Owncloud, cacti , icniga, > naigos has yet to betested.. > > Marcel >

8 21

[PATCH] dnsmasq 2.75: latest patches from upstream (051-055)
by Matthias Fischer 23 Jan '16

23 Jan '16

For the records: I'm testing this one since a few days. No problems yet. For details see: http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=summary Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dnsmasq | 5 + .../051-Fix_botch_in_forward_c_flags_code.patch | 29 +++ .../052-Fix_sporadic_crash_in_find_mac.patch | 27 +++ ..._code_and_set_conntrack_on_DNSSEC_queries.patch | 270 +++++++++++++++++++++ ...ms_in_last_commit_when_DNSSEC_not_enabled.patch | 58 +++++ ...main-needed_set_and_no_servers_configured.patch | 91 +++++++ 6 files changed, 480 insertions(+) create mode 100644 src/patches/dnsmasq/051-Fix_botch_in_forward_c_flags_code.patch create mode 100644 src/patches/dnsmasq/052-Fix_sporadic_crash_in_find_mac.patch create mode 100644 src/patches/dnsmasq/053-Complete_DNSSEC_server-selection_code_and_set_conntrack_on_DNSSEC_queries.patch create mode 100644 src/patches/dnsmasq/054-Fix_problems_in_last_commit_when_DNSSEC_not_enabled.patch create mode 100644 src/patches/dnsmasq/055-Fix_wrong_reply_to_simple_name_when_--domain-needed_set_and_no_servers_configured.patch diff --git a/lfs/dnsmasq b/lfs/dnsmasq index 4e5951f..5134c13 100644 --- a/lfs/dnsmasq +++ b/lfs/dnsmasq @@ -123,6 +123,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/048-Disable_DNSSEC_for_server_domain_servers_unless_trust-anchor_provided.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/049-arp_c_tidy_up.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/050-Complete_work_to_allow_DNSSEC_validation_with_private_DNS_servers.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/051-Fix_botch_in_forward_c_flags_code.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/052-Fix_sporadic_crash_in_find_mac.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/053-Complete_DNSSEC_server-selection_code_and_set_conntrack_on_DNSSEC_queries.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/054-Fix_problems_in_last_commit_when_DNSSEC_not_enabled.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/055-Fix_wrong_reply_to_simple_name_when_--domain-needed_set_and_no_servers_configured.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch cd $(DIR_APP) && sed -i src/config.h \ diff --git a/src/patches/dnsmasq/051-Fix_botch_in_forward_c_flags_code.patch b/src/patches/dnsmasq/051-Fix_botch_in_forward_c_flags_code.patch new file mode 100644 index 0000000..aff7f37 --- /dev/null +++ b/src/patches/dnsmasq/051-Fix_botch_in_forward_c_flags_code.patch @@ -0,0 +1,29 @@ +From 1801a29226c53e8af3f7a0f149d3ec9f06c04f3c Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Sun, 17 Jan 2016 21:53:57 +0000 +Subject: [PATCH] Fix botch in forward.c flags code. + +Thanks to Matthias Anfree for spotting this. +--- + src/forward.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/forward.c b/src/forward.c +index c48fd75..95c5ef9 100644 +--- a/src/forward.c ++++ b/src/forward.c +@@ -810,9 +810,9 @@ void reply_query(int fd, int family, time_t now) + { + header->hb3 &= ~(HB3_QR | HB3_AA | HB3_TC); + header->hb4 &= ~(HB4_RA | HB4_RCODE | HB4_CD | HB4_AD); +- if (forward->flags |= FREC_CHECKING_DISABLED) ++ if (forward->flags & FREC_CHECKING_DISABLED) + header->hb4 |= HB4_CD; +- if (forward->flags |= FREC_AD_QUESTION) ++ if (forward->flags & FREC_AD_QUESTION) + header->hb4 |= HB4_AD; + if (forward->flags & FREC_DO_QUESTION) + add_do_bit(header, nn, (unsigned char *)pheader + plen); +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/052-Fix_sporadic_crash_in_find_mac.patch