Development April 2021

development@lists.ipfire.org

15 participants
161 discussions

[PATCH] Crypt-PasswdMD5: Update to 1.41
by Adolf Belka 19 Apr '21

19 Apr '21

- Update from 1.3 to 1.41 - Update of rootfile not needed - Changelog 1.41 2021-02-01T15:56:00 - Adopt new repo structure. See http://savage.net.au/Ron/html/My.Workflow.for.Building.Distros.html. - Reformat Makefile.PL. - Add t/00.*. - Update POD to change RT to github. 1.40 2013-09-30T15:32:00 - No code changes. - Maintenance by Ron Savage <rsavage(a)cpan.org>. - Fabricate some version #s for this file. - Made Passwd.pm utf-8 so we can use Luis' proper name. - Clean up code formatting. - Clean up Makefile.PL. - Use fake (ASCII) ñ in Makefile.PL to keep Solaris happy. See RT#68478. - Clean up README. - Add Build.PL. - Add Changes and Changelog.ini. - Add META.*. - Adopt Test::More in t/basic.t. - Adopt 'use strict' and 'use warnings' to PasswdMD5.pm and t/basic.t. - Accept patch for new function random_md5_salt(), and tests, from kbrint(a)rufus.net. With thanx. See RT#37036. - Add xt/author/pod.t. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/Crypt-PasswdMD5 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/Crypt-PasswdMD5 b/lfs/Crypt-PasswdMD5 index e337b2343..1e82df18e 100644 --- a/lfs/Crypt-PasswdMD5 +++ b/lfs/Crypt-PasswdMD5 @@ -24,10 +24,10 @@ include Config -VER = 1.3 +VER = 1.41 THISAPP = Crypt-PasswdMD5-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tgz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 368205b1be8c0d4f807afe25d6fbd1ad +$(DL_FILE)_MD5 = d8d3b97bf4598b9f75c119c0a4c4445c install : $(TARGET) @@ -69,7 +69,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && perl Makefile.PL cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && make install -- 2.31.1

1 0

[PATCH 1/2] Convert-UUlib: Update to 1.8
by Adolf Belka 19 Apr '21

19 Apr '21

- Update from 1.06 to 1.8 - Update of rootfiles - Changelog 1.8 Thu Dec 17 02:23:53 CET 2020 - no bugfixes in this release due to lack of known bugs, but the major changes in this release might have introduced new bugs, so watch out. - update large decoder example to disable OPT_AUTOCHK and use Smerge -1. - some micro-optimisations. - avoid costly string comparisons by comparing hashes when isnerting items, which speeds up insertion by a constant factor. - improve uulist (and other) structure layout and size. - reverse the order of file list items, which heuristically improves match speed with large usenet file lists. - use getc instead of fgetc, which makes no difference on gnu/linux. - clean up _FP symbol names toi not start with an underscore. - use feof_unlocked and ferror_unlocked. - implement a faster ascii-only strnicmp. - misc very minor code improvements. - remove quite a bit of pre-posix/dos/etc. cruft. - use flockfile, if available, for a potential but small speed gain. - speed up inner yenc decoder loop. - kentnl said that this module should no longer claim to be a simple interface to uulib, as the bunndled copy is now better maintained than the original upstream library. 1.71 Tue Mar 17 00:54:06 CET 2020 - backport to c89 (patch by Paul Howarth). 1.7 Sat Feb 29 22:07:54 CET 2020 - new function: GetFileList. - experimental perlmulticore support (see manpage). - Initialize is now a NOP and CleanUp automatically initializes again. - updated example decoder and documentation a bit. - include ecb.h to deal with compiler builtins and endianness. - some further µ-optimisations in hot code, especially for yEnc. - replace crc32 function by slice-by-16 version by Stephan Brumme, which should speed up yEnc en-/decoding. - yEnc: do not calculate two crcs per part, instead, combine the part crcs together to form the file crc. - yEnc: allow pcrc= in addition to pcrc32= for yenc trailers, as some draft mentions both and it is actually in active use. - yEnc: ignore crc32= on multiparts, except on the last part, which avoids spurious corruption warnings. - be more precise in documenting code licenses in COPYING. - convert constant creation to the method I normally use. - use common::sense. 1.62 Mon Feb 17 23:19:42 CET 2020 - major performance improvement by simplifying code in _FP_gets to not use fscanf. This might slow things down on platforms with very slow fgetc. 1.61 Sun Feb 9 18:38:29 CET 2020 - lint uulib: fix some format string type mismatches and some other minor issues. 1.6 Thu Oct 24 17:11:54 CEST 2019 - fix heap overflow (testcase by Noel Duffy, reported by Robert Scheck). The defense-in-depth mechanism based on mmap should make this unexploitable for other than denial of service, on systems supporting mmap/mprotect. 1.5 Sat Jul 11 03:56:06 CEST 2015 - fix a heap overflow (testcase by Krzysztof Wojtaś). - on systems that support it (posix + mmap + map_anonymous), allocate all dynamic areas via mmap and put four guard pages around them, to catch similar heap overflows safely in the future. - find a safer way to pass in CC/CFLAGS to uulib. - added stability canary support. 1.4 Sun May 29 17:17:01 CEST 2011 - avoid a classical buffer overflow in case a progress message is too long. - this release adds dependencies for snprintf/vsnprintf. - some uuencode encoders do not generate a final "space" line before the "end" marker, so do not rely on the line to be there. 1.34 Tue Dec 14 22:20:00 CET 2010 - fix a one-byte-past-end-write buffer overflow in UURepairData (reported, analysed and testcase provided by Marco Walther). - quoted-printable decoding was completely broken, try a fix. 1.33 Wed Oct 28 09:04:38 CET 2009 - handle yEnc files with part end=0 and total= more gracefully. I wish yEnc had been created by somebody who knows; what he does; but I doubt he even knows; what he did. 1.32 Wed Sep 16 20:07:13 CEST 2009 - Due to a glitch with CVS, configure lacked executable bits. (Quickly reported by Anton Berezin). 1.31 Wed Sep 16 09:04:30 CEST 2009 - do not use system-replacements for case-insensitive string functions when found, as they are broken on too many systems (mostly bsds, as usual, but at least some versions of GNU/Linux disagree with themselves apparently). Analyzed by Anton Berezin. 1.3 Sat Aug 29 01:24:35 CEST 2009 - major changes, new bugs and changes in decoding behaviour are expected (but not intended). - major scanning and decoding speed-up (by a factor of 4), by replacing ultra-slow _FP_gets and improving IsKnownHeader (but fgets is *still* responsible for >50% if the time). - new option OPT_AUTOCHECK to disable O(n) UUCheckGlobalList call after every loadfile, majorly speeds up large decodes (easily by a factor of 10..100). - allow "Smerge -1" to call UUCheckGlobalList. - majorly speed up part insertion (still O(n), but much faster). - allow for 1023 octet headers instead of the standard 255 octet ones. - support strcasestr, strcasecmp, strncasecmp for added speed. 1.12 Mon Oct 13 14:11:01 CEST 2008 - use the yencode filesize as additional matching criterium to avoid false matches. - made the example decoder more verbose w.r.t. error handling. - removed potentially confusing decode_temp calls from example decoder. 1.11 Fri Jun 13 15:32:30 CEST 2008 - don't ask. 1.10 Fri Jun 13 14:22:42 CEST 2008 - fix an infinite-looping problem when scanning in freestyle mode (testcase provided by Pieter Geens and Reinhard Pfau). 1.09 Fri May 25 19:38:11 CEST 2007 - create something sensible, trust a windows program to fuck it up: work around literal "(null)" filenames in yenc-encoded files. - some minor cleanups. 1.08 Sat Dec 16 23:27:13 CET 2006 - URGENT update, the last release did not decode files correctly, usually not at all. - my last patch was, of course, completely bogus. (sorry. looked simple...). 1.07 Sun Dec 10 17:41:46 CET 2006 - fixed an uninitialised variable based on analysis and patch by Mark Martinec. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/Convert-UUlib | 1 - lfs/Convert-UUlib | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/Convert-UUlib b/config/rootfiles/common/Convert-UUlib index 4a05f5182..f86c33382 100644 --- a/config/rootfiles/common/Convert-UUlib +++ b/config/rootfiles/common/Convert-UUlib @@ -2,6 +2,5 @@ usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/Convert/UUlib.pm #usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Convert/UUlib #usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Convert/UUlib/.packlist -#usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Convert/UUlib/UUlib.bs usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Convert/UUlib/UUlib.so #usr/share/man/man3/Convert::UUlib.3 diff --git a/lfs/Convert-UUlib b/lfs/Convert-UUlib index f2e22429c..95f6bc4bb 100644 --- a/lfs/Convert-UUlib +++ b/lfs/Convert-UUlib @@ -24,7 +24,7 @@ include Config -VER = 1.06 +VER = 1.8 THISAPP = Convert-UUlib-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 92514be4d146e8c4ea1941a7f7472dcb +$(DL_FILE)_MD5 = fd470299600064c283d9a52348cdb4ef install : $(TARGET) -- 2.31.1

