IPFire-SCM December 2012

ipfire-scm@lists.ipfire.org

1 participants
59 discussions

[git.ipfire.org] IPFire 2.x development tree branch, thirteen, updated. c51f6767e956061da2cd3db417328e03ae92a4ce
by git＠ipfire.org 11 Dec '12

11 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, thirteen has been updated via c51f6767e956061da2cd3db417328e03ae92a4ce (commit) from 404c8e462b1b4ba05f679e9759a58afd3090f0e0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c51f6767e956061da2cd3db417328e03ae92a4ce Author: Daniel Weismueller <whytea(a)ipfire.org> Date: Tue Dec 11 15:46:09 2012 +0100 bash: Clear console before logout to not leak any information. ----------------------------------------------------------------------- Summary of changes: config/bash/dot_bash_logout | 3 +++ 1 file changed, 3 insertions(+) Difference in files: diff --git a/config/bash/dot_bash_logout b/config/bash/dot_bash_logout index 3762d94..d56620d 100644 --- a/config/bash/dot_bash_logout +++ b/config/bash/dot_bash_logout @@ -2,6 +2,9 @@ # Personal items to perform on logout. +# Clear console to not leak any information. +clear + echo "Bye bye." # End ~/.bash_logout hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f9f13c135b2c8d86a1861aec8f80985483843f52
by git＠ipfire.org 11 Dec '12

11 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f9f13c135b2c8d86a1861aec8f80985483843f52 (commit) via 7c8301fb8a501d03e47923bf7eb321330b663736 (commit) via ff1ed674e01b7db0acd4a565dc74cca01b825f6b (commit) from 1d0fcb09edd3929dda72d23afd3a8d16f7713794 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f9f13c135b2c8d86a1861aec8f80985483843f52 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 11 13:16:34 2012 +0100 etherwake: Also send broadcast packet. Fixes #10191. commit 7c8301fb8a501d03e47923bf7eb321330b663736 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 11 12:32:34 2012 +0100 snort: Update to 2.9.4. Comes with a bunch of bugfixes. Nothing too exciting for us. commit ff1ed674e01b7db0acd4a565dc74cca01b825f6b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 11 12:16:54 2012 +0100 routing.cgi: Allow adding static routes with subnet masks. It was not possible to enter networks in the subnet mask notation, which is fixed by this patch. Fixes #10219. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/daq | 6 +++--- config/rootfiles/common/snort | 4 +++- config/rootfiles/core/65/filelists/files | 2 ++ config/rootfiles/core/{64 => 65}/filelists/snort | 0 html/cgi-bin/ids.cgi | 4 ++-- html/cgi-bin/routing.cgi | 4 +++- lfs/daq | 4 ++-- lfs/snort | 4 ++-- src/misc-progs/launch-ether-wake.c | 4 ++++ 9 files changed, 21 insertions(+), 11 deletions(-) copy config/rootfiles/core/{64 => 65}/filelists/snort (100%) Difference in files: diff --git a/config/rootfiles/common/daq b/config/rootfiles/common/daq index b23fd19..10ec777 100644 --- a/config/rootfiles/common/daq +++ b/config/rootfiles/common/daq @@ -1,4 +1,4 @@ -usr/bin/daq-modules-config +#usr/bin/daq-modules-config #usr/include/daq.h #usr/include/daq_api.h #usr/include/daq_common.h @@ -20,8 +20,8 @@ usr/lib/daq #usr/lib/libdaq.a #usr/lib/libdaq.la #usr/lib/libdaq.so -usr/lib/libdaq.so.1 -usr/lib/libdaq.so.1.0.0 +usr/lib/libdaq.so.2 +usr/lib/libdaq.so.2.0.0 #usr/lib/libdaq_static.a #usr/lib/libdaq_static.la #usr/lib/libdaq_static_modules.a diff --git a/config/rootfiles/common/snort b/config/rootfiles/common/snort index 90233a1..8404486 100644 --- a/config/rootfiles/common/snort +++ b/config/rootfiles/common/snort @@ -26,9 +26,10 @@ usr/bin/u2spewfoo #usr/include/snort/dynamic_output/snort_debug.h #usr/include/snort/dynamic_output/stream_api.h #usr/include/snort/dynamic_preproc -#usr/include/snort/dynamic_preproc/attribute_table_api.h #usr/include/snort/dynamic_preproc/bitop.h #usr/include/snort/dynamic_preproc/cpuclock.h +#usr/include/snort/dynamic_preproc/file_api.h +#usr/include/snort/dynamic_preproc/file_lib.h #usr/include/snort/dynamic_preproc/idle_processing.h #usr/include/snort/dynamic_preproc/ipv6_port.h #usr/include/snort/dynamic_preproc/mempool.h @@ -178,6 +179,7 @@ usr/sbin/snort #usr/share/doc/snort/README.dnp3 #usr/share/doc/snort/README.dns #usr/share/doc/snort/README.event_queue +#usr/share/doc/snort/README.file #usr/share/doc/snort/README.filters #usr/share/doc/snort/README.flowbits #usr/share/doc/snort/README.frag3 diff --git a/config/rootfiles/core/65/filelists/files b/config/rootfiles/core/65/filelists/files index 67bd0b3..13788f1 100644 --- a/config/rootfiles/core/65/filelists/files +++ b/config/rootfiles/core/65/filelists/files @@ -3,7 +3,9 @@ etc/system-release etc/issue srv/web/ipfire/cgi-bin/logs.cgi/calamaris.dat srv/web/ipfire/cgi-bin/ovpnmain.cgi +srv/web/ipfire/cgi-bin/routing.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi +usr/local/bin/launch-ether-wake usr/sbin/ovpn-ccd-convert var/ipfire/general-functions.pl var/ipfire/langs diff --git a/config/rootfiles/core/65/filelists/snort b/config/rootfiles/core/65/filelists/snort new file mode 120000 index 0000000..9406ce0 --- /dev/null +++ b/config/rootfiles/core/65/filelists/snort @@ -0,0 +1 @@ +../../../common/snort \ No newline at end of file diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index efbc3de..c5fb4c6 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -263,9 +263,9 @@ if (-e "/etc/snort/snort.conf") { ####################### End added for snort rules control ################################# if ($snortsettings{'RULES'} eq 'subscripted') { - $url=" http://www.snort.org/reg-rules/snortrules-snapshot-2931_s.tar.gz/$snortsett…'OINKCODE'}"; + $url=" http://www.snort.org/reg-rules/snortrules-snapshot-294_s.tar.gz/$snortsetti…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url=" http://www.snort.org/reg-rules/snortrules-snapshot-2931.tar.gz/$snortsettin…'OINKCODE'}"; + $url=" http://www.snort.org/reg-rules/snortrules-snapshot-294.tar.gz/$snortsetting…'OINKCODE'}"; } else { $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; } diff --git a/html/cgi-bin/routing.cgi b/html/cgi-bin/routing.cgi index 86e0429..afcd388 100644 --- a/html/cgi-bin/routing.cgi +++ b/html/cgi-bin/routing.cgi @@ -118,6 +118,8 @@ if ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) { } if ($settings{'ACTION'} eq $Lang::tr{'add'}) { + # Convert subnet masks to CIDR notation. + $settings{'IP'} = &General::iporsubtocidr($settings{'IP'}); # Validate inputs if (( !&General::validip($settings{'IP'})) and ( !&General::validipandmask($settings{'IP'}))){ @@ -443,4 +445,4 @@ sub SortDataFile # sub BuildConfiguration { system '/usr/local/bin/rebuildroutes'; -} \ No newline at end of file +} diff --git a/lfs/daq b/lfs/daq index a0f7b25..cac012b 100644 --- a/lfs/daq +++ b/lfs/daq @@ -24,7 +24,7 @@ include Config -VER = 1.1.1 +VER = 2.0.0 THISAPP = daq-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = bc204ea09165b4ecbb1bb49c7c1a2ad4 +$(DL_FILE)_MD5 = a00855a153647df76d47f1ea454f74ae install : $(TARGET) diff --git a/lfs/snort b/lfs/snort index 98c232d..950b319 100644 --- a/lfs/snort +++ b/lfs/snort @@ -24,7 +24,7 @@ include Config -VER = 2.9.3.1 +VER = 2.9.4 THISAPP = snort-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b2102605a7ca023ad6a2429821061c29 +$(DL_FILE)_MD5 = e79ee6b4fbb32edc5dfed2d7dfcc6813 install : $(TARGET) diff --git a/src/misc-progs/launch-ether-wake.c b/src/misc-progs/launch-ether-wake.c index f487041..cac4d3c 100644 --- a/src/misc-progs/launch-ether-wake.c +++ b/src/misc-progs/launch-ether-wake.c @@ -29,5 +29,9 @@ int main(int argc, char *argv[]) snprintf(command, BUFFER_SIZE-1, "/usr/sbin/etherwake -i %s %s", argv[2], argv[1]); safe_system(command); + /* Send magic packet with broadcast flag set. */ + snprintf(command, BUFFER_SIZE-1, "/usr/sbin/etherwake -i %s -b %s", argv[2], argv[1]); + safe_system(command); + return(0); } hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, thirteen, updated. 404c8e462b1b4ba05f679e9759a58afd3090f0e0
by git＠ipfire.org 10 Dec '12

10 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, thirteen has been updated via 404c8e462b1b4ba05f679e9759a58afd3090f0e0 (commit) from bec27ff2636c01c0085deddb4c848fc066533a41 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 404c8e462b1b4ba05f679e9759a58afd3090f0e0 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Dec 10 17:15:48 2012 +0100 strongswan: Enable eap-radius plugin. It has been requested by a couple of users to enable this plugin. http://forum.ipfire.org/index.php?topic=3333.0 http://wiki.strongswan.org/projects/strongswan/wiki/EapRadius ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/strongswan | 12 +++++++++--- lfs/strongswan | 1 + 2 files changed, 10 insertions(+), 3 deletions(-) Difference in files: diff --git a/config/rootfiles/common/strongswan b/config/rootfiles/common/strongswan index 18d7582..9dbf4fb 100644 --- a/config/rootfiles/common/strongswan +++ b/config/rootfiles/common/strongswan @@ -13,17 +13,22 @@ etc/strongswan.conf #usr/lib/ipsec #usr/lib/ipsec/libcharon.a #usr/lib/ipsec/libcharon.la -#usr/lib/ipsec/libcharon.so +usr/lib/ipsec/libcharon.so usr/lib/ipsec/libcharon.so.0 usr/lib/ipsec/libcharon.so.0.0.0 #usr/lib/ipsec/libhydra.a #usr/lib/ipsec/libhydra.la -#usr/lib/ipsec/libhydra.so +usr/lib/ipsec/libhydra.so usr/lib/ipsec/libhydra.so.0 usr/lib/ipsec/libhydra.so.0.0.0 +#usr/lib/ipsec/libradius.a +#usr/lib/ipsec/libradius.la +usr/lib/ipsec/libradius.so +usr/lib/ipsec/libradius.so.0 +usr/lib/ipsec/libradius.so.0.0.0 #usr/lib/ipsec/libstrongswan.a #usr/lib/ipsec/libstrongswan.la -#usr/lib/ipsec/libstrongswan.so +usr/lib/ipsec/libstrongswan.so usr/lib/ipsec/libstrongswan.so.0 usr/lib/ipsec/libstrongswan.so.0.0.0 #usr/lib/ipsec/plugins @@ -34,6 +39,7 @@ usr/lib/ipsec/plugins/libstrongswan-constraints.so usr/lib/ipsec/plugins/libstrongswan-curl.so usr/lib/ipsec/plugins/libstrongswan-des.so usr/lib/ipsec/plugins/libstrongswan-dnskey.so +usr/lib/ipsec/plugins/libstrongswan-eap-radius.so usr/lib/ipsec/plugins/libstrongswan-fips-prf.so usr/lib/ipsec/plugins/libstrongswan-gmp.so usr/lib/ipsec/plugins/libstrongswan-hmac.so diff --git a/lfs/strongswan b/lfs/strongswan index e6be0c2..39459c8 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -84,6 +84,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --sysconfdir="/etc" \ --enable-curl \ --enable-openssl \ + --enable-eap-radius \ $(PADLOCK) cd $(DIR_APP) && make $(MAKETUNING) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 3.x development tree branch, master, updated. 5c16bb1ac0c13a057b26a8187a44178d4189416b
by git＠ipfire.org 08 Dec '12

08 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 5c16bb1ac0c13a057b26a8187a44178d4189416b (commit) via 43c69e28b99bb6c6f847f2467d79297df2c96b92 (commit) from 38309f025a1c685fd6741f6a9e2e04908f0d6fa1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5c16bb1ac0c13a057b26a8187a44178d4189416b Merge: 38309f0 43c69e2 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Dec 8 22:34:53 2012 +0100 Merge remote-tracking branch 'stevee/openssh-6.1' commit 43c69e28b99bb6c6f847f2467d79297df2c96b92 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Dec 8 18:22:54 2012 +0100 openssh: Update to 6.1p1. This is a major update to the latest stable release. * Update patchset. * Remove non working configure flag "--with-ldap". * Move service file for sshd-keygen into correct package. ----------------------------------------------------------------------- Summary of changes: openssh/openssh.nm | 25 +- openssh/patches/openssh-5.9p1-2auth.patch | 354 --------- openssh/patches/openssh-5.9p1-mls.patch | 400 ---------- ...1-entropy.patch => openssh-6.0p1-entropy.patch} | 157 ++-- openssh/patches/openssh-6.1p1-akc.patch | 565 ++++++++++++++ ...ass-ld.patch => openssh-6.1p1-askpass-ld.patch} | 14 +- .../openssh-6.1p1-authenticationmethods.patch | 841 +++++++++++++++++++++ ...coverity.patch => openssh-6.1p1-coverity.patch} | 456 +++++------ ...1-kuserok.patch => openssh-6.1p1-kuserok.patch} | 82 +- .../openssh-6.1p1-required-authentications.patch | 22 + ...9p1-role.patch => openssh-6.1p1-role-mls.patch} | 611 +++++++++++---- ...9p1-vendor.patch => openssh-6.1p1-vendor.patch} | 133 ++-- 12 files changed, 2319 insertions(+), 1341 deletions(-) delete mode 100644 openssh/patches/openssh-5.9p1-2auth.patch delete mode 100644 openssh/patches/openssh-5.9p1-mls.patch rename openssh/patches/{openssh-5.9p1-entropy.patch => openssh-6.0p1-entropy.patch} (67%) create mode 100644 openssh/patches/openssh-6.1p1-akc.patch rename openssh/patches/{openssh-5.8p2-askpass-ld.patch => openssh-6.1p1-askpass-ld.patch} (53%) create mode 100644 openssh/patches/openssh-6.1p1-authenticationmethods.patch rename openssh/patches/{openssh-5.9p1-coverity.patch => openssh-6.1p1-coverity.patch} (73%) rename openssh/patches/{openssh-5.9p1-kuserok.patch => openssh-6.1p1-kuserok.patch} (67%) create mode 100644 openssh/patches/openssh-6.1p1-required-authentications.patch rename openssh/patches/{openssh-5.9p1-role.patch => openssh-6.1p1-role-mls.patch} (50%) rename openssh/patches/{openssh-5.9p1-vendor.patch => openssh-6.1p1-vendor.patch} (61%) Difference in files: diff --git a/openssh/openssh.nm b/openssh/openssh.nm index f46e85f..10d43f4 100644 --- a/openssh/openssh.nm +++ b/openssh/openssh.nm @@ -4,8 +4,8 @@ ############################################################################### name = openssh -version = 5.9p1 -release = 8 +version = 6.1p1 +release = 1 groups = Application/Internet url = http://www.openssh.com/portable.html @@ -39,23 +39,21 @@ build # Apply patches in a special order patches - openssh-5.9p1-coverity.patch + openssh-6.1p1-coverity.patch openssh-5.8p1-fingerprint.patch openssh-5.8p1-getaddrinfo.patch openssh-5.8p1-packet.patch - openssh-5.9p1-2auth.patch - openssh-5.9p1-role.patch - openssh-5.9p1-mls.patch + openssh-6.1p1-authenticationmethods.patch + openssh-6.1p1-role-mls.patch openssh-5.9p1-sftp-chroot.patch - openssh-5.9p1-akc.patch - openssh-5.9p1-keygen.patch + openssh-6.1p1-akc.patch openssh-5.2p1-allow-ip-opts.patch openssh-5.9p1-randclean.patch openssh-5.8p1-keyperm.patch openssh-5.8p2-remove-stale-control-socket.patch openssh-5.9p1-ipv6man.patch openssh-5.8p2-sigpipe.patch - openssh-5.8p2-askpass-ld.patch + openssh-6.1p1-askpass-ld.patch openssh-5.5p1-x11.patch openssh-5.6p1-exit-deadlock.patch openssh-5.1p1-askpass-progress.patch @@ -64,10 +62,11 @@ build openssh-5.1p1-scp-manpage.patch openssh-5.8p1-localdomain.patch openssh-5.9p1-ipfire.patch - openssh-5.9p1-entropy.patch - openssh-5.9p1-vendor.patch + openssh-6.0p1-entropy.patch + openssh-6.1p1-vendor.patch openssh-5.8p2-force_krb.patch - openssh-5.9p1-kuserok.patch + openssh-6.1p1-kuserok.patch + openssh-6.1p1-required-authentications.patch end configure_options += \ @@ -82,7 +81,6 @@ build --with-ssl-engine \ --with-authorized-keys-command \ --with-ipaddr-display \ - --with-ldap \ --with-pam \ --with-libedit \ --with-selinux \ @@ -168,6 +166,7 @@ packages %{sysconfdir}/pam.d/sshd %{sysconfdir}/ssh/sshd_config %{unitdir}/sshd.service + %{unitdir}/sshd-keygen.service %{libdir}/openssh/sftp-server %{sbindir}/sshd-keygen %{sbindir}/sshd diff --git a/openssh/patches/openssh-5.8p2-askpass-ld.patch b/openssh/patches/openssh-5.8p2-askpass-ld.patch deleted file mode 100644 index 5b85c80..0000000 --- a/openssh/patches/openssh-5.8p2-askpass-ld.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff -up openssh-5.8p2/contrib/Makefile.askpass-ld openssh-5.8p2/contrib/Makefile ---- openssh-5.8p2/contrib/Makefile.askpass-ld 2011-08-08 22:54:06.050546199 +0200 -+++ openssh-5.8p2/contrib/Makefile 2011-08-08 22:54:43.364420118 +0200 -@@ -2,12 +2,12 @@ all: - @echo "Valid targets: gnome-ssh-askpass1 gnome-ssh-askpass2" - - gnome-ssh-askpass1: gnome-ssh-askpass1.c -- $(CC) `gnome-config --cflags gnome gnomeui` \ -+ $(CC) ${CFLAGS} `gnome-config --cflags gnome gnomeui` \ - gnome-ssh-askpass1.c -o gnome-ssh-askpass1 \ - `gnome-config --libs gnome gnomeui` - - gnome-ssh-askpass2: gnome-ssh-askpass2.c -- $(CC) `pkg-config --cflags gtk+-2.0` \ -+ $(CC) ${CFLAGS} `pkg-config --cflags gtk+-2.0` \ - gnome-ssh-askpass2.c -o gnome-ssh-askpass2 \ - `pkg-config --libs gtk+-2.0 x11` - diff --git a/openssh/patches/openssh-5.9p1-2auth.patch b/openssh/patches/openssh-5.9p1-2auth.patch deleted file mode 100644 index b19d2ac..0000000 --- a/openssh/patches/openssh-5.9p1-2auth.patch +++ /dev/null @@ -1,354 +0,0 @@ -diff -up openssh-5.9p1/auth.h.2auth openssh-5.9p1/auth.h ---- openssh-5.9p1/auth.h.2auth 2011-05-29 13:39:38.000000000 +0200 -+++ openssh-5.9p1/auth.h 2011-09-17 11:36:54.314522599 +0200 -@@ -149,6 +149,8 @@ int auth_root_allowed(char *); - - char *auth2_read_banner(void); - -+void userauth_restart(const char *); -+ - void privsep_challenge_enable(void); - - int auth2_challenge(Authctxt *, char *); -diff -up openssh-5.9p1/auth2.c.2auth openssh-5.9p1/auth2.c ---- openssh-5.9p1/auth2.c.2auth 2011-05-05 06:04:11.000000000 +0200 -+++ openssh-5.9p1/auth2.c 2011-09-17 11:36:54.402521709 +0200 -@@ -290,6 +290,24 @@ input_userauth_request(int type, u_int32 - } - - void -+userauth_restart(const char *method) -+{ -+ options.two_factor_authentication = 0; -+ -+ debug2("userauth restart, method = %s", method); -+ options.pubkey_authentication = options.second_pubkey_authentication && strcmp(method, method_pubkey.name); -+#ifdef GSSAPI -+ options.gss_authentication = options.second_gss_authentication && strcmp(method, method_gssapi.name); -+#endif -+#ifdef JPAKE -+ options.zero_knowledge_password_authentication = options.second_zero_knowledge_password_authentication && strcmp(method, method_jpake.name); -+#endif -+ options.password_authentication = options.second_password_authentication && strcmp(method, method_passwd.name); -+ options.kbd_interactive_authentication = options.second_kbd_interactive_authentication && strcmp(method, method_kbdint.name); -+ options.hostbased_authentication = options.second_hostbased_authentication && strcmp(method, method_hostbased.name); -+} -+ -+void - userauth_finish(Authctxt *authctxt, int authenticated, char *method) - { - char *methods; -@@ -337,6 +355,12 @@ userauth_finish(Authctxt *authctxt, int - - /* XXX todo: check if multiple auth methods are needed */ - if (authenticated == 1) { -+ if (options.two_factor_authentication) { -+ userauth_restart(method); -+ debug("1st factor authentication done go to 2nd factor"); -+ goto ask_methods; -+ } -+ - /* turn off userauth */ - dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore); - packet_start(SSH2_MSG_USERAUTH_SUCCESS); -@@ -356,7 +380,9 @@ userauth_finish(Authctxt *authctxt, int - #endif - packet_disconnect(AUTH_FAIL_MSG, authctxt->user); - } -+ask_methods: - methods = authmethods_get(); -+ debug2("next auth methods = %s", methods); - packet_start(SSH2_MSG_USERAUTH_FAILURE); - packet_put_cstring(methods); - packet_put_char(0); /* XXX partial success, unused */ -diff -up openssh-5.9p1/monitor.c.2auth openssh-5.9p1/monitor.c ---- openssh-5.9p1/monitor.c.2auth 2011-08-05 22:15:18.000000000 +0200 -+++ openssh-5.9p1/monitor.c 2011-09-17 11:36:54.513491937 +0200 -@@ -417,6 +417,10 @@ monitor_child_preauth(Authctxt *_authctx - } - } - #endif -+ if (authenticated && options.two_factor_authentication) { -+ userauth_restart(auth_method); -+ authenticated = 0; -+ } - } - - /* Drain any buffered messages from the child */ -diff -up openssh-5.9p1/servconf.c.2auth openssh-5.9p1/servconf.c ---- openssh-5.9p1/servconf.c.2auth 2011-06-23 00:30:03.000000000 +0200 -+++ openssh-5.9p1/servconf.c 2011-09-17 11:36:54.632461730 +0200 -@@ -92,6 +92,13 @@ initialize_server_options(ServerOptions - options->hostbased_uses_name_from_packet_only = -1; - options->rsa_authentication = -1; - options->pubkey_authentication = -1; -+ options->two_factor_authentication = -1; -+ options->second_pubkey_authentication = -1; -+ options->second_gss_authentication = -1; -+ options->second_password_authentication = -1; -+ options->second_kbd_interactive_authentication = -1; -+ options->second_zero_knowledge_password_authentication = -1; -+ options->second_hostbased_authentication = -1; - options->kerberos_authentication = -1; - options->kerberos_or_local_passwd = -1; - options->kerberos_ticket_cleanup = -1; -@@ -237,6 +244,20 @@ fill_default_server_options(ServerOption - options->permit_empty_passwd = 0; - if (options->permit_user_env == -1) - options->permit_user_env = 0; -+ if (options->two_factor_authentication == -1) -+ options->two_factor_authentication = 0; -+ if (options->second_pubkey_authentication == -1) -+ options->second_pubkey_authentication = 1; -+ if (options->second_gss_authentication == -1) -+ options->second_gss_authentication = 0; -+ if (options->second_password_authentication == -1) -+ options->second_password_authentication = 1; -+ if (options->second_kbd_interactive_authentication == -1) -+ options->second_kbd_interactive_authentication = 0; -+ if (options->second_zero_knowledge_password_authentication == -1) -+ options->second_zero_knowledge_password_authentication = 0; -+ if (options->second_hostbased_authentication == -1) -+ options->second_hostbased_authentication = 0; - if (options->use_login == -1) - options->use_login = 0; - if (options->compression == -1) -@@ -316,8 +337,11 @@ typedef enum { - sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, - sMaxStartups, sMaxAuthTries, sMaxSessions, - sBanner, sUseDNS, sHostbasedAuthentication, -- sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, -- sClientAliveCountMax, sAuthorizedKeysFile, -+ sHostbasedUsesNameFromPacketOnly, sTwoFactorAuthentication, -+ sSecondPubkeyAuthentication, sSecondGssAuthentication, -+ sSecondPasswordAuthentication, sSecondKbdInteractiveAuthentication, -+ sSecondZeroKnowledgePasswordAuthentication, sSecondHostbasedAuthentication, -+ sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, - sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel, - sMatch, sPermitOpen, sForceCommand, sChrootDirectory, - sUsePrivilegeSeparation, sAllowAgentForwarding, -@@ -395,6 +419,21 @@ static struct { - #else - { "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL }, - #endif -+ { "twofactorauthentication", sTwoFactorAuthentication, SSHCFG_ALL }, -+ { "secondpubkeyauthentication", sSecondPubkeyAuthentication, SSHCFG_ALL }, -+#ifdef GSSAPI -+ { "secondgssapiauthentication", sSecondGssAuthentication, SSHCFG_ALL }, -+#else -+ { "secondgssapiauthentication", sUnsupported, SSHCFG_ALL }, -+#endif -+ { "secondpasswordauthentication", sSecondPasswordAuthentication, SSHCFG_ALL }, -+ { "secondkbdinteractiveauthentication", sSecondKbdInteractiveAuthentication, SSHCFG_ALL }, -+#ifdef JPAKE -+ { "secondzeroknowledgepasswordauthentication", sSecondZeroKnowledgePasswordAuthentication, SSHCFG_ALL }, -+#else -+ { "secondzeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL }, -+#endif -+ { "secondhostbasedauthentication", sSecondHostbasedAuthentication, SSHCFG_ALL }, - { "checkmail", sDeprecated, SSHCFG_GLOBAL }, - { "listenaddress", sListenAddress, SSHCFG_GLOBAL }, - { "addressfamily", sAddressFamily, SSHCFG_GLOBAL }, -@@ -982,6 +1021,34 @@ process_server_config_line(ServerOptions - intptr = &options->challenge_response_authentication; - goto parse_flag; - -+ case sTwoFactorAuthentication: -+ intptr = &options->two_factor_authentication; -+ goto parse_flag; -+ -+ case sSecondPubkeyAuthentication: -+ intptr = &options->second_pubkey_authentication; -+ goto parse_flag; -+ -+ case sSecondGssAuthentication: -+ intptr = &options->second_gss_authentication; -+ goto parse_flag; -+ -+ case sSecondPasswordAuthentication: -+ intptr = &options->second_password_authentication; -+ goto parse_flag; -+ -+ case sSecondKbdInteractiveAuthentication: -+ intptr = &options->second_kbd_interactive_authentication; -+ goto parse_flag; -+ -+ case sSecondZeroKnowledgePasswordAuthentication: -+ intptr = &options->second_zero_knowledge_password_authentication; -+ goto parse_flag; -+ -+ case sSecondHostbasedAuthentication: -+ intptr = &options->second_hostbased_authentication; -+ goto parse_flag; -+ - case sPrintMotd: - intptr = &options->print_motd; - goto parse_flag; -@@ -1491,14 +1558,21 @@ void - copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) - { - M_CP_INTOPT(password_authentication); -+ M_CP_INTOPT(second_password_authentication); - M_CP_INTOPT(gss_authentication); -+ M_CP_INTOPT(second_gss_authentication); - M_CP_INTOPT(rsa_authentication); - M_CP_INTOPT(pubkey_authentication); -+ M_CP_INTOPT(second_pubkey_authentication); - M_CP_INTOPT(kerberos_authentication); - M_CP_INTOPT(hostbased_authentication); -+ M_CP_INTOPT(second_hostbased_authentication); - M_CP_INTOPT(hostbased_uses_name_from_packet_only); - M_CP_INTOPT(kbd_interactive_authentication); -+ M_CP_INTOPT(second_kbd_interactive_authentication); - M_CP_INTOPT(zero_knowledge_password_authentication); -+ M_CP_INTOPT(second_zero_knowledge_password_authentication); -+ M_CP_INTOPT(two_factor_authentication); - M_CP_INTOPT(permit_root_login); - M_CP_INTOPT(permit_empty_passwd); - -@@ -1720,17 +1794,24 @@ dump_config(ServerOptions *o) - #endif - #ifdef GSSAPI - dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); -+ dump_cfg_fmtint(sSecondGssAuthentication, o->second_gss_authentication); - dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); - #endif - #ifdef JPAKE - dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication, - o->zero_knowledge_password_authentication); -+ dump_cfg_fmtint(sSecondZeroKnowledgePasswordAuthentication, -+ o->second_zero_knowledge_password_authentication); - #endif - dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); -+ dump_cfg_fmtint(sSecondPasswordAuthentication, o->second_password_authentication); - dump_cfg_fmtint(sKbdInteractiveAuthentication, - o->kbd_interactive_authentication); -+ dump_cfg_fmtint(sSecondKbdInteractiveAuthentication, -+ o->second_kbd_interactive_authentication); - dump_cfg_fmtint(sChallengeResponseAuthentication, - o->challenge_response_authentication); -+ dump_cfg_fmtint(sTwoFactorAuthentication, o->two_factor_authentication); - dump_cfg_fmtint(sPrintMotd, o->print_motd); - dump_cfg_fmtint(sPrintLastLog, o->print_lastlog); - dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding); -diff -up openssh-5.9p1/servconf.h.2auth openssh-5.9p1/servconf.h ---- openssh-5.9p1/servconf.h.2auth 2011-06-23 00:30:03.000000000 +0200 -+++ openssh-5.9p1/servconf.h 2011-09-17 11:36:54.749584245 +0200 -@@ -112,6 +112,14 @@ typedef struct { - /* If true, permit jpake auth */ - int permit_empty_passwd; /* If false, do not permit empty - * passwords. */ -+ int two_factor_authentication; /* If true, the first sucessful authentication -+ * will be followed by the second one from anorher set */ -+ int second_pubkey_authentication; /* second set of authentications */ -+ int second_gss_authentication; -+ int second_password_authentication; -+ int second_kbd_interactive_authentication; -+ int second_zero_knowledge_password_authentication; -+ int second_hostbased_authentication; - int permit_user_env; /* If true, read ~/.ssh/environment */ - int use_login; /* If true, login(1) is used */ - int compression; /* If true, compression is allowed */ -diff -up openssh-5.9p1/sshd_config.2auth openssh-5.9p1/sshd_config ---- openssh-5.9p1/sshd_config.2auth 2011-05-29 13:39:39.000000000 +0200 -+++ openssh-5.9p1/sshd_config 2011-09-17 11:36:54.859588726 +0200 -@@ -87,6 +87,13 @@ AuthorizedKeysFile .ssh/authorized_keys - # and ChallengeResponseAuthentication to 'no'. - #UsePAM no - -+#TwoFactorAuthentication no -+#SecondPubkeyAuthentication yes -+#SecondHostbasedAuthentication no -+#SecondPasswordAuthentication yes -+#SecondKBDInteractiveAuthentication yes -+#SecondGSSAPIAuthentication no -+ - #AllowAgentForwarding yes - #AllowTcpForwarding yes - #GatewayPorts no -diff -up openssh-5.9p1/sshd_config.5.2auth openssh-5.9p1/sshd_config.5 ---- openssh-5.9p1/sshd_config.5.2auth 2011-08-05 22:17:33.000000000 +0200 -+++ openssh-5.9p1/sshd_config.5 2011-09-17 13:45:49.022521436 +0200 -@@ -726,6 +726,12 @@ Available keywords are - .Cm PubkeyAuthentication , - .Cm RhostsRSAAuthentication , - .Cm RSAAuthentication , -+.Cm SecondGSSAPIAuthentication , -+.Cm SecondHostbasedAuthentication , -+.Cm SecondKbdInteractiveAuthentication , -+.Cm SecondPasswordAuthentication , -+.Cm SecondPubkeyAuthentication , -+.Cm TwoFactorAuthentication , - .Cm X11DisplayOffset , - .Cm X11Forwarding - and -@@ -931,6 +937,45 @@ Specifies whether pure RSA authenticatio - The default is - .Dq yes . - This option applies to protocol version 1 only. -+.It Cm SecondGSSAPIAuthentication -+Specifies whether the -+.Cm GSSAPIAuthentication -+may be used on the second authentication while -+.Cm TwoFactorAuthentication -+is set. -+The default is -+.Dq no . -+.It Cm SecondHostbasedAuthentication -+Specifies whether the -+.Cm HostbasedAuthentication -+may be used on the second authentication while -+.Cm TwoFactorAuthentication -+is set. -+The default is -+.Dq no . -+.It Cm SecondKbdInteractiveAuthentication -+Specifies whether the -+.Cm KbdInteractiveAuthentication -+may be used on the second authentication while -+.Cm TwoFactorAuthentication -+is set. -+The default is -+.Dq yes . -+.It Cm SecondPasswordAuthentication -+Specifies whether the -+.Cm PasswordAuthentication -+may be used on the second authentication while -+.Cm TwoFactorAuthentication -+is set. -+The default is -+.Dq yes . -+Specifies whether the -+.Cm PubkeyAuthentication -+may be used on the second authentication while -+.Cm TwoFactorAuthentication -+is set. -+The default is -+.Dq yes . - .It Cm ServerKeyBits - Defines the number of bits in the ephemeral protocol version 1 server key. - The minimum value is 512, and the default is 1024. -@@ -1011,6 +1056,23 @@ For more details on certificates, see th - .Sx CERTIFICATES - section in - .Xr ssh-keygen 1 . -+.It Cm TwoFactorAuthentication -+Specifies whether for a successful login is necessary to meet two independent authentications. -+If select the first method is selected from the set of allowed methods from -+.Cm GSSAPIAuthentication , -+.Cm HostbasedAuthentication , -+.Cm KbdInteractiveAuthentication , -+.Cm PasswordAuthentication , -+.Cm PubkeyAuthentication . -+And the second method is selected from the set of allowed methods from -+.Cm SecondGSSAPIAuthentication , -+.Cm SecondHostbasedAuthentication , -+.Cm SecondKbdInteractiveAuthentication , -+.Cm SecondPasswordAuthentication , -+.Cm SecondPubkeyAuthentication -+without the method used for the first authentication. -+The default is -+.Dq no . - .It Cm UseDNS - Specifies whether - .Xr sshd 8 diff --git a/openssh/patches/openssh-5.9p1-coverity.patch b/openssh/patches/openssh-5.9p1-coverity.patch deleted file mode 100644 index f3524e3..0000000 --- a/openssh/patches/openssh-5.9p1-coverity.patch +++ /dev/null @@ -1,844 +0,0 @@ -diff -up openssh-5.9p1/auth-pam.c.coverity openssh-5.9p1/auth-pam.c ---- openssh-5.9p1/auth-pam.c.coverity 2009-07-12 14:07:21.000000000 +0200 -+++ openssh-5.9p1/auth-pam.c 2011-09-14 08:09:47.074520582 +0200 -@@ -216,7 +216,12 @@ pthread_join(sp_pthread_t thread, void * - if (sshpam_thread_status != -1) - return (sshpam_thread_status); - signal(SIGCHLD, sshpam_oldsig); -- waitpid(thread, &status, 0); -+ while (waitpid(thread, &status, 0) < 0) { -+ if (errno == EINTR) -+ continue; -+ fatal("%s: waitpid: %s", __func__, -+ strerror(errno)); -+ } - return (status); - } - #endif -diff -up openssh-5.9p1/channels.c.coverity openssh-5.9p1/channels.c ---- openssh-5.9p1/channels.c.coverity 2011-06-23 00:31:57.000000000 +0200 -+++ openssh-5.9p1/channels.c 2011-09-14 08:09:47.556582810 +0200 -@@ -229,11 +229,11 @@ channel_register_fds(Channel *c, int rfd - channel_max_fd = MAX(channel_max_fd, wfd); - channel_max_fd = MAX(channel_max_fd, efd); - -- if (rfd != -1) -+ if (rfd >= 0) - fcntl(rfd, F_SETFD, FD_CLOEXEC); -- if (wfd != -1 && wfd != rfd) -+ if (wfd >= 0 && wfd != rfd) - fcntl(wfd, F_SETFD, FD_CLOEXEC); -- if (efd != -1 && efd != rfd && efd != wfd) -+ if (efd >= 0 && efd != rfd && efd != wfd) - fcntl(efd, F_SETFD, FD_CLOEXEC); - - c->rfd = rfd; -@@ -248,11 +248,11 @@ channel_register_fds(Channel *c, int rfd - - /* enable nonblocking mode */ - if (nonblock) { -- if (rfd != -1) -+ if (rfd >= 0) - set_nonblock(rfd); -- if (wfd != -1) -+ if (wfd >= 0) - set_nonblock(wfd); -- if (efd != -1) -+ if (efd >= 0) - set_nonblock(efd); - } - } -diff -up openssh-5.9p1/clientloop.c.coverity openssh-5.9p1/clientloop.c ---- openssh-5.9p1/clientloop.c.coverity 2011-06-23 00:31:58.000000000 +0200 -+++ openssh-5.9p1/clientloop.c 2011-09-14 08:17:41.556521887 +0200 -@@ -1970,14 +1970,15 @@ client_input_global_request(int type, u_ - char *rtype; - int want_reply; - int success = 0; -+/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */ - - rtype = packet_get_string(NULL); - want_reply = packet_get_char(); - debug("client_input_global_request: rtype %s want_reply %d", - rtype, want_reply); - if (want_reply) { -- packet_start(success ? -- SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE); -+ packet_start(/*success ? -+ SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE); - packet_send(); - packet_write_wait(); - } -diff -up openssh-5.9p1/key.c.coverity openssh-5.9p1/key.c ---- openssh-5.9p1/key.c.coverity 2011-05-20 11:03:08.000000000 +0200 -+++ openssh-5.9p1/key.c 2011-09-14 08:09:47.803458435 +0200 -@@ -803,8 +803,10 @@ key_read(Key *ret, char **cpp) - success = 1; - /*XXXX*/ - key_free(k); -+/*XXXX - if (success != 1) - break; -+XXXX*/ - /* advance cp: skip whitespace and data */ - while (*cp == ' ' || *cp == '\t') - cp++; -diff -up openssh-5.9p1/misc.c.coverity openssh-5.9p1/misc.c -diff -up openssh-5.9p1/monitor.c.coverity openssh-5.9p1/monitor.c ---- openssh-5.9p1/monitor.c.coverity 2011-08-05 22:15:18.000000000 +0200 -+++ openssh-5.9p1/monitor.c 2011-09-14 08:09:47.914584009 +0200 -@@ -420,7 +420,7 @@ monitor_child_preauth(Authctxt *_authctx - } - - /* Drain any buffered messages from the child */ -- while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0) -+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0) - ; - - if (!authctxt->valid) -@@ -1161,6 +1161,10 @@ mm_answer_keyallowed(int sock, Buffer *m - break; - } - } -+ -+ debug3("%s: key %p is %s", -+ __func__, key, allowed ? "allowed" : "not allowed"); -+ - if (key != NULL) - key_free(key); - -@@ -1182,9 +1186,6 @@ mm_answer_keyallowed(int sock, Buffer *m - xfree(chost); - } - -- debug3("%s: key %p is %s", -- __func__, key, allowed ? "allowed" : "not allowed"); -- - buffer_clear(m); - buffer_put_int(m, allowed); - buffer_put_int(m, forced_command != NULL); -diff -up openssh-5.9p1/monitor_wrap.c.coverity openssh-5.9p1/monitor_wrap.c ---- openssh-5.9p1/monitor_wrap.c.coverity 2011-09-14 08:11:36.480500123 +0200 -+++ openssh-5.9p1/monitor_wrap.c 2011-09-14 08:14:11.279520598 +0200 -@@ -707,10 +707,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, - if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 || - (tmp2 = dup(pmonitor->m_recvfd)) == -1) { - error("%s: cannot allocate fds for pty", __func__); -- if (tmp1 > 0) -+ if (tmp1 >= 0) - close(tmp1); -- if (tmp2 > 0) -- close(tmp2); -+ /*DEAD CODE if (tmp2 >= 0) -+ close(tmp2);*/ - return 0; - } - close(tmp1); -diff -up openssh-5.9p1/openbsd-compat/bindresvport.c.coverity openssh-5.9p1/openbsd-compat/bindresvport.c ---- openssh-5.9p1/openbsd-compat/bindresvport.c.coverity 2010-12-03 00:50:26.000000000 +0100 -+++ openssh-5.9p1/openbsd-compat/bindresvport.c 2011-09-14 08:09:48.084459344 +0200 -@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr - struct sockaddr_in6 *in6; - u_int16_t *portp; - u_int16_t port; -- socklen_t salen; -+ socklen_t salen = sizeof(struct sockaddr_storage); - int i; - - if (sa == NULL) { -diff -up openssh-5.9p1/packet.c.coverity openssh-5.9p1/packet.c ---- openssh-5.9p1/packet.c.coverity 2011-05-15 00:58:15.000000000 +0200 -+++ openssh-5.9p1/packet.c 2011-09-14 08:09:48.184587842 +0200 -@@ -1177,6 +1177,7 @@ packet_read_poll1(void) - case DEATTACK_DETECTED: - packet_disconnect("crc32 compensation attack: " - "network attack detected"); -+ break; - case DEATTACK_DOS_DETECTED: - packet_disconnect("deattack denial of " - "service detected"); -@@ -1684,7 +1685,7 @@ void - packet_write_wait(void) - { - fd_set *setp; -- int ret, ms_remain; -+ int ret, ms_remain = 0; - struct timeval start, timeout, *timeoutp = NULL; - - setp = (fd_set *)xcalloc(howmany(active_state->connection_out + 1, -diff -up openssh-5.9p1/progressmeter.c.coverity openssh-5.9p1/progressmeter.c ---- openssh-5.9p1/progressmeter.c.coverity 2006-08-05 04:39:40.000000000 +0200 -+++ openssh-5.9p1/progressmeter.c 2011-09-14 08:09:48.300586004 +0200 -@@ -65,7 +65,7 @@ static void update_progress_meter(int); - - static time_t start; /* start progress */ - static time_t last_update; /* last progress update */ --static char *file; /* name of the file being transferred */ -+static const char *file; /* name of the file being transferred */ - static off_t end_pos; /* ending position of transfer */ - static off_t cur_pos; /* transfer position as of last refresh */ - static volatile off_t *counter; /* progress counter */ -@@ -247,7 +247,7 @@ update_progress_meter(int ignore) - } - - void --start_progress_meter(char *f, off_t filesize, off_t *ctr) -+start_progress_meter(const char *f, off_t filesize, off_t *ctr) - { - start = last_update = time(NULL); - file = f; -diff -up openssh-5.9p1/progressmeter.h.coverity openssh-5.9p1/progressmeter.h ---- openssh-5.9p1/progressmeter.h.coverity 2006-03-26 05:30:02.000000000 +0200 -+++ openssh-5.9p1/progressmeter.h 2011-09-14 08:09:48.420645724 +0200 -@@ -23,5 +23,5 @@ - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - --void start_progress_meter(char *, off_t, off_t *); -+void start_progress_meter(const char *, off_t, off_t *); - void stop_progress_meter(void); -diff -up openssh-5.9p1/scp.c.coverity openssh-5.9p1/scp.c ---- openssh-5.9p1/scp.c.coverity 2011-01-06 12:41:21.000000000 +0100 -+++ openssh-5.9p1/scp.c 2011-09-14 08:09:48.531505457 +0200 -@@ -155,7 +155,7 @@ killchild(int signo) - { - if (do_cmd_pid > 1) { - kill(do_cmd_pid, signo ? signo : SIGTERM); -- waitpid(do_cmd_pid, NULL, 0); -+ (void) waitpid(do_cmd_pid, NULL, 0); - } - - if (signo) -diff -up openssh-5.9p1/servconf.c.coverity openssh-5.9p1/servconf.c ---- openssh-5.9p1/servconf.c.coverity 2011-06-23 00:30:03.000000000 +0200 -+++ openssh-5.9p1/servconf.c 2011-09-14 08:30:17.557468182 +0200 -@@ -609,7 +609,7 @@ match_cfg_line(char **condition, int lin - debug3("checking syntax for 'Match %s'", cp); - else - debug3("checking match for '%s' user %s host %s addr %s", cp, -- user ? user : "(null)", host ? host : "(null)", -+ user /* User is not NULL ? user : "(null)" */, host ? host : "(null)", - address ? address : "(null)"); - - while ((attrib = strdelim(&cp)) && *attrib != '\0') { -@@ -1171,7 +1171,7 @@ process_server_config_line(ServerOptions - fatal("%s line %d: Missing subsystem name.", - filename, linenum); - if (!