Development April 2018

development@lists.ipfire.org

10 participants
27 discussions

[PATCH] remove forgotten Nagios files, if any
by Peter Müller 26 Apr '18

26 Apr '18

When we decided to drop Nagios, some files were not removed on the installations. Since the package does not exist anymore, "pakfire remove nagios" does not work so we need to clean them up manually in case they exist. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/core/120/update.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/rootfiles/core/120/update.sh b/config/rootfiles/core/120/update.sh index e4ee15b52..310f669c1 100644 --- a/config/rootfiles/core/120/update.sh +++ b/config/rootfiles/core/120/update.sh @@ -86,6 +86,12 @@ done # Remove deprecated SSH configuration option sed -e "/UsePrivilegeSeparation/d" -i /etc/ssh/sshd_config +# Remove forgotten Nagios files, if any... +test -f /etc/rc.d/init.d/nagios && rm -f /etc/rc.d/init.d/nagios +test -f /usr/bin/nagios && rm -f /usr/bin/nagios +test -d /usr/share/nagios/ && rm -rf /usr/share/nagios/ +test -d /var/nagios/ && rm -rf /var/nagios/ + # Remove any pakfire keys stored in / rm -rfv /.gnupg -- 2.13.6

2 8

[PATCH] Start Core Update 121
by Peter Müller 26 Apr '18

26 Apr '18

Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/core/{120 => 121}/exclude | 0 config/rootfiles/core/{120 => 121}/meta | 0 config/rootfiles/core/121/update.sh | 62 ++++++++++++++++++++++ config/rootfiles/oldcore/120/exclude | 30 +++++++++++ .../{core => oldcore}/120/filelists/Net_SSLeay | 0 .../{core => oldcore}/120/filelists/apache2 | 0 .../rootfiles/{core => oldcore}/120/filelists/apr | 0 .../{core => oldcore}/120/filelists/aprutil | 0 .../rootfiles/{core => oldcore}/120/filelists/bind | 0 .../rootfiles/{core => oldcore}/120/filelists/curl | 0 .../{core => oldcore}/120/filelists/cyrus-sasl | 0 .../rootfiles/{core => oldcore}/120/filelists/dma | 0 .../{core => oldcore}/120/filelists/files | 0 .../{core => oldcore}/120/filelists/gnupg | 0 .../120/filelists/i586/openssl-sse2 | 0 .../{core => oldcore}/120/filelists/libevent2 | 0 .../{core => oldcore}/120/filelists/logrotate | 0 .../rootfiles/{core => oldcore}/120/filelists/ntp | 0 .../{core => oldcore}/120/filelists/openssh | 0 .../{core => oldcore}/120/filelists/openssl | 0 .../{core => oldcore}/120/filelists/openssl-compat | 0 .../{core => oldcore}/120/filelists/openvpn | 0 .../{core => oldcore}/120/filelists/python-typing | 0 .../{core => oldcore}/120/filelists/snort | 0 .../{core => oldcore}/120/filelists/strongswan | 0 .../{core => oldcore}/120/filelists/unbound | 0 .../{core => oldcore}/120/filelists/vnstat | 0 .../rootfiles/{core => oldcore}/120/filelists/wget | 0 .../{core => oldcore}/120/filelists/wpa_supplicant | 0 config/rootfiles/{core => oldcore}/120/update.sh | 0 make.sh | 4 +- 31 files changed, 94 insertions(+), 2 deletions(-) rename config/rootfiles/core/{120 => 121}/exclude (100%) rename config/rootfiles/core/{120 => 121}/meta (100%) create mode 100644 config/rootfiles/core/121/update.sh create mode 100644 config/rootfiles/oldcore/120/exclude rename config/rootfiles/{core => oldcore}/120/filelists/Net_SSLeay (100%) rename config/rootfiles/{core => oldcore}/120/filelists/apache2 (100%) rename config/rootfiles/{core => oldcore}/120/filelists/apr (100%) rename config/rootfiles/{core => oldcore}/120/filelists/aprutil (100%) rename config/rootfiles/{core => oldcore}/120/filelists/bind (100%) rename config/rootfiles/{core => oldcore}/120/filelists/curl (100%) rename