Development June 2019

development@lists.ipfire.org

14 participants
77 discussions

[PATCH] suricata: correct rule actions in IPS mode
by Tim FitzGeorge 05 Jun '19

05 Jun '19

In IPS mode rule actions need to be have the action 'drop' for the protection to work, however this is not appropriate for all rules. Modify the generator for oinkmaster-modify-sids.conf to leave rules with the action 'alert' here this is appropriate. Also add a script to be run on update to correct existing downloaded rules. Fixes #12086 Signed-off-by: Tim FitzGeorge <ipfr(a)tfitzgeorge.me.uk> --- config/cfgroot/ids-functions.pl | 44 +++++++++++++-- config/rootfiles/common/configroot | 1 + config/rootfiles/core/133/update.sh | 3 ++ config/suricata/convert-ids-modifysids-file | 84 +++++++++++++++++++++++++++++ html/cgi-bin/ids.cgi | 22 +++++++- lfs/configroot | 1 + 6 files changed, 148 insertions(+), 7 deletions(-) create mode 100644 config/suricata/convert-ids-modifysids-file diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index 88734a3ca..d7f659d69 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -243,7 +243,7 @@ sub downloadruleset { # Load perl module to deal with temporary files. use File::Temp; - # Generate temporay file name, located in "/var/tmp" and with a suffix of ".tar.gz". + # Generate temporary file name, located in "/var/tmp" and with a suffix of ".tar.gz". my $tmp = File::Temp->new( SUFFIX => ".tar.gz", DIR => "/var/tmp/", UNLINK => 0 ); my $tmpfile = $tmp->filename(); @@ -293,6 +293,9 @@ sub downloadruleset { # Overwrite existing rules tarball with the new downloaded one. move("$tmpfile", "$rulestarball"); + # Set correct ownership for the rulesdir and files. + set_ownership("$rulestarball"); + # If we got here, everything worked fine. Return nothing. return; } @@ -726,8 +729,8 @@ sub write_used_rulefiles_file(@) { # ## Function to generate and write the file for modify the ruleset. # -sub write_modify_sids_file($) { - my ($ruleaction) = @_; +sub write_modify_sids_file($$) { + my ($ruleaction,$rulefile) = @_; # Open modify sid's file for writing. open(FILE, ">$modify_sids_file") or die "Could not write to $modify_sids_file. $!\n"; @@ -737,8 +740,39 @@ sub write_modify_sids_file($) { # Check if the traffic only should be monitored. unless($ruleaction eq "alert") { - # Tell oinkmaster to switch all rules from alert to drop. - print FILE "modifysid \* \"alert\" \| \"drop\"\n"; + # Suricata is in IPS mode, which means that the rule actions have to be changed + # from 'alert' to 'drop', however not all rules should be changed. Some rules + # exist purely to set a flowbit which is used to convey other information, such + # as a specific type of file being downloaded, to other rulewhich then check for + # malware in that file. Rules which fall into the first category should stay as + # alert since not all flows of that type contain malware. + + if($rulefile eq 'registered' or $rulefile eq 'subscripted' or $rulefile eq 'community') { + # These types of rulesfiles contain meta-data which gives the action that should + # be used when in IPS mode. Do the following: + # + # 1. Disable all rules and set the action to 'drop' + # 2. Set the action back to 'alert' if the rule contains 'flowbits:noalert;' + # This should give rules not in the policy a reasonable default if the user + # manually enables them. + # 3. Enable rules and set actions according to the meta-data strings. + + my $policy = 'balanced'; # Placeholder to allow policy to be changed. + + print FILE <<END; +modifysid * "^#?(?:alert|drop)" | "#drop" +modifysid * "^#drop(.+flowbits:noalert;)" | "#alert\${1}" +modifysid * "^#(?:alert|drop)(.+policy $policy-ips alert)" | "alert\${1}" +modifysid * "^#(?:alert|drop)(.+policy $policy-ips drop)" | "drop\${1}" +END + } else { + # These rulefiles don't have the metadata, so set rules to 'drop' unless they + # contain the string 'flowbits:noalert;'. + print FILE <<END; +modifysid * "^(#?)(?:alert|drop)" | "\${1}drop" +modifysid * "^(#?)drop(.