Development July 2021

development@lists.ipfire.org

12 participants
102 discussions

[PATCH] README: Update installation URL
by Michael Tremer 19 Jul '21

19 Jul '21

Reported-by: Konrad Panzlaff <konrad.panzlaff(a)pa-bu.de> Fixes: #12661 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/cdrom/README.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/cdrom/README.txt b/config/cdrom/README.txt index e342bc401..e42df6744 100644 --- a/config/cdrom/README.txt +++ b/config/cdrom/README.txt @@ -5,10 +5,11 @@ Installation ------------ Please read the IPFire Installation manual before installing the firewall. -This document is located on our wiki (http://wiki.ipfire.org/en/installation/start) +This document is located on our wiki (https://wiki.ipfire.org/installation) It will guide you through the installation process and will help you make the necessary decisions during the installation process. + License ------- -- 2.20.1

1 0

[PATCH] firewall.cgi: Map rule if manual target address belongs to IPFire
by Stefan Schantl 17 Jul '21

17 Jul '21

Automatically map the rule target if a manual entered target address is assigned to a network zone. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/firewall.cgi | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index e50a98179..e168788eb 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -213,6 +213,7 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') &General::readhasharray("$configfwdfw", \%configfwdfw); &General::readhasharray("$configinput", \%configinputfw); &General::readhasharray("$configoutgoing", \%configoutgoingfw); + &General::readhash("/var/ipfire/ethernet/settings", \%netsettings); my $maxkey; #Set Variables according to the JQuery code in protocol section if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') @@ -231,6 +232,38 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') { $fwdfwsettings{'USESRV'} = 'ON'; } + + # Check if a manual target IP is one of the IPFire's addresses. + if ($fwdfwsettings{'grp2'} eq 'tgt_addr') { + # Grab all available network zones. + my @network_zones = &Network::get_available_network_zones(); + + # Loop through the array of network zones. + foreach my $zone (@network_zones) { + # Skip red network zone. + next if $zone eq "red"; + + # Convert current zone name into upper case. + $zone = uc($zone); + + # Generate key to access the required data from the netsettings hash. + my $key = $zone . "_ADDRESS"; + + # Obtain the configured address for the current zone from the netsettings hash. + my $zone_address = $netsettings{$key}; + + # Check if the given address and the current processed zone address are the same. + if ($fwdfwsettings{$fwdfwsettings{'grp2'}} eq $zone_address) { + # Map the type and target. + $fwdfwsettings{'grp2'} = 'ipfire'; + $fwdfwsettings{$fwdfwsettings{'grp2'}} = $zone; + + # End loop. + last; + } + } + } + $errormessage=&checksource; if(!$errormessage){&checktarget;} if(!$errormessage){&checkrule;} -- 2.30.2

2 1

[PATCH] firewall.cgi: Allow to creating input rules from Orange to another zone.
by Stefan Schantl 17 Jul '21

17 Jul '21

It was not able to create a firewall rule from the orange network to a different network address of the firewall. ( For example: Orange -> IPFire's green address) These rules always have been handled as FORWARD rules which is totaly wrong. Fixes #12265. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Tested-by: Peter Müller <peter.mueller(a)ipfire.org> --- html/cgi-bin/firewall.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 70dee8d3c..e50a98179 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -247,7 +247,7 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') $errormessage=$Lang::tr{'fwdfw err same'}; } # INPUT part - if ($fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE'){ + if ($fwdfwsettings{'grp2'} eq 'ipfire') { $fwdfwsettings{'config'}=$configinput; $fwdfwsettings{'chain'} = 'INPUTFW'; $maxkey=&General::findhasharraykey(\%configinputfw); -- 2.30.2

2 1

Re: [PATCH] BUG12301: Iptables “host/network ‘none’ not found”
by Michael Tremer 16 Jul '21

