Development February 2020

development@lists.ipfire.org

13 participants
55 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

Core Update 142 (testing) report
by Peter Müller 29 Feb '20

29 Feb '20

Hello *, upcoming Core Update 142 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-142-is-available-for-t…) is running here for about 24 hours by now without any unexpected behaviour so far. Suricata 5.0.2 significantly decreased performance penalties when running an IPS, especially when it comes to IPsec N2N traffic encapsulating HTTP(S) content (measured ~ 4 MBit/Sec. before, ~ 11 MBit/Sec. after with some non-deterministic peaks around 20 MBit/Sec.); however, the Emerging Threats folks are currently cleaning up their free ruleset as well, which might have some impact on this, too. Special thanks to Stefan for making this possible! > refcount_t: increment on 0; use-after-free. still happens with Suricata 5, but Michael already blamed something else to be the root cause. ;-) By looking at some tcpdumps, it seems like Unbound is indeed spreading its DNS queries across all configured (DNS over TLS) resolvers - which is a good thing in terms of privacy. :-) Missing TCP connection reuse still causes quite noticeable delays... I can confirm Guardian is now blocking Apache httpd DoS sources again. Enforcing properly signed kernel modules shows up in /var/log/bootlog as follows: > [ 2.673362] Loading compiled-in X.509 certificates > [ 2.679536] Loaded X.509 cert 'IPFire.org: Build time autogenerated kernel key: 059a804f6f2ed46fe68f9b15784d5fa8a62363d4' Possibly related: > [ 9.887006] xt_geoip: loading out-of-tree module taints kernel. Tested IPFire functionalities in detail: - IPsec (N2N connections only) - Squid (authentication enabled, using an upstream proxy) - OpenVPN (RW connections only) - IPS/Suricata (with Emerging Threats ruleset enabled) - Guardian - Quality of Service - DNS (with DNS over TLS) - Tor (relay mode) I look forward to the release of Core Update 142. Thanks, and best regards, Peter Müller

