Development February 2025

development@lists.ipfire.org

7 participants
29 discussions

[PATCH] RPZ: update code to include WEBGUI and additional languages
by Jon Murphy 02 Mar '25

02 Mar '25

What is it? Response Policy Zone (RPZ) is a mechanism to define local policies in a standardized way and load those policies from external sources. Bottom line: RPZ allows admins to easily block access to websites via DNS lookup. RPZ can block websites via categories. Examples include: fake websites, annoying pop-up ads, newly registered domains, DoH bypass sites, bad "host" services, maliscious top level domains (e.g., *.zip, *.mov), piracy, gambling, pornography, and more. RPZ lists come from various RPZ providers and their available catagories. This RPZ add-on enables the RPZ functionality by adding a couple lines in a configuration file. This add-on simply adds configuration files and adds scripts (config, metrics and sleep) to make RPZ easier for the admin to use. The RPZ scripts include additional languages: German, Spanish, French, Turkish, and Italian. RPZ itself was release in 2010 and has been part of the IPFire build since ~2015. Why is it needed? What is its value? - The RPZ concept places this filtering into IPFire, our internet access gateway, which is (should be) solely used as DNS source of the internal network. - As most sites use HTTPS it makes it difficult to filter traffic with URL Filter without also properly configuring conventional (non-transparent) mode on the proxy. RPZ is a nice replacement for the URL Filter. - No need to install and maintain an additional device like PiHole or AdBlock browser extensions on multiple user devices. - This is an additional layer of protection for users. Less worry someone will click on something that gets them into trouble. And, saying this with emphasis, the ability to do it in one place! - Blocked sites save on unneeded traffic and can lessen the threat of malware in advertisements - Logging allows the admin to see the site blocked and take actions - RPZ will be used at the home, home-office (work from home), schools, ministerial, and at the office. Device counts are small (2-6) to medium (~80) to mediam-large (200+). - RPZ can block ads, popups, phishing, scammers, spyware, malware, annoying popups, NSFW links, DOH servers, and the usual internet trash. ------------------------------ Change Log for RPZ add-on rpz-1.0.0-18 on 2025-02-05 - Build for approval & release as IPFire add-on --- rpz-beta-0.1.18-18.ipfire on 2025-02-01 rpz.cgi: - new feature: added a mod key to force a unbound restart rpz-config and rpz-make: - new feature: added action for unbound restart `rpz-config unbound-restart` rpz-metrics: - simple reformatting - rename far right column from "last update" to "last download" --- rpz-beta-0.1.17-17.ipfire on 2024-12-09 rpz-make - bug fix: corrected validation regex for wildcards like: `*.domain.com` --- rpz-beta-0.1.16-16.ipfire on 2024-11-18 rpz-make - new feature: updated validation regex - bug fix: moved validation to beginning of process. Now we validate before creating config files. rpz.cgi: - new feature: use CSS color variables of the main ipfire theme - bug fix: empty zonefile remarks were stored as “undef” and caused a warning - bug fix: HTML textarea removes the first empty line in a custom list - thank you Leo! --- rpz-beta-0.1.15-15.ipfire on 2024-11-04 rpz.cgi: - new feature: added new language file for Turkish (thank you Peppe) rpz-make - bug fix: corrected empty allow/block list issue. An empty allow/block list will now remove contents of allow/block.rpz files and remove unneeded allow/block.conf file. (thank you iptom) --- rpz-beta-0.1.14-14.ipfire on 2024-10-29 rpz-config: - bug fix: correct missing rpz extension. `rpz-config list` displayed URL incorrectly (thank you Bernhard) rpz.cgi: - bug fix: remove extra `"` in language files (thank you Bernhard) - new feature: slightly dim "apply" button when not enabled --- rpz-beta-0.1.13-13.ipfire on 2024-10-27 - skipped --- rpz-beta-0.1.12-12.ipfire on 2024-10-21 rpz.cgi: - new feature: added new language file for French (thank you gw-ipfire) --- rpz-beta-0.1.11-11.ipfire on 2024-10-18 rpz.cgi: - new feature: added new language file for Italian (thank you umberto) - new feature: added new language file for Spanish (thank you Roberto) --- rpz-beta-0.1.10-10.ipfire on 2024-10-15 rpz-make: - bug fix: corrected validation error for a custom list entry (thank you siosios) - e.g., `*.cloudflare-dns.com` install.sh: - bug fix: add chown to correct user created files update.sh: - bug fix: add chown to correct user created files (thank you siosios) --- rpz-beta-0.1.9-9.ipfire on 2024-10-08 rpz.cgi: - new feature: added new language file for German (thank you Leo) - bug fix: add missing "rpz exitcode 110" - bug fix: corrected missing RPZ menu item at menu > IPFire --- rpz-beta-0.1.8-8.ipfire on 2024-10-04 - skipped --- rpz-beta-0.1.7-7.ipfire on 2024-10-03 All: - new feature: includes beta version numbers for pakfire package, instead of only `rpz-1.0.0-1.ipfire`, for each release. rpz.cgi: - new feature: added new WebGUI at `rpz.cgi` - a BIG thank you to Leo Hofmann for all of his work creating the webgui!! - bug fix: corrected missing RPZ menu item at menu > IPFire rpz-make: - new feature: validate entries in allowlist and blocklist - new feature: add "no-reload" option for WebGUI rpz-metrics: - new feature: info can be sorted by name, by hit count, by line count, by "enabled" list or all lists backups: - bug fix: include all files in `/var/ipfire/dns/rpz` directory in backup update.sh: - bug fix: corrected ownership for `/var/ipfire/dns/rpz` directory during an update Build: - bug fix: `block.rpz.conf` and `block.rpz` from build. Files to be created by `rpz-make` WebGUI and German language file Contribution-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> Spanish language file Contribution-by: Roberto Peña Italian language file Contribution-by: Umberto Parma French language file Contribution-by: gw-ipfire Turkish language file Contribution-by: Peppe Tech Contribution-by: Bernhard Bitsch <bbitsch(a)ipfire.org> Contribution-by: Erik Kapfer <erik.kapfer(a)ipfire.org> Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org --- config/backup/includes/rpz | 4 + config/cfgroot/manualpages | 1 + config/menu/EX-rpz.menu | 6 + config/rootfiles/common/configroot | 1 + config/rootfiles/common/web-user-interface | 1 + config/rootfiles/packages/rpz | 20 + config/rpz/00-rpz.conf | 10 + config/rpz/rpz-config | 130 +++ config/rpz/rpz-functions | 85 ++ config/rpz/rpz-make | 203 +++++ config/rpz/rpz-metrics | 170 ++++ config/rpz/rpz-sleep | 58 ++ config/rpz/rpz.de.pl | 30 + config/rpz/rpz.en.pl | 30 + config/rpz/rpz.es.pl | 30 + config/rpz/rpz.fr.pl | 30 + config/rpz/rpz.it.pl | 30 + config/rpz/rpz.tr.pl | 30 + html/cgi-bin/rpz.cgi | 923 +++++++++++++++++++++ lfs/rpz | 96 +++ make.sh | 3 +- src/paks/rpz/install.sh | 36 + src/paks/rpz/uninstall.sh | 38 + src/paks/rpz/update.sh | 52 ++ 24 files changed, 2016 insertions(+), 1 deletion(-) create mode 100644 config/backup/includes/rpz create mode 100644 config/menu/EX-rpz.menu create mode 100644 config/rootfiles/packages/rpz create mode 100644 config/rpz/00-rpz.conf create mode 100644 config/rpz/rpz-config create mode 100644 config/rpz/rpz-functions create mode 100644 config/rpz/rpz-make create mode 100755 config/rpz/rpz-metrics create mode 100755 config/rpz/rpz-sleep create mode 100644 config/rpz/rpz.de.pl create mode 100644 config/rpz/rpz.en.pl create mode 100644 config/rpz/rpz.es.pl create mode 100644 config/rpz/rpz.fr.pl create mode 100644 config/rpz/rpz.it.pl create mode 100644 config/rpz/rpz.tr.pl create mode 100644 html/cgi-bin/rpz.cgi create mode 100644 lfs/rpz create mode 100644 src/paks/rpz/install.sh create mode 100644 src/paks/rpz/uninstall.sh create mode 100644 src/paks/rpz/update.sh diff --git a/config/backup/includes/rpz b/config/backup/includes/rpz new file mode 100644 index 000000000..36513e494 --- /dev/null +++ b/config/backup/includes/rpz @@ -0,0 +1,4 @@ +/var/ipfire/dns/rpz/* +/etc/unbound/zonefiles/allow.rpz +/etc/unbound/zonefiles/block.rpz +/etc/unbound/local.d/*rpz.conf diff --git a/config/cfgroot/manualpages b/config/cfgroot/manualpages index 1f7e01efc..d3a48c633 100644 --- a/config/cfgroot/manualpages +++ b/config/cfgroot/manualpages @@ -70,6 +70,7 @@ pakfire.cgi=configuration/ipfire/pakfire wlanap.cgi=addons/wireless tor.cgi=addons/tor samba.cgi=addons/samba +rpz.cgi=addons/rpz # Logs menu logs.cgi/summary.dat=configuration/logs/summary diff --git a/config/menu/EX-rpz.menu b/config/menu/EX-rpz.menu new file mode 100644 index 000000000..2f4daf410 --- /dev/null +++ b/config/menu/EX-rpz.menu @@ -0,0 +1,6 @@ +$subipfire->{'20.rpz'} = { + 'caption' => $Lang::tr{'rpz'}, + 'uri' => '/cgi-bin/rpz.cgi', + 'title' => "RPZ", + 'enabled' => 1, +}; diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index 9839eee45..b30d6aae4 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -120,6 +120,7 @@ var/ipfire/menu.d/70-log.menu #var/ipfire/menu.d/EX-apcupsd.menu #var/ipfire/menu.d/EX-guardian.menu #var/ipfire/menu.d/EX-mympd.menu +#var/ipfire/menu.d/EX-rpz.menu #var/ipfire/menu.d/EX-samba.menu #var/ipfire/menu.d/EX-tor.menu #var/ipfire/menu.d/EX-transmission.menu diff --git a/config/rootfiles/common/web-user-interface b/config/rootfiles/common/web-user-interface index 816241dae..e00464076 100644 --- a/config/rootfiles/common/web-user-interface +++ b/config/rootfiles/common/web-user-interface @@ -69,6 +69,7 @@ srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/qos.cgi srv/web/ipfire/cgi-bin/remote.cgi srv/web/ipfire/cgi-bin/routing.cgi +#srv/web/ipfire/cgi-bin/rpz.cgi #srv/web/ipfire/cgi-bin/samba.cgi srv/web/ipfire/cgi-bin/services.cgi srv/web/ipfire/cgi-bin/shutdown.cgi diff --git a/config/rootfiles/packages/rpz b/config/rootfiles/packages/rpz new file mode 100644 index 000000000..1c8663049 --- /dev/null +++ b/config/rootfiles/packages/rpz @@ -0,0 +1,20 @@ +etc/unbound/local.d/00-rpz.conf +etc/unbound/zonefiles +etc/unbound/zonefiles/allow.rpz +usr/sbin/rpz-config +usr/sbin/rpz-functions +usr/sbin/rpz-make +usr/sbin/rpz-metrics +usr/sbin/rpz-sleep +var/ipfire/addon-lang/rpz.de.pl +var/ipfire/addon-lang/rpz.en.pl +var/ipfire/addon-lang/rpz.es.pl +var/ipfire/addon-lang/rpz.fr.pl +var/ipfire/addon-lang/rpz.it.pl +var/ipfire/addon-lang/rpz.tr.pl +var/ipfire/backup/addons/includes/rpz +var/ipfire/dns/rpz +var/ipfire/dns/rpz/allowlist +var/ipfire/dns/rpz/blocklist +var/ipfire/menu.d/EX-rpz.menu +srv/web/ipfire/cgi-bin/rpz.cgi diff --git a/config/rpz/00-rpz.conf b/config/rpz/00-rpz.conf new file mode 100644 index 000000000..f005a4f2e --- /dev/null +++ b/config/rpz/00-rpz.conf @@ -0,0 +1,10 @@ +server: + module-config: "respip validator iterator" + +rpz: + name: allow.rpz + zonefile: /etc/unbound/zonefiles/allow.rpz + rpz-action-override: passthru + rpz-log: yes + rpz-log-name: allow + rpz-signal-nxdomain-ra: yes diff --git a/config/rpz/rpz-config b/config/rpz/rpz-config new file mode 100644 index 000000000..c72d50f9b --- /dev/null +++ b/config/rpz/rpz-config @@ -0,0 +1,130 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024-2025 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +version="2025-01-11 - v44" + +############### Functions ############### + +source /usr/sbin/rpz-functions + +############### Main ############### + +tagName="unbound" + +rpzAction="${1}" # input RPZ action +rpzName="${2}" # input RPZ name +rpzURL="${3}" # input RPZ URL +rpzOption1="${4}" # input RPZ option #1 +rpzOption2="${5}" # input RPZ option #2 + +rpzConfig="/etc/unbound/local.d/${rpzName}.rpz.conf" # output zone conf file +rpzFile="/etc/unbound/zonefiles/${rpzName}.rpz" # output for RPZ file + +rpzLog="yes" # log default is yes +ucReload="yes" # reload default is yes + +while [[ $# -gt 0 ]] ; do + case "$1" in + --no-log ) rpzLog="no" ;; + --no-reload ) ucReload="no" ; checkConf="no" ;; + esac + shift # Shift after checking all the cases to get next option +done + +case "${rpzAction}" in + # add new rpz list + add ) + check_name "${rpzName}" # is this a valid name? + # does this config already exist? If yes, then exit + if [[ -f "${rpzConfig}" ]] ; then + msg_log "error: rpz: duplicate - ${rpzConfig} already exists. exit" + exit 104 + fi + + # is this a valid URL? + regex='^https://[-[:alnum:]\+&@#/%?