Development July 2021

development@lists.ipfire.org

12 participants
102 discussions

[PATCH] firewall.cgi: Bring back check for single IP when using DNAT.
by Stefan Schantl 05 Aug '21

05 Aug '21

This check has been removed by commit: bbe8e009b824aef745c9ab9718dce9a1b557f5fc So it was able to create DNAT rules with a network as target. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/firewall.cgi | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index e168788eb..b328b426c 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -569,6 +569,24 @@ sub checktarget #check DNAT settings (has to be single Host and single Port or portrange) if ($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat'){ if($fwdfwsettings{'grp2'} eq 'tgt_addr' || $fwdfwsettings{'grp2'} eq 'cust_host_tgt' || $fwdfwsettings{'grp2'} eq 'ovpn_host_tgt'){ + # Check if a manual entered IP is a single Host (if set) + if ($fwdfwsettings{'grp2'} eq 'tgt_addr') { + # Split input into address and prefix (if provided). + my ($address, $subnet) = split ('/', $fwdfwsettings{$fwdfwsettings{'grp2'}}); + + # Check if a subnet is given. + if ($subnet) { + # Check if the prefix or subnetmask is for a single host. + unless ($subnet eq "32" || $subnet eq "255.255.255.255") { + # Set error message. + $errormessage=$Lang::tr{'fwdfw dnat error'}."<br>"; + + # Return the error. + return $errormessage; + } + } + } + #check if Port is a single Port or portrange if ($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT'){ if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){ -- 2.30.2

2 1

[PATCH] igmpproxy: Update to version 0.3
by Adolf Belka 05 Aug '21

05 Aug '21

- Update from 0.2.1 to 0.3 - Update of rootfile not required - Changelog 2021-01-04 18:40:01 +0100 Pali Rohár <pali.rohar(a)gmail.com> * Release version 0.3 2020-09-05 13:52:50 +0200 Pali Rohár <pali.rohar(a)gmail.com> * Remove duplicate code in mcgroup.c file Existing functionality is provided by k_join and k_leave functions. 2020-09-05 13:07:38 +0200 Pali Rohár <pali.rohar(a)gmail.com> * Fix initialization and deinitialization of mrouter socket Ensure that uninitialized socket is invalid (-1) and not stdin (0). 2020-09-05 13:07:00 +0200 Pali Rohár <pali.rohar(a)gmail.com> * Use main mrouter socket also for sending join/leave messages to upstream router There is no need to open additional UDP socket which is used just for calling IP_ADD_MEMBERSHIP/IP_DROP_MEMBERSHIP setsockopt. Main mrouter socket is can be used for these operations too. 2020-05-20 09:59:11 +0200 Uglymotha <uglymotha(a)wizdom.nu> * Free BSD Compilation Patch On FreeBSD compilation failed due to missing includes in os-freebsd.h. This was causing errors about undefined structs and types in missing includes. Also defines __BSD_VISIBLE due to FreeBSD not providing u_int, u_long etc in a default _POSIX_C_SOURCE environment. Fixes: https://github.com/pali/igmpproxy/issues/68 2020-05-08 22:54:06 +0200 Pali Rohár <pali.rohar(a)gmail.com> * Remove MAX_MC_VIFS macro Its value is same as MAXVIFS, so use MAXVIFS instead. 2020-03-06 11:51:21 +0100 Pali Rohár <pali.rohar(a)gmail.com> * Improve downstream host tracking for quickleave mode Use bit based per multicast route hash table for tracking downstream hosts. For hasing function is used 32bit MurmurHash3 with pseudorandom seed and size of hash table can be configured via a new "hashtablesize" token in config file. Default size of hash table is 32 bytes, so it can store approximatelly 128 hosts which is half of /24 subnet. For home networks this should be sane default value. Fixes: https://github.com/pali/igmpproxy/pull/57 2020-02-26 20:27:08 +0100 Pali Rohár <pali.rohar(a)gmail.com> * Show error message when IP_ADD_MEMBERSHIP fails with errno ENOBUFS Also on Linux show hint how to increase maximum number of multicast groups. Fixes: https://github.com/pali/igmpproxy/issues/30 2020-02-25 23:46:57 +0100 Pali Rohár <pali.rohar(a)gmail.com> * Fix gcc-7 and clang-9 on Travis 2020-02-25 23:24:26 +0100 Pali Rohár <pali.rohar(a)gmail.com> * Update Travis config file 2019-06-26 17:42:15 +0200 Pali Rohár <pali.rohar(a)gmail.com> * Use AS_IF macro for C99 check in configure.ac 2018-09-30 00:28:05 +0200 Pali Rohár <pali.rohar(a)gmail.com> * Fix makefile rules for generating AUTHORS and ChangeLog files 2018-02-13 20:17:30 +0100 Pali Rohár <pali.rohar(a)gmail.com> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/igmpproxy | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/igmpproxy b/lfs/igmpproxy index c32d519b9..bd6407bdc 100644 --- a/lfs/igmpproxy +++ b/lfs/igmpproxy @@ -24,7 +24,7 @@ include Config -VER = 0.2.1 +VER = 0.3 THISAPP = igmpproxy-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = igmpproxy -PAK_VER = 5 +PAK_VER = 6 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3a9c2cb42c1f5ee0cb769a4884545641 +$(DL_FILE)_MD5 = 5565874d9631103109a72452cecb5ce7 install : $(TARGET) -- 2.32.0