1 0

[PATCH v2] lang: Improvements to French translation
by Michael Tremer 28 Feb '20

28 Feb '20

From: Stéphane Pautrel <stephane.pautrel(a)gmail.com> This patch adds translations for the new DNS part as well as various improvements. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- doc/language_issues.fr | 19 ++--------- doc/language_missings | 19 ----------- langs/fr/cgi-bin/fr.pl | 75 ++++++++++++++++++++++++++---------------- 3 files changed, 49 insertions(+), 64 deletions(-) diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 928c37a46..3edee88df 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -231,6 +231,7 @@ WARNING: translation string unused: dns address deleted WARNING: translation string unused: dns address deleted txt WARNING: translation string unused: dns address done WARNING: translation string unused: dns address recon +WARNING: translation string unused: dns could not add server WARNING: translation string unused: dns desc WARNING: translation string unused: dns error 0 WARNING: translation string unused: dns error 01 @@ -511,6 +512,7 @@ WARNING: translation string unused: noservicename WARNING: translation string unused: notes WARNING: translation string unused: o-no WARNING: translation string unused: o-yes +WARNING: translation string unused: okay WARNING: translation string unused: online help en WARNING: translation string unused: only red WARNING: translation string unused: open to all @@ -810,21 +812,8 @@ WARNING: translation string unused: zoneconf val zoneslave amount error WARNING: untranslated string: Captive ACTIVATE = unknown string WARNING: untranslated string: Captive clients = unknown string WARNING: untranslated string: Scan for Songs = unknown string -WARNING: untranslated string: broken = Broken WARNING: untranslated string: bytes = unknown string WARNING: untranslated string: dns = unknown string -WARNING: untranslated string: dns check servers = Check DNS Servers -WARNING: untranslated string: dns configuration = DNS Configuration -WARNING: untranslated string: dns enable safe-search = Enable Safe Search -WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server -WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time. -WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation -WARNING: untranslated string: dns no address given = No IP Address given. -WARNING: untranslated string: dns no tls hostname given = No TLS hostname given. -WARNING: untranslated string: dns recursor mode = Recursor Mode -WARNING: untranslated string: dns tls hostname = TLS Hostname -WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers -WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries WARNING: untranslated string: fwhost cust geoipgrp = unknown string WARNING: untranslated string: fwhost err hostip = unknown string WARNING: untranslated string: guardian block a host = unknown string @@ -859,7 +848,6 @@ WARNING: untranslated string: guardian service = unknown string WARNING: untranslated string: ike lifetime should be between 1 and 8 hours = unknown string WARNING: untranslated string: info messages = unknown string WARNING: untranslated string: no data = unknown string -WARNING: untranslated string: not validating = Not validating WARNING: untranslated string: pakfire ago = ago. WARNING: untranslated string: pakfire invalid tree = Invalid repository selected WARNING: untranslated string: pakfire tree = Repository @@ -870,7 +858,4 @@ WARNING: untranslated string: route config changed = unknown string WARNING: untranslated string: routing config added = unknown string WARNING: untranslated string: routing config changed = unknown string WARNING: untranslated string: routing table = unknown string -WARNING: untranslated string: standard = Standard -WARNING: untranslated string: strict = Strict WARNING: untranslated string: vpn statistics n2n = unknown string -WARNING: untranslated string: working = Working diff --git a/doc/language_missings b/doc/language_missings index a427f5706..31ea82788 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -936,30 +936,11 @@ ############################################################################ # Checking cgi-bin translations for language: fr # ############################################################################ -< broken -< dns check servers -< dns configuration -< dns could not add server -< dns enable safe-search -< dns isp assigned nameserver -< dns isp nameservers and tls not allowed -< dns mode for qname minimisation -< dns no address given -< dns no tls hostname given -< dns recursor mode -< dns tls hostname -< dns use isp assigned nameservers -< dns use protocol for dns queries -< not validating -< okay < pakfire invalid tree < pakfire tree < pakfire tree stable < pakfire tree testing < pakfire tree unstable -< standard -< strict -< working ############################################################################ # Checking cgi-bin translations for language: it # ############################################################################ diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl index 6729cd6c5..ec81e3e36 100644 --- a/langs/fr/cgi-bin/fr.pl +++ b/langs/fr/cgi-bin/fr.pl @@ -256,7 +256,7 @@ 'advproxy banned mac clients' => 'Adresses MAC interdites (une par ligne) ', 'advproxy basic authentication' => 'Autoriser l\'authentification HTTP basique', 'advproxy cache management' => 'Gestion du cache', -'advproxy cache replacement policy' => 'Politique du cache de remplacement ', +'advproxy cache replacement policy' => 'Politique cache de remplacement ', 'advproxy cache-digest' => 'Activer la génération de Cache-Digest ', 'advproxy chgwebpwd ERROR' => 'E R R E U R :', 'advproxy chgwebpwd SUCCESS' => 'S U C C E S :', @@ -320,7 +320,7 @@ 'advproxy errmsg radius server' => 'Adresse IP du serveur RADIUS non valide', 'advproxy errmsg time restriction' => 'Restriction horaire non valide', 'advproxy errmsg wpad invalid ip or mask' => 'WPAD : IP ou sous-réseau invalide pour le sous-réseau IP exclu', -'advproxy error design' => 'Construction des messages erronés ', +'advproxy error design' => 'Construction messages erronés ', 'advproxy error language' => 'Langage des messages erronés ', 'advproxy fake referer' => 'Fausses références soumises aux sites externes ', 'advproxy fake useragent' => 'Faux useragent soumis aux sites externes ', @@ -508,6 +508,7 @@ 'blue access use hint' => 'Vous devez saisir l\'adresse IP ou MAC de votre périphérique. Vous pouvez également saisir les deux', 'blue interface' => 'Interface BLEUE', 'broadcast' => 'Diffusion', +'broken' => 'Rompu', 'broken pipe' => 'Lien rompu', 'buffered memory' => 'Mémoire tampon', 'buffers' => 'tampons', @@ -840,23 +841,36 @@ 'dns address done' => 'Les adresses du serveur DNS vont être sauvegardées.', 'dns address recon' => 'Tentative de reconnexion !', 'dns check failed' => 'La vérification DNS a échouée', +'dns check servers' => 'Vérif. serveurs DNS', +'dns configuration' => 'DNS Configuration DNS', +'dns could not add server' => 'Ne peut ajouter le serveur - Motif :', 'dns desc' => 'Si l\'interface ROUGE0 obtient ses informations d\'adresse IP via le DHCP du fournisseur d\'accès, les adresses du serveur DNS seront définies automatiquement. Sinon, vous pouvez également remplacer les adresses IP du serveur DNS par celles de votre choix.', +'dns enable safe-search' => 'Activer recherche sécurisée', 'dns error 0' => 'L\'adresse IP du premier serveur DNS n\'est pas valide, veuillez revoir