Development October 2018

development@lists.ipfire.org

9 participants
29 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

[PATCH] BUG 11786 - squid: Remove setting for filter processes the number of Squid processes
by Daniel Weismüller 17 Dec '18

17 Dec '18

I added a function to determine the number of cores. Now the number of squid processes will be equal to the number of logical cores. Further I removed the possibility of changing the number of squid processes in the proxy.cgi Signed-off-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> --- config/cfgroot/general-functions.pl | 7 +++++++ html/cgi-bin/proxy.cgi | 16 ++-------------- 2 files changed, 9 insertions(+), 14 deletions(-) diff --git a/config/cfgroot/general-functions.pl b/config/cfgroot/general-functions.pl index 0577afe28..e8495e885 100644 --- a/config/cfgroot/general-functions.pl +++ b/config/cfgroot/general-functions.pl @@ -1165,5 +1165,12 @@ sub dnssec_status() { return $status; } +sub number_cpu_cores() { + open my $cpuinfo, "/proc/cpuinfo" or die "Can't open cpuinfo: $!\n"; + my $cores = scalar (map /^processor/, <$cpuinfo>); + close $cpuinfo; + + return $cores; +} 1; diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index 738425b9a..92bebfe18 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -287,7 +287,6 @@ $proxysettings{'IDENT_USER_ACL'} = 'positive'; $proxysettings{'ENABLE_FILTER'} = 'off'; $proxysettings{'ENABLE_UPDXLRATOR'} = 'off'; $proxysettings{'ENABLE_CLAMAV'} = 'off'; -$proxysettings{'CHILDREN'} = '10'; $ncsa_buttontext = $Lang::tr{'advproxy NCSA create user'}; @@ -437,11 +436,6 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'} $errormessage = $Lang::tr{'invalid maximum incoming size'}; goto ERROR; } - if (!($proxysettings{'CHILDREN'} =~ /^\d+$/) || ($proxysettings{'CHILDREN'} < 1)) - { - $errormessage = $Lang::tr{'advproxy invalid num of children'}; - goto ERROR; - } if ($proxysettings{'ENABLE_BROWSER_CHECK'} eq 'on') { $browser_regexp = ''; @@ -1034,12 +1028,8 @@ print <<END </table> <hr size='1'> <table width='100%'> -<tr><td class='base' colspan='4'><b>$Lang::tr{'advproxy redirector children'}</b></td></tr> -<tr><td class='base' >$Lang::tr{'processes'}: <img src='/blob.gif' alt='*' /><input type='text' name='CHILDREN' value='$proxysettings{'CHILDREN'}' size='5' /></td> END ; -my $count = `ip n| wc -l`; -if ( $count < 1 ){$count = 1;} if ( -e "/usr/bin/squidclamav" ) { print "<td class='base'><b>".$Lang::tr{'advproxy squidclamav'}."</b><br />"; if ( ! -e "/var/run/clamav/clamd.pid" ){ @@ -1048,18 +1038,16 @@ if ( -e "/usr/bin/squidclamav" ) { } else { print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_CLAMAV' ".$checked{'ENABLE_CLAMAV'}{'on'}." /><br />"; - print "+ ".int(( $count**(1/3)) * 8);} +} print "</td>"; } else { print "<td></td>"; } print "<td class='base'><a href='/cgi-bin/urlfilter.cgi'><b>".$Lang::tr{'advproxy url filter'}."</a></b><br />"; print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_FILTER' ".$checked{'ENABLE_FILTER'}{'on'}." /><br />"; -print "+ ".int(($count**(1/3)) * 6); print "</td>"; print "<td class='base'><a href='/cgi-bin/updatexlrator.cgi'><b>".$Lang::tr{'advproxy update accelerator'}."</a></b><br />"; print $Lang::tr{'advproxy enabled'}."<input type='checkbox' name='ENABLE_UPDXLRATOR' ".$checked{'ENABLE_UPDXLRATOR'}{'on'}." /><br />"; -print "+ ".int(($count**(1/3)) * 5); print "</td></tr>"; print <<END </table> @@ -4095,7 +4083,7 @@ END if (($proxysettings{'ENABLE_FILTER'} eq 'on') || ($proxysettings{'ENABLE_UPDXLRATOR'} eq 'on') || ($proxysettings{'ENABLE_CLAMAV'} eq 'on')) { print FILE "url_rewrite_program /usr/sbin/redirect_wrapper\n"; - print FILE "url_rewrite_children $proxysettings{'CHILDREN'}\n\n"; + print FILE "url_rewrite_children ", &General::number_cpu_cores(), "\n\n"; } # Include file with user defined settings. -- 2.12.2

3 10

[Fwd: Re: request for info: unbound via https / tls]
by Paul Simmons 13 Dec '18

13 Dec '18

Forgot the list cc :-(.

