Development February 2020

development@lists.ipfire.org

13 participants
55 discussions

unbound.conf: Do not set defaults explicitly
by Peter Müller 03 Feb '20

03 Feb '20

In order to keep configuration files small and easy to review/audit, omitting defaults makes more sense than configure them explicitly (have changed my mind here). Unbound comes with a good default confiuration, and we should only make changes when they are necessary. In addition, this patch updates the documentation's URL to the current one. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- config/unbound/unbound.conf | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 24822ee67..c78ca1db7 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -2,7 +2,7 @@ # Unbound configuration file for IPFire # # The full documentation is available at: -# https://www.unbound.net/documentation/unbound.conf.html +# https://nlnetlabs.nl/documentation/unbound/unbound.conf/ # server: @@ -10,26 +10,17 @@ server: chroot: "" directory: "/etc/unbound" username: "nobody" - port: 53 - do-ip4: yes do-ip6: no - do-udp: yes - do-tcp: yes - so-reuseport: yes - do-not-query-localhost: yes # System Tuning include: "/etc/unbound/tuning.conf" # Logging Options - verbosity: 1 use-syslog: yes log-time-ascii: yes - log-queries: no # Unbound Statistics statistics-interval: 86400 - statistics-cumulative: yes extended-statistics: yes # Prefetching @@ -42,26 +33,17 @@ server: # Privacy Options hide-identity: yes hide-version: yes - qname-minimisation: yes - minimal-responses: yes # DNSSEC auto-trust-anchor-file: "/var/lib/unbound/root.key" - val-permissive-mode: no - val-clean-additional: yes val-log-level: 1 + log-servfail: yes # Hardening Options - harden-glue: yes - harden-short-bufsize: no harden-large-queries: yes - harden-dnssec-stripped: yes - harden-below-nxdomain: yes harden-referral-path: yes - harden-algo-downgrade: no use-caps-for-id: yes aggressive-nsec: yes - qname-minimisation: yes # TLS tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt -- 2.16.4