votre saisie La saisie de l\'adresse du second serveur DNS est valide.', 'dns error 01' => 'Les adresses IP du premier et du second serveur DNS ne sont pas valides, veuillez revoir vos saisies', 'dns error 1' => 'L\'adresse IP du second serveur DNS n\'est pas valide, veuillez revoir votre saisie La saisie de l\'adresse du premier serveur DNS est valide.', 'dns forward disable dnssec' => 'Désactiver DNSSEC (dangereux)', 'dns forwarding dnssec disabled notice' => '(DNSSEC désactivé)', 'dns header' => 'Assigner les adresses du serveur DNS seulement pour le DHCP sur ROUGE0', +'dns isp assigned nameserver' => 'Serveur DNS attribué par le FAI', +'dns isp nameservers and tls not allowed' => 'Les serveurs DNS et TLS attribués par le FAI ne peuvent pas être utilisés en même temps.', 'dns list' => 'Liste de serveurs DNS publiques gratuits', 'dns menu' => 'Assigner un serveur DNS', +'dns mode for qname minimisation' => 'Minimisation de QNAME', 'dns new 0' => 'Nouvelle adresse IP du premier serveur DNS :', 'dns new 1' => 'Nouvelle adresse IP du second serveur DNS :', +'dns no address given' => 'Aucune adresse IP donnée.', +'dns no tls hostname given' => 'Aucun nom d\'hôte TLS donné.', 'dns proxy server' => 'Serveur proxy DNS', +'dns recursor mode' => 'Exécution en mode récursif.', 'dns saved' => 'Sauvegarde effectuée !', 'dns saved txt' => 'La sauvegarde des deux adresses saisies du serveur DNS a été effectée correctement. Vous devez redémarrer ou vous reconnecter pour que les changements prennent effets !', 'dns server' => 'Serveur DNS', 'dns servers' => 'Serveurs DNS', 'dns title' => 'Nom du domaine système', +'dns tls hostname' => 'Nom d\'hôte TLS', +'dns use isp assigned nameservers' => 'Utiliser des serveurs DNS attribués par le FAI', +'dns use protocol for dns queries' => 'Protocole pour les requêtes DNS', 'dnsforward' => 'Transfert DNS', 'dnsforward add a new entry' => 'Ajouter une nouvelle entrée', 'dnsforward configuration' => 'Configuration de transfert DNS', @@ -865,11 +879,11 @@ 'dnsforward entries' => 'Entrées actuelles', 'dnsforward forward_servers' => 'Nom des serveurs ', 'dnsforward zone' => 'Zone ', -'dnssec aware' => 'DNSSEC avisé', +'dnssec aware' => 'DNSSEC notifié', 'dnssec disabled warning' => 'AVERTISSEMENT : DNSSEC a été désactivé', 'dnssec information' => 'Informations DNSSEC', 'dnssec not supported' => 'DNSSEC non supporté', -'dnssec validating' => 'Validation DNSSEC', +'dnssec validating' => 'DNSSEC validé', 'do not log this port list' => 'Ne pas inscrire cette liste de ports dans le journal (réduit la taille du journal)', 'dod' => 'Connexion à la demande', 'dod for dns' => 'Connexion à la demande pour le DNS :', @@ -1121,7 +1135,7 @@ 'fwdfw change' => 'Mettre à jour', 'fwdfw copy' => 'Copie', 'fwdfw delete' => 'Supprime', -'fwdfw dnat' => 'Destination NAT (Port forwarding)', +'fwdfw dnat' => 'Destination NAT (redirection de port)', 'fwdfw dnat error' => 'Vous devez choisir un seul hôte pour DNAT. Les groupes ou réseaux ne sont pas autorisés.', 'fwdfw dnat extport' => 'Le port externe doit être vide lors de l\'utilisation de règles NAT source.', 'fwdfw dnat nochoice' => 'Veuillez choisir un NAT source ou un NAT de destination dans la section NAT.', @@ -1399,7 +1413,7 @@ 'ids show' => 'Afficher', 'ids working' => 'Les modifications sont en cours d\'application. Veuillez patienter jusqu\'à ce que toutes les opérations soient terminées avec succès...', 'iface' => 'Iface', -'ignore filter' => 'Filtre d\'exclusion ', +'ignore filter' => 'Filtre exclusion ', 'ike encryption' => 'Chiffrement IKE :', 'ike grouptype' => 'Type de groupe IKE :', 'ike integrity' => 'Intégrité IKE :', @@ -1415,7 +1429,7 @@ 'incoming' => 'entrant', 'incoming compression in bytes per