2 3

[PATCH v2 1/8] make.sh: Remove crda and remaining python2 modules
by Adolf Belka 04 Aug '21

04 Aug '21

- crda only works with python2 version of m2crypto python-m2crypto requires python-setuptools and python-typing - With Linux kernel 4.15 and later the country code status check that crda did is built into the kernel. - So from kernel 4.15, crda can be removed, which allows removal of m2crypto, setuptools and typing. - python-typing is built into python3 so no additional python3 module required. - python3 version of python-setuptools has already been installed. - python3 version of python-m2crypto is not required. python-m2crypto is only used for the build of crda. - ipaddr can be removed as the function of this python2 module is built into python3 with ipaddress.py - removal of crda tested with 5.10.45 kernel and the setting of a country code was recognised. If this test carried out with crda removed and 4.14.232 kernel then country code stays defined as the global code "00". Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- make.sh | 5 ----- 1 file changed, 5 deletions(-) diff --git a/make.sh b/make.sh index 13a48f461..57b83e432 100755 --- a/make.sh +++ b/make.sh @@ -1296,7 +1296,6 @@ buildipfire() { lfsmake2 whatmask lfsmake2 libtirpc lfsmake2 conntrack-tools - lfsmake2 ipaddr lfsmake2 iputils lfsmake2 l7-protocols lfsmake2 hwdata @@ -1333,7 +1332,6 @@ buildipfire() { lfsmake2 XML-Parser lfsmake2 Crypt-PasswdMD5 lfsmake2 Net-Telnet - lfsmake2 python-setuptools lfsmake2 python3-setuptools lfsmake2 python3-inotify lfsmake2 python3-docutils @@ -1517,10 +1515,7 @@ buildipfire() { lfsmake2 swig lfsmake2 u-boot lfsmake2 u-boot-friendlyarm - lfsmake2 python-typing - lfsmake2 python-m2crypto lfsmake2 wireless-regdb - lfsmake2 crda lfsmake2 libsolv lfsmake2 ddns lfsmake2 python3-setuptools-scm -- 2.32.0

2 10

jwhois appears to be no longer maintained
by Peter Müller 04 Aug '21

04 Aug '21

Hello development folks, looking at it's Git repository (https://github.com/jonasob/jwhois), jwhois does not seem to be maintained anymore. It's last commit currently dates November 20th, 2015, while the latest release was tagged on July 10th, 2005. Debian switched to another WHOIS client (https://github.com/rfc1036/whois), being far more actively maintained than jwhois (see also: https://packages.debian.org/buster/whois). From my point of view, we should to as well. Since I am currently short on spare time: Is someone volounteering to do this for me? Whoever it will be, thank you. :-) Thanks, and best regards, Peter Müller