2 1

[PATCH] dma: update to 0.12
by Peter Müller 03 Feb '20

03 Feb '20

All of the dma patches in src/patches/ were merged into its upstream repository by now, thus becoming obsolete and deleted by this patch. Cc: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/dma | 9 +- src/patches/dma-0.10-better-authentication.patch | 373 ----------------------- src/patches/dma-0.10-better-tls.patch | 26 -- src/patches/dma-0.11-compile-fixes.patch | 29 -- 4 files changed, 3 insertions(+), 434 deletions(-) delete mode 100644 src/patches/dma-0.10-better-authentication.patch delete mode 100644 src/patches/dma-0.10-better-tls.patch delete mode 100644 src/patches/dma-0.11-compile-fixes.patch diff --git a/lfs/dma b/lfs/dma index 2b89bcc6e..aceb2704e 100644 --- a/lfs/dma +++ b/lfs/dma @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.11 +VER = 0.12 THISAPP = dma-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4090572921fc33be0977f4010881b501 +$(DL_FILE)_MD5 = 58cb2a286995381c92dc557e639622d6 install : $(TARGET) @@ -73,9 +73,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) mkdir -pv /var/ipfire/dma touch /var/ipfire/dma/mail.conf - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.10-better-authentication.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.10-better-tls.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.11-compile-fixes.patch cd $(DIR_APP) && sed -i '/PREFIX/s/usr\/local/usr/g' Makefile cd $(DIR_APP) && sed -i '/CONFDIR/s/etc\/dma/var\/ipfire\/dma/g' Makefile cd $(DIR_APP) && make diff --git a/src/patches/dma-0.10-better-authentication.patch b/src/patches/dma-0.10-better-authentication.patch deleted file mode 100644 index 596168d2a..000000000 --- a/src/patches/dma-0.10-better-authentication.patch +++ /dev/null @@ -1,373 +0,0 @@ -From 1fa7a882dd22d5f619b3645c6597a419034e9b4e Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Mon, 9 Nov 2015 21:52:08 +0000 -Subject: [PATCH] Implement better authentication - -DMA tries to authenticate by simply trying various authentication -mechanisms. This is obviously not conforming to RFC and some mail -providers detect this is spam and reject all emails. - -This patch parses the EHLO response and reads various keywords -from it that can then later in the program be used to jump into -certain code paths. - -Currently this is used to only authenticate with CRAM-MD5 and/or -LOGIN if the server supports one or both of these. The -implementation can be easily be extended though. - -Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ---- - crypto.c | 6 +- - dma.h | 13 +++- - net.c | 219 +++++++++++++++++++++++++++++++++++++++++++++++---------------- - 3 files changed, 181 insertions(+), 57 deletions(-) - -diff --git a/crypto.c b/crypto.c -index 897b55b..8048f20 100644 ---- a/crypto.c -+++ b/crypto.c -@@ -77,7 +77,7 @@ init_cert_file(SSL_CTX *ctx, const char *path) - } - - int --smtp_init_crypto(int fd, int feature) -+smtp_init_crypto(int fd, int feature, struct smtp_features* features) - { - SSL_CTX *ctx = NULL; - #if (OPENSSL_VERSION_NUMBER >= 0x00909000L) -@@ -118,8 +118,7 @@ smtp_init_crypto(int fd, int feature) - /* TLS init phase, disable SSL_write */ - config.features |= NOSSL; - -- send_remote_command(fd, "EHLO %s", hostname()); -- if (read_remote(fd, 0, NULL) == 2) { -+ if (perform_server_greeting(fd, features) == 0) { - send_remote_command(fd, "STARTTLS"); - if (read_remote(fd, 0, NULL) != 2) { - if ((feature & TLS_OPP) == 0) { -@@ -131,6 +130,7 @@ smtp_init_crypto(int fd, int feature) - } - } - } -+ - /* End of TLS init phase, enable SSL_write/read */ - config.features &= ~NOSSL; - } -diff --git a/dma.h b/dma.h -index acf5e44..ee749d8 100644 ---- a/dma.h -+++ b/dma.h -@@ -51,6 +51,7 @@ - #define BUF_SIZE 2048 - #define ERRMSG_SIZE 200 - #define USERNAME_SIZE 50 -+#define EHLO_RESPONSE_SIZE BUF_SIZE - #define MIN_RETRY 300 /* 5 minutes */ - #define MAX_RETRY (3*60*60) /* retry at least every 3 hours */ - #define MAX_TIMEOUT (5*24*60*60) /* give up after 5 days */ -@@ -160,6 +161,15 @@ struct mx_hostentry { - struct sockaddr_storage sa; - }; - -+struct smtp_auth_mechanisms { -+ int cram_md5; -+ int login; -+}; -+ -+struct smtp_features { -+ struct smtp_auth_mechanisms auth; -+ int starttls; -+}; - - /* global variables */ - extern struct aliases aliases; -@@ -187,7 +197,7 @@ void parse_authfile(const char *); - /* crypto.c */ - void hmac_md5(unsigned char *, int, unsigned char *, int, unsigned char *); - int smtp_auth_md5(int, char *, char *); --int smtp_init_crypto(int, int); -+int smtp_init_crypto(int, int, struct smtp_features*); - - /* dns.c */ - int dns_get_mx_list(const char *, int, struct mx_hostentry **, int); -@@ -196,6 +206,7 @@ int dns_get_mx_list(const char *, int, struct mx_hostentry **, int); - char *ssl_errstr(void); - int