16 Jul '21

Hello, > On 12 Apr 2021, at 11:23, Alexander Marx <alexander.marx(a)ipfire.org> wrote: > > > > Am 12.04.21 um 12:18 schrieb Michael Tremer: >> Hi, >> >>> On 12 Apr 2021, at 07:05, Alexander Marx <alexander.marx(a)ipfire.org> wrote: >>> >>> Fixes: #12301 >>> >>> When using hosts with MAC-addresses in a hostgroup, >>> the rule won't be generated if those hosts are selected as target. >>> There is a hint but due to a wrong hashparameter the hint was not shown. >>> >>> With this patch the hint is shown again. >>> Additionally the rule is skipped when rules.pl creates rules. >>> >>> There are no bootmessages with failed target "none" anymore. >>> --- >>> config/firewall/firewall-lib.pl | 4 ++-- >>> html/cgi-bin/firewall.cgi | 2 +- >>> 2 files changed, 3 insertions(+), 3 deletions(-) >>> >>> diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl >>> index bc0b30ca5..e7ec30ae0 100644 >>> --- a/config/firewall/firewall-lib.pl >>> +++ b/config/firewall/firewall-lib.pl >>> @@ -2,7 +2,7 @@ >>> ############################################################################### >>> # # >>> # IPFire.org - A linux based firewall # >>> -# Copyright (C) 2013 Alexander Marx <amarx(a)ipfire.org> # >>> +# Copyright (C) 2021 Alexander Marx <amarx(a)ipfire.org> # >>> # # >>> # This program is free software: you can redistribute it and/or modify # >>> # it under the terms of the GNU General Public License as published by # >>> @@ -315,7 +315,7 @@ sub get_addresses >>> foreach my $grp (sort {$a <=> $b} keys %customgrp) { >>> if ($customgrp{$grp}[0] eq $value) { >>> my @address = &get_address($customgrp{$grp}[3], $customgrp{$grp}[2], $type); >>> - >>> + next if ($address[0][0] eq 'none'); >> A comment for these rather obscure things would not hurt, but technically I agree with how this is solved. >> >> >> >>> if (@address) { >>> push(@addresses, @address); >>> } >>> diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi >>> index 1483e779f..b0851dd3e 100644 >>> --- a/html/cgi-bin/firewall.cgi >>> +++ b/html/cgi-bin/firewall.cgi >>> @@ -592,7 +592,7 @@ sub checktarget >>> &General::readhasharray("$confighost", \%customhost); >>> foreach my $grpkey (sort keys %customgrp){ >>> foreach my $hostkey (sort keys %customhost){ >>> - if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customgrp{$grpkey}[2] eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $customhost{$hostkey}[1] eq 'mac'){ >>> + if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customgrp{$grpkey}[0] eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $customhost{$hostkey}[1] eq 'mac'){ >> What has changed here? > only the hashfield > > $customgrp{$grpkey}[0] (was 2 before) Yes I saw that, but what does that change? -Michael P.S. Do not forget to CC the list > >> >>> $hint=$Lang::tr{'fwdfw hint mac'}; >>> return $hint; >>> } >>> — >>> 2.25.1 >>> >> Best, >> -Michael

3 2

[PATCH 1/2] mountkernfs: Mount cgroup2 hierarchy
by Michael Tremer 16 Jul '21

16 Jul '21

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/initscripts/system/mountkernfs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/mountkernfs index f0bfc5289..264da24c4 100644 --- a/src/initscripts/system/mountkernfs +++ b/src/initscripts/system/mountkernfs @@ -34,6 +34,11 @@ case "${1}" in mount -n -t tmpfs -o nosuid,nodev,mode=755,size=8M /run /run || failed=1 fi + if ! mountpoint /sys/fs/cgroup &> /dev/null; then + boot_mesg -n " /sys/fs/cgroup" ${NORMAL} + mount -t cgroup2 none /sys/fs/cgroup || failed=1 + fi + # create folder for dhcpcd changeroot mkdir -p /run/dhcpcd/chroot chown dhcpcd:dhcpcd /run/dhcpcd/chroot -- 2.20.1

1 1

[PATCH 1/2] pmacct: Patch file to allow build to work with GCC 11
by Adolf Belka 16 Jul '21

