Development February 2024

development@lists.ipfire.org

9 participants
36 discussions

Can the firewall interface be simplified
by Nick Howitt 02 Mar '24

02 Mar '24

Hi, I posted this to the forums but this may be a better place for discussion. I am a new user of IPFire had have just transitioned from ClearOS which is going end of life this year and I believe some of the firewalling could be a lot easier. Full disclosure - I used to be a basic maintainer of ClearOS (and sole maintainer for about 20 months) and I have good understanding of iptables. I have found the firewall complicated to use as it is trying to do everything in one screen and I can only really get it to work with my knowledge of iptables and using the help screens. It is not something any family member could easily take over if I ever pass on. Many domestic routers have a very simple Port Forwarding menu. At its simplest, it has a destination (LAN) IP, protocol and port/port range which applies to the external interface. ClearOS also allows you to switch ports, so, for example incoming tcp:2222 can be switched to tcp:22. There is no mention of NAT, of source ports (which are irrelevant) or interfaces. It would greatly help unknowledgeable users to have a simple port forwarding menu something like that, with maybe a source IP field as well. I have a /29 block of static IP’s, Really using one of them should need a screen little more complicated than a Port Forwarding screen, but should also allow you to specify which of your external IPs to use. Then it should set up the Alias for you and do the port forwarding with the option of any protocol. At the same time it should set up an SNAT rule so outbound traffic is seen to originate from your designated external IP rather than the default interface IP, and a hairpin rule should be set up so the external IP can be accessed from the LAN (it is only needed for the LAN that the target device is on and not the other LANs). As you have in ClearOS, you could then have a separate menu to open the incoming firewall e.g. for OpenVPN. I like the Service groups concept but, at the same time, it could be made largely redundant. If the use of “-m multiport” is made use of for all port based rules, including a single port, then the destination port selector in the Protocol section could be opened up to allow up to 15 ports to be specified, like you can in the Services section. Then I think service groups are only relevant for when you have more than 1 protocol that you want to apply the rule to. I would also need to think about it more, but it may be good if Static Routes also created their own hairpin firewall rule. Regards, Nick

4 6

Request for Home directory
by jon 01 Mar '24

01 Mar '24

Hello, How do I enable a Home directory <https://www.ipfire.org/docs/community/people/home-directories>for me? Best regards, Jon

3 8

[PATCH] samba: wsdd started and stopped when samba started or stopped
by Adolf Belka 01 Mar '24

01 Mar '24

- Add wsdd as a dependency to samba so it will be installed together with samba - Add the starting and stopping of wsdd into the samba initscript Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/samba | 4 ++-- src/initscripts/packages/samba | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/lfs/samba b/lfs/samba index 76088abfa..df7811313 100644 --- a/lfs/samba +++ b/lfs/samba @@ -33,9 +33,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 99 +PAK_VER = 100 -DEPS = avahi cups perl-Parse-Yapp perl-JSON +DEPS = avahi cups perl-Parse-Yapp perl-JSON wsdd SERVICES = samba diff --git a/src/initscripts/packages/samba b/src/initscripts/packages/samba index 93f14cd29..99b9929cf 100644 --- a/src/initscripts/packages/samba +++ b/src/initscripts/packages/samba @@ -42,6 +42,8 @@ case "$1" in boot_mesg "Starting winbind..." loadproc /usr/sbin/winbindd + + /etc/rc.d/init.d/wsdd start ;; stop) @@ -53,7 +55,9 @@ case "$1" in boot_mesg "Stopping winbind..." killproc /usr/sbin/winbindd - ;; + + /etc/rc.d/init.d/wsdd stop + ;; reload) boot_mesg "Reloading smbd..." -- 2.44.0