read_remote(int, int, char *); - ssize_t send_remote_command(int, const char*, ...) __attribute__((__nonnull__(2), __format__ (__printf__, 2, 3))); -+int perform_server_greeting(int, struct smtp_features*); - int deliver_remote(struct qitem *); - - /* base64.c */ -diff --git a/net.c b/net.c -index 26935a8..33ff8f5 100644 ---- a/net.c -+++ b/net.c -@@ -247,64 +247,70 @@ read_remote(int fd, int extbufsize, char *extbuf) - * Handle SMTP authentication - */ - static int --smtp_login(int fd, char *login, char* password) -+smtp_login(int fd, char *login, char* password, const struct smtp_features* features) - { - char *temp; - int len, res = 0; - -- res = smtp_auth_md5(fd, login, password); -- if (res == 0) { -- return (0); -- } else if (res == -2) { -- /* -- * If the return code is -2, then then the login attempt failed, -- * do not try other login mechanisms -- */ -- return (1); -- } -- -- if ((config.features & INSECURE) != 0 || -- (config.features & SECURETRANS) != 0) { -- /* Send AUTH command according to RFC 2554 */ -- send_remote_command(fd, "AUTH LOGIN"); -- if (read_remote(fd, 0, NULL) != 3) { -- syslog(LOG_NOTICE, "remote delivery deferred:" -- " AUTH login not available: %s", -- neterr); -+ // CRAM-MD5 -+ if (features->auth.cram_md5) { -+ res = smtp_auth_md5(fd, login, password); -+ if (res == 0) { -+ return (0); -+ } else if (res == -2) { -+ /* -+ * If the return code is -2, then then the login attempt failed, -+ * do not try other login mechanisms -+ */ - return (1); - } -+ } - -- len = base64_encode(login, strlen(login), &temp); -- if (len < 0) { -+ // LOGIN -+ if (features->auth.login) { -+ if ((config.features & INSECURE) != 0 || -+ (config.features & SECURETRANS) != 0) { -+ /* Send AUTH command according to RFC 2554 */ -+ send_remote_command(fd, "AUTH LOGIN"); -+ if (read_remote(fd, 0, NULL) != 3) { -+ syslog(LOG_NOTICE, "remote delivery deferred:" -+ " AUTH login not available: %s", -+ neterr); -+ return (1); -+ } -+ -+ len = base64_encode(login, strlen(login), &temp); -+ if (len < 0) { - encerr: -- syslog(LOG_ERR, "can not encode auth reply: %m"); -- return (1); -- } -+ syslog(LOG_ERR, "can not encode auth reply: %m"); -+ return (1); -+ } - -- send_remote_command(fd, "%s", temp); -- free(temp); -- res = read_remote(fd, 0, NULL); -- if (res != 3) { -- syslog(LOG_NOTICE, "remote delivery %s: AUTH login failed: %s", -- res == 5 ? "failed" : "deferred", neterr); -- return (res == 5 ? -1 : 1); -- } -+ send_remote_command(fd, "%s", temp); -+ free(temp); -+ res = read_remote(fd, 0, NULL); -+ if (res != 3) { -+ syslog(LOG_NOTICE, "remote delivery %s: AUTH login failed: %s", -+ res == 5 ? "failed" : "deferred", neterr); -+ return (res == 5 ? -1 : 1); -+ } - -- len = base64_encode(password, strlen(password), &temp); -- if (len < 0) -- goto encerr; -- -- send_remote_command(fd, "%s", temp); -- free(temp); -- res = read_remote(fd, 0, NULL); -- if (res != 2) { -- syslog(LOG_NOTICE, "remote delivery %s: Authentication failed: %s", -- res == 5 ? "failed" : "deferred", neterr); -- return (res == 5 ? -1 : 1); -+ len = base64_encode(password, strlen(password), &temp); -+ if (len < 0) -+ goto encerr; -+ -+ send_remote_command(fd, "%s", temp); -+ free(temp); -+ res = read_remote(fd, 0, NULL); -+ if (res != 2) { -+ syslog(LOG_NOTICE, "remote delivery %s: Authentication failed: %s", -+ res == 5 ? "failed" : "deferred", neterr); -+ return (res == 5 ? -1 : 1); -+ } -+ } else { -+ syslog(LOG_WARNING, "non-encrypted SMTP login is disabled in config, so skipping it. "); -+ return (1); - } -- } else { -- syslog(LOG_WARNING, "non-encrypted SMTP login is disabled in config, so skipping it. "); -- return (1); - } - - return (0); -@@ -348,10 +354,115 @@ close_connection(int fd) - close(fd); - } - -+static void parse_auth_line(char* line, struct smtp_auth_mechanisms* auth) { -+ // Skip the auth prefix -+ line += strlen("AUTH "); -+ -+ char* method = strtok(line, " "); -+ while (method) { -+ if (strcmp(method, "CRAM-MD5") == 0) -+ auth->cram_md5 = 1; -+ -+ else if (strcmp(method, "LOGIN") == 0) -+ auth->login = 1; -+ -+ method = strtok(NULL, " "); -+ } -+} -+ -+int perform_server_greeting(int fd, struct smtp_features* features) { -+ /* -+ Send EHLO -+ XXX allow HELO fallback -+ */ -+ send_remote_command(fd, "EHLO %s", hostname()); -+ -+ char buffer[EHLO_RESPONSE_SIZE]; -+ memset(buffer, 0, sizeof(buffer)); -+ -+ int res = read_remote(fd, sizeof(buffer) - 1, buffer); -+ -+ // Got an unexpected response -+ if (res != 2) -+ return -1; -+ -+ // Reset all features -+ memset(features, 0, sizeof(*features)); -+ -+ // Run through the buffer line by line -+ char linebuffer[EHLO_RESPONSE_SIZE]; -+ char* p = buffer; -+ -+ while (*p) { -+ char* line = linebuffer; -+ while (*p && *p != '\n') { -+ *line++ = *p++; -+ } -+ -+ // p should never point to NULL after the loop -+ // above unless we reached the end of the buffer. -+ // In that case we will raise an error. -+ if (!