=~_|!:,.;]*[-[:alnum:]\+&@#/%=~_|]' + if ! [[ "${rpzURL}" =~ $regex ]] ; then + msg_log "error: rpz: the URL is not valid: \"${rpzURL}\". exit." + exit 105 + fi + + # create the zone config file + { + echo "rpz:" + echo " name: ${rpzName}.rpz" + echo " zonefile: ${rpzFile}" + echo " url: ${rpzURL}" + echo " rpz-action-override: nxdomain" + echo " rpz-log: ${rpzLog}" + echo " rpz-log-name: ${rpzName}" + echo " rpz-signal-nxdomain-ra: yes" + } > "${rpzConfig}" + + # set-up zonefile + # create an empty rpz file if it does not exist + if [[ ! -f "${rpzFile}" ]] ; then + touch "${rpzFile}" + # unbound requires these settings for rpz files + set_permissions "${rpzFile}" "${rpzConfig}" + fi + ;; + + # trash config file & rpz file + remove ) + if ! [[ -f "${rpzConfig}" ]] ; then + msg_log "error: rpz: cannot remove ${rpzConfig}, does not exist. exit" + exit 106 + fi + + msg_log "info: rpz: remove config file & rpz file \"${rpzName}\"" + rm "${rpzConfig}" + rm "${rpzFile}" + ;; + + reload ) + check_unbound_conf "${checkConf}" + ;; + + list ) + awk -F':' '/^\s*name:/{ gsub(/[[:blank:]]|\.rpz/, "",$2) ; NAME=$2 } \ + /^\s*url:/{ gsub(/[[:blank:]]/, "") ; print NAME"="$2":"$3} ' \ + /etc/unbound/local.d/*rpz.conf + exit + ;; + + unbound-restart ) + check_unbound_conf "${checkConf}" + unbound_restart + exit + ;; + + * ) + msg_log "error: rpz: missing or incorrect parameter" + printf "Usage: $(basename "$0") <ACTION> <NAME> <URL> <OPTION> <OPTION>\n" + printf "Version: ${version}\n" + exit 108 + ;; + +esac + +unbound_control_reload "${ucReload}" + +exit diff --git a/config/rpz/rpz-functions b/config/rpz/rpz-functions new file mode 100644 index 000000000..ace1d2690 --- /dev/null +++ b/config/rpz/rpz-functions @@ -0,0 +1,85 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +version="2024-12-10 - v02" + +############### Functions ############### + +msg_log () { + logger --tag "${tagName}" "$*" + if tty --silent ; then + echo "${tagName}:" "$*" + fi +} + +# check for a valid name +check_name () { + local theName="${1}" + + regex='^[a-zA-Z0-9_]+$' # no dash or plus, alpha numeric only + regex1='^(allow|block)$' # allow and block are reserved NAMEs + if [[ ! "${theName}" =~ $regex ]] || [[ "${theName}" =~ $regex1 ]] ; then + msg_log "error: rpz: the NAME is not valid: \"${theName}\". exit." + exit 101 + fi +} + +set_permissions () { + chown nobody:nobody "$@" + chmod 644 "$@" +} + +check_unbound_conf () { + local thecheckConf="${1:-yes}" # check config default is yes + + # check the above config files + if [[ "${thecheckConf}" == yes ]] ; then + msg_log "info: rpz: check for errors with \"unbound-checkconf\"" + + if ! unbound-checkconf ; then + msg_log "error: rpz: unbound-checkconf found invalid configuration." + msg_log \ + "error: rpz: In Terminal run the command \"unbound-checkconf\" for more information. exit." + exit 102 + fi + fi +} + +unbound_control_reload () { + local theReload="${1:-yes}" # reload default is yes + + if [[ "${theReload}" == yes ]] ; then + # reload due to the changes + msg_log "info: rpz: run \"unbound-control reload\"" + + if ! unbound-control reload ; then + msg_log "error: rpz: unbound-control reload. exit." + exit 109 + fi + fi +} + +unbound_restart () { + # restart due to the changes + msg_log "info: rpz: run \"unbound restart\"" + + /usr/local/bin/unboundctrl restart +} diff --git a/config/rpz/rpz-make b/config/rpz/rpz-make new file mode 100644 index 000000000..927d55170 --- /dev/null +++ b/config/rpz/rpz-make @@ -0,0 +1,203 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024-2025 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +version="2025-01-11 - v14" + +############### Functions ############### + +source /usr/sbin/rpz-functions + +# create the config file for allow +make_allow_config () { + local theLog="${1:-yes}" # log default ON + local theConfig="/etc/unbound/local.d/00-rpz.conf" # output zone conf file + local theList="/var/ipfire/dns/rpz/allowlist" # input custom list of domains + + msg_log "info: rpz: make config file \"00-rpz.conf\"" + + echo "server: + module-config: \"respip validator iterator\"" > "${theConfig}" + + # does allow list exist? + if [[ -s "${theList}" ]] && grep -q . "${theList}" ; then + + echo "rpz: + name: allow.rpz + zonefile: /etc/unbound/zonefiles/allow.rpz + rpz-action-override: passthru + rpz-log: ${theLog} + rpz-log-name: allow + rpz-signal-nxdomain-ra: yes" >> "${theConfig}" + + fi + + # set-up zonefile - unbound requires these settings for rpz files + set_permissions "${theConfig}" +} + +# create the config file for block +make_block_config () { + local theLog="${1:-yes}" # log default ON + local theConfig="/etc/unbound/local.d/block.rpz.conf" # output zone conf file + local theList="/var/ipfire/dns/rpz/blocklist" # input custom list of domains + + msg_log "info: rpz: make config file \"block.rpz.conf\"" + + # does block list exist? + if [[ -s "${theList}" ]] && grep -q . "${theList}" ; then + + echo "rpz: + name: block.rpz + zonefile: /etc/unbound/zonefiles/block.rpz + rpz-action-override: nxdomain + rpz-log: ${theLog} + rpz-log-name: block + rpz-signal-nxdomain-ra: yes" > "${theConfig}" + + # set-up zonefile - unbound requires these settings for rpz files + set_permissions "${theConfig}" + else + # no - trash the config file + rm --verbose /etc/unbound/local.d/block.rpz.conf + fi +} + +# create an RPZ file for allow or block +make_rpz_file () { + local theName="${1}" # allow or block + local theAction='.' # the default is nxdomain or block + local actionList + + local theList="/var/ipfire/dns/rpz/${theName}list" # input custom list of domains + local theZonefile="/etc/unbound/zonefiles/${theName}.rpz" # output file for RPZ + + # does a list exist? + if [[ -s "${theList}" ]] && grep -q . "${theList}" ; then + + # for allow set to passthru + [[ "${theName}" == allow ]] && theAction='rpz-passthru.' + + # drop any extra "blanks" and add "CNAME <RPZ action>." to each line + actionList=$( awk '{$1=$1};1' "${theList}" | + sed "/^[^;].*[[:alnum:]]/ s|$| CNAME ${theAction}|" ) + + msg_log "info: rpz: create zonefile for \"${theName}list\"" + +echo "; Name: ${theName} list +; Last modified: $(date "+%Y-%m-%d at %H.%M.%S %Z") +; +; domains with actions list +; +${actionList}" > "${theZonefile}" + + # set-up zonefile - unbound requires these settings for rpz files + set_permissions "${theZonefile}" + # set-up allow/block list files + set_permissions "${theList}" + else + msg_log "info: rpz: the ${theList} is empty." + + rm --verbose "${theZonefile}" # trash the RPZ file + fi +} + +# check if allow/block list is valid +validate_list () { + local theName="${1}" # allow or block + local theList="/var/ipfire/dns/rpz/${theName}list" # input custom list of domains + + # remove good: + # - properly formated domain names with or without leading wildcard + # - properly formated top level domain (TLD) names with wildcard + # - blank lines and comment lines + # remaining lines are considered "bad" + bad_lines=$( sed --regexp-extended \ + '/^(\*\.)?([a-zA-Z0-9](([a-zA-Z0-9\-]){0,61}[a-zA-Z0-9])?\.)+([a-zA-Z]{2,}|xn--[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])$/d ; + /^(\*\.)([a-z]{2,61}|xn--[a-z0-9]{1,60})$/d ; + /^$/d ; /^;/d' "${theList}" ) + + if [[ ! -z "${bad_lines}" ]] ; then + msg_log "error: rpz: invalid line(s) in ${theList}." + printf "%s\n" "bad line(s): ${bad_lines}" + exit 110 + fi +} + + +############### Main ############### + +tagName="unbound" + +rpzName="${1}" # input RPZ name + +rpzLog="yes" # log default is yes +ucReload="yes" # reload default is yes + +while [[ $# -gt 0 ]] ; do + case "$1" in + --no-log ) rpzLog="no" ;; + --no-reload ) ucReload="no" ; checkConf="no" ;; + esac + shift # Shift after checking all the cases to get next option +done + +case "${rpzName}" in + # make a new allow or block rpz file + + allow ) + validate_list 'allow' # is the allowlist valid? + make_allow_config "${rpzLog}" + make_rpz_file 'allow' + ;; + + allowblock ) + validate_list 'allow' # is the list valid? + make_allow_config "${rpzLog}" + make_rpz_file 'allow' + ;& + + block ) + validate_list 'block' # is the blocklist valid? + make_block_config "${rpzLog}" + make_rpz_file 'block' + ;; + + reload ) + check_unbound_conf "${checkConf}" + ;; + + unbound-restart ) + check_unbound_conf "${checkConf}" + unbound_restart + exit + ;; + + * ) + msg_log "error: rpz: missing or incorrect parameter" + printf "Usage: $(basename "$0") <NAME> <OPTION> <OPTION>\n" + printf "Version: ${version}\n" + exit 108 + ;; +esac + +unbound_control_reload "${ucReload}" + +exit diff --git a/config/rpz/rpz-metrics b/config/rpz/rpz-metrics new file mode 100755 index 000000000..4d43e1629 --- /dev/null +++ b/config/rpz/rpz-metrics @@ -0,0 +1,170 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +version="2025-01-20 - v25" + +############### Main ############### + +weeks="2" # default to two message logs +sortBy="name" # default "by name" +rpzActive="enabled" # default "enabled only" + +while [[ $# -gt 0 ]] ; do + case "$1" in + --by-names | --by-name | name ) sortBy="name" ;; + + --by-hits | --by-hit | hits | hit ) sortBy="hit" ;; + + --by-lines | --by-line | lines | line ) sortBy="line" ;; + + --by-effect ) sortBy="effect" ;; + + --enabled-only ) rpzActive="enabled" ;; + + --active-all | --all | all ) rpzActive="all" ;; + + [0-9] | [0-9][0-9] ) weeks=$1 ;; + esac + shift # Shift after checking all the cases to get next option +done + +# get the list of message logs for N weeks +messageLogs=$( find /var/log/messages* -type f | sort --version-sort | + head -"${weeks}" ) + +# get the list of RPZ names & counts from the message log(s) +rpzNameCount=$( for logf in ${messageLogs} ; do + zgrep --text --fixed-strings 'info: rpz: applied' "${logf}" | + awk '$10 ~ /\[\w*]/ { print $10 }' ; + done | sort | uniq --count ) + +# flip results and remove brackets `[` and `]` +rpzNameCount=$( echo "${rpzNameCount}" | + awk '{ print $2, $1 }' | + sed --regexp-extended 's|^\[(.*)\]|\1|' ) + +# grab only names +rpzNames=$( echo "${rpzNameCount}" | awk '{ print $1 }' ) + +# get list of RPZ files +rpzFileList=$( find /etc/unbound/zonefiles -type f -iname "*.rpz" ) + +# get basename of those files +rpzBaseNames=$( echo "${rpzFileList}" | + sed 's|/etc/unbound/zonefiles/||g ; s|\.rpz||g ;' ) + +# add to rpzNames +rpzNames="${rpzNames}"$'\n'"${rpzBaseNames}" + +# drop duplicate names +rpzNames=$( echo "${rpzNames}" | sort --unique ) + +# get line count for each RPZ +lineCount=$( echo "${rpzFileList}" | xargs wc -l ) + +# get comment line count and blank line count for each RPZ +commentCount=$( echo "${rpzFileList}" | xargs grep --count -e "^$" -e "^;" ) + +# get modified date each RPZ +modDateList=$( echo "${rpzFileList}" | xargs stat -c '%.10y %n' ) + +ucListAuthZones=$( unbound-control list_auth_zones ) + +# get width of RPZ names +pWidth=$( echo "${rpzNames}" | awk '{ print $1" " }' | wc -L ) +pFormat="%-${pWidth}s %-8s %-8s %8s %12s %12s\n" + +# print title line +printf "${pFormat}" "name" "hits" "active" "lines" " hits/line" "last download" +printf -- "--------------" + +theResults="" +totalLines=0 +totalHits=0 +while read -r theName +do + printf -- "--" # pretend progress bar + + # is this RPZ list active? + theActive="disabled" + if grep --quiet "^${theName}\.rpz" <<< "${ucListAuthZones}" + then + theActive="enabled" + else + [[ "${rpzActive}" == enabled ]] && continue + fi + + # get hit count + theHits="0" + if output=$( grep "^${theName}\s" <<< "${rpzNameCount}" ) ; then + theHits=$( echo "${output}" | awk '{ print $2 }' ) + totalHits=$(( totalHits + theHits )) + fi + + # get line count + theLines="n/a" + hitsPerLine="0" + if output=$( grep --fixed-strings "/${theName}.rpz" <<< "${lineCount}" ) ; then + theLines=$( echo "${output}" | awk '{ print $1 }' ) + totalLines=$(( totalLines + theLines )) + + if [[ "${theLines}" -gt 2 ]] ; then + hitsPerLine=$(( 100 * theHits / theLines )) + fi + fi + + # get modification date + theModDate="n/a" + if output=$( grep --fixed-strings "/${theName}.rpz" <<< "${modDateList}" ) ; then + theModDate=$( echo "${output}" | awk '{ print $1 }' ) + fi + + # add to results list + theResults+="${theName} ${theHits} ${theActive} ${theLines} ${hitsPerLine} ${theModDate}"$'\n' + +done <<< "${rpzNames}" + +case "${sortBy}" in + # sort by "active" then by "name" + name) sortArg=(-k3,3r -k1,1) ;; + + # sort by "active" then by "hits" then by "name" + hit) sortArg=(-k3,3r -k2,2nr -k1,1) ;; + + # sort by "active" then by "lines" then by "name" + line) sortArg=(-k3,3r -k4,4nr -k1,1) ;; + + # sort by "active" then by "effect" then by "name" + effect) sortArg=(-k3,3r -k5,5nr -k1,1) ;; +esac + +printf -- "--------------\n" +# remove blank lines, sort, print as columns +echo "${theResults}" | + awk '!/^[[:space:]]*$/' | + sort "${sortArg[@]}" | + awk --assign=width="${pWidth}" \ + '{ printf "%-*s %-8s %-8s %8s %10s %% %12s\n", width, $1, $2, $3, $4, $5, $6 }' + +printf "${pFormat}" "" "=======" "" "========" "" "" +printf "${pFormat}" "Totals -->" "${totalHits}" "" "${totalLines}" "" "" + +exit diff --git a/config/rpz/rpz-sleep b/config/rpz/rpz-sleep new file mode 100755 index 000000000..dd3603599 --- /dev/null +++ b/config/rpz/rpz-sleep @@ -0,0 +1,58 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +version="2024-08-16" # v05 + +############### Functions ############### + +# send message to message log +msg_log () { + logger --tag "${tagName}" "$*" + if tty --silent ; then + echo "${tagName}:" "$*" + fi +} + +############### Main ############### + +tagName="unbound" + +sleepTime="${1:-5m}" # default to sleep for 5m (5 minutes) + +zoneList=$( unbound-control list_auth_zones | awk '{print $1}' ) + +for zone in ${zoneList} ; do + printf "disable ${zone}\t" + unbound-control rpz_disable "${zone}" +done + +msg_log "info: rpz: disabled all zones for ${sleepTime}" + +sleep "${sleepTime}" + +for zone in ${zoneList} ; do + printf "enable ${zone}\t" + unbound-control rpz_enable "${zone}" +done + +msg_log "info: rpz: enabled all zones" + +exit diff --git a/config/rpz/rpz.de.pl b/config/rpz/rpz.de.pl new file mode 100644 index 000000000..3770c6bb0 --- /dev/null +++ b/config/rpz/rpz.de.pl @@ -0,0 +1,30 @@ +# Added for Response Policy Zone (RPZ) add-on +%tr = (%tr, +'rpz' => 'Response Policy Zones (RPZ)', +'rpz apply' => 'Übernehmen', +'rpz cl allow enable' => 'Benutzerdefinierte Allowlist aktivieren:', +'rpz cl allow info' => 'Zugelassene Domains (eine pro Zeile)<br>Beispiel: domain.com, *.domain.com', +'rpz cl allow' => 'Benutzerdefinierte Allowlist', +'rpz cl block enable' => 'Benutzerdefinierte Blocklist aktivieren:', +'rpz cl block info' => 'Gesperrte Domains (eine pro Zeile)<br>Beispiel: domain.com, *.domain.com', +'rpz cl block' => 'Benutzerdefinierte Blocklist', +'rpz cl' => 'Benutzerdefinierte Listen', +'rpz exitcode 101' => 'Der Name enthält unzulässige Zeichen', +'rpz