Development November 2017

development@lists.ipfire.org

15 participants
68 discussions

DANE-Record for www.ipfire.org missing
by Peter Müller 11 Nov '17

11 Nov '17

Hello Michael, during some tests, I noticed that the DANE record for www.ipfire.org is still missing. In the first place, I thought this was because of some DNS reply caching, but it isn't. Just for the record, should be an easy change. Apart from that all DANE records seem to be present. I will deal with the Postfix configuration on IPFire's MX next week (need to work at the weekend). Best regards, Peter Müller

2 3

Running projects - proxy graphs rebuilt
by Matthias Fischer 10 Nov '17

10 Nov '17

Hi, I have just some short question about 'sgraph' (Proxy-Diagramme): Should I build 'sgraphs' (Proxy-Diagramme - see: https://sourceforge.net/projects/squid-graph/) as an addon for pakfire or as an update for GUI integration? Localizations and GUI are ok - running. [Translation ON] Auf deutsch - da ist vll. verständlicher, was ich meine: Die Übersetzungen und die GUI sind soweit klar. Läuft. Wollen wir 'sgraph' als Addon per Pakfire verteilen oder soll ich das in den aktuellen 'next' fest integrieren? [Translation OFF] Best, Matthias

2 2

[PATCH] display rDNS and GeoIP information for used nameservers
by Peter Müller 09 Nov '17

09 Nov '17

Display rDNS/PTR record and GeoIP information for used nameservers on the netexternal.cgi WebUI page. These information might be useful for debugging. Thanks to Matthias Fischer for style improvements. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/netexternal.cgi | 25 +++++++++++++++++++++++++ langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + 3 files changed, 27 insertions(+) diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi index 299612d4c..cd2223ac6 100644 --- a/html/cgi-bin/netexternal.cgi +++ b/html/cgi-bin/netexternal.cgi @@ -25,9 +25,13 @@ use strict; #use warnings; #use CGI::Carp 'fatalsToBrowser'; +use IO::Socket; +use Geo::IP::PurePerl; + require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; require "${General::swroot}/graphs.pl"; my %color = (); @@ -99,6 +103,12 @@ if ( $querry[0] ne~ ""){ $Lang::tr{'nameserver'} </th> <th align="center"> + $Lang::tr{'flag'} + </th> + <th align="center"> + $Lang::tr{'rdns'} + </th> + <th align="center"> $Lang::tr{'status'} </th> </tr> @@ -138,10 +148,25 @@ END } my $table_colour = ($id++ % 2) ? $color{'color22'} : $color{'color20'}; + + my $iaddr = inet_aton($nameserver); + my $rdns = gethostbyaddr($iaddr, AF_INET); + if (!$rdns) { $rdns = $Lang::tr{'lookup failed'}; } + + my $gi = Geo::IP::PurePerl->new(); + my $ccode = $gi->country_code_by_name($nameserver); + my $fcode = lc($ccode); + my $flag_icon = &GeoIP::get_flag_icon($fcode); print <<END; <tr bgcolor="$table_colour"> <td>$nameserver</td> + <td align="center"> + <a href="country.cgi#$fcode"><img src="$flag_icon" border="0" align="absmiddle" alt="$ccode" title="$ccode"></a> + </td> + <td align="center"> + $rdns + </td> <td bgcolor="$bgcolour" align="center"> $message </td> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index af96a6445..4cf866a3a 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1951,6 +1951,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM-Speicher', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Gelesene Bytes', 'read list' => 'Liste der Leseberechtigten', 'real address' => 'Reale Addresse', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 7e4f95ccf..946aba873 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1989,6 +1989,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Read Bytes', 'read list' => 'list with readonly hosts', 'real address' => 'Real Address', -- 2.13.6

2 5

Cleaned up bug list
by Peter Müller 09 Nov '17

09 Nov '17

Hello all, I just cleaned up the bug list at https://bugzilla.ipfire.org/ a little bit - we have now ~ 100 open bugs in IPFire 2.x (~ 160 before). In case I closed any valid bug, please reopen it and forgive me. :-) Best regards, Peter Müller

