Development January 2016

development@lists.ipfire.org

17 participants
55 discussions

AW: Re: The parallel projects
by Marcel Lorenz 23 Jan '16

23 Jan '16

Hallo, vielleicht auch von mir ein kleiner Abschlusskommentar. Leider in Deutsch. Das Wort "useless" ist sicherlich von meiner Seite unglücklich gewählt. Ich habe für mich leider keinen Zugang zur Mailingliste gefunden bzw. (technisch ja) kann da schlicht nicht mitreden auf Grund der Sprachbarriere. Mir fehlt mit Sicherheit auch Wissen über die Zusammenhänge wie das "Upstreaming work" Deutsche Übersetzungen ergeben leider nicht immer einen Sinn. Möglicherweise habe ich mich auch irgendwo verrannt. He agrees that there have to be rules when many people are working together, but he does not accept ours Mir ist nicht mal so recht klar wie "eure" Regeln aussehen. Jenseits von "Post only english" Das ist so ähnlich wie mit Public Ordner anlegen auf dem Server. Dass muss man einfach wissen ansonsten geht man sterben. Auch die technischen Belange wie das überhaupt in die Distri kommt sind mir nicht wirklich bekannt. "If someone wants to take their stuff and post it to the list in an orderly fashion that is something else. Maybe these people can agree that one member of the team is talking to the rest of the developers as a spokesman. I find that just silly, but there might be other ways." Ich denke du hast mich auch nicht richtig verstanden. Mein Gedanke wäre es eine kleine Gruppe zu bilden die gemeinsam an größeren Baustellen zu arbeiten. Aber möglicherweise ist das ein unsinniger Gedanke/Idee. Aus meiner Perspektive sehe ich nur die 2-3 Leute aus dem Forum die mit gepostet haben. Mit "Spokesman" hat das nichts zu tun. "I won't talk with these people as there is clearly no point" Wenn es mir egal wäre würde ich nicht die Zeit aufwenden diese Post zu schreiben. Es ist auch nicht mein Ziel deine (eure) Zeit zu verschwenden. Viele Dinge die für die richtigen Entwickler Usus sind fehlen mir leider. Daher hat sich das so entwickelt. Ich bin aber bereit zu lernen und vielleicht kommt das ja doch noch auf eine grünen Zweig. Vielleicht sind unsere Realitäten aber zu unterschiedlich. Es wäre von meiner Seite schade wenn es so ist. Marcel

2 2

pakfire --verbose
by Larsen 22 Jan '16

22 Jan '16

Hi, I wanted to see if I could add a command line parameter to tell pakfire to be more verbose, instead of silently putting its output into "/var/log/pakfire/update-core-upgrade-##.log". I have cloned the repository https://github.com/ipfire/pakfire.git but cannot find one of the other params (non-interactive, no-colors) in the code. What am I doing wrong? Lars

2 8

[PATCH] cmake: Disable parallelism
by Daniel Weismüller 22 Jan '16

22 Jan '16

Building cmake uses a high amount of memory (>2G) and fails to build on my system. Using less processes reduces memory usage and lets the build succeed. Signed-off-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> --- lfs/cmake | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lfs/cmake b/lfs/cmake index e3d2119..a9ada50 100644 --- a/lfs/cmake +++ b/lfs/cmake @@ -32,9 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) -ifeq "$(MACHINE)" "armv5tel" - MAKETUNING = -j2 -endif +MAKETUNING = -j2 ############################################################################### # Top-level Rules -- 2.4.4

2 1

[PATCH 1/5] Enable correct display of ipv6 entries in Firewall log pages of web UI
by Michael Eitelwein 22 Jan '16

