Development January 2019

development@lists.ipfire.org

16 participants
57 discussions

[PATCH] tzdata: update to 2018i
by Peter Müller 07 Jan '19

07 Jan '19

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- tzdata/tzdata.nm | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tzdata/tzdata.nm b/tzdata/tzdata.nm index d24bd2237..a9cfbc0a1 100644 --- a/tzdata/tzdata.nm +++ b/tzdata/tzdata.nm @@ -3,16 +3,16 @@ # Copyright (C) - IPFire Development Team <info(a)ipfire.org> # ############################################################################### -tzdata_version = 2018c -tzcode_version = 2018c +tzdata_version = 2018i +tzcode_version = 2018i name = tzdata version = %{tzdata_version} -release = 1 +release = 2 arch = noarch groups = System/Base -url = http://www.iana.org/time-zones +url = https://www.iana.org/time-zones license = Public Domain summary = Timezone data. @@ -21,7 +21,7 @@ description the world. end -source_dl += http://www.iana.org/time-zones/repository/releases/ +source_dl += https://www.iana.org/time-zones/repository/releases/ sources = tzdata%{tzdata_version}.tar.gz tzcode%{tzcode_version}.tar.gz build -- 2.16.4

2 1

[PATCH] kernel: enable IWLWIFI module.
by Arne Fitzenreiter 07 Jan '19

07 Jan '19

IWLWIFI seems disabled by a mistake. Enable it. fixes #11867 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- kernel/config-generic | 14 +++++++++++++- kernel/kernel.nm | 2 +- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/config-generic b/kernel/config-generic index 3c9d9bc..184cd4e 100644 --- a/kernel/config-generic +++ b/kernel/config-generic @@ -2138,7 +2138,19 @@ CONFIG_IWL3945=m # iwl3945 / iwl4965 Debugging Options # # CONFIG_IWLEGACY_DEBUG is not set -# CONFIG_IWLWIFI is not set +CONFIG_IWLWIFI=m +CONFIG_IWLWIFI_LEDS=y +CONFIG_IWLDVM=m +CONFIG_IWLMVM=m +CONFIG_IWLWIFI_OPMODE_MODULAR=y +# CONFIG_IWLWIFI_BCAST_FILTERING is not set +# CONFIG_IWLWIFI_PCIE_RTPM is not set + +# +# Debugging Options +# +# CONFIG_IWLWIFI_DEBUG is not set +CONFIG_IWLWIFI_DEVICE_TRACING=y CONFIG_WLAN_VENDOR_INTERSIL=y CONFIG_HOSTAP=m CONFIG_HOSTAP_FIRMWARE=y diff --git a/kernel/kernel.nm b/kernel/kernel.nm index 2cf7210..4595e62 100644 --- a/kernel/kernel.nm +++ b/kernel/kernel.nm @@ -5,7 +5,7 @@ name = kernel version = 4.20 -release = 11 +release = 12 thisapp = linux-%{version} maintainer = Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> -- 2.6.3

2 1

Forward default "DROP" is not applied to ORANGE traffic?!
by Peter Müller 07 Jan '19

07 Jan '19

Hello list, I recently stumbled across a strange behaviour of IPFire 2.x, which seems to be quite critical in my eyes, but I am not sure whether it is intentional or not. Default settings of IPFire allow traffic from internal networks (GREEN, BLUE, ORANGE) to the internet (RED), as documented here: https://wiki.ipfire.org/configuration/firewall/default-policy For several reasons, no direct internet access is desired on most firewall installations I administer, so setting the "default firewall behaviour" to DROP for both FORWARD and OUTGOING usually is one of the first steps after installation. Speaking about GREEN and BLUE, this seems to work: No direct connection is possible except it has been explicitly allowed. It turns out this setting does not apply to traffic from ORANGE: Even default is set to DROP, and no firewall rules allowing anything are in place, a server located in DMZ is able to reach full internet - every port on every IP in every country. This is not my expectation of "default policy" = DROP after all! Could somebody of the core developers urgently have a look at this, please? Thanks, and best regards, Peter Müller -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