exitcode 102' => 'unbound-checkconf hat eine fehlerhafte Konfiguration ermittelt. Führen Sie das Kommando unbound-checkconf auf der Konsole aus, um weitere Informationen zu erhalten.', +'rpz exitcode 103' => 'Die benutzerdefinierte Allow-/Blocklist ist leer', +'rpz exitcode 104' => 'Ein Eintrag mit identischem Namen existiert bereits', +'rpz exitcode 105' => 'Die URL ist ungültig', +'rpz exitcode 106' => 'Eintrag kann nicht entfernt werden, der Name existiert nicht', +'rpz exitcode 107' => 'Der Name ist ungültig - nur "allow" oder "block" möglich', +'rpz exitcode 108' => 'Fehlende oder inkorrekte Parameter', +'rpz exitcode 109' => 'unbound-control reload ist fehlgeschlagen', +'rpz exitcode 110' => 'Die benutzerdefinierte Allow-/Blocklist enthält unzulässige Einträge', +'rpz exitcode 201' => 'Die Anmerkung enthält unzulässige Zeichen', +'rpz exitcode 202' => 'Ungültiger Eintrag in der benutzerdefinierten Allowlist, Zeile ', +'rpz exitcode 203' => 'Ungültiger Eintrag in der benutzerdefinierten Blocklist, Zeile ', +'rpz exitcode 204' => 'Ausgewählter Eintrag existiert nicht: ', +'rpz zf editor' => 'Zonendatei-Eintrag bearbeiten', +'rpz zf imported' => '(importiert aus rpz-config)', +'rpz zf remark info' => 'Erlaubte Zeichen sind a-z, A-Z, 0-9 und Unterstriche', +'rpz zf' => 'Zonendateien', +); diff --git a/config/rpz/rpz.en.pl b/config/rpz/rpz.en.pl new file mode 100644 index 000000000..0720a8940 --- /dev/null +++ b/config/rpz/rpz.en.pl @@ -0,0 +1,30 @@ +# Added for Response Policy Zone (RPZ) add-on +%tr = (%tr, +'rpz' => 'Response Policy Zones (RPZ)', +'rpz apply' => 'Apply', +'rpz cl allow enable' => 'Enable custom allowlist:', +'rpz cl allow info' => 'Allowed domains (one per line)<br>Example: domain.com, *.domain.com', +'rpz cl allow' => 'Custom allowlist', +'rpz cl block enable' => 'Enable custom blocklist:', +'rpz cl block info' => 'Blocked domains (one per line)<br>Example: domain.com, *.domain.com', +'rpz cl block' => 'Custom blocklist', +'rpz cl' => 'Custom lists', +'rpz exitcode 101' => 'the NAME is not valid', +'rpz exitcode 102' => 'unbound-checkconf found invalid configuration. In the Terminal run the command unbound-checkconf for more information', +'rpz exitcode 103' => 'the allow/block list is empty', +'rpz exitcode 104' => 'duplicate - NAME already exists', +'rpz exitcode 105' => 'the URL is not valid', +'rpz exitcode 106' => 'cannot remove the NAME does not exist', +'rpz exitcode 107' => 'the NAME is not valid - "allow" or "block" only', +'rpz exitcode 108' => 'missing or incorrect parameter', +'rpz exitcode 109' => 'unbound-control reload failed', +'rpz exitcode 110' => 'custom Allowlist/Blocklist contains invalid entries', +'rpz exitcode 201' => 'the REMARK is not valid', +'rpz exitcode 202' => 'invalid entry in allowlist, line ', +'rpz exitcode 203' => 'invalid entry in blocklist, line ', +'rpz exitcode 204' => 'Selected entry does not exist: ', +'rpz zf editor' => 'Edit zonefiles entry', +'rpz zf imported' => '(imported from rpz-config)', +'rpz zf remark info' => 'Valid characters are a-z, A-Z, 0-9 and underscore.', +'rpz zf' => 'Zonefiles', +); diff --git a/config/rpz/rpz.es.pl b/config/rpz/rpz.es.pl new file mode 100644 index 000000000..98628e4aa --- /dev/null +++ b/config/rpz/rpz.es.pl @@ -0,0 +1,30 @@ +# Added for Response Policy Zone (RPZ) add-on +%tr = (%tr, +'rpz' => 'Zonas de política de respuesta (RPZ)', +'rpz apply' => 'Aplicar', +'rpz cl allow enable' => 'Habilitar la lista blanca personalizada:', +'rpz cl allow info' => 'Dominio permitido (uno por línea)<br>Ejemplo: domain.com, *.domain.com', +'rpz cl allow' => 'Lista blanca personalizada', +'rpz cl block enable' => 'Habilitar la lista negra personalizada:', +'rpz cl block info' => 'Dominio bloqueado (uno por línea)<br>Ejemplo: domain.com, *.domain.com', +'rpz cl block' => 'Lista negra personalizada', +'rpz cl' => 'Lista personalizada', +'rpz exitcode 101' => 'El NOMBRE no es válido', +'rpz exitcode 102' => 'unbound-checkconf ha encontrado una configuración no válida. Desde Terminal, ejecute el comando unbound-checkconf para mayor información', +'rpz exitcode 103' => 'La lista de permitidos/bloqueados está vacía', +'rpz exitcode 104' => 'duplicado - NOMBRE ya existe', +'rpz exitcode 105' => 'la URL no es válida', +'rpz exitcode 106' => 'no es posible eliminar el NOMBRE que no existe', +'rpz exitcode 107' => 'el NOMBRE no es válido - sólo "permitir" o "bloquear"', +'rpz exitcode 108' => 'parámetro faltante o incorrecto', +'rpz exitcode 109' => 'Error al recargar unbound-control', +'rpz exitcode 110' => 'la Lista blanca/Lista negra personalizada contiene entradas no válidas', +'rpz exitcode 201' => 'el COMENTARIO no es válido', +'rpz exitcode 202' => 'entrada no válida en la lista blanca, línea ', +'rpz exitcode 203' => 'entrada no válida en la lista negra, línea ', +'rpz exitcode 204' => 'La entrada seleccionada no existe: ', +'rpz zf editor' => 'Editar la entrada de archivos de zona', +'rpz zf imported' => '(importado de rpz-config)', +'rpz zf remark info' => 'Los caracteres válidos son a-z, A-Z, 0-9 y guión bajo', +'rpz zf' => 'Archivos de zona', +); diff --git a/config/rpz/rpz.fr.pl b/config/rpz/rpz.fr.pl new file mode 100644 index 000000000..f35f3c2d0 --- /dev/null +++ b/config/rpz/rpz.fr.pl @@ -0,0 +1,30 @@ +# Added for Response Policy Zone (RPZ) add-on +%tr = (%tr, +'rpz' => 'Response Policy Zones (RPZ)', +'rpz apply' => 'Appliquer', +'rpz cl allow enable' => 'Activer la liste d\'autorisations personnalisée:', +'rpz cl allow info' => 'Domaines autorisés (un par ligne)<br>Example: domain.com, *.domain.com', +'rpz cl allow' => 'Liste d\'autorisations personnalisée', +'rpz cl block enable' => 'Activer la liste de blocage personnalisée:', +'rpz cl block info' => 'Domaines bloqués (un par ligne)<br>Example: domain.com, *.domain.com', +'rpz cl block' => 'liste de blocage personnalisé', +'rpz cl' => 'Listes personnalisées', +'rpz exitcode 101' => 'le NOM n\'est pas valide', +'rpz exitcode 102' => 'unbound-checkconf configuration non valide trouvée. Dans le terminal, exécutez la commande unbound-checkconf pour plus d\'informations', +'rpz exitcode 103' => 'la liste autoriser/bloquer est vide', +'rpz exitcode 104' => 'le NOM existe déjà', +'rpz exitcode 105' => 'L\'URL n\'est pas valide', +'rpz exitcode 106' => 'impossible de supprimer le NOM n\'existe pas', +'rpz exitcode 107' => 'le NOM n\'est pas valide - « autoriser » ou « bloquer » seulement', +'rpz exitcode 108' => 'paramètre manquant ou incorrect', +'rpz exitcode 109' => 'unbound-control rechargement échoué', +'rpz exitcode 110' => 'la liste autoriser/bloquer contient des entrées non valides', +'rpz exitcode 201' => 'la REMARQUE n\'est pas valable', +'rpz exitcode 202' => 'entrée non valide dans la liste d\'autorisation, ligne ', +'rpz exitcode 203' => 'entrée non valide dans la liste de blocs, ligne ', +'rpz exitcode 204' => 'L\'entrée sélectionnée n\'existe pas: ', +'rpz zf editor' => 'Modifier l\'entrée Fichiers Zone', +'rpz zf imported' => '(importé de rpz-config)', +'rpz zf remark info' => 'Les caractères valides sont a-z, A-Z, 0-9 et soulignement.', +'rpz zf' => 'Fichiers Zone', +); diff --git a/config/rpz/rpz.it.pl b/config/rpz/rpz.it.pl new file mode 100644 index 000000000..ee81605c9 --- /dev/null +++ b/config/rpz/rpz.it.pl @@ -0,0 +1,30 @@ +# Added for Response Policy Zone (RPZ) add-on +%tr = (%tr, +'rpz' => 'Response Policy Zones (RPZ)', +'rpz apply' => 'Applica', +'rpz cl allow enable' => 'Abilita la Whitelist personalizzata:', +'rpz cl allow info' => 'Domini consentiti (uno per riga)<br>Esempio: domain.com, *.domain.com', +'rpz cl allow' => 'Whitelist personalizzata', +'rpz cl block enable' => 'Abilita la Blacklist personalizzata:', +'rpz cl block info' => 'Domini bloccati (uno per riga)<br>Esempio: domain.com, *.domain.com', +'rpz cl block' => 'Blacklist personalizzata', +'rpz cl' => 'Liste personalizzate', +'rpz exitcode 101' => 'il NOME non è valido', +'rpz exitcode 102' => 'unbound-checkconf ha trovato una configurazione non valida. Dal Terminale esegui il comando unbound-checkconf per maggiori informazioni', +'rpz exitcode 103' => 'l\'elenco consentiti/bloccati è vuoto', +'rpz exitcode 104' => 'duplicato - NAME esiste di già', +'rpz exitcode 105' => 'l\'URL non è valido', +'rpz exitcode 106' => 'non è possibile rimuovere il NOME non esiste', +'rpz exitcode 107' => 'il NOME non è valido - solo "consenti" o "blocca"', +'rpz exitcode 108' => 'parametro mancante o non corretto', +'rpz exitcode 109' => 'ricaricamento del controllo non associato non riuscito', +'rpz exitcode 110' => 'la Whitelist/Blacklist personalizzata contiene voci non valide', +'rpz exitcode 201' => 'l"OSSERVAZIONE non è valida', +'rpz exitcode 202' => 'voce non valida nella Whitelist, riga ', +'rpz exitcode 203' => 'voce non valida nella Blacklist, riga ', +'rpz exitcode 204' => 'La voce selezionata non esiste: ', +'rpz zf editor' => 'Modifica la voce dei file di zona', +'rpz zf imported' => '(importato da rpz-config)', +'rpz zf remark info' => 'I caratteri validi sono a-z, A-Z, 0-9 e trattino basso', +'rpz zf' => 'Zonefiles', +); diff --git a/config/rpz/rpz.tr.pl b/config/rpz/rpz.tr.pl new file mode 100644 index 000000000..00226e192 --- /dev/null +++ b/config/rpz/rpz.tr.pl @@ -0,0 +1,30 @@ +# I�in eklendi Ayriyeten Response Policy Zone (RPZ) +%tr = (%tr, +'rpz' => 'Response Policy Zones (RPZ)', +'rpz apply' => 'Uygulamak', +'rpz cl allow enable' => '�zel Etkinlestir allowlist:', +'rpz cl allow info' => 'Izin verilmis domains (satir basina bir)<br>�rnegin: domain.com, *.domain.com', +'rpz cl allow' => 'Etkinlestir allowlist', +'rpz cl block enable' => '�zel Etkinlestir blocklist:', +'rpz cl block info' => 'Engellenmis domains (satir basina bir)<br>�rnegin: domain.com, *.domain.com', +'rpz cl block' => 'Engellenmis blocklist', +'rpz cl' => 'Engellenmis lists', +'rpz exitcode 101' => 'NAME ge�erli degil', +'rpz exitcode 102' => 'unbound-checkconf ge�ersiz yapilandirma bulundu. Terminalde daha fazla bilgi i�in Unbound-checkConf komutunu �alistirin', +'rpz exitcode 103' => 'allow/block liste bos', +'rpz exitcode 104' => 'kopyalamak - NAME zaten var', +'rpz exitcode 105' => 'URL ge�erli degil', +'rpz exitcode 106' => '�ikarilamiyor NAME yok', +'rpz exitcode 107' => 'NAME ge�erli degil - "allow" veya "block" yalniz', +'rpz exitcode 108' => 'Parametre eksik veya yanlis', +'rpz exitcode 109' => 'unbound-control basarisiz', +'rpz exitcode 110' => 'Engellenmis Allowlist/Blocklist ge�ersiz girisler i�erir', +'rpz exitcode 201' => 'REMARK ge�erli degil', +'rpz exitcode 202' => 'Ge�ersiz giris allowlist, line ', +'rpz exitcode 203' => 'Ge�ersiz giris blocklist, line ', +'rpz exitcode 204' => 'Se�ilen giris yok: ', +'rpz zf editor' => 'yazimlamak zonefiles giris', +'rpz zf imported' => '(ithal edildi rpz-config)', +'rpz zf remark info' => 'Ge�erli karakterler a-z, A-Z, 0-9ve alt�st.', +'rpz zf' => 'Zonefiles', +); diff --git a/html/cgi-bin/rpz.cgi b/html/cgi-bin/rpz.cgi new file mode 100644 index 000000000..a821c92ac --- /dev/null +++ b/html/cgi-bin/rpz.cgi @@ -0,0 +1,923 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2005-2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; +use Scalar::Util qw(looks_like_number); + +# debugging +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; +#use Data::Dumper; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + +###--- Extra HTML ---### +my $extraHead = <<END +<style> + /* alternating row background */ + .tbl tr:nth-child(2n+2) { + background-color: var(--color-light-grey); + } + .tbl tr:nth-child(2n+3) { + background-color: var(--color-grey); + } + /* text styles */ + .tbl th:not(:last-child) { + text-align: left; + } + div.right { + text-align: right; + margin-top: 0.5em; + } + /* customlist input */ + textarea.domainlist { + margin: 0.5em 0; + resize: vertical; + min-height: 10em; + overflow: auto; + white-space: pre; + } + button[type=submit]:disabled { + opacity: 0.6; + } +</style> +END +; +###--- End of extra HTML ---### + + +### Settings ### + +# Request DNS service reload after configuration change +my $RPZ_RELOAD_FLAG = "${General::swroot}/dns/rpz/reload.flag"; + +# Configuration file for all available zonefiles +# Format: index, name (unique), enabled (on/off), URL, remark +my $ZONEFILES_CONF = "${General::swroot}/dns/rpz/zonefiles.conf"; + +# Configuration file for custom lists +# IDs: 0=allowlist, 1=blocklist, 2=options (allow/block enabled) +my $CUSTOMLISTS_CONF = "${General::swroot}/dns/rpz/customlists.conf"; + +# Export custom lists to rpz-config +my $RPZ_ALLOWLIST = "${General::swroot}/dns/rpz/allowlist"; +my $RPZ_BLOCKLIST = "${General::swroot}/dns/rpz/blocklist"; + + +### Preparation ### + +# Create missing config files +unless(-f $ZONEFILES_CONF) { &General::system('touch', "$ZONEFILES_CONF"); } +unless(-f $CUSTOMLISTS_CONF) { &General::system('touch', "$CUSTOMLISTS_CONF"); } + + +## Global gui data +my $errormessage = ""; + +## Global configuration data +my %zonefiles = (); +my %customlists = (); +&_zonefiles_load(); +&_customlists_load(); + +## Global CGI form data +my %cgiparams = (); +&Header::getcgihash(\%cgiparams); + +my $action = $cgiparams{'ACTION'} // 'NONE'; +my $action_key = $cgiparams{'KEY'} // ''; # entry being edited, empty = none/new + + +###--- Process form actions ---### + +# Zonefiles action: Check whether the requested entry exists +if((substr($action, 0, 3) eq 'ZF_') && ($action_key)) { + unless(defined $zonefiles{$action_key}) { + $errormessage = &_rpz_error_tr(204, $action_key); + $action = 'NONE'; + } +} + +## Perform actions +if($action eq 'ZF_SAVE') { ## Save new or