22 Jan '16

3 main changes: - Fill $iface and $out from PHYSIN and PHYSOUT when looking at bridged packets, othewerwise fill from IN and OUT - Recognize ipv4 and ipv6 address style for $srcaddr and $dstaddr - Match color coding of tables to pie charts I am using the bridged ipv6 setup as proposed in the wiki. I do not think this breaks anything when not using ipv6. So it would be nice to include this even if ipv6 is not officially supported yet. It is quite useful when using the ipv6 setup. Signed-off-by: Michael Eitelwein <michael(a)eitelwein.net> --- html/cgi-bin/logs.cgi/firewalllog.dat | 14 ++-- html/cgi-bin/logs.cgi/firewalllogcountry.dat | 43 ++++++++----- html/cgi-bin/logs.cgi/firewalllogip.dat | 15 ++--- html/cgi-bin/logs.cgi/firewalllogport.dat | 12 ++-- html/cgi-bin/logs.cgi/showrequestfromcountry.dat | 81 +++++++++++++++++------- html/cgi-bin/logs.cgi/showrequestfromip.dat | 27 ++++---- html/cgi-bin/logs.cgi/showrequestfromport.dat | 14 ++-- 7 files changed, 131 insertions(+), 75 deletions(-) diff --git a/html/cgi-bin/logs.cgi/firewalllog.dat b/html/cgi-bin/logs.cgi/firewalllog.dat index 5a584d6..42c9612 100644 --- a/html/cgi-bin/logs.cgi/firewalllog.dat +++ b/html/cgi-bin/logs.cgi/firewalllog.dat @@ -328,7 +328,10 @@ END $lines = 0; foreach $_ (@log) { - /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; + # If ipv6 uses a bridge, PHYSIN= contains the relevant iface information + # otherwise use IN= + if ($_ =~ /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} + elsif ($_ =~ /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} my $day = $1; $day =~ tr / /0/; my $time = $cgiparams{'DAY'} ? "$2" : "$day/$2" ; @@ -336,9 +339,12 @@ foreach $_ (@log) my $packet = $4; my ($iface, $srcaddr, $dstaddr, $macaddr, $proto, $srcport, $dstport); - $iface=$1 if $packet =~ /IN=(\w+)/; - $srcaddr=$1 if $packet =~ /SRC=([\d\.]+)/; - $dstaddr=$1 if $packet =~ /DST=([\d\.]+)/; + if ($packet =~ /PHYSIN=(\w+)/) { $iface=$1 } elsif ($packet =~ /IN=(\w+)/) { $iface = $1} + # Identify whether ipv4 or ipv6. Both are mutally exclusive. + if ($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) { $srcaddr=$1 } + if ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/) { $srcaddr=$1 } + if ($packet =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) { $dstaddr=$1 } + if ($packet =~ /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/) { $dstaddr=$1 } $macaddr=$1 if $packet =~ /MAC=([\w+\:]+)/; $proto=$1 if $packet =~ /PROTO=(\w+)/; $srcport=$1 if $packet =~ /SPT=(\d+)/; diff --git a/html/cgi-bin/logs.cgi/firewalllogcountry.dat b/html/cgi-bin/logs.cgi/firewalllogcountry.dat index f998a62..2661ddd 100644 --- a/html/cgi-bin/logs.cgi/firewalllogcountry.dat +++ b/html/cgi-bin/logs.cgi/firewalllogcountry.dat @@ -261,7 +261,6 @@ if( $cgiparams{'pienumber'} != 0){$pienumber=$cgiparams{'pienumber'};} if( $cgiparams{'otherspie'} != 0){$otherspie=$cgiparams{'otherspie'};} if( $cgiparams{'showpie'} != 0){$showpie=$cgiparams{'showpie'};} if( $cgiparams{'sortcolumn'} != 0){$sortcolumn=$cgiparams{'sortcolumn'};} - print <<END </select> </td> @@ -294,15 +293,24 @@ $lines = 0; foreach $_ (@log) { - /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; + # If ipv6 uses bridge, use PHYSIN for iface, otherwise IN + if (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} + elsif (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} my $packet = $4; - $packet =~ /IN=(\w+)/; my $iface=$1; if ( $1 =~ /2./ ){ $iface="";} - $packet =~ /SRC=([\d\.]+)/; my $srcaddr=$1; + my $iface = ''; + if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($packet =~ /IN=(\w+)/) { $iface = $1 } + if ( $1 =~ /2./ ) { $iface=''; } + my $srcaddr = ''; + # Find ipv4 and ipv6 addresses + if ($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) { $srcaddr = $1 } + elsif ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/) { $srcaddr = $1 } if($iface eq $red_interface) { + # Traffic from red if($srcaddr ne '') { + # srcaddr is set my $ccode = $gi->country_code_by_name($srcaddr); - if( $ccode eq '') { + if ($ccode eq '') { $ccode = 'unknown'; } $tabjc{$ccode} = $tabjc{$ccode} + 1 ; @@ -311,11 +319,16 @@ foreach $_ (@log) } } else { + # Traffic not from red if($iface ne '') { $tabjc{$iface} = $tabjc{$iface} + 1 ; if(($tabjc{$iface} == 1) && ($lines < $pienumber)) { $lines = $lines + 1; } $linesjc++; } + else { + # What to do with empty iface lines? + # This probably is traffic from ipfire itself (IN= OUT=XY)? + } } } @@ -423,7 +436,6 @@ if ($showpie != 2 && $pienumber <= 50 && $pienumber != 0) { print "<img src='/graphs/fwlog-country$imagerandom.png'>"; print "</div>"; } - print <<END <table width='100%' class='tbl'> <tr> @@ -448,10 +460,8 @@ for($s=0;$s<$lines;$s++) $percent = $value[$s] * 100 / $linesjc; $percent = sprintf("%.f", $percent); $total = $total + $value[$s]; - my $colorIndex = $color % 10; - if($colorIndex == 0) { - $colorIndex = 10; - } + # colors are numbered 1 to 10 + my $colorIndex = ($color % 10) + 1; $col="bgcolor='$color{\"color$colorIndex\"}'"; $color++; print "<tr>"; @@ -466,8 +476,11 @@ for($s=0;$s<$lines;$s++) print"<input type='hidden' name='country' value='$key[$s]'>"; print"<input type='submit' value='details'></form>"; } - - if($key[$s] eq 'blue0' || $key[$s] eq 'green0' || $key[$s] eq 'orange0') { + elsif ($key[$s] eq 'unknown') { + print "unknown"; + } + # Looks dangerous to use hardcoded interface names here. Probably needs fixing. + if ($key[$s] eq 'blue0' || $key[$s] eq 'green0' || $key[$s] eq 'orange0' ) { print "<td align='center' $col>$key[$s]</td>"; } else { @@ -489,10 +502,8 @@ for($s=0;$s<$lines;$s++) if($cgiparams{'otherspie'} == 2 ){} else{ - my $colorIndex = $color % 10; - if($colorIndex == 0) { - $colorIndex = 10; - } + # colors are numbered 1 to 10 + my $colorIndex = ($color % 10) + 1; $col="bgcolor='$color{\"color$colorIndex\"}'"; print "<tr>"; diff --git a/html/cgi-bin/logs.cgi/firewalllogip.dat b/html/cgi-bin/logs.cgi/firewalllogip.dat index 7d82d20..6fc3422 100644 --- a/html/cgi-bin/logs.cgi/firewalllogip.dat +++ b/html/cgi-bin/logs.cgi/firewalllogip.dat @@ -291,7 +291,8 @@ if ($pienumber == -1 || $pienumber > $lines || $sortcolumn == 2) { $pienumber = $lines = 0; foreach $_ (@log) { - if($_ =~ /SRC\=([\d\.]