3 7

Re: IPFire meets Suricata - Call for Tester
by Stefan Schantl 06 Jan '19

06 Jan '19

Hello Dirk, thanks for testing and providing your feedback. > Hello Stefan, > > I just downloaded your new image and installed it in a new VM. > Unfortunately I have to report the same problems as Michael had - > downloading of rules doesn’t work. > > Any clue what is the problem ? The problem was introduced, during develoment from Beta 3 to 4. The fix can be found here: https://git.ipfire.org/?p=people/stevee/ipfire-2.x.git;a=commit;h=b749416ad… I'll release a new testing image as soon as possible. In the meantime, simple grab the fixed "ids-functions.pl" from GIT and replace the existing one in "/var/ipfire/". Best regards, -Stefan > > Best regards > Dirk

1 0

[PATCH] snort: Update to 2.9.12
by Matthias Fischer 05 Jan '19

05 Jan '19

For details see: Release notes: https://snort.org/downloads/snort/release_notes_2.9.12.txt Changelog: https://snort.org/downloads/snort/changelog_2.9.12.txt Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/ids.cgi | 4 ++-- lfs/snort | 8 +++++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index eddfc387c..5a3f4c314 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -259,9 +259,9 @@ if ($snortsettings{'OINKCODE'} ne "") { if (!$errormessage) { if ($snortsettings{'RULES'} eq 'subscripted') { - $url=" https://www.snort.org/rules/snortrules-snapshot-29111.tar.gz?oinkcode=$snor…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-29120.tar.gz?oinkcode=$snor…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url=" https://www.snort.org/rules/snortrules-snapshot-29111.tar.gz?oinkcode=$snor…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-29120.tar.gz?oinkcode=$snor…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'community') { $url=" https://www.snort.org/rules/community"; } else { diff --git a/lfs/snort b/lfs/snort index 813c05c14..e7b5a19f7 100644 --- a/lfs/snort +++ b/lfs/snort @@ -24,7 +24,7 @@ include Config -VER = 2.9.11.1 +VER = 2.9.12 THISAPP = snort-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 378e3938b2b5c8e358f942d0ffce18cc +$(DL_FILE)_MD5 = 3a305d9c44bd0319aa50783a60c8947f install : $(TARGET) @@ -75,7 +75,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --sysconfdir=/etc/snort \ --target=i586 \ --enable-linux-smp-stats \ - --enable-gre --enable-mpls \ + --disable-open-appid \ + --enable-gre \ + --enable-mpls \ --enable-targetbased \ --enable-ppm \ --enable-non-ether-decoders \ -- 2.18.0

1 0

[PATCH] tar: Update to 1.31
by Matthias Fischer 04 Jan '19

04 Jan '19

For details see: http://savannah.gnu.org/forum/forum.php?forum_id=9344 "- Fix heap-buffer-overrun with --one-top-level. - Support for zstd compression. - The -K option interacts properly with member names given in the command line. - Fix CVE-2018-20482" Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/tar | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/tar b/lfs/tar index cbab6c2a9..b8cf8b3b2 100644 --- a/lfs/tar +++ b/lfs/tar @@ -24,7 +24,7 @@ include Config -VER = 1.30 +VER = 1.31 THISAPP = tar-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8404e4c1fc5a3000228ab2b8ad674a65 +$(DL_FILE)_MD5 = 77afa35b696c8d760331fa0e12c2fac9 install : $(TARGET) -- 2.18.0

2 1

Monthly Telephone Conference next Monday
by Michael Tremer 04 Jan '19

04 Jan '19

Hello list, I just wanted to remind everyone that we are having our monthly telephone conference on Monday. https://wiki.ipfire.org/devel/telco/2019-01-07 As usual everyone is invited. All you need to know about this is here: https://wiki.ipfire.org/devel/telco/start Have a nice weekend! Best, -Michael