modified zonefiles entry + if(&_action_zf_save()) { + $action = 'NONE'; # success, return to main page + &_http_prg_redirect(); + } else { + $action = 'ZF_EDIT'; # error occured, keep editing + } + +} elsif($action eq 'ZF_TOGGLE') { ## Toggle on/off + if(&_action_zf_toggle()) { + $action = 'NONE'; + &_http_prg_redirect(); + } + +} elsif($action eq 'ZF_REMOVE') { ## Remove entry + if(&_action_zf_remove()) { + $action = 'NONE'; + &_http_prg_redirect(); + } + +} elsif($action eq 'CL_SAVE') { ## Save custom lists + if(&_action_cl_save()) { + $action = 'NONE'; + &_http_prg_redirect(); + } + +} elsif($action eq 'RPZ_RELOAD') { ## Reload dns configuration + if(&_action_rpz_reload()) { + $action = 'NONE'; + &_http_prg_redirect(); + } + +} elsif($action eq 'UNB_RESTART') { ## Restart unbound service + if(&_action_unb_restart()) { + $action = 'NONE'; + &_http_prg_redirect(); + } + +} + + +###--- Start GUI ---### + +## Start http output +&Header::showhttpheaders(); + +# Start HTML +&Header::openpage($Lang::tr{'rpz'}, 1, $extraHead); +&Header::openbigbox('100%', 'left', ''); + +# Show error messages +if($errormessage) { + &_print_message($errormessage); +} + +# Handle zonefile add/edit mode +if($action eq "ZF_EDIT") { + &_print_zonefile_editor(); + + # Finalize page and exit cleanly + &Header::closebigbox(); + &Header::closepage(); + exit(0); +} + +# Show gui elements +&_print_zonefiles(); +&_print_customlists(); +&_print_gui_extras(); + +&Header::closebigbox(); +&Header::closepage(); + +###--- End of GUI ---### + + +###--- Internal configuration file functions ---### + +# Load all available zonefiles from rpz-config and the internal configuration +sub _zonefiles_load { + # Clean start + %zonefiles = (); + + # Source 1: Get the currently enabled zonefiles from rpz-config (expected format [name]=[URL]) + my @enabled_files = &General::system_output('/usr/sbin/rpz-config', 'list'); + + foreach my $row (@enabled_files) { + chomp($row); + + # Use regex instead of split() to skip non-matching lines + next unless($row =~ /^(\w+)=(.+)$/); + my ($name, $url) = ($1, $2); + + # Unique names are already guaranteed by rpz-config + if(&_rpz_validate_zonefile($name, $url, '', 0) == 0) { + # Populate global data hash, mark all found entries as enabled + my %entry = ('enabled' => 'on', + 'url' => $url, + 'remark' => $Lang::tr{'rpz zf imported'}); + + $zonefiles{$name} = \%entry; + } + } + + # Source 2: Get additional data and disabled entries from configuration file + my %configured_files = (); + &General::readhasharray($ZONEFILES_CONF, \%configured_files); + + foreach my $row (values (%configured_files)) { + my ($name, $enabled, $url, $remark) = @$row; + $remark //= ""; + + next unless($name); + + # Check whether this row belongs to an entry already imported from rpz-config + if(defined $zonefiles{$name}) { + # Existing entry, only merge additional data + $zonefiles{$name}{'remark'} = $remark; + } else { + # Skip entry if it is marked as enabled but not found by rpz-config. It was then deleted manually + if($enabled ne 'on') { + # Populate global data hash + my %entry = ('enabled' => 'off', + 'url' => $url // "", + 'remark' => $remark); + + $zonefiles{$name} = \%entry; + } + } + } +} + +# Save internal zonefiles configuration +sub _zonefiles_save_conf { + my $index = 0; + my %export = (); + + # Loop trough all zonefiles and create "hasharray" type export + foreach my $name (keys %zonefiles) { + my @entry = ($name, + $zonefiles{$name}{'enabled'}, + $zonefiles{$name}{'url'}, + $zonefiles{$name}{'remark'}); + + $export{$index++} = \@entry; + } + + &General::writehasharray($ZONEFILES_CONF, \%export); +} + +# Load custom lists from rpz-config and the internal configuration +sub _customlists_load { + # Clean start + %customlists = (); + + # Load configuration file + my %lists_conf = (); + &General::readhasharray($CUSTOMLISTS_CONF, \%lists_conf); + + # Get list options, enabled by default to start import + $customlists{'allow'}{'enabled'} = $lists_conf{2}[0] // 'on'; + $customlists{'block'}{'enabled'} = $lists_conf{2}[1] // 'on'; + + # Import enabled list from rpz-config, otherwise retrieve stored or empty list from configuration file + if($customlists{'allow'}{'enabled'} eq 'on') { + &_customlist_import('allow', $RPZ_ALLOWLIST); + } else { + $customlists{'allow'}{'list'} = $lists_conf{0} // []; + } + if($customlists{'block'}{'enabled'} eq 'on') { + &_customlist_import('block', $RPZ_BLOCKLIST); + } else { + $customlists{'block'}{'list'} = $lists_conf{1} // []; + } +} + +# Save internal custom lists configuration +sub _customlists_save_conf { + my %export = (); + + # Match IDs with import function + $export{0} = $customlists{'allow'}{'list'}; + $export{1} = $customlists{'block'}{'list'}; + $export{2} = [$customlists{'allow'}{'enabled'}, $customlists{'block'}{'enabled'}]; + + &General::writehasharray($CUSTOMLISTS_CONF, \%export); +} + +# Import a custom list from plain file, returns empty list if file is missing +sub _customlist_import { + my ($listname, $filename) = @_; + my @list = (); + + # File exists, load and check all lines + if(-f $filename) { + open(my $FH, '<', $filename) or die "Can't read $filename: $!"; + while(my $line = <$FH>) { + chomp($line); + push(@list, $line); + } + close($FH); + + # Clean up imported data + &_rpz_validate_customlist(\@list, 1); + } + + $customlists{$listname}{'list'} = \@list; +} + +# Export a custom list to plain file or clear file if list is disabled +sub _customlist_export { + my ($listname, $filename) = @_; + return unless(defined $customlists{$listname}); + + # Write enabled domain list to file, otherwise save empty file + open(my $FH, '>', $filename) or die "Can't write $filename: $!"; + + if($customlists{$listname}{'enabled'} eq 'on') { + foreach my $line (@{$customlists{$listname}{'list'}}) { + print $FH "$line\n"; + } + } else { + print $FH "; Note: This list is currently disabled by $ENV{'SCRIPT_NAME'}\n"; + } + + close($FH); +} + + +###--- Internal gui functions ---### + +# Show simple message box +sub _print_message { + my ($message, $title) = @_; + $title ||= $Lang::tr{'error messages'}; + + &Header::openbox('100%', 'left', $title); + print "<span>$message</span>"; + &Header::closebox(); +} + +# Show all zone files and related gui elements +sub _print_zonefiles { + &Header::openbox('100%', 'left', $Lang::tr{'rpz zf'}); + + print <<END +<table class="tbl" width="100%"> + <tr> + <th>$Lang::tr{'name'}</th> + <th>URL</th> + <th>$Lang::tr{'remark'}</th> + <th colspan="3">$Lang::tr{'action'}</th> + </tr> +END +; + + # Sort zonefiles by name and loop trough all entries + foreach my $name (sort keys %zonefiles) { + + # Toggle button label translation + my $toggle_tr = ($zonefiles{$name}{'enabled'} eq 'on') ? $Lang::tr{'click to disable'} : $Lang::tr{'click to enable'}; + + print <<END + <tr> + <td>$name</td> + <td>$zonefiles{$name}{'url'}</td> + <td>$zonefiles{$name}{'remark'}</td> + + <td align="center" width="5%"> + <form method="post" action="$ENV{'SCRIPT_NAME'}"> + <input type="hidden" name="KEY" value="$name"> + <input type="hidden" name="ACTION" value="ZF_TOGGLE"> + <input type="image" src="/images/$zonefiles{$name}{'enabled'}.gif" title="$toggle_tr" alt="$toggle_tr"> + </form> + </td> + <td align="center" width="5%"> + <form method="post" action="$ENV{'SCRIPT_NAME'}"> + <input type="hidden" name="KEY" value="$name"> + <input type="hidden" name="ACTION" value="ZF_EDIT"> + <input type="image" src="/images/edit.gif" title="$Lang::tr{'edit'}" alt="$Lang::tr{'edit'}"> + </form> + </td> + <td align="center" width="5%"> + <form method="post" action="$ENV{'SCRIPT_NAME'}"> + <input type="hidden" name="KEY" value="$name"> + <input type="hidden" name="ACTION" value="ZF_REMOVE"> + <input type="image" src="/images/delete.gif" title="$Lang::tr{'remove'}" alt="$Lang::tr{'remove'}"> + </form> + </td> + </tr> +END +; + } + + # Disable reload button if not needed + my $reload_state = &_rpz_needs_reload() ? "" : " disabled"; + + print <<END +</table> + +<div class="right"> + <form method="post" action="$ENV{'SCRIPT_NAME'}"> + <input type="hidden" name="KEY" value=""> + <button type="submit" name="ACTION" value="ZF_EDIT">$Lang::tr{'add'}</button> + <button type="submit" name="ACTION" value="RPZ_RELOAD" class="commit"$reload_state>$Lang::tr{'rpz apply'}</button> + </form> +</div> +END +; + + &Header::closebox(); +} + +# Show zonefiles entry editor +sub _print_zonefile_editor { + + # Key specified: Edit existing entry + if(($action_key) && (defined $zonefiles{$action_key})) { + # Load data to be edited, but don't override already present values (allows user to edit after error) + $cgiparams{'ZF_NAME'} //= $action_key; + $cgiparams{'ZF_URL'} //= $zonefiles{$action_key}{'url'}; + $cgiparams{'ZF_REMARK'} //= $zonefiles{$action_key}{'remark'}; + } + + # Fallback to empty form + $cgiparams{'ZF_NAME'} //= ""; + $cgiparams{'ZF_URL'} //= ""; + $cgiparams{'ZF_REMARK'} //= ""; + + &Header::openbox('100%', 'left', $Lang::tr{'rpz zf editor'}); + + print <<END +<form method="post" action="$ENV{'SCRIPT_NAME'}"> +<input type="hidden" name="KEY" value="$action_key"> +<table width="100%"> + <tr> + <td width="20%">$Lang::tr{'name'}: <img src="/blob.gif" alt="*"></td> + <td><input type="text" name="ZF_NAME" value="$cgiparams{'ZF_NAME'}" size="40" maxlength="32" title="$Lang::tr{'rpz zf remark info'}" pattern="[a-zA-Z0-9_]{1,32}" required></td> + </tr> + <tr> + <td width="20%">URL: <img src="/blob.gif" alt="*"></td> + <td><input type="url" name="ZF_URL" value="$cgiparams{'ZF_URL'}" size="40" maxlength="128" required></td> + </tr> + <tr> + <td width="20%">$Lang::tr{'remark'}:</td> + <td><input type="text" name="ZF_REMARK" value="$cgiparams{'ZF_REMARK'}" size="40" maxlength="32"></td> + </tr> + <tr> + <td colspan="2"><hr></td> + </tr> + <tr> + <td width="55%"><img src="/blob.gif" alt="*"> $Lang::tr{'required field'}</td> + <td align="right"><button type="submit" name="ACTION" value="ZF_SAVE">$Lang::tr{'save'}</button></td> + </tr> +</table> +</form> + +<div class="right"> + <form method="post" action="$ENV{'SCRIPT_NAME'}"> + <button type="submit" name="ACTION" value="NONE">$Lang::tr{'back'}</button> + </form> +</div> +END +; + + &Header::closebox(); +} + +# Show custom allow/block files and related gui elements +sub _print_customlists { + + # Load lists from config, unless they are currently being edited + if($action ne 'CL_SAVE') { + $cgiparams{'ALLOW_LIST'} = join("\n", @{$customlists{'allow'}{'list'}}); + $cgiparams{'BLOCK_LIST'} = join("\n", @{$customlists{'block'}{'list'}}); + + $cgiparams{'ALLOW_ENABLED'} = ($customlists{'allow'}{'enabled'} eq 'on') ? 'on' : undef; + $cgiparams{'BLOCK_ENABLED'} = ($customlists{'block'}{'enabled'} eq 'on') ? 'on' : undef; + } + + # Fallback to empty form + $cgiparams{'ALLOW_LIST'} //= ""; + $cgiparams{'BLOCK_LIST'} //= ""; + + # HTML checkboxes, unchecked = no or undef value in POST data + my %checked = (); + $checked{'ALLOW_ENABLED'} = (defined $cgiparams{'ALLOW_ENABLED'}) ? " checked" : ""; + $checked{'BLOCK_ENABLED'} = (defined $cgiparams{'BLOCK_ENABLED'}) ? " checked" : ""; + + # Disable reload button if not needed + my $reload_state = &_rpz_needs_reload() ? "" : " disabled"; + + &Header::openbox('100%', 'left', $Lang::tr{'rpz cl'}); + + print <<END +<form method="post" action="$ENV{'SCRIPT_NAME'}"> +<table width="100%"> + <tr> + <td colspan="2"><b>$Lang::tr{'rpz cl allow'}</b><br>$Lang::tr{'rpz cl allow info'}</td> + <td colspan="2"><b>$Lang::tr{'rpz cl block'}</b><br>$Lang::tr{'rpz cl block info'}</td> + </tr> + <tr> + <td colspan="2"><textarea name="ALLOW_LIST" class="domainlist" cols="45"> +$cgiparams{'ALLOW_LIST'}</textarea></td> + <td colspan="2"><textarea name="BLOCK_LIST" class="domainlist" cols="45"> +$cgiparams{'BLOCK_LIST'}</textarea></td> + </tr> + <tr> + <td><label for="allow_enabled">$Lang::tr{'rpz cl allow enable'}</label></td> + <td width="15%"><input type="checkbox" name="ALLOW_ENABLED" id="allow_enabled"$checked{'ALLOW_ENABLED'}></td> + <td><label for="block_enabled">$Lang::tr{'rpz cl block enable'}</label></td> + <td width="15%"><input type="checkbox" name="BLOCK_ENABLED" id="block_enabled"$checked{'BLOCK_ENABLED'}></td> + </tr> + <tr> + <td colspan="4"><hr></td> + </tr> + <tr> + <td align="right" colspan="4"> + <button type="submit" name="ACTION" value="CL_SAVE">$Lang::tr{'save'}</button> + <button type="submit" name="ACTION" value="RPZ_RELOAD" class="commit"$reload_state>$Lang::tr{'rpz apply'}</button> + </td> +</table> +</form> +END +; + + &Header::closebox(); +} + +# Output javascript and extra gui elements +sub _print_gui_extras { + + # Apply/Restart button modifier key handler + if(&_rpz_needs_reload()) { + print <<END +<script> + // Commit modifier key handler + (function(jq, document) { + var keyEventsOn = false; // Keyboard events attached + var keyModify = false; // Modifier key pressed + var mouseHover = false; // Mouse over commit button + var btnModified = false; // Button modified to "Restart" + + // Document-level key events, enable only while cursor is over button + function attachKeyEvents() { + if(keyEventsOn) { + return; + } + keyEventsOn = true; + + jq(document).on("keydown.rpz", function(event) { + if((!keyModify) && event.shiftKey) { + keyModify = true; + handleModify(); + } + }); + jq(document).on("keyup.rpz", function(event) { + if(keyModify && (!event.shiftKey)) { + keyModify = false; + handleModify(); + } + }); + } + function removeKeyEvents() { + keyModify = false; + if(keyEventsOn) { + jq(document).off("keydown.rpz keyup.rpz"); + keyEventsOn = false; + } + } + + // Attach mouse hover events to commit buttons + function attachMouseEvents() { + jq("button.commit").on("mouseenter", function(event) { + if(!mouseHover) { + mouseHover = true; + attachKeyEvents(); + // Handle already pressed key + keyModify = !!