Development February 2022

development@lists.ipfire.org

16 participants
114 discussions

[PATCH] unbound: fix dns working check
by Arne Fitzenreiter 19 Feb '22

19 Feb '22

pool.ipfire.org cannot resolved. Now try both default dns servers. If one works dns is working. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- src/initscripts/system/unbound | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index 1b42ac720..b959520a1 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -267,7 +267,8 @@ get_memory_amount() { fix_time_if_dns_fails() { # If DNS is working, everything is fine - if resolve "ipfire.pool.ntp.org" &>/dev/null; then + if resolve "0.ipfire.pool.ntp.org" &>/dev/null || \ + resolve "1.ipfire.pool.ntp.org" &>/dev/null ; then return 0 fi -- 2.34.1

2 1

[PATCH] accounting.cgi: Change some variables to alphanumeric - Bug#12777
by Adolf Belka 18 Feb '22

18 Feb '22

- The Postcode in the address only allowed numeric postcodes. The Netherlands and Great Britain are at lease two countries that use alphanumeric postcodes with spaces. Changed the postcode check from numeric to alphanumeric. - The Bank Code in the Providers details only allowed numeric Bank Codes. In Great Britain the Bank Code, also known as the Sort Code is made up of three groups of digits separated by a - . - Adjusted the regex for the alphanumeric check to include a space and a - . The original comment indicated that a - was allowed but it was not included in the regex. - Tested on a vm system and confirmed that a postcode from The Netherlands and Great Britain and a Sort Code from Breat Britain are now accepted. Fixes: Bug#12777 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- src/squid-accounting/accounting.cgi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/squid-accounting/accounting.cgi b/src/squid-accounting/accounting.cgi index 751b6e8a5..e1e2346da 100755 --- a/src/squid-accounting/accounting.cgi +++ b/src/squid-accounting/accounting.cgi @@ -1488,7 +1488,7 @@ sub checkaddress{ if (! $cgiparams{'txt_plz'}){ $errormessage.="$Lang::tr{'acct empty field'} $Lang::tr{'acct plz'}<br>"; }else{ - if(! &validnumfield($cgiparams{'txt_plz'})){ + if(! &validalphanumfield($cgiparams{'txt_plz'})){ $errormessage.="$Lang::tr{'acct invalid'} $Lang::tr{'acct plz'}<br>"; } } @@ -1523,7 +1523,7 @@ sub checkaddress{ } if(($cgiparams{'txt_iban'} && $cgiparams{'txt_blz'})||(!$cgiparams{'txt_iban'} && $cgiparams{'txt_blz'})){ #Check BLZ - if(! &validnumfield($cgiparams{'txt_blz'})){ + if(! &validalphanumfield($cgiparams{'txt_blz'})){ $errormessage.="$Lang::tr{'acct invalid'} $Lang::tr{'acct blz'}<br>"; } #Check BANKACCOUNT @@ -1653,7 +1653,7 @@ sub validphonefield{ } sub validalphanumfield{ - #GET: Input from a numeric field + #GET: Input from an alphanumeric field #GIVES: True if valid, false if not valid my $remark = $_[0]; @@ -1661,8 +1661,8 @@ sub validalphanumfield{ # but no more than 63 characters if (length ($remark) < 1 || length ($remark) > 255) { return 0;} - # Only valid characters are a-z, A-Z, 0-9 and - - if ($remark !~ /^[0-9a-zA-Z]*$/) { + # Only valid characters are a-z, A-Z, 0-9 - and space + if ($remark !~ /^[0-9a-zA-Z- ]*$/) { return 0;} # First character can only be a letter or a digit if (substr ($remark, 0, 1) !~ /^[0-9A-Za-z]*$/) { -- 2.35.1

2 1

[PATCH] bind: Update to 9.16.26
by Matthias Fischer 18 Feb '22

18 Feb '22

For details see: https://downloads.isc.org/isc/bind9/9.16.26/doc/arm/html/notes.html#notes-f… "Notes for BIND 9.16.26 Feature Changes The DLZ API has been updated: EDNS Client-Subnet (ECS) options sent by a client are now included in the client information sent to DLZ modules when processing queries. [GL #3082] Bug Fixes Previously, recvmmsg support was enabled in libuv 1.35.0 and 1.36.0, but not in libuv versions 1.37.0 or greater, reducing the maximum query-response performance. This has been fixed. [GL #3095] A failed view configuration during a named reconfiguration procedure could cause inconsistencies in BIND internal structures, causing a crash or other unexpected errors. This has been fixed. [GL #3060] Previously, named logged a “quota reached” message when it hit its hard quota on the number of connections. That message was accidentally removed but has now been restored. [GL #3125] Build errors were introduced in some DLZ modules due to an incomplete change in the previous release. This has been fixed. [GL #3111]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 14 +++++++------- lfs/bind | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 4ea64dc0c..c0e56854a 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -274,24 +274,24 @@ usr/bin/nsupdate #usr/include/pk11/site.h #usr/include/pkcs11 #usr/include/pkcs11/pkcs11.h -usr/lib/libbind9-9.16.25.so +usr/lib/libbind9-9.16.26.so #usr/lib/libbind9.la #usr/lib/libbind9.so -usr/lib/libdns-9.16.25.so +usr/lib/libdns-9.16.26.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libirs-9.16.25.so +usr/lib/libirs-9.16.26.so #usr/lib/libirs.la #usr/lib/libirs.so -usr/lib/libisc-9.16.25.so +usr/lib/libisc-9.16.26.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.16.25.so +usr/lib/libisccc-9.16.26.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.16.25.so +usr/lib/libisccfg-9.16.26.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.16.25.so +usr/lib/libns-9.16.26.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index fc6e7654e..72c85f5f5 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.16.25 +VER = 9.16.26 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 361a54fc5ebeb3a1af77abec08b33661 +$(DL_FILE)_MD5 = 799696f44e0d61659fa0efaa3c5fe5d8 install : $(TARGET) -- 2.25.1