config/rootfiles/{core => oldcore}/120/filelists/cyrus-sasl (100%) rename config/rootfiles/{core => oldcore}/120/filelists/dma (100%) rename config/rootfiles/{core => oldcore}/120/filelists/files (100%) rename config/rootfiles/{core => oldcore}/120/filelists/gnupg (100%) rename config/rootfiles/{core => oldcore}/120/filelists/i586/openssl-sse2 (100%) rename config/rootfiles/{core => oldcore}/120/filelists/libevent2 (100%) rename config/rootfiles/{core => oldcore}/120/filelists/logrotate (100%) rename config/rootfiles/{core => oldcore}/120/filelists/ntp (100%) rename config/rootfiles/{core => oldcore}/120/filelists/openssh (100%) rename config/rootfiles/{core => oldcore}/120/filelists/openssl (100%) rename config/rootfiles/{core => oldcore}/120/filelists/openssl-compat (100%) rename config/rootfiles/{core => oldcore}/120/filelists/openvpn (100%) rename config/rootfiles/{core => oldcore}/120/filelists/python-typing (100%) rename config/rootfiles/{core => oldcore}/120/filelists/snort (100%) rename config/rootfiles/{core => oldcore}/120/filelists/strongswan (100%) rename config/rootfiles/{core => oldcore}/120/filelists/unbound (100%) rename config/rootfiles/{core => oldcore}/120/filelists/vnstat (100%) rename config/rootfiles/{core => oldcore}/120/filelists/wget (100%) rename config/rootfiles/{core => oldcore}/120/filelists/wpa_supplicant (100%) rename config/rootfiles/{core => oldcore}/120/update.sh (100%) diff --git a/config/rootfiles/core/120/exclude b/config/rootfiles/core/121/exclude similarity index 100% rename from config/rootfiles/core/120/exclude rename to config/rootfiles/core/121/exclude diff --git a/config/rootfiles/core/120/meta b/config/rootfiles/core/121/meta similarity index 100% rename from config/rootfiles/core/120/meta rename to config/rootfiles/core/121/meta diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh new file mode 100644 index 000000000..9986316e9 --- /dev/null +++ b/config/rootfiles/core/121/update.sh @@ -0,0 +1,62 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 3 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2017 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +/usr/local/bin/backupctrl exclude >/dev/null 2>&1 + +core=120 + +# Remove old core updates from pakfire cache to save space... +for (( i=1; i<=$core; i++ )); do + rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire +done + +# Stop services + +# Extract files +extract_files + +# update linker config +ldconfig + +# Update Language cache +/usr/local/bin/update-lang-cache + +# Start services + +# This update needs a reboot... +touch /var/run/need_reboot + +# Finish +/etc/init.d/fireinfo start +sendprofile + +# Update grub config to display new core version +if [ -e /boot/grub/grub.cfg ]; then + grub-mkconfig -o /boot/grub/grub.cfg +fi + +sync + +# Don't report the exitcode last command +exit 0 diff --git a/config/rootfiles/oldcore/120/exclude b/config/rootfiles/oldcore/120/exclude new file mode 100644 index 000000000..d6fd053b6 --- /dev/null +++ b/config/rootfiles/oldcore/120/exclude @@ -0,0 +1,30 @@ +boot/config.txt +boot/grub/grub.cfg +boot/grub/grubenv +etc/alternatives +etc/collectd.custom +etc/default/grub +etc/ipsec.conf +etc/ipsec.secrets +etc/ipsec.user.conf +etc/ipsec.user.secrets +etc/localtime +etc/shadow +etc/snort/snort.conf +etc/ssh/ssh_config +etc/ssh/sshd_config +etc/ssl/openssl.cnf +etc/sudoers +etc/sysconfig/firewall.local +etc/sysconfig/rc.local +etc/udev/rules.d/30-persistent-network.rules +srv/web/ipfire/html/proxy.pac +var/ipfire/dma +var/ipfire/time +var/ipfire/ovpn +var/lib/alternatives +var/log/cache +var/log/dhcpcd.log +var/log/messages +var/state/dhcp/dhcpd.leases +var/updatecache diff --git a/config/rootfiles/core/120/filelists/Net_SSLeay b/config/rootfiles/oldcore/120/filelists/Net_SSLeay similarity index 100% rename from config/rootfiles/core/120/filelists/Net_SSLeay rename to config/rootfiles/oldcore/120/filelists/Net_SSLeay diff --git a/config/rootfiles/core/120/filelists/apache2 b/config/rootfiles/oldcore/120/filelists/apache2 similarity index 100% rename from config/rootfiles/core/120/filelists/apache2 rename to config/rootfiles/oldcore/120/filelists/apache2 diff --git a/config/rootfiles/core/120/filelists/apr b/config/rootfiles/oldcore/120/filelists/apr similarity index 100% rename from config/rootfiles/core/120/filelists/apr rename to config/rootfiles/oldcore/120/filelists/apr diff --git a/config/rootfiles/core/120/filelists/aprutil b/config/rootfiles/oldcore/120/filelists/aprutil similarity index 100% rename from config/rootfiles/core/120/filelists/aprutil rename to config/rootfiles/oldcore/120/filelists/aprutil diff --git a/config/rootfiles/core/120/filelists/bind b/config/rootfiles/oldcore/120/filelists/bind similarity index 100% rename from config/rootfiles/core/120/filelists/bind rename to config/rootfiles/oldcore/120/filelists/bind diff --git a/config/rootfiles/core/120/filelists/curl b/config/rootfiles/oldcore/120/filelists/curl similarity index 100% rename from config/rootfiles/core/120/filelists/curl rename to config/rootfiles/oldcore/120/filelists/curl diff --git a/config/rootfiles/core/120/filelists/cyrus-sasl b/config/rootfiles/oldcore/120/filelists/cyrus-sasl similarity index 100% rename from config/rootfiles/core/120/filelists/cyrus-sasl rename to config/rootfiles/oldcore/120/filelists/cyrus-sasl diff --git a/config/rootfiles/core/120/filelists/dma b/config/rootfiles/oldcore/120/filelists/dma similarity index 100% rename from config/rootfiles/core/120/filelists/dma rename to config/rootfiles/oldcore/120/filelists/dma diff --git a/config/rootfiles/core/120/filelists/files b/config/rootfiles/oldcore/120/filelists/files similarity index 100% rename from config/rootfiles/core/120/filelists/files rename to config/rootfiles/oldcore/120/filelists/files diff --git a/config/rootfiles/core/120/filelists/gnupg b/config/rootfiles/oldcore/120/filelists/gnupg similarity index 100% rename from config/rootfiles/core/120/filelists/gnupg rename to config/rootfiles/oldcore/120/filelists/gnupg diff --git a/config/rootfiles/core/120/filelists/i586/openssl-sse2 b/config/rootfiles/oldcore/120/filelists/i586/openssl-sse2 similarity index 100% rename from config/rootfiles/core/120/filelists/i586/openssl-sse2 rename to config/rootfiles/oldcore/120/filelists/i586/openssl-sse2 diff --git a/config/rootfiles/core/120/filelists/libevent2 b/config/rootfiles/oldcore/120/filelists/libevent2 similarity index 100% rename from config/rootfiles/core/120/filelists/libevent2 rename to config/rootfiles/oldcore/120/filelists/libevent2 diff --git a/config/rootfiles/core/120/filelists/logrotate b/config/rootfiles/oldcore/120/filelists/logrotate similarity index 100% rename from config/rootfiles/core/120/filelists/logrotate rename to config/rootfiles/oldcore/120/filelists/logrotate diff --git a/config/rootfiles/core/120/filelists/ntp b/config/rootfiles/oldcore/120/filelists/ntp similarity index 100% rename from config/rootfiles/core/120/filelists/ntp