second' => 'Compression entrante', 'incoming firewall access' => 'Accès entrant du pare-feu', -'incoming overhead in bytes per second' => 'Incoming Overhead', +'incoming overhead in bytes per second' => 'Surcharge entrante (octets/s)', 'incoming traffic in bytes per second' => 'Trafic entrant', 'incorrect password' => 'Mot de passe incorrect', 'info' => 'Info', @@ -1538,10 +1552,10 @@ 'iptmangles' => 'Table IP Mangle ', 'iptnats' => 'Traduction d\'adresses réseaux table IP ', 'ipts' => 'Tables IP ', -'isdn' => 'ISDN', -'isdn settings' => 'Réglages ISDN supplémentaires :', -'isdn1' => 'ISDN unique', -'isdn2' => 'Double ISDN', +'isdn' => 'RNIS', +'isdn settings' => 'Réglages RNIS supplémentaires :', +'isdn1' => 'RNIS unique', +'isdn2' => 'RNIS double', 'itlb multihit' => 'MultiHit iTLB', 'january' => 'Janvier', 'javascript menu error1' => 'Si les menus déroulants ne fonctionnent pas, désactivez le Javascript sur la', @@ -1561,7 +1575,7 @@ 'last activity' => 'Dernière activité', 'lateprompting' => 'Dernière action', 'lease expires' => 'Bail expiré', -'least preferred' => 'le moins apprécié', +'least preferred' => 'le moins souhaité', 'legend' => 'Légende ', 'length' => 'Longueur', 'lifetime' => 'Durée de vie :', @@ -1729,7 +1743,7 @@ 'monthly volume start day short' => 'Premier jour', 'months' => 'mois', 'more' => 'plus', -'most preferred' => 'le davantage préféré', +'most preferred' => 'le préféré', 'mount' => 'Monter', 'mounted on' => 'Monté en tant que', 'mpfire' => 'Lecteur de médias pour IPFire', @@ -1805,6 +1819,7 @@ 'not present' => 'Absent', 'not running' => 'ne fonctionne pas', 'not set' => 'non fixé', +'not validating' => 'Pas de validation', 'notes' => 'Notes', 'notice' => 'Remarque ', 'november' => 'Novembre', @@ -1822,6 +1837,7 @@ 'october' => 'Octobre', 'off' => 'off', 'ok' => 'Ok', +'okay' => 'Okay', 'older' => 'Plus anciens', 'on' => 'sur', 'one hour' => 'Une heure', @@ -1893,9 +1909,9 @@ 'outgoing firewall reset' => 'Tout réinitialiser', 'outgoing firewall view group' => 'Voir le groupe', 'outgoing firewall warning' => 'Ne pas choisir IP source ou Mac ignore les', -'outgoing overhead in bytes per second' => 'Outgoing Overhead', -'outgoing traffic in bytes per second' => 'Trafic sortant', -'override mtu' => 'Outrepasser le MTU par défaut', +'outgoing overhead in bytes per second' => 'Surcharge en sortie (octets/s)', +'outgoing traffic in bytes per second' => 'Trafic sortant (octets/s)', +'override mtu' => 'Remplacer le MTU par défaut', 'ovpn' => 'OpenVPN', 'ovpn add conf' => 'Configuration additionnelle', 'ovpn con stat' => 'Statistiques de connexions OpenVPN', @@ -2045,7 +2061,7 @@ 'proxy admin password' => 'Mot de passe admnistrateur du cache ', 'proxy cachemgr' => 'Activer le gestionnaire de cache ', 'proxy errmsg filedescriptors' => 'Mauvais montant de fichier descripteurs', -'proxy filedescriptors' => 'Nombre de descripteurs de fichier ', +'proxy filedescriptors' => 'Nombre de descripteurs fichier ', 'proxy log viewer' => 'Rapports de proxy', 'proxy logs' => 'Rapports de proxy', 'proxy no proxy extend' => 'Où spécifier une liste de destination sans transit par le proxy', @@ -2286,6 +2302,7 @@ 'sssystem status' => 'Statut système', 'sstraffic' => 'Trafic réseau', 'sstraffic graphs' => 'Graphiques du trafic', +'standard' => 'Standard', 'standard login script' => 'Script de connexion standard', 'start' => 'Démarrer', 'start address' => 'Adresse de début :', @@ -2300,6 +2317,7 @@ 'stop' => 'Arrêter', 'stop ovpn server' => 'Arrêter serveur OpenVPN', 'stopped' => 'ARRETE', +'strict' => 'Strict', 'subject' => 'Sujet', 'subject test' => 'Email de test', 'subject warn' => 'Attention - Le niveau d\'alerte a été atteint', @@ -2534,7 +2552,7 @@ 'updxlrtr save and restart' => 