+)/){ + # Extract ipv4 or ipv6 address + if (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $tabjc{$1} = $tabjc{$1} + 1 ; if(($tabjc{$1} == 1) && ($lines < $pienumber)) { $lines = $lines + 1; } $linesjc++; @@ -428,10 +429,8 @@ for($s=0;$s<$lines;$s++) $percent = $value[$s] * 100 / $linesjc; $percent = sprintf("%.f", $percent); $total = $total + $value[$s]; - my $colorIndex = $color % 10; - if($colorIndex == 0) { - $colorIndex = 10; - } + # colors are numbered 1 to 10 + my $colorIndex = ($color % 10) + 1; $col="bgcolor='$color{\"color$colorIndex\"}'"; print "<tr>"; @@ -459,10 +458,8 @@ for($s=0;$s<$lines;$s++) if($cgiparams{'otherspie'} == 2 ){} else{ - my $colorIndex = $color % 10; - if($colorIndex == 0) { - $colorIndex = 10; - } + # colors are numbered 1 to 10 + my $colorIndex = ($color % 10) + 1; $col="bgcolor='$color{\"color$colorIndex\"}'"; print "<tr>"; diff --git a/html/cgi-bin/logs.cgi/firewalllogport.dat b/html/cgi-bin/logs.cgi/firewalllogport.dat index 5b0db62..583c1b3 100644 --- a/html/cgi-bin/logs.cgi/firewalllogport.dat +++ b/html/cgi-bin/logs.cgi/firewalllogport.dat @@ -429,10 +429,8 @@ for($s=0;$s<$lines;$s++) $percent = $value[$s] * 100 / $linesjc; $percent = sprintf("%.f", $percent); $total = $total + $value[$s]; - my $colorIndex = $color % 10; - if($colorIndex == 0) { - $colorIndex = 10; - } + # colors are numbered 1 to 10 + my $colorIndex = ($color % 10) + 1; $col="bgcolor='$color{\"color$colorIndex\"}'"; print "<tr>"; @@ -446,10 +444,8 @@ for($s=0;$s<$lines;$s++) if($cgiparams{'otherspie'} == 2 ){} else{ - my $colorIndex = $color % 10; - if($colorIndex == 0) { - $colorIndex = 10; - } + # colors are numbered 1 to 10 + my $colorIndex = ($color % 10) + 1; $col="bgcolor='$color{\"color$colorIndex\"}'"; print "<tr>"; diff --git a/html/cgi-bin/logs.cgi/showrequestfromcountry.dat b/html/cgi-bin/logs.cgi/showrequestfromcountry.dat index 5283c42..0784ab9 100644 --- a/html/cgi-bin/logs.cgi/showrequestfromcountry.dat +++ b/html/cgi-bin/logs.cgi/showrequestfromcountry.dat @@ -158,23 +158,35 @@ if (!$skip) { while (<FILE>) { - if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { - my $packet = $2; - $packet =~ /IN=(\w+)/; my $iface=$1; if ( $1 =~ /2./ ){ $iface="";} - $packet =~ /SRC=([\d\.]+)/; my $srcaddr=$1; + # First check whether valid log line (date, day) + if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { + # If ipv6 uses bridge, then use PHYSIN otherwise use IN + if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(PHYSIN=.*)$/) {} + elsif (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) {} + my $packet = $2; + my $iface = ''; + my $srcaddr = ''; + # If ipv6 uses bridge, use PHYSIN otherwise IN + if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($packet =~ /IN=(\w+)/) { $iface = $1 } + # Extract ipv4 and ipv6 addresses + if (($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { + $srcaddr = $1 + }; if($iface eq $country) { + # iface matches country code $log[$lines] = $_; $lines++; } elsif($srcaddr ne '') { + # or srcaddr matches country code my $ccode = $gi->country_code_by_name($srcaddr); if($ccode eq $country){ $log[$lines] = $_; $lines++; } } - } + } } close (FILE); } @@ -194,16 +206,28 @@ if ($multifile) { } if (!$skip) { while (<FILE>) { - if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { - if($_ =~ /SRC\=([\d\.]+)/){ - my $srcaddr=$1; - my $ccode = $gi->country_code_by_name($srcaddr); - if($ccode eq $country){ + # Check if valid log line (date, day) + if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { + my $iface = ''; + # If ipv6 uses bridge, then use PHYSIN otherwise IN + if ($_ =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($_ =~ /IN=(\w+)/) { $iface = $1 } + + if($iface eq $country) { + # iface matches country code + $log[$lines] = $_; + $lines++; + } + # extract ipv4 and ipv6 address + elsif (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { + my $srcaddr=$1; + my $ccode = $gi->country_code_by_name($srcaddr); + if($ccode eq $country){ + # or srcaddr matches country code $log[$lines] = $_; $lines++; + } } - } - } + } } close (FILE); } @@ -308,32 +332,45 @@ $lines = 0; foreach $_ (@slice) { $a = $_; - /^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; + # If ipv6 uses bridge, use PHYSIN otherwise use IN + if (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} + elsif (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {}; my $packet = $4; - $packet =~ /IN=(\w+)/; my $iface=$1; if ( $1 =~ /2./ ){ $iface="";} - $packet =~ /SRC=([\d\.]