rename to config/rootfiles/oldcore/120/filelists/ntp diff --git a/config/rootfiles/core/120/filelists/openssh b/config/rootfiles/oldcore/120/filelists/openssh similarity index 100% rename from config/rootfiles/core/120/filelists/openssh rename to config/rootfiles/oldcore/120/filelists/openssh diff --git a/config/rootfiles/core/120/filelists/openssl b/config/rootfiles/oldcore/120/filelists/openssl similarity index 100% rename from config/rootfiles/core/120/filelists/openssl rename to config/rootfiles/oldcore/120/filelists/openssl diff --git a/config/rootfiles/core/120/filelists/openssl-compat b/config/rootfiles/oldcore/120/filelists/openssl-compat similarity index 100% rename from config/rootfiles/core/120/filelists/openssl-compat rename to config/rootfiles/oldcore/120/filelists/openssl-compat diff --git a/config/rootfiles/core/120/filelists/openvpn b/config/rootfiles/oldcore/120/filelists/openvpn similarity index 100% rename from config/rootfiles/core/120/filelists/openvpn rename to config/rootfiles/oldcore/120/filelists/openvpn diff --git a/config/rootfiles/core/120/filelists/python-typing b/config/rootfiles/oldcore/120/filelists/python-typing similarity index 100% rename from config/rootfiles/core/120/filelists/python-typing rename to config/rootfiles/oldcore/120/filelists/python-typing diff --git a/config/rootfiles/core/120/filelists/snort b/config/rootfiles/oldcore/120/filelists/snort similarity index 100% rename from config/rootfiles/core/120/filelists/snort rename to config/rootfiles/oldcore/120/filelists/snort diff --git a/config/rootfiles/core/120/filelists/strongswan b/config/rootfiles/oldcore/120/filelists/strongswan similarity index 100% rename from config/rootfiles/core/120/filelists/strongswan rename to config/rootfiles/oldcore/120/filelists/strongswan diff --git a/config/rootfiles/core/120/filelists/unbound b/config/rootfiles/oldcore/120/filelists/unbound similarity index 100% rename from config/rootfiles/core/120/filelists/unbound rename to config/rootfiles/oldcore/120/filelists/unbound diff --git a/config/rootfiles/core/120/filelists/vnstat b/config/rootfiles/oldcore/120/filelists/vnstat similarity index 100% rename from config/rootfiles/core/120/filelists/vnstat rename to config/rootfiles/oldcore/120/filelists/vnstat diff --git a/config/rootfiles/core/120/filelists/wget b/config/rootfiles/oldcore/120/filelists/wget similarity index 100% rename from config/rootfiles/core/120/filelists/wget rename to config/rootfiles/oldcore/120/filelists/wget diff --git a/config/rootfiles/core/120/filelists/wpa_supplicant b/config/rootfiles/oldcore/120/filelists/wpa_supplicant similarity index 100% rename from config/rootfiles/core/120/filelists/wpa_supplicant rename to config/rootfiles/oldcore/120/filelists/wpa_supplicant diff --git a/config/rootfiles/core/120/update.sh b/config/rootfiles/oldcore/120/update.sh similarity index 100% rename from config/rootfiles/core/120/update.sh rename to config/rootfiles/oldcore/120/update.sh diff --git a/make.sh b/make.sh index 1f8738665..85f101bf0 100755 --- a/make.sh +++ b/make.sh @@ -25,8 +25,8 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name VERSION="2.19" # Version number -CORE="120" # Core Level (Filename) -PAKFIRE_CORE="120" # Core Level (PAKFIRE) +CORE="121" # Core Level (Filename) +PAKFIRE_CORE="121" # Core Level (PAKFIRE) GIT_BRANCH=`git rev-parse --abbrev-ref HEAD` # Git Branch SLOGAN="www.ipfire.org" # Software slogan CONFIG_ROOT=/var/ipfire # Configuration rootdir -- 2.13.6

