Development July 2018

development@lists.ipfire.org

14 participants
32 discussions

IP traffic being dropped rather than forwarded
by Jeffrey Walton 22 Jul '18

22 Jul '18

Hi Everyone, My apologies if this is the wrong list. I did not see a Users list at https://lists.ipfire.org/mailman/listinfo . Please let me know a better list if one is available. I'm following https://wiki.ipfire.org/configuration/firewall/rules/port-forwarding. I've setup a port forwarding rule to send inbound TCP|UDP/1522 traffic to an internal host/22 (i.e., forward to SSH). See https://postimg.cc/image/ubpzpkaaf/ . Inspecting the Firewall Log shows the traffic is being DROP_INPUT. See https://s15.postimg.cc/sl6ynm2wr/Firewall-2.png . I don't understand two items. First, why is this listed under Outgoing Firewall Rules? This is something to handle incoming traffic, not outgoing traffic. Second, the "Destination" and the "Firewall: 22" part. I'm pretty sure I configured <any>:1522 to forward to <internal host>:22. How does one forward <incoming>:1522 to <host>:22? What am I doing wrong? Is there an easier way to do this?

1 0

patchwork.ipfire.org => Internal Server Error
by Matthias Fischer 22 Jul '18

22 Jul '18

Hi, FYI: https://patchwork.ipfire.org/project/ipfire/list/ ends with "Internal Server Error The server encountered an internal error or misconfiguration and was unable to complete your request." Too hot to handle the requests... ;-) Best, Matthias

1 0

[PATCH] bind: Update to 9.11.3
by Matthias Fischer 21 Jul '18

21 Jul '18

For details see: http://ftp.isc.org/isc/bind9/9.11.4/RELEASE-NOTES-bind-9.11.4.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/bind | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/bind b/lfs/bind index 35f76443e..7a14a245a 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.3 +VER = 9.11.4 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4ed2a3f235595eadbd763b7ecb687ca0 +$(DL_FILE)_MD5 = 9b4834d78f30cdb796ce437262272a36 install : $(TARGET) -- 2.18.0

1 1

EFI
by Michael Tremer 18 Jul '18

18 Jul '18

Hello, it is finally time to think about EFI. That's the new kind of BIOS. In the past we have been ignoring this since the community did not want to fund any work in this area and there was enough hardware out there that booted up fine without support for EFI. Now this has changed, since Hannes told me that there is going to be more and more boards without a CSM and we are going to port IPFire to ARM64 soon which doesn't have a classic BIOS at all. For ARM64, I might even want to push for EFI-only, but Arne disagrees :P So what has happened so far? I have created a new branch "efi": https://git.ipfire.org/?p=ipfire-2.x.git;a=shortlog;h=refs/heads/efi This branch collects all the changes to the bootloader, the scripts that author the images and the installer. Please review and send your comments. The build creates two things in the end: An ISO image that is bootable in EFI mode. It will install the system for EFI whether the system supports EFI or not. That will allow us to move a harddisk from one machine to another one. Opposed to the flash image, the installer will try to create a boot entry in the EFI BIOS. The flash image will also boot in EFI mode or normal BIOS mode, depending on the system and leave the system configuration untouched. Since EFI is a tricky standard and other distributions had loads of trouble with it in the past, we need loads of people to test these images on their hardware. I hope that we will be able to sort out any boot issues as soon as possible with this method. Existing installations will not be migrated. We will support EFI only for x86_64 and aarch64. There is only a few systems out there that are 32 bit and support EFI. Those are usually not a good choice for running IPFire. Since I have no images ready right now, there is only code to review. I will upload images as soon as possible so that you guys can help testing without compiling them yourself. Best, -Michael

