Development March 2021

development@lists.ipfire.org

14 participants
107 discussions

[PATCH] bzip2: Update to 1.0.8
by Adolf Belka 29 Mar '21

29 Mar '21

- Update from 1.0.6 to 1.0.8 - Update of rootfile - Changelog 1.0.8 (13 Jul 19) * Accept as many selectors as the file format allows. This relaxes the fix for CVE-2019-12900 from 1.0.7 so that bzip2 allows decompression of bz2 files that use (too) many selectors again. * Fix handling of large (> 4GB) files on Windows. * Cleanup of bzdiff and bzgrep scripts so they don't use any bash extensions and handle multiple archives correctly. * There is now a bz2-files testsuite at https://sourceware.org/git/bzip2-tests.git 1.0.7 (27 Jun 19) * Fix undefined behavior in the macros SET_BH, CLEAR_BH, & ISSET_BH * bzip2: Fix return value when combining --test,-t and -q. * bzip2recover: Fix buffer overflow for large argv[0] * bzip2recover: Fix use after free issue with outFile (CVE-2016-3189) * Make sure nSelectors is not out of range (CVE-2019-12900) Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/bzip2 | 2 +- lfs/bzip2 | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/bzip2 b/config/rootfiles/common/bzip2 index f6ad610d4..9a8e88148 100644 --- a/config/rootfiles/common/bzip2 +++ b/config/rootfiles/common/bzip2 @@ -2,7 +2,7 @@ bin/bunzip2 bin/bzcat bin/bzip2 lib/libbz2.so.1.0 -lib/libbz2.so.1.0.6 +lib/libbz2.so.1.0.8 usr/bin/bunzip2 usr/bin/bzcat usr/bin/bzcmp diff --git a/lfs/bzip2 b/lfs/bzip2 index da20ce68c..9c6f9c5a4 100644 --- a/lfs/bzip2 +++ b/lfs/bzip2 @@ -24,7 +24,7 @@ include Config -VER = 1.0.6 +VER = 1.0.8 THISAPP = bzip2-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 00b516f4704d4a7cb50a1d97e6e8e15b +$(DL_FILE)_MD5 = 67e051268d0c475ea773822f7500d0e5 install : $(TARGET) -- 2.31.0

1 0

[PATCH] bison: Update to 3.7.6
by Adolf Belka 29 Mar '21

29 Mar '21

- Update from 3.7.1 to 3.7.6 - No update of rootfile required - Changelog is too large to include here Full changelog can be viewed in ChangeLog file in the source tarball 3.7.6 1 bug fix 3.7.5 4 bug fixes 3.7.4 2 bug fixes 3.7.3 2 bug fixes 3.7.2 6 bug fixes Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/bison | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/bison b/lfs/bison index 9c65723f5..3a2681406 100644 --- a/lfs/bison +++ b/lfs/bison @@ -24,7 +24,7 @@ include Config -VER = 3.7.1 +VER = 3.7.6 THISAPP = bison-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -45,7 +45,7 @@ objects =$(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e7c8c321351ebdf70f5f0825f3faaee2 +$(DL_FILE)_MD5 = d61aa92e3562cb7292b004ce96173cf7 install : $(TARGET) -- 2.31.0

1 0

Few questions concerning creating addon package
by Robin Roevens 29 Mar '21

29 Mar '21

Hi all Firstly, thank you Adolf for the encouragement and extra pointers to start this task.. I think I have currently successfully prepared a new version of the zabbix_agentd package containing latest zabbix_agentd LTS version (v5.0.9). I tested the package on an ipfire-test-vm instance set up with the iso built by the make.sh script and then manually unpacking the package using the instructions of https://wiki.ipfire.org/devel/ipfire-2-x/addon-howto and all seems well except that the service is not automatically started during install.sh which calls: --- restore_backup ${NAME} start_service --background ${NAME} --- So I'm assuming ${NAME} is not available when I manually run install.sh as per instructions, and that it will be available when pakfire itself installs the package? Is there a way to test the actual package deployment using pakfire ? Then I have a few other questions: - In the LFS template there is a PAK_VER variable, and it is not clear to me what this exactly is. Is this a revision number for current packaged version? or just a 'counter' for how many package versions there have been for this program in IPFire ? - In the LFS template for current zabbix_agentd v4.2.6 DL_FROM is pointing to URL_IPFIRE.. Should this be changed ? Or should I upload the new source-file for v5.0.9 to URL_IPFIRE in some way ? (are there instructions somewhere?) or ..? Then a more practical question: Next to 'just' an upgrade of the current Zabbix agent I also added a few config files etc for use with my Zabbix IPFire specific monitoring template. This changes Alexander's original config a little, but should remain backwards compatible. Should I submit this as 2 separate patches or will a single patch suffice? Regards Robin -- Dit bericht is gescanned op virussen en andere gevaarlijke inhoud door MailScanner en lijkt schoon te zijn.