2 3

BUG:11312 When renaming a GeoIP Group, the corresponding names in firewallrules (if any) are not changed accordingly. Now when changing a GeoIP Group the firewallrules are renamed correctly.
by Peter Müller 26 Apr '18

26 Apr '18

Slightly improved first version of this patch (contained a blank line with trailing whitespace). No functionality changed, patch has been confirmed as working correctly. Fixes: #11312 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> --- html/cgi-bin/fwhosts.cgi | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi index a2ade8a20..10217425d 100644 --- a/html/cgi-bin/fwhosts.cgi +++ b/html/cgi-bin/fwhosts.cgi @@ -1278,7 +1278,7 @@ if ($fwhostsettings{'ACTION'} eq 'changegeoipgrpname') } &General::writehasharray("$configgeoipgrp", \%customgeoipgrp ); #change name in FW Rules - &changenameinfw($fwhostsettings{'oldgrpname'},$fwhostsettings{'grp'},6); + &changenameinfw($fwhostsettings{'oldgrpname'},$fwhostsettings{'grp'},4,"geoip"); } } &addgeoipgrp; @@ -3052,6 +3052,12 @@ sub changenameinfw my $old=shift; my $new=shift; my $fld=shift; + my $type=shift; + + if ($type eq 'geoip'){ + $old="group:$old"; + $new="group:$new"; + } &General::readhasharray("$fwconfigfwd", \%fwfwd); &General::readhasharray("$fwconfiginp", \%fwinp); &General::readhasharray("$fwconfigout", \%fwout); -- 2.13.6

2 1

Changes to the website according to the new GDPR legislation
by Michael Tremer 25 Apr '18

25 Apr '18

Hello guys, I guess you have seen it by now that there is a lot of fuzz and panic about the new GDPR. We are slightly affected by this as well and therefore I have been investigating what we need to do to be compliant. The website needs the following things changed: https://git.ipfire.org/?p=ipfire.org.git;a=commitdiff;h=77a085ed3f2e0444ba6… This just updates the disclaimer and adds a few clauses about data protection and what we are doing with the data. This applies mainly to the support forums. This also needs to be ported to the new website design, which I can do shortly. Sven's development branch unfortunately has a few merge issues with the master branch and I need a little time to sort this out. The other thing that we probably do not need to change because of legal restrictions, but is a good idea anyways is to serve *all* additional JS, CSS and fonts locally. That reduces the amount of data that is being collected by Google Fonts and other CDNs so that we protect our users from that. The additional time the website needs to load is not too bad and should be acceptable over privacy. Just wanted to keep you folks updated about this. If anybody else knows anything that we are not doing right about GDPR yet and we need to change, please let me know. Best, -Michael

