Development April 2020

development@lists.ipfire.org

12 participants
133 discussions

[PATCH] kernel: enable page poisoning on x86_64
by Peter Müller 14 Apr '20

14 Apr '20

This is already active on i586 and prevents information leaks from freed data. Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.x86_64-ipfire | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index b16d13504..f6819859d 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -6387,7 +6387,9 @@ CONFIG_DEBUG_KERNEL=y # # CONFIG_PAGE_EXTENSION is not set # CONFIG_DEBUG_PAGEALLOC is not set -# CONFIG_PAGE_POISONING is not set +CONFIG_PAGE_POISONING=y +# CONFIG_PAGE_POISONING_NO_SANITY is not set +CONFIG_PAGE_POISONING_ZERO=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set # CONFIG_DEBUG_OBJECTS is not set -- 2.16.4

2 4

[PATCH] toolchain: Do not attempt to strip anything in /dev, /proc, /sys and /tmp
by Michael Tremer 14 Apr '20

14 Apr '20

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/strip | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/lfs/strip b/lfs/strip index 08aaee7c4..3d0ede8bd 100644 --- a/lfs/strip +++ b/lfs/strip @@ -59,6 +59,14 @@ $(TARGET) : # Don't strip VDR binaries, because they use a weird plugin system # which does not work when unneeded symbols get stripped from # /usr/sbin/vdr. - STRIP=$(STRIP) $(SHELL) $(DIR_SRC)/src/stripper $(ROOT) \ - --exclude=/usr/src --exclude=$(TOOLS_DIR) \ - --exclude=/usr/sbin/vdr --exclude=/usr/lib/vdr + STRIP=$(STRIP) $(SHELL) $(DIR_SRC)/src/stripper \ + $(ROOT) \ + --exclude=$(TOOLS_DIR) \ + --exclude=/dev \ + --exclude=/proc \ + --exclude=/sys \ + --exclude=/tmp \ + --exclude=/usr/src \ + --exclude=/usr/lib/vdr \ + --exclude=/usr/sbin/vdr \ + --exclude=/var/tmp -- 2.20.1

1 0

Fwd: Forthcoming OpenSSL Release
by Michael Tremer 14 Apr '20

14 Apr '20

Happy Easter, boys! > Begin forwarded message: > > From: Matt Caswell <matt(a)openssl.org> > Subject: Forthcoming OpenSSL Release > Date: 14 April 2020 at 14:23:40 BST > To: openssl-announce(a)openssl.org, "openssl-users(a)openssl.org" <openssl-users(a)openssl.org>, "openssl-project(a)openssl.org" <openssl-project(a)openssl.org> > Reply-To: openssl-users(a)openssl.org > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > The OpenSSL project team would like to announce the forthcoming release > of OpenSSL version 1.1.1g. > > This release will be made available on Tuesday 21st April 2020 between > 1300-1700 UTC. > > OpenSSL 1.1.g is a security-fix release. The highest severity issue > fixed in this release is HIGH: > https://www.openssl.org/policies/secpolicy.html#high > > Yours > > The OpenSSL Project Team > -----BEGIN PGP SIGNATURE----- > > iQEzBAEBCAAdFiEEhlersmDwVrHlGQg52cTSbQ5gRJEFAl6VuVwACgkQ2cTSbQ5g > RJEGGwgAnvbo6LVTEz8PdAOoKPgHiz1ObbB8M/fNANk1Oog1w6CF7a8JPEuB/LlQ > ZS0/31x+69xE+GzD4kPBglG6IVnt7F1mlXSc1YEh5c5zs2T5w5Gak5AIzJNZqEFK > EmplFS8eZCpKJZc+0YKgMisF4Q+VbRjI+KVtYQKBn3sHRNH04z4Ti6jlS14R4pQd > PCB4ftXS/LnISkrxL1uVf1seY+5SpmQjk3FR8ZgrR3vuYAyLcD7aeQNKf+unsS4W > u8VnDmqONHa2JfHjsr5PezLZfWa3YTvK352gamyq5sn6y2ciTcI+fABeSD4OYjvQ > I6t4kQrzfCdMrBNY8G2D5NYOi5cOKQ== > =5CII > -----END PGP SIGNATURE-----

1 0

[PATCH] haproxy: Update to 2.1.4
by Michael Tremer 14 Apr '20

14 Apr '20

This is a security release: https://www.mail-archive.com/haproxy@formilux.org/msg36876.html Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/haproxy | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/haproxy b/lfs/haproxy index d326a090a..62a1c4d10 100644 --- a/lfs/haproxy +++ b/lfs/haproxy @@ -24,7 +24,7 @@ include Config -VER = 2.1.3 +VER = 2.1.4 THISAPP = haproxy-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = haproxy -PAK_VER = 13 +PAK_VER = 14 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = bea4726d8c99f5d9bac0e62906a1f2d0 +$(DL_FILE)_MD5 = 100cccf98aaf3ba80b5fd070866ad115 install : $(TARGET) -- 2.20.1