16 Jul '21

- Created pmacct-1.7.6-Werror.patch to remove -Werror flags from the configure This was flagging up warnings as errors and stopping the build - Removed the SUP_ARCH line to allow it to build again - No update required to the rootfile Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/pmacct | 17 ++++++------ src/patches/pmacct-1.7.6-Werror.patch | 38 +++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 8 deletions(-) create mode 100644 src/patches/pmacct-1.7.6-Werror.patch diff --git a/lfs/pmacct b/lfs/pmacct index 5674ecc1b..2307f8c87 100644 --- a/lfs/pmacct +++ b/lfs/pmacct @@ -32,9 +32,8 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = pmacct -PAK_VER = 1 +PAK_VER = 2 -SUP_ARCH = none DEPS = libcdada @@ -79,13 +78,15 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && rm configure + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/pmacct-1.7.6-Werror.patch cd $(DIR_APP) && ./autogen.sh - cd $(DIR_APP) && ./configure \ - --prefix=/usr \ - --sysconfdir=/etc/pmacct \ - --enable-sqlite3 \ - --enable-l2 \ - --enable-jansson + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --sysconfdir=/etc/pmacct \ + --enable-sqlite3 \ + --enable-l2 \ + --enable-jansson # Add directory for plugins and pipes -mkdir -v /var/spool/pmacct # Add configuration folder and copy conf file to it diff --git a/src/patches/pmacct-1.7.6-Werror.patch b/src/patches/pmacct-1.7.6-Werror.patch new file mode 100644 index 000000000..57bb7d1ff --- /dev/null +++ b/src/patches/pmacct-1.7.6-Werror.patch @@ -0,0 +1,38 @@ +--- pmacct-1.7.6/configure.ac.orig 2021-02-05 02:07:36.000000000 +0100 ++++ pmacct-1.7.6/configure.ac 2021-07-15 19:58:37.247916727 +0200 +@@ -1153,9 +1153,9 @@ AC_ARG_ENABLE(debug, + AC_MSG_RESULT(yes) + tmp_CFLAGS=`echo $CFLAGS | sed 's/O2/O0/g'` + CFLAGS="$tmp_CFLAGS" +- CFLAGS="$CFLAGS -g -Wall -Werror" ++ CFLAGS="$CFLAGS -g -Wall" + else +- CFLAGS="$CFLAGS -Wall -Werror" ++ CFLAGS="$CFLAGS -Wall" + AC_MSG_RESULT(no) + fi + ], + + +--- pmacct-1.7.6/src/external_libs/libcdada/configure.ac.orig 2021-02-07 16:29:15.000000000 +0100 ++++ pmacct-1.7.6/src/external_libs/libcdada/configure.ac 2021-07-16 09:04:30.858749121 +0200 +@@ -4,7 +4,7 @@ AC_INIT(LIBCDADA, m4_esyscmd_s(cat VERSI + AC_CONFIG_AUX_DIR([build-aux]) + AC_CONFIG_MACRO_DIR([m4]) + +-AM_INIT_AUTOMAKE([-Wall -Werror foreign subdir-objects]) ++AM_INIT_AUTOMAKE([-Wall foreign subdir-objects]) + + AC_GNU_SOURCE + +@@ -24,8 +24,8 @@ LT_INIT + AC_ENABLE_STATIC + + # Some useful default flags +-CFLAGS="-std=gnu89 -Werror -Wall $CFLAGS" +-CXXFLAGS="-Werror -Wall $CXXFLAGS" ++CFLAGS="-std=gnu89 -Wall $CFLAGS" ++CXXFLAGS="-Wall $CXXFLAGS" + AC_DEFINE([__STDC_FORMAT_MACROS], [], [Description]) + + # Check for Python3 -- 2.32.0

1 1

[PATCH] qos.cgi: Fix missing translation
by Leo-Andres Hofmann 16 Jul '21

16 Jul '21

Fixes: #12443 Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- html/cgi-bin/qos.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/qos.cgi b/html/cgi-bin/qos.cgi index fa566b523..c45e24992 100644 --- a/html/cgi-bin/qos.cgi +++ b/html/cgi-bin/qos.cgi @@ -360,7 +360,7 @@ END ; close FILE; } -elsif ($qossettings{'DOTOS'} eq 'Loeschen') +elsif ($qossettings{'DOTOS'} eq $Lang::tr{'delete'}) { open( FILE, "< $tosfile" ) or die "Unable to read $tosfile"; @tosrules = <FILE>; -- 2.27.0.windows.1