1 0

[PATCH] squid: Update to 4.5
by Matthias Fischer 04 Jan '19

04 Jan '19

For details see: http://www.squid-cache.org/Versions/v4/changesets/ Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 9 +- ...b_exchange_with_a_TLS_cache_peer_307.patch | 91 ------------ ...all_format_formally_to_make_dist_325.patch | 22 --- .../03_The_handshake_logformat_code_331.patch | 132 ------------------ ... squid-4.5-fix-max-file-descriptors.patch} | 4 +- 5 files changed, 5 insertions(+), 253 deletions(-) delete mode 100644 src/patches/squid/01_Fix_netdb_exchange_with_a_TLS_cache_peer_307.patch delete mode 100644 src/patches/squid/02_Maintenance_add_xz_tarball_format_formally_to_make_dist_325.patch delete mode 100644 src/patches/squid/03_The_handshake_logformat_code_331.patch rename src/patches/squid/{squid-4.4-fix-max-file-descriptors.patch => squid-4.5-fix-max-file-descriptors.patch} (92%) diff --git a/lfs/squid b/lfs/squid index aaa2d0b96..6033ab394 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 4.4 +VER = 4.5 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 892504ca9700e1f139a53f84098613bd +$(DL_FILE)_MD5 = 8275da5846f9f2243ad2625e5aef2ee0 install : $(TARGET) @@ -72,10 +72,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/01_Fix_netdb_exchange_with_a_TLS_cache_peer_307.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/02_Maintenance_add_xz_tarball_format_formally_to_make_dist_325.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/03_The_handshake_logformat_code_331.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-4.4-fix-max-file-descriptors.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-4.5-fix-max-file-descriptors.patch cd $(DIR_APP) && autoreconf -vfi cd $(DIR_APP)/libltdl && autoreconf -vfi diff --git a/src/patches/squid/01_Fix_netdb_exchange_with_a_TLS_cache_peer_307.patch b/src/patches/squid/01_Fix_netdb_exchange_with_a_TLS_cache_peer_307.patch deleted file mode 100644 index 09f8961dc..000000000 --- a/src/patches/squid/01_Fix_netdb_exchange_with_a_TLS_cache_peer_307.patch +++ /dev/null @@ -1,91 +0,0 @@ -commit bc54d7a6f7ec510a25966f2f800d3ea874657546 -Author: chi-mf <43963496+chi-mf(a)users.noreply.github.com> -Date: 2018-10-30 04:48:40 +0000 - - Fix netdb exchange with a TLS cache_peer (#307) - - Squid uses http-scheme URLs when sending netdb exchange (and possibly - other) requests to a cache_peer. If a DIRECT path is selected for that - cache_peer URL, then Squid sends a clear text HTTP request to that - cache_peer. If that cache_peer expects a TLS connection, it will reject - that request (with, e.g., error:transaction-end-before-headers), - resulting in an HTTP 503 or 504 netdb fetch error. - - Workaround this by adding an internalRemoteUri() parameter to indicate - whether https or http URL scheme should be used. Netdb fetches from - CachePeer::secure peers now get an https scheme and, hence, a TLS - connection. - -diff --git a/src/icmp/net_db.cc b/src/icmp/net_db.cc -index 0f488de..526093f 100644 ---- a/src/icmp/net_db.cc -+++ b/src/icmp/net_db.cc -@@ -1282,7 +1282,7 @@ netdbExchangeStart(void *data) - #if USE_ICMP - CachePeer *p = (CachePeer *)data; - static const SBuf netDB("netdb"); -- char *uri = internalRemoteUri(p->host, p->http_port, "/squid-internal-dynamic/", netDB); -+ char *uri = internalRemoteUri(p->secure.encryptTransport, p->host, p->http_port, "/squid-internal-dynamic/", netDB); - debugs(38, 3, "Requesting '" << uri << "'"); - const MasterXaction::Pointer mx = new MasterXaction(XactionInitiator::initIcmp); - HttpRequest *req = HttpRequest::FromUrl(uri, mx); -diff --git a/src/internal.cc b/src/internal.cc -index 6ebc7a6..ff7b4d6 100644 ---- a/src/internal.cc -+++ b/src/internal.cc -@@ -82,7 +82,7 @@ internalStaticCheck(const SBuf &urlPath) - * makes internal url with a given host and port (remote internal url) - */ - char * --internalRemoteUri(const char *host, unsigned short port, const char *dir, const SBuf &name) -+internalRemoteUri(bool encrypt, const char *host, unsigned short port, const char *dir, const SBuf &name) - { - static char lc_host[SQUIDHOSTNAMELEN]; - assert(host && !name.isEmpty()); -@@ -115,7 +115,7 @@ internalRemoteUri(const char *host, unsigned short port, const char *dir, const - static MemBuf mb; - - mb.reset(); -- mb.appendf("http://" SQUIDSBUFPH, SQUIDSBUFPRINT(tmp.authority())); -+ mb.appendf("%s://" SQUIDSBUFPH, encrypt ? "https" : "http", SQUIDSBUFPRINT(tmp.authority())); - - if (dir) - mb.append(dir, strlen(dir)); -@@ -132,7 +132,10 @@ internalRemoteUri(const char *host, unsigned short port, const