2 2

[PATCH 1/2] wsdd: Install wsdd - fixes bug13445
by Adolf Belka 01 Mar '24

01 Mar '24

- lfs and toorfile created for wsdd - wsdd added to make.sh script - created install/update/uninstall scripts for wsdd that create an unpriveleged user and group. - initscript created for wsdd. As wsdd is a python3 script, when it is run as a daemon the pidof command does not find any pid for wsdd. So a directory/file for a pid file was created. This is then passed to the loadproc and killproc commands. After the loadproc command has been created the pid is extracted from the ps aux command and put into the pid file. This then works when running the killproc command for it to know what to go and stop. The statusproc command does not have the ability to feed in the pid from a pid file and so it fails to find a running wsdd as it uses the pidof command. Code was added to the status section of the initscript to check if the pid file exists and if so to print the same command as used with the statusproc command, and also the same wording if the pid file does not exist because wsdd is not running. - info from the ethernet/settings file is used to identify if only green0 is available or if blue0 is also used and based on this the appropriate interface commands are added to the wsdd command. - wsdd is also set up to run in a chroot - Has been tested on my vm testbed, initially by editing the files on the vm clone. After everything confiremd to be working, the build was successfully carried out and the .ipfire package was copied to a new vm clone installed and shown to perform as expected. This test only confirms that wsdd is correctly installed and started. Shutsdown and restarts on reboot successfully. Confirmed from the ps aux info that wsdd has been started with the correct options. Thge testing can not evaluate if wsdd enables windows systems newer than version 7 top be able to detect the samba shares as I have no windows systems. Fixes: Bug13445 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/wsdd | 2 + lfs/wsdd | 89 ++++++++++++++++++++++++++++++++++ make.sh | 1 + src/initscripts/packages/wsdd | 63 ++++++++++++++++++++++++ src/paks/wsdd/install.sh | 40 +++++++++++++++ src/paks/wsdd/uninstall.sh | 30 ++++++++++++ src/paks/wsdd/update.sh | 27 +++++++++++ 7 files changed, 252 insertions(+) create mode 100644 config/rootfiles/packages/wsdd create mode 100644 lfs/wsdd create mode 100644 src/initscripts/packages/wsdd create mode 100644 src/paks/wsdd/install.sh create mode 100644 src/paks/wsdd/uninstall.sh create mode 100644 src/paks/wsdd/update.sh diff --git a/config/rootfiles/packages/wsdd b/config/rootfiles/packages/wsdd new file mode 100644 index 000000000..ce225043a --- /dev/null +++ b/config/rootfiles/packages/wsdd @@ -0,0 +1,2 @@ +etc/rc.d/init.d/wsdd +usr/bin/wsdd diff --git a/lfs/wsdd b/lfs/wsdd new file mode 100644 index 000000000..aa65e47ef --- /dev/null +++ b/lfs/wsdd @@ -0,0 +1,89 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 0.7.1 +SUMMARY = A Web Service Discovery host daemon. + +THISAPP = wsdd-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = wsdd +PAK_VER = 1 + +DEPS = + +SERVICES = wsdd + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_BLAKE2 = ce43022c3bd9f7ff1fd7169ac0d5ab6b2ff78d35c221c05b2e20908a5772d563ab2aca571d4e6ae48a55d19d4adcb9cde60f720ae47af8ee950198224fcfdb26 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +b2 : $(subst %,%_BLAKE2,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, b2sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_BLAKE2,$(objects)) : + @$(B2SUM) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && cp src/wsdd.py /usr/bin/wsdd + + #install initscripts + $(call INSTALL_INITSCRIPTS,$(SERVICES)) + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 06e09c9a3..5af3dedc3 100755 --- a/make.sh +++ b/make.sh @@ -1699,6 +1699,7 @@ buildipfire() { lfsmake2 perl-MIME-Base32 lfsmake2 perl-URI-Encode lfsmake2 rsnapshot + lfsmake2 wsdd # Kernelbuild ... current we have no platform that need # multi kernel builds so KCFG is empty diff --git a/src/initscripts/packages/wsdd b/src/initscripts/packages/wsdd new file mode 100644 index 000000000..c5207f872 --- /dev/null +++ b/src/initscripts/packages/wsdd @@ -0,0 +1,63 @@ +#!/bin/sh +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +. /etc/sysconfig/rc +. $rc_functions + +eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) + +# Create chroot directory for wsdd +mkdir -p /var/run/wsdd + +INTERFACES="-i ${GREEN_DEV}" + if [ -n "${BLUE_DEV}" ]; then + INTERFACES="${INTERFACES} -i ${BLUE_DEV}" + fi +WSDD_WORKGROUP="-w $(/usr/bin/testparm -s --parameter-name workgroup 2>/dev/null)" +WSDD_USER="-u wsdd:wsdd" +WSDD_CHROOT="-c /var/run/wsdd" + +case "$1" in + start) + boot_mesg "Starting wsdd daemon..." + loadproc -b /usr/bin/wsdd -4 ${WSDD_USER} ${INTERFACES} ${WSDD_WORKGROUP} ${WSDD_CHROOT} + sleep 1 + echo $(ps aux | grep "/usr/bin/wsdd" | grep -v grep | awk '{print $2}') > /var/run/wsdd/pid + ;; + stop) + boot_mesg "Stopping wsdd daemon..." + killproc -p /var/run/wsdd/pid /usr/bin/wsdd + ;; + status) + WSDD_PID=$(ps aux | grep "/usr/bin/wsdd" | grep -v grep | awk '{print $2}') + if [ -n "${WSDD_PID}" ]; then + echo -e "\\033[1;36m /usr/bin/wsdd is running with Process"\ + "ID(s) $WSDD_PID.\\033[0;39m" + else + echo -e "\\033[1;36m /usr/bin/wsdd is not running.\\033[0;39m" + fi + ;; + *) + echo "Usage: $0 (start|stop|status)" + exit 1 + ;; +esac + diff --git a/src/paks/wsdd/install.sh b/src/paks/wsdd/install.sh new file mode 100644 index 000000000..181b84eb9 --- /dev/null +++ b/src/paks/wsdd/install.sh @@ -0,0 +1,40 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh + +# If the wsdd user does not exist yet, then create it and add to wsdd group. +if ! getent user wsdd >/dev/null; then + useradd -r -U -d / -s /bin/false -c "wsdd user" wsdd + usermod -a -G wsdd wsdd +fi + +extract_files +restore_backup ${NAME} + +# Create startlinks +ln -sf ../init.d/wsdd /etc/rc.d/rc0.d/K35wsdd +ln -sf ../init.d/wsdd /etc/rc.d/rc3.d/S65wsdd +ln -sf ../init.d/wsdd /etc/rc.d/rc6.d/K35wsdd +start_service ${NAME} +exit 0 diff --git a/src/paks/wsdd/uninstall.sh b/src/paks/wsdd/uninstall.sh new file mode 100644 index 000000000..4c52ee281 --- /dev/null +++ b/src/paks/wsdd/uninstall.sh @@ -0,0 +1,30 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +stop_service ${NAME} +make_backup ${NAME} +remove_files +# Remove all start links. +rm -rf /etc/rc.d/rc*.d/*wsdd +exit 0 diff --git a/src/paks/wsdd/update.sh b/src/paks/wsdd/update.sh new file mode 100644 index 000000000..99776659c --- /dev/null +++ b/src/paks/wsdd/update.sh @@ -0,0 +1,27 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007-2020 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +extract_backup_includes +./uninstall.sh +./install.sh -- 2.43.0