1 2

[PATCH] squid: Update to 3.5.28
by Matthias Fischer 17 Jul '18

17 Jul '18

For details see: http://www.squid-cache.org/Versions/v3/3.5/changesets/ Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 8 ++---- src/patches/squid/SQUID-2018_1.patch | 28 ------------------- src/patches/squid/SQUID-2018_2.patch | 23 --------------- ...uid-3.5.28-fix-max-file-descriptors.patch} | 0 4 files changed, 3 insertions(+), 56 deletions(-) delete mode 100644 src/patches/squid/SQUID-2018_1.patch delete mode 100644 src/patches/squid/SQUID-2018_2.patch rename src/patches/squid/{squid-3.5.27-fix-max-file-descriptors.patch => squid-3.5.28-fix-max-file-descriptors.patch} (100%) diff --git a/lfs/squid b/lfs/squid index f93097019..cae56407c 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 3.5.27 +VER = 3.5.28 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 39ef8199675d48a314b540f92c00c545 +$(DL_FILE)_MD5 = 9367e0375ea53ba0e99f77054d4402c5 install : $(TARGET) @@ -72,9 +72,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/SQUID-2018_1.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/SQUID-2018_2.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5.27-fix-max-file-descriptors.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5.28-fix-max-file-descriptors.patch cd $(DIR_APP) && autoreconf -vfi cd $(DIR_APP)/libltdl && autoreconf -vfi diff --git a/src/patches/squid/SQUID-2018_1.patch b/src/patches/squid/SQUID-2018_1.patch deleted file mode 100644 index 9392219a9..000000000 --- a/src/patches/squid/SQUID-2018_1.patch +++ /dev/null @@ -1,28 +0,0 @@ -commit eb2db98a676321b814fc4a51c4fb7928a8bb45d9 (refs/remotes/origin/v3.5) -Author: Amos Jeffries <yadij(a)users.noreply.github.com> -Date: 2018-01-19 13:54:14 +1300 - - ESI: make sure endofName never exceeds tagEnd (#130) - -diff --git a/src/esi/CustomParser.cc b/src/esi/CustomParser.cc -index d86d2d3..db634d9 100644 ---- a/src/esi/CustomParser.cc -+++ b/src/esi/CustomParser.cc -@@ -121,7 +121,7 @@ ESICustomParser::parse(char const *dataToParse, size_t const lengthOfData, bool - - char * endofName = strpbrk(const_cast<char *>(tag), w_space); - -- if (endofName > tagEnd) -+ if (!endofName || endofName > tagEnd) - endofName = const_cast<char *>(tagEnd); - - *endofName = '\0'; -@@ -214,7 +214,7 @@ ESICustomParser::parse(char const *dataToParse, size_t const lengthOfData, bool - - char * endofName = strpbrk(const_cast<char *>(tag), w_space); - -- if (endofName > tagEnd) -+ if (!endofName || endofName > tagEnd) - endofName = const_cast<char *>(tagEnd); - - *endofName = '\0'; diff --git a/src/patches/squid/SQUID-2018_2.patch b/src/patches/squid/SQUID-2018_2.patch deleted file mode 100644 index 9ecd8a5b7..000000000 --- a/src/patches/squid/SQUID-2018_2.patch +++ /dev/null @@ -1,23 +0,0 @@ -commit 8232b83d3fa47a1399f155cb829db829369fbae9 (refs/remotes/origin/v3.5) -Author: squidadm <squidadm(a)users.noreply.github.com> -Date: 2018-01-21 08:07:08 +1300 - - Fix indirect IP logging for transactions without a client connection (#129) (#136) - -diff --git a/src/client_side_request.cc b/src/client_side_request.cc -index be124f3..203f89d 100644 ---- a/src/client_side_request.cc -+++ b/src/client_side_request.cc -@@ -488,9 +488,9 @@ clientFollowXForwardedForCheck(allow_t answer, void *data) - * Ensure that the access log shows the indirect client - * instead of the direct client. - */ -- ConnStateData *conn = http->getConn(); -- conn->log_addr = request->indirect_client_addr; -- http->al->cache.caddr = conn->log_addr; -+ http->al->cache.caddr = request->indirect_client_addr; -+ if (ConnStateData *conn = http->getConn()) -+ conn->log_addr = request->indirect_client_addr; - } - request->x_forwarded_for_iterator.clean(); - request->flags.done_follow_x_forwarded_for = true; diff --git a/src/patches/squid/squid-3.5.27-fix-max-file-descriptors.patch b/src/patches/squid/squid-3.5.28-fix-max-file-descriptors.patch similarity index 100% rename from src/patches/squid/squid-3.5.27-fix-max-file-descriptors.patch rename to src/patches/squid/squid-3.5.28-fix-max-file-descriptors.patch -- 2.18.0

1 0

[PATCH 0/1] Apache: Update to 2.4.34
by Wolfgang Apolinarski 17 Jul '18

17 Jul '18

Apache: Update to 2.4.34 - Small bugfix release, apr and apr-util are still up-to-date. - Built and tested. Wolfgang Apolinarski (1): Apache: Update to 2.4.34 lfs/apache2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.13.0