b/src/patches/dnsmasq/052-Fix_sporadic_crash_in_find_mac.patch new file mode 100644 index 0000000..54efae9 --- /dev/null +++ b/src/patches/dnsmasq/052-Fix_sporadic_crash_in_find_mac.patch @@ -0,0 +1,27 @@ +From f4d0c660ca403e933d51093167c0d01526c7f9d1 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Mon, 18 Jan 2016 12:51:08 +0000 +Subject: [PATCH] Fix sporadic crash in find_mac() - hwlen must be zero for + empty entries. + +--- + src/arp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/arp.c b/src/arp.c +index 968455c..d70d2af 100644 +--- a/src/arp.c ++++ b/src/arp.c +@@ -188,7 +188,8 @@ int find_mac(union mysockaddr *addr, unsigned char *mac, int lazy, time_t now) + arps = arp; + arp->status = ARP_EMPTY; + arp->family = addr->sa.sa_family; +- ++ arp->hwlen = 0; ++ + if (addr->sa.sa_family == AF_INET) + arp->addr.addr.addr4.s_addr = addr->in.sin_addr.s_addr; + #ifdef HAVE_IPV6 +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/053-Complete_DNSSEC_server-selection_code_and_set_conntrack_on_DNSSEC_queries.patch b/src/patches/dnsmasq/053-Complete_DNSSEC_server-selection_code_and_set_conntrack_on_DNSSEC_queries.patch new file mode 100644 index 0000000..3f8b053 --- /dev/null +++ b/src/patches/dnsmasq/053-Complete_DNSSEC_server-selection_code_and_set_conntrack_on_DNSSEC_queries.patch @@ -0,0 +1,270 @@ +From f344dbc62216570b6471c81e4e39fc99bf47af5f Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Mon, 18 Jan 2016 18:04:17 +0000 +Subject: [PATCH] Complete DNSSEC server-selection code and set conntrack on + DNSSEC queries. + +--- + src/forward.c | 148 ++++++++++++++++++++++++++++++++++++++++++++++----------- + 1 file changed, 121 insertions(+), 27 deletions(-) + +diff --git a/src/forward.c b/src/forward.c +index 95c5ef9..506d194 100644 +--- a/src/forward.c ++++ b/src/forward.c +@@ -923,7 +923,7 @@ void reply_query(int fd, int family, time_t now) + status = STAT_ABANDONED; + else + { +- int fd, type; ++ int fd, type = SERV_DO_DNSSEC; + struct frec *next = new->next; + char *domain; + +@@ -936,7 +936,7 @@ void reply_query(int fd, int family, time_t now) + servers for domains are involved. */ + if (search_servers(now, NULL, F_QUERY, daemon->keyname, &type, &domain, NULL) == 0) + { +- struct server *start = server; ++ struct server *start = server, *new_server = NULL; + type &= ~SERV_DO_DNSSEC; + + while (1) +@@ -945,8 +945,12 @@ void reply_query(int fd, int family, time_t now) + (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) && + !(start->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP))) + { +- server = start; +- break; ++ new_server = start; ++ if (server == start) ++ { ++ new_server = NULL; ++ break; ++ } + } + + if (!(start = start->next)) +@@ -954,7 +958,11 @@ void reply_query(int fd, int family, time_t now) + if (start == server) + break; + } ++ ++ if (new_server) ++ server = new_server; + } ++ + new->sentto = server; + + new->rfd4 = NULL; +@@ -1010,6 +1018,15 @@ void reply_query(int fd, int family, time_t now) + + if (fd != -1) + { ++#ifdef HAVE_CONNTRACK ++ /* Copy connection mark of incoming query to outgoing connection. */ ++ if (option_bool(OPT_CONNTRACK)) ++ { ++ unsigned int mark; ++ if (get_incoming_mark(&orig->source, &orig->dest, 0, &mark)) ++ setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); ++ } ++#endif + while (retry_send(sendto(fd, (char *)header, nn, 0, + &server->addr.sa, + sa_len(&server->addr)))); +@@ -1072,7 +1089,7 @@ void reply_query(int fd, int family, time_t now) + else + header->hb4 &= ~HB4_CD; + +- if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure, bogusanswer, ++ if ((nn = process_reply(header, now, forward->sentto, (size_t)n, check_rebind, no_cache_dnssec, cache_secure, bogusanswer, + forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION, + forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source))) + { +@@ -1433,20 +1450,27 @@ void receive_query(struct listener *listen, time_t now) + } + + #ifdef HAVE_DNSSEC ++/* Recurse up the key heirarchy */ + static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n, +- int class, char *name, char *keyname, struct server *server, int *keycount) ++ int class, char *name, char *keyname, struct server *server, ++ int have_mark, unsigned int mark, int *keycount) + { +- /* Recurse up the key heirarchy */ + int new_status; + unsigned char *packet = NULL; +- size_t m; + unsigned char *payload = NULL; + struct dns_header *new_header = NULL; + u16 *length = NULL; +- unsigned char c1, c2; ++ ++ (void)have_mark; ++ (void)mark; + + while (1) + { ++ int type = SERV_DO_DNSSEC; ++ char *domain; ++ size_t m; ++ unsigned char c1, c2; ++ + /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */ + if (--(*keycount) == 0) + new_status = STAT_ABANDONED; +@@ -1480,6 +1504,67 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si + new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr, server->edns_pktsz); + + *length = htons(m); ++ ++ /* Find server to forward to. This will normally be the ++ same as for the original query, but may be another if ++ servers for domains are involved. */ ++ if (search_servers(now, NULL, F_QUERY, keyname, &type, &domain, NULL) == 0) ++ { ++ struct server *start = server, *new_server = NULL; ++ type &= ~SERV_DO_DNSSEC; ++ ++ while (1) ++ { ++ if (type == (start->flags & SERV_TYPE) && ++ (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) && ++ !(start->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP))) ++ { ++ new_server = start; ++ if (server == start) ++ { ++ new_server = NULL; ++ break; ++ } ++ } ++ ++ if (!(start = start->next)) ++ start = daemon->servers; ++ if (start == server) ++ break; ++ } ++ ++ ++ if (new_server) ++ { ++ server = new_server; ++ /* may need to make new connection. */ ++ if (server->tcpfd == -1) ++ { ++ if ((server->tcpfd = socket(server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1) ++ { ++ new_status = STAT_ABANDONED; ++ break; ++ } ++ ++#ifdef HAVE_CONNTRACK ++ /* Copy connection mark of incoming query to outgoing connection. */ ++ if (have_mark) ++ setsockopt(server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); ++#endif ++ ++ if (!local_bind(server->tcpfd, &server->source_addr, server->interface, 1) || ++ connect(server->tcpfd, &server->addr.sa, sa_len(&server->addr)) == -1) ++ { ++ close(server->tcpfd); ++ server->tcpfd = -1; ++ new_status = STAT_ABANDONED; ++ break; ++ } ++ ++ } ++ } ++ } ++ + + if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) || + !read_write(server->tcpfd, &c1, 1, 1) || +@@ -1492,7 +1577,7 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si + + m = (c1 << 8) | c2; + +- new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount); ++ new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, have_mark, mark, keycount); + + if (new_status != STAT_OK) + break; +@@ -1536,10 +1621,30 @@ unsigned char *tcp_request(int confd, time_t now, + socklen_t peer_len = sizeof(union mysockaddr); + int query_count = 0; + unsigned char *pheader; ++#ifdef HAVE_CONNTRACK ++ unsigned int mark = 0; ++ int have_mark = 0; ++#endif + + if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1) + return packet; +- ++ ++#ifdef HAVE_CONNTRACK ++ /* Get connection mark of incoming query to set on outgoing connections. */ ++ if (option_bool(OPT_CONNTRACK)) ++ { ++ struct all_addr