+flowbits:noalert;)" | "\${1}alert\${2}" +END + } } # Close file handle. diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index a7f27fe55..56b0257bc 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -3,6 +3,7 @@ usr/sbin/convert-outgoingfw usr/sbin/convert-portfw usr/sbin/convert-snort usr/sbin/convert-xtaccess +usr/sbin/convert-ids-modifysids-file usr/sbin/firewall-policy #var/ipfire var/ipfire/addon-lang diff --git a/config/rootfiles/core/133/update.sh b/config/rootfiles/core/133/update.sh index 3b769f42e..c2fe5db04 100644 --- a/config/rootfiles/core/133/update.sh +++ b/config/rootfiles/core/133/update.sh @@ -59,6 +59,9 @@ telinit u # Update Language cache /usr/local/bin/update-lang-cache +# Modify suricata modify-sids file +/usr/sbin/convert-ids-modifysids-file + # Start services /usr/local/bin/ipsecctrl S /etc/init.d/suricata restart diff --git a/config/suricata/convert-ids-modifysids-file b/config/suricata/convert-ids-modifysids-file new file mode 100644 index 000000000..8b70aa0fc --- /dev/null +++ b/config/suricata/convert-ids-modifysids-file @@ -0,0 +1,84 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2019 IPFire Development Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/ids-functions.pl"; + +# Hash which contains the IDS (suricata) settings. +my %idssettings; + +# Hash which contains the RULES settings. +my %rulessettings; + +# +## Step 1: Read IDS and rules settings. +# + +exit unless(-f $IDS::ids_settings_file and -f $IDS::rules_settings_file); + +# Read IDS settings. +&General::readhash("$IDS::ids_settings_file", \%idssettings); + +# Read rules settings. +&General::readhash("$IDS::rules_settings_file", \%rulessettings); + +# +## Step 2: Generate and write the file to modify the ruleset. +# + +my $IDS_action = "drop"; + +# Check if the traffic only should be monitored. +if ($idssettings{"MONITOR_TRAFFIC_ONLY"} eq "on") { + # Switch IDS action to alert only. + $IDS_action = "alert"; +} + +# Call subfunction and pass the desired IDS action. +&IDS::write_modify_sids_file($IDS_action, $rulessettings{RULES}); + +# Set correct ownership. +&IDS::set_ownership("$IDS::modify_sids_file"); + +# +## Step 3: Call oinkmaster to extract and setup the rules structures. +# + +# Check if a rulestarball is present. +if (-f $IDS::rulestarball) { + # Launch oinkmaster by calling the subfunction. + &IDS::oinkmaster(); + + # Set correct ownership for the rulesdir and files. + &IDS::set_ownership("$IDS::rulespath"); +} + +# +## Step 4: Start the IDS if enabled. +# + +# Check if the IDS should be started. +if($idssettings{"ENABLE_IDS"} eq "on") { + # Call suricatactrl and reload the rules. + &IDS::call_suricatactrl("reload"); +} diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 00db6a0c3..1791e9beb 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -359,7 +359,7 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { $errormessage = "$Lang::tr{'could not download latest updates'} - $Lang::tr{'system is offline'}"; } - # Check if enought free disk space is availabe. + # Check if enough free disk space is availabe. if(&IDS::checkdiskspace()) { $errormessage = "$Lang::tr{'not enough disk space'}"; } @@ -370,6 +370,22 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # a new ruleset. &working_notice("$Lang::tr{'ids working'}"); + &General::readhash("$IDS::ids_settings_file", \%idssettings); + + # Temporary variable to set the ruleaction. + # Default is "drop" to use suricata as IPS. + my $ruleaction="drop"; + + # Check if the traffic only should be monitored. + if($idssettings{'MONITOR_TRAFFIC_ONLY'} eq 'on') { + # Switch the ruleaction to "alert". + # Suricata acts as an IDS only. + $ruleaction="alert"; + } + + # Write the modify sid's file and pass the taken ruleaction. + &IDS::write_modify_sids_file($ruleaction, $cgiparams{'RULES'}); + # Call subfunction to download the ruleset. if(&IDS::downloadruleset()) { $errormessage = $Lang::tr{'could not download latest updates'}; @@ -609,8 +625,10 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { $ruleaction="alert"; } + &General::readhash("$IDS::rules_settings_file", \%rulessettings); + # Write the modify sid's file and pass the taken ruleaction. - &IDS::write_modify_sids_file($ruleaction); + &IDS::write_modify_sids_file($ruleaction, $rulessettings{'RULES'}); # Check if "MONITOR_TRAFFIC_ONLY" has been changed. if($cgiparams{'MONITOR_TRAFFIC_ONLY'} ne $oldidssettings{'MONITOR_TRAFFIC_ONLY'}) { diff --git a/lfs/configroot b/lfs/configroot index d4eb545f0..227d09239 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -135,6 +135,7 @@ $(TARGET) : # Install snort to suricata converter. cp $(DIR_SRC)/config/suricata/convert-snort /usr/sbin/convert-snort + cp $(DIR_SRC)/config/suricata/convert-ids-modifysids-file /usr/sbin/convert-ids-modifysids-file # Add conntrack helper default settings for proto in FTP H323 IRC SIP TFTP; do \ -- 2.16.4