2 3

[PATCH] lfs/Config: fix build if MAX_PARALLELISM is lower than one
by Arne Fitzenreiter 28 Mar '21

28 Mar '21

If you have 2GB RAM the build of dnsdist will fail because MAX_PARALLELISM was set to zero by RAM/2048 because a bit of RAM is used by the system. This patch ensure that the lowest PARALLELISM value is 1. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/Config | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/lfs/Config b/lfs/Config index ee3dc2365..4e3ddb880 100644 --- a/lfs/Config +++ b/lfs/Config @@ -35,11 +35,15 @@ unexport BUILD_ARCH BUILD_PLATFORM BUILDTARGET CROSSTARGET TOOLCHAIN TOOLS_DIR unexport XZ_OPT PARALLELISM = $(shell echo $$( \ - if [ -n "$(MAX_PARALLELISM)" ] && [ $(MAX_PARALLELISM) -lt $(DEFAULT_PARALLELISM) ]; then \ - echo $(MAX_PARALLELISM); \ + if [ -n "$(MAX_PARALLELISM)" ] && [ $(MAX_PARALLELISM) -lt 1 ]; then \ + echo 1 ; \ else \ - echo $(DEFAULT_PARALLELISM); \ - fi) \ + if [ -n "$(MAX_PARALLELISM)" ] && [ $(MAX_PARALLELISM) -lt $(DEFAULT_PARALLELISM) ]; then \ + echo $(MAX_PARALLELISM); \ + else \ + echo $(DEFAULT_PARALLELISM); \ + fi \ + fi ) \ ) MAKETUNING = -j$(PARALLELISM) -- 2.25.1

1 0

[PATCH] Tor: update to 0.4.5.7
by Peter Müller 28 Mar '21

28 Mar '21

Full changelog as per https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.5.7: Changes in version 0.4.5.7 - 2021-03-16 Tor 0.4.5.7 fixes two important denial-of-service bugs in earlier versions of Tor. One of these vulnerabilities (TROVE-2021-001) would allow an attacker who can send directory data to a Tor instance to force that Tor instance to consume huge amounts of CPU. This is easiest to exploit against authorities, since anybody can upload to them, but directory caches could also exploit this vulnerability against relays or clients when they download. The other vulnerability (TROVE-2021-002) only affects directory authorities, and would allow an attacker to remotely crash the authority with an assertion failure. Patches have already been provided to the authority operators, to help ensure network stability. We recommend that everybody upgrade to one of the releases that fixes these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available to you. This release also updates our GeoIP data source, and fixes a few smaller bugs in earlier releases. o Major bugfixes (security, denial of service): - Disable the dump_desc() function that we used to dump unparseable information to disk. It was called incorrectly in several places, in a way that could lead to excessive CPU usage. Fixes bug 40286; bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- 001 and CVE-2021-28089. - Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority. Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 and CVE-2021-28090. o Minor features (geoip data): - We have switched geoip data sources. Previously we shipped IP-to- country mappings from Maxmind's GeoLite2, but in 2019 they changed their licensing terms, so we were unable to update them after that point. We now ship geoip files based on the IPFire Location Database instead. (See https://location.ipfire.org/ for more information). This release updates our geoip files to match the IPFire Location Database as retrieved on 2021/03/12. Closes ticket 40224. o Minor bugfixes (directory authority): - Now that exit relays don't allow exit connections to directory authority DirPorts (to prevent network reentry), disable authorities' reachability self test on the DirPort. Fixes bug 40287; bugfix on 0.4.5.5-rc. o Minor bugfixes (documentation): - Fix a formatting error in the documentation for VirtualAddrNetworkIPv6. Fixes bug 40256; bugfix on 0.2.9.4-alpha. o Minor bugfixes (Linux, relay): - Fix a bug in determining total available system memory that would have been triggered if the format of Linux's /proc/meminfo file had ever changed to include "MemTotal:" in the middle of a line. Fixes bug 40315; bugfix on 0.2.5.4-alpha. o Minor bugfixes (metrics port): - Fix a BUG() warning on the MetricsPort for an internal missing handler. Fixes bug 40295; bugfix on 0.4.5.1-alpha. o Minor bugfixes (onion service): - Remove a harmless BUG() warning when reloading tor configured with onion services. Fixes bug 40334; bugfix on 0.4.5.1-alpha. o Minor bugfixes (portability): - Fix a non-portable usage of "==" with "test" in the configure script. Fixes bug 40298; bugfix on 0.4.5.1-alpha. o Minor bugfixes (relay): - Remove a spammy log notice falsely claiming that the IPv4/v6 address was missing. Fixes bug 40300; bugfix on 0.4.5.1-alpha. - Do not query the address cache early in the boot process when deciding if a relay needs to fetch early directory information from an authority. This bug resulted in a relay falsely believing it didn't have an address and thus triggering an authority fetch at each boot. Related to our fix for 40300. o Removed features (mallinfo deprecated): - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. Closes ticket 40309. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tor b/lfs/tor index 8ad5986b0..34e3b3ffb 100644 --- a/lfs/tor +++ b/lfs/tor @@ -24,7 +24,7 @@ include Config -VER = 0.4.5.6 +VER = 0.4.5.7 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 58 +PAK_VER = 59 DEPS = libseccomp @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 22a04ef62c714b7d9d8928ebe238e4c4 +$(DL_FILE)_MD5 = 3a1800592293a8d4122823eab9233739 install : $(TARGET) -- 2.26.2