1 1

[PATCH] kernel: Enable EFI on aarch64
by Michael Tremer 14 Jul '18

14 Jul '18

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 39 +++++++++++++++------- 1 file changed, 27 insertions(+), 12 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 7444864f308e..37e1907419ad 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.14.48-ipfire-multi Kernel Configuration +# Linux/arm64 4.14.50-ipfire Kernel Configuration # CONFIG_ARM64=y CONFIG_64BIT=y @@ -441,6 +441,7 @@ CONFIG_PCI_ECAM=y # CONFIG_PCI_IOV is not set # CONFIG_PCI_PRI is not set # CONFIG_PCI_PASID is not set +CONFIG_PCI_LABEL=y # CONFIG_HOTPLUG_PCI is not set # @@ -597,7 +598,9 @@ CONFIG_ARM64_MODULE_CMODEL_LARGE=y # CONFIG_CMDLINE="console=ttyAM0,115200 root=/dev/sda1 rootdelay=20" # CONFIG_CMDLINE_FORCE is not set -# CONFIG_EFI is not set +CONFIG_EFI_STUB=y +CONFIG_EFI=y +CONFIG_DMI=y # # Userspace binary formats @@ -2403,7 +2406,6 @@ CONFIG_WLAN=y # CONFIG_WIRELESS_WDS is not set CONFIG_WLAN_VENDOR_ADMTEK=y CONFIG_ADM8211=m -# CONFIG_RTL8189ES is not set CONFIG_ATH_COMMON=m CONFIG_WLAN_VENDOR_ATH=y # CONFIG_ATH_DEBUG is not set @@ -2614,7 +2616,6 @@ CONFIG_WL18XX=m CONFIG_WLCORE=m CONFIG_WLCORE_SDIO=m CONFIG_WILINK_PLATFORM_DATA=y -# CONFIG_WLAN_VENDOR_XRADIO is not set CONFIG_WLAN_VENDOR_ZYDAS=y CONFIG_USB_ZD1201=m CONFIG_ZD1211RW=m @@ -2861,6 +2862,7 @@ CONFIG_LP_CONSOLE=y CONFIG_PPDEV=m # CONFIG_HVC_DCC is not set CONFIG_IPMI_HANDLER=m +CONFIG_IPMI_DMI_DECODE=y # CONFIG_IPMI_PANIC_EVENT is not set CONFIG_IPMI_DEVICE_INTERFACE=m CONFIG_IPMI_SI=m @@ -3580,7 +3582,6 @@ CONFIG_REGULATOR_PFUZE100=y # CONFIG_REGULATOR_PV88080 is not set # CONFIG_REGULATOR_PV88090 is not set # CONFIG_REGULATOR_PWM is not set -CONFIG_REGULATOR_SY8106A=y # CONFIG_REGULATOR_TPS51632 is not set # CONFIG_REGULATOR_TPS62360 is not set # CONFIG_REGULATOR_TPS65023 is not set @@ -3591,7 +3592,6 @@ CONFIG_REGULATOR_TWL4030=y CONFIG_REGULATOR_VEXPRESS=y CONFIG_CEC_CORE=m CONFIG_CEC_NOTIFIER=y -CONFIG_CEC_PIN=y CONFIG_RC_CORE=m CONFIG_RC_MAP=m CONFIG_RC_DECODERS=y @@ -4234,12 +4234,6 @@ CONFIG_DRM_UDL=m # CONFIG_DRM_MGAG200 is not set # CONFIG_DRM_CIRRUS_QEMU is not set CONFIG_DRM_RCAR_DW_HDMI=m -CONFIG_DRM_SUN4I=m -CONFIG_DRM_SUN4I_HDMI=m -CONFIG_DRM_SUN4I_HDMI_CEC=y -CONFIG_DRM_SUN4I_BACKEND=m -CONFIG_DRM_SUN8I_DW_HDMI=m -CONFIG_DRM_SUN8I_MIXER=m # CONFIG_DRM_QXL is not set # CONFIG_DRM_BOCHS is not set CONFIG_DRM_PANEL=y @@ -4329,6 +4323,7 @@ CONFIG_FB_ARMCLCD=m # CONFIG_FB_ASILIANT is not set # CONFIG_FB_IMSTT is not set # CONFIG_FB_UVESA is not set +CONFIG_FB_EFI=y CONFIG_FB_OPENCORES=m # CONFIG_FB_S1D13XXX is not set # CONFIG_FB_NVIDIA is not set @@ -5315,6 +5310,7 @@ CONFIG_RTC_DRV_DS1553=m # CONFIG_RTC_DRV_DS1685_FAMILY is not set CONFIG_RTC_DRV_DS1742=m CONFIG_RTC_DRV_DS2404=m +# CONFIG_RTC_DRV_EFI is not set CONFIG_RTC_DRV_STK17TA8=m # CONFIG_RTC_DRV_M48T86 is not set CONFIG_RTC_DRV_M48T35=m @@ -6048,10 +6044,27 @@ CONFIG_ARM_PSCI_FW=y # CONFIG_ARM_PSCI_CHECKER is not set # CONFIG_ARM_SCPI_PROTOCOL is not set # CONFIG_FIRMWARE_MEMMAP is not set +CONFIG_DMIID=y +# CONFIG_DMI_SYSFS is not set CONFIG_RASPBERRYPI_FIRMWARE=y # CONFIG_FW_CFG_SYSFS is not set CONFIG_HAVE_ARM_SMCCC=y # CONFIG_GOOGLE_FIRMWARE is not set + +# +# EFI (Extensible Firmware Interface) Support +# +CONFIG_EFI_VARS=y +CONFIG_EFI_ESRT=y +CONFIG_EFI_VARS_PSTORE=y +# CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE is not set +CONFIG_EFI_PARAMS_FROM_FDT=y +CONFIG_EFI_RUNTIME_WRAPPERS=y +CONFIG_EFI_ARMSTUB=y +CONFIG_EFI_BOOTLOADER_CONTROL=m +# CONFIG_EFI_CAPSULE_LOADER is not set +# CONFIG_EFI_TEST is not set +# CONFIG_RESET_ATTACK_MITIGATION is not set CONFIG_MESON_SM=y # @@ -6173,6 +6186,7 @@ CONFIG_TMPFS_XATTR=y # CONFIG_HUGETLB_PAGE is not set CONFIG_ARCH_HAS_GIGANTIC_PAGE=y CONFIG_CONFIGFS_FS=m +CONFIG_EFIVAR_FS=m CONFIG_MISC_FILESYSTEMS=y # CONFIG_ORANGEFS_FS is not set # CONFIG_ADFS_FS is not set @@ -6790,6 +6804,7 @@ CONFIG_DDR=y CONFIG_IRQ_POLL=y CONFIG_LIBFDT=y CONFIG_OID_REGISTRY=m +CONFIG_UCS2_STRING=y CONFIG_FONT_SUPPORT=y # CONFIG_FONTS is not set CONFIG_FONT_8x8=y -- 2.17.1