*p) { -+ return -1; -+ } -+ -+ // Otherwise p points to the newline character which -+ // we will skip. -+ p++; -+ -+ // Terminte the string (and remove the carriage-return character) -+ *--line = '\0'; -+ line = linebuffer; -+ -+ // End main loop for empty lines -+ if (*line == '\0') -+ break; -+ -+ // Process the line -+ // - Must start with 250, followed by dash or space -+ // - We won't check for the correct usage of space and dash because -+ // that is already done in read_remote(). -+ if ((strncmp(line, "250-", 4) != 0) && (strncmp(line, "250 ", 4) != 0)) { -+ syslog(LOG_ERR, "Invalid line: %s\n", line); -+ return -1; -+ } -+ -+ // Skip the prefix -+ line += 4; -+ -+ // Check for STARTTLS -+ if (strcmp(line, "STARTTLS") == 0) -+ features->starttls = 1; -+ -+ // Parse authentication mechanisms -+ else if (strncmp(line, "AUTH ", 5) == 0) -+ parse_auth_line(line, &features->auth); -+ } -+ -+ syslog(LOG_DEBUG, "Server greeting successfully completed"); -+ -+ // STARTTLS -+ if (features->starttls) -+ syslog(LOG_DEBUG, " Server supports STARTTLS"); -+ else -+ syslog(LOG_DEBUG, " Server does not support STARTTLS"); -+ -+ // Authentication -+ if (features->auth.cram_md5) { -+ syslog(LOG_DEBUG, " Server supports CRAM-MD5 authentication"); -+ } -+ if (features->auth.login) { -+ syslog(LOG_DEBUG, " Server supports LOGIN authentication"); -+ } -+ -+ return 0; -+} -+ - static int - deliver_to_host(struct qitem *it, struct mx_hostentry *host) - { - struct authuser *a; -+ struct smtp_features features; - char line[1000]; - size_t linelen; - int fd, error = 0, do_auth = 0, res = 0; -@@ -389,7 +500,7 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - } - - if ((config.features & SECURETRANS) != 0) { -- error = smtp_init_crypto(fd, config.features); -+ error = smtp_init_crypto(fd, config.features, &features); - if (error == 0) - syslog(LOG_DEBUG, "SSL initialization successful"); - else -@@ -399,10 +510,12 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - READ_REMOTE_CHECK("connect", 2); - } - -- /* XXX allow HELO fallback */ -- /* XXX record ESMTP keywords */ -- send_remote_command(fd, "EHLO %s", hostname()); -- READ_REMOTE_CHECK("EHLO", 2); -+ // Say EHLO -+ if (perform_server_greeting(fd, &features) != 0) { -+ syslog(LOG_ERR, "Could not perform server greeting at %s [%s]: %s", -+ host->host, host->addr, neterr); -+ return -1; -+ } - - /* - * Use SMTP authentication if the user defined an entry for the remote -@@ -421,7 +534,7 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - * encryption. - */ - syslog(LOG_INFO, "using SMTP authentication for user %s", a->login); -- error = smtp_login(fd, a->login, a->password); -+ error = smtp_login(fd, a->login, a->password, &features); - if (error < 0) { - syslog(LOG_ERR, "remote delivery failed:" - " SMTP login failed: %m"); diff --git a/src/patches/dma-0.10-better-tls.patch b/src/patches/dma-0.10-better-tls.patch deleted file mode 100644 index 8f60fdd04..000000000 --- a/src/patches/dma-0.10-better-tls.patch +++ /dev/null @@ -1,26 +0,0 @@ -commit e94f50bbbe7318eec5b6b165ff73d94bbc9d20b0 -Author: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sun Feb 11 11:05:43 2018 +0000 - - crypto: Don't limit to TLSv1 only - - Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> - -diff --git a/crypto.c b/crypto.c -index 897b55bfdcfc..440c882880b5 100644 ---- a/crypto.c -+++ b/crypto.c -@@ -93,7 +93,12 @@ smtp_init_crypto(int fd, int feature) - SSL_library_init(); - SSL_load_error_strings(); - -- meth = TLSv1_client_method(); -+ // Allow any possible version -+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) -+ meth = TLS_client_method(); -+#else -+ meth = SSLv23_client_method(); -+#endif - - ctx = SSL_CTX_new(meth); - if (ctx == NULL) { diff --git a/src/patches/dma-0.11-compile-fixes.patch b/src/patches/dma-0.11-compile-fixes.patch deleted file mode 100644 index a6e5165c9..000000000 --- a/src/patches/dma-0.11-compile-fixes.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 60cf6f03a4b13ec0e491a282ab5233a1619a7a66 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Tue, 24 Apr 2018 12:30:13 +0100 -Subject: [PATCH] net.c: Include string.h - -Various functions that have been used come from string.h. GCC compiled -dma without this header, but unfortunately the binary segfaulted at random -times. - -Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ---- - net.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net.c b/net.c -index a1cc3e3bfd79..221dda131a23 100644 ---- a/net.c -+++ b/net.c -@@ -53,6 +53,7 @@ - #include <netdb.h> - #include <setjmp.h> - #include <signal.h> -+#include <string.h> - #include <syslog.h> - #include <unistd.h> - --- -2.14.3 - -- 2.16.4