1 0

VoIP connection tracking oddities
by Peter Müller 28 Mar '21

28 Mar '21

Hello development folks, broken VoIP calls involving VoIP telephone equipment behind an IPFire machine have been an ongoing nuisance for me for years by now. While I cannot pinpoint their first occurrence anymore, I recall them to happen ever since we moved to Linux 4.14.x - since VoIP is the only technology requiring advanced connection tracking I have in use, there might be more related bugs. While VoIP calls to my ISP using SIP over UDP and RTP with opportunistic SRTP support enabled worked in most (but not all) cases, using the same equipment to make a phone call via an IPsec VPN between two IPFire machines failed with a chance 30 to 50 percent per call. The failure mode has been always the same: At least one participant could not hear the other after picking up the phone. Sometimes, both callers could not hear each other. Initially, I blamed the netfilter ALGs we ship, as they were error-prone and tampered with traffic they should not have tampered with (Arne mentioned the SIP ALG interfered with IPsec traffic as well - for whatever reason it does). Since ALGs do not work on encrypted traffic, switching to SIP over TLS and mandatory SRTP should do the trick, I assumed. It did not. After running Core Update 155 (where we disabled all ALGs), I recently experienced a broken call again, with SIP over TLS and SRTP in place. Since I am able to rule out a faulty configuration of the VoIP equipment with a high level of confidence, this leaves me with the suggestion that there is a more fundamental flaw in the Linux 4.14.x connection tracking, causing establishment of RTP streams to fail sometimes. Worse, this is not reproducible at all - at least all attempts of mine to provoke this failure did not accomplish anything. (For the sake of completeness, I should mention that all needed firewall rules are present and no dropped packets were logged. IPS is not triggering, either, at least there are no corresponding log messages in /var/log/suricata/fast.log .) Since involved IPFire machines handle between 1k and 5k connections at any time, increasing the size of the connection tracking table by running > sysctl net.netfilter.nf_conntrack_max=655360; seemed useful to me. It did, however, not improve the reliability of VoIP call establishment. All in all, this situation is quite unsatisfying. _Something_ in IPFire sometimes messes up with RTP streams, without doing so reproducible, logging anything or being otherwise reasonably debuggable. After Core Update 155, we can strike ALGs of the list of potential failure sources. I have no idea where - and even how - to look further. Hopefully Linux 5.x will our connection tracking reliability. I am pretty much out of ideas for Linux 4.14.x, though. Thanks, and best regards, Peter Müller