1 0

[PATCH 1/2] File modified : html/cgi-bin/vpnmain.cgi
by jbsky 12 Jul '18

12 Jul '18

Added xauthrsasig option instead of cert in /var/ipfire/vpn/config. By replacing cert with xauth in the 5th place option, the vpn connection is configured to support xauthrsasig, ikev1 is also to be changed manually in the file. --- html/cgi-bin/vpnmain.cgi | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 378acb326..a5c50dbda 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -304,7 +304,7 @@ sub writeipsecfiles { } # Local Cert and Remote Cert (unless auth is DN dn-auth) - if ($lconfighash{$key}[4] eq 'cert') { + if (($lconfighash{$key}[4] eq 'cert')||($lconfighash{$key}[4] eq 'xauthrsasig')) { print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n"; print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn'); } @@ -408,7 +408,12 @@ sub writeipsecfiles { print SECRETS $psk_line; } print CONF "\tauthby=secret\n"; - } else { + } + elsif ($lconfighash{$key}[4] eq 'xauthrsasig') { + print CONF "\tauthby=xauthrsasig\n"; + print CONF "\txauth=server\n"; + } + else { print CONF "\tauthby=rsasig\n"; print CONF "\tleftrsasigkey=%cert\n"; print CONF "\trightrsasigkey=%cert\n"; @@ -2841,7 +2846,7 @@ END print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ") $confighash{$key}[29]</td>"; if ($confighash{$key}[2] eq '%auth-dn') { print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[9]</td>"; - } elsif ($confighash{$key}[4] eq 'cert') { + } elsif (($confighash{$key}[4] eq 'cert')||($confighash{$key}[4] eq 'xauthrsasig')) { print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[2]</td>"; } else { print "<td align='left' $col> </td>"; @@ -2893,7 +2898,7 @@ END } else { print "<td width='2%' $col> </td>"; } - if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/certs/$confighash{$key}[1].p12") { + if ((($confighash{$key}[4] eq 'cert')||($confighash{$key}[4] eq 'xauthrsasig')) && -f "${General::swroot}/certs/$confighash{$key}[1].p12") { print <<END <td align='center' $col> <form method='post' action='$ENV{'SCRIPT_NAME'}'> @@ -2904,7 +2909,7 @@ END </td> END ; - } elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) { + } elsif ((($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn'))||(($confighash{$key}[4] eq 'xauthrsasig') && ($confighash{$key}[2] ne '%auth-dn'))) { print <<END <td align='center' $col> <form method='post' action='$ENV{'SCRIPT_NAME'}'> -- 2.12.2