'Sauvegarder et redémarrer', 'updxlrtr source' => 'Source', 'updxlrtr source checkup' => 'Vérifications des sources', -'updxlrtr source checkup schedule' => 'Fréquence de vérification des sources ', +'updxlrtr source checkup schedule' => 'Fréquence vérification des sources ', 'updxlrtr sources' => 'Sources', 'updxlrtr standard view' => 'Vue standard', 'updxlrtr statistics' => 'Statistiques', @@ -2817,7 +2835,7 @@ 'vpn force mobike' => 'Force utilisation MOBIKE (seulement IKEv2)', 'vpn inactivity timeout' => 'Délai dépassé inactivité', 'vpn incompatible use of defaultroute' => 'hostname=%defaultroute non admis', -'vpn keyexchange' => 'Keyexchange', +'vpn keyexchange' => 'Échange de clés', 'vpn local id' => 'ID Local', 'vpn missing remote id' => 'Vous devez spécifier un nom unique correct (DN) pour cette authentification.', 'vpn mtu invalid' => 'MTU doit être une valeur numérique !', @@ -2866,13 +2884,13 @@ 'wireless configuration' => 'Configuration réseau sans fil', 'wireless network' => 'Réseau wifi', 'wlan client' => 'Client réseau sans fil', -'wlan client advanced settings' => 'Paramètres avancés', +'wlan client advanced settings' => 'Paramètres avancés ', 'wlan client and' => 'et', -'wlan client anonymous identity' => 'Identité anonyme', +'wlan client anonymous identity' => 'Identité anonyme ', 'wlan client auth auto' => 'Auto', 'wlan client auth peap' => 'PEAP', 'wlan client auth ttls' => 'TTLS', -'wlan client authentication settings' => 'Paramètres d\'authentification', +'wlan client authentication settings' => 'Paramètres d\'authentification ', 'wlan client bssid' => 'BSSID', 'wlan client ccmp' => 'CCMP', 'wlan client configuration' => 'Configuration client sans fil', @@ -2882,7 +2900,7 @@ 'wlan client eap phase2 method' => 'Méthode phase 2 EAP', 'wlan client eap state' => 'Statut EAP', 'wlan client edit entry' => 'Modifier la configuration du client sans fil', -'wlan client encryption' => 'Chiffrement', +'wlan client encryption' => 'Chiffrement ', 'wlan client encryption eap' => 'EAP', 'wlan client encryption none' => 'Aucun', 'wlan client encryption wep' => 'WEP', @@ -2890,7 +2908,7 @@ 'wlan client encryption wpa2' => 'WPA2', 'wlan client group cipher' => 'Chiffrer groupe', 'wlan client group key algorithm' => 'GKA', -'wlan client identity' => 'Identité', +'wlan client identity' => 'Identité ', 'wlan client invalid key length' => 'Longueur de clé invalide.', 'wlan client method' => 'Méthode', 'wlan client new entry' => 'Créer une nouvelle configuration de client sans fil', @@ -2898,13 +2916,13 @@ 'wlan client pairwise cipher' => 'Chiffrer par paire', 'wlan client pairwise key algorithm' => 'PKA', 'wlan client pairwise key group key' => 'Clé par paire / clé de groupe', -'wlan client password' => 'Mot de passe', -'wlan client psk' => 'Clé pré-partagée', -'wlan client ssid' => 'SSID', +'wlan client password' => 'Mot de passe ', +'wlan client psk' => 'Clé pré-partagée ', +'wlan client ssid' => 'SSID ', 'wlan client tkip' => 'TKIP', 'wlan client tls cipher' => 'Chiffrer TLS', 'wlan client tls version' => 'Version TLS', -'wlan client wpa mode' => 'Mode WPA', +'wlan client wpa mode' => 'Mode WPA ', 'wlan client wpa mode all' => 'Auto', 'wlan client wpa mode ccmp ccmp' => 'CCMP-CCMP', 'wlan client wpa mode ccmp tkip' => 'CCMP-TKIP', @@ -2941,6 +2959,7 @@ 'wlanap wlan status' => 'Statut WLan', 'wol wakeup' => 'Réveil', 'workgroup' => 'Groupe de travail', +'working' => 'Working', 'written bytes' => 'Octets écrits', 'xtaccess all error' => 'Vous ne pouvez pas donner l\'accès externe à tout ce qui se fait dans le dossier de redirection de port.', 'xtaccess bad transfert' => 'Si vous spécifiez une plage de ports de destination, la plage source doit être identique !', -- 2.20.1

