Development December 2017

development@lists.ipfire.org

5 participants
28 discussions

[PATCH] use CHAP for dial-in as default
by Peter Müller 04 Dec '17

04 Dec '17

Use CHAP as default setting for PPPoE dial-in connections. Although CHAP does not provide strong transport security at all, it is better than submitting credentials in plain text. Enforcing CHAP prevents the system from silently falling down to no encryption (MITM attack!). Existing installations remain untouched. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/pppsetup.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/pppsetup.cgi b/html/cgi-bin/pppsetup.cgi index 4b45ee50c..a96dce9df 100644 --- a/html/cgi-bin/pppsetup.cgi +++ b/html/cgi-bin/pppsetup.cgi @@ -1042,7 +1042,7 @@ sub initprofile $pppsettings{'HOLDOFF'} = 30; $pppsettings{'TIMEOUT'} = 15; $pppsettings{'MODULATION'} = 'AUTO'; - $pppsettings{'AUTH'} = 'pap-or-chap'; + $pppsettings{'AUTH'} = 'chap'; $pppsettings{'DNS'} = 'Automatic'; $pppsettings{'DEBUG'} = 'off'; $pppsettings{'BACKUPPROFILE'} = $pppsettings{'PROFILE'}; -- 2.13.6

2 4

[PATCH] prevent loading resources from external sites
by Peter Müller 03 Dec '17

03 Dec '17

Make Apache transmit a CSP (Content Security Policy) header for WebUI and Captive Portal contents. This prevents some XSS and content injection attacks, especially in case no transport encryption (Captive Portal!) can be used. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/httpd/vhosts.d/captive.conf | 2 ++ config/httpd/vhosts.d/ipfire-interface-ssl.conf | 2 ++ config/httpd/vhosts.d/ipfire-interface.conf | 2 ++ 3 files changed, 6 insertions(+) diff --git a/config/httpd/vhosts.d/captive.conf b/config/httpd/vhosts.d/captive.conf index e4e1d78f1..2640654fd 100644 --- a/config/httpd/vhosts.d/captive.conf +++ b/config/httpd/vhosts.d/captive.conf @@ -9,6 +9,8 @@ Listen 1013 # code was entered. KeepAlive Off + Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" + ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/captive/ Alias /assets/ /srv/web/ipfire/html/captive/assets/ diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index dacf6a005..e7eb6c041 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -18,6 +18,8 @@ SSLCertificateFile /etc/httpd/server-ecdsa.crt SSLCertificateKeyFile /etc/httpd/server-ecdsa.key + Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" + <Directory /srv/web/ipfire/html> Options ExecCGI AllowOverride None diff --git a/config/httpd/vhosts.d/ipfire-interface.conf b/config/httpd/vhosts.d/ipfire-interface.conf index be15cd041..abc36a61a 100644 --- a/config/httpd/vhosts.d/ipfire-interface.conf +++ b/config/httpd/vhosts.d/ipfire-interface.conf @@ -6,6 +6,8 @@ RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) RewriteRule .* - [F] + Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" + <Directory /srv/web/ipfire/html> Options ExecCGI AllowOverride None -- 2.13.6