2 2

[Discussion] Privacy and security for IPFire updates
by Peter Müller 24 Apr '18

24 Apr '18

Hello, a few days ago, I had a discussion with Michael about privacy and security for IPFire updates (we mainly focused on IPFire 3.x, but some points might be applicable to 2.x, too). In order to get some more opinions about this, I would like to mention the main points here and ask for comments. Forgive me if you receive this mail twice; I'll post it on both development and mirror list. (a) Security Whenever you are updating an application or an entire operating systems, security is the most important aspect: An attacker must not be able to manipulate update packages, or fake information about the current patchlevel, or something similar. In the past, we saw several incidents here - perhaps the most famous one was "Flame" (also known as "Flamer" or "Skywiper"), a sophisticated malware which was detected in Q1/2012 and spread via Windows Updates with a valid signature - and it turned out that strong cryptography is a very good way to be more robust here. In IPFire 2.x, we recently switched from SHA1 to SHA512 for the Pakfire signatures, and plan to change the signing key (which is currently a 1024-bit-DSA one) with Core Update 121 to a more secure one. So far, so good. Speaking about IPFire 3.x, we plan to download updates over HTTPS only (see below why). However, there are still a few questions left: (i) Should we sign the mirror list? In 3.x, using a custom mirror (i.e. in a company network) will be possible. If not specified, we use the public mirror infrastructure; a list of all servers and paths will be published as it already is today. In my opinion, we should sign that list, too, to prevent an attacker from inserting his/her mirror silently. On the other hand, packages are sill signed, so a manipulation here would not be possible (and we do not have to trust our mirrors), but an attacker might still gather some metadata. [The mirror list can be viewed at https://mirrors.ipfire.org/, if anyone is interested.] (ii) Should we introduce signers? A package built for IPFire 3.x will be signed at the builder using a custom key for each machine. Since malicious activity might took place during the build, the key might became compromised. Some Linux distributions are using dedicated signers, which are only signing data but never unpack or execute them. That way, we could also move the signing keys to a HSM (example: https://www.nitrokey.com/) and run the server at a secure location (not in a public data centre). (b) Privacy Fetching updates typically leaks a lot of information (such as your current patch level, or systems architecture, or IP address). By using HTTPS only, we avoid information leaks to eavesdroppers, which I consider a security benefit, too. However, a mirror operator still has access to those information. Perhaps the IP address is the most critical one, since it allows tracing a system back to a city/country, or even to an organisation. Because of that, I do consider mirrors to be somewhat critical, and would like to see the list singed in 3.x, too. (i) Should we introduce mirror servers in the Tor network? One way to solve this problem is to download updates via a proxy, or an anonymisation network. In most cases, Tor fits the bill. For best privacy, some mirror servers could be operated as so-called "hidden services", so traffic won't even leave the Tor network and pass some exit nodes. (Debian runs several services that way, including package mirrors: https://onion.debian.org/ .) Since Tor is considered bad traffic in some corporate network (or even states), this technique should be disabled by default. What are your opinions here? (ii) Reducing update connections to anybody else Some resources (GeoIP database, IDS rulesets, proxy blacklists) are currently not fetched via the IPFire mirrors, causing some of the problems mentioned above. For example, to fetch the GeoIP database, all systems sooner or later connect to "geolite.maxmind.com", so we can assume they see a lot of IP addresses IPFire systems are located behind. :-\ Michael and I are currently working on a replacement for this, called "libloc", but that is a different topic. Pushing all these resources into packages (if they are free, of course) and deliver them over our own mirrors would reduce some traffic to third party servers here. For libloc, we plan to do so. Should we do this for other resources such as rulesets and blacklists, too? Looking forward to read your comments. Thanks, and best regards, Peter Müller

3 7

[PATCH] BUG: 11696 - VPN Subnets missing from wpad.dat
by Oliver Fuhrer 24 Apr '18

24 Apr '18

This Patch excludes enabled ipsec/ OpenVPN N2N Subnets from wpad.dat so they don't go through the proxy. I could only test it with ipsec tunnels, however as the code for openvpn is pretty much the same, I included this one as well and some basic tests worked as expected. As I'm not very familiar with Perl, there probably is some room for improvement too. Regards Oliver diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index c36fc4e..69bfdd4 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -3014,6 +3014,11 @@ sub write_acls sub writepacfile { + my %vpnconfig=(); + my %ovpnconfig=(); + &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig); + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ovpnconfig); + open(FILE, ">/srv/web/ipfire/html/proxy.pac"); flock(FILE, 2); print FILE "function FindProxyForURL(url, host)\n"; @@ -3039,6 +3044,26 @@ END print FILE " (isInNet(host, \"$netsettings{'ORANGE_NETADDRESS'}\", \"$netsettings{'ORANGE_NETMASK'}\")) ||\n"; } + foreach my $key (sort { uc($vpnconfig{$a}[1]) cmp uc($vpnconfig{$b}[1]) } keys %vpnconfig) { + if ($vpnconfig{$key}[0] eq 'on' && $vpnconfig{$key}[3] ne 'host') { + my @networks = split(/\|/, $vpnconfig{$key}[11]); + foreach my $network (@networks) { + my ($vpnip, $vpnsub) = split("/", $network); + $vpnsub = &Network::convert_prefix2netmask($vpnsub) || $vpnsub; + print FILE " (isInNet(host, \"$vpnip\", \"$vpnsub\")) ||\n"; + } + } + } + + foreach my $key (sort { uc($ovpnconfig{$a}[1]) cmp uc($ovpnconfig{$b}[1]) } keys %ovpnconfig) { + if ($ovpnconfig{$key}[0] eq 'on' && $ovpnconfig{$key}[3] ne 'host') { + my @networks = split(/\|/, $ovpnconfig{$key}[11]); + foreach my $network (@networks) { + my ($vpnip, $vpnsub) = split("/", $network); + print FILE " (isInNet(host, \"$vpnip\", \"$vpnsub\")) ||\n"; + } + } + } print FILE <<END (isInNet(host, "169.254.0.0", "255.255.0.0")) ) --