1 0

[PATCH] rust: Update to 1.51
by Matthias Fischer 27 Mar '21

27 Mar '21

For details see: https://github.com/rust-lang/rust/blob/master/RELEASES.md Please note: I can only build on Intel 32bit and 64bit, rootfiles for 'aarch64' and 'armv5tel' are still missing. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/i586/rust | 64 +++++++++++++--------------- config/rootfiles/common/x86_64/rust | 66 ++++++++++++++--------------- lfs/rust | 10 ++--- 3 files changed, 66 insertions(+), 74 deletions(-) diff --git a/config/rootfiles/common/i586/rust b/config/rootfiles/common/i586/rust index 4592d661f..1ba069dee 100644 --- a/config/rootfiles/common/i586/rust +++ b/config/rootfiles/common/i586/rust @@ -6,13 +6,9 @@ #usr/bin/rustdoc #usr/etc/bash_completion.d #usr/etc/bash_completion.d/cargo -#usr/lib/libchalk_derive-dfa7d4aa3c4122b5.so -#usr/lib/librustc_driver-6f74b8765a504030.so -#usr/lib/librustc_macros-5af2465d06f3e5ef.so -#usr/lib/libserde_derive-cc14479bf5403ff4.so -#usr/lib/libstd-432c60b323be1e4f.so -#usr/lib/libtest-c924162c32bc9689.so -#usr/lib/libtracing_attributes-9e3e92feee9eb8a7.so +#usr/lib/librustc_driver-c20ca3c04a59a7fd.so +#usr/lib/libstd-17af607fafeec010.so +#usr/lib/libtest-6ed499b2de6f7ed3.so #usr/lib/rustlib #usr/lib/rustlib/components #usr/lib/rustlib/etc @@ -26,33 +22,33 @@ #usr/lib/rustlib/i686-unknown-linux-gnu #usr/lib/rustlib/i686-unknown-linux-gnu/bin #usr/lib/rustlib/i686-unknown-linux-gnu/lib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libaddr2line-1110d28274a5a558.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libadler-4b1049af3d913803.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/liballoc-5e2a7d41358b8c39.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libcfg_if-a9603e8333d12216.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libcompiler_builtins-57f1b8bc97a86ad5.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libcore-041b4871def5ffdd.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libgetopts-0c11f8eb378407f6.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libgimli-f94ca12d741aa829.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libhashbrown-05b3bb325f871ab6.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/liblibc-71dc1a7fd36fc1f8.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libminiz_oxide-647a40100ab2bea5.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libobject-6f43ac9680623372.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libpanic_abort-55b8dce24446be0e.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libpanic_unwind-5792752fa50f924f.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libproc_macro-65269cd9094d14e6.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libprofiler_builtins-22fe3e13ecb9d52f.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_demangle-97839ff2b38debae.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_std_workspace_alloc-970c252fdb322ff9.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_std_workspace_core-e2ebdd0dee50567f.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_std_workspace_std-cd6fe2855767d095.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libstd-432c60b323be1e4f.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libstd-432c60b323be1e4f.so -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libterm-111efd21a26ba2c8.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libtest-c924162c32bc9689.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libtest-c924162c32bc9689.so -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libunicode_width-6d6c428d48531c31.rlib -#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libunwind-cb989ad6c1d6d8e4.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libaddr2line-c8071f4fd64b8447.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libadler-0349698873defa34.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/liballoc-4ee3c33938208aa4.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libcfg_if-026ad87104cdfeea.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libcompiler_builtins-9a06243c6c7e8528.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libcore-7da5ae6b1d061c3d.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libgetopts-0ddc724072fa12a1.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libgimli-0eddbd769f241c1d.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libhashbrown-9e99065747e32362.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/liblibc-92bbd0da49665057.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libminiz_oxide-24ad70872c68e01f.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libobject-5ab850799bc1d85d.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libpanic_abort-95ba58a890227a5f.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libpanic_unwind-469a8af1d4d55ce7.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libproc_macro-28c6ba6967e07051.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libprofiler_builtins-d58f76d15eb44c57.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_demangle-7a538ce2f1f58338.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_std_workspace_alloc-63380016f02a674e.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_std_workspace_core-b83ea8012e4ee99e.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/librustc_std_workspace_std-1bece10cc5dfb00b.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libstd-17af607fafeec010.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libstd-17af607fafeec010.so +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libterm-2aea246853cd806a.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libtest-6ed499b2de6f7ed3.