local; ++#ifdef HAVE_IPV6 ++ if (local_addr->sa.sa_family == AF_INET6) ++ local.addr.addr6 = local_addr->in6.sin6_addr; ++ else ++#endif ++ local.addr.addr4 = local_addr->in.sin_addr; ++ ++ have_mark = get_incoming_mark(&peer_addr, &local, 1, &mark); ++ } ++#endif ++ + /* We can be configured to only accept queries from at-most-one-hop-away addresses. */ + if (option_bool(OPT_LOCAL_SERVICE)) + { +@@ -1665,7 +1770,7 @@ unsigned char *tcp_request(int confd, time_t now, + { + unsigned int flags = 0; + struct all_addr *addrp = NULL; +- int type = 0; ++ int type = SERV_DO_DNSSEC; + char *domain = NULL; + size_t new_size = add_edns0_config(header, size, ((unsigned char *) header) + 65536, &peer_addr, now, &check_subnet); + +@@ -1728,20 +1833,8 @@ unsigned char *tcp_request(int confd, time_t now, + + #ifdef HAVE_CONNTRACK + /* Copy connection mark of incoming query to outgoing connection. */ +- if (option_bool(OPT_CONNTRACK)) +- { +- unsigned int mark; +- struct all_addr local; +-#ifdef HAVE_IPV6 +- if (local_addr->sa.sa_family == AF_INET6) +- local.addr.addr6 = local_addr->in6.sin6_addr; +- else +-#endif +- local.addr.addr4 = local_addr->in.sin_addr; +- +- if (get_incoming_mark(&peer_addr, &local, 1, &mark)) +- setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); +- } ++ if (have_mark) ++ setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); + #endif + + if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) || +@@ -1802,7 +1895,8 @@ unsigned char *tcp_request(int confd, time_t now, + if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled && (last_server->flags & SERV_DO_DNSSEC)) + { + int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */ +- int status = tcp_key_recurse(now, STAT_OK, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount); ++ int status = tcp_key_recurse(now, STAT_OK, header, m, 0, daemon->namebuff, daemon->keyname, ++ last_server, have_mark, mark, &keycount); + char *result, *domain = "result"; + + if (status == STAT_ABANDONED) +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/054-Fix_problems_in_last_commit_when_DNSSEC_not_enabled.patch b/src/patches/dnsmasq/054-Fix_problems_in_last_commit_when_DNSSEC_not_enabled.patch new file mode 100644 index 0000000..f409038 --- /dev/null +++ b/src/patches/dnsmasq/054-Fix_problems_in_last_commit_when_DNSSEC_not_enabled.patch @@ -0,0 +1,58 @@ +From f7443d76f7b4ff1c2eb05a0313619b0a4bb8787e Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Tue, 19 Jan 2016 20:29:57 +0000 +Subject: [PATCH] Fix problems in last commit when DNSSEC not enabled. + +--- + src/forward.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/src/forward.c b/src/forward.c +index 506d194..ff0ab7e 100644 +--- a/src/forward.c ++++ b/src/forward.c +@@ -331,8 +331,8 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + + #ifdef HAVE_DNSSEC + do_dnssec = type & SERV_DO_DNSSEC; +- type &= ~SERV_DO_DNSSEC; +-#endif ++#endif ++ type &= ~SERV_DO_DNSSEC; + + if (!flags && !(forward = get_new_frec(now, NULL, 0))) + /* table full - server failure. */ +@@ -1461,9 +1461,6 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si + struct dns_header *new_header = NULL; + u16 *length = NULL; + +- (void)have_mark; +- (void)mark; +- + while (1) + { + int type = SERV_DO_DNSSEC; +@@ -1621,10 +1618,8 @@ unsigned char *tcp_request(int confd, time_t now, + socklen_t peer_len = sizeof(union mysockaddr); + int query_count = 0; + unsigned char *pheader; +-#ifdef HAVE_CONNTRACK + unsigned int mark = 0; + int have_mark = 0; +-#endif + + if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1) + return packet; +@@ -1783,9 +1778,7 @@ unsigned char *tcp_request(int confd, time_t