3 3

[PATCH] BUG 11487:solve problem with unexspected shutdown
by sfeddersen 05 Jun '19

05 Jun '19

Solve problem with unexspected shutdown problem when checking a single client. --- lfs/wio | 2 +- src/wio/main/wio.pl | 11 +++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/lfs/wio b/lfs/wio index 7098dd9cf..92186efad 100644 --- a/lfs/wio +++ b/lfs/wio @@ -15,7 +15,7 @@ THISAPP = wio-$(VER) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = wio -PAK_VER = 3 +PAK_VER = 4 ############################################################################### # Top-level Rules diff --git a/src/wio/main/wio.pl b/src/wio/main/wio.pl index b846feafa..8e2fb8879 100644 --- a/src/wio/main/wio.pl +++ b/src/wio/main/wio.pl @@ -21,7 +21,7 @@ # # ############################################################################### # -# Version: 2017/08/04 18:55:23 +# Version: 2019/06/04 21:12:23 # # This wio.pl is based on the Code from the IPCop WIO Addon # and is extremly adapted to work with IPFire. @@ -86,9 +86,9 @@ my $redip = $hostname; my $vpnpid = ( -e "/var/run/charon.pid" ? `awk '{print $1}' /var/run/charon.pid`: ''); my $ovpnpid = ( -e "/var/run/openvpn.pid" ? `awk '{print $1}' /var/run/openvpn.pid`: ''); -my $steptime = $wiosettings{'CRON'} *= 60; -my $i_ping = 'icmp'; -my $t_ping = 'tcp'; +my $steptime = $wiosettings{'CRON'} *= 60; +my $i_ping = 'icmp'; +my $t_ping = 'tcp'; my $nr = 1; my $poweroff = 0; @@ -101,7 +101,6 @@ my ( $ping_i, $ping_t, $ping_ib, $ping_tb, $ping_iv, $ping_tv, $pingmode ) = ''; my ( @tmp, @arptmp, @myarray, @status, @arpclients ) = ''; my @ifaces = ('GREEN','BLUE','ORANGE'); - if ( $mailsettings{'USEMAIL'} eq 'on' ) { $mailen = 'on'; } else { $mailen = 'off'; } @@ -299,7 +298,7 @@ if ($debug) { if ( $smailtxt ne '' ) { &WIO::mailsender($Lang::tr{'wio_sub'}, $smailtxt); } -if ($shutdown eq 'on') { +if ($shutdown eq 'on' && ! -e $onoffip) { foreach (@status) { chomp; @tmp = split( /\,/, $_ ); -- 2.17.1