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libtest-6ed499b2de6f7ed3.so +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libunicode_width-9a244ee40f5e4b24.rlib +#usr/lib/rustlib/i686-unknown-linux-gnu/lib/libunwind-78445e0a22ee32d6.rlib #usr/lib/rustlib/install.log #usr/lib/rustlib/manifest-cargo #usr/lib/rustlib/manifest-rust-std-i686-unknown-linux-gnu diff --git a/config/rootfiles/common/x86_64/rust b/config/rootfiles/common/x86_64/rust index f21cdc9fd..6f4c7fd45 100644 --- a/config/rootfiles/common/x86_64/rust +++ b/config/rootfiles/common/x86_64/rust @@ -7,14 +7,10 @@ #usr/etc #usr/etc/bash_completion.d #usr/etc/bash_completion.d/cargo -#usr/lib/libLLVM-11-rust-1.50.0-stable.so -#usr/lib/libchalk_derive-61359e51e4358720.so -#usr/lib/librustc_driver-02bb148e88292f22.so -#usr/lib/librustc_macros-4fdb095435d7e9cb.so -#usr/lib/libserde_derive-ebf4f007defb9256.so -#usr/lib/libstd-6f77337c1826707d.so -#usr/lib/libtest-e47ef95451387c6a.so -#usr/lib/libtracing_attributes-36f34216659db5d4.so +#usr/lib/libLLVM-11-rust-1.51.0-stable.so +#usr/lib/librustc_driver-7ea116e55de24565.so +#usr/lib/libstd-b1047a2788193be4.so +#usr/lib/libtest-db2b7a6bef408fa0.so #usr/lib/rustlib #usr/lib/rustlib/components #usr/lib/rustlib/etc @@ -34,37 +30,37 @@ #usr/lib/rustlib/x86_64-unknown-linux-gnu #usr/lib/rustlib/x86_64-unknown-linux-gnu/bin #usr/lib/rustlib/x86_64-unknown-linux-gnu/lib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-65e4f8df4b8bbd73.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libadler-c0e64497deb085aa.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/liballoc-edc29aa8c04b480f.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-2e8740599b11634b.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcompiler_builtins-d36087076e1dd756.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcore-2408224b4af46d83.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgetopts-b3c2130783b6e355.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-fec1b74170245419.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libhashbrown-72a374d36f3d0a31.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/liblibc-241cf59851357bea.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libminiz_oxide-78f8506dd5004913.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-217a514dc8d845c6.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_abort-d669fd4a86f7cf8c.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-e238540f8faf9927.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libproc_macro-bba0624c33176ddd.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libprofiler_builtins-123e57c2755f4d4f.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-4b4efaa8c4601753.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libadler-eaad965909c4200f.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/liballoc-d4ef8bf89076ed01.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-2642d2bccc00517a.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcompiler_builtins-e2523c360f03ba10.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcore-3aaf8f932781f33e.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgetopts-95dbee16e1f1413e.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-d36e07ed2cc56ee4.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libhashbrown-58a065cdff5508a2.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/liblibc-760e48b3f782e7f5.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libminiz_oxide-c6b02b522c91c060.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libobject-dca728ac8ed54d87.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_abort-e64bb1b2baa83853.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-e8e399e2092f3b2a.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libproc_macro-54c67f2a732d07c8.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libprofiler_builtins-3d6f66b0d6604f40.rlib #usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-stable_rt.asan.a #usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-stable_rt.lsan.a #usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-stable_rt.msan.a #usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-stable_rt.tsan.a -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_demangle-e74f867eb2f15322.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_alloc-cb9206ed96de54c3.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_core-6a141406945fda5a.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_std-e773e1a4ab176789.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-6f77337c1826707d.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-6f77337c1826707d.so -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libterm-17f420b89a471dd5.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libtest-e47ef95451387c6a.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libtest-e47ef95451387c6a.so -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libunicode_width-fc4fe3c8698a6dd4.rlib -#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libunwind-33ee81149d314805.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_demangle-3855d04b1bb40ceb.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_alloc-82aeeedcc8d1450a.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_core-36070e2029bb21ea.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_std-bb10221986b0d0dc.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-b1047a2788193be4.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-b1047a2788193be4.so +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libterm-48aa4fef4e05ebc9.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libtest-db2b7a6bef408fa0.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libtest-db2b7a6bef408fa0.so +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libunicode_width-ca628c5eca5e5caf.rlib +#usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libunwind-5c4d6c9d7595f844.rlib #usr/libexec/cargo-credential-1password #usr/share/doc/cargo #usr/share/doc/cargo/LICENSE-APACHE diff --git a/lfs/rust b/lfs/rust index 5af9c4cec..2c357944d 100644 --- a/lfs/rust +++ b/lfs/rust @@ -24,7 +24,7 @@ include Config -VER = 1.50.0 +VER = 1.51.0 THISAPP = rust-$(VER) DL_FILE = $(THISAPP)-$(RUST_BOOTSTRAP).tar.gz @@ -53,10 +53,10 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(THISAPP)-x86_64-unknown-linux-gnu.tar.gz_MD5 = df740a74cd0887feaf36edc8b36f9b77 -$(THISAPP)-i686-unknown-linux-gnu.tar.gz_MD5 = 62a242568c0a4479c5f0050522fd44f8 -$(THISAPP)-aarch64-unknown-linux-gnu.tar.gz_MD5 = acda9f6336efd24d1d8949a2c470fb91 -$(THISAPP)-arm-unknown-linux-gnueabi.tar.gz_MD5 = fc073998405ea150f699cbf910ba9296 +$(THISAPP)-x86_64-unknown-linux-gnu.tar.gz_MD5 = efc4d147e25918e60678a69fcaf67b55 +$(THISAPP)-i686-unknown-linux-gnu.tar.gz_MD5 = 666d7a99abf2834b2cb4bb8e6c571c76 +$(THISAPP)-aarch64-unknown-linux-gnu.tar.gz_MD5 = e85e1758b9770bae16c253825e2ecf9c +$(THISAPP)-arm-unknown-linux-gnueabi.tar.gz_MD5 = da4fa1b2bd21dc6d2d7e791d8faaa3eb install : $(TARGET) -- 2.18.0