1 1

[PATCH] Convert-TNEF: Update to 0.18
by Adolf Belka 19 Apr '21

19 Apr '21

- Update from 0.17 to 0.18 - Update of rootfile not needed - Changelog - Add IO::Wrap dependency to Makefile.PL (RT78412). - Change longname() to detect names in newer versions of Outlook. (RT78484) Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/Convert-TNEF | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/Convert-TNEF b/lfs/Convert-TNEF index ad21047f9..136bc71d0 100644 --- a/lfs/Convert-TNEF +++ b/lfs/Convert-TNEF @@ -24,7 +24,7 @@ include Config -VER = 0.17 +VER = 0.18 THISAPP = Convert-TNEF-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 31cddf42fae9495b4a686b17ec68d7e0 +$(DL_FILE)_MD5 = 6f69ff242a807b861c6e68a3d93a58f7 install : $(TARGET) -- 2.31.1

1 0

[PATCH 0/4] [V2] zabbix_agentd: new maintainer/summary
by Robin Roevens 19 Apr '21

19 Apr '21

Since a new version of Zabbix Agent 5 LTS was released before the previous patch-set was reviewed, I resubmit my patchset as a V2 updating current zabbix_agentd 4.2.6 to 5.0.10 as opposed to v5.0.9 in my previous submission. The other 3 patches in the set remain unchanged. For reference I'll include the summary again: This set of patches does not only update the binaries (well, the first patch only does that) but also fixes some things that I see as problematic in previous version: - /usr/lib/zabbix is created for users to drop custom agent modules in, however that dir was removed and recreated on update as it was not in the backup. I added it to the backup and prevented deletion of the directory if it is not empty upon uninstall, so user-added content would not disapear when the package is removed. - Sometimes a new version of the agent will introduce new configuration parameters. In general the Zabbix Agent config file(s) should remain compatible, but we never know what the future will bring us; and the user may miss out on new features introduced with new parameters in the config file. However we don't want to plain overwrite the configfile as the user may (probably has) have changed it. Currently on upgrade configfiles are backed up, removed, new are installed, then overwritten by the old ones from the backup. Ending with the old config and the new agent. I didn't find an example of another package doing something similar, so I chose to save the new configfile(s) as .ipfirenew-files like RPM-based distro's do with .rpmnew-files. If the original config file is absent the install script will automatically strip the .ipfirenew extension. And if the new config file does not differ from the currently installed one, the .ipfirenew-file is removed. The install-script will also issue warning messages if such .ipfirenew-files are left on the filesystem, requesting the user to manually investigate and possibly merge the configfile. I hope those warnings are visible in the pakfire output. A side effect is that the config files are also not removed when the package is uninstalled. I don't see a problem here for the zabbix own config-files. But it may pose a risk concerning the sudoers-file? - I added a few IPFire specific monitoring items to the agent config which can be used for more in-depth monitoring of the IPFire installation. The user is of course free to use my template available on share.zabbix.com or github to monitor those items, or create their own template. Thanks for considering this patch-set. Please be honest but gentle commenting on it :-). Regards Robin -- Dit bericht is gescanned op virussen en andere gevaarlijke inhoud door MailScanner en lijkt schoon te zijn.