2 3

[PATCH 1/2] automake: update to 1.16.2
by Peter Müller 14 Apr '20

14 Apr '20

This is required in order to build coreutils 8.32. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/automake | 236 +++++++++++++-------------- lfs/automake | 7 +- src/patches/automake-1.15_perl_warning.patch | 10 -- 3 files changed, 121 insertions(+), 132 deletions(-) delete mode 100644 src/patches/automake-1.15_perl_warning.patch diff --git a/config/rootfiles/common/automake b/config/rootfiles/common/automake index 21a6720ad..595eaf396 100644 --- a/config/rootfiles/common/automake +++ b/config/rootfiles/common/automake @@ -1,130 +1,130 @@ #usr/bin/aclocal -#usr/bin/aclocal-1.15 +#usr/bin/aclocal-1.16 #usr/bin/automake -#usr/bin/automake-1.15 +#usr/bin/automake-1.16 #usr/share/aclocal -#usr/share/aclocal-1.15 -#usr/share/aclocal-1.15/amversion.m4 -#usr/share/aclocal-1.15/ar-lib.m4 -#usr/share/aclocal-1.15/as.m4 -#usr/share/aclocal-1.15/auxdir.m4 -#usr/share/aclocal-1.15/cond-if.m4 -#usr/share/aclocal-1.15/cond.m4 -#usr/share/aclocal-1.15/depend.m4 -#usr/share/aclocal-1.15/depout.m4 -#usr/share/aclocal-1.15/dmalloc.m4 -#usr/share/aclocal-1.15/extra-recurs.m4 -#usr/share/aclocal-1.15/gcj.m4 -#usr/share/aclocal-1.15/init.m4 -#usr/share/aclocal-1.15/install-sh.m4 -#usr/share/aclocal-1.15/internal -#usr/share/aclocal-1.15/internal/ac-config-macro-dirs.m4 -#usr/share/aclocal-1.15/lead-dot.m4 -#usr/share/aclocal-1.15/lex.m4 -#usr/share/aclocal-1.15/lispdir.m4 -#usr/share/aclocal-1.15/maintainer.m4 -#usr/share/aclocal-1.15/make.m4 -#usr/share/aclocal-1.15/missing.m4 -#usr/share/aclocal-1.15/mkdirp.m4 -#usr/share/aclocal-1.15/obsolete.m4 -#usr/share/aclocal-1.15/options.m4 -#usr/share/aclocal-1.15/prog-cc-c-o.m4 -#usr/share/aclocal-1.15/python.m4 -#usr/share/aclocal-1.15/runlog.m4 -#usr/share/aclocal-1.15/sanity.m4 -#usr/share/aclocal-1.15/silent.m4 -#usr/share/aclocal-1.15/strip.m4 -#usr/share/aclocal-1.15/substnot.m4 -#usr/share/aclocal-1.15/tar.m4 -#usr/share/aclocal-1.15/upc.m4 -#usr/share/aclocal-1.15/vala.m4 +#usr/share/aclocal-1.16 +#usr/share/aclocal-1.16/amversion.m4 +#usr/share/aclocal-1.16/ar-lib.m4 +#usr/share/aclocal-1.16/as.m4 +#usr/share/aclocal-1.16/auxdir.m4 +#usr/share/aclocal-1.16/cond-if.m4 +#usr/share/aclocal-1.16/cond.m4 +#usr/share/aclocal-1.16/depend.m4 +#usr/share/aclocal-1.16/depout.m4 +#usr/share/aclocal-1.16/dmalloc.m4 +#usr/share/aclocal-1.16/extra-recurs.m4 +#usr/share/aclocal-1.16/gcj.m4 +#usr/share/aclocal-1.16/init.m4 +#usr/share/aclocal-1.16/install-sh.m4 +#usr/share/aclocal-1.16/internal +#usr/share/aclocal-1.16/internal/ac-config-macro-dirs.m4 +#usr/share/aclocal-1.16/lead-dot.m4 +#usr/share/aclocal-1.16/lex.m4 +#usr/share/aclocal-1.16/lispdir.m4 +#usr/share/aclocal-1.16/maintainer.m4 +#usr/share/aclocal-1.16/make.m4 +#usr/share/aclocal-1.16/missing.m4 +#usr/share/aclocal-1.16/mkdirp.m4 +#usr/share/aclocal-1.16/obsolete.m4 +#usr/share/aclocal-1.16/options.m4 +#usr/share/aclocal-1.16/prog-cc-c-o.m4 +#usr/share/aclocal-1.16/python.m4 +#usr/share/aclocal-1.16/runlog.m4 +#usr/share/aclocal-1.16/sanity.m4 +#usr/share/aclocal-1.16/silent.m4 +#usr/share/aclocal-1.16/strip.m4 +#usr/share/aclocal-1.16/substnot.m4 +#usr/share/aclocal-1.16/tar.m4 +#usr/share/aclocal-1.16/upc.m4 +#usr/share/aclocal-1.16/vala.m4 #usr/share/aclocal/README -#usr/share/automake-1.15 -#usr/share/automake-1.15/Automake -#usr/share/automake-1.15/Automake/ChannelDefs.pm -#usr/share/automake-1.15/Automake/Channels.pm -#usr/share/automake-1.15/Automake/Condition.pm -#usr/share/automake-1.15/Automake/Config.pm -#usr/share/automake-1.15/Automake/Configure_ac.pm -#usr/share/automake-1.15/Automake/DisjConditions.pm -#usr/share/automake-1.15/Automake/FileUtils.pm -#usr/share/automake-1.15/Automake/General.pm -#usr/share/automake-1.15/Automake/Getopt.pm -#usr/share/automake-1.15/Automake/Item.pm -#usr/share/automake-1.15/Automake/ItemDef.pm -#usr/share/automake-1.15/Automake/Language.pm -#usr/share/automake-1.15/Automake/Location.pm -#usr/share/automake-1.15/Automake/Options.pm -#usr/share/automake-1.15/Automake/Rule.pm -#usr/share/automake-1.15/Automake/RuleDef.pm -#usr/share/automake-1.15/Automake/VarDef.pm -#usr/share/automake-1.15/Automake/Variable.pm -#usr/share/automake-1.15/Automake/Version.pm -#usr/share/automake-1.15/Automake/Wrap.pm -#usr/share/automake-1.15/Automake/XFile.pm -#usr/share/automake-1.15/COPYING -#usr/share/automake-1.15/INSTALL -#usr/share/automake-1.15/am -#usr/share/automake-1.15/am/check.am -#usr/share/automake-1.15/am/check2.am -#usr/share/automake-1.15/am/clean-hdr.am -#usr/share/automake-1.15/am/clean.am -#usr/share/automake-1.15/am/compile.am -#usr/share/automake-1.15/am/configure.am -#usr/share/automake-1.15/am/data.am -#usr/share/automake-1.15/am/dejagnu.am -#usr/share/automake-1.15/am/depend.am -#usr/share/automake-1.15/am/depend2.am -#usr/share/automake-1.15/am/distdir.am -#usr/share/automake-1.15/am/footer.am -#usr/share/automake-1.15/am/header-vars.am -#usr/share/automake-1.15/am/header.am -#usr/share/automake-1.15/am/inst-vars.am -#usr/share/automake-1.15/am/install.am -#usr/share/automake-1.15/am/java.am -#usr/share/automake-1.15/am/lang-compile.am -#usr/share/automake-1.15/am/lex.am -#usr/share/automake-1.15/am/library.am -#usr/share/automake-1.15/am/libs.am -#usr/share/automake-1.15/am/libtool.am -#usr/share/automake-1.15/am/lisp.am -#usr/share/automake-1.15/am/ltlib.am -#usr/share/automake-1.15/am/ltlibrary.am -#usr/share/automake-1.15/am/mans-vars.am -#usr/share/automake-1.15/am/mans.am -#usr/share/automake-1.15/am/program.am -#usr/share/automake-1.15/am/progs.am -#usr/share/automake-1.15/am/python.am -#usr/share/automake-1.15/am/remake-hdr.am -#usr/share/automake-1.15/am/scripts.am -#usr/share/automake-1.15/am/subdirs.am -#usr/share/automake-1.15/am/tags.am -#usr/share/automake-1.15/am/texi-vers.am -#usr/share/automake-1.15/am/texibuild.am -#usr/share/automake-1.15/am/texinfos.am -#usr/share/automake-1.15/am/vala.am -#usr/share/automake-1.15/am/yacc.am -#usr/share/automake-1.15/ar-lib -#usr/share/automake-1.15/compile -#usr/share/automake-1.15/config.guess -#usr/share/automake-1.15/config.sub -#usr/share/automake-1.15/depcomp -#usr/share/automake-1.15/install-sh -#usr/share/automake-1.15/mdate-sh -#usr/share/automake-1.15/missing -#usr/share/automake-1.15/mkinstalldirs -#usr/share/automake-1.15/py-compile -#usr/share/automake-1.15/tap-driver.sh -#usr/share/automake-1.15/test-driver -#usr/share/automake-1.15/texinfo.tex -#usr/share/automake-1.15/ylwrap +#usr/share/automake-1.16 +#usr/share/automake-1.16/Automake +#usr/share/automake-1.16/Automake/ChannelDefs.pm +#usr/share/automake-1.16/Automake/Channels.pm +#usr/share/automake-1.16/Automake/Condition.pm +#usr/share/automake-1.16/Automake/Config.pm +#usr/share/automake-1.16/Automake/Configure_ac.pm +#usr/share/automake-1.16/Automake/DisjConditions.pm +#usr/share/automake-1.16/Automake/FileUtils.pm +#usr/share/automake-1.16/Automake/General.pm +#usr/share/automake-1.16/Automake/Getopt.pm +#usr/share/automake-1.16/Automake/Item.pm +#usr/share/automake-1.16/Automake/ItemDef.pm +#usr/share/automake-1.16/Automake/Language.pm +#usr/share/automake-1.16/Automake/Location.pm +#usr/share/automake-1.16/Automake/Options.pm +#usr/share/automake-1.16/Automake/Rule.pm +#usr/share/automake-1.16/Automake/RuleDef.pm +#usr/share/automake-1.16/Automake/VarDef.pm +#usr/share/automake-1.16/Automake/Variable.pm +#usr/share/automake-1.16/Automake/Version.pm +#usr/share/automake-1.16/Automake/Wrap.pm +#usr/share/automake-1.16/Automake/XFile.pm +#usr/share/automake-1.16/COPYING +#usr/share/automake-1.16/INSTALL +#usr/share/automake-1.16/am +#usr/share/automake-1.16/am/check.am +#usr/share/automake-1.16/am/check2.am +#usr/share/automake-1.16/am/clean-hdr.am +#usr/share/automake-1.16/am/clean.am +#usr/share/automake-1.16/am/compile.am +#usr/share/automake-1.16/am/configure.am +#usr/share/automake-1.16/am/data.am +#usr/share/automake-1.16/am/dejagnu.am +#usr/share/automake-1.16/am/depend.am +#usr/share/automake-1.16/am/depend2.am +#usr/share/automake-1.16/am/distdir.am +#usr/share/automake-1.16/am/footer.am +#usr/share/automake-1.16/am/header-vars.am +#usr/share/automake-1.16/am/header.am +#usr/share/automake-1.16/am/inst-vars.am +#usr/share/automake-1.16/am/install.am +#usr/share/automake-1.16/am/java.am +#usr/share/automake-1.16/am/lang-compile.am +#usr/share/automake-1.16/am/lex.am +#usr/share/automake-1.16/am/library.am +#usr/share/automake-1.16/am/libs.am +#usr/share/automake-1.16/am/libtool.am +#usr/share/automake-1.16/am/lisp.am +#usr/share/automake-1.16/am/ltlib.am +#usr/share/automake-1.16/am/ltlibrary.am +#usr/share/automake-1.16/am/mans-vars.am +#usr/share/automake-1.16/am/mans.am +#usr/share/automake-1.16/am/program.am +#usr/share/automake-1.16/am/progs.am +#usr/share/automake-1.16/am/python.am +#usr/share/automake-1.16/am/remake-hdr.am +#usr/share/automake-1.16/am/scripts.am +#usr/share/automake-1.16/am/subdirs.am +#usr/share/automake-1.16/am/tags.am +#usr/share/automake-1.16/am/texi-vers.am +#usr/share/automake-1.16/am/texibuild.am +#usr/share/automake-1.16/am/texinfos.am +#usr/share/automake-1.16/am/vala.am +#usr/share/automake-1.16/am/yacc.am +#usr/share/automake-1.16/ar-lib +#usr/share/automake-1.16/compile +#usr/share/automake-1.16/config.guess +#usr/share/automake-1.16/config.sub +#usr/share/automake-1.16/depcomp +#usr/share/automake-1.16/install-sh +#usr/share/automake-1.16/mdate-sh +#usr/share/automake-1.16/missing +#usr/share/automake-1.16/mkinstalldirs +#usr/share/automake-1.16/py-compile +#usr/share/automake-1.16/tap-driver.sh +#usr/share/automake-1.16/test-driver +#usr/share/automake-1.16/texinfo.tex +#usr/share/automake-1.16/ylwrap #usr/share/doc/automake #usr/share/doc/automake/amhello-1.0.tar.gz #usr/share/info/automake-history.info #usr/share/info/automake.info #usr/share/info/automake.info-1 #usr/share/info/automake.info-2 -#usr/share/man/man1/aclocal-1.15.1 +#usr/share/man/man1/aclocal-1.16.1 #usr/share/man/man1/aclocal.1 -#usr/share/man/man1/automake-1.15.1 +#usr/share/man/man1/automake-1.16.1 #usr/share/man/man1/automake.1 diff --git a/lfs/automake b/lfs/automake index 26d17f540..0dcb58983 100644 --- a/lfs/automake +++ b/lfs/automake @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.15 +VER = 1.16.2 THISAPP = automake-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 9a1ddb0e053474d9d1105cfe39b0c48d +$(DL_FILE)_MD5 = 6cb234c86f3f984df29ce758e6d0d1d7 install : $(TARGET) @@ -78,7 +78,6 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar Jxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/automake-1.15_perl_warning.patch cd $(DIR_APP) && ./configure --prefix=$(PREFIX) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/automake-1.15_perl_warning.patch b/src/patches/automake-1.15_perl_warning.patch deleted file mode 100644 index 9a031e8da..000000000 --- a/src/patches/automake-1.15_perl_warning.patch +++ /dev/null @@ -1,10 +0,0 @@ ---- automake-1.15/bin/automake.in -+++ automake-1.15/bin/automake.in -@@ -3878,7 +3878,7 @@ - sub substitute_ac_subst_variables - { - my ($text) = @_; -- $text =~ s/\${([^ \t=:+{}]+)}/substitute_ac_subst_variables_worker ($1)/ge; -+ $text =~ s/\$\{([^ \t=:+{}]+)}/substitute_ac_subst_variables_worker ($1)/ge; - return $text; - } -- 2.16.4