3 2

[PATCH] firewall: Load ipset list before creating rules for DROP_HOSTILE.
by Stefan Schantl 18 Feb '22

18 Feb '22

Otherwise there is no ipset list use-able and the feature will not work. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/system/firewall | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index adb2240bb..2ae6157aa 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -22,6 +22,8 @@ IPS_REPEAT_MASK="0x80000000" IPS_BYPASS_MARK="0x40000000" IPS_BYPASS_MASK="0x40000000" +IPSET_DB_DIR="/var/lib/location/ipset" + function iptables() { /sbin/iptables --wait "$@" } @@ -146,6 +148,9 @@ iptables_init() { # a technical threat to our users (i. e. listed at Spamhaus DROP et al.) iptables -N HOSTILE if [ "$DROPHOSTILE" == "on" ]; then + # Call ipset and load the list which contains the hostile networks. + ipset restore < $IPSET_DB_DIR/CC_XD.ipset4 + iptables -A HOSTILE -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE " iptables -A INPUT -i $IFACE -m set --match-set CC_XD src -j HOSTILE iptables -A FORWARD -i $IFACE -m set --match-set CC_XD src -j HOSTILE -- 2.30.2

2 1

[PATCH] Core 165: Export location DB in new format.
by Stefan Schantl 18 Feb '22

18 Feb '22

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/core/165/update.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/rootfiles/core/165/update.sh b/config/rootfiles/core/165/update.sh index 7371d047a..564f58606 100644 --- a/config/rootfiles/core/165/update.sh +++ b/config/rootfiles/core/165/update.sh @@ -109,6 +109,12 @@ ldconfig # Filesytem cleanup /usr/local/bin/filesystem-cleanup +# Export location DB in new format. +/usr/bin/location export \ + --directory=/var/lib/location/ipset \ + --family=ipv4 \ + --format=ipset + # Start services telinit u /etc/rc.d/init.d/firewall restart -- 2.30.2

2 1

[PATCH] firewall: Add proper logging prefix for conntrack INVALID hits
by Peter Müller 18 Feb '22

18 Feb '22

Fixes: #12778 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/initscripts/system/firewall | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index fc355cd5d..2f4b4e30e 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -119,9 +119,13 @@ iptables_init() { iptables -A FORWARD -p tcp -j BADTCP # Connection tracking chains + iptables -N CTINVALID + iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID " + iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID" + iptables -N CONNTRACK iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT - iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP + iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT # Restore any connection marks -- 2.34.1

3 2

[PATCH] manualpages: Drop p2p-block entry
by Leo-Andres Hofmann 17 Feb '22

17 Feb '22

The p2p-block CGI has been removed. Therefore the link to its manual page can be removed as well. Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- config/cfgroot/manualpages | 1 - 1 file changed, 1 deletion(-) diff --git a/config/cfgroot/manualpages b/config/cfgroot/manualpages index 4bfec8ab7..6c2e54b55 100644 --- a/config/cfgroot/manualpages +++ b/config/cfgroot/manualpages @@ -61,7 +61,6 @@ firewall=configuration/firewall fwhosts=configuration/firewall/fwgroups optionsfw=configuration/firewall/options ids=configuration/firewall/ips -p2p-block=configuration/firewall/p2p-block location-block=configuration/firewall/geoip-block wireless=configuration/firewall/accesstoblue iptables=configuration/firewall/iptables -- 2.27.0.windows.1