(event.shiftKey); + handleModify(); + } + }); + + // Cursor moved away: Disable key listener to minimize events + jq("button.commit").on("mouseleave", function() { + if(mouseHover) { + mouseHover = false; + removeKeyEvents(); + handleModify(); + } + }); + } + + // Modify commit button + function handleModify() { + let modify = mouseHover && keyModify; + if(btnModified != modify) { + if(modify) { + jq("button.commit").text("$Lang::tr{'restart'}").val("UNB_RESTART"); + } else { + jq("button.commit").text("$Lang::tr{'rpz apply'}").val("RPZ_RELOAD"); + } + btnModified = modify; + } + } + + // jQuery DOM ready + jq(function() { + attachMouseEvents(); + }); + })(jQuery, document); +</script> +END +; + } # End of modifier key handler + +} + + +###--- Internal action processing functions ---### + +# Toggle zonefile on/off +sub _action_zf_toggle { + return unless(defined $zonefiles{$action_key}); + + my $result = 0; + my $enabled = $zonefiles{$action_key}{'enabled'}; + + # Perform toggle action + if($enabled eq 'on') { + $enabled = 'off'; + $result = &General::system('/usr/sbin/rpz-config', 'remove', $action_key, '--no-reload'); + } else { + $enabled = 'on'; + $result = &General::system('/usr/sbin/rpz-config', 'add', $action_key, $zonefiles{$action_key}{'url'}, '--no-reload'); + } + + # Check for errors, request service reload on success + return unless &_rpz_check_result($result, 1); + + # Save changes + $zonefiles{$action_key}{'enabled'} = $enabled; + &_zonefiles_save_conf(); + + return 1; +} + +# Remove zonefile +sub _action_zf_remove { + return unless(defined $zonefiles{$action_key}); + + # Remove from rpz-config if currently active + if($zonefiles{$action_key}{'enabled'} eq 'on') { + my $result = &General::system('/usr/sbin/rpz-config', 'remove', $action_key, '--no-reload'); + + # Check for errors, request service reload on success + return unless &_rpz_check_result($result, 1); + } + + # Remove from data hash and save changes + delete $zonefiles{$action_key}; + &_zonefiles_save_conf(); + + # Clear action_key, as the entry is now removed entirely + $action_key = ""; + + return 1; +} + +# Create or update zonefile entry +# Returns undef if gui needs to stay in editor mode +sub _action_zf_save { + my $result = 0; + + my $name = $cgiparams{'ZF_NAME'} // ""; + my $url = $cgiparams{'ZF_URL'} // ""; + my $remark = $cgiparams{'ZF_REMARK'} // ""; + my $enabled = 'on'; # Enable new entries by default + + # Note on variables: + # name = unique key, will be used to address the entry + # action_key = name of the entry being edited, empty for new entry + + # Only check for unique name if it changed + # (this also checks new entries because the action_key is empty in this case) + $result = &_rpz_validate_zonefile($name, $url, $remark, (lc($name) ne lc($action_key))); + return unless &_rpz_check_result($result, 0); + + # Edit existing entry: Determine what was changed + if(($action_key) && (defined $zonefiles{$action_key})) { + # Name und URL remain unchanged, only save remark and finish + if(($name eq $action_key) && ($url eq $zonefiles{$action_key}{'url'})) { + $zonefiles{$action_key}{'remark'} = $remark; + &_zonefiles_save_conf(); + + return 1; + } + + # Entry was changed and needs to be recreated, preserve status + $enabled = $zonefiles{$action_key}{'enabled'}; + + # Remove from rpz-config + return unless &_action_zf_remove(); + } + + # Add new entry to rpz-config + if($enabled eq 'on') { + $result = &General::system('/usr/sbin/rpz-config', 'add', $name, $url, '--no-reload'); + + # Check for errors, request service reload on success + return unless &_rpz_check_result($result, 1); + } + + # Add to global data hash and save changes + my %entry = ('enabled' => $enabled, + 'url' => $url, + 'remark' => $remark); + + $zonefiles{$name} = \%entry; + &_zonefiles_save_conf(); + + return 1; +} + +# Save custom lists +sub _action_cl_save { + return unless((defined $cgiparams{'ALLOW_LIST'}) && (defined $cgiparams{'BLOCK_LIST'})); + + my $result = 0; + + my @allowlist = split(/\R/, $cgiparams{'ALLOW_LIST'}); + my @blocklist = split(/\R/, $cgiparams{'BLOCK_LIST'}); + + # Validate lists + $result = &_rpz_validate_customlist(\@allowlist); + if($result != 0) { + $errormessage = &_rpz_error_tr(202, $result); + return; + } + $result = &_rpz_validate_customlist(\@blocklist); + if($result != 0) { + $errormessage = &_rpz_error_tr(203, $result); + return; + } + + # Add to global data hash and save changes + $customlists{'allow'}{'list'} = \@allowlist; + $customlists{'block'}{'list'} = \@blocklist; + $customlists{'allow'}{'enabled'} = (defined $cgiparams{'ALLOW_ENABLED'}) ? 'on' : 'off'; + $customlists{'block'}{'enabled'} = (defined $cgiparams{'BLOCK_ENABLED'}) ? 'on' : 'off'; + + &_customlists_save_conf(); + &_customlist_export('allow', $RPZ_ALLOWLIST); + &_customlist_export('block', $RPZ_BLOCKLIST); + + # Make new lists, request service reload on success + $result = &General::system('/usr/sbin/rpz-make', 'allowblock', '--no-reload'); + return unless &_rpz_check_result($result, 1); + + return 1; +} + +# Trigger rpz-config reload +sub _action_rpz_reload { + return 1 unless &_rpz_needs_reload(); + + # Immediately clear flag to prevent multiple reloads + if(-f $RPZ_RELOAD_FLAG) { + unlink($RPZ_RELOAD_FLAG) or die "Can't remove $RPZ_RELOAD_FLAG: $!"; + } + + # Perform reload, recreate reload flag on error to enable retry + my $result = &General::system('/usr/sbin/rpz-config', 'reload'); + if(not &_rpz_check_result($result, 0)) { + &General::system('touch', "$RPZ_RELOAD_FLAG"); + return; + } + + return 1; +} + +# Trigger unbound restart +sub _action_unb_restart { + return 1 unless &_rpz_needs_reload(); + + # Immediately clear flag to prevent multiple restarts + if(-f $RPZ_RELOAD_FLAG) { + unlink($RPZ_RELOAD_FLAG) or die "Can't remove $RPZ_RELOAD_FLAG: $!"; + } + + # Perform restart, unboundctrl always exits zero + &General::system('/usr/local/bin/unboundctrl', 'restart'); + + return 1; +} + + +###--- Internal rpz-config functions ---### + +# Translate rpz-config exitcodes and messages +# 100-199: rpz-config, 200-299: webgui +sub _rpz_error_tr { + my ($error, $append) = @_; + $append //= ''; + + # Translate numeric exit codes + if(looks_like_number($error)) { + if(defined $Lang::tr{"rpz exitcode $error"}) { + $error = $Lang::tr{"rpz exitcode $error"}; + } + } + + return "RPZ $Lang::tr{'error'}: $error" . &Header::escape($append); +} + +# Check result of rpz-config system call, request reload on success +sub _rpz_check_result { + my ($result, $request_reload) = @_; + $request_reload //= 0; + + # exitcode 0 = success + if($result != 0) { + $errormessage = &_rpz_error_tr($result); + return; + } + + # Set reload flag + if($request_reload) { + &General::system('touch', "$RPZ_RELOAD_FLAG"); + } + + return 1; +} + +# Test whether reload flag is set +sub _rpz_needs_reload { + return (-f $RPZ_RELOAD_FLAG); +} + +# Validate a zonefile entry, returns rpz-config exitcode on failure. Use _rpz_check_result to verify. +# unique = check for unique name +sub _rpz_validate_zonefile { + my ($name, $url, $remark, $unique) = @_; + $unique //= 1; + + unless($name =~ /^[a-zA-Z0-9_]{1,32}$/) { + return 101; + } + unless($url =~ /^[\w+\.:;\/\\&@#%?=\-~|!]{1,128}$/) { + return 105; + } + unless($remark =~ /^[\w \-()\.:;*\/\\?!&=]{0,32}$/) { + return 201; + } + + # Check against already existing names + if($unique) { + foreach my $existing (keys %zonefiles) { + if(lc($name) eq lc($existing)) { + return 104; + } + } + } + + return 0; +} + +# Validate a custom list, returns number of rejected line on failure. Check for non-zero results. +# listref = array reference, cleanup = remove invalid entries instead of returning an error +sub _rpz_validate_customlist { + my ($listref, $cleanup) = @_; + $cleanup //= 0; + + foreach my $index (reverse 0..$#{$listref}) { + my $row = @$listref[$index]; + next unless($row); # Skip/allow empty lines + + # Reject/remove everything besides wildcard domains and remarks + if((not &General::validwildcarddomainname($row)) && (not $row =~ /^;[\w \-()\.:;*\/\\?!&=]*$/)) { + unless($cleanup) { + # +1 for user friendly line number and to ensure non-zero exitcode + return $index + 1; + } + + # Remove current row + splice(@$listref, $index, 1); + } + } + + return 0; +} + + +###--- Internal misc functions ---### + +# Send HTTP 303 redirect headers for post/request/get pattern +# (Must be sent before calling &Header::showhttpheaders()) +sub _http_prg_redirect { + my $location = "https://$ENV{'SERVER_NAME'}:$ENV{'SERVER_PORT'}$ENV{'SCRIPT_NAME'}"; + print "Status: 303 See Other\n"; + print "Location: $location\n"; +} diff --git a/lfs/rpz b/lfs/rpz new file mode 100644 index 000000000..7ddbc38e5 --- /dev/null +++ b/lfs/rpz @@ -0,0 +1,96 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +SUMMARY = response policy zone - RPZ reputation system for unbound DNS + +VER = 1.0.0 + +THISAPP = rpz-$(VER) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +PROG = rpz +PAK_VER = 18 + +DEPS = + +SERVICES = + +############################################################################### +# Top-level Rules +############################################################################### + +install : $(TARGET) + +check : + +download : + +b2 : + +dist: + @$(PAK) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : + @$(PREBUILD) + @rm -rf $(DIR_APP) + + # RPZ scripts + install --verbose --mode=755 \ + $(DIR_CONF)/rpz/{rpz-config,rpz-metrics,rpz-sleep,rpz-make,rpz-functions} \ + --target-directory=/usr/sbin + + # RPZ config files + mkdir -pv /etc/unbound/local.d + install --verbose --mode=644 --owner=nobody --group=nobody \ + $(DIR_CONF)/rpz/00-rpz.conf \ + --target-directory=/etc/unbound/local.d + chown --verbose --recursive nobody:nobody /etc/unbound/local.d + + # RPZ custom list files for allow and block + mkdir -pv /var/ipfire/dns/rpz + touch /var/ipfire/dns/rpz/{allowlist,blocklist} + chown --verbose --recursive nobody:nobody /var/ipfire/dns/rpz + + # RPZ zone files + # create empty RPZ config file to avoid a unbound config error + mkdir -pv /etc/unbound/zonefiles + touch /etc/unbound/zonefiles/allow.rpz + chown --verbose --recursive nobody:nobody /etc/unbound/zonefiles + + # Install addon-specific language-files + install --verbose --mode=004 $(DIR_CONF)/rpz/rpz.*.pl \ + --target-directory=/var/ipfire/addon-lang + + # Install backup definition + cp -vf $(DIR_CONF)/backup/includes/rpz /var/ipfire/backup/addons/includes/rpz + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 827ea9e77..a77535b13 100755 --- a/make.sh +++ b/make.sh @@ -390,7 +390,7 @@ prepareenv() { if [ "${free_space}" -lt "${required_space}" ]; then # Add any consumed space while read -r consumed_space path; do - (( free_space += consumed_space / 1024 / 1024 )) + (( free_space += consumed_space / 1024 / 1024 )) done <<< "$(du --summarize --bytes "${BUILD_DIR}" "${IMAGES_DIR}" "${LOG_DIR}" 2>/dev/null)" fi @@ -2087,6 +2087,7 @@ build_system() { lfsmake2 btrfs-progs lfsmake2 inotify-tools lfsmake2 grub-btrfs + lfsmake2 rpz lfsmake2 linux lfsmake2 rtl8812au diff --git a/src/paks/rpz/install.sh b/src/paks/rpz/install.sh new file mode 100644 index 000000000..ef99bf742 --- /dev/null +++ b/src/paks/rpz/install.sh @@ -0,0 +1,36 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### +# +. /opt/pakfire/lib/functions.sh +extract_files +restore_backup ${NAME} + +# fix user created files +chown --verbose --recursive nobody:nobody \ + /var/ipfire/dns/rpz \ + /etc/unbound/zonefiles \ + /etc/unbound/local.d + +# Update Language cache +/usr/local/bin/update-lang-cache + +# restart unbound to load config file +/etc/init.d/unbound restart diff --git a/src/paks/rpz/uninstall.sh b/src/paks/rpz/uninstall.sh new file mode 100644 index 000000000..e11427df3 --- /dev/null +++ b/src/paks/rpz/uninstall.sh @@ -0,0 +1,38 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### +# +. /opt/pakfire/lib/functions.sh + +# stop unbound to delete RPZ conf file +/etc/init.d/unbound stop + +make_backup ${NAME} +remove_files + +# delete rpz config files. Otherwise unbound will throw error: +# "[1723428668] unbound-control[17117:0] error: connect: Connection refused for 127.0.0.1 port 8953" +/bin/rm --verbose --force /etc/unbound/local.d/*.rpz.conf + +# Update Language cache +/usr/local/bin/update-lang-cache + +# start unbound to load unbound config file +/etc/init.d/unbound start diff --git a/src/paks/rpz/update.sh b/src/paks/rpz/update.sh new file mode 100644 index 000000000..9bc340bc6 --- /dev/null +++ b/src/paks/rpz/update.sh @@ -0,0 +1,52 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2024 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### +# +. /opt/pakfire/lib/functions.sh + +# from update.sh +extract_backup_includes + +# stop unbound to delete RPZ conf file +/etc/init.d/unbound stop + +# from uninstall.sh +make_backup ${NAME} +remove_files + +# delete rpz config files. Otherwise unbound will throw error: +# "unbound-control[nn:0] error: connect: Connection refused for 127.0.0.1 port 8953" +/bin/rm --verbose --force /etc/unbound/local.d/*.rpz.conf + +# from install.sh +extract_files +restore_backup ${NAME} + +# fix user created files +chown --verbose --recursive nobody:nobody \ + /var/ipfire/dns/rpz \ + /etc/unbound/zonefiles \ + /etc/unbound/local.d + +# Update Language cache +/usr/local/bin/update-lang-cache + +# restart unbound to load config files +/etc/init.d/unbound start -- 2.39.5