2 2

[PATCH] vnstat 2.6: Fix for initscript - removed 'evaluate_retval'
by Matthias Fischer 14 Apr '20

14 Apr '20

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- src/initscripts/system/vnstat | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/initscripts/system/vnstat b/src/initscripts/system/vnstat index c1bb2942a..210230c15 100644 --- a/src/initscripts/system/vnstat +++ b/src/initscripts/system/vnstat @@ -20,7 +20,6 @@ case "$1" in boot_mesg "Starting vnstatd..." loadproc /usr/sbin/vnstatd -d --alwaysadd - evaluate_retval ;; stop) @@ -30,7 +29,6 @@ case "$1" in umount_ramdisk "${VNSTATLOG}" boot_mesg "Unmounting vnstat ramdisk..." - evaluate_retval ;; restart) -- 2.18.0

2 1

[PATCH 1/2] openvpn: Add metrics script
by Michael Tremer 13 Apr '20

13 Apr '20

This script is called when an OpenVPN Roadwarrior client connects or disconnect and logs the start and duration of the session. This can be used to monitor session duration and data transfer. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/common/aarch64/stage2 | 1 + config/rootfiles/common/stage2 | 1 + config/rootfiles/common/x86_64/stage2 | 1 + html/cgi-bin/ovpnmain.cgi | 5 + lfs/stage2 | 1 + src/scripts/openvpn-metrics | 171 +++++++++++++++++++++++++ 6 files changed, 180 insertions(+) create mode 100755 src/scripts/openvpn-metrics diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2 index f4169a44e..f52768726 100644 --- a/config/rootfiles/common/aarch64/stage2 +++ b/config/rootfiles/common/aarch64/stage2 @@ -131,6 +131,7 @@ usr/local/bin/xt_geoip_update #usr/local/share/zoneinfo #usr/local/src #usr/sbin +usr/sbin/openvpn-metrics usr/sbin/ovpn-ccd-convert usr/sbin/ovpn-collectd-convert #usr/share diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index fca540431..63aeeffe1 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -131,6 +131,7 @@ usr/local/bin/xt_geoip_update #usr/local/share/zoneinfo #usr/local/src #usr/sbin +usr/sbin/openvpn-metrics usr/sbin/ovpn-ccd-convert usr/sbin/ovpn-collectd-convert #usr/share diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index cc67837e5..6a6fe7b88 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -133,6 +133,7 @@ usr/local/bin/xt_geoip_update #usr/local/share/zoneinfo #usr/local/src #usr/sbin +usr/sbin/openvpn-metrics usr/sbin/ovpn-ccd-convert usr/sbin/ovpn-collectd-convert #usr/share diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 00ecd77a0..734cc0bfa 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -372,6 +372,11 @@ sub writeserverconf { } else { print CONF "verb 3\n"; } + + print CONF "# Log clients connecting/disconnecting\n"; + print CONF "client-connect \"/usr/sbin/openvpn-metrics client-connect\"\n"; + print CONF "client-disconnect \"/usr/sbin/openvpn-metrics client-disconnect\"\n"; + # Print server.conf.local if entries exist to server.conf if ( !-z $local_serverconf && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') { open (LSC, "$local_serverconf"); diff --git a/lfs/stage2 b/lfs/stage2 index 355aeef54..ad6d64838 100644 --- a/lfs/stage2 +++ b/lfs/stage2 @@ -105,6 +105,7 @@ endif done # Move script to correct place. + mv -vf /usr/local/bin/openvpn-metrics /usr/sbin/ mv -vf /usr/local/bin/ovpn-ccd-convert /usr/sbin/ mv -vf /usr/local/bin/ovpn-collectd-convert /usr/sbin/ mv -vf /usr/local/bin/captive-cleanup /usr/bin/ diff --git a/src/scripts/openvpn-metrics b/src/scripts/openvpn-metrics new file mode 100755 index 000000000..30b3932c5 --- /dev/null +++ b/src/scripts/openvpn-metrics @@ -0,0 +1,171 @@ +#!