2 1

Security vulnerabilities in snort and Guardian
by Peter Müller 08 Nov '17

08 Nov '17

Hello, there are two security vulnerabilities in IPFire's IDS/IPS (snort/Guardian) which I consider quite critical: (a) Guardian does not malicious destination IP addresses As described in bug #11532, it is possible to access a "bad" IP address (C&C server, Spamhaus DROP, Dshield, and others) in the internet from a internal network behind IPFire. This is because Guardian only looks at the source IP of a snort alert, and in this case, it is the firewall's IP which should not be blocked for obvious reason. There is little change that an admin will notice that the IPS is only working in case of inbound attacks since snort triggers an alert correctly. Could someone (maintainer?) have a look at Guardian and fix this? Unfortunately, my programming skills are too little for this job. :-| (b) Snort does not detect internal attacks As described in bug #10273 (which has been reported back in 2012), the IDS is fully working on RED only. Although it can be turned on for GREEN, BLUE and ORANGE, too, it does not capture any attacks in internal networks. This can be hardly examined from the WebUI, too, since it shows snort being up and running on GREEN and others. Changing this also allows blocking an infected PC in a local network which is spreading malware. On RED, the internal IP is already NATted. Maybe Guardian can be configured so it shows a big warning in case of blocked local IPs (internal networks should be clean), but this is kind of a feature request. See also: * https://bugzilla.ipfire.org/show_bug.cgi?id=10273 * https://bugzilla.ipfire.org/show_bug.cgi?id=11532 (Thanks again to Michael for enabling HTTPS with trusted certificates.) One question left: If there are attacks from a network connected via VPN, where are they captured by snort? On RED? I hate bringing up bugs like this - and hope I did not harm anybody :-) - but since this has a security impact, it seems okay to me. Thanks and best regards, Peter Müller

3 3

Re: Can't send patch or mail to mail01.ipfire.org:587 - authentication fails
by Michael Tremer 08 Nov '17

08 Nov '17

Hi, our LDAP server crashed earlier today. I just restarted it now. This sort of seems to be happening repeatedly :( But all should be working fine again. Best, -Michael On Wed, 2017-11-08 at 10:23 +0100, Matthias Fischer wrote: > Hi, > > I just tried to send a small patch with "git send-email...", but GIT > keeps telling me: > > ***SNIP*** > Password for 'smtp://mfischer@mail01.ipfire.org:587': > 5.7.8 Error: authentication failed: > ***SNAP*** > > I didn't change anything on my side - GIT-version is 2.15.0. > > Bug or feature or anyone else experiencing this? Any hints? > > Pushing with "git push mfischer..." was OK. > > Best, > Matthias > > P.S.: Sending this mail with my IPFire-account gave me: "Login to server > mail01.ipfire.org failed".