5 12

[PATCH] dhcpcd: Update to 10.20.1
by Matthias Fischer 24 Feb '25

24 Feb '25

For details see: https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.2.1 "What's Changed Fix building with different options by @rsmarples in #461 Only drop IPv4 LL addresses if configured to handle them by @ColinMcInnes in #464" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dhcpcd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index 6b77a9db7..43d43f64a 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -24,7 +24,7 @@ include Config -VER = 10.2.0 +VER = 10.2.1 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 0b209f253e6462cc176ffef749228fc3b82474ee4baa2c468277b58abea9541282a2a96633e88641c46e3e9a612049f574009dd42f00f86334e655b10c234e81 +$(DL_FILE)_BLAKE2 = f550f69a3db07e9b388e5e24fe94820e25c91aa5332bc32120194d268d1697fd1db2f5619119f030fd9774336757709b40416333a3f0f5beb9fa25e64f451134 install : $(TARGET) -- 2.43.0

1 0

[PATCH] ddrescue: Update to version 1.29
by Adolf Belka 24 Feb '25

24 Feb '25

- Update from version 1.28 to 1.29 - Update of rootfile not required - Changelog 1.29 The new option '--continue-on-errno' has been added. If ddrescue exits because of a fatal read error, it now prints the value of the variable 'errno' so that it can be used as argument to '--continue-on-errno'. When using '--ask' and '--verbose', print rescue options before asking user. Option '--log-reads' now records the value of errno if different from EIO. (The four changes above suggested by Christian Franke). The effect of option '-O, --reopen-on-error' has been extended to all phases. It has been documented in the manual that '--reopen-on-error' may be needed when using '--continue-on-errno'. A compilation error on FiwixOS 3.3 about an ambiguous call to std::abs has been fixed. (Reported by Jordi Sanfeliu). The chapter 'Syntax of command-line arguments' has been added to the manual. Two examples of combined use with lziprecover have been added to the manual. (One of them uses the new Forward Error Correction (FEC) feature of lziprecover). It has been documented in the manual that option '-b' of ddrescuelog is position dependent. (Reported by Winston B. E.). Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/ddrescue | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/ddrescue b/lfs/ddrescue index 9d1c08fe2..8320751ae 100644 --- a/lfs/ddrescue +++ b/lfs/ddrescue @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Data Copying in the Presence of I/O Errors -VER = 1.28 +VER = 1.29 THISAPP = ddrescue-$(VER) DL_FILE = $(THISAPP).tar.lz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = ddrescue -PAK_VER = 4 +PAK_VER = 5 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 8c212f0d495e0df8e0398b97730c812ea9ccb77bd42e730198222e9918e3652fc52d932449b1e0dc9bdd453a123e2450c962e33e98d9845ce81b9a934a5bbdaa +$(DL_FILE)_BLAKE2 = 88eab69f2296464859dc8720930f28f6bc32aa694649e15a99dcd9dfd63ed8ba845d7af347e8b1ee90e954f8317888ec0f2cd90ec98994a7d2b4d654a31adbfc install : $(TARGET) -- 2.48.1