1 0

[PATCH v2 1/2] pmacct: New addon
by Adolf Belka 27 Mar '21

27 Mar '21

- What is it? pmacct is a monitoring tool for network management tasks. Data collected can be used for analysis and troubleshooting purposes to maintain the health of the network. pmacct can collect, replicate and export network information. It can cache in memory tables, store persistently to SQLite3 and output to flat-files like CSV, formatted, and JSON. - Why is it needed? To monitor data usage (IP-based or MAC-based data accounting) down to the client level. Net-Traffic will monitor traffic for the entire RED, GREEN, etc. networks, but it cannot pinpoint which client is using lots of data. Connections will take a snapshot but not show day by day sums. pmacct can help admins keep tabs on users that use too much data. - What are the use cases? An ISP may implement data caps and if the limit is over-run then you have to pay for every additional xxGB of data used. Typical charges can be around $10 per 50GB. With pmacct you can identify the high users and take action, hopefully before the limit is breached. - This is being introduced as a command line only tool. However, at a later date, if it is useful to enough additional users a WUI page could be developed as discussed in the development mailing list https://lists.ipfire.org/pipermail/development/2021-January/009174.html - Changes in V2 version - Initscript is using IPFire template and installed with IPFire method. - All other daemons except pmacct and pmacctd have been removed from the install. - Example conf files have been removed from /etc/pmacct Both example conf files are described in the pmacct wiki draft. Tested-by: Jon Murphy <jon.murphy(a)ipfire.org> Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/backup/includes/pmacct | 2 + config/pmacct/pmacct.conf | 24 +++++++ config/rootfiles/packages/pmacct | 109 +++++++++++++++++++++++++++++++ lfs/pmacct | 100 ++++++++++++++++++++++++++++ make.sh | 2 + src/initscripts/packages/pmacct | 33 ++++++++++ src/paks/pmacct/install.sh | 36 ++++++++++ src/paks/pmacct/uninstall.sh | 33 ++++++++++ src/paks/pmacct/update.sh | 26 ++++++++ 9 files changed, 365 insertions(+) create mode 100644 config/backup/includes/pmacct create mode 100644 config/pmacct/pmacct.conf create mode 100644 config/rootfiles/packages/pmacct create mode 100644 lfs/pmacct create mode 100644 src/initscripts/packages/pmacct create mode 100755 src/paks/pmacct/install.sh create mode 100755 src/paks/pmacct/uninstall.sh create mode 100644 src/paks/pmacct/update.sh diff --git a/config/backup/includes/pmacct b/config/backup/includes/pmacct new file mode 100644 index 000000000..4359067ad --- /dev/null +++ b/config/backup/includes/pmacct @@ -0,0 +1,2 @@ +/etc/pmacct/ +/var/spool/pmacct/ diff --git a/config/pmacct/pmacct.conf b/config/pmacct/pmacct.conf new file mode 100644 index 000000000..3c1d47efa --- /dev/null +++ b/config/pmacct/pmacct.conf @@ -0,0 +1,24 @@ +! +! Pmacctd configuration file for IPFire environment +! + +syslog: daemon +daemonize: true +debug: false +promisc: true +interface: green0 + + +! +! "plugin1" plugin configuration +! +plugins: memory[plugin1] + +plugin_buffer_size[plugin1]: 102400 +plugin_pipe_size[plugin1]: 10240000 + +imt_mem_pools_number: 256 +imt_path[plugin1]: /var/spool/pmacct/plugin1.pipe + +aggregate[plugin1]: src_host, src_port, src_mac, dst_host, dst_port, dst_mac, proto +aggregate_filter[plugin1]: ip \ No newline at end of file diff --git a/config/rootfiles/packages/pmacct b/config/rootfiles/packages/pmacct new file mode 100644 index 000000000..e73a9b8a7 --- /dev/null +++ b/config/rootfiles/packages/pmacct @@ -0,0 +1,109 @@ +etc/pmacct +etc/pmacct/pmacct.conf +etc/rc.d/init.d/pmacct +usr/bin/pmacct +#usr/lib/pmacct +#usr/lib/pmacct/examples +#usr/lib/pmacct/examples/custom +#usr/lib/pmacct/examples/custom/libcustom.la +#usr/lib/pmacct/examples/lg +#usr/lib/pmacct/examples/lg/pmbgp +#usr/sbin/nfacctd +usr/sbin/pmacctd +#usr/sbin/pmbgpd +#usr/sbin/pmbmpd +#usr/sbin/pmtelemetryd +#usr/sbin/sfacctd +#usr/share/pmacct +#usr/share/pmacct/CONFIG-KEYS +#usr/share/pmacct/FAQS +#usr/share/pmacct/QUICKSTART +#usr/share/pmacct/UPGRADE +#usr/share/pmacct/docs +#usr/share/pmacct/docs/IPFIX +#usr/share/pmacct/docs/LOOKING_GLASS_FORMAT +#usr/share/pmacct/docs/MSGLOG_DUMP_FORMATS +#usr/share/pmacct/docs/SIGNALS +#usr/share/pmacct/docs/TRIGGER_VARS +#usr/share/pmacct/examples +usr/share/pmacct/examples/allow.lst.example +#usr/share/pmacct/examples/amqp +usr/share/pmacct/examples/amqp/amqp_receiver.py +#usr/share/pmacct/examples/avro +usr/share/pmacct/examples/avro/avro_file_decoder.py +usr/share/pmacct/examples/bgp_agent.map.example +usr/share/pmacct/examples/bgp_md5.lst.example +usr/share/pmacct/examples/bgp_xconnects.map.example +usr/share/pmacct/examples/flow_to_rd.map.example +#usr/share/pmacct/examples/kafka +usr/share/pmacct/examples/kafka/kafka_consumer.py +#usr/share/pmacct/examples/lg +usr/share/pmacct/examples/lg/pmbgp.py +usr/share/pmacct/examples/networks.lst.example +usr/share/pmacct/examples/nfacctd-sql.conf.example +usr/share/pmacct/examples/pcap_interfaces.map.example +usr/share/pmacct/examples/peers.map.example +usr/share/pmacct/examples/pmacctd-imt.conf.example +usr/share/pmacct/examples/pmacctd-multiple-plugins.conf.example +usr/share/pmacct/examples/pmacctd-sql.conf.example +usr/share/pmacct/examples/pmacctd-sqlite3.conf.example +usr/share/pmacct/examples/ports.lst.example +usr/share/pmacct/examples/pretag.map.example +usr/share/pmacct/examples/primitives.lst.example +usr/share/pmacct/examples/probe_netflow.conf.example +usr/share/pmacct/examples/probe_sflow.conf.example +usr/share/pmacct/examples/sampling.map.example +usr/share/pmacct/examples/tee_receivers.lst.example +#usr/share/pmacct/sql +#usr/share/pmacct/sql/README.64bit +#usr/share/pmacct/sql/README.GeoIP +#usr/share/pmacct/sql/README.IPv6 +#usr/share/pmacct/sql/README.cos +#usr/share/pmacct/sql/README.custom_primitives +#usr/share/pmacct/sql/README.etype +#usr/share/pmacct/sql/README.export_proto +#usr/share/pmacct/sql/README.iface +#usr/share/pmacct/sql/README.label +#usr/share/pmacct/sql/README.mask +#usr/share/pmacct/sql/README.mpls +#usr/share/pmacct/sql/README.mysql +#usr/share/pmacct/sql/README.nat +#usr/share/pmacct/sql/README.pgsql +#usr/share/pmacct/sql/README.sampling +usr/share/pmacct/sql/README.sqlite3 +#usr/share/pmacct/sql/README.tag2 +#usr/share/pmacct/sql/README.timestamp +#usr/share/pmacct/sql/README.tunnel +#usr/share/pmacct/sql/pmacct-create-db.pgsql +#usr/share/pmacct/sql/pmacct-create-db_bgp_v1.mysql +#usr/share/pmacct/sql/pmacct-create-db_v1.mysql +#usr/share/pmacct/sql/pmacct-create-db_v2.mysql +#usr/share/pmacct/sql/pmacct-create-db_v3.mysql +#usr/share/pmacct/sql/pmacct-create-db_v4.mysql +#usr/share/pmacct/sql/pmacct-create-db_v5.mysql +#usr/share/pmacct/sql/pmacct-create-db_v6.mysql +#usr/share/pmacct/sql/pmacct-create-db_v7.mysql +#usr/share/pmacct/sql/pmacct-create-db_v8.mysql +#usr/share/pmacct/sql/pmacct-create-db_v9.mysql +#usr/share/pmacct/sql/pmacct-create-table_bgp_v1.pgsql +usr/share/pmacct/sql/pmacct-create-table_bgp_v1.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v1.pgsql +usr/share/pmacct/sql/pmacct-create-table_v1.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v2.pgsql +usr/share/pmacct/sql/pmacct-create-table_v2.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v3.pgsql +usr/share/pmacct/sql/pmacct-create-table_v3.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v4.pgsql +usr/share/pmacct/sql/pmacct-create-table_v4.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v5.pgsql +usr/share/pmacct/sql/pmacct-create-table_v5.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v6.pgsql +usr/share/pmacct/sql/pmacct-create-table_v6.sqlite3 +usr/share/pmacct/sql/pmacct-create-table_v7.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v7_v8.pgsql +usr/share/pmacct/sql/pmacct-create-table_v8.sqlite3 +#usr/share/pmacct/sql/pmacct-create-table_v9.pgsql +usr/share/pmacct/sql/pmacct-create-table_v9.sqlite3 +#usr/share/pmacct/sql/pmacct-grant-db.mysql +var/ipfire/backup/addons/includes/pmacct +var/spool/pmacct diff --git a/lfs/pmacct b/lfs/pmacct new file mode 100644 index 000000000..30c6c47e1 --- /dev/null +++ b/lfs/pmacct @@ -0,0 +1,100 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2019 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.7.6 + +THISAPP = pmacct-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = pmacct +PAK_VER = 1 + +DEPS = libcdada + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = b829cfdc394d5acd6d32fb23de181a6b + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./autogen.sh + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --sysconfdir=/etc/pmacct \ + --enable-sqlite3 \ + --enable-l2 \ + --enable-jansson + # Add directory for plugins and pipes + -mkdir -v /var/spool/pmacct + # Add configuration folder and copy conf file to it + -mkdir -v /etc/pmacct + cp -vf $(DIR_CONF)/pmacct/pmacct.conf /etc/pmacct + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + #install initscripts + $(call INSTALL_INITSCRIPT,pmacct) + # Install backup definition + install -v -m 644 ${DIR_SRC}/config/backup/includes/pmacct \ + /var/ipfire/backup/addons/includes/pmacct + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 0c124ac81..9b2b4f52e 100755 --- a/make.sh +++ b/make.sh @@ -1659,6 +1659,8 @@ buildipfire() { lfsmake2 ncdu lfsmake2 lshw lfsmake2 socat + lfsmake2 libcdada + lfsmake2 pmacct } buildinstaller() { diff --git a/src/initscripts/packages/pmacct b/src/initscripts/packages/pmacct new file mode 100644 index 000000000..45d4c336a --- /dev/null +++ b/src/initscripts/packages/pmacct @@ -0,0 +1,33 @@ +#!/bin/sh +# Begin $rc_base/init.d/pmacct + +# Based on sysklogd script from LFS-3.1 and earlier. + +. /etc/sysconfig/rc +. $rc_functions + +case "$1" in + start) + boot_mesg "Starting the pmacctd daemon..." + loadproc /usr/sbin/pmacctd -f /etc/pmacct/pmacct.conf + ;; + stop) + boot_mesg "Stopping the pmacctd daemon..." + killproc /usr/sbin/pmacctd + ;; + restart) + ${0} stop + sleep 1 + ${0} start + ;; + status) + statusproc /usr/sbin/pmacctd + ;; + *) + echo "Usage: $0 (start|stop|restart|status)" + exit 1 + ;; +esac + +# End $rc_base/init.d/pmacct + diff --git a/src/paks/pmacct/install.sh b/src/paks/pmacct/install.sh new file mode 100755 index 000000000..11b16f6c1 --- /dev/null +++ b/src/paks/pmacct/install.sh @@ -0,0 +1,36 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh + +extract_files +restore_backup ${NAME} + +# Add symlinks for runlevels +ln -s ../init.d/${NAME} /etc/rc.d/rc0.d/K85${NAME} +ln -s ../init.d/${NAME} /etc/rc.d/rc3.d/S50${NAME} +ln -s ../init.d/${NAME} /etc/rc.d/rc6.d/K85${NAME} +start_service ${NAME} + + +# EOF diff --git a/src/paks/pmacct/uninstall.sh b/src/paks/pmacct/uninstall.sh new file mode 100755 index 000000000..51631e8c1 --- /dev/null +++ b/src/paks/pmacct/uninstall.sh @@ -0,0 +1,33 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh + +stop_service ${NAME} +make_backup ${NAME} +remove_files + +# Delete symlinks +rm -rfv /etc/rc.d/rc?.d/???${NAME} + +# EOF diff --git a/src/paks/pmacct/update.sh b/src/paks/pmacct/update.sh new file mode 100644 index 000000000..89c40d0d7 --- /dev/null +++ b/src/paks/pmacct/update.sh @@ -0,0 +1,26 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +./uninstall.sh +./install.sh -- 2.31.0

