Development November 2017

development@lists.ipfire.org

15 participants
68 discussions

Planning out Core Update 117
by Michael Tremer 12 May '18

12 May '18

Hello, so the big Core Update 115 has been shipped last week. Core Update 116 is coming today. So the next one should be a little bit calmer please :) I do not have anything so far except some smaller bug fixes here and there. Does anyone have anything big? It doesn't have to be another big update. We could also just improve IPFire where ever it is needed with loads of smaller changes and start working on 3 and other sub-projects that are floating around... Best, -Michael

5 31

[PATCH v2] WebUI: print more information on used nameservers
by Peter Müller 29 Jan '18

29 Jan '18

Show rDNS/PTR entry and country flag of the used nameservers on the nameserver status list at "netexternal.cgi". These information might be useful for debugging, or are just "nice to have" and do not harm anything. :-) Changes since v1: Corrected file link to country.cgi and added title to flag. Please disregard the first version of this patch. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi index 299612d4c..6fe0cc7d6 100644 --- a/html/cgi-bin/netexternal.cgi +++ b/html/cgi-bin/netexternal.cgi @@ -25,9 +25,13 @@ use strict; #use warnings; #use CGI::Carp 'fatalsToBrowser'; +use IO::Socket; +use Geo::IP::PurePerl; + require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; require "${General::swroot}/graphs.pl"; my %color = (); @@ -99,6 +103,12 @@ if ( $querry[0] ne~ ""){ $Lang::tr{'nameserver'} </th> <th align="center"> + $Lang::tr{'flag'} + </th> + <th align="center"> + $Lang::tr{'rdns'} + </th> + <th align="center"> $Lang::tr{'status'} </th> </tr> @@ -139,9 +149,22 @@ END my $table_colour = ($id++ % 2) ? $color{'color22'} : $color{'color20'}; + # Get rDNS entry for nameserver (might be useful) + my $iaddr = inet_aton($nameserver); + my $rdns = gethostbyaddr($iaddr, AF_INET); + if (!$rdns) { $rdns = $Lang::tr{'lookup failed'}; } + + # Get country flag for the nameserver (might be useful) + my $gi = Geo::IP::PurePerl->new(); + my $ccode = $gi->country_code_by_name($nameserver); + my $fcode = lc($ccode); + my $flag_icon = &GeoIP::get_flag_icon($fcode); + print <<END; <tr bgcolor="$table_colour"> <td>$nameserver</td> + <td align="center"><a href="country.cgi#$fcode"><img src="$flag_icon" border="0" align="absmiddle" alt="$ccode" title="$ccode"></a></td> + <td>$rdns</td> <td bgcolor="$bgcolour" align="center"> $message </td> @@ -271,3 +294,4 @@ sub check_dnssec($$) { return $aware + $validating; } + diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 0138cbc02..a63eb3160 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1902,6 +1902,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM-Speicher', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Gelesene Bytes', 'read list' => 'Liste der Leseberechtigten', 'real address' => 'Reale Addresse', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index b3aee5a2b..13c18f4c8 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1936,6 +1936,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Read Bytes', 'read list' => 'list with readonly hosts', 'real address' => 'Real Address',

4 16

Upgrading to OpenSSL 1.1.0
by Michael Tremer 18 Jan '18

18 Jan '18

Hello, I have started working on upgrading the entire distribution to OpenSSL 1.1.0. This is however not the easiest task since many packages are just incompatible with the API changes of OpenSSL. Therefore, I started this in an own branch, upgraded all sorts of packages that won't build and patched those who could be patched. However, this is still quite chaotic and I need some help of the maintainers of some of the packages to do this for their own packages. I have already dropped some packages in this process that a) were incompatible with OpenSSL 1.1.0, b) where no patches were available and c) that are not maintained upstream any longer. I also cherry-picked those commits to the current next tree. If someone disagrees, please open a separate discussion. The packages dropped are: * Pound * vsftp * sslscan Packages which currently don't build and I could not patch very easily: * php * asterisk * openvpn I suppose Erik is best to upgrade to openvpn 2.4, Dirk upgrades asterisk and I am quite sure that there is a few people out there who have been working on php. Please raise your hands. I would like to have the openssl 1.1 branch ready for merge into next at the end of December. Please make sure that any patches have been submitted until then. Please work on top of this branch: https://git.ipfire.org/pub/git/people/ms/ipfire-2.x.git openssl-11 https://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=shortlog;h=refs/heads/… Please also submit improvements of other packages that we can make sure of (i.e. better cipher suites for Apache, etc.)... Best, -Michael