3 4

[PATCH] network-functions.pl: Improve wifi_get_link_quality
by Leo-Andres Hofmann 04 Aug '21

04 Aug '21

iwconfig doesn't return values for "Link Quality" if the interface is disconnected, causing a division by zero error. If there are odd values, the resulting percentage may contain many decimal places. This patch makes wifi_get_link_quality return zero instead of failing and rounds the percentage to a more meaningful integer. Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- config/cfgroot/network-functions.pl | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index b7a840559..c0abc76b5 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -403,7 +403,11 @@ sub wifi_get_link_quality($) { my ($cur, $max) = $status =~ /Link Quality=(\d+)\/(\d+)/; - return $cur * 100 / $max; + if($max > 0) { + return sprintf('%.0f', ($cur * 100) / $max); + } + + return 0; } sub wifi_get_signal_level($) { -- 2.27.0.windows.1

2 1

[RFC PATCH] initscripts: Add switch to start processes in background
by Michael Tremer 04 Aug '21

04 Aug '21

Since systemd, many programs no longer behave like a well-behaved daemon. To avoid any extra solutions, this patch adds a -b switch which will start a program in the background and throw away any output. The behaviour remains unchanged for any other programs. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/initscripts/system/functions | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/initscripts/system/functions b/src/initscripts/system/functions index d610a524d..e44a2b4a1 100644 --- a/src/initscripts/system/functions +++ b/src/initscripts/system/functions @@ -436,6 +436,7 @@ getpids() #******************************************************************************* loadproc() { + local background="" local pidfile="" local forcestart="" local nicelevel="" @@ -448,6 +449,10 @@ loadproc() while true do case "${1}" in + -b) + background="1" + shift 1 + ;; -f) forcestart="1" shift 1 @@ -506,8 +511,16 @@ loadproc() cmd="nice -n "${nicelevel}" ${cmd}" fi - ${cmd} - evaluate_retval # This is "Probably" not LSB compliant, but required to be compatible with older bootscripts + if [ -n "${background}" ]; then + ( + ${cmd} &>/dev/null + ) & + evaluate_retval + else + ${cmd} + evaluate_retval # This is "Probably" not LSB compliant, but required to be compatible with older bootscripts + fi + return 0 } -- 2.20.1

2 2

[PATCH] qos.cgi: Fix truncated status output
by Stefan Schantl 04 Aug '21

04 Aug '21

In the past only the fist line of the status output has been passed to the cleanhtml() function and displayed. Now the whole output will be converted to a string, cleaned and displyed on the WUI again. Fixes #12666. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/qos.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/qos.cgi b/html/cgi-bin/qos.cgi index fa566b523..d768f95f5 100644 --- a/html/cgi-bin/qos.cgi +++ b/html/cgi-bin/qos.cgi @@ -543,7 +543,7 @@ elsif ($qossettings{'ACTION'} eq $Lang::tr{'status'} ) if ($qossettings{'ENABLED'} eq 'on'){ my $output = ""; my @output = &General::system_output("/usr/local/bin/qosctrl", "status"); - $output = &Header::cleanhtml(@output[0],"y"); + $output = &Header::cleanhtml(join("", @output), "y"); print "<pre>$output</pre>\n"; } else { print "$Lang::tr{'QoS not enabled'}"; } &Header::closebox(); -- 2.30.2