3 13

Re: IPFire 2.29 - Core Update 184 is available for testing
by Adolf Belka 28 Feb '24

28 Feb '24

Hi All, The fix for bug#12981 of choosing to log or not log the Hostile traffic coming in and out separately has one bug if you are doing a core update and another if you do a fresh install. For the Core Update the collectd.conf file changes were not shipped so the DROP_HOSTILE_IN & DROP_HOSTILE_OUT directories are not created and the graphs have an error then as they look for those directories. I submitted a patch for that issue three days ago. If you do a fresh install the DROP_HOSTILE_IN & DROP_HOSTILE_OUT directories are created but the code errors as it tries to open the DROP_HOSTILE directory that is not present. I submitted a patch for that issue this morning. Regards, Adolf. On 14/02/2024 12:15, IPFire Project wrote: > Today we are releasing the next version of IPFire for testing: IPFire 2.29 - Core Update 184. It comes with a number of improvements all around the system and a lot of package updates. This change log reads a lot more compact than our usual release, but nevertheless give this update a good test and report any found issues back to the development team. If you would like to support us financially, please help us with a donation. > ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ > > > IPFire_ > > > IPFire 2.29 - Core Update 184 is available for testing > > Today we are releasing the next version of IPFire for testing: IPFire 2.29 - Core Update 184. It comes with a number of improvements all around the system and a lot of package updates. This change log reads a lot more compact than our usual release, but nevertheless give this update a good test and report any found issues back to the development team. If you would like to support us financially, please help us with a donation. > > Read The Full Post On Our Blog <https://www.ipfire.org/blog/ipfire-2-29-core-update-184-is-available-for-te…> > > The IPFire Project, c/o Lightning Wire Labs GmbH, Gerhardstraße 8, 45711 Datteln, Germany > > Unsubscribe <https://www.ipfire.org/unsubscribe> >

1 1

[PATCH] zabbix_agentd: v6.0.27 + ovpn certificate checks
by Robin Roevens 28 Feb '24

28 Feb '24

Hi all A new version of the Zabbix Agent addon fixing a bug and improving logfile reading performance with regex. Added IPFire specific functionality: Checking and validating OpenVPN Client, server and CA certificates. Patch 1: Zabbix agent version update Patch 2: Helper script for added openvpn certificate items Patch 3: Actual configuration of agent for new certificate checking functionality Zabbix agentd wiki entry will be updated after merge. Regards Robin -- Dit bericht is gescanned op virussen en andere gevaarlijke inhoud door MailScanner en lijkt schoon te zijn.

2 6

[PATCH] en.pl: Correct typo of marsians instead of martians
by Adolf Belka 28 Feb '24