4 27

[PATCH v2] fireinfo: support upstream proxy with authentication
by Peter Müller 11 Dec '18

11 Dec '18

Fireinfo could not send its profile to https://fireinfo.ipfire.org/ if the machine is behind an upstream proxy which requires username and password. This is fixed by tweaking urllib2's opening handler. To apply this on existing installations, the fireinfo package needs to be shipped during an update. The second version of this patch fixes bogus indention, assembles proxy authentication string more readable and preserves HTTP proxy handler. Fixes #11905 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- src/sendprofile | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) mode change 100644 => 100755 src/sendprofile diff --git a/src/sendprofile b/src/sendprofile old mode 100644 new mode 100755 index b836567..1f32440 --- a/src/sendprofile +++ b/src/sendprofile @@ -73,10 +73,21 @@ def send_profile(profile): request.add_header("User-Agent", "fireinfo/%s" % fireinfo.__version__) # Set upstream proxy if we have one. - # XXX this cannot handle authentication proxy = get_upstream_proxy() + if proxy["host"]: - request.set_proxy(proxy["host"], "http") + # handling upstream proxies with authentication is more tricky... + if proxy["user"] and proxy["pass"]: + prx_auth_string = "http://%s:%s@%s/" % (proxy["user"], proxy["pass"], proxy["host"]) + + proxy_handler = urllib2.ProxyHandler({'http': prx_auth_string}) + proxy_handler = urllib2.ProxyHandler({'https': prx_auth_string}) + auth = urllib2.HTTPBasicAuthHandler() + opener = urllib2.build_opener(proxy_handler, auth, urllib2.HTTPHandler) + urllib2.install_opener(opener) + else: + request.set_proxy(proxy["host"], "http") + request.set_proxy(proxy["host"], "https") try: urllib2.urlopen(request, timeout=60) -- 2.16.4

2 5

Unbound configuration switch "ignore-cd-flag"
by Peter Müller 31 Oct '18

31 Oct '18

Hello *, while doing some research about DNS tunnelling, I stumbled across this Unbound configuration directive: "ignore-cd-flag" It is set to "no" as a default value, allowing DNSSEC validation bypass: > user@machine:~> dig soa +cd dnssec-failed.org > > ; <<>> DiG 9.11.2 <<>> soa +cd dnssec-failed.org > ;; global options: +cmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5844 > ;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 > > ;; OPT PSEUDOSECTION: > ; EDNS: version: 0, flags:; udp: 4096 > ;; QUESTION SECTION: > ;dnssec-failed.org. IN SOA > > ;; ANSWER SECTION: > dnssec-failed.org. 8092 IN SOA dns101.comcast.org. dnsadmin.comcast.net. 2010101935 900 180 604800 7200 > > ;; Query time: 1198 msec > ;; SERVER: 10.[REDACTED]#53(10.[REDACTED]) > ;; WHEN: Tue Oct 30 15:49:53 CET 2018 > ;; MSG SIZE rcvd: 117 > I consider this being a security risk and would like to set this value to "yes" in IPFire. Thoughts? Opinions? Thanks, and best regards, Peter Müller -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

2 2

Reachability of DNS root servers for zone transfers
by Peter Müller 30 Oct '18

30 Oct '18

Hello *, I am currently working on making Unbound mirror essential DNS root zones such as ".", "arpa.", "in-addr.arpa." and "ip6.arpa.". Since Unbound provides the "auth-zone" flag for some time now, I did not think of this as being too difficult. However, things use to become difficult while having a closer look at them. :-\ Having IPFire installations with no direct access to the DNS root servers turned out to be the biggest issue here. (Besides, not all root servers can be used, as some of them do not allow zone transfers via AXFR.) I am currently thinking of this procedure: (a) If DNS servers are set an known to work, they are used to fetch mentioned DNS root zones. In case of failures, Unbound falls back to current behaviour. As DNS resolvers usually do not allow zone transfers, I expect this to fail in most cases. (b) In case no DNSSEC-validating or -aware resolvers are available, Unbound falls back into recursor mode, assuming reachability of at least one of these servers. In this case, fetching the zones is easy. (c) In case of permissive operation (no DNSSEC available), root zones are not fetched. It turned out Unbound bumps into validation errors sometime, which needs some further investigation. Can/should we always assume DNS root servers are reachable? Any opinions on this? Thanks, and best regards, Peter Müller P.S.: In case anybody wants to test, here is the corresponding Unbound configuration snippet (adjust paths if needed): > # mirror DNS root zones > auth-zone: > name: "." > for-downstream: no > for-upstream: yes > fallback-enabled: yes > master: b.root-servers.net > master: c.root-servers.net > master: e.root-servers.net > master: f.root-servers.net > master: g.root-servers.net > master: k.root-servers.net > zonefile: "auth-zones/root" > > auth-zone: > name: "arpa." > for-downstream: no > for-upstream: yes > fallback-enabled: yes > master: b.root-servers.net > master: c.root-servers.net > master: e.root-servers.net > master: f.root-servers.net > master: g.root-servers.net > master: k.root-servers.net > master: 80.67.169.40 > master: 188.213.49.35 > zonefile: "auth-zones/arpa" > > auth-zone: > name: "in-addr.arpa." > for-downstream: no > for-upstream: yes > fallback-enabled: yes > master: f.in-addr-servers.arpa. > zonefile: "auth-zones/in-addr.arpa" > > auth-zone: > name: "ip6.arpa." > for-downstream: no > for-upstream: yes > fallback-enabled: yes > master: f.ip6-servers.arpa. > zonefile: "auth-zones/ip6.arpa" P.P.S.: See https://unbound.nlnetlabs.nl/pipermail/unbound-users/2018-May/005268.html for upstream mailinglist thread. -- Microsoft DNS terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