now, + if (gotname) + flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind); + +-#ifdef HAVE_DNSSEC + type &= ~SERV_DO_DNSSEC; +-#endif + + if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server) + last_server = daemon->servers; +-- +1.7.10.4 + diff --git a/src/patches/dnsmasq/055-Fix_wrong_reply_to_simple_name_when_--domain-needed_set_and_no_servers_configured.patch b/src/patches/dnsmasq/055-Fix_wrong_reply_to_simple_name_when_--domain-needed_set_and_no_servers_configured.patch new file mode 100644 index 0000000..9eea14a --- /dev/null +++ b/src/patches/dnsmasq/055-Fix_wrong_reply_to_simple_name_when_--domain-needed_set_and_no_servers_configured.patch @@ -0,0 +1,91 @@ +From d05dd58de1113bb99060af2772247a45ceb3a1ad Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Tue, 19 Jan 2016 21:23:30 +0000 +Subject: [PATCH] Fix wrong reply to simple name when --domain-needed set and + no servers configured. + +Also return REFUSED and not SERVFAIL when out of memory. + +Thanks to Allain Legacy for problem report. +--- + CHANGELOG | 9 +++++++++ + src/forward.c | 13 +++++++------ + src/rfc1035.c | 4 +--- + 3 files changed, 17 insertions(+), 9 deletions(-) + +diff --git a/CHANGELOG b/CHANGELOG +index dcaa699..d3cf909 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -22,6 +22,15 @@ version 2.76 + reading a hosts-file fails. Thanks to AndrÃ© GlÃ¼pker + for the patch. + ++ Fix wrong answer to simple name query when --domain-needed ++ set, but no upstream servers configured. Dnsmasq returned ++ REFUSED, in this case, when it should be the same as when ++ upstream servers are configured - NOERROR. Thanks to ++ Allain Legacy for spotting the problem. ++ ++ Return REFUSED when running out of forwarding table slots, ++ not SERVFAIL. ++ + + version 2.75 + Fix reversion on 2.74 which caused 100% CPU use when a +diff --git a/src/forward.c b/src/forward.c +index ff0ab7e..414f988 100644 +--- a/src/forward.c ++++ b/src/forward.c +@@ -249,9 +249,7 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + (void)do_bit; + + /* may be no servers available. */ +- if (!daemon->servers) +- forward = NULL; +- else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash)))) ++ if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash)))) + { + /* If we didn't get an answer advertising a maximal packet in EDNS, + fall back to 1280, which should work everywhere on IPv6. +@@ -334,9 +332,9 @@ static int forward_query(int udpfd, union mysockaddr *udpaddr, + #endif + type &= ~SERV_DO_DNSSEC; + +- if (!flags && !(forward = get_new_frec(now, NULL, 0))) +- /* table full - server failure. */ +- flags = F_NEG; ++ if (daemon->servers && !flags) ++ forward = get_new_frec(now, NULL, 0); ++ /* table full - flags == 0, return REFUSED */ + + if (forward) + { +@@ -1621,6 +1619,9 @@ unsigned char *tcp_request(int confd, time_t now, + unsigned int mark = 0; + int have_mark = 0; + ++ (void)mark; ++ (void)have_mark; ++ + if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1) + return packet; + +diff --git a/src/rfc1035.c b/src/rfc1035.c +index 55dec48..9c0ddb5 100644 +--- a/src/rfc1035.c ++++ b/src/rfc1035.c +@@ -896,9 +896,7 @@ size_t setup_reply(struct dns_header *header, size_t qlen, + header->nscount = htons(0); + header->arcount = htons(0); + header->ancount = htons(0); /* no answers unless changed below */ +- if (flags == F_NEG) +- SET_RCODE(header, SERVFAIL); /* couldn't get memory */ +- else if (flags == F_NOERR) ++ if (flags == F_NOERR) + SET_RCODE(header, NOERROR); /* empty domain */ + else if (flags == F_NXDOMAIN) + SET_RCODE(header, NXDOMAIN); +-- +1.7.10.4 + -- 2.7.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2016