2 1

[PATCH] Tor: update to 0.4.2.6
by Peter Müller 03 Feb '20

03 Feb '20

Please refer to https://blog.torproject.org/new-releases-tor-0426-0418 for release notes. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tor b/lfs/tor index b2a8d5ce0..cbe1a431b 100644 --- a/lfs/tor +++ b/lfs/tor @@ -24,7 +24,7 @@ include Config -VER = 0.4.2.5 +VER = 0.4.2.6 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 45 +PAK_VER = 46 DEPS = "libseccomp" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = ea9e9078ff2e175332f0095c60284458 +$(DL_FILE)_MD5 = 33383c897640e6ea55ab82c80d772ee0 install : $(TARGET) -- 2.16.4

2 1

core 140?
by Paul Simmons 03 Feb '20

03 Feb '20

So, are we skipping 140? The nightly builds are at 141...

2 2

[PATCH] lang: Improvements to French translation
by Michael Tremer 03 Feb '20

03 Feb '20

From: Stéphane Pautrel <stephane.pautrel(a)gmail.com> This patch adds translations for the new DNS part as well as various improvements. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- doc/language_issues.fr | 19 ++--------- doc/language_missings | 19 ----------- langs/fr/cgi-bin/fr.pl | 75 ++++++++++++++++++++++++++---------------- 3 files changed, 49 insertions(+), 64 deletions(-) diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 8e9d7babb..aded71b6a 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -231,6 +231,7 @@ WARNING: translation string unused: dns address deleted WARNING: translation string unused: dns address deleted txt WARNING: translation string unused: dns address done WARNING: translation string unused: dns address recon +WARNING: translation string unused: dns could not add server WARNING: translation string unused: dns desc WARNING: translation string unused: dns error 0 WARNING: translation string unused: dns error 01 @@ -511,6 +512,7 @@ WARNING: translation string unused: noservicename WARNING: translation string unused: notes WARNING: translation string unused: o-no WARNING: translation string unused: o-yes +WARNING: translation string unused: okay WARNING: translation string unused: online help en WARNING: translation string unused: only red WARNING: translation string unused: open to all @@ -810,21 +812,8 @@ WARNING: translation string unused: zoneconf val zoneslave amount error WARNING: untranslated string: Captive ACTIVATE = unknown string WARNING: untranslated string: Captive clients = unknown string WARNING: untranslated string: Scan for Songs = unknown string -WARNING: untranslated string: broken = Broken WARNING: untranslated string: bytes = unknown string WARNING: untranslated string: dns = unknown string -WARNING: untranslated string: dns check servers = Check DNS Servers -WARNING: untranslated string: dns configuration = DNS Configuration -WARNING: untranslated string: dns enable safe-search = Enable Safe Search -WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server -WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time. -WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation -WARNING: untranslated string: dns no address given = No IP Address given. -WARNING: untranslated string: dns no tls hostname given = No TLS hostname given. -WARNING: untranslated string: dns recursor mode = Recursor Mode -WARNING: untranslated string: dns tls hostname = TLS Hostname -WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers -WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries WARNING: untranslated string: fwhost cust geoipgrp = unknown string WARNING: untranslated string: fwhost err hostip = unknown string WARNING: untranslated string: guardian block a host = unknown string @@ -859,13 +848,9 @@ WARNING: untranslated string: guardian service = unknown string WARNING: untranslated string: ike lifetime should be between 1 and 8 hours = unknown string WARNING: untranslated string: info messages = unknown string WARNING: untranslated string: no data = unknown string -WARNING: untranslated string: not validating = Not validating WARNING: untranslated string: pakfire ago = ago. WARNING: untranslated string: route config changed = unknown string WARNING: untranslated string: routing config added = unknown string WARNING: untranslated string: routing config changed = unknown string WARNING: untranslated string: routing table = unknown string -WARNING: untranslated string: standard = Standard -WARNING: untranslated string: strict = Strict WARNING: untranslated string: vpn statistics n2n = unknown string -WARNING: untranslated string: working = Working diff --git a/doc/language_missings b/doc/language_missings index 40724a80b..7b71fa033 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -926,25 +926,6 @@ ############################################################################ # Checking cgi-bin translations for language: fr # ############################################################################ -< broken -< dns check servers -< dns configuration -< dns could not add server -< dns enable safe-search -< dns isp assigned nameserver -< dns isp nameservers and tls not allowed -< dns mode for qname minimisation -< dns no address given -< dns no tls hostname given -< dns recursor mode -< dns tls hostname -< dns use isp assigned nameservers -< dns use protocol for dns queries -< not validating -< okay -< standard -< strict -< working ############################################################################ # Checking cgi-bin translations for language: it # ############################################################################ diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl index 6729cd6c5..ec81e3e36 100644 --- a/langs/fr/cgi-bin/fr.pl +++ b/langs/fr/cgi-bin/fr.pl @@ -256,7 +256,7 @@ 'advproxy banned mac clients' => 'Adresses MAC interdites (une par ligne) ', 'advproxy basic authentication' => 'Autoriser l\'authentification HTTP basique', 'advproxy cache management' => 'Gestion du cache', -'advproxy cache replacement policy' => 'Politique du cache de remplacement ', +'advproxy cache replacement policy' => 'Politique cache de remplacement ', 'advproxy cache-digest' => 'Activer la génération de Cache-Digest ', 'advproxy chgwebpwd ERROR' => 'E R R E U R :', 'advproxy chgwebpwd SUCCESS' => 'S U C C E S :', @@ -320,7 +320,7 @@ 'advproxy errmsg radius server' => 'Adresse IP du serveur RADIUS non valide', 'advproxy errmsg time restriction' => 'Restriction horaire non valide', 'advproxy errmsg wpad invalid ip or mask' => 'WPAD : IP ou sous-réseau invalide pour le sous-réseau IP exclu', -'advproxy error design' => 'Construction des messages erronés ', +'advproxy error design' => 'Construction messages erronés ', 'advproxy error language' => 'Langage des messages erronés ', 'advproxy fake referer' => 'Fausses références soumises aux sites externes ', 'advproxy fake useragent' => 'Faux useragent soumis aux sites externes ', @@ -508,6 +508,7 @@ 'blue access use hint' => 'Vous devez saisir l\'adresse IP ou MAC de votre périphérique. Vous pouvez également saisir les deux', 'blue interface' => 'Interface BLEUE', 'broadcast' => 'Diffusion', +'broken' => 'Rompu', 'broken pipe' => 'Lien rompu', 'buffered memory' => 'Mémoire tampon', 'buffers' => 'tampons', @@ -840,23 +841,36 @@ 'dns address done' => 'Les adresses du serveur DNS vont être sauvegardées.', 'dns address recon' => 'Tentative de reconnexion !', 'dns check failed' => 'La vérification DNS a échouée', +'dns check servers' => 'Vérif. serveurs DNS', +'dns configuration' => 'DNS Configuration DNS', +'dns could not add server' => 'Ne peut ajouter le serveur - Motif :', 'dns desc' => 'Si l\'interface ROUGE0 obtient ses informations d\'adresse IP via le DHCP du fournisseur d\'accès, les adresses du serveur DNS seront définies automatiquement. Sinon, vous pouvez également remplacer les adresses IP du serveur DNS par celles de votre choix.', +'dns enable safe-search' => 'Activer recherche sécurisée', 'dns error 0' => 'L\'adresse IP du premier serveur DNS n\'est pas valide, veuillez revoir votre saisie La saisie de l\'adresse du second serveur DNS est valide.', 'dns error 01' => 'Les adresses IP du premier et du second serveur DNS ne sont pas valides, veuillez revoir vos saisies', 'dns error 1' => 'L\'adresse IP du second serveur DNS n\'est pas valide, veuillez revoir votre saisie La saisie de l\'adresse du premier serveur DNS est valide.', 'dns forward disable dnssec' => 'Désactiver DNSSEC (dangereux)', 'dns forwarding dnssec disabled notice' => '(DNSSEC désactivé)', 'dns header' => 'Assigner les adresses du serveur DNS seulement pour le DHCP sur ROUGE0', +'dns isp assigned nameserver' => 'Serveur DNS attribué par le FAI', +'dns isp nameservers and tls not allowed' => 'Les serveurs DNS et TLS attribués par le FAI ne peuvent pas être utilisés en même temps.', 'dns list' => 'Liste de serveurs DNS publiques gratuits', 'dns menu' => 'Assigner un serveur DNS', +'dns mode for qname minimisation' => 'Minimisation de QNAME', 'dns new 0' => 'Nouvelle adresse IP du premier serveur DNS :', 'dns new 1' => 'Nouvelle adresse IP du second serveur DNS :', +'dns no address given' => 'Aucune adresse IP donnée.', +'dns no tls hostname given' => 'Aucun nom d\'hôte TLS donné.', 'dns proxy server' => 'Serveur proxy DNS', +'dns recursor mode' => 'Exécution en mode récursif.', 'dns saved' => 'Sauvegarde effectuée !', 'dns saved txt' => 'La sauvegarde des deux adresses saisies du serveur DNS a été effectée correctement. Vous devez redémarrer ou vous reconnecter pour que les changements prennent effets !', 'dns server' => 'Serveur DNS', 'dns servers' => 'Serveurs DNS', 'dns title' => 'Nom du domaine système', +'dns tls hostname' => 'Nom d\'hôte