3 27

Fwd: [openssh-unix-announce] Announce: OpenSSH 8.6 released
by Michael Tremer 19 Apr '21

19 Apr '21

Morning, Does anyone want to grab this one? > Begin forwarded message: > > From: Damien Miller <djm(a)cvs.openbsd.org> > Subject: [openssh-unix-announce] Announce: OpenSSH 8.6 released > Date: 19 April 2021 at 01:53:14 BST > To: openssh-unix-announce(a)mindrot.org > > OpenSSH 8.6 has just been released. It will be available from the > mirrors listed at https://www.openssh.com/ shortly. > > OpenSSH is a 100% complete SSH protocol 2.0 implementation and > includes sftp client and server support. > > Once again, we would like to thank the OpenSSH community for their > continued support of the project, especially those who contributed > code or patches, reported bugs, tested snapshots or donated to the > project. More information on donations may be found at: > https://www.openssh.com/donations.html > > Future deprecation notice > ========================= > > It is now possible[1] to perform chosen-prefix attacks against the > SHA-1 algorithm for less than USD$50K. > > In the SSH protocol, the "ssh-rsa" signature scheme uses the SHA-1 > hash algorithm in conjunction with the RSA public key algorithm. > OpenSSH will disable this signature scheme by default in the near > future. > > Note that the deactivation of "ssh-rsa" signatures does not necessarily > require cessation of use for RSA keys. In the SSH protocol, keys may be > capable of signing using multiple algorithms. In particular, "ssh-rsa" > keys are capable of signing using "rsa-sha2-256" (RSA/SHA256), > "rsa-sha2-512" (RSA/SHA512) and "ssh-rsa" (RSA/SHA1). Only the last of > these is being turned off by default. > > This algorithm is unfortunately still used widely despite the > existence of better alternatives, being the only remaining public key > signature algorithm specified by the original SSH RFCs that is still > enabled by default. > > The better alternatives include: > > * The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512. These > algorithms have the advantage of using the same key type as > "ssh-rsa" but use the safe SHA-2 hash algorithms. These have been > supported since OpenSSH 7.2 and are already used by default if the > client and server support them. > > * The RFC8709 ssh-ed25519 signature algorithm. It has been supported > in OpenSSH since release 6.5. > > * The RFC5656 ECDSA algorithms: ecdsa-sha2-nistp256/384/521. These > have been supported by OpenSSH since release 5.7. > > To check whether a server is using the weak ssh-rsa public key > algorithm, for host authentication, try to connect to it after > removing the ssh-rsa algorithm from ssh(1)'s allowed list: > > ssh -oHostKeyAlgorithms=-ssh-rsa user@host > > If the host key verification fails and no other supported host key > types are available, the server software on that host should be > upgraded. > > OpenSSH recently enabled the UpdateHostKeys option by default to assist > the client by automatically migrating to better algorithms. > > [1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and > Application to the PGP Web of Trust" Leurent, G and Peyrin, T > (2020) https://eprint.iacr.org/2020/014.pdf > > Security > ======== > > * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this > option was enabled with a set of patterns that activated logging > in code that runs in the low-privilege sandboxed sshd process, the > log messages were constructed in such a way that printf(3) format > strings could effectively be specified the low-privilege code. > > An attacker who had sucessfully exploited the low-privilege > process could use this to escape OpenSSH's sandboxing and attack > the high-privilege process. Exploitation of this weakness is > highly unlikely in practice as the LogVerbose option is not > enabled by default and is typically only used for debugging. No > vulnerabilities in the low-privilege process are currently known > to exist. > > Thanks to Ilja Van Sprundel for reporting this bug. > > Changes since OpenSSH 8.5 > ========================= > > This release contains mostly bug fixes. > > New features > ------------ > > * sftp-server(8): add a new limits(a)openssh.com protocol extension > that allows a client to discover various server limits, including > maximum packet size and maximum read/write length. > > * sftp(1): use the new limits(a)openssh.com extension (when available) > to select better transfer lengths in the client. > > * sshd(8): Add ModuliFile keyword to sshd_config to specify the > location of the "moduli" file containing the groups for DH-GEX. > > * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to > enable printing of the elapsed time in seconds of each test. > > Bugfixes > -------- > > * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in > manual pages with the current default. GHPR#174 > > * ssh(1): ensure that pkcs11_del_provider() is called before exit. > GHPR#234 > > * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple > backslashes were not being dequoted correctly and quoted space in > the middle of a string was being incorrectly split. GHPR#223 > > * ssh(1): return non-zero exit status when killed by signal; bz#3281 > > * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum > packet size. Also handle zero-length reads that are not explicitly > banned by the spec. > > Portability > ----------- > > * sshd(8): don't mistakenly exit on transient read errors on the > network socket (e.g. EINTR, EAGAIN); bz3297 > > * Create a dedicated contrib/gnome-ssk-askpass3.c source instead of > building it from the same file as used for GNOME2. Use the GNOME3 > gdk_seat_grab() to manage keyboard/mouse/server grabs for better > compatibility with Wayland. > > * Fix portability build errors bz3293 bz3292 bz3291 bz3278 > > * sshd(8): soft-disallow the fstatat64 syscall in the Linux > seccomp-bpf sandbox. bz3276 > > * unit tests: enable autoopt and misc unit tests that were > previously skipped > > Checksums: > ========== > > - SHA1 (openssh-8.6.tar.gz) = a3e93347eed6296faaaceb221e8786391530fccb > - SHA256 (openssh-8.6.tar.gz) = ihmgdEgKfCBRpC0qzdQRwYownrpBf+rsihvk4Rmim8M= > > - SHA1 (openssh-8.6p1.tar.gz) = 8f9f0c94317baeb97747d6258f3997b4542762c0 > - SHA256 (openssh-8.6p1.tar.gz) = w+bk2hYhdiyFDQO0fu0eSN/0zJYI3etUcgKiNN+O164= > > Please note that the SHA256 signatures are base64 encoded and not > hexadecimal (which is the default for most checksum tools). The PGP > key used to sign the releases is available from the mirror sites: > https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc > > Please note that the OpenPGP key used to sign releases has been > rotated for this release. The new key has been signed by the previous > key to provide continuity. > > Reporting Bugs: > =============== > > - Please read https://www.openssh.com/report.html > Security bugs should be reported directly to openssh(a)openssh.com > _______________________________________________ > openssh-unix-announce mailing list > openssh-unix-announce(a)mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-announce