3 3

Testing report for Core Update 120
by Peter Müller 24 Apr '18

24 Apr '18

Hello, I installed Core Update 120 on one machine and performed a reboot. So far, I am able to report the following: Squid works IDS works IPsec VPN works (except #11688) OpenVPN VPN works (no TLS 1.2 tested, yet) OpenSSH works WebUI works OpenSSL also uses new default cipher list and provides Chacha/Poly. However, NRPE does not work anymore, clients are unable to establish a SSL connection to the server listening on port 5666: Apr 20 18:53:09 firewall nrpe[9756]: Error: Could not complete SSL handshake. 1 I guess this is related to OpenSSL 1.1, but I am not sure. strace does not show anything very helpful: > [pid 13832] <... close resumed> ) = 0 > [pid 13831] <... munmap resumed> ) = 0 > [pid 13832] getpeername(5, {sa_family=AF_INET, sin_port=htons(54200), sin_addr=inet_addr("10.71.204.3")}, [16]) = 0 > [pid 13832] rt_sigaction(SIGALRM, {0x403350, [ALRM], SA_RESTORER|SA_RESTART, 0x67c135cf22e0}, {SIG_DFL, [], 0}, 8) = 0 > [pid 13831] exit_group(0) = ? > [pid 13832] alarm(300) = 0 > [pid 13831] +++ exited with 0 +++ > [pid 13819] <... wait4 resumed> NULL, 0, NULL) = 13831 > [pid 13819] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13831, si_status=0, si_utime=0, si_stime=0} --- > [pid 13819] select(5, [4], NULL, [4], {0, 500000} <unfinished ...> > [pid 13832] read(5, "\26\3\1\0r", 5) = 5 > [pid 13832] read(5, "\1\0\0n\3\3\321C\211\335\36\265\231wV\242\234\7\314Tm|-\367\210\200\310y\233\363?^"..., 114) = 114 > [pid 13832] getpid() = 13832 > [pid 13832] write(5, "\25\3\3\0\2\2(", 7) = 7 > [pid 13832] getpid() = 13832 > [pid 13832] sendto(3, "<27>Apr 20 18:56:20 nrpe[13832]:"..., 76, MSG_NOSIGNAL, NULL, 0) = 76 > [pid 13832] close(5) = 0 > [pid 13832] munmap(0x67c13567b000, 2187664) = 0 > [pid 13832] exit_group(0) = ? > [pid 13832] +++ exited with 0 +++ Any ideas? Best regards, Peter Müller

2 1

[PATCH] improve error message if make.sh is executed by non-root user
by Peter Müller 24 Apr '18

24 Apr '18

Fixes #11706. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- make.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make.sh b/make.sh index c03e464b5..252183cc8 100755 --- a/make.sh +++ b/make.sh @@ -416,7 +416,7 @@ prepareenv() { # Checking if running as root user if [ $(id -u) -ne 0 ]; then - exiterror "Not building as root" + exiterror "root privileges required for building" fi # Checking for necessary temporary space -- 2.13.6

2 1

[PATCH] clamav 0.100.0: Add missing update for rootfile
by Matthias Fischer 23 Apr '18