TLS', +'dns use isp assigned nameservers' => 'Utiliser des serveurs DNS attribués par le FAI', +'dns use protocol for dns queries' => 'Protocole pour les requêtes DNS', 'dnsforward' => 'Transfert DNS', 'dnsforward add a new entry' => 'Ajouter une nouvelle entrée', 'dnsforward configuration' => 'Configuration de transfert DNS', @@ -865,11 +879,11 @@ 'dnsforward entries' => 'Entrées actuelles', 'dnsforward forward_servers' => 'Nom des serveurs ', 'dnsforward zone' => 'Zone ', -'dnssec aware' => 'DNSSEC avisé', +'dnssec aware' => 'DNSSEC notifié', 'dnssec disabled warning' => 'AVERTISSEMENT : DNSSEC a été désactivé', 'dnssec information' => 'Informations DNSSEC', 'dnssec not supported' => 'DNSSEC non supporté', -'dnssec validating' => 'Validation DNSSEC', +'dnssec validating' => 'DNSSEC validé', 'do not log this port list' => 'Ne pas inscrire cette liste de ports dans le journal (réduit la taille du journal)', 'dod' => 'Connexion à la demande', 'dod for dns' => 'Connexion à la demande pour le DNS :', @@ -1121,7 +1135,7 @@ 'fwdfw change' => 'Mettre à jour', 'fwdfw copy' => 'Copie', 'fwdfw delete' => 'Supprime', -'fwdfw dnat' => 'Destination NAT (Port forwarding)', +'fwdfw dnat' => 'Destination NAT (redirection de port)', 'fwdfw dnat error' => 'Vous devez choisir un seul hôte pour DNAT. Les groupes ou réseaux ne sont pas autorisés.', 'fwdfw dnat extport' => 'Le port externe doit être vide lors de l\'utilisation de règles NAT source.', 'fwdfw dnat nochoice' => 'Veuillez choisir un NAT source ou un NAT de destination dans la section NAT.', @@ -1399,7 +1413,7 @@ 'ids show' => 'Afficher', 'ids working' => 'Les modifications sont en cours d\'application. Veuillez patienter jusqu\'à ce que toutes les opérations soient terminées avec succès...', 'iface' => 'Iface', -'ignore filter' => 'Filtre d\'exclusion ', +'ignore filter' => 'Filtre exclusion ', 'ike encryption' => 'Chiffrement IKE :', 'ike grouptype' => 'Type de groupe IKE :', 'ike integrity' => 'Intégrité IKE :', @@ -1415,7 +1429,7 @@ 'incoming' => 'entrant', 'incoming compression in bytes per second' => 'Compression entrante', 'incoming firewall access' => 'Accès entrant du pare-feu', -'incoming overhead in bytes per second' => 'Incoming Overhead', +'incoming overhead in bytes per second' => 'Surcharge entrante (octets/s)', 'incoming traffic in bytes per second' => 'Trafic entrant', 'incorrect password' => 'Mot de passe incorrect', 'info' => 'Info', @@ -1538,10 +1552,10 @@ 'iptmangles' => 'Table IP Mangle ', 'iptnats' => 'Traduction d\'adresses réseaux table IP ', 'ipts' => 'Tables IP ', -'isdn' => 'ISDN', -'isdn settings' => 'Réglages ISDN supplémentaires :', -'isdn1' => 'ISDN unique', -'isdn2' => 'Double ISDN', +'isdn' => 'RNIS', +'isdn settings' => 'Réglages RNIS supplémentaires :', +'isdn1' => 'RNIS unique', +'isdn2' => 'RNIS double', 'itlb multihit' => 'MultiHit iTLB', 'january' => 'Janvier', 'javascript menu error1' => 'Si les menus déroulants ne fonctionnent pas, désactivez le Javascript sur la', @@ -1561,7 +1575,7 @@ 'last activity' => 'Dernière activité', 'lateprompting' => 'Dernière action', 'lease expires' => 'Bail expiré', -'least preferred' => 'le moins apprécié', +'least preferred' => 'le moins souhaité', 'legend' => 'Légende ', 'length' => 'Longueur', 'lifetime' => 'Durée de vie :', @@ -1729,7 +1743,7 @@ 'monthly volume start day short' => 'Premier jour', 'months' => 'mois', 'more' => 'plus', -'most preferred' => 'le davantage préféré', +'most preferred' => 'le préféré', 'mount' => 'Monter', 'mounted on' => 'Monté en tant que', 'mpfire' => 'Lecteur de médias pour IPFire', @@ -1805,6 +1819,7 @@ 'not present' => 'Absent', 'not running' => 'ne fonctionne pas', 'not set' => 'non fixé', +'not validating' => 'Pas de validation', 'notes' => 'Notes', 'notice' => 'Remarque ', 'november' => 'Novembre', @@ -1822,6 +1837,7 @@ 'october' => 'Octobre', 'off' => 'off', 'ok' => 'Ok', +'okay' => 'Okay', 'older' => 'Plus anciens', 'on' => 'sur', 'one hour' => 'Une heure', @@ -1893,9 +1909,9 @@ 'outgoing firewall reset' => 'Tout réinitialiser', 'outgoing firewall view group' => 'Voir le groupe', 'outgoing firewall warning' => 'Ne pas choisir IP source ou Mac ignore les', -'outgoing overhead in bytes per second' => 'Outgoing Overhead', -'outgoing traffic in bytes per second' => 'Trafic sortant', -'override mtu' => 'Outrepasser le MTU par défaut', +'outgoing overhead in bytes per second' => 'Surcharge en sortie (octets/s)', +'outgoing traffic in bytes per second' => 'Trafic sortant (octets/s)', +'override mtu' => 'Remplacer le MTU par défaut', 'ovpn' => 'OpenVPN', 'ovpn add conf' => 'Configuration additionnelle', 'ovpn con stat' => 'Statistiques de connexions OpenVPN', @@ -2045,7 +2061,7 @@ 'proxy admin password' => 'Mot de passe admnistrateur du cache ', 'proxy cachemgr' => 'Activer