6 20

ASN support for iptables
by Peter Müller 05 Dec '17

05 Dec '17

Hello development list, today, I'd like to discuss whether a new feature in the firewall engine of IPFire makes sense or not. Since Core Update 90, IPFire supports GeoIP based firewall rules, which goes beyond simple IP addresses or CIDR blocks and makes firewalling easier. The idea I had in mind is to add ASN (Autonomous System Number) support for firewall rules, too. An AS (Autonomous System) can be described as an administrative instance on top of IP: For example, several IP blocks belong to an AS, i.e. to the same company, university or whatever. Although these blocks may be used for completely different purposes in completely different countries, they share the same owner. Every AS has a number (ASN) and a description (sometimes abbreviated to ASDescr), while the number is unique. There are some scenarios in which AS based firewall rules make sense, since AS information change less seldom than IP ranges: (a) One wants to block malicious traffic, but blocking entire countries is too much since there are some legitimate partners, customers, ... out there. With AS support, it is possible to grant them access by simply permitting their AS. The rest of the country may now safely be blocked. (b) In some cases, IP ranges change very often, making firewall rules very complex and hard to maintain, or the exact IP address of a machine cannot be determined (dial-up connections). In both cases, the AS (mostly) stays the same and allows firewall rules without permitting access to a whole country. (c) Rogue ISPs (networks which are controlled/operated by professional spammers or worse, such as the "Russian Business Network" (RBN), which died in end-2007) sometimes run networks located in "good" countries such as US or NL. Blocking them by GeoIP is not an option because of many false-positives. AS based rules may help here. Since the data behind this can be extracted from BGP feeds, no external databases (such as MaxMind) are required. Unfortunately, my programming skills are too low for implementing this feature. Thereof, if it is decided to do this, I will need some help here. :-) Technically, this is similar to the GeoIP firewall stuff (just another database), so I assume most of the work done there can just be copied. Any thoughts on this idea? Best regards, Peter Müller

2 7

[PATCH] use CHAP for dial-in as default
by Peter Müller 04 Dec '17

04 Dec '17

Use CHAP as default setting for PPPoE dial-in connections. Although CHAP does not provide strong transport security at all, it is better than submitting credentials in plain text. Enforcing CHAP prevents the system from silently falling down to no encryption (MITM attack!). Existing installations remain untouched. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/pppsetup.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/pppsetup.cgi b/html/cgi-bin/pppsetup.cgi index 4b45ee50c..a96dce9df 100644 --- a/html/cgi-bin/pppsetup.cgi +++ b/html/cgi-bin/pppsetup.cgi @@ -1042,7 +1042,7 @@ sub initprofile $pppsettings{'HOLDOFF'} = 30; $pppsettings{'TIMEOUT'} = 15; $pppsettings{'MODULATION'} = 'AUTO'; - $pppsettings{'AUTH'} = 'pap-or-chap'; + $pppsettings{'AUTH'} = 'chap'; $pppsettings{'DNS'} = 'Automatic'; $pppsettings{'DEBUG'} = 'off'; $pppsettings{'BACKUPPROFILE'} = $pppsettings{'PROFILE'}; -- 2.13.6

2 4

[PATCH] mc: Update to 4.8.20
by Matthias Fischer 29 Nov '17

29 Nov '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/mc | 4 ++++ lfs/mc | 9 +++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/mc b/config/rootfiles/packages/mc index 820d23333..4733af6fa 100644 --- a/config/rootfiles/packages/mc +++ b/config/rootfiles/packages/mc @@ -162,6 +162,7 @@ usr/share/mc/syntax/fortran.syntax usr/share/mc/syntax/glsl.syntax usr/share/mc/syntax/go.syntax usr/share/mc/syntax/haskell.syntax +usr/share/mc/syntax/hive.syntax usr/share/mc/syntax/html.syntax usr/share/mc/syntax/idl.syntax usr/share/mc/syntax/ini.syntax @@ -177,6 +178,7 @@ usr/share/mc/syntax/lua.syntax usr/share/mc/syntax/m4.syntax usr/share/mc/syntax/mail.syntax usr/share/mc/syntax/makefile.syntax +usr/share/mc/syntax/markdown.syntax usr/share/mc/syntax/ml.syntax usr/share/mc/syntax/named.syntax usr/share/mc/syntax/nemerle.syntax @@ -191,6 +193,7 @@ usr/share/mc/syntax/po.syntax usr/share/mc/syntax/povray.syntax usr/share/mc/syntax/procmail.syntax usr/share/mc/syntax/properties.syntax +usr/share/mc/syntax/protobuf.syntax usr/share/mc/syntax/puppet.syntax usr/share/mc/syntax/python.syntax usr/share/mc/syntax/r.syntax @@ -205,6 +208,7 @@ usr/share/mc/syntax/swig.syntax usr/share/mc/syntax/syntax.syntax usr/share/mc/syntax/tcl.syntax usr/share/mc/syntax/texinfo.syntax +usr/share/mc/syntax/ts.syntax usr/share/mc/syntax/tt.syntax usr/share/mc/syntax/unknown.syntax usr/share/mc/syntax/verilog.syntax diff --git a/lfs/mc b/lfs/mc index 1680a9638..741d41b13 100644 --- a/lfs/mc +++ b/lfs/mc @@ -24,7 +24,7 @@ include Config -VER = 4.8.19 +VER = 4.8.20 THISAPP = mc-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = mc -PAK_VER = 15 +PAK_VER = 16 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 57209d138c0adcb9ea01dfe6bbb4cb87 +$(DL_FILE)_MD5 = 7f808b01f3f7d9aa52152a9efb86dbca install : $(TARGET) @@ -79,7 +79,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./configure --prefix=/usr \ --sysconfdir=/etc \ - --without-x --disable-nls \ + --without-x \ + --disable-nls \ --with-screen=ncurses cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install -- 2.15.0