1 0

[PATCH] prevent IE from interpreting HTML MIME type
by Peter Müller 03 Dec '17

03 Dec '17

Add X-Content-Type-Options header to prevent Internet Explorer from interpreting the MIME type of a server answer on its own, which could lead to security risks. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/httpd/vhosts.d/captive.conf | 2 ++ config/httpd/vhosts.d/ipfire-interface-ssl.conf | 4 ++++ config/httpd/vhosts.d/ipfire-interface.conf | 2 ++ 3 files changed, 8 insertions(+) diff --git a/config/httpd/vhosts.d/captive.conf b/config/httpd/vhosts.d/captive.conf index e4e1d78f1..e71a26081 100644 --- a/config/httpd/vhosts.d/captive.conf +++ b/config/httpd/vhosts.d/captive.conf @@ -9,6 +9,8 @@ Listen 1013 # code was entered. KeepAlive Off + Header always set X-Content-Type-Options nosniff + ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/captive/ Alias /assets/ /srv/web/ipfire/html/captive/assets/ diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index dacf6a005..c5d8ffba9 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -3,10 +3,12 @@ RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) RewriteRule .* - [F] + DocumentRoot /srv/web/ipfire/html ServerAdmin root@localhost ErrorLog /var/log/httpd/error_log TransferLog /var/log/httpd/access_log + SSLEngine on SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA @@ -18,6 +20,8 @@ SSLCertificateFile /etc/httpd/server-ecdsa.crt SSLCertificateKeyFile /etc/httpd/server-ecdsa.key + Header always set X-Content-Type-Options nosniff + <Directory /srv/web/ipfire/html> Options ExecCGI AllowOverride None diff --git a/config/httpd/vhosts.d/ipfire-interface.conf b/config/httpd/vhosts.d/ipfire-interface.conf index be15cd041..5c7ddc719 100644 --- a/config/httpd/vhosts.d/ipfire-interface.conf +++ b/config/httpd/vhosts.d/ipfire-interface.conf @@ -6,6 +6,8 @@ RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) RewriteRule .* - [F] + Header always set X-Content-Type-Options nosniff + <Directory /srv/web/ipfire/html> Options ExecCGI AllowOverride None -- 2.13.6

1 0

[PATCH] pakfire - 'functions.pl': fixed typo
by Matthias Fischer 03 Dec '17

03 Dec '17

Just read this typo in a forum posting. Couldn't resist... Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- src/pakfire/lib/functions.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index cfb7e5117..5fe4cc4e6 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -904,7 +904,7 @@ sub checkcryptodb { logger("CRYPTO INFO: Checking GnuPG Database"); my $ret = system("gpg --list-keys | grep -q $myid"); unless ( "$ret" eq "0" ) { - message("CRYPTO WARN: The GnuPG isn't configured corectly. Trying now to fix this."); + message("CRYPTO WARN: The GnuPG isn't configured correctly. Trying now to fix this."); message("CRYPTO WARN: It's normal to see this on first execution."); message("CRYPTO WARN: If this message is being shown repeatedly, check if time and date are set correctly, and if IPFire can connect via port 11371 TCP."); my $command = "gpg --keyserver pgp.ipfire.org --always-trust --status-fd 2"; -- 2.15.1

1 0

[PATCH] display GeoIP information for hosts blocked by Guardian
by Peter Müller 02 Dec '17

02 Dec '17

Display GeoIP flag for blocked hosts at guardian.cgi in the WebUI. This makes spotting blocked local IPs (grey flag with question mark) easier. Enumerating the rDNS entry, unfortunately, takes way too long. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/guardian.cgi | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/guardian.cgi b/html/cgi-bin/guardian.cgi index e15501ef5..3bfa1b522 100644 --- a/html/cgi-bin/guardian.cgi +++ b/html/cgi-bin/guardian.cgi @@ -30,6 +30,7 @@ use Guardian::Socket; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; #workaround to suppress a warning when a variable is used only once my @dummy = ( @@ -791,7 +792,10 @@ sub showBlockedBox() { print <<END; <table width='60%'> <tr> - <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td> + <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'ip address'}</b></td> + <td class='base' align='center' bgcolor='$color{'color20'}'><b>$Lang::tr{'country'}</b></td> + <td class='base' bgcolor='$color{'color20'}'></td> + <td class='base' align='center' bgcolor='$color{'color20'}'><b>$Lang::tr{'unblock'}</b></td> </tr> END @@ -814,9 +818,17 @@ END $col="bgcolor='$color{'color20'}'"; } + # enumerate GeoIP information for blocked host... + my $ccode = &GeoIP::lookup($blocked_host); + my $flag_icon = &GeoIP::get_flag_icon($ccode); + print <<END; <tr> - <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td> + <td width='20%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td> + <td width='20%' class='base' align='center' $col> + <a href='/cgi-bin/country.cgi#$ccode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode' /></a> + </td> + <td width='30%' class='base' $col></td> <td width='20%' align='center' $col> <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'> <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'> @@ -834,7 +846,7 @@ END # Print notice that currently no hosts are blocked. print "<tr>\n"; - print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n"; + print "<td class='base' colspan='4'>$Lang::tr{'guardian no entries'}</td>\n"; print "</tr>\n"; } -- 2.13.6