char *dir, const - char * - internalLocalUri(const char *dir, const SBuf &name) - { -- return internalRemoteUri(getMyHostname(), -+ // XXX: getMy*() may return https_port info, but we force http URIs -+ // because we have not checked whether the callers can handle https. -+ const bool secure = false; -+ return internalRemoteUri(secure, getMyHostname(), - getMyPort(), dir, name); - } - -diff --git a/src/internal.h b/src/internal.h -index c91f9ac..13a43a6 100644 ---- a/src/internal.h -+++ b/src/internal.h -@@ -24,7 +24,7 @@ void internalStart(const Comm::ConnectionPointer &clientConn, HttpRequest *, Sto - bool internalCheck(const SBuf &urlPath); - bool internalStaticCheck(const SBuf &urlPath); - char *internalLocalUri(const char *dir, const SBuf &name); --char *internalRemoteUri(const char *, unsigned short, const char *, const SBuf &); -+char *internalRemoteUri(bool, const char *, unsigned short, const char *, const SBuf &); - const char *internalHostname(void); - int internalHostnameIs(const char *); - -diff --git a/src/peer_digest.cc b/src/peer_digest.cc -index 36a8705..f515aaa 100644 ---- a/src/peer_digest.cc -+++ b/src/peer_digest.cc -@@ -323,7 +323,7 @@ peerDigestRequest(PeerDigest * pd) - if (p->digest_url) - url = xstrdup(p->digest_url); - else -- url = xstrdup(internalRemoteUri(p->host, p->http_port, "/squid-internal-periodic/", SBuf(StoreDigestFileName))); -+ url = xstrdup(internalRemoteUri(p->secure.encryptTransport, p->host, p->http_port, "/squid-internal-periodic/", SBuf(StoreDigestFileName))); - debugs(72, 2, url); - - const MasterXaction::Pointer mx = new MasterXaction(XactionInitiator::initCacheDigest); diff --git a/src/patches/squid/02_Maintenance_add_xz_tarball_format_formally_to_make_dist_325.patch b/src/patches/squid/02_Maintenance_add_xz_tarball_format_formally_to_make_dist_325.patch deleted file mode 100644 index 58ceaa034..000000000 --- a/src/patches/squid/02_Maintenance_add_xz_tarball_format_formally_to_make_dist_325.patch +++ /dev/null @@ -1,22 +0,0 @@ -commit 3c23ae8c7431344f8fc50bb5ee8f4b56d08c10a4 -Author: Amos Jeffries <yadij(a)users.noreply.github.com> -Date: 2018-11-11 04:29:58 +0000 - - Maintenance: add .xz tarball format formally to make dist (#325) - - Automake can now handle generating this format itself and the - experiments of providing it for downstream have gone well. - -diff --git a/configure.ac b/configure.ac -index 3f8af6d..f668567 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -10,7 +10,7 @@ AC_PREREQ(2.61) - AC_CONFIG_HEADERS([include/autoconf.h]) - AC_CONFIG_AUX_DIR(cfgaux) - AC_CONFIG_SRCDIR([src/main.cc]) --AM_INIT_AUTOMAKE([tar-ustar nostdinc subdir-objects]) -+AM_INIT_AUTOMAKE([tar-ustar nostdinc subdir-objects dist-xz]) - AC_REVISION($Revision$)dnl - AC_PREFIX_DEFAULT(/usr/local/squid) - AM_MAINTAINER_MODE diff --git a/src/patches/squid/03_The_handshake_logformat_code_331.patch b/src/patches/squid/03_The_handshake_logformat_code_331.patch deleted file mode 100644 index 2ce8bdc4a..000000000 --- a/src/patches/squid/03_The_handshake_logformat_code_331.patch +++ /dev/null @@ -1,132 +0,0 @@ -commit 0022167d80725513d95b38aaebc90086fc0b6938 (tag: refs/tags/M-staged-PR331, refs/remotes/origin/v4) -Author: Christos Tsantilas <christos(a)chtsanti.net> -Date: 2018-11-14 15:17:06 +0000 - - The %>handshake logformat code (#331) - - Logging client "handshake" bytes is useful in at least two contexts: - - * Runtime traffic bypass and bumping/splicing decisions. Identifying - popular clients like Skype for Business (that uses a TLS handshake but - then may not speak TLS) is critical for handling their traffic - correctly. Squid does not have enough ACLs to interrogate most TLS - handshake aspects. Adding more ACLs may still be a good idea, but - initial sketches for SfB handshakes showed rather complex - ACLs/configurations, _and_ no reasonable ACLs would be able to handle - non-TLS handshakes. An external ACL receiving the handshake is in a - much better position to analyze/fingerprint it according to custom - admin needs. - - * A logged handshake can be used to analyze new/unusual traffic or even - trigger security-related alarms. - - The current support is limited to cases where Squid was saving handshake - for other reasons. With enough demand, this initial support can be - extended to all protocols and port configurations. - - This is a Measurement Factory project. - -diff --git a/src/cf.data.pre b/src/cf.data.pre -index fa8af56..a8ca587 100644 ---- a/src/cf.data.pre -+++ b/src/cf.data.pre -@@ -4394,6 +4394,37 @@ DOC_START - <qos