/usr/bin/python3 +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org>. # +# # +############################################################################ + +import argparse +import logging +import logging.handlers +import os +import sqlite3 +import sys + +_ = lambda x: x + +DEFAULT_DATABASE_PATH = "/var/ipfire/ovpn/clients.db" + +def setup_logging(level=logging.INFO): + l = logging.getLogger("openvpn-metrics") + l.setLevel(level) + + # Log to console + h = logging.StreamHandler() + h.setLevel(logging.DEBUG) + l.addHandler(h) + + # Log to syslog + h = logging.handlers.SysLogHandler(address="/dev/log", + facility=logging.handlers.SysLogHandler.LOG_DAEMON) + h.setLevel(logging.INFO) + l.addHandler(h) + + # Format syslog messages + formatter = logging.Formatter("openvpn-metrics[%(process)d]: %(message)s") + h.setFormatter(formatter) + + return l + +# Initialise logging +log = setup_logging() + +class OpenVPNMetrics(object): + def __init__(self): + self.db = self._open_database() + + def parse_cli(self): + parser = argparse.ArgumentParser( + description=_("Tool that collects metrics of OpenVPN Clients"), + ) + subparsers = parser.add_subparsers() + + # client-connect + client_connect = subparsers.add_parser("client-connect", + help=_("Called when a client connects"), + ) + client_connect.add_argument("file", nargs="?", + help=_("Configuration file") + ) + client_connect.set_defaults(func=self.client_connect) + + # client-disconnect + client_disconnect = subparsers.add_parser("client-disconnect", + help=_("Called when a client disconnects"), + ) + client_disconnect.add_argument("file", nargs="?", + help=_("Configuration file") + ) + client_disconnect.set_defaults(func=self.client_disconnect) + + # Parse CLI + args = parser.parse_args() + + # Print usage if no action was given + if not "func" in args: + parser.print_usage() + sys.exit(2) + + return args + + def __call__(self): + # Parse command line arguments + args = self.parse_cli() + + # Call function + try: + ret = args.func(args) + except Exception as e: + log.critical(e) + + # Return with exit code + sys.exit(ret or 0) + + def _open_database(self, path=DEFAULT_DATABASE_PATH): + db = sqlite3.connect(path) + + # Create schema if it doesn't exist already + db.executescript(""" + CREATE TABLE IF NOT EXISTS sessions( + common_name TEXT NOT NULL, + connected_at INTEGER NOT NULL, + duration INTEGER, + bytes_received INTEGER, + bytes_sent INTEGER + ); + + -- Create index for speeding up searches + CREATE INDEX IF NOT EXISTS sessions_common_name ON sessions(common_name); + """) + + return db + + def _get_environ(self, key): + if not key in os.environ: + sys.stderr.write("%s missing from environment\n" % key) + raise SystemExit(1) + + return os.environ.get(key) + + def client_connect(self, args): + common_name = self._get_environ("common_name") + + # Time + time_ascii = self._get_environ("time_ascii") + time_unix = self._get_environ("time_unix") + + log.info("Opening session for %s at %s" % (common_name, time_ascii)) + + c = self.db.cursor() + c.execute("INSERT INTO sessions(common_name, connected_at) \ + VALUES(?, ?)", (common_name, time_unix)) + self.db.commit() + + def client_disconnect(self, args): + common_name = self._get_environ("common_name") + duration = self._get_environ("time_duration") + + # Collect some usage statistics + bytes_received = self._get_environ("bytes_received") + bytes_sent = self._get_environ("bytes_sent") + + log.info("Closing session for %s after %ss and receiving/sending %s/%s bytes" \ + % (common_name, duration, bytes_received, bytes_sent)) + + c = self.db.cursor() + c.execute("UPDATE sessions SET duration = ?, bytes_received = ?, \ + bytes_sent = ? WHERE common_name = ? AND duration IS NULL", + (duration, bytes_received, bytes_sent, common_name)) + self.db.commit() + +def main(): + m = OpenVPNMetrics() + m() + +main() -- 2.20.1