+)/; my $srcaddr=$1; + my $iface = ''; + # If ipv6 uses bridge, use PHYSIN otherwise use IN + if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($packet =~ /IN=(\w+)/) { $iface = $1 } + if ( $1 =~ /2./ ){ $iface="";} + my $srcaddr = ''; + # Extract ipv4 and ipv6 addresses + if (($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { + $srcaddr = $1 + }; if($iface eq $country || $srcaddr ne '') { - my $ccode; + my $ccode=''; if($iface ne $country) { $ccode = $gi->country_code_by_name($srcaddr); } if($iface eq $country || $ccode eq $country) { - my $chain = ''; + my $chain = ''; my $in = '-'; my $out = '-'; my $srcaddr = ''; my $dstaddr = ''; my $protostr = ''; my $srcport = ''; my $dstport = ''; - $_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; + # If ipv6 uses bridge, the use PHYSIN otherwise use IN + if ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} + elsif ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} my $timestamp = $1; my $chain = $2; my $packet = $3; $timestamp =~ /(...) (..) (..:..:..)/; my $month = $1; my $day = $2; my $time = $3; - if ($a =~ /IN\=(\w+)/) { $iface = $1; } - if ($a =~ /OUT\=(\w+)/) { $out = $1; } - if ($a =~ /SRC\=([\d\.]+)/) { $srcaddr = $1; } - if ($a =~ /DST\=([\d\.]+)/) { $dstaddr = $1; } + # If ipv6 uses bridge, use PHYSIN and PHYSOUT, otherwise use IN and OUT + if ($a =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($a =~ /IN=(\w+)/) { $iface = $1 } + if ($a =~ /PHYSOUT=(\w+)/) { $out = $1 } elsif ($a =~ /OUT=(\w+)/) { $out = $1 } + # Extract ipv4 and ipv6 addresses + if (($a =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr = $1; } + if (($a =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr = $1; } if ($a =~ /PROTO\=(\w+)/) { $protostr = $1; } my $protostrlc = lc($protostr); if ($a =~ /SPT\=([\d\.]+)/){ $srcport = $1; } diff --git a/html/cgi-bin/logs.cgi/showrequestfromip.dat b/html/cgi-bin/logs.cgi/showrequestfromip.dat index 09a60b5..94e795c 100644 --- a/html/cgi-bin/logs.cgi/showrequestfromip.dat +++ b/html/cgi-bin/logs.cgi/showrequestfromip.dat @@ -155,7 +155,7 @@ if (!$skip) while (<FILE>) { if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { - if($_ =~ /SRC\=([\d\.]+)/){ + if (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { if($1 eq $ip){ $log[$lines] = $_; $lines++; @@ -182,12 +182,12 @@ if ($multifile) { if (!$skip) { while (<FILE>) { if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { - if($_ =~ /SRC\=([\d\.]+)/){ - if($1 eq $ip){ + if (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { + if($1 eq $ip){ $log[$lines] = $_; $lines++; - } - } + } + } } } close (FILE); @@ -293,7 +293,8 @@ $lines = 0; foreach $_ (@slice) { $a = $_; - if($_ =~ /SRC\=([\d\.]+)/){ + # Check whether valid ipv4 or ipv6 address + if (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { if($1 eq $ip){ my $chain = ''; my $in = '-'; my $out = '-'; @@ -301,15 +302,19 @@ foreach $_ (@slice) my $protostr = ''; my $srcport = ''; my $dstport = ''; - $_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; + # If ipv6 uses bridge, the use PHYSIN, otherwise use IN + if ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} + elsif ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} my $timestamp = $1; my $chain = $2; my $packet = $3; $timestamp =~ /(...) (..) (..:..:..)/; my $month = $1; my $day = $2; my $time = $3; - if ($a =~ /IN\=(\w+)/) { $iface = $1; } - if ($a =~ /OUT\=(\w+)/) { $out = $1; } - if ($a =~ /SRC\=([\d\.]+)/) { $srcaddr = $1; } - if ($a =~ /DST\=([\d\.]+)/) { $dstaddr = $1; } + # If ipv6 uses bridge, the use PHYSIN and PHYSOUT, otherwise use IN and OUT + if ($a =~ /PHYSIN=(\w+)/) { $iface = $1 } elsif ($a =~ /IN=(\w+)/) { $iface = $1 } + if ($a =~ /PHYSOUT=(\w+)/) { $out = $1 } elsif ($a =~ /OUT=(\w+)/) { $out = $1 } + # Detect ipv4 and ipv6 addresses + if (($a =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr = $1; } + if (($a =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr = $1; } if ($a =~ /PROTO\=(\w+)/) { $protostr = $1; } my $protostrlc = lc($protostr); if ($a =~ /SPT\=([\d\.]+)/){ $srcport = $1; } diff --git a/html/cgi-bin/logs.cgi/showrequestfromport.dat b/html/cgi-bin/logs.cgi/showrequestfromport.dat index ad9823c..af7779a 100644 --- a/html/cgi-bin/logs.cgi/showrequestfromport.dat +++ b/html/cgi-bin/logs.cgi/showrequestfromport.dat @@ -307,15 +307,19 @@ foreach $_ (@slice) my $protostr = ''; my $srcport = ''; my $dstport = ''; - $_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/; + # If ipv6 uses bridge, the use PHYSIN, otherwise use IN + if ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} + elsif ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} my $timestamp = $1; my $chain = $2; my $packet = $3; $timestamp =~ /(...) (..) (..:..:..)/; my $month = $1; my $day = $2; my $time = $3; my $iface; - if ($a =~ /IN\=(\w+)/) { $iface = $1; } - if ($a =~ /OUT\=(\w+)/) { $out = $1; } - if ($a =~ /SRC\=([\d\.]+)/) { $srcaddr = $1; } - if ($a =~ /DST\=([\d\.]+)/) { $dstaddr = $1; } + # If ipv6 uses bridge, the use PHYSIN and PHYSOUT, otherwise use IN and OUT + if ($a =~ /PHYSIN\=(\w+)/) { $iface = $1; } elsif ($a =~ /IN\=(\w+)/) { $iface = $1; } + if ($a =~ /PHYSOUT\=(\w+)/) { $out = $1; } elsif ($a =~ /OUT\=(\w+)/) { $out = $1; } + # Detect ipv4 and ipv6 addresses + if (($a =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr = $1; } + if (($a =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr = $1; } if ($a =~ /PROTO\=(\w+)/) { $protostr = $1; } my $protostrlc = lc($protostr); if ($a =~ /SPT\=([\d\.]+)/){ $srcport = $1; } -- 1.9.1