Server connection TOS/DSCP value set by Squid - <nfmark Server connection netfilter mark set by Squid - -+ >handshake Raw client handshake -+ Initial client bytes received by Squid on a newly -+ accepted TCP connection or inside a just established -+ CONNECT tunnel. Squid stops accumulating handshake -+ bytes as soon as the handshake parser succeeds or -+ fails (determining whether the client is using the -+ expected protocol). -+ -+ For HTTP clients, the handshake is the request line. -+ For TLS clients, the handshake consists of all TLS -+ records up to and including the TLS record that -+ contains the last byte of the first ClientHello -+ message. For clients using an unsupported protocol, -+ this field contains the bytes received by Squid at the -+ time of the handshake parsing failure. -+ -+ See the on_unsupported_protocol directive for more -+ information on Squid handshake traffic expectations. -+ -+ Current support is limited to these contexts: -+ - http_port connections, but only when the -+ on_unsupported_protocol directive is in use. -+ - https_port connections (and CONNECT tunnels) that -+ are subject to the ssl_bump peek or stare action. -+ -+ To protect binary handshake data, this field is always -+ base64-encoded (RFC 4648 Section 4). If logformat -+ field encoding is configured, that encoding is applied -+ on top of base64. Otherwise, the computed base64 value -+ is recorded as is. -+ - Time related format codes: - - ts Seconds since epoch -diff --git a/src/format/ByteCode.h b/src/format/ByteCode.h -index ad230bb..a6f8fd9 100644 ---- a/src/format/ByteCode.h -+++ b/src/format/ByteCode.h -@@ -46,6 +46,8 @@ typedef enum { - LFT_CLIENT_LOCAL_TOS, - LFT_CLIENT_LOCAL_NFMARK, - -+ LFT_CLIENT_HANDSHAKE, -+ - /* client connection local squid.conf details */ - LFT_LOCAL_LISTENING_IP, - LFT_LOCAL_LISTENING_PORT, -diff --git a/src/format/Format.cc b/src/format/Format.cc -index c1e19b4..8fd6720 100644 ---- a/src/format/Format.cc -+++ b/src/format/Format.cc -@@ -8,6 +8,7 @@ - - #include "squid.h" - #include "AccessLogEntry.h" -+#include "base64.h" - #include "client_side.h" - #include "comm/Connection.h" - #include "err_detail_type.h" -@@ -547,6 +548,24 @@ Format::Format::assemble(MemBuf &mb, const AccessLogEntry::Pointer &al, int logS - } - break; - -+ case LFT_CLIENT_HANDSHAKE: -+ if (al->request && al->request->clientConnectionManager.valid()) { -+ const auto &handshake = al->request->clientConnectionManager->preservedClientData; -+ if (const auto rawLength = handshake.length()) { -+ // add 1 byte to optimize the c_str() conversion below -+ char *buf = sb.rawAppendStart(base64_encode_len(rawLength) + 1); -+ -+ struct base64_encode_ctx ctx; -+ base64_encode_init(&ctx); -+ auto encLength = base64_encode_update(&ctx, buf, rawLength, reinterpret_cast<const uint8_t*>(handshake.rawContent())); -+ encLength += base64_encode_final(&ctx, buf + encLength); -+ -+ sb.rawAppendFinish(buf, encLength); -+ out = sb.c_str(); -+ } -+ } -+ break; -+ - case LFT_TIME_SECONDS_SINCE_EPOCH: - // some platforms store time in 32-bit, some 64-bit... - outoff = static_cast<int64_t>(current_time.tv_sec); -diff --git a/src/format/Token.cc b/src/format/Token.cc -index 186ade5..06c60cf 100644 ---- a/src/format/Token.cc -+++ b/src/format/Token.cc -@@ -141,6 +141,7 @@ static TokenTableEntry TokenTableMisc[] = { - TokenTableEntry("<qos", LFT_SERVER_LOCAL_TOS), - TokenTableEntry(">nfmark", LFT_CLIENT_LOCAL_NFMARK), - TokenTableEntry("<nfmark", LFT_SERVER_LOCAL_NFMARK), -+ TokenTableEntry(">handshake", LFT_CLIENT_HANDSHAKE), - TokenTableEntry("err_code", LFT_SQUID_ERROR ), - TokenTableEntry("err_detail", LFT_SQUID_ERROR_DETAIL ), - TokenTableEntry("note", LFT_NOTE ), diff --git a/src/patches/squid/squid-4.4-fix-max-file-descriptors.patch b/src/patches/squid/squid-4.5-fix-max-file-descriptors.patch similarity index 92% rename from src/patches/squid/squid-4.4-fix-max-file-descriptors.patch rename to src/patches/squid/squid-4.5-fix-max-file-descriptors.patch index 8d1a4e03a..57fd0a6a6 100644 --- a/src/patches/squid/squid-4.4-fix-max-file-descriptors.patch +++ b/src/patches/squid/squid-4.5-fix-max-file-descriptors.patch @@ -1,6 +1,6 @@ --- configure.ac.~ Wed Apr 20 14:26:07 2016 +++ configure.ac Fri Apr 22 17:20:46 2016 -@@ -3156,6 +3156,9 @@ +@@ -3160,6 +3160,9 @@ ;; esac @@ -10,7 +10,7 @@ dnl --with-maxfd present for compatibility with Squid-2. dnl undocumented in ./configure --help to encourage using the Squid-3 directive AC_ARG_WITH(maxfd,, -@@ -3186,8 +3189,6 @@ +@@ -3190,8 +3193,6 @@ esac ]) -- 2.18.0