*activep) { -- arg = strdelim(&cp); -+ /*arg =*/ (void) strdelim(&cp); - break; - } - for (i = 0; i < options->num_subsystems; i++) -@@ -1262,8 +1262,9 @@ process_server_config_line(ServerOptions - if (*activep && *charptr == NULL) { - *charptr = tilde_expand_filename(arg, getuid()); - /* increase optional counter */ -- if (intptr != NULL) -- *intptr = *intptr + 1; -+ /* DEAD CODE intptr is still NULL ;) -+ if (intptr != NULL) -+ *intptr = *intptr + 1; */ - } - break; - -diff -up openssh-5.9p1/serverloop.c.coverity openssh-5.9p1/serverloop.c ---- openssh-5.9p1/serverloop.c.coverity 2011-05-20 11:02:50.000000000 +0200 -+++ openssh-5.9p1/serverloop.c 2011-09-14 08:09:48.793586380 +0200 -@@ -147,13 +147,13 @@ notify_setup(void) - static void - notify_parent(void) - { -- if (notify_pipe[1] != -1) -+ if (notify_pipe[1] >= 0) - write(notify_pipe[1], "", 1); - } - static void - notify_prepare(fd_set *readset) - { -- if (notify_pipe[0] != -1) -+ if (notify_pipe[0] >= 0) - FD_SET(notify_pipe[0], readset); - } - static void -@@ -161,8 +161,8 @@ notify_done(fd_set *readset) - { - char c; - -- if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) -- while (read(notify_pipe[0], &c, 1) != -1) -+ if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) -+ while (read(notify_pipe[0], &c, 1) >= 0) - debug2("notify_done: reading"); - } - -@@ -330,7 +330,7 @@ wait_until_can_do_something(fd_set **rea - * If we have buffered data, try to write some of that data - * to the program. - */ -- if (fdin != -1 && buffer_len(&stdin_buffer) > 0) -+ if (fdin >= 0 && buffer_len(&stdin_buffer) > 0) - FD_SET(fdin, *writesetp); - } - notify_prepare(*readsetp); -@@ -470,7 +470,7 @@ process_output(fd_set *writeset) - int len; - - /* Write buffered data to program stdin. */ -- if (!compat20 && fdin != -1 && FD_ISSET(fdin, writeset)) { -+ if (!compat20 && fdin >= 0 && FD_ISSET(fdin, writeset)) { - data = buffer_ptr(&stdin_buffer); - dlen = buffer_len(&stdin_buffer); - len = write(fdin, data, dlen); -@@ -583,7 +583,7 @@ server_loop(pid_t pid, int fdin_arg, int - set_nonblock(fdin); - set_nonblock(fdout); - /* we don't have stderr for interactive terminal sessions, see below */ -- if (fderr != -1) -+ if (fderr >= 0) - set_nonblock(fderr); - - if (!(datafellows & SSH_BUG_IGNOREMSG) && isatty(fdin)) -@@ -607,7 +607,7 @@ server_loop(pid_t pid, int fdin_arg, int - max_fd = MAX(connection_in, connection_out); - max_fd = MAX(max_fd, fdin); - max_fd = MAX(max_fd, fdout); -- if (fderr != -1) -+ if (fderr >= 0) - max_fd = MAX(max_fd, fderr); - #endif - -@@ -637,7 +637,7 @@ server_loop(pid_t pid, int fdin_arg, int - * If we have received eof, and there is no more pending - * input data, cause a real eof by closing fdin. - */ -- if (stdin_eof && fdin != -1 && buffer_len(&stdin_buffer) == 0) { -+ if (stdin_eof && fdin >= 0 && buffer_len(&stdin_buffer) == 0) { - if (fdin != fdout) - close(fdin); - else -@@ -735,15 +735,15 @@ server_loop(pid_t pid, int fdin_arg, int - buffer_free(&stderr_buffer); - - /* Close the file descriptors. */ -- if (fdout != -1) -+ if (fdout >= 0) - close(fdout); - fdout = -1; - fdout_eof = 1; -- if (fderr != -1) -+ if (fderr >= 0) - close(fderr); - fderr = -1; - fderr_eof = 1; -- if (fdin != -1) -+ if (fdin >= 0) - close(fdin); - fdin = -1; - -@@ -937,7 +937,7 @@ server_input_window_size(int type, u_int - - debug("Window change received."); - packet_check_eom(); -- if (fdin != -1) -+ if (fdin >= 0) - pty_change_window_size(fdin, row, col, xpixel, ypixel); - } - -@@ -990,7 +990,7 @@ server_request_tun(void) - } - - tun = packet_get_int(); -- if (forced_tun_device != -1) { -+ if (forced_tun_device >= 0) { - if (tun != SSH_TUNID_ANY && forced_tun_device != tun) - goto done; - tun = forced_tun_device; -diff -up openssh-5.9p1/sftp-client.c.coverity openssh-5.9p1/sftp-client.c ---- openssh-5.9p1/sftp-client.c.coverity 2010-12-04 23:02:48.000000000 +0100 -+++ openssh-5.9p1/sftp-client.c 2011-09-14 08:09:48.910470343 +0200 -@@ -149,7 +149,7 @@ get_msg(struct sftp_conn *conn, Buffer * - } - - static void --send_string_request(struct sftp_conn *conn, u_int id, u_int code, char *s, -+send_string_request(struct sftp_conn *conn, u_int id, u_int code, const char *s, - u_int len) - { - Buffer msg; -@@ -165,7 +165,7 @@ send_string_request(struct sftp_conn *co - - static void - send_string_attrs_request(struct sftp_conn *conn, u_int id, u_int code, -- char *s, u_int len, Attrib *a) -+ const char *s, u_int len, Attrib *a) - { - Buffer msg; - -@@ -422,7 +422,7 @@ sftp_proto_version(struct sftp_conn *con - } - - int --do_close(struct sftp_conn *conn, char *handle, u_int handle_len) -+do_close(struct sftp_conn *conn, const char *handle, u_int handle_len) - { - u_int id, status; - Buffer msg; -@@ -447,7 +447,7 @@ do_close(struct sftp_conn *conn, char *h - - - static int --do_lsreaddir(struct sftp_conn *conn, char *path, int printflag, -+do_lsreaddir(struct sftp_conn *conn, const char *path, int printflag, - SFTP_DIRENT ***dir) - { - Buffer msg; -@@ -571,7 +571,7 @@ do_lsreaddir(struct sftp_conn *conn, cha - } - - int --do_readdir(struct sftp_conn *conn, char *path, SFTP_DIRENT ***dir) -+do_readdir(struct sftp_conn *conn, const char *path, SFTP_DIRENT ***dir) - { - return(do_lsreaddir(conn, path, 0, dir)); - } -@@ -589,7 +589,7 @@ void free_sftp_dirents(SFTP_DIRENT **s) - } - - int --do_rm(struct sftp_conn *conn, char *path) -+do_rm(struct sftp_conn *conn, const char *path) - { - u_int status, id; - -@@ -604,7 +604,7 @@ do_rm(struct sftp_conn *conn, char *path - } - - int --do_mkdir(struct sftp_conn *conn, char *path, Attrib *a, int printflag) -+do_mkdir(struct sftp_conn *conn, const char *path, Attrib *a, int printflag) - { - u_int status, id; - -@@ -620,7 +620,7 @@ do_mkdir(struct sftp_conn *conn, char *p - } - - int --do_rmdir(struct sftp_conn *conn, char *path) -+do_rmdir(struct sftp_conn *conn, const char *path) - { - u_int status, id; - -@@ -636,7 +636,7 @@ do_rmdir(struct sftp_conn *conn, char *p - } - - Attrib * --do_stat(struct sftp_conn *conn, char *path, int quiet) -+do_stat(struct sftp_conn *conn, const char *path, int quiet) - { - u_int id; - -@@ -650,7 +650,7 @@ do_stat(struct sftp_conn *conn, char *pa - } - - Attrib * --do_lstat(struct sftp_conn *conn, char *path, int quiet) -+do_lstat(struct sftp_conn *conn, const char *path, int quiet) - { - u_int id; - -@@ -684,7 +684,7 @@ do_fstat(struct sftp_conn *conn, char *h - #endif - - int --do_setstat(struct sftp_conn *conn, char *path, Attrib *a) -+do_setstat(struct sftp_conn *conn, const char *path, Attrib *a) - { - u_int status, id; - -@@ -701,7 +701,7 @@ do_setstat(struct sftp_conn *conn, char - } - - int --do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len, -+do_fsetstat(struct sftp_conn *conn, const char *handle, u_int handle_len, - Attrib *a) - { - u_int status, id; -@@ -718,12 +718,12 @@ do_fsetstat(struct sftp_conn *conn, char - } - - char * --do_realpath(struct sftp_conn *conn, char *path) -+do_realpath(struct sftp_conn *conn, const char *path) - { - Buffer msg; - u_int type, expected_id, count, id; - char *filename, *longname; -- Attrib *a; -+/*UNUSED Attrib *a; */ - - expected_id = id = conn->msg_id++; - send_string_request(conn, id, SSH2_FXP_REALPATH, path, -@@ -754,7 +754,7 @@ do_realpath(struct sftp_conn *conn, char - - filename = buffer_get_string(&msg, NULL); - longname = buffer_get_string(&msg, NULL); -- a = decode_attrib(&msg); -+ /*a =*/ (void) decode_attrib(&msg); - - debug3("SSH_FXP_REALPATH %s -> %s", path, filename); - -@@ -766,7 +766,7 @@ do_realpath(struct sftp_conn *conn, char - } - - int --do_rename(struct sftp_conn *conn, char *oldpath, char *newpath) -+do_rename(struct sftp_conn *conn, const char *oldpath, const char *newpath) - { - Buffer msg; - u_int status, id; -@@ -800,7 +800,7 @@ do_rename(struct sftp_conn *conn, char * - } - - int --do_hardlink(struct sftp_conn *conn, char *oldpath, char *newpath) -+do_hardlink(struct sftp_conn *conn, const char *oldpath, const char *newpath) - { - Buffer msg; - u_int status, id; -@@ -833,7 +833,7 @@ do_hardlink(struct sftp_conn *conn, char - } - - int --do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath) -+do_symlink(struct sftp_conn *conn, const char *oldpath, const char *newpath) - { - Buffer msg; - u_int status, id; -@@ -984,7 +984,7 @@ send_read_request(struct sftp_conn *conn - } - - int --do_download(struct sftp_conn *conn, char *remote_path, char *local_path, -+do_download(struct sftp_conn *conn, const char *remote_path, const char *local_path, - Attrib *a, int pflag) - { - Attrib junk; -@@ -1223,7 +1223,7 @@ do_download(struct sftp_conn *conn, char - } - - static int --download_dir_internal(struct sftp_conn *conn, char *src, char *dst, -+download_dir_internal(struct sftp_conn *conn, const char *src, const char *dst, - Attrib *dirattrib, int pflag, int printflag, int depth) - { - int i, ret = 0; -@@ -1313,7 +1313,7 @@ download_dir_internal(struct sftp_conn * - } - - int --download_dir(struct sftp_conn *conn, char *src, char *dst, -+download_dir(struct sftp_conn *conn, const char *src, const char *dst, - Attrib *dirattrib, int pflag, int printflag) - { - char *src_canon; -@@ -1331,7 +1331,7 @@ download_dir(struct sftp_conn *conn, cha - } - - int --do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, -+do_upload(struct sftp_conn *conn, const char *local_path, const char *remote_path, - int pflag) - { - int local_fd; -@@ -1514,7 +1514,7 @@ do_upload(struct sftp_conn *conn, char * - } - - static int --upload_dir_internal(struct sftp_conn *conn, char *src, char *dst, -+upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst, - int pflag, int printflag, int depth) - { - int ret = 0, status; -@@ -1605,7 +1605,7 @@ upload_dir_internal(struct sftp_conn *co - } - - int --upload_dir(struct sftp_conn *conn, char *src, char *dst, int printflag, -+upload_dir(struct sftp_conn *conn, const char *src, const char *dst, int printflag, - int pflag) - { - char *dst_canon; -@@ -1622,7 +1622,7 @@ upload_dir(struct sftp_conn *conn, char - } - - char * --path_append(char *p1, char *p2) -+path_append(const char *p1, const char *p2) - { - char *ret; - size_t len = strlen(p1) + strlen(p2) + 2; -diff -up openssh-5.9p1/sftp-client.h.coverity openssh-5.9p1/sftp-client.h ---- openssh-5.9p1/sftp-client.h.coverity 2010-12-04 23:02:48.000000000 +0100 -+++ openssh-5.9p1/sftp-client.h 2011-09-14 08:09:49.021583940 +0200 -@@ -56,49 +56,49 @@ struct sftp_conn *do_init(int, int, u_in - u_int sftp_proto_version(struct sftp_conn *); - - /* Close file referred to by 'handle' */ --int do_close(struct sftp_conn *, char *, u_int); -+int do_close(struct sftp_conn *, const char *, u_int); - - /* Read contents of 'path' to NULL-terminated array 'dir' */ --int do_readdir(struct sftp_conn *, char *, SFTP_DIRENT ***); -+int do_readdir(struct sftp_conn *, const char *, SFTP_DIRENT ***); - - /* Frees a NULL-terminated array of SFTP_DIRENTs (eg. from do_readdir) */ - void free_sftp_dirents(SFTP_DIRENT **); - - /* Delete file 'path' */ --int do_rm(struct sftp_conn *, char *); -+int do_rm(struct sftp_conn *, const char *); - - /* Create directory 'path' */ --int do_mkdir(struct sftp_conn *, char *, Attrib *, int); -+int do_mkdir(struct sftp_conn *, const char *, Attrib *, int); - - /* Remove directory 'path' */ --int do_rmdir(struct sftp_conn *, char *); -+int do_rmdir(struct sftp_conn *, const char *); - - /* Get file attributes of 'path' (follows symlinks) */ --Attrib *do_stat(struct sftp_conn *, char *, int); -+Attrib *do_stat(struct sftp_conn *, const char *, int); - - /* Get file attributes of 'path' (does not follow symlinks) */ --Attrib *do_lstat(struct sftp_conn *, char *, int); -+Attrib *do_lstat(struct sftp_conn *, const char *, int); - - /* Set file attributes of 'path' */ --int do_setstat(struct sftp_conn *, char *, Attrib *); -+int do_setstat(struct sftp_conn *, const char *, Attrib *); - - /* Set file attributes of open file 'handle' */ --int do_fsetstat(struct sftp_conn *, char *, u_int, Attrib *); -+int do_fsetstat(struct sftp_conn *, const char *, u_int, Attrib *); - - /* Canonicalise 'path' - caller must free result */ --char *do_realpath(struct sftp_conn *, char *); -+char *do_realpath(struct sftp_conn *, const char *); - - /* Get statistics for filesystem hosting file at "path" */ - int do_statvfs(struct sftp_conn *, const char *, struct sftp_statvfs *, int); - - /* Rename 'oldpath' to 'newpath' */ --int do_rename(struct sftp_conn *, char *, char *); -+int do_rename(struct sftp_conn *, const char *, const char *); - - /* Link 'oldpath' to 'newpath' */ --int do_hardlink(struct sftp_conn *, char *, char *); -+int do_hardlink(struct sftp_conn *, const char *, const char *); - --/* Rename 'oldpath' to 'newpath' */ --int do_symlink(struct sftp_conn *, char *, char *); -+/* Symlink 'oldpath' to 'newpath' */ -+int do_symlink(struct sftp_conn *, const char *, const char *); - - /* XXX: add callbacks to do_download/do_upload so we can do progress meter */ - -@@ -106,27 +106,27 @@ int do_symlink(struct sftp_conn *, char - * Download 'remote_path' to 'local_path'. Preserve permissions and times - * if 'pflag' is set - */ --int do_download(struct sftp_conn *, char *, char *, Attrib *, int); -+int do_download(struct sftp_conn *, const char *, const char *, Attrib *, int); - - /* - * Recursively download 'remote_directory' to 'local_directory'. Preserve - * times if 'pflag' is set - */ --int download_dir(struct sftp_conn *, char *, char *, Attrib *, int, int); -+int download_dir(struct sftp_conn *, const char *, const char *, Attrib *, int, int); - - /* - * Upload 'local_path' to 'remote_path'. Preserve permissions and times - * if 'pflag' is set - */ --int do_upload(struct sftp_conn *, char *, char *, int); -+int do_upload(struct sftp_conn *, const char *, const char *, int); - - /* - * Recursively upload 'local_directory' to 'remote_directory'. Preserve - * times if 'pflag' is set - */ --int upload_dir(struct sftp_conn *, char *, char *, int, int); -+int upload_dir(struct sftp_conn *, const char *, const char *, int, int); - - /* Concatenate paths, taking care of slashes. Caller must free result. */ --char *path_append(char *, char *); -+char *path_append(const char *, const char *); - - #endif -diff -up openssh-5.9p1/sftp.c.coverity openssh-5.9p1/sftp.c ---- openssh-5.9p1/sftp.c.coverity 2010-12-04 23:02:48.000000000 +0100 -+++ openssh-5.9p1/sftp.c 2011-09-14 08:09:49.468493585 +0200 -@@ -206,7 +206,7 @@ killchild(int signo) - { - if (sshpid > 1) { - kill(sshpid, SIGTERM); -- waitpid(sshpid, NULL, 0); -+ (void) waitpid(sshpid, NULL, 0); - } - - _exit(1); -@@ -316,7 +316,7 @@ local_do_ls(const char *args) - - /* Strip one path (usually the pwd) from the start of another */ - static char * --path_strip(char *path, char *strip) -+path_strip(const char *path, const char *strip) - { - size_t len; - -@@ -334,7 +334,7 @@ path_strip(char *path, char *strip) - } - - static char * --make_absolute(char *p, char *pwd) -+make_absolute(char *p, const char *pwd) - { - char *abs_str; - -@@ -482,7 +482,7 @@ parse_df_flags(const char *cmd, char **a - } - - static int --is_dir(char *path) -+is_dir(const char *path) - { - struct stat sb; - -@@ -494,7 +494,7 @@ is_dir(char *path) - } - - static int --remote_is_dir(struct sftp_conn *conn, char *path) -+remote_is_dir(struct sftp_conn *conn, const char *path) - { - Attrib *a; - -@@ -508,7 +508,7 @@ remote_is_dir(struct sftp_conn *conn, ch - - /* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */ - static int --pathname_is_dir(char *pathname) -+pathname_is_dir(const char *pathname) - { - size_t l = strlen(pathname); - -@@ -516,7 +516,7 @@ pathname_is_dir(char *pathname) - } - - static int --process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd, -+process_get(struct sftp_conn *conn, const char *src, const char *dst, const char *pwd, - int pflag, int rflag) - { - char *abs_src = NULL; -@@ -590,7 +590,7 @@ out: - } - - static int --process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, -+process_put(struct sftp_conn *conn, const char *src, const char *dst, const char *pwd, - int pflag, int rflag) - { - char *tmp_dst = NULL; -@@ -695,7 +695,7 @@ sdirent_comp(const void *aa, const void - - /* sftp ls.1 replacement for directories */ - static int --do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag) -+do_ls_dir(struct sftp_conn *conn, const char *path, const char *strip_path, int lflag) - { - int n; - u_int c = 1, colspace = 0, columns = 1; -@@ -780,10 +780,10 @@ do_ls_dir(struct sftp_conn *conn, char * - - /* sftp ls.1 replacement which handles path globs */ - static int --do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path, -+do_globbed_ls(struct sftp_conn *conn, const char *path, const char *strip_path, - int lflag) - { -- Attrib *a = NULL; -+/*UNUSED Attrib *a = NULL;*/ - char *fname, *lname; - glob_t g; - int err; -@@ -828,7 +828,7 @@ do_globbed_ls(struct sftp_conn *conn, ch - colspace = width / columns; - } - -- for (i = 0; g.gl_pathv[i] && !interrupted; i++, a = NULL) { -+ for (i = 0; g.gl_pathv[i] && !interrupted; i++/*, a = NULL*/) { - fname = path_strip(g.gl_pathv[i], strip_path); - if (lflag & LS_LONG_VIEW) { - if (g.gl_statv[i] == NULL) { -@@ -861,7 +861,7 @@ do_globbed_ls(struct sftp_conn *conn, ch - } - - static int --do_df(struct sftp_conn *conn, char *path, int hflag, int iflag) -+do_df(struct sftp_conn *conn, const char *path, int hflag, int iflag) - { - struct sftp_statvfs st; - char s_used[FMT_SCALED_STRSIZE]; -diff -up openssh-5.9p1/ssh-agent.c.coverity openssh-5.9p1/ssh-agent.c ---- openssh-5.9p1/ssh-agent.c.coverity 2011-06-03 06:14:16.000000000 +0200 -+++ openssh-5.9p1/ssh-agent.c 2011-09-14 08:09:49.572460295 +0200 -@@ -1147,8 +1147,8 @@ main(int ac, char **av) - sanitise_stdfd(); - - /* drop */ -- setegid(getgid()); -- setgid(getgid()); -+ (void) setegid(getgid()); -+ (void) setgid(getgid()); - - #if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE) - /* Disable ptrace on Linux without sgid bit */ -diff -up openssh-5.9p1/sshd.c.coverity openssh-5.9p1/sshd.c ---- openssh-5.9p1/sshd.c.coverity 2011-06-23 11:45:51.000000000 +0200 -+++ openssh-5.9p1/sshd.c 2011-09-14 08:09:49.687509968 +0200 -@@ -676,8 +676,10 @@ privsep_preauth(Authctxt *authctxt) - if (getuid() == 0 || geteuid() == 0) - privsep_preauth_child(); - setproctitle("%s", "[net]"); -- if (box != NULL) -+ if (box != NULL) { - ssh_sandbox_child(box); -+ xfree(box); -+ } - - return 0; - } -@@ -1302,6 +1304,9 @@ server_accept_loop(int *sock_in, int *so - if (num_listen_socks < 0) - break; - } -+ -+ if (fdset != NULL) -+ xfree(fdset); - } - - -@@ -1774,7 +1779,7 @@ main(int ac, char **av) - - /* Chdir to the root directory so that the current disk can be - unmounted if desired. */ -- chdir("/"); -+ (void) chdir("/"); - - /* ignore SIGPIPE */ - signal(SIGPIPE, SIG_IGN); diff --git a/openssh/patches/openssh-5.9p1-entropy.patch b/openssh/patches/openssh-5.9p1-entropy.patch deleted file mode 100644 index b3dec46..0000000 --- a/openssh/patches/openssh-5.9p1-entropy.patch +++ /dev/null @@ -1,251 +0,0 @@ -diff -up openssh-5.9p0/entropy.c.entropy openssh-5.9p0/entropy.c ---- openssh-5.9p0/entropy.c.entropy 2011-08-31 13:20:59.660150441 +0200 -+++ openssh-5.9p0/entropy.c 2011-08-31 13:21:05.072024970 +0200 -@@ -232,6 +232,9 @@ seed_rng(void) - memset(buf, '\0', sizeof(buf)); - - #endif /* OPENSSL_PRNG_ONLY */ -+#ifdef __linux__ -+ linux_seed(); -+#endif /* __linux__ */ - if (RAND_status() != 1) - fatal("PRNG is not seeded"); - } -diff -up openssh-5.9p0/openbsd-compat/Makefile.in.entropy openssh-5.9p0/openbsd-compat/Makefile.in ---- openssh-5.9p0/openbsd-compat/Makefile.in.entropy 2011-08-31 13:20:54.000000000 +0200 -+++ openssh-5.9p0/openbsd-compat/Makefile.in 2011-08-31 13:44:25.138151565 +0200 -@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport - - COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o - --PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o -+PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o - - .c.o: - $(CC) $(CFLAGS) $(CPPFLAGS) -c $< -diff -up openssh-5.9p0/openbsd-compat/port-linux-prng.c.entropy openssh-5.9p0/openbsd-compat/port-linux-prng.c ---- openssh-5.9p0/openbsd-compat/port-linux-prng.c.entropy 2011-08-31 13:21:05.382024083 +0200 -+++ openssh-5.9p0/openbsd-compat/port-linux-prng.c 2011-08-31 13:21:05.386024776 +0200 -@@ -0,0 +1,59 @@ -+/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */ -+ -+/* -+ * Copyright (c) 2011 Jan F. Chadima <jchadima(a)redhat.com> -+ * -+ * Permission to use, copy, modify, and distribute this software for any -+ * purpose with or without fee is hereby granted, provided that the above -+ * copyright notice and this permission notice appear in all copies. -+ * -+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES -+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF -+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR -+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN -+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF -+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ */ -+ -+/* -+ * Linux-specific portability code - prng support -+ */ -+ -+#include "includes.h" -+ -+#include <errno.h> -+#include <stdarg.h> -+#include <string.h> -+#include <stdio.h> -+#include <openssl/rand.h> -+ -+#include "log.h" -+#include "xmalloc.h" -+#include "servconf.h" -+#include "port-linux.h" -+#include "key.h" -+#include "hostfile.h" -+#include "auth.h" -+ -+void -+linux_seed(void) -+{ -+ int len; -+ char *env = getenv("SSH_USE_STRONG_RNG"); -+ char *random = "/dev/random"; -+ size_t ienv, randlen = 6; -+ -+ if (!env || !strcmp(env, "0")) -+ random = "/dev/urandom"; -+ else if ((ienv = atoi(env)) > 6) -+ randlen = ienv; -+ -+ errno = 0; -+ if ((len = RAND_load_file(random, randlen)) != randlen) { -+ if (errno) -+ fatal ("cannot read from %s, %s", random, strerror(errno)); -+ else -+ fatal ("EOF reading %s", random); -+ } -+} -diff -up openssh-5.9p0/ssh-add.1.entropy openssh-5.9p0/ssh-add.1 ---- openssh-5.9p0/ssh-add.1.entropy 2010-11-05 00:20:14.000000000 +0100 -+++ openssh-5.9p0/ssh-add.1 2011-08-31 13:21:05.597122030 +0200 -@@ -158,6 +158,20 @@ Identifies the path of a - .Ux Ns -domain - socket used to communicate with the agent. - .El -+.It Ev SSH_USE_STRONG_RNG -+The reseeding of the OpenSSL random generator is usually done from -+.Cm /dev/urandom . -+If the -+.Cm SSH_USE_STRONG_RNG -+environment variable is set to value other than -+.Cm 0 -+the OpenSSL random generator is reseeded from -+.Cm /dev/random . -+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. -+Minimum is 6 bytes. -+This setting is not recommended on the computers without the hardware -+random generator because insufficient entropy causes the connection to -+be blocked until enough entropy is available. - .Sh FILES - .Bl -tag -width Ds - .It Pa ~/.ssh/identity -diff -up openssh-5.9p0/ssh-agent.1.entropy openssh-5.9p0/ssh-agent.1 ---- openssh-5.9p0/ssh-agent.1.entropy 2010-12-01 01:50:35.000000000 +0100 -+++ openssh-5.9p0/ssh-agent.1 2011-08-31 13:21:05.735150196 +0200 -@@ -198,6 +198,24 @@ sockets used to contain the connection t - These sockets should only be readable by the owner. - The sockets should get automatically removed when the agent exits. - .El -+.Sh ENVIRONMENT -+.Bl -tag -width Ds -compact -+.Pp -+.It Pa SSH_USE_STRONG_RNG -+The reseeding of the OpenSSL random generator is usually done from -+.Cm /dev/urandom . -+If the -+.Cm SSH_USE_STRONG_RNG -+environment variable is set to value other than -+.Cm 0 -+the OpenSSL random generator is reseeded from -+.Cm /dev/random . -+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. -+Minimum is 6 bytes. -+This setting is not recommended on the computers without the hardware -+random generator because insufficient entropy causes the connection to -+be blocked until enough entropy is available. -+.El - .Sh SEE ALSO - .Xr ssh 1 , - .Xr ssh-add 1 , -diff -up openssh-5.9p0/ssh-keygen.1.entropy openssh-5.9p0/ssh-keygen.1 ---- openssh-5.9p0/ssh-keygen.1.entropy 2011-08-31 13:20:59.200212619 +0200 -+++ openssh-5.9p0/ssh-keygen.1 2011-08-31 13:21:06.077150115 +0200 -@@ -669,6 +669,24 @@ Contains Diffie-Hellman groups used for - The file format is described in - .Xr moduli 5 . - .El -+.Sh ENVIRONMENT -+.Bl -tag -width Ds -compact -+.Pp -+.It Pa SSH_USE_STRONG_RNG -+The reseeding of the OpenSSL random generator is usually done from -+.Cm /dev/urandom . -+If the -+.Cm SSH_USE_STRONG_RNG -+environment variable is set to value other than -+.Cm 0 -+the OpenSSL random generator is reseeded from -+.Cm /dev/random . -+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. -+Minimum is 6 bytes. -+This setting is not recommended on the computers without the hardware -+random generator because insufficient entropy causes the connection to -+be blocked until enough entropy is available. -+.El - .Sh SEE ALSO - .Xr ssh 1 , - .Xr ssh-add 1 , -diff -up openssh-5.9p0/ssh-keysign.8.entropy openssh-5.9p0/ssh-keysign.8 ---- openssh-5.9p0/ssh-keysign.8.entropy 2010-08-31 14:41:14.000000000 +0200 -+++ openssh-5.9p0/ssh-keysign.8 2011-08-31 13:21:06.207024356 +0200 -@@ -78,6 +78,24 @@ must be set-uid root if host-based authe - If these files exist they are assumed to contain public certificate - information corresponding with the private keys above. - .El -+.Sh ENVIRONMENT -+.Bl -tag -width Ds -compact -+.Pp -+.It Pa SSH_USE_STRONG_RNG -+The reseeding of the OpenSSL random generator is usually done from -+.Cm /dev/urandom . -+If the -+.Cm SSH_USE_STRONG_RNG -+environment variable is set to value other than -+.Cm 0 -+the OpenSSL random generator is reseeded from -+.Cm /dev/random . -+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. -+Minimum