2 1

[PATCH] Add GeoIP location to nameservers
by IT Superhack 19 Jan '16

19 Jan '16

Add the GeoIP location flag to the nameservers entry on netexternal.cgi. The appropriate flag is shown between ip address and dnssec status. Signed-off-by: Timmothy Wilson <itsuperhack(a)web.de> --- diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi index 299612d..757785e 100644 --- a/html/cgi-bin/netexternal.cgi +++ b/html/cgi-bin/netexternal.cgi @@ -19,6 +19,7 @@ # # ############################################################################### +use Geo::IP::PurePerl; use strict; # enable only the following on debugging purpose @@ -28,6 +29,7 @@ use strict; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; require "${General::swroot}/graphs.pl"; my %color = (); @@ -99,6 +101,9 @@ if ( $querry[0] ne~ ""){ <strong>$Lang::tr{'nameserver'}</strong> </th> <th align="center"> + <strong>$Lang::tr{'location'}</strong> + </th> + <th align="center"> <strong>$Lang::tr{'status'}</strong> </th> </tr> @@ -138,10 +143,20 @@ END } my $table_colour = ($id++ % 2) ? $color{'color22'} : $color{'color20'}; + + # geoip lookup + my $geoaddr = Geo::IP::PurePerl->new(); + my $ccode = $geoaddr->country_code_by_name($nameserver); + my $fcode = lc($ccode); + # Get flag icon for of the country. + my $flag_icon = &GeoIP::get_flag_icon($ccode); print <<END; <tr bgcolor="$table_colour"> <td>$nameserver</td> + <td align="center"> + <a href='/cgi-bin/country.cgi#$fcode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode'></a> + </td> <td bgcolor="$bgcolour" align="center"> <font color="$colour"><strong>$message</strong></font> </td> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 2bca854..836d12f 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1429,6 +1429,7 @@ 'local vpn hostname/ip' => 'Lokaler VPN Hostname/IP', 'localkey' => 'Localkey', 'localkeyfile' => 'Localkeyfile', +'location' => 'Standort', 'log' => 'Protokoll', 'log enabled' => 'Log aktiviert', 'log level' => 'Log Level', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 4c52392..51a6241 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1459,6 +1459,7 @@ 'local vpn hostname/ip' => 'Local VPN Hostname/IP', 'localkey' => 'Localkey', 'localkeyfile' => 'Localkeyfile', +'location' => 'Location', 'log' => 'Log', 'log enabled' => 'Log Enabled', 'log level' => 'Log Level',