2 1

Problems trying to update lua-5.4.3
by Adolf Belka 19 Apr '21

19 Apr '21

Hi All, I have been working on updating lua from 5.3.5 to 5.4.3 I updated the autotoolize.patch and the shared_library-1.patch and found that 5.4.3 no longer has lbitlib.c in the tarball src directory I removed lbitlib.c from the liblua_la_SOURCES section in the diff for lua-5.3.5/src/Makefile.am ----------------------------------------------------------- +AM_CFLAGS = -Wall + +include_HEADERS = lua.h lualib.h lauxlib.h lua.hpp + +nodist_include_HEADERS = luaconf.h + +lib_LTLIBRARIES = liblua.la +liblua_la_LDFLAGS = -release @MAJOR_VERSION@ +liblua_la_SOURCES = \ + lapi.c lauxlib.c lbaselib.c lbitlib.c lcode.c lcorolib.c lctype.c ldblib.c \ + ldebug.c ldo.c ldump.c lfunc.c lgc.c linit.c liolib.c llex.c lmathlib.c lmem.c \ + loadlib.c lobject.c lopcodes.c loslib.c lparser.c lstate.c lstring.c lstrlib.c \ + ltable.c ltablib.c ltm.c lundump.c lutf8lib.c lvm.c lzio.c \ + lapi.h lcode.h lctype.h ldebug.h ldo.h lfunc.h lgc.h llex.h llimits.h \ + lmem.h lobject.h lopcodes.h lparser.h lstate.h lstring.h ltable.h ltm.h \ + lundump.h lvm.h lzio.h + ----------------------------------------------------------- and then lua built without any problems. So lua built successfully but looking at the files in the tarball src directory for 5.3.5 & 5.4.3 there are some differences The following files lua.c luac.c lua.h luaconf.h lualib.h lauxlib.h lprefix.h are in both 5.3.5 & 5.4.3 but not in the liblua_la_SOURCES section. This may be deliberate, I can't tell. However lbitlib.c is in 5.3.5 & liblua_la_SOURCES but not in 5.4.3 Is that a problem for IPFire's use of lua? ljumptab.h and lopnames.h are not in 5.3.5 or liblua_la_SOURCES but are in 5.4.3 Should these now be included somewhere in the Makefile.am or elsewhere or is it OK to ignore them for IPFire? Regards, Adolf.

2 5

Backup: Rework and altering of functionalities and GUI for better usability
by Matthias Fischer 18 Apr '21

18 Apr '21

Based on https://bugzilla.ipfire.org/show_bug.cgi?id=12588 Hi, in the meantime I worked on this - a bit. I've made several changes and adjustments which could be implemented one by one - if they are wanted/accepted: - Changed icons to buttons => better readability. - For buttons to work, I added two lang strings for button labeling. - Cleaned up the code a bit, some if-queries were unnessecary (if ($cgiparams{'ACTION'} eq...). - Changed the order of the (Addon-)buttons to "Download - Save - Delete" (old: Download was in the middle). - Marked IPF-files bold => better readability (I already sent this in one day: => https://patchwork.ipfire.org/patch/3124/). - Added query for deleting a backup file (onclick=\"return confirm...). Details in the attached screenshot. Proposed ToDo - as a start: Alter the info text for restoring to make clear that only the addon *configs* are restored, not the addons themselves. Thoughts? Opinions? Best, Matthias