2 7

[PATCH] fix SSH port description in WebUI again
by Peter Müller 03 Jan '19

03 Jan '19

Fixes #11881. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- langs/de/cgi-bin/de.pl | 2 +- langs/en/cgi-bin/en.pl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 0ca760f52..2f3ed41bc 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -2167,7 +2167,7 @@ 'ssh no active logins' => 'Keine aktiven Benutzeranmeldungen', 'ssh no auth' => 'Sie haben keinerlei Authentifizierungverfahren zugelassen; dies wird Ihre Anmeldung verhindern', 'ssh passwords' => 'Passwortbasierte Authentifizierung zulassen', -'ssh port' => 'SSH-Port auf 222 setzen (Standard ist 22)', +'ssh port' => 'SSH-Port auf Standardport 22 setzen (andernfalls 222)', 'ssh portfw' => 'TCP-Weiterleitung zulassen', 'ssh tempstart15' => 'SSH-Deamon in 15 Minuten beenden', 'ssh tempstart30' => 'SSH-Deamon in 30 Minuten beenden', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 465738b96..258176970 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2205,7 +2205,7 @@ 'ssh no active logins' => 'No active logins', 'ssh no auth' => 'You have not allowed any authentication methods; this will stop you logging in', 'ssh passwords' => 'Allow password based authentication', -'ssh port' => 'SSH port set to 222 (default is 22)', +'ssh port' => 'Set SSH port to default 22 (222 is used otherwise)', 'ssh portfw' => 'Allow TCP forwarding', 'ssh tempstart15' => 'Stop SSH demon in 15 minutes', 'ssh tempstart30' => 'Stop SSH demon in 30 minutes', -- 2.16.4