1 0

[PATCH] nano: Update to 2.9.1
by Matthias Fischer 02 Dec '17

02 Dec '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/nano | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/nano b/lfs/nano index 379983196..3935a8b09 100644 --- a/lfs/nano +++ b/lfs/nano @@ -24,7 +24,7 @@ include Config -VER = 2.8.6 +VER = 2.9.1 THISAPP = nano-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nano -PAK_VER = 16 +PAK_VER = 17 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e05d83c0f1687b733322f806c080d256 +$(DL_FILE)_MD5 = 0e2c5d7ae5378fe42b7166e7fe268736 install : $(TARGET) -- 2.15.1

1 0

[PATCH] sudo: Fix for lfs-file (Typo)
by Matthias Fischer 02 Dec '17

02 Dec '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/sudo | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/sudo b/lfs/sudo index 9dd72fef5..1c66bc558 100644 --- a/lfs/sudo +++ b/lfs/sudo @@ -79,7 +79,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-env-editor \ --with-ignore-dot \ --with-tty-tickets \ - --with-passpromt="[sudo] password for %p: " \ + --with-passprompt="[sudo] password for %p: " \ --without-pam cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install -- 2.15.1

1 0

[PATCH] ffmpeg-libs: Update for rootfile
by Matthias Fischer 02 Dec '17

02 Dec '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/ffmpeg-libs | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/config/rootfiles/packages/ffmpeg-libs b/config/rootfiles/packages/ffmpeg-libs index 7a512f9da..03815c6b8 100644 --- a/config/rootfiles/packages/ffmpeg-libs +++ b/config/rootfiles/packages/ffmpeg-libs @@ -119,35 +119,35 @@ #usr/lib/libavcodec.a #usr/lib/libavcodec.so usr/lib/libavcodec.so.57 -usr/lib/libavcodec.so.57.64.101 +usr/lib/libavcodec.so.57.107.100 #usr/lib/libavdevice.a #usr/lib/libavdevice.so usr/lib/libavdevice.so.57 -usr/lib/libavdevice.so.57.1.100 +usr/lib/libavdevice.so.57.10.100 #usr/lib/libavfilter.a #usr/lib/libavfilter.so usr/lib/libavfilter.so.6 -usr/lib/libavfilter.so.6.65.100 +usr/lib/libavfilter.so.6.107.100 #usr/lib/libavformat.a #usr/lib/libavformat.so usr/lib/libavformat.so.57 -usr/lib/libavformat.so.57.56.101 +usr/lib/libavformat.so.57.83.100 #usr/lib/libavutil.a #usr/lib/libavutil.so usr/lib/libavutil.so.55 -usr/lib/libavutil.so.55.34.101 +usr/lib/libavutil.so.55.78.100 #usr/lib/libpostproc.a #usr/lib/libpostproc.so usr/lib/libpostproc.so.54 -usr/lib/libpostproc.so.54.1.100 +usr/lib/libpostproc.so.54.7.100 #usr/lib/libswresample.a #usr/lib/libswresample.so usr/lib/libswresample.so.2 -usr/lib/libswresample.so.2.3.100 +usr/lib/libswresample.so.2.9.100 #usr/lib/libswscale.a #usr/lib/libswscale.so usr/lib/libswscale.so.4 -usr/lib/libswscale.so.4.2.100 +usr/lib/libswscale.so.4.8.100 #usr/lib/pkgconfig/libavcodec.pc #usr/lib/pkgconfig/libavdevice.pc #usr/lib/pkgconfig/libavfilter.pc -- 2.15.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development December 2017