2 1

[PATCH v2 1/2] rrd graphs: Remove unused individual graph output
by Leo-Andres Hofmann 16 Jul '21

16 Jul '21

PNG generation has been moved to getrrdimage.cgi Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- html/cgi-bin/entropy.cgi | 11 ----------- html/cgi-bin/hardwaregraphs.cgi | 32 -------------------------------- html/cgi-bin/media.cgi | 11 ----------- html/cgi-bin/memory.cgi | 14 -------------- html/cgi-bin/netexternal.cgi | 11 ----------- html/cgi-bin/netinternal.cgi | 17 ----------------- html/cgi-bin/netother.cgi | 19 ------------------- html/cgi-bin/netovpnrw.cgi | 10 ---------- html/cgi-bin/netovpnsrv.cgi | 14 -------------- html/cgi-bin/qos.cgi | 11 ----------- html/cgi-bin/system.cgi | 18 ------------------ 11 files changed, 168 deletions(-) diff --git a/html/cgi-bin/entropy.cgi b/html/cgi-bin/entropy.cgi index f8045db5a..6cfcadd1c 100644 --- a/html/cgi-bin/entropy.cgi +++ b/html/cgi-bin/entropy.cgi @@ -30,16 +30,6 @@ require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; require "${General::swroot}/graphs.pl"; -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - -if ( $querry[0] ne~ "") { - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updateentropygraph($querry[1]); - -} else { &Header::showhttpheaders(); &Header::openpage($Lang::tr{'entropy'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -86,7 +76,6 @@ EOF &Header::closebigbox(); &Header::closepage(); -} sub has_rdrand() { open(FILE, "/proc/cpuinfo") or return 0; diff --git a/html/cgi-bin/hardwaregraphs.cgi b/html/cgi-bin/hardwaregraphs.cgi index e8f0fa362..be45a8c99 100644 --- a/html/cgi-bin/hardwaregraphs.cgi +++ b/html/cgi-bin/hardwaregraphs.cgi @@ -90,35 +90,6 @@ if (@thermal_zone_sensors) { } } -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - -if ( $querry[0] =~ "hwtemp"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatehwtempgraph($querry[1]); -}elsif ( $querry[0] =~ "hwfan"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatehwfangraph($querry[1]); -}elsif ( $querry[0] =~ "hwvolt"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatehwvoltgraph($querry[1]); -}elsif ( $querry[0] =~ "thermaltemp"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatethermaltempgraph($querry[1]); -}elsif ( $querry[0] =~ "sd?" ){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatehddgraph($querry[0],$querry[1]); -}elsif ( $querry[0] =~ "nvme?" ){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatehddgraph($querry[0],$querry[1]); -}else{ &Header::showhttpheaders(); &Header::openpage($Lang::tr{'hardware graphs'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -184,9 +155,6 @@ if ( $querry[0] =~ "hwtemp"){ &Header::closebigbox(); &Header::closepage(); -} - - sub sensorsbox { &Header::openbox('100%', 'center', "$Lang::tr{'mbmon settings'}"); diff --git a/html/cgi-bin/media.cgi b/html/cgi-bin/media.cgi index f574729ed..835565811 100644 --- a/html/cgi-bin/media.cgi +++ b/html/cgi-bin/media.cgi @@ -41,18 +41,8 @@ undef (@dummy); my %cgiparams=(); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - my @devices = `ls -1 /sys/block | grep -E '^sd|^mmcblk|^nvme|^xvd|^vd|^md' | sort | uniq`; -if ( $querry[0] =~ "sd?" || $querry[0] =~ "mmcblk?" || $querry[0] =~ "nvme?n?" || $querry[0] =~ "xvd??" || $querry[0] =~ "vd?" || $querry[0] =~ "md*" ){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - - &Graphs::updatediskgraph($querry[0],$querry[1]); -}else{ &Header::showhttpheaders(); &Header::openpage($Lang::tr{'media