3 8

[PATCH] webaccess.cgi: Fixed language settings.
by Erik Kapfer 19 Jan '16

19 Jan '16

Fix for #10879. Added also use strict. Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- html/cgi-bin/webaccess.cgi | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/html/cgi-bin/webaccess.cgi b/html/cgi-bin/webaccess.cgi index afa3770..0d50f01 100644 --- a/html/cgi-bin/webaccess.cgi +++ b/html/cgi-bin/webaccess.cgi @@ -19,8 +19,18 @@ # # ############################################################################### +use strict; + +#usable only the following on debugging purpose +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; use CGI; +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + + my $swroot = "/var/ipfire"; my $apdir = "$swroot/proxy/advanced"; my $group_def_file = "$apdir/cre/classrooms"; @@ -31,6 +41,7 @@ my $acl_src_noaccess_mac = "$apdir/acls/src_noaccess_mac.acl"; my $banner = "A D V A N C E D   P R O X Y   -   W E B   A C C E S S   M A N A G E R"; my %cgiparams; my %proxysettings; +my %temp; my %acl=(); my @group_defs=(); @@ -49,8 +60,8 @@ require "${swroot}/lang.pl"; foreach (@groups) { - if ($cgiparams{$_} eq $tr{'advproxy mode deny'}) { $acl{$_}='on'; } - if ($cgiparams{$_} eq $tr{'advproxy mode allow'}) { $acl{$_}='off'; } + if ($cgiparams{$_} eq $Lang::tr{'advproxy mode deny'}) { $acl{$_}='on'; } + if ($cgiparams{$_} eq $Lang::tr{'advproxy mode allow'}) { $acl{$_}='off'; } } &read_all_groups; @@ -144,7 +155,7 @@ if (($is_supervisor) && ((defined($proxysettings{'SUPERVISOR_PASSWORD'})) && (!( { print <<END <td align='center'> - <font face='verdana,arial,helvetica' color='#000000' size='2'>$tr{'advproxy supervisor password'}:</font> + <font face='verdana,arial,helvetica' color='#000000' size='2'>$Lang::tr{'advproxy supervisor password'}:</font> </td> <td align='center'><input type='password' name='PASSWORD' size='15'></td> END @@ -176,11 +187,11 @@ END if ((defined($acl{$_})) && ($acl{$_} eq 'on')) { print "</td><td width='120' align='center'>"; - print "<input type='submit' name='$_' value=' $tr{'advproxy mode allow'} '>"; + print "<input type='submit' name='$_' value=' $Lang::tr{'advproxy mode allow'} '>"; print "</td><td width='16' bgcolor='#D00000'> </td>\n"; } else { print "</td><td width='120' align='center'>"; - print "<input type='submit' name='$_' value=' $tr{'advproxy mode deny'} '>"; + print "<input type='submit' name='$_' value=' $Lang::tr{'advproxy mode deny'} '>"; print "</td><td width='16' bgcolor='#00A000'> </td>\n"; } } @@ -199,14 +210,14 @@ END } else { print " <tr>\n"; print " <td align='center'>\n"; - print " <font face='verdana,arial,helvetica' color='#000000' size='2'>$tr{'advproxy no cre groups'}</font>\n"; + print " <font face='verdana,arial,helvetica' color='#000000' size='2'>$Lang::tr{'advproxy no cre groups'}</font>\n"; print " </td>\n"; print " </tr>\n"; } } else { print " <tr>\n"; print " <td align='center'>\n"; - print " <font face='verdana,arial,helvetica' color='#000000' size='2'>$tr{'advproxy cre disabled'}</font>\n"; + print " <font face='verdana,arial,helvetica' color='#000000' size='2'>$Lang::tr{'advproxy cre disabled'}</font>\n"; print " </td>\n"; print " </tr>\n"; } -- 2.4.4