3 2

[PATCH] monit: Update to 5.28.1
by Matthias Fischer 04 Aug '21

04 Aug '21

For details see: https://mmonit.com/monit/changes/ New: Issue #979: If filesystem mount flags changed, show both old and new value. Originally only the new value was reported. Fixed: Issue #960: The memory usage may report wrong value if system memory size changed after Monit start. The problem was frequent on KVM/LXC containers where MemTotal is dynamicaly updated. Fixed: Issue #965: Monit CLI: if a custom configuration file was used with the -c option, and the file cannot be read by Monit, an AssertException was thrown. Monit will report normal error instead of the exception now. Fixed: Issue #966: Monit CLI: The service name pattern was changed to case-sensitive in Monit 5.28.0. Revert the behaviour back to case-insensitive. Fixed: Issue #971: The LINK UP and LINK DOWN tests now support short form of the optional ELSE condition, in addition to the verbose ELSE IF <SUCCEEDED|FAILED> form. Fixed: Issue #976: The space free test recovery always reported value in percent, regardless of the test setting. If the test uses absolute limit, Monit will report absolute space usage now. Fixed: Issue #986: Services checks with custom schedule (the EVERY statement) did set the data collection timestamp even if the monitoring was skipped in the given cycle. The timestamp is now updated only when the check was performed. Fixed: Issue #990: Monit built with libressl may crash during verification of the expired SSL certificate. Fixed: Issue #968: Systemd and upstart templates: templates used to set the path to the configuration file in the sysconfdir, which is optionally set via the configure script during the compilation. The path wasn't fully expanded in the template though, so it was invalid. The template doesn't specify the explicit path now and lets Monit search for the configuration file in all supported locations (including the sysconfdir). Changed: Issue #984: The permission check of the SSL PEM key file allows group read permissions now (originally Monit enforced that the file is readable only by the file owner). Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/monit | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/monit b/lfs/monit index 3720995cd..06306eb8f 100644 --- a/lfs/monit +++ b/lfs/monit @@ -24,7 +24,7 @@ include Config -VER = 5.28.0 +VER = 5.28.1 THISAPP = monit-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = monit -PAK_VER = 14 +PAK_VER = 15 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 778ac383dea002a5cf2330dffcc65660 +$(DL_FILE)_MD5 = 832783145cbd523bd6bc2c36e0e5c052 install : $(TARGET) -- 2.18.0

2 1

ClamAV 0.104.0 Release Candidate
by Matthias Fischer 04 Aug '21

04 Aug '21

Hi, ClamAV will be updated to 0.104.0 in the next "about two or four weeks", see: https://blog.clamav.net/2021/07/clamav-01040-release-candidate-is-here.html To be prepared, I tried "to verify that [you] 0.104.0 can [be] build and run in your environment". Interesting problem, because "As of ClamAV 0.104, CMake is required to build ClamAV." So first I tried to find out which 'cmake' commands are needed to build 0.104.0 the same way as 0.103 (hopefully) and started building, based on Core 158. But I always got the following errors from 'frr 6.0', no chance: ***SNIP*** frr (6.0) [ 19 ][ FAIL ] 5405 | bool all_vrf = FALSE; | ^~~~~ ospfd/ospf_vty.c: In function 'show_ip_ospf_database_max': ospfd/ospf_vty.c:6288:17: error: 'FALSE' undeclared (first use in this function) 6288 | bool all_vrf = FALSE; | ^~~~~ ospfd/ospf_vty.c: In function 'show_ip_ospf_instance_database': ospfd/ospf_vty.c:6345:17: error: 'FALSE' undeclared (first use in this function) 6345 | bool all_vrf = FALSE; | ^~~~~ ospfd/ospf_vty.c: In function 'show_ip_ospf_instance_database_type_adv_router': ospfd/ospf_vty.c:6495:17: error: 'FALSE' undeclared (first use in this function) 6495 | bool all_vrf = FALSE; | ^~~~~ ospfd/ospf_vty.c: In function 'show_ip_ospf_border_routers': ospfd/ospf_vty.c:9263:17: error: 'FALSE' undeclared (first use in this function) 9263 | bool all_vrf = FALSE; | ^~~~~ ospfd/ospf_vty.c: In function 'show_ip_ospf_route': ospfd/ospf_vty.c:9389:17: error: 'FALSE' undeclared (first use in this function) 9389 | bool all_vrf = FALSE; | ^~~~~ make[3]: *** [Makefile:3951: ospfd/ospf_vty.o] Error 1 make[3]: *** Waiting for unfinished jobs.... make[3]: Leaving directory '/usr/src/frr-6.0' make[2]: *** [Makefile:4627: all-recursive] Error 1 make[2]: Leaving directory '/usr/src/frr-6.0' make[1]: *** [Makefile:2047: all] Error 2 make[1]: Leaving directory '/usr/src/frr-6.0' make: *** [frr:84: /usr/src/log/frr-6.0] Error 2 ***SNAP** Then I tried with current 'next / Core 159' (25.7.2021) and build went through. No errors. Questions and thoughts: - Could "someone" please check my 'cmake' changes - are they ok this way? Please see attached lfs and rootfile for 0.104.0. - I couldn't test with arm so I disabled this lfs part for now: ***SNIP*** #ifeq "$(BUILD_PLATFORM)" "arm" #CONFIGURE_FLAGS = --disable-fanotify #endif # ***SNAP*** - When do we plan to ship Core 159? If the final ClamAV 0.104.0 comes out, I would like to update ClamaV as soon as possible, but at the moment, I have no clue how to build 0.104.0 with Core 158 and 'frr 6.0'. - They're planning (starting with 0.103 or 0.104.0? as) a LTS feature release: => https://lists.clamav.net/pipermail/clamav-users/2021-July/011676.html What do we think of this...? ;-) Best, Matthias