2 1

[PATCH] rrdtool: Update to 1.7.2
by Matthias Fischer 05 Jun '19

05 Jun '19

For details see: https://oss.oetiker.ch/rrdtool/pub/CHANGES Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/rrdtool | 201 ++++++++++++++++---------------- lfs/rrdtool | 4 +- 2 files changed, 101 insertions(+), 104 deletions(-) diff --git a/config/rootfiles/common/rrdtool b/config/rootfiles/common/rrdtool index 9edf10c01..adf230925 100644 --- a/config/rootfiles/common/rrdtool +++ b/config/rootfiles/common/rrdtool @@ -11,7 +11,7 @@ usr/bin/rrdupdate #usr/lib/librrd.la #usr/lib/librrd.so usr/lib/librrd.so.8 -usr/lib/librrd.so.8.2.0 +usr/lib/librrd.so.8.2.1 usr/lib/perl5/site_perl/5.12.3/RRDp.pm usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/RRDs.pm #usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/RRDp @@ -21,107 +21,104 @@ usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/RRDs.pm #usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/RRDs/RRDs.bs usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/RRDs/RRDs.so #usr/lib/pkgconfig/librrd.pc -#usr/share/doc/rrdtool-1.7.1 -#usr/share/doc/rrdtool-1.7.1/html -#usr/share/doc/rrdtool-1.7.1/html/RRDp.html -#usr/share/doc/rrdtool-1.7.1/html/RRDs.html -#usr/share/doc/rrdtool-1.7.1/html/bin_dec_hex.html -#usr/share/doc/rrdtool-1.7.1/html/cdeftutorial.html -#usr/share/doc/rrdtool-1.7.1/html/index.html -#usr/share/doc/rrdtool-1.7.1/html/librrd.html -#usr/share/doc/rrdtool-1.7.1/html/rpntutorial.html -#usr/share/doc/rrdtool-1.7.1/html/rrd-beginners.html -#usr/share/doc/rrdtool-1.7.1/html/rrd_pdpcalc.html -#usr/share/doc/rrdtool-1.7.1/html/rrdbuild.html -#usr/share/doc/rrdtool-1.7.1/html/rrdcached.html -#usr/share/doc/rrdtool-1.7.1/html/rrdcgi.html -#usr/share/doc/rrdtool-1.7.1/html/rrdcreate.html -#usr/share/doc/rrdtool-1.7.1/html/rrddump.html -#usr/share/doc/rrdtool-1.7.1/html/rrdfetch.html -#usr/share/doc/rrdtool-1.7.1/html/rrdfirst.html -#usr/share/doc/rrdtool-1.7.1/html/rrdflushcached.html -#usr/share/doc/rrdtool-1.7.1/html/rrdgraph.html -#usr/share/doc/rrdtool-1.7.1/html/rrdgraph_data.html -#usr/share/doc/rrdtool-1.7.1/html/rrdgraph_examples.html -#usr/share/doc/rrdtool-1.7.1/html/rrdgraph_graph.html -#usr/share/doc/rrdtool-1.7.1/html/rrdgraph_rpn.html -#usr/share/doc/rrdtool-1.7.1/html/rrdinfo.html -#usr/share/doc/rrdtool-1.7.1/html/rrdlast.html -#usr/share/doc/rrdtool-1.7.1/html/rrdlastupdate.html -#usr/share/doc/rrdtool-1.7.1/html/rrdlist.html -#usr/share/doc/rrdtool-1.7.1/html/rrdlua.html -#usr/share/doc/rrdtool-1.7.1/html/rrdresize.html -#usr/share/doc/rrdtool-1.7.1/html/rrdrestore.html -#usr/share/doc/rrdtool-1.7.1/html/rrdthreads.html -#usr/share/doc/rrdtool-1.7.1/html/rrdtool.html -#usr/share/doc/rrdtool-1.7.1/html/rrdtune.html -#usr/share/doc/rrdtool-1.7.1/html/rrdtutorial.html -#usr/share/doc/rrdtool-1.7.1/html/rrdupdate.html -#usr/share/doc/rrdtool-1.7.1/html/rrdxport.html -#usr/share/doc/rrdtool-1.7.1/txt -#usr/share/doc/rrdtool-1.7.1/txt/bin_dec_hex.pod -#usr/share/doc/rrdtool-1.7.1/txt/bin_dec_hex.txt -#usr/share/doc/rrdtool-1.7.1/txt/cdeftutorial.pod -#usr/share/doc/rrdtool-1.7.1/txt/cdeftutorial.txt -#usr/share/doc/rrdtool-1.7.1/txt/librrd.txt -#usr/share/doc/rrdtool-1.7.1/txt/rpntutorial.pod -#usr/share/doc/rrdtool-1.7.1/txt/rpntutorial.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrd-beginners.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrd-beginners.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrd_pdpcalc.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrd_pdpcalc.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdbuild.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdbuild.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdcached.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdcached.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdcgi.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdcgi.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdcreate.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdcreate.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrddump.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrddump.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdfetch.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdfetch.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdfirst.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdfirst.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdflushcached.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdflushcached.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_data.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_data.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_examples.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_examples.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_graph.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_graph.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_rpn.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdgraph_rpn.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdinfo.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdinfo.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdlast.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdlast.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdlastupdate.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdlastupdate.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdlist.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdlist.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdlua.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdlua.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdresize.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdresize.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdrestore.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdrestore.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdthreads.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdthreads.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdtool.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdtool.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdtune.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdtune.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdtutorial.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdtutorial.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdupdate.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdupdate.txt -#usr/share/doc/rrdtool-1.7.1/txt/rrdxport.pod -#usr/share/doc/rrdtool-1.7.1/txt/rrdxport.txt +#usr/share/doc/rrdtool-1.7.2 +#usr/share/doc/rrdtool-1.7.2/html +#usr/share/doc/rrdtool-1.7.2/html/RRDp.html +#usr/share/doc/rrdtool-1.7.2/html/RRDs.html +#usr/share/doc/rrdtool-1.7.2/html/bin_dec_hex.html +#usr/share/doc/rrdtool-1.7.2/html/cdeftutorial.html +#usr/share/doc/rrdtool-1.7.2/html/index.html +#usr/share/doc/rrdtool-1.7.2/html/librrd.html +#usr/share/doc/rrdtool-1.7.2/html/rpntutorial.html +#usr/share/doc/rrdtool-1.7.2/html/rrd-beginners.html +#usr/share/doc/rrdtool-1.7.2/html/rrd_pdpcalc.html +#usr/share/doc/rrdtool-1.7.2/html/rrdbuild.html +#usr/share/doc/rrdtool-1.7.2/html/rrdcached.html +#usr/share/doc/rrdtool-1.7.2/html/rrdcgi.html +#usr/share/doc/rrdtool-1.7.2/html/rrdcreate.html +#usr/share/doc/rrdtool-1.7.2/html/rrddump.html +#usr/share/doc/rrdtool-1.7.2/html/rrdfetch.html +#usr/share/doc/rrdtool-1.7.2/html/rrdfirst.html +#usr/share/doc/rrdtool-1.7.2/html/rrdflushcached.html +#usr/share/doc/rrdtool-1.7.2/html/rrdgraph.html +#usr/share/doc/rrdtool-1.7.2/html/rrdgraph_data.html +#usr/share/doc/rrdtool-1.7.2/html/rrdgraph_examples.html +#usr/share/doc/rrdtool-1.7.2/html/rrdgraph_graph.html +#usr/share/doc/rrdtool-1.7.2/html/rrdgraph_rpn.html +#usr/share/doc/rrdtool-1.7.2/html/rrdinfo.html +#usr/share/doc/rrdtool-1.7.2/html/rrdlast.html +#usr/share/doc/rrdtool-1.7.2/html/rrdlastupdate.html +#usr/share/doc/rrdtool-1.7.2/html/rrdlist.html +#usr/share/doc/rrdtool-1.7.2/html/rrdresize.html +#usr/share/doc/rrdtool-1.7.2/html/rrdrestore.html +#usr/share/doc/rrdtool-1.7.2/html/rrdthreads.html +#usr/share/doc/rrdtool-1.7.2/html/rrdtool.html +#usr/share/doc/rrdtool-1.7.2/html/rrdtune.html +#usr/share/doc/rrdtool-1.7.2/html/rrdtutorial.html +#usr/share/doc/rrdtool-1.7.2/html/rrdupdate.html +#usr/share/doc/rrdtool-1.7.2/html/rrdxport.html +#usr/share/doc/rrdtool-1.7.2/txt +#usr/share/doc/rrdtool-1.7.2/txt/bin_dec_hex.pod +#usr/share/doc/rrdtool-1.7.2/txt/bin_dec_hex.txt +#usr/share/doc/rrdtool-1.7.2/txt/cdeftutorial.pod +#usr/share/doc/rrdtool-1.7.2/txt/cdeftutorial.txt +#usr/share/doc/rrdtool-1.7.2/txt/librrd.txt +#usr/share/doc/rrdtool-1.7.2/txt/rpntutorial.pod +#usr/share/doc/rrdtool-1.7.2/txt/rpntutorial.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrd-beginners.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrd-beginners.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrd_pdpcalc.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrd_pdpcalc.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdbuild.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdbuild.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdcached.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdcached.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdcgi.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdcgi.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdcreate.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdcreate.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrddump.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrddump.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdfetch.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdfetch.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdfirst.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdfirst.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdflushcached.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdflushcached.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_data.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_data.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_examples.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_examples.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_graph.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_graph.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_rpn.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdgraph_rpn.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdinfo.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdinfo.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdlast.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdlast.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdlastupdate.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdlastupdate.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdlist.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdlist.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdresize.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdresize.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdrestore.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdrestore.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdthreads.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdthreads.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdtool.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdtool.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdtune.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdtune.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdtutorial.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdtutorial.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdupdate.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdupdate.txt +#usr/share/doc/rrdtool-1.7.2/txt/rrdxport.pod +#usr/share/doc/rrdtool-1.7.2/txt/rrdxport.txt #usr/share/locale/fr/LC_MESSAGES/rrdtool.mo #usr/share/locale/hu/LC_MESSAGES/rrdtool.mo #usr/share/man/man1/bin_dec_hex.1 diff --git a/lfs/rrdtool b/lfs/rrdtool index 9244bc75a..bbc7f3330 100644 --- a/lfs/rrdtool +++ b/lfs/rrdtool @@ -24,7 +24,7 @@ include Config -VER = 1.7.1 +VER = 1.7.2 THISAPP = rrdtool-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5f6133630324efe82c8dcefab2056818 +$(DL_FILE)_MD5 = 638e3a0a1609d97e9f82e8832759dcd2 install : $(TARGET) -- 2.18.0