1 0

[PATCH] Some cosmetics for 'lang.pl'
by Matthias Fischer 08 Nov '17

08 Nov '17

Found by chance: Fixed and removed some typos, some trailing spaces/tabs/identations. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/cfgroot/lang.pl | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/config/cfgroot/lang.pl b/config/cfgroot/lang.pl index 2b09c4a9f..390dc5ab4 100644 --- a/config/cfgroot/lang.pl +++ b/config/cfgroot/lang.pl @@ -15,17 +15,17 @@ use strict; ### A cache file to avoid long recalculation $Lang::CacheLang = '/var/ipfire/langs/cache-lang.pl'; -# When you want to add your own language strings/entries to the ipcop language file, +# When you want to add your own language strings/entries to the language file, # you should create a file with <PREFIX>.<LANG>.pl into CONFIG_ROOT/addon-lang dir -# <PREFIX> is free choosable but should be significant. An Example might be "myAddnName" -# <LANG> is a mnemonic of the used language like en, de, it, nl etc. -# You can find a detailed list of possible mnemonic's in the file CONFIG_ROOT/langs/list +# PREFIX> is free choosable but should be significant. An example might be "myAddnName" +# <LANG> is a mnemonic of the used language like en, de, it, nl etc. +# You can find a detailed list of possible mnemonic's in the file CONFIG_ROOT/langs/list # A file could be named "VirtualHttpd.en.pl" for example. # # The file content has to start with (of course without the leading #): # --------- CODE --------- #%tr = (%tr, -# 'key1' => 'value', # add all your entries key/values here +# 'key1' => 'value', # add all your entries key/values here # 'key2' => 'value' # and end with (of course without the leading #): #); # --------- CODE END--------- @@ -47,7 +47,7 @@ $language = $settings{'LANGUAGE'}; # # Load requested language file from cachefile. If cachefile doesn't exist, build on the fly. -# (it is a developper options) +# (it is a developer option) # sub reload { my $LG = &FindWebLanguage(shift); @@ -56,12 +56,12 @@ sub reload { # Use CacheLang if present & not empty. if (-s "$Lang::CacheLang.$LG" ) { - ##fix: need to put a lock_shared on it in case rebuild is active ? + ##fix: need to put a lock_shared on it in case rebuild is active? do "$Lang::CacheLang.$LG"; - #&General::log ("cachelang file used [$LG]"); + #&General::log ("cachelang file used [$LG]"); return; } - + #&General::log("Building on the fly cachelang file for [$LG]"); do "${General::swroot}/langs/en.pl"; do "${General::swroot}/langs/$LG.pl" if ($LG ne 'en'); @@ -80,20 +80,20 @@ sub reload { # read again, overwriting 'en' with choosed lang if ($LG ne 'en') { foreach my $file (grep (/.*\.$LG\.pl$/,@files) ) { - do "$AddonDir/$file"; + do "$AddonDir/$file"; } } } # # Assume this procedure is called with enough privileges. -# Merge ipcop langage file + all other extension found in addon-lang +# Merge language file + all other extension found in addon-lang # to build a 'cachefile' for selected language # sub BuildUniqueCacheLang { my ($LG) = @_; - + # Make CacheLang empty so that it won't be used by Lang::reload open (FILE, ">$Lang::CacheLang.$LG") or return 1; flock (FILE, 2) or return 1; @@ -101,7 +101,7 @@ sub BuildUniqueCacheLang { # Load languages files &Lang::reload ($LG); - + # Write the unique %tr=('key'=>'value') array open (FILE, ">$Lang::CacheLang.$LG") or return 1; flock (FILE, 2) or return 1; @@ -112,7 +112,7 @@ sub BuildUniqueCacheLang { } print FILE ');'; close (FILE); - + # Make nobody:nobody file's owner # Will work when called by root/rc.sysinit chown (0,0,"$Lang::CacheLang.$LG"); @@ -121,12 +121,12 @@ sub BuildUniqueCacheLang { } # -# Switch Ipcop Language for each lang then call build cachelang +# Switch language for each lang then call build cachelang # sub BuildCacheLang { my $AddonDir = ${General::swroot}.'/addon-lang'; - + # Correct permission in case addon-installer did not do it opendir (DIR, $AddonDir); my @files = readdir (DIR); @@ -140,7 +140,7 @@ sub BuildCacheLang { my $selected = '';; my $missed = ''; my $error = 0; - + open (LANGS, "${General::swroot}/langs/list"); while (<LANGS>) { ($selected) = split (':'); @@ -150,10 +150,10 @@ sub BuildCacheLang { } close (LANGS); - if ($missed) { # collision with current cache lang being used ? + if ($missed) { # collision with current cache lang being used? $error = &BuildUniqueCacheLang ($missed); } - + &General::log ("WARNING: cannot build cachelang file for [$missed].") if ($error); return $error; } -- 2.15.0

1 0

Solved (was: Can't send patch or mail to mail01.ipfire.org:587 - authentication fails)
by Matthias Fischer 08 Nov '17

08 Nov '17

Hi, Thanks. Worked... ;-) Best, Matthias

1 0

[PATCH] captive: added missing german localisation string
by Matthias Fischer 08 Nov '17

08 Nov '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- langs/de/cgi-bin/de.pl | 1 + 1 file changed, 1 insertion(+) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 6dff5d781..2e5385d28 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -2332,6 +2332,7 @@ 'unix password sync' => 'Unix Password Sync', 'unix shell' => 'UNIX-Shell', 'unknown' => 'Unbekannt', +'unlimited' => 'Unbegrenzt', 'unnamed' => 'Unbenannt', 'update' => 'Aktualisieren', 'update accelerator' => 'Update-Accelerator', -- 2.15.0

1 0

Can't send patch or mail to mail01.ipfire.org:587 - authentication fails
by Matthias Fischer 08 Nov '17

08 Nov '17

Hi, I just tried to send a small patch with "git send-email...", but GIT keeps telling me: ***SNIP*** Password for 'smtp://mfischer@mail01.ipfire.org:587': 5.7.8 Error: authentication failed: ***SNAP*** I didn't change anything on my side - GIT-version is 2.15.0. Bug or feature or anyone else experiencing this? Any hints? Pushing with "git push mfischer..." was OK. Best, Matthias P.S.: Sending this mail with my IPFire-account gave me: "Login to server mail01.ipfire.org failed". P.P.S.: Second try - with IPFire account...

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2017