information'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -162,7 +152,6 @@ END &Header::closebigbox(); &Header::closepage(); -} sub percentbar { diff --git a/html/cgi-bin/memory.cgi b/html/cgi-bin/memory.cgi index 441b1d4e7..037d5800b 100644 --- a/html/cgi-bin/memory.cgi +++ b/html/cgi-bin/memory.cgi @@ -35,19 +35,6 @@ my %mainsettings = (); &General::readhash("${General::swroot}/main/settings", \%mainsettings); &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - -if ( $querry[0] =~ "memory"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatememorygraph($querry[1]); -}elsif ( $querry[0] =~ "swap"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updateswapgraph($querry[1]); -}else{ &Header::showhttpheaders(); &Header::openpage($Lang::tr{'memory information'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -139,7 +126,6 @@ END &Header::closebigbox(); &Header::closepage(); -} sub percentbar{ my $percent = $_[0]; diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi index 1e3760c2b..704cd8727 100644 --- a/html/cgi-bin/netexternal.cgi +++ b/html/cgi-bin/netexternal.cgi @@ -43,16 +43,6 @@ my %netsettings=(); my @graphs=(); my %dhcpinfo=(); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - -if ( $querry[0] ne~ ""){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updateifgraph($querry[0],$querry[1]); -}else{ - &Header::showhttpheaders(); &Header::openpage($Lang::tr{'network traffic graphs external'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -163,4 +153,3 @@ END &Header::closebigbox(); &Header::closepage(); -} diff --git a/html/cgi-bin/netinternal.cgi b/html/cgi-bin/netinternal.cgi index 3c2828fbf..8d7105e36 100644 --- a/html/cgi-bin/netinternal.cgi +++ b/html/cgi-bin/netinternal.cgi @@ -40,22 +40,6 @@ my %netsettings=(); my @graphs=(); my @wireless=(); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; -$querry[2] = '' unless defined $querry[2]; - -if ( $querry[0] =~ /wireless/ ){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - $querry[0] =~ s/wireless//g; - &Graphs::updatewirelessgraph($querry[0],$querry[1]); -}elsif ( $querry[0] ne "" ){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updateifgraph($querry[0],$querry[1]); -}else{ - &Header::showhttpheaders(); &Header::openpage($Lang::tr{'network traffic graphs internal'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -84,4 +68,3 @@ if ( $querry[0] =~ /wireless/ ){ &Header::closebigbox(); &Header::closepage(); -} diff --git a/html/cgi-bin/netother.cgi b/html/cgi-bin/netother.cgi index cbd2bc228..c1d6a64a0 100755 --- a/html/cgi-bin/netother.cgi +++ b/html/cgi-bin/netother.cgi @@ -37,24 +37,6 @@ my %mainsettings = (); my @pings=(); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - -if ( $querry[0] eq "conntrack") { - print "Content-Type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updateconntrackgraph($querry[1]); -} elsif ( $querry[0] =~ "fwhits"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatefwhitsgraph($querry[1]); -}elsif ( $querry[0] ne ""){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatepinggraph($querry[0],$querry[1]); -}else{ - &Header::showhttpheaders(); &Header::openpage($Lang::tr{'network traffic graphs others'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -103,4 +85,3 @@ if ( $querry[0] eq "conntrack") { &Header::closebigbox(); &Header::closepage(); -} diff --git a/html/cgi-bin/netovpnrw.cgi b/html/cgi-bin/netovpnrw.cgi index 00ef35337..fc2e43508 100755 --- a/html/cgi-bin/netovpnrw.cgi +++ b/html/cgi-bin/netovpnrw.cgi @@ -37,15 +37,6 @@ my %mainsettings = (); my @vpns=(); -my @querry = split(/\?