1 0

[PATCH] kmod: Update to 26
by Michael Tremer 27 Feb '20

27 Feb '20

This patch links kmod against OpenSSL which is required to decode the kernel modules' PKCS#7 signatures. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/common/kmod | 2 +- lfs/kmod | 5 +++-- make.sh | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/kmod b/config/rootfiles/common/kmod index 4c9b448f7..ff9cda26d 100644 --- a/config/rootfiles/common/kmod +++ b/config/rootfiles/common/kmod @@ -9,6 +9,6 @@ sbin/rmmod #usr/lib/libkmod.la #usr/lib/libkmod.so usr/lib/libkmod.so.2 -usr/lib/libkmod.so.2.3.3 +usr/lib/libkmod.so.2.3.4 #usr/lib/pkgconfig/libkmod.pc #usr/share/bash-completion/completions/kmod diff --git a/lfs/kmod b/lfs/kmod index 4ef2088fd..39e350c02 100644 --- a/lfs/kmod +++ b/lfs/kmod @@ -24,7 +24,7 @@ include Config -VER = 25 +VER = 26 THISAPP = kmod-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 34f325cab568f842fdde4f8b2182f220 +$(DL_FILE)_MD5 = 1129c243199bdd7db01b55a61aa19601 install : $(TARGET) @@ -75,6 +75,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --bindir=/bin \ --sysconfdir=/etc \ --disable-manpages \ + --with-openssl \ --with-xz \ --with-zlib diff --git a/make.sh b/make.sh index 07c0f52c2..b434e7188 100755 --- a/make.sh +++ b/make.sh @@ -1111,7 +1111,6 @@ buildbase() { lfsmake2 pkg-config lfsmake2 make lfsmake2 man - lfsmake2 kmod lfsmake2 net-tools lfsmake2 patch lfsmake2 psmisc @@ -1133,6 +1132,7 @@ buildipfire() { lfsmake2 backup lfsmake2 openssl [ "${BUILD_ARCH}" = "i586" ] && lfsmake2 openssl KCFG='-sse2' + lfsmake2 kmod lfsmake2 popt lfsmake2 libedit lfsmake2 libusb -- 2.20.1

1 0

[PATCH] pakfire: Re-install previous core update when in testing mode
by Michael Tremer 24 Feb '20

24 Feb '20

From: Arne Fitzenreiter <arne_f(a)ipfire.org> Fixes: #12302 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> Tested-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/pakfire/lib/functions.pl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index ddb1e9aad..45e3427b1 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -768,6 +768,12 @@ sub upgradecore { getcoredb("noforce"); eval(`grep "core_" $Conf::dbdir/lists/core-list.db`); if ("$core_release" > "$Conf::core_mine") { + # Safety check for lazy testers: + # Before we upgrade to the latest release, we re-install the previous release + # to make sure that the tester has always been on the latest version. + my $tree = &get_tree(); + $Conf::core_mine-- if ($tree eq "testing" || $tree eq "unstable"); + message("CORE UPGR: Upgrading from release $Conf::core_mine to $core_release"); my @seq = `seq $Conf::core_mine $core_release`; -- 2.20.1

2 1

[PATCH] haproxy: fix unexpected argument
by Yu Lung Shao 24 Feb '20

24 Feb '20

-- Yu-Lung Shao 邵玉龍 http://blog.bestlong.idv.tw http://www.bestlong.idv.tw

2 1

[PATCH] fireinfo.cgi: Use pakfire lib to gather the pakfire version.
by Stefan Schantl 23 Feb '20

23 Feb '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/fireinfo.cgi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/fireinfo.cgi b/html/cgi-bin/fireinfo.cgi index 08fee3d8a..967e250c7 100644 --- a/html/cgi-bin/fireinfo.cgi +++ b/html/cgi-bin/fireinfo.cgi @@ -28,6 +28,7 @@ use CGI::Carp 'fatalsToBrowser'; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require '/opt/pakfire/lib/functions.pl'; my $configfile = "/var/ipfire/main/send_profile"; @@ -84,7 +85,7 @@ if ($errormessage) { } my $ipfire_version = `cat /etc/system-release`; -my $pakfire_version = `cat /opt/pakfire/etc/pakfire.conf | grep "version =" | cut -d\\" -f2`; +my $pakfire_version = &Pakfire::make_version(); my $kernel_version = `uname -a`; &Header::openbox('100%', 'left', $Lang::tr{'fireinfo system version'}); -- 2.25.0