2 14

[PATCH v2] libxcrypt: Update to version 4.4.38
by Adolf Belka 23 Feb '25

23 Feb '25

- Update from version 4.4.36 to 4.4.38 - Update of rootfile not required - in version 4.4.37 pkg-config was made a dependency for building libxcrypt. This caused user(s) a problem when libxcrypt was being built before pkg-config wasw available. - In version 4.4.38 it was allowed that if pkg-config was not available then the build would continue and complete but any installation of .pc files was no longer carried out. - moved pkg-config to before libxcrypt so that the libxcrypt.pc file is installed in the build environment and the libcrypt.pc file linked to it, the same as used to occur in version 4.4.36 - Changelog 4.4.38 * Fix several "-Wunterminated-string-initialization", which are seen by upcoming GCC 15.x (issue #194). * Fix "-Wmaybe-uninitialized" in crypt.c, which is seen by GCC 13.3.0. * Skip test/explicit-bzero if compiling with ASAN. * Drop hard requirement for the pkg-config binary (issue #198). 4.4.37 * Several fixes to the manpages (issue #185). * Add binary compatibility for x86_64 GNU/Hurd (issue #189). * Only test the needed makecontext signature during configure (issue #178). * Fix -Werror=strict-overflow in lib/crypt-bcrypt.c, which is seen by GCC 4.8.5 (issue #197). Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/libxcrypt | 6 +++--- make.sh | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/libxcrypt b/lfs/libxcrypt index 4ec63516a..2f40385ca 100644 --- a/lfs/libxcrypt +++ b/lfs/libxcrypt @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.4.36 +VER = 4.4.38 THISAPP = libxcrypt-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9f028e0fe2cb7bb4273f3f6d1e579e0fe93cd71eba21286aa7dc078c904ea3cdce38b2955bdcd618853f7657b01aea7e28c4d898680e69fdf75f812b5a304c1d +$(DL_FILE)_BLAKE2 = 42d594fe36f61a1b5343d9fda22541b09373fe74c587537db8203f9c92120b6c73edef2e1b3d7febda14ae979845405b5fdaeb31dd2b89eedc423b0924ea7cff install : $(TARGET) diff --git a/make.sh b/make.sh index 2910ff7a4..6258705fe 100755 --- a/make.sh +++ b/make.sh @@ -1420,6 +1420,7 @@ build_system() { lfsmake2 gmp lfsmake2 mpfr lfsmake2 libmpc + lfsmake2 pkg-config lfsmake2 libxcrypt lfsmake2 file lfsmake2 gcc @@ -1455,7 +1456,6 @@ build_system() { lfsmake2 whois lfsmake2 kbd lfsmake2 less - lfsmake2 pkg-config lfsmake2 procps lfsmake2 make lfsmake2 libpipeline -- 2.48.1

1 0

[PATCH] dhcpcd: Update to 10.2.0
by Matthias Fischer 22 Feb '25

22 Feb '25

For details see: https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.2.0 "What's Changed dhcp6: start request when advertise received after IRT by @sshambar in #376 dhcpcd: stdout output sometimes empty when redirected to a file by @diego-santacruz in #364 Fix help text formatting by @jvfranklin in #379 Apply lastlease behavior to DHCPv6 by @jvfranklin in #384 dhcpcd not ignoring source-based routes on linux by @sshambar in #372 DHCP6: lastlease behavior after Confim non-response by @jvfranklin in #387 Allow limited RLIMIT_FSIZE when dumping lease by @ColinMcInnes in #389 IPv6: Avoid uninitialized ifp state when adding address by @kensimon in #395 DHCPv6: Add support for sending Option 17 (VSIO) by @spoljak-ent in #383 Exit the timesyncd hook if not on systemd and not executable (#398) by @perkelix in #403 Add route lifetime from Router Advertisement by @ColinMcInnes in #429 revert e3c5de1 by @zacknewman in #425 Fix using multiple enterprise IDs with vendclass (Option 124 DHCP / Option 16 DHCPv6) (#328) by @spoljak-ent in #408 Update route if acquired time changes by @ColinMcInnes in #441 Always send req for InfoRefreshTime option on Inform-Req by @ColinMcInnes in #446 Increase max IPv4 clientid. by @gnaaman-dn in #442 Update build.yml to fix BSD builds by @perkelix in #456" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dhcpcd | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index 0c21544ab..6b77a9db7 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 10.1.0 +VER = 10.2.0 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9d47ae8b97ba082f980966a2c3f688c6a8addb10989c166dafebdb6491793815c4caddc3016334f6549923632fd01fc8ce0987eca31af01948b0f4a643f88b38 +$(DL_FILE)_BLAKE2 = 0b209f253e6462cc176ffef749228fc3b82474ee4baa2c468277b58abea9541282a2a96633e88641c46e3e9a612049f574009dd42f00f86334e655b10c234e81 install : $(TARGET) -- 2.43.0

1 0

[PATCH] bind 9.20.6: Fix for rootfile
by Matthias Fischer 22 Feb '25

22 Feb '25

Unfortunately i missed this one file... Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 1 + 1 file changed, 1 insertion(+) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 2eee6aa5b..8c50f830a 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -30,6 +30,7 @@ usr/bin/nsupdate #usr/include/dns/dsdigest.h #usr/include/dns/dyndb.h #usr/include/dns/ecs.h +#usr/include/dns/ede.h #usr/include/dns/edns.h #usr/include/dns/enumclass.h #usr/include/dns/enumtype.h -- 2.43.0

1 0

[PATCH 1/2] autoconf: Update to version 2.72
by Adolf Belka 21 Feb '25

21 Feb '25

- Update from version 2.71 to 2.72 - Update of rootfile - The update of collectd from 4.10.9 to 5.12.0 now allows it to build with this newer version of autoconf. - pmacct however failed to build with it. Updated the pmacct lfs to allow it to build with this newer version of autoconf. Fix for that is combined in this patch set. - Changelog 2.72 Backward incompatibilities Configure scripts no longer support pre-1989 C compilers. Specifically, compilers that *only* implement the original “K&R” function definition syntax, and not the newer “prototyped” syntax, will not be able to parse the test programs now emitted by AC_CHECK_FUNC, AC_LANG_CALL, and similar macros. AC_PROG_CC still accepts such compilers, but this may change in the near future. This change was necessary in order to support the upcoming 2024 edition of the C standard (often referred to as “C23”), which will officially remove the function declaration syntax used by AC_CHECK_FUNC in Autoconf 2.71 and earlier. We feel that support for compilers that support only C 2024 is more useful, nowadays, than support for compilers that don’t implement a core feature of C 1989. Autoconf developers now need Perl 5.10 (2007) or later. “Autoconf developers” means specifically people hacking on Autoconf itself. Autoconf *users*, i.e. authors of configure.ac files and add-on M4 macros, still need only Perl 5.6 (2000) or later. We do recommend all Autoconf users upgrade to Perl 5.10 or later if possible, as this version significantly improves Perl’s ability to handle files with last-modification timestamps separated by less than a second. (Note: even in the most recent release, Perl cannot always match the file system’s timestamp resolution.) Generated configure scripts continue to run without Perl. Autoconf users now need GNU M4 1.4.8 (2006) or later. Use of GNU M4 1.4.16 or later is recommended, as all earlier versions are known to have had serious bugs in the text-processing builtins on some, but not all, operating systems. Autoconf’s own configure script will attempt to find a version of M4 that is not affected by these bugs. Note: Autoconf 2.70 and 2.71 include code that malfunctions with M4 1.4.6 or 1.4.7. However, the only effect of the malfunction is that you will get a confusing error message if you run autoconf on a configure.ac that neglects to use AC_INIT or AC_OUTPUT. Generated 'configure' scripts continue to run without M4. Some m4sh diversions have been renumbered. This will only affect macros that use m4_divert with numbered rather than named diversions, which has always been strongly discouraged both by the documentation and with warnings. AC_FUNC_GETGROUPS and AC_TYPE_GETGROUPS no longer run test programs. These macros were testing for OS bugs that we believe are at least twenty years in the past. Most operating systems are now trusted to provide an accurate prototype for getgroups in unistd.h, and to implement it as specified in POSIX. AC_FUNC_GETGROUPS still includes a short block-list of OSes with known, severe bugs in getgroups. It can be overridden using config.site. If you encounter a mistake in this list, please report it to bug-autoconf. All internal uses of AC_EGREP_CPP and AC_EGREP_HEADER have been removed. These macros look for text matching a regular expression in the output of the C preprocessor. Their use has been discouraged for many years, as they tend to be unreliable; it is better to find a way to use AC_COMPILE_IFELSE or AC_PREPROC_IFELSE instead. We have finally taken our own advice. This change might break configure scripts that expected probes for ‘grep’ and/or the C preprocessor to happen as a side effect of an unrelated operation. Such scripts can be fixed by adding AC_PROG_EGREP and/or AC_PROG_CPP in an appropriate place. The macros affected by this change are AC_C_STRINGIZE, AC_C_VARARRAYS, AC_FUNC_GETGROUPS, AC_FUNC_GETLOADAVG, AC_HEADER_TIOCGWINSZ, AC_PROG_GCC_TRADITIONAL, AC_TYPE_GETGROUPS, AC_TYPE_UID_T, and AC_XENIX_DIR. Many of these macros are themselves obsolete; if your configure script uses any of them, check whether it is actually needed. New features Support for ensuring time_t is Y2038-safe configure can now ensure that time_t can represent moments in time after 18 January 2038, i.e. 2**31 - 1 seconds after the Unix epoch. On most “64-bit” systems this is true by default; the new feature is detection of systems where time_t is a 32-bit signed integer by default, *and* there is an alternative mode in which it is larger, in which case that mode will be enabled. In this release, all configure scripts that use AC_SYS_LARGEFILE gain a new command line option --enable-year2038. When this option is used, the configure script will check for and enable support for a large time_t. This release also adds two new macros, AC_SYS_YEAR2038 and AC_SYS_YEAR2038_RECOMMENDED. Both have all the effects of AC_SYS_LARGEFILE. (This is because it is not possible to enlarge time_t without also enlarging off_t, on any system we are aware of.) AC_SYS_YEAR2038 additionally flips the default for --enable-year2038; a configure script that uses this macro will check for and enable support for a large time_t by default, but this can be turned off by using --disable-year2038. AC_SYS_YEAR2038_RECOMMENDED goes even further, and makes the configure script fail on systems that do not seem to support timestamps after 18 January 2038 at all. This failure can be suppressed by using --disable-year2038. Changing the size of time_t can change a library’s ABI. Therefore, application and library builders should take care that all packages are configured with consistent use of --enable-year2038 or --disable-year2038, to ensure binary compatibility. This is similar to longstanding consistency requirements with --enable-largefile and --disable-largefile. In this release, these macros only know how to enlarge time_t on two classes of systems: 32-bit MinGW, and any system where time_t can be enlarged by defining the preprocessor macro _TIME_BITS with the value 64. At the time this NEWS entry was written, only GNU libc (version 2.34 and later) supported the latter macro. Authors of other C libraries with a 32-bit time_t are encouraged to adopt _TIME_BITS, rather than inventing a different way to enlarge time_t. AC_USE_SYSTEM_EXTENSIONS now enables C23 Annex F extensions by defining __STDC_WANT_IEC_60559_EXT__. Obsolete features and new warnings Autoconf now quotes 'like this' instead of `like this'. Autoconf’s diagnostics now follow current GNU coding standards, which say that diagnostics in the C locale should quote 'like this' with plain apostrophes instead of the older GNU style `like this' with grave accent and apostrophe. AC_PROG_GCC_TRADITIONAL no longer does anything. This macro has had no useful effect since GCC dropped support for traditional-mode compilation in version 3.3 (released in 2003), and the systems that needed it are also long obsolete. It is now a compatibility synonym for AC_PROG_CC. Notable bug fixes autom4te now uses fine-grained file timestamps Autoconf’s internal “autom4te” utility is now able to compare file modification timestamps with sub-second precision, when available. This eliminates a class of bugs where autom4te fails to regenerate an outdated file. Automake 1.17 (forthcoming) is required for a complete fix. AC_HEADER_STDBOOL, AC_CHECK_HEADER_STDBOOL are obsolescent and less picky. These macros are now obsolescent, as most programs can simply include stdbool.h unconditionally. If you use these macros, they now accept a stdbool.h that exists but does nothing, so long as ‘bool’, ‘true’, and ‘false’ work anyway. This is for compatibility with C23 and with C++. AC_PROG_MKDIR_P now falls back on plain 'mkdir -p'. When AC_PROG_MKDIR_P cannot find a mkdir implementation that is known to lack race condition bugs, it now falls back on 'mkdir -p' instead of falling back on a relative path to install-sh, as the relative paths now seem to be a more important problem than the problems of ancient mkdir implementations with race condition bugs. See <https://savannah.gnu.org/support/?110740>. The only ancient mkdir still supported is Solaris 10 /usr/bin/mkdir, and for that platform AC_PROG_MKDIR_P falls back on /opt/sfw/bin/mkdir which should work if it is installed; if not, you should avoid parallel 'make' on that platform. Better diagnostics for calling m4_warn() with a bad first argument Calling m4_warn with a first argument that doesn’t match any of the official warning categories now produces a sensible error message, instead of something that makes it look like there’s a bug in the guts of autom4te. Also, the documentation has been adjusted in several places to make it clearer what the official warning categories are. Note: In Autoconf 2.69 and earlier, the manual said that [] and [all] could be used as the first argument to m4_warn. This was incorrect, even at the time. Improved compatibility with a wide variety of systems and tools including CheriBSD, Darwin (macOS), GNU Guix, OS/2, z/OS, Bash 5.2, the BusyBox shell and utilities, Clang/LLVM version 16, the upcoming GCC version 14, etc. Known bugs AC_SYS_LARGEFILE and AC_SYS_YEAR2038 only work correctly in C mode. This is only a problem for configure scripts that invoke either macro while AC_LANG([something other than C]) is in effect, and will only be a *visible* problem on systems where support for large files and/or timestamps after 2038 are *available* but not enabled by default. This is the cause of the AC_SYS_LARGEFILE, AC_SYS_YEAR2038, and/or AC_SYS_YEAR2038_RECOMMENDED testsuite failures on some systems. See <https://savannah.gnu.org/support/index.php?110983> for details and a workaround. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/autoconf | 2 +- lfs/autoconf | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/autoconf b/config/rootfiles/common/autoconf index c9aeb7a87..a351b29c6 100644 --- a/config/rootfiles/common/autoconf +++ b/config/rootfiles/common/autoconf @@ -58,7 +58,7 @@ #usr/share/autoconf/m4sugar/m4sh.m4f #usr/share/autoconf/m4sugar/m4sugar.m4 #usr/share/autoconf/m4sugar/m4sugar.m4f -#usr/share/autoconf/m4sugar/version.m4 +#usr/share/autoconf/version.m4 #usr/share/info/autoconf.info #usr/share/info/standards.info #usr/share/man/man1/autoconf.1 diff --git a/lfs/autoconf b/lfs/autoconf index 18880cb5a..43033d6db 100644 --- a/lfs/autoconf +++ b/lfs/autoconf @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.71 +VER = 2.72 THISAPP = autoconf-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -39,7 +39,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7fd4b98b4cfff10720e8da6ee91045637991643b50fcb3e47a0ecfcc01600f7b7b36fd1c0a5f08b68a418f1bdbd8d5a98de1008157595dd37cc3a31facb61416 +$(DL_FILE)_BLAKE2 = 01caeced9e53d8bd39fb0cf4929322f0d463971b0a96368aa55892026897a9e98c2ca84a77db1b3c6c4483aea54b96da16a7bc00b7ac15e23c6b0471438012db install : $(TARGET) -- 2.48.1