5 14

[PATCH 1/2] lm_sensors: Update to 3-6-0
by Adolf Belka 16 Apr '21

16 Apr '21

- Update from 3-4-0 to 3-6-0 - Update of rootfilers in each architecture Only the library version changed in each rootfile - Installed updated lm_sensors. Confirmed updated version was installed. sensors-detect ran successfully but could not confirm successful sensor detection as installation was run on vm testbed and this has no sesnors Testing on real hardware to confirm that sensors are detected and sensor-* directories correctly created in IPFire. - Changelog 3.6.0 (2019-10-18) configs: Added a number of new configuration files fancontrol: AVERAGE env variable can be used to set the number of previ> Makefile: The MACHINE variable has been renamed to ARCH sensord: Add an option -1/--oneline to print chip and adapter on the sa> sensors: Fixed a stray comma bug in the JSON output Fixed Fahrenheit conversion with raw and JSON output Scale voltage and current values in the default output format sensors-detect: Add detection of AMD Family 17h, models 30h, 70h Add detection of some AMD Family 15h models Add detection of AMD Family 16h model 30h power sensors Add detection of Hygon Family 18h thermal sensors Add detection of Nuvoton NCT6797D Add detection of Nuvoton NCT6798D Add detection of Nuvoton NCT6112D/NCT6114D/NCT6116D Fix printing CPU info on non-x86 arches Fix printing lm_sensors version Mark Fintek F75387SG/RG as supported by the f75375s dri> 3.5.0 (2018-11-23) Fixed disappearance of certain hwmon chips with 4.19+ kernels Add the find-driver script for debugging Various documentation and man page improvements Fix various issues found by Coverity Scan Fix compilation with the musl C library Development version string now contains "+git" instead of "+SVN" Updated links in documentation to reflect the new home of lm_sensors sensors.1: Add reference to sensors-detect Document -j option (json output) sensors: Add support for json output Add support for power min, lcrit, min_alarm, lcrit_alarm sensors-detect: Fix systemd paths Add detection of Fintek F81768 Only probe I/O ports on x86 Add detection of Nuvoton NCT6793D Add detection of Microchip MCP9808 Mark F71868A as supported by the f71882fg driver Mark F81768D as supported by the f71882fg driver Mark F81866D as supported by the f71882fg driver Add detection of various ITE chips Add detection of Nuvoton NCT6795D Add detection of DDR4 SPD Add detection of ITE IT8987D Add detection of AMD Family 17h temperature sensors Add detection of AMD KERNCZ SMBus controller Add detection of various Intel SMBus controllers Add detection of Giantec GT30TS00 Add detection of ONS CAT34TS02C and CAT34TS04 Add detection of AMD Family 15h Model 60+ temperature s> Add detection of Nuvoton NCT6796D Add detection of AMD Family 15h Model 70+ temperature s> configs: Add sample configuration files. sensors.conf.default: Add hardwired inputs of NCT6795D Add hardwired inputs of F71868A Add hardwired NCT6796D inputs vt1211_pwm: replaced deprecated sub shell syntax run with bash instead of sh pwmconfig: replaced deprecated sub shell syntax fancontrol: replaced deprecated sub shell syntax save original pwm values fancontrol.8: replaced deprecated sub shell syntax libsensors: Add support for SENSORS_BUS_TYPE_SCSI Add support for power min, lcrit, min_alarm, lcrit_alarm Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/aarch64/lm_sensors | 4 ++-- config/rootfiles/common/armv5tel/lm_sensors | 4 ++-- config/rootfiles/common/i586/lm_sensors | 4 ++-- config/rootfiles/common/x86_64/lm_sensors | 4 ++-- lfs/lm_sensors | 10 +++++----- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/config/rootfiles/common/aarch64/lm_sensors b/config/rootfiles/common/aarch64/lm_sensors index 1346047b9..f10ad80bd 100644 --- a/config/rootfiles/common/aarch64/lm_sensors +++ b/config/rootfiles/common/aarch64/lm_sensors @@ -7,8 +7,8 @@ usr/bin/sensors-conf-convert #usr/include/sensors/sensors.h #usr/lib/libsensors.a #usr/lib/libsensors.so -usr/lib/libsensors.so.4 -usr/lib/libsensors.so.4.4.0 +usr/lib/libsensors.so.5 +usr/lib/libsensors.so.5.0.0 #usr/man/man1/sensors.1 #usr/man/man3/libsensors.3 #usr/man/man5/sensors.conf.5 diff --git a/config/rootfiles/common/armv5tel/lm_sensors b/config/rootfiles/common/armv5tel/lm_sensors index 998b02e9f..52514f1ab 100644 --- a/config/rootfiles/common/armv5tel/lm_sensors +++ b/config/rootfiles/common/armv5tel/lm_sensors @@ -7,8 +7,8 @@ usr/bin/sensors-conf-convert #usr/include/sensors/sensors.h #usr/lib/libsensors.a usr/lib/libsensors.so -usr/lib/libsensors.so.4 -usr/lib/libsensors.so.4.4.0 +usr/lib/libsensors.so.5 +usr/lib/libsensors.so.5.0.0 #usr/man/man1/sensors.1 #usr/man/man3/libsensors.3 #usr/man/man5/sensors.conf.5 diff --git a/config/rootfiles/common/i586/lm_sensors b/config/rootfiles/common/i586/lm_sensors index 9936e0466..0f7461d4c 100644 --- a/config/rootfiles/common/i586/lm_sensors +++ b/config/rootfiles/common/i586/lm_sensors @@ -7,8 +7,8 @@ usr/bin/sensors-conf-convert #usr/include/sensors/sensors.h #usr/lib/libsensors.a usr/lib/libsensors.so -usr/lib/libsensors.so.4 -usr/lib/libsensors.so.4.4.0 +usr/lib/libsensors.so.5 +usr/lib/libsensors.so.5.0.0 #usr/man/man1/sensors.1 #usr/man/man3/libsensors.3 #usr/man/man5/sensors.conf.5 diff --git a/config/rootfiles/common/x86_64/lm_sensors b/config/rootfiles/common/x86_64/lm_sensors index 9936e0466..0f7461d4c 100644 --- a/config/rootfiles/common/x86_64/lm_sensors +++ b/config/rootfiles/common/x86_64/lm_sensors @@ -7,8 +7,8 @@ usr/bin/sensors-conf-convert #usr/include/sensors/sensors.h #usr/lib/libsensors.a usr/lib/libsensors.so -usr/lib/libsensors.so.4 -usr/lib/libsensors.so.4.4.0 +usr/lib/libsensors.so.5 +usr/lib/libsensors.so.5.0.0 #usr/man/man1/sensors.1 #usr/man/man3/libsensors.3 #usr/man/man5/sensors.conf.5 diff --git a/lfs/lm_sensors b/lfs/lm_sensors index 8403be6e0..42c55d6d6 100644 --- a/lfs/lm_sensors +++ b/lfs/lm_sensors @@ -24,10 +24,10 @@ include Config -VER = 3.4.0 +VER = 3-6-0 -THISAPP = lm_sensors-$(VER) -DL_FILE = $(THISAPP).tar.bz2 +THISAPP = lm-sensors-$(VER) +DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c03675ae9d43d60322110c679416901a +$(DL_FILE)_MD5 = f60e47b5eb50bbeed48a9f43bb08dd5e install : $(TARGET) @@ -72,7 +72,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && make PREFIX=/usr $(MAKETUNING) cd $(DIR_APP) && make PREFIX=/usr install @rm -rf $(DIR_APP) -- 2.31.1