4 6

Upcoming telephone conference regarding IDS situation in 2.x
by Peter Müller 12 Jul '18

12 Jul '18

Hello *, just for those who are interested: There will be a telephone conference on 20:00 CEST next Monday (16.07.) in conference room 1 regarding the IDS situation in IPFire 2.x . Over time, some bugs have been collected and we need to decide about the next step. On possibility is to keep Snort in 2.x and fix these bugs so we have a clean setup there. The other way Stefan and myself worked out is to switch to Suricata in 2.x (for 3.x, it is already settled, so we have to deal with it sooner or later) and use a completely new IDS CGI. For the latter, Stefan already did some work: https://git.ipfire.org/?p=people/stevee/ipfire-2.x.git;a=shortlog;h=refs/he… In case anybody is interested, please join. @Michael: Raise hand in case room 1 is occupied on this evening. Thanks. :-) Thanks, and Best regards, Peter Müller -- "We don't care. We don't have to. We're the Phone Company."

2 1

[PATCH] OpenVPN: Deleted mtu-disc completely since it has been dropped.
by Erik Kapfer 10 Jul '18

10 Jul '18

Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index f06e7cf..976300f 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -271,7 +271,7 @@ sub writeserverconf { print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n"; #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n"; - # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500. + # Check if we are using mssfix, fragment and set the corretct mtu of 1500. # If we doesn't use one of them, we can use the configured mtu value. if ($sovpnsettings{'MSSFIX'} eq 'on') { print CONF "tun-mtu 1500\n"; } @@ -2183,15 +2183,6 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";} if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} } - if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') || - ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') || - ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) { - if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) { - if ($tunmtu eq '1500' ) { - print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n"; - } - } - } # Check host certificate if X509 is RFC3280 compliant. # If not, old --ns-cert-type directive will be used. # If appropriate key usage extension exists, new --remote-cert-tls directive will be used. @@ -2272,7 +2263,7 @@ else print CLIENTCONF "dev tun\r\n"; print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n"; - # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500 + # Check if we are using fragment, mssfix and set MTU to 1500 # or use configured value. if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) { print CLIENTCONF "tun-mtu 1500\r\n"; } @@ -3378,7 +3369,6 @@ my $complzoactive; my $mssfixactive; my $authactive; my $n2nfragment; -my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]); my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]); my @n2nproto = split(/-/, $n2nproto2[1]); my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]); @@ -3414,7 +3404,6 @@ $n2nremsub[2] =~ s/\n|\r//g; $n2nlocalsub[2] =~ s/\n|\r//g; $n2nfragment[1] =~ s/\n|\r//g; $n2nmgmt[2] =~ s/\n|\r//g; -$n2nmtudisc[1] =~ s/\n|\r//g; $n2ncipher[1] =~ s/\n|\r//g; $n2nauth[1] =~ s/\n|\r//g; chomp ($complzoactive); @@ -3491,7 +3480,6 @@ foreach my $dkey (keys %confighash) { $confighash{$key}[29] = $n2nport[1]; $confighash{$key}[30] = $complzoactive; $confighash{$key}[31] = $n2ntunmtu[1]; - $confighash{$key}[38] = $n2nmtudisc[1]; $confighash{$key}[39] = $n2nauth[1]; $confighash{$key}[40] = $n2ncipher[1]; $confighash{$key}[41] = 'disabled'; @@ -3531,7 +3519,6 @@ foreach my $dkey (keys %confighash) { <tr><td class='boldbase' nowrap='nowrap'>MSSFIX:</td><td>$confighash{$key}[23]</td></tr> <tr><td class='boldbase' nowrap='nowrap'>Fragment:</td><td>$confighash{$key}[24]</td></tr> <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td>$confighash{$key}[31]</td></tr> - <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td><td>$confighash{$key}[38]</td></tr> <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td>$confighash{$key}[22]</td></tr> <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn hmac'}:</td><td>$confighash{$key}[39]</td></tr> <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td><td>$confighash{$key}[40]</td></tr> -- 2.7.4

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2018