1 1

[PATCH 1/2] mpd: Update to version 0.23.17
by Adolf Belka 21 Feb '25

21 Feb '25

- Update from version 0.23.15 to 0.23.17 - Update of rootfile not required - Patch no longer needed as the fixes to work with fmt-11.0.x have been included in the source tarball. - This version includes the fix to work with fmt-11.1.x - Changelog 0.23.17 * protocol - "albumart" tries to send larger chunks if available - explicitly disallow "idle" and "noidle" in command lists * storage - nfs: require libnfs 4.0 or later * database - inotify: trigger update after symlink was created * decoder - ffmpeg: prefer over sndfile and audiofile for its DTS-WAV support * support libfmt 11.1 0.23.16 * database - fix integer overflows with 64-bit inode numbers * filter - ffmpeg: fix for filters producing no output * support libfmt 11 * support ICU 76 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/mpd | 9 ++- ...format_function_const_for_fmt-11.0.0.patch | 57 ------------------- 2 files changed, 4 insertions(+), 62 deletions(-) delete mode 100644 src/patches/mpd-0.23.15_make_format_function_const_for_fmt-11.0.0.patch diff --git a/lfs/mpd b/lfs/mpd index 40b34b910..7ec2d7df1 100644 --- a/lfs/mpd +++ b/lfs/mpd @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Music Player Daemon -VER = 0.23.15 +VER = 0.23.17 THISAPP = mpd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/${THISAPP} TARGET = $(DIR_INFO)/$(THISAPP) PROG = mpd -PAK_VER = 42 +PAK_VER = 43 # SUP_ARCH = aarch64 x86_64 DEPS = alsa avahi faad2 ffmpeg flac lame libmad libshout libogg libid3tag libvorbis opus soxr fmt @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 78036078b850afab900b5d50e44ce83cbbf900369f5028d4177fdbfc4128dd3c35c59a773528a1fcfcc0179d0e579566b827fe87ef780a88082dc3b7f70cd5e7 +$(DL_FILE)_BLAKE2 = 3a789244ebe38a181e0e63e32b7a3a6dd0b5f8ea081355d61dda82ba7d5788bbe5f4bf55abb3e5036be54442373d857442fc12f4b66bd9ee0c8e7051bf1f70af install : $(TARGET) @@ -82,7 +82,6 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/mpd-0.23.15_make_format_function_const_for_fmt-11.0.0.patch $(UPDATE_AUTOMAKE) cd $(DIR_APP) && meson setup \ --prefix=/usr \ diff --git a/src/patches/mpd-0.23.15_make_format_function_const_for_fmt-11.0.0.patch b/src/patches/mpd-0.23.15_make_format_function_const_for_fmt-11.0.0.patch deleted file mode 100644 index beea45484..000000000 --- a/src/patches/mpd-0.23.15_make_format_function_const_for_fmt-11.0.0.patch +++ /dev/null @@ -1,57 +0,0 @@ -diff -Naur mpd-0.23.15.orig/src/lib/ffmpeg/LibFmt.hxx mpd-0.23.15/src/lib/ffmpeg/LibFmt.hxx ---- mpd-0.23.15.orig/src/lib/ffmpeg/LibFmt.hxx 2023-12-20 16:21:57.000000000 +0100 -+++ mpd-0.23.15/src/lib/ffmpeg/LibFmt.hxx 2024-07-15 23:04:27.093307051 +0200 -@@ -29,7 +29,7 @@ - struct fmt::formatter<AVSampleFormat> : formatter<string_view> - { - template<typename FormatContext> -- auto format(const AVSampleFormat format, FormatContext &ctx) { -+ auto format(const AVSampleFormat format, FormatContext &ctx) const { - const char *name = av_get_sample_fmt_name(format); - if (name == nullptr) - name = "?"; -diff -Naur mpd-0.23.15.orig/src/lib/fmt/AudioFormatFormatter.hxx mpd-0.23.15/src/lib/fmt/AudioFormatFormatter.hxx ---- mpd-0.23.15.orig/src/lib/fmt/AudioFormatFormatter.hxx 2023-12-20 16:21:57.000000000 +0100 -+++ mpd-0.23.15/src/lib/fmt/AudioFormatFormatter.hxx 2024-07-15 23:05:48.519267115 +0200 -@@ -39,7 +39,7 @@ - struct fmt::formatter<SampleFormat> : formatter<string_view> - { - template<typename FormatContext> -- auto format(const SampleFormat format, FormatContext &ctx) { -+ auto format(const SampleFormat format, FormatContext &ctx) const { - return formatter<string_view>::format(sample_format_to_string(format), - ctx); - } -@@ -49,7 +49,7 @@ - struct fmt::formatter<AudioFormat> : formatter<string_view> - { - template<typename FormatContext> -- auto format(const AudioFormat &af, FormatContext &ctx) { -+ auto format(const AudioFormat &af, FormatContext &ctx) const { - return formatter<string_view>::format(ToString(af).c_str(), - ctx); - } -diff -Naur mpd-0.23.15.orig/src/lib/fmt/ExceptionFormatter.hxx mpd-0.23.15/src/lib/fmt/ExceptionFormatter.hxx ---- mpd-0.23.15.orig/src/lib/fmt/ExceptionFormatter.hxx 2023-12-20 16:21:57.000000000 +0100 -+++ mpd-0.23.15/src/lib/fmt/ExceptionFormatter.hxx 2024-07-15 23:06:21.330325382 +0200 -@@ -38,7 +38,7 @@ - struct fmt::formatter<std::exception_ptr> : formatter<string_view> - { - template<typename FormatContext> -- auto format(std::exception_ptr e, FormatContext &ctx) { -+ auto format(std::exception_ptr e, FormatContext &ctx) const { - return formatter<string_view>::format(GetFullMessage(e), ctx); - } - }; -diff -Naur mpd-0.23.15.orig/src/lib/fmt/PathFormatter.hxx mpd-0.23.15/src/lib/fmt/PathFormatter.hxx ---- mpd-0.23.15.orig/src/lib/fmt/PathFormatter.hxx 2023-12-20 16:21:57.000000000 +0100 -+++ mpd-0.23.15/src/lib/fmt/PathFormatter.hxx 2024-07-15 23:07:13.908687683 +0200 -@@ -29,7 +29,7 @@ - struct fmt::formatter<Path> : formatter<string_view> - { - template<typename FormatContext> -- auto format(Path path, FormatContext &ctx) { -+ auto format(Path path, FormatContext &ctx) const { - return formatter<string_view>::format(path.ToUTF8(), ctx); - } - }; -- 2.48.1

1 1

[PATCH] bind: Update to 9.20.6
by Matthias Fischer 20 Feb '25

20 Feb '25

For details see: https://downloads.isc.org/isc/bind9/9.20.5/doc/arm/html/notes.html#notes-fo… "Notes for BIND 9.20.6 New Features Adds support for EDE code 1 and 2. Support was added for EDE codes 1 and 2, which might occur during DNSSEC validation in the case of an unsupported RRSIG algorithm or DNSKEY digest. [GL #2715] Add an rndc command to toggle jemalloc profiling. The new command is rndc memprof; the memory profiling status is also reported inside rndc status. The status shows whether named can toggle memory profiling, and whether the server is built with jemalloc. [GL #4759] Add support for multiple extended DNS errors. The Extended DNS Error (EDE) mechanism may raise errors during a DNS resolution. named is now able to add up to three EDE codes in a DNS response. If there are duplicate error codes, only the first one is part of the DNS response. [GL #5085] Print the expiration time of stale records. BIND now prints the expiration time of any stale RRsets in the cache dump. Bug Fixes Recently expired records could be returned with a timestamp in future. Under rare circumstances, an RRSet that expired at the time of the query could be returned with a TTL in the future. This has been fixed. As a side effect, the expiration time of expired RRSets is no longer returned in a cache dump. [GL #5094] YAML string not terminated in negative response in delv. [GL #5098] Fix a bug in dnssec-signzone related to keys being offline. When dnssec-signzone was called on an already-signed zone and the private key file was unavailable, a signature that needed to be refreshed was dropped without being able to generate a replacement. This has been fixed. [GL #5126] Apply the memory limit only to ADB database items. Under heavy load, a resolver could exhaust the memory available for storing the information in the Address Database (ADB), effectively discarding previously stored information in the ADB. The memory used to retrieve and provide information from the ADB is no longer subject to the same memory limits that are applied to the Address Database. [GL #5127] Avoid unnecessary locking in the zone/cache database. Lock contention among many worker threads referring to the same database node at the same time is now prevented. This improves zone and cache database performance for any heavily contended database nodes. [GL #5130] Fix reporting of Extended DNS Error 22 (No Reachable Authority). This error code was previously not reported in some applicable situations. This has been fixed. [GL #5137]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 10 +++++----- lfs/bind | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index c0ef2a3f2..2eee6aa5b 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -239,18 +239,18 @@ usr/bin/nsupdate #usr/include/ns/types.h #usr/include/ns/update.h #usr/include/ns/xfrout.h -usr/lib/libdns-9.20.5.so +usr/lib/libdns-9.20.6.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libisc-9.20.5.so +usr/lib/libisc-9.20.6.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.20.5.so +usr/lib/libisccc-9.20.6.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.20.5.so +usr/lib/libisccfg-9.20.6.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.20.5.so +usr/lib/libns-9.20.6.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index cad711ed2..c23fb1a9d 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.20.5 +VER = 9.20.6 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = bf470c9c881b865baeaf469f94601bb6884d9989c0eee634b6f8dd88d4bafa07b138ec56dfe6e333d8ea729b483b6f41272992c6e036217fb9df1a9d23d0db29 +$(DL_FILE)_BLAKE2 = 2ee3770517a811f64899993ead37d919e746960a72e754546d6cfcab4e57b034392254eda7341efd1b7fdd976225b951c42cf52ed462a7a136829dbdad43312d install : $(TARGET) -- 2.43.0

1 0

[PATCH 1/3] sources: Remove ABUSECH_BOTNETC2 from ipblocklist sources
by Adolf Belka 20 Feb '25

20 Feb '25

- Abuse.ch deprecated the ABUSECH_BOTNETC2 list on 3rd Jan 2025 without any warning or notification except for the deprecation message in the block list. - This patch removes that list from the ipblocklist sources. - This is part of a patch set that also removes this list from the files in users systems and from any restore from an earlier backup when the updates sources list is issued. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/ipblocklist/sources | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources index 158c8bc20..a25353528 100644 --- a/config/ipblocklist/sources +++ b/config/ipblocklist/sources @@ -128,11 +128,5 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name' => 'Emerging Threats Blocklis 'info' => 'https://blacklist.3coresec.net', 'parser' => 'ip-or-net-list', 'rate' => '1d', - 'category' => 'attacker' }, - 'ABUSECH_BOTNETC2' => { 'name' => 'ABUSE.ch Botnet C2 IP Blocklist', - 'url' => 'https://sslbl.abuse.ch/blacklist/sslipblacklist.txt', - 'info' => 'https://sslbl.abuse.ch/blacklist#botnet-c2-ips-csv', - 'parser' => 'ip-or-net-list', - 'rate' => '5m', - 'category' => 'reputation' } + 'category' => 'attacker' } ); -- 2.48.1

1 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2025