le gestionnaire de cache ', 'proxy errmsg filedescriptors' => 'Mauvais montant de fichier descripteurs', -'proxy filedescriptors' => 'Nombre de descripteurs de fichier ', +'proxy filedescriptors' => 'Nombre de descripteurs fichier ', 'proxy log viewer' => 'Rapports de proxy', 'proxy logs' => 'Rapports de proxy', 'proxy no proxy extend' => 'Où spécifier une liste de destination sans transit par le proxy', @@ -2286,6 +2302,7 @@ 'sssystem status' => 'Statut système', 'sstraffic' => 'Trafic réseau', 'sstraffic graphs' => 'Graphiques du trafic', +'standard' => 'Standard', 'standard login script' => 'Script de connexion standard', 'start' => 'Démarrer', 'start address' => 'Adresse de début :', @@ -2300,6 +2317,7 @@ 'stop' => 'Arrêter', 'stop ovpn server' => 'Arrêter serveur OpenVPN', 'stopped' => 'ARRETE', +'strict' => 'Strict', 'subject' => 'Sujet', 'subject test' => 'Email de test', 'subject warn' => 'Attention - Le niveau d\'alerte a été atteint', @@ -2534,7 +2552,7 @@ 'updxlrtr save and restart' => 'Sauvegarder et redémarrer', 'updxlrtr source' => 'Source', 'updxlrtr source checkup' => 'Vérifications des sources', -'updxlrtr source checkup schedule' => 'Fréquence de vérification des sources ', +'updxlrtr source checkup schedule' => 'Fréquence vérification des sources ', 'updxlrtr sources' => 'Sources', 'updxlrtr standard view' => 'Vue standard', 'updxlrtr statistics' => 'Statistiques', @@ -2817,7 +2835,7 @@ 'vpn force mobike' => 'Force utilisation MOBIKE (seulement IKEv2)', 'vpn inactivity timeout' => 'Délai dépassé inactivité', 'vpn incompatible use of defaultroute' => 'hostname=%defaultroute non admis', -'vpn keyexchange' => 'Keyexchange', +'vpn keyexchange' => 'Échange de clés', 'vpn local id' => 'ID Local', 'vpn missing remote id' => 'Vous devez spécifier un nom unique correct (DN) pour cette authentification.', 'vpn mtu invalid' => 'MTU doit être une valeur numérique !', @@ -2866,13 +2884,13 @@ 'wireless configuration' => 'Configuration réseau sans fil', 'wireless network' => 'Réseau wifi', 'wlan client' => 'Client réseau sans fil', -'wlan client advanced settings' => 'Paramètres avancés', +'wlan client advanced settings' => 'Paramètres avancés ', 'wlan client and' => 'et', -'wlan client anonymous identity' => 'Identité anonyme', +'wlan client anonymous identity' => 'Identité anonyme ', 'wlan client auth auto' => 'Auto', 'wlan client auth peap' => 'PEAP', 'wlan client auth ttls' => 'TTLS', -'wlan client authentication settings' => 'Paramètres d\'authentification', +'wlan client authentication settings' => 'Paramètres d\'authentification ', 'wlan client bssid' => 'BSSID', 'wlan client ccmp' => 'CCMP', 'wlan client configuration' => 'Configuration client sans fil', @@ -2882,7 +2900,7 @@ 'wlan client eap phase2 method' => 'Méthode phase 2 EAP', 'wlan client eap state' => 'Statut EAP', 'wlan client edit entry' => 'Modifier la configuration du client sans fil', -'wlan client encryption' => 'Chiffrement', +'wlan client encryption' => 'Chiffrement ', 'wlan client encryption eap' => 'EAP', 'wlan client encryption none' => 'Aucun', 'wlan client encryption wep' => 'WEP', @@ -2890,7 +2908,7 @@ 'wlan client encryption wpa2' => 'WPA2', 'wlan client group cipher' => 'Chiffrer groupe', 'wlan client group key algorithm' => 'GKA', -'wlan client identity' => 'Identité', +'wlan client identity' => 'Identité ', 'wlan client invalid key length' => 'Longueur de clé invalide.', 'wlan client method' => 'Méthode', 'wlan client new entry' => 'Créer une nouvelle configuration de client sans fil', @@ -2898,13 +2916,13 @@ 'wlan client pairwise cipher' => 'Chiffrer par paire', 'wlan client pairwise key algorithm' => 'PKA', 'wlan client pairwise key group key' => 'Clé par paire / clé de groupe', -'wlan client password' => 'Mot de passe', -'wlan client psk' => 'Clé pré-partagée', -'wlan client ssid' => 'SSID', +'wlan client password' => 'Mot de passe ', +'wlan client psk' => 'Clé pré-partagée ', +'wlan client ssid' => 'SSID ', 'wlan client tkip' => 'TKIP', 'wlan client tls cipher' => 'Chiffrer TLS', 'wlan client tls version' => 'Version TLS', -'wlan client wpa mode' => 'Mode WPA', +'wlan client wpa mode' => 'Mode WPA ', 'wlan client wpa mode all' => 'Auto', 'wlan client wpa mode ccmp ccmp' => 'CCMP-CCMP', 'wlan client wpa mode ccmp tkip' => 'CCMP-TKIP', @@ -2941,6 +2959,7 @@ 'wlanap wlan status' => 'Statut WLan', 'wol wakeup' => 'Réveil', 'workgroup' => 'Groupe de travail', +'working' => 'Working', 'written bytes' => 'Octets écrits', 'xtaccess all error' => 'Vous ne pouvez pas donner l\'accès externe à tout ce qui se fait dans le dossier de redirection de port.', 'xtaccess bad transfert' => 'Si vous spécifiez une plage de ports de destination, la plage source doit être identique !', -- 2.20.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2020