2 6

[PATCH 1/3] rrdimage: Add scripts for new graph display method
by Leo-Andres Hofmann 15 Apr '21

15 Apr '21

This patch adds two scripts which will later be used to display graphs: -> getrrdimage.cgi: Generates PNG images for graphs. Until now, each CGI with embedded graphs had to be able to output images. These functions are now gathered in this new script. The additional parameter handling can be removed and the CGIs can be simplified. This makes it easier to use and output the graphs. -> rrdimage.js: Interactive Javascript functions This allows the user to select time ranges without reloading the page. In addition, the graphs are now periodically updated, allowing users to live monitor the data. Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- config/cfgroot/graphs.pl | 10 +- config/rootfiles/common/web-user-interface | 2 + html/cgi-bin/getrrdimage.cgi | 245 +++++++++++++++++++++ html/html/include/rrdimage.js | 122 ++++++++++ 4 files changed, 377 insertions(+), 2 deletions(-) create mode 100644 html/cgi-bin/getrrdimage.cgi create mode 100644 html/html/include/rrdimage.js diff --git a/config/cfgroot/graphs.pl b/config/cfgroot/graphs.pl index e4c3613fb..beddff032 100644 --- a/config/cfgroot/graphs.pl +++ b/config/cfgroot/graphs.pl @@ -29,6 +29,12 @@ require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +# Graph image size in pixel +our %image_size = ('width' => 910, 'height' => 300); + +# List of all available time ranges +our @time_ranges = ("hour", "day", "week", "month", "year"); + my $ERROR; my @GRAPH_ARGS = ( @@ -48,8 +54,8 @@ my @GRAPH_ARGS = ( "-W www.ipfire.org", # Default size - "-w 910", - "-h 300", + "-w $image_size{'width'}", + "-h $image_size{'height'}", # Use alternative grid "--alt-y-grid", diff --git a/config/rootfiles/common/web-user-interface b/config/rootfiles/common/web-user-interface index 540bf1e4b..23e9f3e5e 100644 --- a/config/rootfiles/common/web-user-interface +++ b/config/rootfiles/common/web-user-interface @@ -20,6 +20,7 @@ srv/web/ipfire/cgi-bin/extrahd.cgi srv/web/ipfire/cgi-bin/fireinfo.cgi srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/fwhosts.cgi +srv/web/ipfire/cgi-bin/getrrdimage.cgi srv/web/ipfire/cgi-bin/gpl.cgi #srv/web/ipfire/cgi-bin/guardian.cgi srv/web/ipfire/cgi-bin/gui.cgi @@ -300,6 +301,7 @@ srv/web/ipfire/html/images/view-refresh.png srv/web/ipfire/html/images/wakeup.gif srv/web/ipfire/html/images/window-new.png srv/web/ipfire/html/include +srv/web/ipfire/html/include/rrdimage.js srv/web/ipfire/html/include/zoneconf.js srv/web/ipfire/html/index.cgi srv/web/ipfire/html/redirect-templates diff --git a/html/cgi-bin/getrrdimage.cgi b/html/cgi-bin/getrrdimage.cgi new file mode 100644 index 000000000..0caefe0ac --- /dev/null +++ b/html/cgi-bin/getrrdimage.cgi @@ -0,0 +1,245 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2005-2021 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; +use URI; +use GD; +use GD::Text::Wrap; +use experimental 'smartmatch'; + +# debugging +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; +require "${General::swroot}/graphs.pl"; + +# List of graph origins that getrrdimage.cgi can process directly +# (unknown origins are forwarded to ensure compatibility) +my @supported_origins = ("entropy.cgi", "hardwaregraphs.cgi", "media.cgi", + "memory.cgi","netexternal.cgi", "netinternal.cgi", "netother.cgi", + "netovpnrw.cgi", "netovpnsrv.cgi", "qos.cgi", "system.cgi"); + +### Process GET parameters ### +# URL format: /?origin=[graph origin cgi]&graph=[graph name]&range=[time range] +my $uri = URI->new($ENV{'REQUEST_URI'}); +my %query = $uri->query_form; + +my $origin = lc $query{'origin'}; # lower case +my $graph = $query{'graph'}; +my $range = lc $query{'range'}; # lower case + +# Check parameters +unless(($origin =~ /^\w+?\.cgi$/) && ($graph =~ /^[\w-]+?$/) && ($range ~~ @Graphs::time_ranges)) { + # Send HTTP headers + _start_png_output(); + + _print_error("URL parameters missing or malformed."); + exit; +} + +# Unsupported graph origin: Redirect request to the CGI specified in the "origin" parameter +# This enables backwards compatibility with addons that use Graphs::makegraphbox to ouput their own graphs +unless($origin ~~ @supported_origins) { + # Rewrite to old URL format: /[graph origin cgi]?[graph name]?[time range] + my $location = "https://$ENV{'SERVER_NAME'}:$ENV{'SERVER_PORT'}/cgi-bin/${origin}?${graph}?${range}"; + + # Send HTTP redirect + print "Status: 302 Found\n"; + print "Location: $location\n"; + print "Content-type: text/html; charset=UTF-8\n"; + print "\n"; # End of HTTP headers + + print "Unsupported origin, request redirected to '$location'"; + exit; +} + +### Create graphs ### +# Send HTTP headers +_start_png_output(); + +# Graphs are first grouped by their origin. +# This is because some graph categories require special parameter handling. +my $graphstatus = ''; +if($origin eq "entropy.cgi") { ## entropy.cgi + $graphstatus = Graphs::updateentropygraph($range); +# ------ + +} elsif($origin eq "hardwaregraphs.cgi") { ## hardwaregraphs.cgi + if($graph eq "hwtemp") { + $graphstatus = Graphs::updatehwtempgraph($range); + } elsif($graph eq "hwfan") { + $graphstatus = Graphs::updatehwfangraph($range); + } elsif($graph eq "hwvolt") { + $graphstatus = Graphs::updatehwvoltgraph($range); + } elsif($graph eq "thermaltemp") { + $graphstatus = Graphs::updatethermaltempgraph($range); + } elsif($graph =~ "sd?") { + $graphstatus = Graphs::updatehddgraph($graph, $range); + } elsif($graph =~ "nvme?") { + $graphstatus = Graphs::updatehddgraph($graph, $range); + } else { + $graphstatus = "Unknown graph name."; + } +# ------ + +} elsif($origin eq "media.cgi") { ## media.cgi + if ($graph =~ "sd?" || $graph =~ "mmcblk?" || $graph =~ "nvme?n?" || $graph =~ "xvd??" || $graph =~ "vd?" || $graph =~ "md*" ) { + $graphstatus = Graphs::updatediskgraph($graph, $range); + } else { + $graphstatus = "Unknown graph name."; + } +# ------ + +} elsif($origin eq "memory.cgi") { ## memory.cgi + if($graph eq "memory") { + $graphstatus = Graphs::updatememorygraph($range); + } elsif($graph eq "swap") { + $graphstatus = Graphs::updateswapgraph($range); + } else { + $graphstatus = "Unknown graph name."; + } +# ------ + +} elsif($origin eq "netexternal.cgi") { ## netexternal.cgi + $graphstatus = Graphs::updateifgraph($graph, $range); +# ------ + +} elsif($origin eq "netinternal.cgi") { ## netinternal.cgi + if ($graph =~ /wireless/){ + $graph =~ s/wireless//g; + $graphstatus = Graphs::updatewirelessgraph($graph, $range); + } else { + $graphstatus = Graphs::updateifgraph($graph, $range); + } +# ------ + +} elsif($origin eq "netother.cgi") { ## netother.cgi + if($graph eq "conntrack") { + $graphstatus = Graphs::updateconntrackgraph($range); + } elsif($graph eq "fwhits") { + $graphstatus = Graphs::updatefwhitsgraph($range); + } else { + $graphstatus = Graphs::updatepinggraph($graph, $range); + } +# ------ + +} elsif($origin eq "netovpnrw.cgi") { ## netovpnrw.cgi + if($graph ne "UNDEF") { + $graphstatus = Graphs::updatevpngraph($graph, $range); + } else { + $graphstatus = "Unknown graph name."; + } +# ------ + +} elsif($origin eq "netovpnsrv.cgi") { ## netovpnsrv.cgi + if ($graph =~ /ipsec-/){ + $graph =~ s/ipsec-//g; + $graphstatus = Graphs::updateifgraph($graph, $range); + } else { + $graphstatus = Graphs::updatevpnn2ngraph($graph, $range); + } +# ------ + +} elsif($origin eq "qos.cgi") { ## qos.cgi + $graphstatus = Graphs::updateqosgraph($graph, $range); +# ------ + +} elsif($origin eq "services.cgi") { ## services.cgi + if($graph eq "processescpu") { + $graphstatus = Graphs::updateprocessescpugraph($range); + } elsif($graph eq "processesmemory") { + $graphstatus = Graphs::updateprocessesmemorygraph($range); + } else { + $graphstatus = "Unknown graph name."; + } +# ------ + +} elsif($origin eq "system.cgi") { ## system.cgi + if($graph eq "cpu") { + $graphstatus = Graphs::updatecpugraph($range); + } elsif($graph eq "cpufreq") { + $graphstatus = Graphs::updatecpufreqgraph($range); + } elsif($graph eq "load") { + $graphstatus = Graphs::updateloadgraph($range); + } else { + $graphstatus = "Unknown graph name."; + } +# ------ + +} else { + $graphstatus = "Unknown graph origin."; +} + +### Print error message ### +# Add request parameters for debugging +if($graphstatus) { + $graphstatus = "$graphstatus\n($origin, $graph, $range)"; + _print_error($graphstatus); +} + +###--- Internal functions ---### + +# Send HTTP headers and switch to binary output +# (don't print any non-image data to STDOUT afterwards) +sub _start_png_output { + print "Cache-Control: no-cache, no-store\n"; + print "Content-Type: image/png\n"; + print "\n"; # End of HTTP headers + binmode(STDOUT); +} + +# Print error message to PNG output +sub _print_error { + my ($message) = @_; + $message = "- Error -\n \n$message"; + + # Create new image with the same size as a graph + my $img = GD::Image->new($Graphs::image_size{'width'}, $Graphs::image_size{'height'}); + $img->interlaced('true'); + + # Basic colors + my $color_background = $img->colorAllocate(255, 255, 255); + my $color_border = $img->colorAllocate(255, 0, 0); + my $color_text = $img->colorAllocate(0, 0, 0); + + # Background and border + $img->setThickness(2); + $img->filledRectangle(0, 0, $img->width, $img->height, $color_background); + $img->rectangle(10, 10, $img->width - 10, $img->height - 10, $color_border); + + # Draw message with line-wrap + my $textbox = GD::Text::Wrap->new($img, + text => $message, + width => ($img->width - 50), + color => $color_text, + align => 'center', + line_space => 5, + preserve_nl => 1 + ); + $textbox->set_font(gdLargeFont); + $textbox->draw(25, 25); + + # Get PNG output + print $img->png; +} diff --git a/html/html/include/rrdimage.js b/html/html/include/rrdimage.js new file mode 100644 index 000000000..e7ee4c769 --- /dev/null +++ b/html/html/include/rrdimage.js @@ -0,0 +1,122 @@ +/*############################################################################# +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +#############################################################################*/ + +// "onclick" event handler for graph time range select button +// buttonObj: reference to the button +function rrdimage_selectRange(buttonObj) { + if(! (buttonObj && ('range' in buttonObj.dataset))) { + return; //required parameters are missing + } + + // Get selected time range from button + const range = buttonObj.dataset.range; + + // Get surrounding div box and select new range + let graphBox = $(buttonObj).closest('div'); + _rrdimg_setRange(graphBox, range); +} + +// Document loaded: Process all graphs, start reload timers +$(function() { + $('div.rrdimage').each(function() { + let graphBox = $(this); + _rrdimg_setRange(graphBox, graphBox.data('defaultRange'), true); + }); +}); + +//--- Internal functions --- + +// Set or update graph time range, start automatic reloading +// graphBox: jQuery object, reference to graph div box +// range: time range (day, hour, ...) +// initMode: don't immediately reload graph, but force timers and attributes update +function _rrdimg_setRange(graphBox, range, initMode = false) { + if(! ((graphBox instanceof jQuery) && (graphBox.length === 1))) { + return; //graphBox element missing + } + + // Check range parameter, default to "day" on error + if(! ["hour", "day", "week", "month", "year"].includes(range)) { + range = "day"; + } + + // Check if the time range is changed + if((graphBox.data('range') !== range) || initMode) { + graphBox.data('range', range); //Store new range + + // Update button highlighting + graphBox.find('button').removeClass('selected'); + graphBox.find(`button[data-range="${range}"]`).addClass('selected'); + } + + // Clear pending reload timer to prevent multiple image reloads + let timerId = graphBox.data('reloadTimer'); + if(timerId !== undefined) { + window.clearInterval(timerId); + graphBox.removeData('reloadTimer'); + } + + // Determine auto reload interval (in seconds), + // interval = 0 disables auto reloading by default + let interval = 0; + switch(range) { + case 'hour': + interval = 60; + break; + + case 'day': + case 'week': + interval = 300; + break; + } + + // Start reload timer and store reference + if(interval > 0) { + timerId = window.setInterval(function(graphRef) { + _rrdimg_reload(graphRef); + }, interval * 1000, graphBox); + graphBox.data('reloadTimer', timerId); + } + + // Always reload image unless disabled by init mode + if(! initMode) { + _rrdimg_reload(graphBox); + } +} + +// Reload graph image, add timestamp to prevent caching +// graphBox: jQuery object (graph element must be valid) +function _rrdimg_reload(graphBox) { + const origin = graphBox.data('origin'); + const graph = graphBox.data('graph'); + const timestamp = Date.now(); + + // Get user selected range or fall back to default + let range = graphBox.data('range'); + if(! range) { + range = graphBox.data('defaultRange'); + } + + // Generate new image URL with timestamp + const imageUrl = `/cgi-bin/getrrdimage.cgi?origin=${origin}&graph=${graph}&range=${range}&timestamp=${timestamp}`; + + // Get graph image and set new URL + graphBox.children('img').first().attr('src', imageUrl); +} -- 2.27.0.windows.1