1 1

[PATCH 01/19] openvpn: Add WUI page for client usage statistics
by Stefan Schantl 13 Apr '20

13 Apr '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/logs.cgi/ovpnclients.dat | 327 ++++++++++++++++++++++++++ langs/en/cgi-bin/en.pl | 2 + 2 files changed, 329 insertions(+) create mode 100755 html/cgi-bin/logs.cgi/ovpnclients.dat diff --git a/html/cgi-bin/logs.cgi/ovpnclients.dat b/html/cgi-bin/logs.cgi/ovpnclients.dat new file mode 100755 index 000000000..703f4e507 --- /dev/null +++ b/html/cgi-bin/logs.cgi/ovpnclients.dat @@ -0,0 +1,327 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2020 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; +use POSIX(); +use DBI; + +# enable only the following on debugging purpose +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + +my %color = (); +my %mainsettings = (); +&General::readhash("${General::swroot}/main/settings", \%mainsettings); +&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color); + +# Path and file of the OVPN connections database. +my $database = "/var/ipfire/ovpn/clients.db"; + +my %cgiparams=(); +my %logsettings=(); +my %ovpnsettings=(); + +my $errormessage=''; + +# Hash wich contains the month numbers and the translated names for easy access. +my %monthhash = ( + "1" => "$Lang::tr{'january'}", + "2" => "$Lang::tr{'february'}", + "3" => "$Lang::tr{'march'}", + "4" => "$Lang::tr{'april'}", + "5" => "$Lang::tr{'may'}", + "6" => "$Lang::tr{'june'}", + "7" => "$Lang::tr{'july'}", + "8" => "$Lang::tr{'august'}", + "9" => "$Lang::tr{'september'}", + "10" => "$Lang::tr{'october'}", + "11" => "$Lang::tr{'november'}", + "12" => "$Lang::tr{'december'}" +); + +# Get current time. +my ($sec,$min,$hour,$mday,$month,$year,$wday,$yday,$isdst) = localtime(time); + +# Adjust month, because Jan starts as month "0". +$month = $month+1; + +# Adjust year number. +$year = $year+1900; + +# Assign default vaules. +$cgiparams{'FROM_DAY'} = $mday; +$cgiparams{'FROM_MONTH'} = $month; +$cgiparams{'FROM_YEAR'} = $year; +$cgiparams{'TO_DAY'} = $mday; +$cgiparams{'TO_MONTH'} = $month; +$cgiparams{'TO_YEAR'} = $year; + +&Header::getcgihash(\%cgiparams); + +# Read-in OpenVPN settings and connections. +&General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ovpnsettings); + +# Init DB Module and connect to the database. +my $database_handle = DBI->connect("DBI:SQLite:dbname=$database", "", "", { RaiseError => 1 }); + +# Generate datestrings for SQL queries. +my $from_datestring = sprintf '%04d-%02d-%02d', ($cgiparams{"FROM_YEAR"}, $cgiparams{"FROM_MONTH"}, $cgiparams{"FROM_DAY"}); +my $to_datestring = sprintf '%04d-%02d-%02d', ($cgiparams{"TO_YEAR"}, $cgiparams{"TO_MONTH"}, $cgiparams{"TO_DAY"}); + +my $database_query = qq( + SELECT + common_name, SUM( + STRFTIME('%s', ( + CASE + WHEN DATETIME(COALESCE(disconnected_at, CURRENT_TIMESTAMP), 'localtime') < DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds') + THEN DATETIME(COALESCE(disconnected_at, CURRENT_TIMESTAMP), 'localtime') + ELSE DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds') + END + ), 'utc') - + STRFTIME('%s', ( + CASE + WHEN DATETIME(connected_at, 'localtime') > DATETIME('$from_datestring', 'localtime', 'start of day') + THEN DATETIME(connected_at, 'localtime') + ELSE DATETIME('$from_datestring', 'localtime', 'start of day') + END + ), 'utc') + ) + FROM sessions + WHERE + disconnected_at IS NULL + OR + DATETIME(disconnected_at, 'localtime') > DATETIME('$from_datestring', 'localtime', 'start of day') + OR + DATETIME(connected_at, 'localtime') < DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds') + GROUP BY common_name + ORDER BY common_name; +); + +if ($cgiparams{'CONNECTION_NAME'}) { + $database_query = qq( + SELECT * + FROM sessions + WHERE + common_name = '$cgiparams{"CONNECTION_NAME"}' AND ( + DATETIME(disconnected_at, 'localtime') > DATETIME('$from_datestring', 'localtime', 'start of day') + OR + DATETIME(connected_at, 'localtime') < DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds')); + ); +} + +# Prepare SQL statement. +my $statement_handle = $database_handle->prepare($database_query); + +# Execute SQL statement and get retun value if any error happened. +my $database_return_value = $statement_handle->execute(); + +# If an error has been returned, assign it to the errorstring value for displaying. +if($database_return_value < 0) { + $errormessage = "$DBI::errstr"; +} + +&Header::showhttpheaders(); + +&Header::openpage($Lang::tr{'ovpn rw connection log'}, 1, ''); + +&Header::openbigbox('100%', 'left', '', $errormessage); + +if ($errormessage) { + &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); + print "<font class='base'>$errormessage </font>\n"; + &Header::closebox(); +} + +&Header::openbox('100%', 'left', "$Lang::tr{'settings'}:"); + +print "<form method='post' action=\"$ENV{'SCRIPT_NAME'}\">\n"; +print "<table width='100%'>\n"; + print "<tr>\n"; + print "<td class='base' colspan='2'><b>$Lang::tr{'from'}:</b></td>\n"; + print "</tr>\n"; + + print "<tr>\n"; + print "<td class='base'>$Lang::tr{'day'}:&nbsp\;\n"; + &generate_select("FROM_DAY", "days"); + print "</td>\n"; + + print "<td class='base'>$Lang::tr{'month'}:&nbsp\;\n"; + &generate_select("FROM_MONTH", "months"); + print "</td>\n"; + + print "<td class='base'>$Lang::tr{'year'}:&nbsp\;\n"; + &generate_select("FROM_YEAR", "years"); + print "</td>\n"; + print "</tr>\n"; + + print "<tr><td><br></td></tr>\n"; + + print "<tr>\n"; + print "<td class='base' colspan='2'><b>$Lang::tr{'to'}:</b></td>\n"; + print "</tr>\n"; + + print "<tr>\n"; + print "<td class='base'>$Lang::tr{'day'}:&nbsp\;\n"; + &generate_select("TO_DAY", "days"); + print "</td>\n"; + + print "<td class='base'>$Lang::tr{'month'}:&nbsp\;\n"; + &generate_select("TO_MONTH", "months"); + print "</td>\n"; + + print "<td class='base'>$Lang::tr{'year'}:&nbsp\;\n"; + &generate_select("TO_YEAR", "years"); + print "</td>\n"; + print "</tr>\n"; + + print "<tr><td><br></td></tr>\n"; + + print "<tr>\n"; + print "<td class='base'>$Lang::tr{'ovpn connection name'}:</td>\n"; + print "<td class='base' colspan='2'>\n"; + + print "<select name='CONNECTION_NAME' size='1'>\n"; + print "<option value=''>All</option>\n"; + + # Loop through all configured OpenVPN connections and sort them by name. + foreach my $key (sort { $ovpnsettings{$a}[2] cmp $ovpnsettings{$b}[2] } keys %ovpnsettings) { + my $connection_name = $ovpnsettings{$key}[2]; + my $selected; + + # Skip all non roadwarrior connections. + next unless ($ovpnsettings{"$key"}[3] eq "host"); + + # Check and mark the selected one. + if ($connection_name eq "$cgiparams{'CONNECTION_NAME'}") { + $selected = "selected"; + } + + print "<option value='$connection_name' $selected>$connection_name</option>\n"; + } + + print "</select>\n"; + print "</td>\n"; + print "</tr>\n"; + + print "<tr>\n"; + print "<td width='100%' align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'update'}'></td>\n"; + print "</tr>\n"; +print "</table>\n"; +print "</form>\n"; + +&Header::closebox(); + +&Header::openbox('100%', 'left', $Lang::tr{'log'}); + +my $lines = 0; + +print "<table width='100%' class='tbl'>"; + +my $col=""; + +while(my @row = $statement_handle->fetchrow_array()) { + # Assign some nice to read variable names for the DB fields. + my $connection_name = $row[0]; + my $connection_open_time = $row[1]; + my $connection_close_time = $row[2]; + my $connection_bytes_recieved = $row[3]; + my $connection_bytes_sent = $row[4]; + + # Colorize columns. + if ($lines % 2) { + $col="bgcolor='$color{'color22'}'"; + } else { + $col="bgcolor='$color{'color20'}'"; + } + +print <<END + <tr> + <td width="40%" align="left" $col>$connection_name</td> + <td width="20%" align="center" $col>$connection_open_time</td> + <td width="20%" align="center" $col>$connection_close_time</td> + <td width="10%" align="center" $col>$connection_bytes_recieved</td> + <td width="10%" align="center" $col>$connection_bytes_sent</td> + </tr> +END +; + + # Increase lines count. + $lines++; + + } + +print "</table><br>\n"; + +&Header::closebox(); + +# Close database connection. +$database_handle->disconnect(); + +&Header::closebigbox(); + +&Header::closepage(); + +# +## Function for easy select generation. +# +sub generate_select($$) { + my ($name, $type) = @_; + + my $start = 1; + my $stop; + + # Adjust start and stop by the given type. + if ($type eq "days") { + $stop = 31; + } elsif ($type eq "months") { + $stop = 12; + } elsif ($type = "years") { + $stop = $year; + $start = $stop - 10; + } + + # Print select HTML tag. + print "<select name='$name' size='1'>\n"; + + # Loop through the range. + for ( my $i = $start; $i <= $stop; $i++) { + print "\t<option "; + + # Check and select the current processed item. + if ($i == $cgiparams{$name}) { + print 'selected="selected" '; + } + + # Check if months are processed and display the corresponding names. + if ($type eq "months") { + print "value='$i'>$monthhash{$i}</option>\n"; + } else { + print "value='$i'>$i</option>\n"; + } + } + + # Close select HTML tag. + print "</select>\n\n"; +} diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index a68c8f411..9d3ca5c6d 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1915,6 +1915,7 @@ 'ovpn' => 'OpenVPN', 'ovpn add conf' => 'Additional configuration', 'ovpn con stat' => 'OpenVPN Connection Statistics', +'ovpn connection name' => 'Connection name', 'ovpn config' => 'OVPN-Config', 'ovpn crypt options' => 'Cryptographic options', 'ovpn device' => 'OpenVPN device:', @@ -1947,6 +1948,7 @@ 'ovpn reneg sec' => 'Session key lifetime:', 'ovpn routes push' => 'Routes (one per line) e.g. 192.168.10.0/255.255.255.0 192.168.20.0/24', 'ovpn routes push options' => 'Route push options', +'ovpn rw connection log' => 'OpenVPN RW connections log', 'ovpn server status' => 'Current OpenVPN server status:', 'ovpn subnet' => 'OpenVPN subnet:', 'ovpn subnet is invalid' => 'OpenVPN subnet is invalid.', -- 2.26.0

1 18

[PATCH] vnstat 2.6: Fix for lfs
by Matthias Fischer 12 Apr '20

12 Apr '20

Removed 'sleep 2' Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- src/initscripts/system/vnstat | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/initscripts/system/vnstat b/src/initscripts/system/vnstat index bcc19c3ab..a21905d75 100755 --- a/src/initscripts/system/vnstat +++ b/src/initscripts/system/vnstat @@ -20,14 +20,12 @@ case "$1" in boot_mesg "Starting vnstatd..." loadproc /usr/sbin/vnstatd -d --alwaysadd - sleep 2 evaluate_retval ;; stop) boot_mesg "Stopping vnstatd..." killproc /usr/sbin/vnstatd - sleep 2 evaluate_retval umount_ramdisk "${VNSTATLOG}" -- 2.18.0

2 11

[PATCH] vnstat: Changed rights of initscript
by Matthias Fischer 12 Apr '20

12 Apr '20

0755 => 0644 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- src/initscripts/system/vnstat | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 src/initscripts/system/vnstat diff --git a/src/initscripts/system/vnstat b/src/initscripts/system/vnstat old mode 100755 new mode 100644 -- 2.18.0

2 1

← Newer
1
2
3
4
5
6
7
8
9
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2020