28 Feb '24

Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- doc/language_issues.en | 2 +- doc/language_issues.it | 2 +- doc/language_issues.nl | 2 +- doc/language_issues.pl | 2 +- doc/language_issues.ru | 2 +- doc/language_issues.tr | 2 +- langs/en/cgi-bin/en.pl | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/doc/language_issues.en b/doc/language_issues.en index 86d5890f2..40f85a748 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -687,7 +687,7 @@ WARNING: untranslated string: drop outgoing = Log dropped outgoing packets WARNING: untranslated string: drop portscan = Log dropped portscan packets WARNING: untranslated string: drop proxy = Drop all packets not addressed to proxy WARNING: untranslated string: drop samba = Drop all Microsoft ports 135,137,138,139,445,1025 -WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and marsians +WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and martians WARNING: untranslated string: drop wirelessforward = Log dropped wireless forward packets WARNING: untranslated string: drop wirelessinput = Log dropped wireless input packets WARNING: untranslated string: dst port = Dst Port diff --git a/doc/language_issues.it b/doc/language_issues.it index 24efece2b..1aca878ff 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -973,7 +973,7 @@ WARNING: untranslated string: dnsforward forward_servers = Nameservers WARNING: untranslated string: downfall gather data sampling = Downfall/Gather Data Sampling WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: drop hostile = Drop packets from and to hostile networks (listed at <a href="https://www.spamhaus.org/drop/" target="_blank">Spamhaus DROP</a>, etc.) -WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and marsians +WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and martians WARNING: untranslated string: duration = Duration WARNING: untranslated string: eight hours = 8 Hours WARNING: untranslated string: email config = Configuration diff --git a/doc/language_issues.nl b/doc/language_issues.nl index b6a65fad2..fde14ead1 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -978,7 +978,7 @@ WARNING: untranslated string: download apple profile = Download Apple Configurat WARNING: untranslated string: download tls-auth key = Download tls-auth key WARNING: untranslated string: drop hostile = Drop packets from and to hostile networks (listed at <a href="https://www.spamhaus.org/drop/" target="_blank">Spamhaus DROP</a>, etc.) WARNING: untranslated string: drop outgoing = Log dropped outgoing packets -WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and marsians +WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and martians WARNING: untranslated string: duration = Duration WARNING: untranslated string: eight hours = 8 Hours WARNING: untranslated string: email config = Configuration diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 1a4f62870..454e3fcf3 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -965,7 +965,7 @@ WARNING: untranslated string: drop action2 = Default behaviour of (input) firewa WARNING: untranslated string: drop forward = Log dropped forward packets WARNING: untranslated string: drop hostile = Drop packets from and to hostile networks (listed at <a href="https://www.spamhaus.org/drop/" target="_blank">Spamhaus DROP</a>, etc.) WARNING: untranslated string: drop outgoing = Log dropped outgoing packets -WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and marsians +WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and martians WARNING: untranslated string: duration = Duration WARNING: untranslated string: eight hours = 8 Hours WARNING: untranslated string: email config = Configuration diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 8da6fe4b6..0cb276548 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -962,7 +962,7 @@ WARNING: untranslated string: drop action2 = Default behaviour of (input) firewa WARNING: untranslated string: drop forward = Log dropped forward packets WARNING: untranslated string: drop hostile = Drop packets from and to hostile networks (listed at <a href="https://www.spamhaus.org/drop/" target="_blank">Spamhaus DROP</a>, etc.) WARNING: untranslated string: drop outgoing = Log dropped outgoing packets -WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and marsians +WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and martians WARNING: untranslated string: duration = Duration WARNING: untranslated string: eight hours = 8 Hours WARNING: untranslated string: email config = Configuration diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 96fe71f7b..aeda8127a 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -953,7 +953,7 @@ WARNING: untranslated string: dnsforward forward_servers = Nameservers WARNING: untranslated string: downfall gather data sampling = Downfall/Gather Data Sampling WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: drop hostile = Drop packets from and to hostile networks (listed at <a href="https://www.spamhaus.org/drop/" target="_blank">Spamhaus DROP</a>, etc.) -WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and marsians +WARNING: untranslated string: drop spoofed martians = Log dropped spoofed packets and martians WARNING: untranslated string: duration = Duration WARNING: untranslated string: email recipient invalid = Invalid email recipient WARNING: untranslated string: email tls explicit = explicit (STARTTLS) diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 3246102ba..667fb5d7e 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -959,7 +959,7 @@ 'drop portscan' => 'Log dropped portscan packets', 'drop proxy' => 'Drop all packets not addressed to proxy', 'drop samba' => 'Drop all Microsoft ports 135,137,138,139,445,1025', -'drop spoofed martians' => 'Log dropped spoofed packets and marsians', +'drop spoofed martians' => 'Log dropped spoofed packets and martians', 'drop wirelessforward' => 'Log dropped wireless forward packets', 'drop wirelessinput' => 'Log dropped wireless input packets', 'dst port' => 'Dst Port', -- 2.44.0

1 7

Re: Question about suricata in CU185
by Adolf Belka 28 Feb '24

28 Feb '24

Hi Bailey, On 25/02/2024 13:28, Bailey Calder wrote: > IPFire 2.29 (x86_64) - Core-Update 185 Development Build: next/d2991613 > > Suricata fails to start from ssh and webgui > > [root@Bailey-Firewall ~]# suricata > suricata: error while loading shared libraries: libelf.so.1: cannot open shared object file: No such file or directory > > is this a bug on my side or everyone else? Looking through the git repo I have found that elfutils has not been shipped after being changed from an addon to a core package. I have submitted a patch to ensure that the updated elfutils is shipped in CU185. Any evaluations I have done using CU185 for evaluating bug fixes, package updates etc have all been done via a fresh install of CU185 when the updated elfutils is properly included. Thanks for the heads up. Regards, Adolf. > > Thanks > Bailey