2 3

[PATCH] fix downloading Snort rules if behind upstream proxy
by Peter Müller 29 Oct '18

29 Oct '18

Currently, the wget call only uses proxy information for HTTP. Since rulesets are downloaded via HTTPS now, the same information also needs to be applied for HTTPS. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/ids.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index d9d697deb..eddfc387c 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -692,7 +692,7 @@ sub downloadrulesfile { } if ($peer) { - system("wget -r --proxy=on --proxy-user=$proxysettings{'UPSTREAM_USER'} --proxy-passwd=$proxysettings{'UPSTREAM_PASSWORD'} -e http_proxy=http://$peer:$peerport/ -o /var/tmp/log --output-document=/var/tmp/snortrules.tar.gz $url"); + system("wget -r --proxy=on --proxy-user=$proxysettings{'UPSTREAM_USER'} --proxy-passwd=$proxysettings{'UPSTREAM_PASSWORD'} -e http_proxy=http://$peer:$peerport/ -e https_proxy=http://$peer:$peerport/ -o /var/tmp/log --output-document=/var/tmp/snortrules.tar.gz $url"); } else { system("wget -r -o /var/tmp/log --output-document=/var/tmp/snortrules.tar.gz $url"); } -- 2.16.4

1 0

[PATCH 0/1] Updated apache and apr
by Wolfgang Apolinarski 29 Oct '18

29 Oct '18

Updated apache httpd to 2.4.37 and apr to 1.6.5 Changes: http://www.apache.org/dist/httpd/CHANGES_2.4.37 http://www.apache.org/dist/apr/CHANGES-APR-1.6 Wolfgang Apolinarski (1): Updated apache and apr config/rootfiles/common/apache2 | 454 ++++++++++++++++++++-------------------- config/rootfiles/common/apr | 2 +- lfs/apache2 | 4 +- lfs/apr | 4 +- 4 files changed, 233 insertions(+), 231 deletions(-) -- 2.13.0

2 6

[PATCH] fireinfo: support upstream proxy with authentication
by Peter Müller 29 Oct '18

29 Oct '18

Fireinfo could not send its profile to https://fireinfo.ipfire.org/ if the machine is behind an upstream proxy which requires username and password. This is fixed by tweaking urllib2's opening handler. To apply this on existing installations, the fireinfo package needs to be shipped during an update. Fixes #11905 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- src/sendprofile | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) mode change 100644 => 100755 src/sendprofile diff --git a/src/sendprofile b/src/sendprofile old mode 100644 new mode 100755 index b836567..8c0603f --- a/src/sendprofile +++ b/src/sendprofile @@ -73,10 +73,17 @@ def send_profile(profile): request.add_header("User-Agent", "fireinfo/%s" % fireinfo.__version__) # Set upstream proxy if we have one. - # XXX this cannot handle authentication proxy = get_upstream_proxy() + if proxy["host"]: - request.set_proxy(proxy["host"], "http") + # handling upstream proxies with authentication is more tricky... + if proxy["user"] and proxy["pass"]: + proxy_handler = urllib2.ProxyHandler({'https': 'http://' + proxy["user"] + ':' + proxy["pass"] + '@' + proxy["host"] + '/'}) + auth = urllib2.HTTPBasicAuthHandler() + opener = urllib2.build_opener(proxy_handler, auth, urllib2.HTTPHandler) + urllib2.install_opener(opener) + else: + request.set_proxy(proxy["host"], "https") try: urllib2.urlopen(request, timeout=60) -- 2.16.4

2 1

[PATCH] Unbound: output statistics daily instead of just on shutdown
by Peter Müller 27 Oct '18

27 Oct '18

Currently, Unbound only prints statistics if it is being shutdown (mostly because of a machine reboot). This makes detecting DNS anomalies hard as no intermediate statistic result is being logged. This patch changes Unbound's behaviour in order to log statistics every 86,400 seconds (i.e. 24 hours). Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/unbound/unbound.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index cda591dab..2cc5bab8a 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -28,7 +28,7 @@ server: log-queries: no # Unbound Statistics - statistics-interval: 0 + statistics-interval: 86400 statistics-cumulative: yes extended-statistics: yes -- 2.16.4

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development October 2018