23 Apr '18

This is missing in https://patchwork.ipfire.org/patch/1722/ Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/clamav | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index d7636e983..ec5e09c84 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -4,7 +4,6 @@ usr/bin/clamconf usr/bin/clamdscan usr/bin/clamdtop usr/bin/clamscan -usr/bin/clamsubmit usr/bin/freshclam usr/bin/sigtool #usr/include/clamav.h @@ -12,6 +11,11 @@ usr/bin/sigtool usr/lib/libclamav.so usr/lib/libclamav.so.7 usr/lib/libclamav.so.7.1.1 +#usr/lib/libclammspack.a +#usr/lib/libclammspack.la +usr/lib/libclammspack.so +usr/lib/libclammspack.so.0 +usr/lib/libclammspack.so.0.1.0 #usr/lib/libclamunrar.la usr/lib/libclamunrar.so usr/lib/libclamunrar.so.7 @@ -21,6 +25,7 @@ usr/lib/libclamunrar_iface.so usr/lib/libclamunrar_iface.so.7 usr/lib/libclamunrar_iface.so.7.1.1 #usr/lib/pkgconfig/libclamav.pc +#usr/lib/pkgconfig/libclammspack.pc usr/sbin/clamd usr/share/clamav #usr/share/man/man1/clambc.1 @@ -28,7 +33,6 @@ usr/share/clamav #usr/share/man/man1/clamdscan.1 #usr/share/man/man1/clamdtop.1 #usr/share/man/man1/clamscan.1 -#usr/share/man/man1/clamsubmit.1 #usr/share/man/man1/freshclam.1 #usr/share/man/man1/sigtool.1 #usr/share/man/man5/clamav-milter.conf.5 -- 2.17.0

2 1

[PATCH] update ClamAV to 0.100.0
by Peter Müller 23 Apr '18

23 Apr '18

Update ClamAV to 0.100.0, which brings some new features and bugfixes (release notes are available here: https://blog.clamav.net/2018/04/clamav-01000-has-been-released.html). Since the internal LLVM code is now deprecated and disabled by default, patching clamav/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp does not seem to be necessary anymore. Further, the --disable-zlib-vcheck option has been removed since it produces warnings during compilation. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- lfs/clamav | 8 +++----- src/patches/clamav/llvm-glibc.patch | 12 ------------ 2 files changed, 3 insertions(+), 17 deletions(-) delete mode 100644 src/patches/clamav/llvm-glibc.patch diff --git a/lfs/clamav b/lfs/clamav index 748c2c371..7623801fb 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.99.4 +VER = 0.100.0 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 37 +PAK_VER = 38 DEPS = "" @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b9359b90086948b3c4eb97c84cf4b400 +$(DL_FILE)_MD5 = 93e8efb489c2afdfca73703b76c24e01 install : $(TARGET) @@ -81,10 +81,8 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/clamav/llvm-glibc.patch cd $(DIR_APP) && ./configure \ --prefix=/usr \ - --disable-zlib-vcheck \ --sysconfdir=/var/ipfire/clamav \ $(CONFIGURE_FLAGS) cd $(DIR_APP) && make $(MAKETUNING) diff --git a/src/patches/clamav/llvm-glibc.patch b/src/patches/clamav/llvm-glibc.patch deleted file mode 100644 index 78845fcfc..000000000 --- a/src/patches/clamav/llvm-glibc.patch +++ /dev/null @@ -1,12 +0,0 @@ -Index: clamav-0.97.3/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp -=================================================================== ---- clamav-0.97.3.orig/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp -+++ clamav-0.97.3/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp -@@ -55,6 +55,7 @@ static void runAtExitHandlers() { - #include <sys/stat.h> - #endif - #include <fcntl.h> -+#include <unistd.h> - /* stat functions are redirecting to __xstat with a version number. On x86-64 - * linking with libc_nonshared.a and -Wl,--export-dynamic doesn't make 'stat' - * available as an exported symbol, so we have to add it explicitly. -- 2.13.6

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2018