2 1

[PATCH] bird: Update to version 2.0.8
by Adolf Belka 02 Aug '21

02 Aug '21

- Update from 2.0.7 to 2.0.8 - Update of rootfile not required - Changelog Version 2.0.8 (2021-03-18) o Automatic channel reloads based on RPKI changes o Multiple static routes with the same network o Use bitmaps to keep track of exported routes o Per-channel debug flags o CLI commands show info from multiple protocols o Linux: IPv4 routes with IPv6 nexthops o Filter: Optimized redesign of prefix sets o Filter: Improved type checking of user filters o Filter: New src/dst accessors for Flowspec and SADR o Filter: New 'weight' route attribute o Filter: BGP path mask loop operator o Filter: Remove quitbird command o RIP: Demand circuit support (RFC 2091) o BGP: New 'allow as sets' and 'enforce first as' options o BGP: Support for BGP hostname capability o BGP: Support for MD5SIG with dynamic BGP o BFD: Optional separation of IPv4 / IPv6 BFD instances o BFD: Per-peer session options o RPKI: Allow build without libSSH o RPKI: New 'ignore max length' option o OSPF: Redesign of handling of unnumbered PtPs o OSPF: Allow key id 0 in authentication o Babel: Use onlink flag for routes with unreachable next hop o Many bugfixes Notes: Automatic channel reloads based on RPKI changes are enabled by default, but require import table enabled when used in BGP import filter. BIRD now uses bitmaps to keep track of exported routes instead of re-evaluation of export filters. That should improve speed and accuracy in route export handling during reconfiguration, but takes some more memory. Per-channel debug logging and some CLI commands (like 'show ospf neighbors') defaulting to all protocol instances lead to some minor changes in log and CLI output. Caution is recommended when logs or CLI output are monitored by scripts. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/bird | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/bird b/lfs/bird index ee1829907..a57e745a5 100644 --- a/lfs/bird +++ b/lfs/bird @@ -24,7 +24,7 @@ include Config -VER = 2.0.7 +VER = 2.0.8 THISAPP = bird-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = bird -PAK_VER = 7 +PAK_VER = 8 DEPS = @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = dc884bbe5905578e452f28158700527c +$(DL_FILE)_MD5 = d807bdb34b27fe15ba8b71e83474eb27 install : $(TARGET) -- 2.32.0

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2021