2 1

[PATCH] Add GeoIP information to ipinfo.cgi
by IT Superhack 19 Jan '16

19 Jan '16

Add the GeoIP information to the general ip information (address, reverse dns name) on the ipinfo.cgi. The ip address is given to Geo::IP::PurePerl first, then the country code and the flag icon path are queried. Fixes a feature request filed under bug #10946 Signed-off-by: Timmothy Wilson <itsuperhack(a)web.de> --- diff --git a/html/cgi-bin/ipinfo.cgi b/html/cgi-bin/ipinfo.cgi index 71098a2..cebce23 100644 --- a/html/cgi-bin/ipinfo.cgi +++ b/html/cgi-bin/ipinfo.cgi @@ -20,6 +20,7 @@ ############################################################################### use IO::Socket; +use Geo::IP::PurePerl; use strict; # enable only the following on debugging purpose @@ -27,10 +28,13 @@ use strict; #use CGI::Carp 'fatalsToBrowser'; require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/geoip-functions.pl"; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; my %cgiparams=(); +my $s; +my @key; &Header::showhttpheaders(); @@ -52,6 +56,14 @@ next if $addr eq ""; my $iaddr = inet_aton($addr); my $hostname = gethostbyaddr($iaddr, AF_INET); if (!$hostname) { $hostname = $Lang::tr{'lookup failed'}; } + + # geoip lookup + my $geoaddr = Geo::IP::PurePerl->new(); + my $ccode = $geoaddr->country_code_by_name($addr); + my $fcode = lc($ccode); + # Get flag icon for of the country. + my $flag_icon = &GeoIP::get_flag_icon($ccode); + my $sock = new IO::Socket::INET ( PeerAddr => $whoisname, PeerPort => 43, Proto => 'tcp'); if ($sock) @@ -84,7 +96,9 @@ next if $addr eq ""; @lines = ( "$Lang::tr{'unable to contact'} $whoisname" ); } - &Header::openbox('100%', 'left', $addr . ' (' . $hostname . ') : '.$whoisname); + # include geoip information here + &Header::openbox('100%', 'left', $addr . ' <a href=\'/cgi-bin/country.cgi#' . $fcode . '\'><img src=\'' . $flag_icon . '\' border=\'0\' align=\'absmiddle\' alt=\'' +.$ccode .'\' title=\'' . $ccode . '\'></a> (' . $hostname . ') : '.$whoisname); print "<pre>\n"; foreach my $line (@lines) { print &Header::cleanhtml($line,"y");

2 2

Re: OpenSSH client bug CVE-2016-0777
by Michael Tremer 17 Jan '16

17 Jan '16

Hi, On Sun, 2016-01-17 at 11:22 +0100, Matthias Fischer wrote: > Hi Michael, > > On 14.01.2016 18:56, Michael Tremer wrote: > > could you please update OpenSSH to the latest version to fix the > > latest > > security bugs: > > > > http://www.undeadly.org/cgi?action=article&sid=20160114142733 > > > > It should not be anything difficult, but should be patched in > > IPFire > > today if we can. > > Since there was no further feedback on this and because I don't know > exactly, when the next update will be ready (or if the patch came too > late?): Nah the patch is alright. Also merged. > Would it make sense, if I offer an update on the list - to those > which > are interested in testing it - the same way as 'dnsmasq 2.75'? An update to what? Like binary? Probably not because we want to have a defined state of the machines. So when people install Core Update X, we should be sure that there is actually the full set of software installed and running. > > Its running without seen problems here since 15.01.2016 / ~6pm. ;-) > > Package is at the usual place: > http://people.ipfire.org/~mfischer/openssh-7.1p2-for-ipfire.tar.gz > MD5: 6b8d0a7abd429014a942bad6371f2cf4 > > Best, > Matthias -Michael P.S. Don't forget to CC the list.

2 1

RE: Sending in patches
by Blago Culjak 16 Jan '16

16 Jan '16

Well, I do have cluster with free space, I can setup a machine myself. But recording proccess of submiting a patch would be of great value. Poslano s mog Windows Phonea ________________________________ Šalje: Michael Tremer<mailto:michael.tremer@ipfire.org> Poslano: ‎16.‎1.‎2016. 15:45 Prima: R. W. Rodolico<mailto:rodo@dailydata.net>; development(a)lists.ipfire.org<mailto:development@lists.ipfire.org> Predmet: Re: Sending in patches Hey Rod, this is a great offer. Thank you very much. I hope that someone will find this useful. On Fri, 2016-01-15 at 13:24 -0600, R. W. Rodolico wrote: > I understand that some people may need or want Windows as their base > machine and have little reason for having a separate Unix (Linux) > machine. Yet, in some cases, having access to such a machine for > development purposes could be useful. > > I run a series of servers at a NOC here in the US. If anyone is > interested, I'd be happy to build out a Linux or FreeBSD virtual for > this purpose. I could be a pure Command Line machine (what I normally > run) or I could put a very basic GUI (XFCE4) on it. You could choose > to access it via OpenVPN (much more secure) or direct public IP. Just wanted to say quickly that it will have to be a Linux. I am not sure if is possible in any way to build IPFire on a BSD. Our build system doesn't support this right now and I doubt that this is possible at all. So use Linux please. > > If anyone wants to try it, let me know. This is totally no pressure, > you can try the system, and if the environment is too alien for you > to > really get work done, then just bail out. But I'd be happy to set it > up for one or more developers to use. > > Feel free to respond on list, or write me directly. > > Rod -Michael > > On 01/15/2016 02:07 AM, IT Superhack wrote: > > Hello Michael, > > > > Michael Tremer: > > > Hi, > > > > > > so about half a week has passed since my initial email. I suppose > > > this is all that is coming and that the others are perfectly > > > satisfied with this process. > > > > > > So let's conclude: > > > > > > On Mon, 2016-01-11 at 21:40 +0100, Larsen wrote: > > > > On Sun, 10 Jan 2016 22:54:26 +0100, Michael Tremer > > > > <michael.tremer(a)ipfire.org> wrote: > > > > > > > > > I find this process with "git send-email" very easy and I am > > > > > not sure where the problems could be. > > > > > > > > I am using TortoiseGit with Windows 7. I don't know if this > > > > tool supports "git send-email" and I wouldn't want to use > > > > command line git (it is annoying to use more than one tool for > > > > the same job, IMHO). > > > > > > > > > I didn't know that this many people use Windows. The problem with > > > that is you cannot build the distribution. You can copy some > > > files back and forth, but never build. > > > > > > I consider this to be a huge disadvantage. > > > > > > Is this just by choice or did you not want to go through the > > > trouble setting up a Linux system? > > > > > > > Therefore, I create a patch file using TortoiseGit (I need a > > > > workflow reminder for this to get it right), then send the > > > > contents with Thunderbird where I have to remember to disable > > > > line wrap (also using a workflow reminder text). > > > > > > When ever you make personal notes, why not use the wiki for that > > > and share? Many other people might have the same questions. > > I recently wrote a page about sending in patches via a Mail User > > Agent. It can be found here: > > https://wiki.ipfire.org/devel/send-tb-patches (Thanks to Matthias > > Fischer here who sent me a good hint about disabling line-wrapping > > in TB.) > > > > > > > In other projects (using Github), IMHO it is much easier to > > > > push to one's own repository and create a merge request to the > > > > upstream repository. > > > > > > > > > We can't use GitHub. I have explained that at various occasions > > > and this thread wasn't started to discuss other tools. Other > > > things have been proposed, too, and the same goes for them. > > > > > > At the end the only problem I understand you are experiencing > > > here is actually emailing the patch files without your mail > > > agents not making garbage out of that. This can't be too hard to > > > get right. > > > > > > > Discussion can take place with that merge request. > > > > > > No, not at all. This process is actually well thought through > > > and designed to maximise participation of the users and make > > > everything easy for developers. And I actually think it does that > > > well. > > For me, sending in patches is not a very big issue since you only > > need to "set up" a system for sending in patches once. > > > > The problem is more the workflow after a patch has been sent in. > > Some of them seem to be dropped silently, while others are > > commented and then somehow forgotten. Perhaps I need to polish my > > english skills in order to add better descriptions to my patches... > > ;-) > > > > > > > In case you are open to using other tools in place of > > > > Patchwork, what > > > > > > > > about Gitlab? > > > > > > Patchwork is just a view to the patches. My actual repository for > > > that is my inbox. > > > > > > > > > > > > > > > Lars > > > > > > -Michael > > > > > Best regards, Timmothy Wilson > > > > >