2 1

[PATCH] dns.cgi: Fixes bug#12395 - German umlauts not correctly displayed in remarks
by Adolf Belka 28 Feb '24

28 Feb '24

- If Freifunk München e.V. is entered as a remark it gets converted to Freifunk MÃ¼nchen e.V. - This is because cleanhtml is used on the remark text before saving it to the file and the HTML::Entities::encode_entities command that is run on that remark text encodes all higher bit characters as unsafe characters and replaces them with their HTML entity representation. - Have tested out the remark with a range of different characters with diacritical marks and all of the ones tested were re-written. - The use of the cleanhtml makes sense when used on URL's or on text that is going to be printed as part of the HTML code for a page but it doesn't seem to make sense for text used in a remark. - The cleanhtml function is only used on the remark text in dns.cgi and not on any other entries on the page. - Removing the call to the cleanhtml function results in the German umlauts being printed in the remark section. - Many of the WUI pages have the cleanhtml function used on remark or comment text. - fwhosts.cgi does not use cleanhtml anywhere. So all its remark sections work with characters with diacritical marks. - If this patch is accepted, I will then submit patches for the other WUI pages where characters with diacritical marks are re-written in remark or comment sections. Fixes: Bug#12395 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/dns.cgi | 2 -- 1 file changed, 2 deletions(-) diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi index 0a34d3fd6..f3dd5c7a9 100644 --- a/html/cgi-bin/dns.cgi +++ b/html/cgi-bin/dns.cgi @@ -141,8 +141,6 @@ if (($cgiparams{'SERVERS'} eq $Lang::tr{'save'}) || ($cgiparams{'SERVERS'} eq $L # Go further if there was no error. if ( ! $errormessage) { - # Check if a remark has been entered. - $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'}); my %dns_servers = (); my $id; -- 2.44.0

2 1

[PATCH 1/2] ovpnmain.cgi: Fixes bug#13404 - prevents certs being saved if common name is already used
by Adolf Belka 26 Feb '24

26 Feb '24

- This was fixed by moving the code for checking if the common name is already used, to the same location as the code for checking if the connection name is already used. - Tested out on vm testbed and confirmed that the certificates are not created and the index.txt not updated if the common name is flagged as already being used. If the entry is changed to use a new CN and Save pressed then the certs are saved and the index.txt updated. If Cancel is pressed then no certs are saved and index.txt is not updated. Fixes: Bug#13404 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index eb89c5095..98900b277 100755 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -4216,15 +4216,25 @@ if ($cgiparams{'TYPE'} eq 'net') { } } - # Check for RW if client name is already set - if ($cgiparams{'TYPE'} eq 'host') { - foreach my $key (keys %confighash) { - if ($confighash{$key}[1] eq $cgiparams{'NAME'}) { - $errormessage = $Lang::tr{'a connection with this name already exists'}; - goto VPNCONF_ERROR; - } - } - } + # Check for RW if client name is already set + if ($cgiparams{'TYPE'} eq 'host') { + foreach my $key (keys %confighash) { + if ($confighash{$key}[1] eq $cgiparams{'NAME'}) { + $errormessage = $Lang::tr{'a connection with this name already exists'}; + goto VPNCONF_ERROR; + } + } + } + + # Check if there is no other entry with this common name + if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) { + foreach my $key (keys %confighash) { + if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) { + $errormessage = $Lang::tr{'a connection with this common name already exists'}; + goto VPNCONF_ERROR; + } + } + } # Replace empty strings with a . (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./; @@ -4309,16 +4319,6 @@ if ($cgiparams{'TYPE'} eq 'net') { goto VPNCONF_ERROR; } - # Check if there is no other entry with this common name - if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) { - foreach my $key (keys %confighash) { - if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) { - $errormessage = $Lang::tr{'a connection with this common name already exists'}; - goto VPNCONF_ERROR; - } - } - } - # Save the config my $key = $cgiparams{'KEY'}; -- 2.44.0

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2024