1 0

[PATCH] update links to www.ipfire.org at credits.cgi
by Peter Müller 29 Nov '17

29 Nov '17

The links to the IPFire homepage in the credits.cgi file should point to the HTTPS version of the site now. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/credits.cgi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/credits.cgi b/html/cgi-bin/credits.cgi index f370e80b6..7cda40251 100644 --- a/html/cgi-bin/credits.cgi +++ b/html/cgi-bin/credits.cgi @@ -41,7 +41,7 @@ print <<END $Lang::tr{'donation-text'} <div align="center"> - <a href="http://www.ipfire.org/donate"> + <a href="https://www.ipfire.org/donate"> $Lang::tr{'donation'} </a> </div> @@ -54,7 +54,7 @@ END print <<END <center> - $Lang::tr{'visit us at'}: <a href='http://www.ipfire.org/' target="_blank">http://www.ipfire.org/</a> + $Lang::tr{'visit us at'}: <a href='https://www.ipfire.org/' target="_blank">https://www.ipfire.org/</a> </center> -- 2.13.6

2 1

[PATCH] correct wrong headline at hardwaregraphs.cgi
by Peter Müller 27 Nov '17

27 Nov '17

The page description (title and headline) should print "hardware graphs" instead of only mentioning HDDs. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/hardwaregraphs.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/hardwaregraphs.cgi b/html/cgi-bin/hardwaregraphs.cgi index 7b5a848bf..f5999c87e 100644 --- a/html/cgi-bin/hardwaregraphs.cgi +++ b/html/cgi-bin/hardwaregraphs.cgi @@ -73,7 +73,7 @@ if ( $querry[0] =~ "hwtemp"){ &Graphs::updatehddgraph($querry[0],$querry[1]); }else{ &Header::showhttpheaders(); - &Header::openpage($Lang::tr{'harddisk temperature graphs'}, 1, ''); + &Header::openpage($Lang::tr{'hardware graphs'}, 1, ''); &Header::openbigbox('100%', 'left'); &Header::getcgihash(\%sensorsettings); -- 2.13.6

2 2

[PATCH] translate 'firewall hits' at netother.cgi
by Peter Müller 24 Nov '17

24 Nov '17

Also translate 'firewall hits' at the network status (other) page in WebUI. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/netother.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/netother.cgi b/html/cgi-bin/netother.cgi index 1809abfda..dde1b603a 100644 --- a/html/cgi-bin/netother.cgi +++ b/html/cgi-bin/netother.cgi @@ -67,7 +67,7 @@ if ( $querry[0] =~ "fwhits"){ &Header::closebox(); } - &Header::openbox('100%', 'center', "Firewall Hits $Lang::tr{'graph'}"); + &Header::openbox('100%', 'center', "$Lang::tr{'firewallhits'} $Lang::tr{'graph'}"); &Graphs::makegraphbox("netother.cgi","fwhits","day"); &Header::closebox(); -- 2.13.6

1 0

[PATCH] link to DNS server status page on index.cgi
by Peter Müller 24 Nov '17

24 Nov '17

Show a link to the DNS server status at netexternal.cgi on index.cgi in WebUI. For the lazy ones... :-) Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/index.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi index 6ba345dde..ea91e0c20 100644 --- a/html/cgi-bin/index.cgi +++ b/html/cgi-bin/index.cgi @@ -210,7 +210,7 @@ END print <<END; <tr> <td> - $Lang::tr{'dns servers'}: + <a href="netexternal.cgi">$Lang::tr{'dns servers'}</a>: </td> <td style='text-align:center;'> $dns_servers -- 2.13.6

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2017