2 1

[PATCH] linux-pam: Update to 1.3.1
by Matthias Fischer 05 Jun '19

05 Jun '19

For details see: https://github.com/linux-pam/linux-pam/releases Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/pam | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/lfs/pam b/lfs/pam index 2d7b319e3..d5ce5ef69 100644 --- a/lfs/pam +++ b/lfs/pam @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,10 +24,10 @@ include Config -VER = 1.3.0 +VER = 1.3.1 THISAPP = Linux-PAM-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.xz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 642c994edb9cf39b74cb1bca0649613b +$(DL_FILE)_MD5 = 558ff53b0fc0563ca97f79e911822165 install : $(TARGET) @@ -72,10 +72,12 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) $(UPDATE_AUTOMAKE) cd $(DIR_APP) && ./configure --libdir=/usr/lib \ - --sbindir=/lib/security \ - --enable-securedir=/lib/security \ - --enable-docdir=/usr/share/doc/Linux-PAM-$(VER) \ - --enable-read-both-confs --disable-nls + --sbindir=/lib/security \ + --enable-securedir=/lib/security \ + --enable-docdir=/usr/share/doc/Linux-PAM-$(VER) \ + --enable-read-both-confs \ + --disable-nls + cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install -- 2.18.0

2 1

Optimization for 'monit'
by Matthias Fischer 05 Jun '19

05 Jun '19

Hi, could someone please take a look at the '--enable-optimized'-option in 'monit'-configure: The corresponding code from 'configure' reads: ... # Check whether --enable-optimized was given. if test "${enable_optimized+set}" = set; then : enableval=$enable_optimized; CFLAGS=`echo $CFLAGS|sed 's/-O.//g'` if test "x$enableval" = "xyes" ; then CFLAGS=`echo $CFLAGS|sed 's/-g[^ ]*//g'` CFLAGS=`echo $CFLAGS|sed 's/-O.//g'` CFLAGS="$CFLAGS -O3 -DNDEBUG" OPTIMIZED=1 else OPTIMIZED=0 fi ... Since I'm not so good in 'CFGLAG'-options ( ;-) ), I'd like to know what this option REALLY does and if we should use it - prior to pushing it to GIT. Second option would be '--without-ipv6' since I think we do not really need this in v2.23. Its running here on Core 131 - compiled with these two options and without seen problems - but I just want to be sure. What do you think? Best, Matthias