2 1

[PATCH] database_attribute: Deliver/create index.txt.attr
by Erik Kapfer 03 Jan '19

03 Jan '19

Fixes #11904 Since OpenSSL-1.1.0x the database attribute file for IPSec and OpenVPN wasn´t created while initial PKI generation. OpenVPN delivered an error message but IPSec did crashed within the first attempt. This problem persists also after X509 deletion and new generation. index.txt.attr will now be delivered by the system but also deleted and recreated while setting up a new x509. --- config/ovpn/certs/index.txt.attr | 0 config/rootfiles/common/configroot | 1 + config/rootfiles/common/openvpn | 1 + html/cgi-bin/ovpnmain.cgi | 9 +++++++++ html/cgi-bin/vpnmain.cgi | 9 +++++++++ lfs/configroot | 2 +- 6 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 config/ovpn/certs/index.txt.attr diff --git a/config/ovpn/certs/index.txt.attr b/config/ovpn/certs/index.txt.attr new file mode 100644 index 000000000..e69de29bb diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index c72768165..6f5d2fe2f 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -19,6 +19,7 @@ var/ipfire/captive/settings var/ipfire/captive/voucher_out var/ipfire/certs #var/ipfire/certs/index.txt +var/ipfire/certs/index.txt.attr #var/ipfire/certs/serial var/ipfire/connscheduler #var/ipfire/connscheduler/connscheduler.conf diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index 131d79873..547842db3 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -25,6 +25,7 @@ var/ipfire/ovpn/caconfig var/ipfire/ovpn/ccd #var/ipfire/ovpn/certs var/ipfire/ovpn/certs/index.txt +var/ipfire/ovpn/certs/index.txt.attr var/ipfire/ovpn/certs/serial var/ipfire/ovpn/crls var/ipfire/ovpn/n2nconf diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 976300fc7..4fb234995 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -174,7 +174,12 @@ sub cleanssldatabase print FILE ""; close FILE; } + if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) { + print FILE ""; + close FILE; + } unlink ("${General::swroot}/ovpn/certs/index.txt.old"); + unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old"); unlink ("${General::swroot}/ovpn/certs/serial.old"); unlink ("${General::swroot}/ovpn/certs/01.pem"); } @@ -189,7 +194,11 @@ sub newcleanssldatabase if (! -s ">${General::swroot}/ovpn/certs/index.txt") { system ("touch ${General::swroot}/ovpn/certs/index.txt"); } + if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") { + system ("touch ${General::swroot}/ovpn/certs/index.txt.attr"); + } unlink ("${General::swroot}/ovpn/certs/index.txt.old"); + unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old"); unlink ("${General::swroot}/ovpn/certs/serial.old"); } diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 21fd1f4cd..a5d27c8d8 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -149,7 +149,12 @@ sub cleanssldatabase { print FILE ""; close FILE; } + if (open(FILE, ">${General::swroot}/certs/index.txt.attr")) { + print FILE ""; + close FILE; + } unlink ("${General::swroot}/certs/index.txt.old"); + unlink ("${General::swroot}/certs/index.txt.attr.old"); unlink ("${General::swroot}/certs/serial.old"); unlink ("${General::swroot}/certs/01.pem"); } @@ -162,7 +167,11 @@ sub newcleanssldatabase { if (! -s ">${General::swroot}/certs/index.txt") { system ("touch ${General::swroot}/certs/index.txt"); } + if (! -s ">${General::swroot}/certs/index.txt.attr") { + system ("touch ${General::swroot}/certs/index.txt.attr"); + } unlink ("${General::swroot}/certs/index.txt.old"); + unlink ("${General::swroot}/certs/index.txt.attr.old"); unlink ("${General::swroot}/certs/serial.old"); # unlink ("${General::swroot}/certs/01.pem"); numbering evolves. Wrong place to delete } diff --git a/lfs/configroot b/lfs/configroot index 4701d9e39..c66dcdedb 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -62,7 +62,7 @@ $(TARGET) : # Touch empty files for i in auth/users backup/include.user backup/exclude.user \ - captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt ddns/config ddns/settings ddns/ipcache dhcp/settings \ + captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \ dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \ ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \ fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \ -- 2.12.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2019