is 6 bytes. -+This setting is not recommended on the computers without the hardware -+random generator because insufficient entropy causes the connection to -+be blocked until enough entropy is available. -+.El - .Sh SEE ALSO - .Xr ssh 1 , - .Xr ssh-keygen 1 , -diff -up openssh-5.9p0/ssh.1.entropy openssh-5.9p0/ssh.1 ---- openssh-5.9p0/ssh.1.entropy 2011-08-31 13:21:00.835103535 +0200 -+++ openssh-5.9p0/ssh.1 2011-08-31 13:21:05.482032754 +0200 -@@ -1255,6 +1255,23 @@ For more information, see the - .Cm PermitUserEnvironment - option in - .Xr sshd_config 5 . -+.Sh ENVIRONMENT -+.Bl -tag -width Ds -compact -+.It Ev SSH_USE_STRONG_RNG -+The reseeding of the OpenSSL random generator is usually done from -+.Cm /dev/urandom . -+If the -+.Cm SSH_USE_STRONG_RNG -+environment variable is set to value other than -+.Cm 0 -+the OpenSSL random generator is reseeded from -+.Cm /dev/random . -+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. -+Minimum is 6 bytes. -+This setting is not recommended on the computers without the hardware -+random generator because insufficient entropy causes the connection to -+be blocked until enough entropy is available. -+.El - .Sh FILES - .Bl -tag -width Ds -compact - .It Pa ~/.rhosts -diff -up openssh-5.9p0/sshd.8.entropy openssh-5.9p0/sshd.8 ---- openssh-5.9p0/sshd.8.entropy 2011-08-31 13:21:00.000000000 +0200 -+++ openssh-5.9p0/sshd.8 2011-08-31 13:46:27.341025537 +0200 -@@ -940,6 +940,24 @@ concurrently for different ports, this c - started last). - The content of this file is not sensitive; it can be world-readable. - .El -+.Sh ENVIRONMENT -+.Bl -tag -width Ds -compact -+.Pp -+.It Pa SSH_USE_STRONG_RNG -+The reseeding of the OpenSSL random generator is usually done from -+.Cm /dev/urandom . -+If the -+.Cm SSH_USE_STRONG_RNG -+environment variable is set to value other than -+.Cm 0 -+the OpenSSL random generator is reseeded from -+.Cm /dev/random . -+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. -+Minimum is 6 bytes. -+This setting is not recommended on the computers without the hardware -+random generator because insufficient entropy causes the connection to -+be blocked until enough entropy is available. -+.El - .Sh IPV6 - IPv6 address can be used everywhere where IPv4 address. In all entries must be the IPv6 address enclosed in square brackets. Note: The square brackets are metacharacters for the shell and must be escaped in shell. - .Sh SEE ALSO diff --git a/openssh/patches/openssh-5.9p1-kuserok.patch b/openssh/patches/openssh-5.9p1-kuserok.patch deleted file mode 100644 index 11f38a5..0000000 --- a/openssh/patches/openssh-5.9p1-kuserok.patch +++ /dev/null @@ -1,167 +0,0 @@ -diff -up openssh-5.9p0/auth-krb5.c.kuserok openssh-5.9p0/auth-krb5.c ---- openssh-5.9p0/auth-krb5.c.kuserok 2011-08-30 16:37:32.651150128 +0200 -+++ openssh-5.9p0/auth-krb5.c 2011-08-30 16:37:37.549087368 +0200 -@@ -54,6 +54,20 @@ - - extern ServerOptions options; - -+int -+ssh_krb5_kuserok(krb5_context krb5_ctx, krb5_principal krb5_user, const char *client) -+{ -+ if (options.use_kuserok) -+ return krb5_kuserok(krb5_ctx, krb5_user, client); -+ else { -+ char kuser[65]; -+ -+ if (krb5_aname_to_localname(krb5_ctx, krb5_user, sizeof(kuser), kuser)) -+ return 0; -+ return strcmp(kuser, client) == 0; -+ } -+} -+ - static int - krb5_init(void *context) - { -@@ -146,7 +160,7 @@ auth_krb5_password(Authctxt *authctxt, c - if (problem) - goto out; - -- if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) { -+ if (!ssh_krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) { - problem = -1; - goto out; - } -diff -up openssh-5.9p0/gss-serv-krb5.c.kuserok openssh-5.9p0/gss-serv-krb5.c ---- openssh-5.9p0/gss-serv-krb5.c.kuserok 2011-08-30 16:37:36.988024804 +0200 -+++ openssh-5.9p0/gss-serv-krb5.c 2011-08-30 16:37:37.659088030 +0200 -@@ -68,6 +68,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr - int); - - static krb5_context krb_context = NULL; -+extern int ssh_krb5_kuserok(krb5_context, krb5_principal, const char *); - - /* Initialise the krb5 library, for the stuff that GSSAPI won't do */ - -@@ -115,7 +116,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client - /* NOTE: .k5login and .k5users must opened as root, not the user, - * because if they are on a krb5-protected filesystem, user credentials - * to access these files aren't available yet. */ -- if (krb5_kuserok(krb_context, princ, luser) && k5login_exists) { -+ if (ssh_krb5_kuserok(krb_context, princ, luser) && k5login_exists) { - retval = 1; - logit("Authorized to %s, krb5 principal %s (krb5_kuserok)", - luser, (char *)client->displayname.value); -diff -up openssh-5.9p0/servconf.c.kuserok openssh-5.9p0/servconf.c ---- openssh-5.9p0/servconf.c.kuserok 2011-08-30 16:37:35.093073603 +0200 -+++ openssh-5.9p0/servconf.c 2011-08-30 16:41:13.568087145 +0200 -@@ -144,6 +144,7 @@ initialize_server_options(ServerOptions - options->authorized_principals_file = NULL; - options->ip_qos_interactive = -1; - options->ip_qos_bulk = -1; -+ options->use_kuserok = -1; - } - - void -@@ -291,6 +292,8 @@ fill_default_server_options(ServerOption - options->ip_qos_bulk = IPTOS_THROUGHPUT; - if (options->show_patchlevel == -1) - options->show_patchlevel = 0; -+ if (options->use_kuserok == -1) -+ options->use_kuserok = 1; - - /* Turn privilege separation on by default */ - if (use_privsep == -1) -@@ -317,7 +320,7 @@ typedef enum { - sPermitRootLogin, sLogFacility, sLogLevel, - sRhostsRSAAuthentication, sRSAAuthentication, - sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, -- sKerberosGetAFSToken, -+ sKerberosGetAFSToken, sKerberosUseKuserok, - sKerberosTgtPassing, sChallengeResponseAuthentication, - sPasswordAuthentication, sKbdInteractiveAuthentication, - sListenAddress, sAddressFamily, -@@ -388,11 +391,13 @@ static struct { - #else - { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, - #endif -+ { "kerberosusekuserok", sKerberosUseKuserok, SSHCFG_ALL }, - #else - { "kerberosauthentication", sUnsupported, SSHCFG_ALL }, - { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL }, - { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL }, - { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, -+ { "kerberosusekuserok", sUnsupported, SSHCFG_ALL }, - #endif - { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL }, - { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, -@@ -1371,6 +1376,10 @@ process_server_config_line(ServerOptions - *activep = value; - break; - -+ case sKerberosUseKuserok: -+ intptr = &options->use_kuserok; -+ goto parse_flag; -+ - case sPermitOpen: - arg = strdelim(&cp); - if (!arg || *arg == '\0') -@@ -1580,6 +1589,7 @@ copy_set_server_options(ServerOptions *d - M_CP_INTOPT(max_authtries); - M_CP_INTOPT(ip_qos_interactive); - M_CP_INTOPT(ip_qos_bulk); -+ M_CP_INTOPT(use_kuserok); - - /* See comment in servconf.h */ - COPY_MATCH_STRING_OPTS(); -@@ -1816,6 +1826,7 @@ dump_config(ServerOptions *o) - dump_cfg_fmtint(sUseDNS, o->use_dns); - dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding); - dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); -+ dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok); - - /* string arguments */ - dump_cfg_string(sPidFile, o->pid_file); -diff -up openssh-5.9p0/servconf.h.kuserok openssh-5.9p0/servconf.h ---- openssh-5.9p0/servconf.h.kuserok 2011-08-30 16:37:35.201051957 +0200 -+++ openssh-5.9p0/servconf.h 2011-08-30 16:37:37.926087431 +0200 -@@ -166,6 +166,7 @@ typedef struct { - - int num_permitted_opens; - -+ int use_kuserok; - char *chroot_directory; - char *revoked_keys_file; - char *trusted_user_ca_keys; -diff -up openssh-5.9p0/sshd_config.5.kuserok openssh-5.9p0/sshd_config.5 ---- openssh-5.9p0/sshd_config.5.kuserok 2011-08-30 16:37:35.979024607 +0200 -+++ openssh-5.9p0/sshd_config.5 2011-08-30 16:37:38.040087843 +0200 -@@ -603,6 +603,10 @@ Specifies whether to automatically destr - file on logout. - The default is - .Dq yes . -+.It Cm KerberosUseKuserok -+Specifies whether to look at .k5login file for user's aliases. -+The default is -+.Dq yes . - .It Cm KexAlgorithms - Specifies the available KEX (Key Exchange) algorithms. - Multiple algorithms must be comma-separated. -@@ -746,6 +750,7 @@ Available keywords are - .Cm HostbasedUsesNameFromPacketOnly , - .Cm KbdInteractiveAuthentication , - .Cm KerberosAuthentication , -+.Cm KerberosUseKuserok , - .Cm MaxAuthTries , - .Cm MaxSessions , - .Cm PubkeyAuthentication , -diff -up openssh-5.9p0/sshd_config.kuserok openssh-5.9p0/sshd_config ---- openssh-5.9p0/sshd_config.kuserok 2011-08-30 16:37:36.808026328 +0200 -+++ openssh-5.9p0/sshd_config 2011-08-30 16:37:38.148071520 +0200 -@@ -77,6 +77,7 @@ ChallengeResponseAuthentication no - #KerberosOrLocalPasswd yes - #KerberosTicketCleanup yes - #KerberosGetAFSToken no -+#KerberosUseKuserok yes - - # GSSAPI options - #GSSAPIAuthentication no diff --git a/openssh/patches/openssh-5.9p1-mls.patch b/openssh/patches/openssh-5.9p1-mls.patch deleted file mode 100644 index 1163949..0000000 --- a/openssh/patches/openssh-5.9p1-mls.patch +++ /dev/null @@ -1,400 +0,0 @@ -diff -up openssh-5.9p0/misc.c.mls openssh-5.9p0/misc.c ---- openssh-5.9p0/misc.c.mls 2011-05-05 06:14:34.000000000 +0200 -+++ openssh-5.9p0/misc.c 2011-08-30 12:29:29.157087474 +0200 -@@ -427,6 +427,7 @@ char * - colon(char *cp) - { - int flag = 0; -+ int start = 1; - - if (*cp == ':') /* Leading colon is part of file name. */ - return NULL; -@@ -442,6 +443,13 @@ colon(char *cp) - return (cp); - if (*cp == '/') - return NULL; -+ if (start) { -+ /* Slash on beginning or after dots only denotes file name. */ -+ if (*cp == '/') -+ return (0); -+ if (*cp != '.') -+ start = 0; -+ } - } - return NULL; - } -diff -up openssh-5.9p0/openbsd-compat/port-linux.c.mls openssh-5.9p0/openbsd-compat/port-linux.c ---- openssh-5.9p0/openbsd-compat/port-linux.c.mls 2011-08-30 12:29:28.873086987 +0200 -+++ openssh-5.9p0/openbsd-compat/port-linux.c 2011-08-30 13:28:12.584149668 +0200 -@@ -40,7 +40,15 @@ - #ifdef WITH_SELINUX - #include <selinux/selinux.h> - #include <selinux/flask.h> -+#include <selinux/context.h> - #include <selinux/get_context_list.h> -+#include <selinux/get_default_type.h> -+#include <selinux/av_permissions.h> -+ -+#ifdef HAVE_LINUX_AUDIT -+#include <libaudit.h> -+#include <unistd.h> -+#endif - - #ifndef SSH_SELINUX_UNCONFINED_TYPE - # define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:" -@@ -51,6 +59,149 @@ extern Authctxt *the_authctxt; - extern int inetd_flag; - extern int rexeced_flag; - -+/* Send audit message */ -+static int -+send_audit_message(int success, security_context_t default_context, -+ security_context_t selected_context) -+{ -+ int rc=0; -+#ifdef HAVE_LINUX_AUDIT -+ char *msg = NULL; -+ int audit_fd = audit_open(); -+ security_context_t default_raw=NULL; -+ security_context_t selected_raw=NULL; -+ rc = -1; -+ if (audit_fd < 0) { -+ if (errno == EINVAL || errno == EPROTONOSUPPORT || -+ errno == EAFNOSUPPORT) -+ return 0; /* No audit support in kernel */ -+ error("Error connecting to audit system."); -+ return rc; -+ } -+ if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) { -+ error("Error translating default context."); -+ default_raw = NULL; -+ } -+ if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) { -+ error("Error translating selected context."); -+ selected_raw = NULL; -+ } -+ if (asprintf(&msg, "sshd: default-context=%s selected-context=%s", -+ default_raw ? default_raw : (default_context ? default_context: "?"), -+ selected_context ? selected_raw : (selected_context ? selected_context :"?")) < 0) { -+ error("Error allocating memory."); -+ goto out; -+ } -+ if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, -+ msg, NULL, NULL, NULL, success) <= 0) { -+ error("Error sending audit message."); -+ goto out; -+ } -+ rc = 0; -+ out: -+ free(msg); -+ freecon(default_raw); -+ freecon(selected_raw); -+ close(audit_fd); -+#endif -+ return rc; -+} -+ -+static int -+mls_range_allowed(security_context_t src, security_context_t dst) -+{ -+ struct av_decision avd; -+ int retval; -+ unsigned int bit = CONTEXT__CONTAINS; -+ -+ debug("%s: src:%s dst:%s", __func__, src, dst); -+ retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd); -+ if (retval || ((bit & avd.allowed) != bit)) -+ return 0; -+ -+ return 1; -+} -+ -+static int -+get_user_context(const char *sename, const char *role, const char *lvl, -+ security_context_t *sc) { -+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL -+ if (lvl == NULL || lvl[0] == '\0' || get_default_context_with_level(sename, lvl, NULL, sc) != 0) { -+ /* User may have requested a level completely outside of his -+ allowed range. We get a context just for auditing as the -+ range check below will certainly fail for default context. */ -+#endif -+ if (get_default_context(sename, NULL, sc) != 0) { -+ *sc = NULL; -+ return -1; -+ } -+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL -+ } -+#endif -+ if (role != NULL && role[0]) { -+ context_t con; -+ char *type=NULL; -+ if (get_default_type(role, &type) != 0) { -+ error("get_default_type: failed to get default type for '%s'", -+ role); -+ goto out; -+ } -+ con = context_new(*sc); -+ if (!con) { -+ goto out; -+ } -+ context_role_set(con, role); -+ context_type_set(con, type); -+ freecon(*sc); -+ *sc = strdup(context_str(con)); -+ context_free(con); -+ if (!