7 18

IDS with support for multiple ruleset providers
by Stefan Schantl 15 Apr '21

15 Apr '21

Hello Development Team and list followers, there are a lot of different vendors out there which offers different IDS rules for suricata. Some of them offers a complete set of rules and other ones some very specialized rules for different tasks. Unfortunately it only was possible to select only one ruleset provider at the same time, so it usually wasn't an option to use one of them and keep a lot of traffic uninspected by the IDS. Today I'm very happy to announce a testing version of a reworked Intrusion Detection System which supports the usage of multiple different providers and rulesets at the same time. In total up to 15 different ruleset providers now can be used and mixed together to fit your personal requirements. They easily can be managed and configured via the WUI. Of course each one individually can be disabled or re-enabled at each time. The section for customizing the entire ruleset has been moved to a subpage, which allows to enable a certain amount of ruleset files or enabling / disabling single rules inside them. This helps to speed up the CGI if you want to mange your whitelist, manage your ruleset providers or change basic settings of your IDS. If you liked this short introduction, please help us testing to get this cool stuff as soon as possible into the core distribution and to find bugs or other improvements. The test versions and some screenshots can be found here: https://people.ipfire.org/~stevee/ids-multiple-providers/ To join testing, please download the latest tarball and place it on your IPFire test machine. Execute the archive by using "tar -xvf ids-multiple-providers- XXX.tar.gz - C /" on your local console or via SSH remote session. The next steps would be to regenerate the language cache by executing "update-langs-cache" and to launch "convert-ids-multiple-providers". The converter will convert all your existing settings into the new format and also will take care about your used rules and their settings. As usual, please report back any kind of feedback on this list and submit any found bugs to our bugtracker (https://bugs.ipfire.org). Thanks in advance, -Stefan

3 20

← Newer
1
...
4
5
6
7
8
9
10
...
17
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2021