1 0

[PATCH] rules.pl: Fix SNAT over VPN.
by Stefan Schantl 23 Feb '20

23 Feb '20

This commit adds flags which will are applied if SNAT should be used on the red address or any configured alias. They prevent doing the SNAT when tranismitting packet through a VPN over the red interface. Fixes #12162. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/firewall/rules.pl | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index 86db47367..6129af861 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -479,16 +479,31 @@ sub buildrules { # Source NAT } elsif ($NAT_MODE eq "SNAT") { + my @snat_options = ( "-m", "policy", "--dir", "out", "--pol", "none" ); my @nat_options = @options; + # Get addresses for the configured firewall interfaces. + my @local_addresses = &fwlib::get_internal_firewall_ip_addresses(1); + + # Check if the nat_address is one of the local addresses. + foreach my $local_address (@local_addresses) { + if ($nat_address eq $local_address) { + # Clear SNAT options. + @snat_options = (); + + # Finish loop. + last; + } + } + push(@nat_options, @destination_intf_options); push(@nat_options, @source_options); push(@nat_options, @destination_options); if ($LOG) { - run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @log_limit_options -j LOG --log-prefix 'SNAT '"); + run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @snat_options @log_limit_options -j LOG --log-prefix 'SNAT '"); } - run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j SNAT --to-source $nat_address"); + run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @snat_options -j SNAT --to-source $nat_address"); } } -- 2.25.0

2 1

[PATCH] bind: Update to 9.11.16
by Matthias Fischer 23 Feb '20

23 Feb '20

For details see: https://downloads.isc.org/isc/bind9/9.11.16/RELEASE-NOTES-bind-9.11.16.html "Bug Fixes Notes for BIND 9.11.16 named crashed when it was queried for a nonexistent name in the CHAOS class. [GL #1540] Notes for BIND 9.11.15 Bug Fixes Fixed a GeoIP2 lookup bug which was triggered when certain libmaxminddb versions were used. [GL #1552] Fixed several possible race conditions discovered by ThreadSanitizer. Notes for BIND 9.11.14 Bug Fixes Fixed a bug that caused named to leak memory on reconfiguration when any GeoIP2 database was in use. [GL #1445] Fixed several possible race conditions discovered by ThreadSanitizer." P.S.: Perhaps another chance for armv5tel? Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 10 +++++----- lfs/bind | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index e5435bd02..dd0293db7 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -271,12 +271,12 @@ usr/lib/libbind9.so.161 usr/lib/libbind9.so.161.0.4 #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libdns.so.1107 -usr/lib/libdns.so.1107.1.1 +usr/lib/libdns.so.1109 +usr/lib/libdns.so.1109.0.1 #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisc.so.1104 -usr/lib/libisc.so.1104.0.1 +usr/lib/libisc.so.1105 +usr/lib/libisc.so.1105.0.0 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 @@ -284,7 +284,7 @@ usr/lib/libisccc.so.161.0.1 #usr/lib/libisccfg.la #usr/lib/libisccfg.so usr/lib/libisccfg.so.163 -usr/lib/libisccfg.so.163.0.4 +usr/lib/libisccfg.so.163.0.5 #usr/lib/liblwres.la #usr/lib/liblwres.so usr/lib/liblwres.so.161 diff --git a/lfs/bind b/lfs/bind index 249328843..56bf8b4fd 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.14 +VER = 9.11.16 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5aa75bcb6cdad102f151cae4a53f117f +$(DL_FILE)_MD5 = e5a0fea6c636a9b8f350e6f9e3ecabc3 install : $(TARGET) -- 2.18.0

2 1

[PATCH] unbound: Update to 1.10.0
by Matthias Fischer 23 Feb '20

23 Feb '20

For details see: https://lists.nlnetlabs.nl/pipermail/unbound-users/2020-February/006711.html Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 3569a4170..945b08507 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.6 +usr/lib/libunbound.so.8.1.7 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 50ce9952c..14c1bca5b 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ include Config -VER = 1.9.6 +VER = 1.10.0 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e6423d68e293ffec953477ef1adbbfb7 +$(DL_FILE)_MD5 = 0754392baee77c18fd8295b5e51e6fd8 install : $(TARGET) -- 2.18.0

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2020