1 1

[PATCH] BUG12265: firewall: iptables rules are being created in the wrong chain Fixes: #12265
by Alexander Marx 27 Mar '21

27 Mar '21

When creating a rule like Source:Orange and Target:green IPfire Interface, the rule was created in the forward instead of input chain. This patch sets correct chain and additionally checks if a single target ip (when set) is one of the ipfire interface ip addresses. If this is the case, the target is automatically changed to IPFIRE interface instead of single target ip. --- html/cgi-bin/firewall.cgi | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 532f99f91..c680eed1d 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2013 Alexander Marx <amarx(a)ipfire.org> # +# Copyright (C) 2021 Alexander Marx <amarx(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -213,6 +213,7 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') &General::readhasharray("$configfwdfw", \%configfwdfw); &General::readhasharray("$configinput", \%configinputfw); &General::readhasharray("$configoutgoing", \%configoutgoingfw); + &General::readhash("/var/ipfire/ethernet/settings", \%netsettings); my $maxkey; #Set Variables according to the JQuery code in protocol section if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') @@ -231,6 +232,19 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') { $fwdfwsettings{'USESRV'} = 'ON'; } + #Check if manual targetip is one of IPFire addresses + if ($fwdfwsettings{'grp2'} eq 'tgt_addr' && $fwdfwsettings{$fwdfwsettings{'grp2'}} eq $netsettings{'GREEN_ADDRESS'}){ + $fwdfwsettings{'grp2'} = 'ipfire'; + $fwdfwsettings{$fwdfwsettings{'grp2'}} = 'GREEN'; + } + if ($fwdfwsettings{'grp2'} eq 'tgt_addr' && $fwdfwsettings{$fwdfwsettings{'grp2'}} eq $netsettings{'ORANGE_ADDRESS'}){ + $fwdfwsettings{'grp2'} = 'ipfire'; + $fwdfwsettings{$fwdfwsettings{'grp2'}} = 'ORANGE'; + } + if ($fwdfwsettings{'grp2'} eq 'tgt_addr' && $fwdfwsettings{$fwdfwsettings{'grp2'}} eq $netsettings{'BLUE_ADDRESS'}){ + $fwdfwsettings{'grp2'} = 'ipfire'; + $fwdfwsettings{$fwdfwsettings{'grp2'}} = 'BLUE'; + } $errormessage=&checksource; if(!$errormessage){&checktarget;} if(!$errormessage){&checkrule;} @@ -247,7 +261,7 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') $errormessage=$Lang::tr{'fwdfw err same'}; } # INPUT part - if ($fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE'){ + if ($fwdfwsettings{'grp2'} eq 'ipfire'){ $fwdfwsettings{'config'}=$configinput; $fwdfwsettings{'chain'} = 'INPUTFW'; $maxkey=&General::findhasharraykey(\%configinputfw); @@ -1512,7 +1526,7 @@ sub newrule $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}} = 'CHECKED'; $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}} = 'selected'; $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}} = 'selected'; - $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; + $selected{'ipfire tgt'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected'; #check if update and get values if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on' && !$errormessage){ @@ -1526,7 +1540,7 @@ sub newrule $fwdfwsettings{'ACTIVE'} = $hash{$key}[2]; $fwdfwsettings{'grp1'} = $hash{$key}[3]; $fwdfwsettings{$fwdfwsettings{'grp1'}} = $hash{$key}[4]; - $fwdfwsettings{'grp2'} = $hash{$key}[5]; + $fwdfwsettings{'grp2'} = $hash{$key}[5]; $fwdfwsettings{$fwdfwsettings{'grp2'}} = $hash{$key}[6]; $fwdfwsettings{'USE_SRC_PORT'} = $hash{$key}[7]; $fwdfwsettings{'PROT'} = $hash{$key}[8]; @@ -1584,7 +1598,7 @@ sub newrule $checked{'RATE_LIMIT'}{$fwdfwsettings{'RATE_LIMIT'}} = 'CHECKED'; $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}} = 'selected'; $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}} = 'selected'; - $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; + $selected{'ipfire tgt'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected'; $selected{'dnat'}{$fwdfwsettings{'dnat'}} ='selected'; $selected{'snat'}{$fwdfwsettings{'snat'}} ='selected'; @@ -1753,16 +1767,16 @@ END <table width='100%' border='0'> <tr><td width='1%'><input type='radio' name='grp2' value='tgt_addr' checked></td><td width='60%' nowrap='nowrap'>$Lang::tr{'fwdfw targetip'}<input type='TEXT' name='tgt_addr' value='$fwdfwsettings{'tgt_addr'}' size='16' maxlength='18'><td width='1%'><input type='radio' name='grp2' id='ipfire' value='ipfire' $checked{'grp2'}{'ipfire'}></td><td><b>Firewall</b></td> END - print"<td align='right'><select name='ipfire' style='width:200px;'>"; - print "<option value='ALL' $selected{'ipfire'}{'ALL'}>$Lang::tr{'all'}</option>"; - print "<option value='GREEN' $selected{'ipfire'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'}; - print "<option value='ORANGE' $selected{'ipfire'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used()); - print "<option value='BLUE' $selected{'ipfire'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>"if (&Header::blue_used()); - print "<option value='RED1' $selected{'ipfire'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip); + print"<td align='right'><select name='ipfire tgt' style='width:200px;'>"; + print "<option value='ALL' $selected{'ipfire tgt'}{'ALL'}>$Lang::tr{'all'}</option>"; + print "<option value='GREEN' $selected{'ipfire tgt'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'}; + print "<option value='ORANGE' $selected{'ipfire tgt'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used()); + print "<option value='BLUE' $selected{'ipfire tgt'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>"if (&Header::blue_used()); + print "<option value='RED1' $selected{'ipfire tgt'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip); if (! -z "${General::swroot}/ethernet/aliases"){ foreach my $alias (sort keys %aliases) { - print "<option value='$alias' $selected{'ipfire'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>"; + print "<option value='$alias' $selected{'ipfire tgt'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>"; } } print<<END; -- 2.25.1

2 1

[PATCH] knot: Update to 3.0.5
by Matthias Fischer 27 Mar '21

27 Mar '21

For details see: https://www.knot-dns.cz/2021-03-25-version-305.html "Improvements: kdig: added support for TCP Fast Open on FreeBSD keymgr: the SEP flag can be changed on already generated keys Some documentation improvements Bugfixes: knotd: journal contents can be considered malformed after changeset merge knotd: broken detection of TCP Fast Open availability knotd: zone restore can stuck in an infinite loop if zone configuration changed knotd: failed zone backup makes control socket unavailable knotd: zone not stored to journal after reload if difference-no-serial is enabled knotd: old key is being used after an algorithm rollover with a shared policy #721 keymgr: keytag not recomputed upon key flag change kdig: TCP not used if +fastopen is set mod-dnstap: the local address is empty kzonecheck: missing letter lower-casing of the origin parameter XDP mode wrongly detected on NetBSD Failed to build knotd_stdio fuzzing utility" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/knot | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/knot b/lfs/knot index 39940a358..bdf34b966 100644 --- a/lfs/knot +++ b/lfs/knot @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.0.4 +VER = 3.0.5 THISAPP = knot-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c0a546927ff50db153893de43758cb37 +$(DL_FILE)_MD5 = 687d00586202bc0bbf0c76fa90921652 install : $(TARGET) -- 2.18.0

2 1

← Newer
1
2
3
4
5
6
7
...
11
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2021