2 1

For Better or For Worse: Proposed mail infrastructure changes
by Peter Müller 04 Jun '19

04 Jun '19

Hello infrastructure team, hello development list, for various reasons, I would like to propose some changes to the mail infrastructure of ipfire.org . Since some of them will affect MUA settings for people who have a mail account at this domain, I am trying to announce this as broadly as possible. (1) Separate Mailman VM from MX VM Currently, _any_ mail traffic related to the project is handled by mail01.ipfire.org, including the mailing lists. Especially for the latter, it is difficult to determine the origin of a message which is why things like ARC signing are currently not working. This can be solved by moving Mailman to another VM, which should not have any direct user impact at all. Michael agreed to this and prepared some infrastructure - thank you. (2) Use dedicated IMAP/Submission DNS labels for MUAs mail01.ipfire.org is the hardcoded FQDN for sending and receiving mails via a MUA. This has been grown over time, and while there is no need to change something for technical reasons here, separating MUA labels from MX hosts and actual machine FQDNs is BCP. I propose submissions.ipfire.org as FQDN for authenticated mail submission and imaps.ipfire.org as FQDN for IMAP access. (3) RFC 8314 deprecates explicit TLS connections for MUA connections Currently, we use explicit TLS (aka STARTTLS for most protocols) for both submitting and retrieving messages. There are a number of reasons why this is deprecated, primarily being plaintext traffic prior to encryption. I propose to use implicit TLS only on port 465 (submissions) and 993 (IMAPS) and discontinue support for explicit TLS channels, and POP3 in general. (3) Use only AEAD ciphers for authenticated TLS connections As mentioned in a patch the other day, CBC ciphers have some known vulnerabilities and should be avoided. Since we require TLS 1.2 for nearly all TLS services already, enforcing GCM/AEAD ciphers should not break too much. As far as I am concerned, openssl ciphers -v 'ECDHE+AESGCM:ECDHE+CHACHA20:@STRENGTH' provides a set of secure and fast ciphers suitable for modern TLS connections - talking about HTTPS here as well. These are as follows: TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD This cipher policy will be active on the ports mentioned in (3), and hopefully for our websites some day as well. In case any setup is known to break with this change, please let me know. (4) Moving to DMARC reject policy In case ARC signing is sufficiently working after (1), changing our DMARC policy to "reject" makes sense to me. There is little to no legitimate mail traffic from other MXs than mail01.ipfire.org. Mail forwardings are a known exception to this, and since they happen on some other systems, we cannot do anything in favour or against it. (5) postmaster.ipfire.org We have a defined Acceptable Use Policy for both receiving and sending mail without authentication. However, it is not documented for the public, yet, and there have been some questions and/or complaints about it in the past. Setting up a dedicated website containing this policy (probably a read-only wiki page) might help here, but should not have serious technical impact. According to the current state and local knowledge, no other bigger infrastructure changes are necessary in medium terms. If the ones above will be approved, I plan to shut down legacy MUA ports if everybody adjusted his configuration or at the 1st December 2019 (whichever comes first). I will be happy to answer questions or comments. Thanks, and best regards, Peter Müller P.S.: If anyone asks: The subject phrase refers to the comic strip written by Lynn Johnston. :-) -- The road to Hades is easy to travel. -- Bion of Borysthenes

1 0

[PATCH] ovpnmain.cgi: Fixed line break for LZO option
by Erik Kapfer 02 Jun '19

02 Jun '19

It is better readable if everything is in one line. Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index c5eac26a9..439390228 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2736,7 +2736,7 @@ print <<END; </tr> <tr> - <td width='20%'></td> <td width='15%'> </td><td width='20%'> </td><td width='20%'></td><td width='35%'></td> + <td width='20%'></td> <td width='15%'> </td><td width='35%'> </td><td width='20%'></td><td width='35%'></td> </tr> <tr> -- 2.12.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2019