2 1

[PATCH] dnsmasq 2.75: latest patch
by Matthias Fischer 15 Jan '16

15 Jan '16

One (small) latecoming arp-patch, don't know if this is important, maybe "just for the records"... Download: http://people.ipfire.org/~mfischer/dnsmasq_275_2016_01_15 MD5: a47e090fe132c155f2d041ab4272c52b This is the compiled binary, nothing more is needed. Copy to '/usr/sbin' Stop 'dnsmasq' (/etc/init.d/dnsmasq stop) Rename (don't forget backing up the *old* version!) Start 'dnsmasq' (/etc/init.d/dnsmasq start). Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dnsmasq | 1 + src/patches/dnsmasq/049-arp_c_tidy_up.patch | 34 +++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 src/patches/dnsmasq/049-arp_c_tidy_up.patch diff --git a/lfs/dnsmasq b/lfs/dnsmasq index 0affcf5..bdfb1f8 100644 --- a/lfs/dnsmasq +++ b/lfs/dnsmasq @@ -121,6 +121,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/046-DNSSEC_Handle_non-root_trust_anchors_and_check_we_have_a_root-trust_anchor.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/047-Fix_bad_cache-size_calculation_when_hosts-file_read_fails.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/048-Disable_DNSSEC_for_server_domain_servers_unless_trust-anchor_provided.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/049-arp_c_tidy_up.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch cd $(DIR_APP) && sed -i src/config.h \ diff --git a/src/patches/dnsmasq/049-arp_c_tidy_up.patch b/src/patches/dnsmasq/049-arp_c_tidy_up.patch new file mode 100644 index 0000000..2847eec --- /dev/null +++ b/src/patches/dnsmasq/049-arp_c_tidy_up.patch @@ -0,0 +1,34 @@ +From bb58f63ce598763231fbf320bace1dbd777afd37 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Thu, 14 Jan 2016 19:23:10 +0000 +Subject: [PATCH] arp.c tidy up. + +--- + src/arp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/arp.c b/src/arp.c +index 73a0250..968455c 100644 +--- a/src/arp.c ++++ b/src/arp.c +@@ -132,7 +132,7 @@ int find_mac(union mysockaddr *addr, unsigned char *mac, int lazy, time_t now) + } + #endif + +- /* Only accept poitive entries unless in lazy mode. */ ++ /* Only accept positive entries unless in lazy mode. */ + if (arp->status != ARP_EMPTY || lazy || updated) + { + if (mac && arp->hwlen != 0) +@@ -148,7 +148,7 @@ int find_mac(union mysockaddr *addr, unsigned char *mac, int lazy, time_t now) + last = now; + + /* Mark all non-negative entries */ +- for (arp = arps, up = &arps; arp; arp = arp->next) ++ for (arp = arps; arp; arp = arp->next) + if (arp->status != ARP_EMPTY) + arp->status = ARP_MARK; + +-- +1.7.10.4 + -- 2.7.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2016