2 1

[PATCH] ovpnclients.dat: Fix adjusting input dates
by Michael Tremer 16 Feb '22

16 Feb '22

This patch changes that we no longer interpret any dates put in by the user as UTC. They used to be converted into localtime because, although they have already been in local time. This went unnoticed since in Europe we are close (enough) to UTC that there is no significant discrepancy on the report. However, being in North America is enough to generate confusing reports. Reported-by: Paul <kairis(a)gmail.com> Fixes: #12768 Tested-by: Jon Murphy <jon.murphy(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- html/cgi-bin/logs.cgi/ovpnclients.dat | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/html/cgi-bin/logs.cgi/ovpnclients.dat b/html/cgi-bin/logs.cgi/ovpnclients.dat index 5e2c1ff49..100573214 100755 --- a/html/cgi-bin/logs.cgi/ovpnclients.dat +++ b/html/cgi-bin/logs.cgi/ovpnclients.dat @@ -115,16 +115,16 @@ my $database_query = qq( common_name, SUM( STRFTIME('%s', ( CASE - WHEN DATETIME(COALESCE(disconnected_at, CURRENT_TIMESTAMP), 'localtime') < DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds') + WHEN DATETIME(COALESCE(disconnected_at, CURRENT_TIMESTAMP), 'localtime') < DATETIME('$to_datestring', 'start of day', '+86399 seconds') THEN DATETIME(COALESCE(disconnected_at, CURRENT_TIMESTAMP), 'localtime') - ELSE DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds') + ELSE DATETIME('$to_datestring', 'start of day', '+86399 seconds') END ), 'utc') - STRFTIME('%s', ( CASE - WHEN DATETIME(connected_at, 'localtime') > DATETIME('$from_datestring', 'localtime', 'start of day') + WHEN DATETIME(connected_at, 'localtime') > DATETIME('$from_datestring', 'start of day') THEN DATETIME(connected_at, 'localtime') - ELSE DATETIME('$from_datestring', 'localtime', 'start of day') + ELSE DATETIME('$from_datestring', 'start of day') END ), 'utc') ) AS duration @@ -133,10 +133,10 @@ my $database_query = qq( ( disconnected_at IS NULL OR - DATETIME(disconnected_at, 'localtime') > DATETIME('$from_datestring', 'localtime', 'start of day') + DATETIME(disconnected_at, 'localtime') > DATETIME('$from_datestring', 'start of day') ) AND - DATETIME(connected_at, 'localtime') < DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds') + DATETIME(connected_at, 'localtime') < DATETIME('$to_datestring', 'start of day', '+86399 seconds') GROUP BY common_name ORDER BY common_name, duration DESC; ); @@ -148,9 +148,9 @@ if ($cgiparams{'CONNECTION_NAME'}) { WHERE common_name = '$cgiparams{"CONNECTION_NAME"}' AND ( - DATETIME(disconnected_at, 'localtime') > DATETIME('$from_datestring', 'localtime', 'start of day') + DATETIME(disconnected_at, 'localtime') > DATETIME('$from_datestring', 'start of day') AND - DATETIME(connected_at, 'localtime') < DATETIME('$to_datestring', 'localtime', 'start of day', '+86399 seconds') + DATETIME(connected_at, 'localtime') < DATETIME('$to_datestring', 'start of day', '+86399 seconds') ) ORDER BY connected_at; ); -- 2.30.2

3 4

[PATCH] libloc: Update to 0.9.10
by Peter Müller 16 Feb '22

16 Feb '22

Please refer to https://lists.ipfire.org/pipermail/location/2022-February/000530.html for this version's changelog. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/libloc | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/libloc b/lfs/libloc index 1de135b52..29008191a 100644 --- a/lfs/libloc +++ b/lfs/libloc @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,8 +24,8 @@ include Config -VER = 0.9.9 -DB_DATE = 2021-12-13 +VER = 0.9.10 +DB_DATE = 2022-02-16 THISAPP = libloc-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,8 +43,8 @@ objects = $(DL_FILE) \ $(DL_FILE) = https://source.ipfire.org/releases/libloc/$(DL_FILE) location-$(DB_DATE).db.xz = https://location.ipfire.org/databases/1/archive/location-$(DB_DATE).db.xz -$(DL_FILE)_MD5 = 0d14fcad39b19accc001ed5f17a09471 -location-$(DB_DATE).db.xz_MD5 = 7239646f05ac92e76ae2700e7aa14ab8 +$(DL_FILE)_MD5 = 3f67e15022c142c0731cbb3746351330 +location-$(DB_DATE).db.xz_MD5 = c1ad9c544bab917035eb0cd13b66c453 install : $(TARGET) -- 2.34.1

2 1

[PATCH] make.sh: SIGKILL and SIGSTOP cannot be trapped
by Peter Müller 16 Feb '22

16 Feb '22

There is no sense in instructing "trap" to catch signals it cannot trap whatsoever. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- make.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make.sh b/make.sh index 4dd068e4b..c06b4ec38 100755 --- a/make.sh +++ b/make.sh @@ -437,7 +437,7 @@ prepareenv() { fi # Trap on emergency exit - trap "exiterror 'Build process interrupted'" SIGINT SIGTERM SIGKILL SIGSTOP SIGQUIT + trap "exiterror 'Build process interrupted'" SIGINT SIGTERM SIGQUIT # Checking if running as root user if [ $(id -u) -ne 0 ]; then -- 2.34.1

2 3

← Newer
1
2
3
4
5
6
7
8
...
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2022