/,uri_unescape($ENV{'QUERY_STRING'})); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'week' unless defined $querry[1]; - -if ( $querry[0] ne "" && $querry[0] ne "UNDEF"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatevpngraph($querry[0],$querry[1]); -}else{ &Header::showhttpheaders(); &Header::openpage($Lang::tr{'vpn statistic rw'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -69,4 +60,3 @@ if ( $querry[0] ne "" && $querry[0] ne "UNDEF"){ &Header::closebigbox(); &Header::closepage(); -} diff --git a/html/cgi-bin/netovpnsrv.cgi b/html/cgi-bin/netovpnsrv.cgi index a53090f0f..6ff6e17fe 100755 --- a/html/cgi-bin/netovpnsrv.cgi +++ b/html/cgi-bin/netovpnsrv.cgi @@ -49,19 +49,6 @@ foreach my $key (sort {$vpnsettings{$a}[1] <=> $vpnsettings{$b}[1]} keys %vpnset $ipsecgraphs{$vpnsettings{$key}[1]} = "${interface_mode}${key}"; } -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'week' unless defined $querry[1]; - -if ( $querry[0] ne ""){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - if (grep { $_ eq $querry[0] } values %ipsecgraphs) { - &Graphs::updateifgraph($querry[0],$querry[1]); - } else { - &Graphs::updatevpnn2ngraph($querry[0],$querry[1]); - } -}else{ &Header::showhttpheaders(); &Header::openpage($Lang::tr{'vpn statistic n2n'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -91,4 +78,3 @@ if ( $querry[0] ne ""){ &Header::closebigbox(); &Header::closepage(); -} diff --git a/html/cgi-bin/qos.cgi b/html/cgi-bin/qos.cgi index fa566b523..3410c7353 100644 --- a/html/cgi-bin/qos.cgi +++ b/html/cgi-bin/qos.cgi @@ -111,15 +111,6 @@ my %mainsettings = (); &General::readhash("${General::swroot}/main/settings", \%mainsettings); &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - -if ( $querry[0] ne ""){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updateqosgraph($querry[0],$querry[1]); -}else{ &Header::showhttpheaders(); &Header::openpage('QoS', 1, ''); @@ -721,8 +712,6 @@ if ( ($qossettings{'DEFCLASS_INC'} eq '') || ($qossettings{'DEFCLASS_OUT'} eq '' &Header::closebigbox(); &Header::closepage(); -} - ############################################################################################################################ ############################################################################################################################ diff --git a/html/cgi-bin/system.cgi b/html/cgi-bin/system.cgi index 67c479736..595ca0eab 100644 --- a/html/cgi-bin/system.cgi +++ b/html/cgi-bin/system.cgi @@ -35,23 +35,6 @@ my %mainsettings = (); &General::readhash("${General::swroot}/main/settings", \%mainsettings); &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color); -my @querry = split(/\?/,$ENV{'QUERY_STRING'}); -$querry[0] = '' unless defined $querry[0]; -$querry[1] = 'hour' unless defined $querry[1]; - -if ( $querry[0] =~ "cpufreq"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatecpufreqgraph($querry[1]); -}elsif ( $querry[0] =~ "cpu"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updatecpugraph($querry[1]); -}elsif ( $querry[0] =~ "load"){ - print "Content-type: image/png\n\n"; - binmode(STDOUT); - &Graphs::updateloadgraph($querry[1]); -}else{ &Header::showhttpheaders(); &Header::openpage($Lang::tr{'status information'}, 1, ''); &Header::openbigbox('100%', 'left'); @@ -72,4 +55,3 @@ if ( $querry[0] =~ "cpufreq"){ &Header::closebigbox(); &Header::closepage(); -} -- 2.27.0.windows.1

1 1

[PATCH] fwhosts.cgi: Fix check to limit amount of ports in custom service groups.
by Stefan Schantl 16 Jul '21

16 Jul '21

iptables multiport only supports up to 15 elements for each protocol (TCP or UDP). That can be single ports or portranges (they count doubble). This commit extends the check to calculate the amount of used TCP and/or UDP ports of all existing entries in a group, by increasing the amount for the service which should be added. If the amount of ports for TCP or UDP ports become greater than the limit of 15 the error message will be displayed. Fixes #11323. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/fwhosts.cgi | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi index 35611ac08..f6c7227ce 100644 --- a/html/cgi-bin/fwhosts.cgi +++ b/html/cgi-bin/fwhosts.cgi @@ -818,10 +818,28 @@ if ($fwhostsettings{'ACTION'} eq 'saveservicegrp') } } } - if ($tcpcounter > 14){ + + # Loop through the hash of configured services. + foreach my $key (keys %customservice) { + # Assign nice human-readable values. + my $service_name = $customservice{$key}[0]; + my $service_port = $customservice{$key}[1]; + my $service_proto = $customservice{$key}[2]; + + # Skip services unless the processed one has found. + next unless $service_name eq $fwhostsettings{'CUST_SRV'}; + + # Increase the counters. + $tcpcounter++ if $service_proto eq 'TCP'; + $tcpcounter++ if $service_proto eq 'TCP' && $service_port =~ m/:/i; + $udpcounter++ if $service_proto eq 'UDP'; + $udpcounter++ if $service_proto eq 'UDP' && $service_port =~ m/:/i; + } + + if ($tcpcounter > 15) { $errormessage=$Lang::tr{'fwhost err maxservicetcp'}; } - if ($udpcounter > 14){ + if ($udpcounter > 15) { $errormessage=$Lang::tr{'fwhost err maxserviceudp'}; } $tcpcounter=0; -- 2.30.2

3 2

[PATCHv2] firewalllog.dat: Proper display protocol names.
by Stefan Schantl 15 Jul '21

15 Jul '21

In some cases iptables logs the protocol number instead of the name. When accessing the logs via the WUI, this number has been displayed as used protocol, which is very hard to read and understand. This commit adds a new function to the general-functions.pl, which generates a hash to translate the protocol number into the protocol name. Fixes #11282. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/cfgroot/general-functions.pl | 36 +++++++++++++++++++++++++++ html/cgi-bin/logs.cgi/firewalllog.dat | 8 ++++++ 2 files changed, 44 insertions(+) diff --git a/config/cfgroot/general-functions.pl b/config/cfgroot/general-functions.pl index 550afcf82..1da1218ab 100644 --- a/config/cfgroot/general-functions.pl +++ b/config/cfgroot/general-functions.pl @@ -1363,6 +1363,42 @@ sub formatBytes { return sprintf("%.2f %s", $bytes, $unit); } +# Function to collect and generate a hash for translating protocol numbers into +# their names. +sub generateProtoTransHash () { + # File which contains the protocol definitions. + my $protocols_file = "/etc/protocols"; + + my %protocols = (); + + # Open protocols file. + open(FILE, "$protocols_file") or die "Could not open $protocols_file. $!\n"; + + # Loop through the file. + while (my $line = <FILE>) { + # Skip comments. + next if ($line =~ /^\#/); + + # Skip blank lines. + next if ($line =~ /^\s*$/); + + # Remove any newlines. + chomp($line); + + # Split line content. + my ($protocol_lc, $number, $protocol_uc, $comment) = split(' ', $line); + + # Add proto details to the hash of protocols. + $protocols{$number} = $protocol_uc; + } + + # Close file handle. + close(FILE); + + # Return the hash. + return %protocols; +} + # Cloud Stuff sub running_in_cloud() { diff --git a/html/cgi-bin/logs.cgi/firewalllog.dat b/html/cgi-bin/logs.cgi/firewalllog.dat index e326d65c0..73596d8cd 100644 --- a/html/cgi-bin/logs.cgi/firewalllog.dat +++ b/html/cgi-bin/logs.cgi/firewalllog.dat @@ -325,6 +325,8 @@ print <<END END ; +# Generate hash to translate protocol numbers into protocol names. +my %protocols = &General::generateProtoTransHash(); $lines = 0; foreach $_ (@log) @@ -354,6 +356,12 @@ foreach $_ (@log) # Get the country code. my $ccode = &Location::Functions::lookup_country_code($srcaddr); + # Lookup if the grabbed protocol is part of the protocols hash. + if (exists ($protocols{$proto})) { + # Translate protocol number into protocol name. + $proto = $protocols{$proto}; + } + my $servi = uc(getservbyport($srcport, lc($proto))); if ($servi ne '' && $srcport < 1024) { $srcport = "$srcport($servi)"; -- 2.30.2

3 2

← Newer
1
2
3
4
5
6
7
8
...
11
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2021