*sc) -+ return -1; -+ } -+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL -+ if (lvl != NULL && lvl[0]) { -+ /* verify that the requested range is obtained */ -+ context_t con; -+ security_context_t obtained_raw; -+ security_context_t requested_raw; -+ con = context_new(*sc); -+ if (!con) { -+ goto out; -+ } -+ context_range_set(con, lvl); -+ if (selinux_trans_to_raw_context(*sc, &obtained_raw) < 0) { -+ context_free(con); -+ goto out; -+ } -+ if (selinux_trans_to_raw_context(context_str(con), &requested_raw) < 0) { -+ freecon(obtained_raw); -+ context_free(con); -+ goto out; -+ } -+ -+ debug("get_user_context: obtained context '%s' requested context '%s'", -+ obtained_raw, requested_raw); -+ if (strcmp(obtained_raw, requested_raw)) { -+ /* set the context to the real requested one but fail */ -+ freecon(requested_raw); -+ freecon(obtained_raw); -+ freecon(*sc); -+ *sc = strdup(context_str(con)); -+ context_free(con); -+ return -1; -+ } -+ freecon(requested_raw); -+ freecon(obtained_raw); -+ context_free(con); -+ } -+#endif -+ return 0; -+ out: -+ freecon(*sc); -+ *sc = NULL; -+ return -1; -+} -+ - static void - ssh_selinux_get_role_level(char **role, const char **level) - { -@@ -69,14 +220,15 @@ ssh_selinux_get_role_level(char **role, - } - - /* Return the default security context for the given username */ --static security_context_t --ssh_selinux_getctxbyname(char *pwname) -+static int -+ssh_selinux_getctxbyname(char *pwname, -+ security_context_t *default_sc, security_context_t *user_sc) - { -- security_context_t sc = NULL; - char *sename, *lvl; - char *role; - const char *reqlvl; - int r = 0; -+ context_t con = NULL; - - ssh_selinux_get_role_level(&role, &reqlvl); - -@@ -87,37 +239,62 @@ ssh_selinux_getctxbyname(char *pwname) - } - #else - sename = pwname; -- lvl = NULL; -+ lvl = ""; - #endif - - if (r == 0) { - #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL -- if (role != NULL && role[0]) -- r = get_default_context_with_rolelevel(sename, role, lvl, NULL, &sc); -- else -- r = get_default_context_with_level(sename, lvl, NULL, &sc); -+ r = get_default_context_with_level(sename, lvl, NULL, default_sc); - #else -- if (role != NULL && role[0]) -- r = get_default_context_with_role(sename, role, NULL, &sc); -- else -- r = get_default_context(sename, NULL, &sc); -+ r = get_default_context(sename, NULL, default_sc); - #endif - } - -- if (r != 0) { -- switch (security_getenforce()) { -- case -1: -- fatal("%s: ssh_selinux_getctxbyname: " -- "security_getenforce() failed", __func__); -- case 0: -- error("%s: Failed to get default SELinux security " -- "context for %s", __func__, pwname); -- break; -- default: -- fatal("%s: Failed to get default SELinux security " -- "context for %s (in enforcing mode)", -- __func__, pwname); -+ if (r == 0) { -+ /* If launched from xinetd, we must use current level */ -+ if (inetd_flag && !rexeced_flag) { -+ security_context_t sshdsc=NULL; -+ -+ if (getcon_raw(&sshdsc) < 0) -+ fatal("failed to allocate security context"); -+ -+ if ((con=context_new(sshdsc)) == NULL) -+ fatal("failed to allocate selinux context"); -+ reqlvl = context_range_get(con); -+ freecon(sshdsc); -+ if (reqlvl !=NULL && lvl != NULL && strcmp(reqlvl, lvl) == 0) -+ /* we actually don't change level */ -+ reqlvl = ""; -+ -+ debug("%s: current connection level '%s'", __func__, reqlvl); - } -+ -+ if ((reqlvl != NULL && reqlvl[0]) || (role != NULL && role[0])) { -+ r = get_user_context(sename, role, reqlvl, user_sc); -+ -+ if (r == 0 && reqlvl != NULL && reqlvl[0]) { -+ security_context_t default_level_sc = *default_sc; -+ if (role != NULL && role[0]) { -+ if (get_user_context(sename, role, lvl, &default_level_sc) < 0) -+ default_level_sc = *default_sc; -+ } -+ /* verify that the requested range is contained in the user range */ -+ if (mls_range_allowed(default_level_sc, *user_sc)) { -+ logit("permit MLS level %s (user range %s)", reqlvl, lvl); -+ } else { -+ r = -1; -+ error("deny MLS level %s (user range %s)", reqlvl, lvl); -+ } -+ if (default_level_sc != *default_sc) -+ freecon(default_level_sc); -+ } -+ } else { -+ *user_sc = *default_sc; -+ } -+ } -+ if (r != 0) { -+ error("%s: Failed to get default SELinux security " -+ "context for %s", __func__, pwname); - } - - #ifdef HAVE_GETSEUSERBYNAME -@@ -126,8 +303,12 @@ ssh_selinux_getctxbyname(char *pwname) - if (lvl != NULL) - xfree(lvl); - #endif -- -- return (sc); -+ if (role != NULL) -+ xfree(role); -+ if (con) -+ context_free(con); -+ -+ return (r); - } - - /* Setup environment variables for pam_selinux */ -@@ -165,6 +346,8 @@ void - ssh_selinux_setup_exec_context(char *pwname) - { - security_context_t user_ctx = NULL; -+ int r = 0; -+ security_context_t default_ctx = NULL; - - if (!ssh_selinux_enabled()) - return; -@@ -189,22 +372,45 @@ ssh_selinux_setup_exec_context(char *pwn - - debug3("%s: setting execution context", __func__); - -- user_ctx = ssh_selinux_getctxbyname(pwname); -- if (setexeccon(user_ctx) != 0) { -+ r = ssh_selinux_getctxbyname(pwname, &default_ctx, &user_ctx); -+ if (r >= 0) { -+ r = setexeccon(user_ctx); -+ if (r < 0) { -+ error("%s: Failed to set SELinux execution context %s for %s", -+ __func__, user_ctx, pwname); -+ } -+#ifdef HAVE_SETKEYCREATECON -+ else if (setkeycreatecon(user_ctx) < 0) { -+ error("%s: Failed to set SELinux keyring creation context %s for %s", -+ __func__, user_ctx, pwname); -+ } -+#endif -+ } -+ if (user_ctx == NULL) { -+ user_ctx = default_ctx; -+ } -+ if (r < 0 || user_ctx != default_ctx) { -+ /* audit just the case when user changed a role or there was -+ a failure */ -+ send_audit_message(r >= 0, default_ctx, user_ctx); -+ } -+ if (r < 0) { - switch (security_getenforce()) { - case -1: - fatal("%s: security_getenforce() failed", __func__); - case 0: -- error("%s: Failed to set SELinux execution " -- "context for %s", __func__, pwname); -+ error("%s: SELinux failure. Continuing in permissive mode.", -+ __func__); - break; - default: -- fatal("%s: Failed to set SELinux execution context " -- "for %s (in enforcing mode)", __func__, pwname); -+ fatal("%s: SELinux failure. Aborting connection.", -+ __func__); - } - } -- if (user_ctx != NULL) -+ if (user_ctx != NULL && user_ctx != default_ctx) - freecon(user_ctx); -+ if (default_ctx != NULL) -+ freecon(default_ctx); - - debug3("%s: done", __func__); - } -@@ -222,7 +428,10 @@ ssh_selinux_setup_pty(char *pwname, cons - - debug3("%s: setting TTY context on %s", __func__, tty); - -- user_ctx = ssh_selinux_getctxbyname(pwname); -+ if (getexeccon(&user_ctx) < 0) { -+ error("%s: getexeccon: %s", __func__, strerror(errno)); -+ goto out; -+ } - - /* XXX: should these calls fatal() upon failure in enforcing mode? */ - -diff -up openssh-5.9p0/sshd.c.mls openssh-5.9p0/sshd.c ---- openssh-5.9p0/sshd.c.mls 2011-08-30 12:29:22.663149706 +0200 -+++ openssh-5.9p0/sshd.c 2011-08-30 12:29:29.524024777 +0200 -@@ -2082,6 +2082,9 @@ main(int ac, char **av) - restore_uid(); - } - #endif -+#ifdef WITH_SELINUX -+ ssh_selinux_setup_exec_context(authctxt->pw->pw_name); -+#endif - #ifdef USE_PAM - if (options.use_pam) { - do_pam_setcred(1); diff --git a/openssh/patches/openssh-5.9p1-role.patch b/openssh/patches/openssh-5.9p1-role.patch deleted file mode 100644 index 8a26bdf..0000000 --- a/openssh/patches/openssh-5.9p1-role.patch +++ /dev/null @@ -1,613 +0,0 @@ -diff -up openssh-5.9p0/auth-pam.c.role openssh-5.9p0/auth-pam.c ---- openssh-5.9p0/auth-pam.c.role 2009-07-12 14:07:21.000000000 +0200 -+++ openssh-5.9p0/auth-pam.c 2011-08-31 11:42:54.870087433 +0200 -@@ -1069,7 +1069,7 @@ is_pam_session_open(void) - * during the ssh authentication process. - */ - int --do_pam_putenv(char *name, char *value) -+do_pam_putenv(char *name, const char *value) - { - int ret = 1; - #ifdef HAVE_PAM_PUTENV -diff -up openssh-5.9p0/auth-pam.h.role openssh-5.9p0/auth-pam.h ---- openssh-5.9p0/auth-pam.h.role 2004-09-11 14:17:26.000000000 +0200 -+++ openssh-5.9p0/auth-pam.h 2011-08-31 11:42:54.979086333 +0200 -@@ -38,7 +38,7 @@ void do_pam_session(void); - void do_pam_set_tty(const char *); - void do_pam_setcred(int ); - void do_pam_chauthtok(void); --int do_pam_putenv(char *, char *); -+int do_pam_putenv(char *, const char *); - char ** fetch_pam_environment(void); - char ** fetch_pam_child_environment(void); - void free_pam_environment(char **); -diff -up openssh-5.9p0/auth.h.role openssh-5.9p0/auth.h ---- openssh-5.9p0/auth.h.role 2011-08-31 11:42:47.760024631 +0200 -+++ openssh-5.9p0/auth.h 2011-08-31 11:42:55.090151027 +0200 -@@ -59,6 +59,9 @@ struct Authctxt { - char *service; - struct passwd *pw; /* set if 'valid' */ - char *style; -+#ifdef WITH_SELINUX -+ char *role; -+#endif - void *kbdintctxt; - void *jpake_ctx; - #ifdef BSD_AUTH -diff -up openssh-5.9p0/auth1.c.role openssh-5.9p0/auth1.c ---- openssh-5.9p0/auth1.c.role 2010-08-31 14:36:39.000000000 +0200 -+++ openssh-5.9p0/auth1.c 2011-08-31 11:42:55.215033075 +0200 -@@ -384,6 +384,9 @@ do_authentication(Authctxt *authctxt) - { - u_int ulen; - char *user, *style = NULL; -+#ifdef WITH_SELINUX -+ char *role=NULL; -+#endif - - /* Get the name of the user that we wish to log in as. */ - packet_read_expect(SSH_CMSG_USER); -@@ -392,11 +395,24 @@ do_authentication(Authctxt *authctxt) - user = packet_get_cstring(&ulen); - packet_check_eom(); - -+#ifdef WITH_SELINUX -+ if ((role = strchr(user, '/')) != NULL) -+ *role++ = '\0'; -+#endif -+ - if ((style = strchr(user, ':')) != NULL) - *style++ = '\0'; -+#ifdef WITH_SELINUX -+ else -+ if (role && (style = strchr(role, ':')) != NULL) -+ *style++ = '\0'; -+#endif - - authctxt->user = user; - authctxt->style = style; -+#ifdef WITH_SELINUX -+ authctxt->role = role; -+#endif - - /* Verify that the user is a valid user. */ - if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) -diff -up openssh-5.9p0/auth2-gss.c.role openssh-5.9p0/auth2-gss.c ---- openssh-5.9p0/auth2-gss.c.role 2011-05-05 06:04:11.000000000 +0200 -+++ openssh-5.9p0/auth2-gss.c 2011-08-31 11:42:55.313025576 +0200 -@@ -260,6 +260,7 @@ input_gssapi_mic(int type, u_int32_t ple - Authctxt *authctxt = ctxt; - Gssctxt *gssctxt; - int authenticated = 0; -+ char *micuser; - Buffer b; - gss_buffer_desc mic, gssbuf; - u_int len; -@@ -272,7 +273,13 @@ input_gssapi_mic(int type, u_int32_t ple - mic.value = packet_get_string(&len); - mic.length = len; - -- ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service, -+#ifdef WITH_SELINUX -+ if (authctxt->role && (strlen(authctxt->role) > 0)) -+ xasprintf(&micuser, "%s/%s", authctxt->user, authctxt->role); -+ else -+#endif -+ micuser = authctxt->user; -+ ssh_gssapi_buildmic(&b, micuser, authctxt->service, - "gssapi-with-mic"); - - gssbuf.value = buffer_ptr(&b); -@@ -284,6 +291,8 @@ input_gssapi_mic(int type, u_int32_t ple - logit("GSSAPI MIC check failed"); - - buffer_free(&b); -+ if (micuser != authctxt->user) -+ xfree(micuser); - xfree(mic.value); - - authctxt->postponed = 0; -diff -up openssh-5.9p0/auth2-hostbased.c.role openssh-5.9p0/auth2-hostbased.c ---- openssh-5.9p0/auth2-hostbased.c.role 2011-08-31 11:42:47.863023264 +0200 -+++ openssh-5.9p0/auth2-hostbased.c 2011-08-31 11:42:55.421024814 +0200 -@@ -106,7 +106,15 @@ userauth_hostbased(Authctxt *authctxt) - buffer_put_string(&b, session_id2, session_id2_len); - /* reconstruct packet */ - buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); -- buffer_put_cstring(&b, authctxt->user); -+#ifdef WITH_SELINUX -+ if (authctxt->role) { -+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1); -+ buffer_append(&b, authctxt->user, strlen(authctxt->user)); -+ buffer_put_char(&b, '/'); -+ buffer_append(&b, authctxt->role, strlen(authctxt->role)); -+ } else -+#endif -+ buffer_put_cstring(&b, authctxt->user); - buffer_put_cstring(&b, service); - buffer_put_cstring(&b, "hostbased"); - buffer_put_string(&b, pkalg, alen); -diff -up openssh-5.9p0/auth2-pubkey.c.role openssh-5.9p0/auth2-pubkey.c ---- openssh-5.9p0/auth2-pubkey.c.role 2011-08-31 11:42:47.978087418 +0200 -+++ openssh-5.9p0/auth2-pubkey.c 2011-08-31 11:42:55.551025263 +0200 -@@ -121,7 +121,15 @@ userauth_pubkey(Authctxt *authctxt) - } - /* reconstruct packet */ - buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); -- buffer_put_cstring(&b, authctxt->user); -+#ifdef WITH_SELINUX -+ if (authctxt->role) { -+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1); -+ buffer_append(&b, authctxt->user, strlen(authctxt->user)); -+ buffer_put_char(&b, '/'); -+ buffer_append(&b, authctxt->role, strlen(authctxt->role)); -+ } else -+#endif -+ buffer_put_cstring(&b, authctxt->user); - buffer_put_cstring(&b, - datafellows & SSH_BUG_PKSERVICE ? - "ssh-userauth" : -diff -up openssh-5.9p0/auth2.c.role openssh-5.9p0/auth2.c ---- openssh-5.9p0/auth2.c.role 2011-08-31 11:42:45.409026065 +0200 -+++ openssh-5.9p0/auth2.c 2011-08-31 11:42:55.676024869 +0200 -@@ -216,6 +216,9 @@ input_userauth_request(int type, u_int32 - Authctxt *authctxt = ctxt; - Authmethod *m = NULL; - char *user, *service, *method, *style = NULL; -+#ifdef WITH_SELINUX -+ char *role = NULL; -+#endif - int authenticated = 0; - - if (authctxt == NULL) -@@ -227,6 +230,11 @@ input_userauth_request(int type, u_int32 - debug("userauth-request for user %s service %s method %s", user, service, method); - debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); - -+#ifdef WITH_SELINUX -+ if ((role = strchr(user, '/')) != NULL) -+ *role++ = 0; -+#endif -+ - if ((style = strchr(user, ':')) != NULL) - *style++ = 0; - -@@ -249,8 +257,15 @@ input_userauth_request(int type, u_int32 - use_privsep ? " [net]" : ""); - authctxt->service = xstrdup(service); - authctxt->style = style ? xstrdup(style) : NULL; -- if (use_privsep) -+#ifdef WITH_SELINUX -+ authctxt->role = role ? xstrdup(role) : NULL; -+#endif -+ if (use_privsep) { - mm_inform_authserv(service, style); -+#ifdef WITH_SELINUX -+ mm_inform_authrole(role); -+#endif -+ } - userauth_banner(); - } else if (strcmp(user, authctxt->user) != 0 || - strcmp(service, authctxt->service) != 0) { -diff -up openssh-5.9p0/monitor.c.role openssh-5.9p0/monitor.c ---- openssh-5.9p0/monitor.c.role 2011-08-31 11:42:53.301024819 +0200 -+++ openssh-5.9p0/monitor.c 2011-08-31 11:42:55.796025812 +0200 -@@ -148,6 +148,9 @@ int mm_answer_sign(int, Buffer *); - int mm_answer_pwnamallow(int, Buffer *); - int mm_answer_auth2_read_banner(int, Buffer *); - int mm_answer_authserv(int, Buffer *); -+#ifdef WITH_SELINUX -+int mm_answer_authrole(int, Buffer *); -+#endif - int mm_answer_authpassword(int, Buffer *); - int mm_answer_bsdauthquery(int, Buffer *); - int mm_answer_bsdauthrespond(int, Buffer *); -@@ -231,6 +234,9 @@ struct mon_table mon_dispatch_proto20[] - {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, - {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, - {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, -+#ifdef WITH_SELINUX -+ {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, -+#endif - {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, - {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, - #ifdef USE_PAM -@@ -819,6 +825,9 @@ mm_answer_pwnamallow(int sock, Buffer *m - else { - /* Allow service/style information on the auth context */ - monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); -+#ifdef WITH_SELINUX -+ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); -+#endif - monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); - } - #ifdef USE_PAM -@@ -862,6 +871,25 @@ mm_answer_authserv(int sock, Buffer *m) - return (0); - } - -+#ifdef WITH_SELINUX -+int -+mm_answer_authrole(int sock, Buffer *m) -+{ -+ monitor_permit_authentications(1); -+ -+ authctxt->role = buffer_get_string(m, NULL); -+ debug3("%s: role=%s", -+ __func__, authctxt->role); -+ -+ if (strlen(authctxt->role) == 0) { -+ xfree(authctxt->role); -+ authctxt->role = NULL; -+ } -+ -+ return (0); -+} -+#endif -+ - int - mm_answer_authpassword(int sock, Buffer *m) - { -@@ -1227,7 +1255,7 @@ static int - monitor_valid_userblob(u_char *data, u_int datalen) - { - Buffer b; -- char *p; -+ char *p, *r; - u_int len; - int fail = 0; - -@@ -1253,6 +1281,8 @@ monitor_valid_userblob(u_char *data, u_i - if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) - fail++; - p = buffer_get_string(&b, NULL); -+ if ((r = strchr(p, '/')) != NULL) -+ *r = '\0'; - if (strcmp(authctxt->user, p) != 0) { - logit("wrong user name passed to monitor: expected %s != %.100s", - authctxt->user, p); -@@ -1284,7 +1314,7 @@ monitor_valid_hostbasedblob(u_char *data - char *chost) - { - Buffer b; -- char *p; -+ char *p, *r; - u_int len; - int fail = 0; - -@@ -1301,6 +1331,8 @@ monitor_valid_hostbasedblob(u_char *data - if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) - fail++; - p = buffer_get_string(&b, NULL); -+ if ((r = strchr(p, '/')) != NULL) -+ *r = '\0'; - if (strcmp(authctxt->user, p) != 0) { - logit("wrong user name passed to monitor: expected %s != %.100s", - authctxt->user, p); -diff -up openssh-5.9p0/monitor.h.role openssh-5.9p0/monitor.h ---- openssh-5.9p0/monitor.h.role 2011-08-31 11:42:53.409025333 +0200 -+++ openssh-5.9p0/monitor.h 2011-08-31 11:42:55.889024801 +0200 -@@ -31,6 +31,9 @@ - enum monitor_reqtype { - MONITOR_REQ_MODULI, MONITOR_ANS_MODULI, - MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, -+#ifdef WITH_SELINUX -+ MONITOR_REQ_AUTHROLE, -+#endif - MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, - MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, - MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, -diff -up openssh-5.9p0/monitor_wrap.c.role openssh-5.9p0/monitor_wrap.c ---- openssh-5.9p0/monitor_wrap.c.role 2011-08-31 11:42:53.548024503 +0200 -+++ openssh-5.9p0/monitor_wrap.c 2011-08-31 11:42:56.029024553 +0200 -@@ -336,6 +336,25 @@ mm_inform_authserv(char *service, char * - buffer_free(&m); - } - -+/* Inform the privileged process about role */ -+ -+#ifdef WITH_SELINUX -+void -+mm_inform_authrole(char *role) -+{ -+ Buffer m; -+ -+ debug3("%s entering", __func__); -+ -+ buffer_init(&m); -+ buffer_put_cstring(&m, role ? role : ""); -+ -+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m); -+ -+ buffer_free(&m); -+} -+#endif -+ - /* Do the password authentication */ - int - mm_auth_password(Authctxt *authctxt, char *password) -diff -up openssh-5.9p0/monitor_wrap.h.role openssh-5.9p0/monitor_wrap.h ---- openssh-5.9p0/monitor_wrap.h.role 2011-08-31 11:42:53.660025271 +0200 -+++ openssh-5.9p0/monitor_wrap.h 2011-08-31 11:42:56.131025748 +0200 -@@ -42,6 +42,9 @@ int mm_is_monitor(void); - DH *mm_choose_dh(int, int, int); - int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); - void mm_inform_authserv(char *, char *); -+#ifdef WITH_SELINUX -+void mm_inform_authrole(char *); -+#endif - struct passwd *mm_getpwnamallow(const char *); - char *mm_auth2_read_banner(void); - int mm_auth_password(struct Authctxt *, char *); -diff -up openssh-5.9p0/openbsd-compat/Makefile.in.role openssh-5.9p0/openbsd-compat/Makefile.in ---- openssh-5.9p0/openbsd-compat/Makefile.in.role 2010-10-07 13:19:24.000000000 +0200 -+++ openssh-5.9p0/openbsd-compat/Makefile.in 2011-08-31 11:48:02.404091479 +0200 -@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport - - COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o - --PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o -+PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o - - .c.o: - $(CC) $(CFLAGS) $(CPPFLAGS) -c $< -diff -up openssh-5.9p0/openbsd-compat/port-linux.c.role openssh-5.9p0/openbsd-compat/port-linux.c ---- openssh-5.9p0/openbsd-compat/port-linux.c.role 2011-08-29 08:09:57.000000000 +0200 -+++ openssh-5.9p0/openbsd-compat/port-linux.c 2011-08-31 11:42:56.492087969 +0200 -@@ -31,7 +31,11 @@ - - #include "log.h" - #include "xmalloc.h" -+#include "servconf.h" - #include "port-linux.h" -+#include "key.h" -+#include "hostfile.h" -+#include "auth.h" - - #ifdef WITH_SELINUX - #include <selinux/selinux.h> -@@ -42,41 +46,63 @@ - # define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:" - #endif - --/* Wrapper around is_selinux_enabled() to log its return value once only */ --int --ssh_selinux_enabled(void) --{ -- static int enabled = -1; -+extern ServerOptions options; -+extern Authctxt *the_authctxt; -+extern int inetd_flag; -+extern int rexeced_flag; - -- if (enabled == -1) { -- enabled = (is_selinux_enabled() == 1); -- debug("SELinux support %s", enabled ? "enabled" : "disabled"); -+static void -+ssh_selinux_get_role_level(char **role, const char **level) -+{ -+ *role = NULL; -+ *level = NULL; -+ if (the_authctxt) { -+ if (the_authctxt->role != NULL) { -+ char *slash; -+ *role = xstrdup(the_authctxt->role); -+ if ((slash = strchr(*role, '/')) != NULL) { -+ *slash = '\0'; -+ *level = slash + 1; -+ } -+ } - } -- -- return (enabled); - } - - /* Return the default security context for the given username */ - static security_context_t - ssh_selinux_getctxbyname(char *pwname) - { -- security_context_t sc; -- char *sename = NULL, *lvl = NULL; -- int r; -+ security_context_t sc = NULL; -+ char *sename, *lvl; -+ char *role; -+ const char *reqlvl; -+ int r = 0; -+ -+ ssh_selinux_get_role_level(&role, &reqlvl); - - #ifdef HAVE_GETSEUSERBYNAME -- if (getseuserbyname(pwname, &sename, &lvl) != 0) -- return NULL; -+ if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) { -+ sename = NULL; -+ lvl = NULL; -+ } - #else - sename = pwname; - lvl = NULL; - #endif - -+ if (r == 0) { - #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL -- r = get_default_context_with_level(sename, lvl, NULL, &sc); -+ if (role != NULL && role[0]) -+ r = get_default_context_with_rolelevel(sename, role, lvl, NULL, &sc); -+ else -+ r = get_default_context_with_level(sename, lvl, NULL, &sc); - #else -- r = get_default_context(sename, NULL, &sc); -+ if (role != NULL && role[0]) -+ r = get_default_context_with_role(sename, role, NULL, &sc); -+ else -+ r = get_default_context(sename, NULL, &sc); - #endif -+ } - - if (r != 0) { - switch (security_getenforce()) { -@@ -104,6 +130,36 @@ ssh_selinux_getctxbyname(char *pwname) - return (sc); - } - -+/* Setup environment variables for pam_selinux */ -+static int -+ssh_selinux_setup_pam_variables(void) -+{ -+ const char *reqlvl; -+ char *role; -+ char *use_current; -+ int rv; -+ -+ debug3("%s: setting execution context", __func__); -+ -+ ssh_selinux_get_role_level(&role, &reqlvl); -+ -+ rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : ""); -+ -+ if (inetd_flag && !rexeced_flag) { -+ use_current = "1"; -+ } else { -+ use_current = ""; -+ rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: ""); -+ } -+ -+ rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current); -+ -+ if (role != NULL) -+ xfree(role); -+ -+ return rv; -+} -+ - /* Set the execution context to the default for the specified user */ - void - ssh_selinux_setup_exec_context(char *pwname) -@@ -113,6 +169,24 @@ ssh_selinux_setup_exec_context(char *pwn - if (!ssh_selinux_enabled()) - return; - -+ if (options.use_pam) { -+ /* do not compute context, just setup environment for pam_selinux */ -+ if (ssh_selinux_setup_pam_variables()) { -+ switch (security_getenforce()) { -+ case -1: -+ fatal("%s: security_getenforce() failed", __func__); -+ case 0: -+ error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.", -+ __func__); -+ break; -+ default: -+ fatal("%s: SELinux PAM variable setup failure. Aborting connection.", -+ __func__); -+ } -+ } -+ return; -+ } -+ - debug3("%s: setting execution context", __func__); - - user_ctx = ssh_selinux_getctxbyname(pwname); -@@ -220,21 +294,6 @@ ssh_selinux_change_context(const char *n - xfree(newctx); - } - --void --ssh_selinux_setfscreatecon(const char *path) --{ -- security_context_t context; -- -- if (!ssh_selinux_enabled()) -- return; -- if (path == NULL) { -- setfscreatecon(NULL); -- return; -- } -- if (matchpathcon(path, 0700, &context) == 0) -- setfscreatecon(context); --} -- - #endif /* WITH_SELINUX */ - - #ifdef LINUX_OOM_ADJUST -diff -up openssh-5.9p0/openbsd-compat/port-linux_part_2.c.role openssh-5.9p0/openbsd-compat/port-linux_part_2.c ---- openssh-5.9p0/openbsd-compat/port-linux_part_2.c.role 2011-08-31 11:42:56.583047619 +0200 -+++ openssh-5.9p0/openbsd-compat/port-linux_part_2.c 2011-08-31 11:42:56.586178005 +0200 -@@ -0,0 +1,75 @@ -+/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */ -+ -+/* -+ * Copyright (c) 2005 Daniel Walsh <dwalsh(a)redhat.com> -+ * Copyright (c) 2006 Damien Miller <djm(a)openbsd.org> -+ * -+ * Permission to use, copy, modify, and distribute this software for any -+ * purpose with or without fee is hereby granted, provided that the above -+ * copyright notice and this permission notice appear in all copies. -+ * -+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES -+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF -+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR -+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN -+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF -+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ */ -+ -+/* -+ * Linux-specific portability code - just SELinux support at present -+ */ -+ -+#include "includes.h" -+ -+#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) -+#include <errno.h> -+#include <stdarg.h> -+#include <string.h> -+#include <stdio.h> -+ -+#include "log.h" -+#include "xmalloc.h" -+#include "port-linux.h" -+#include "key.h" -+#include "hostfile.h" -+#include "auth.h" -+ -+#ifdef WITH_SELINUX -+#include <selinux/selinux.h> -+#include <selinux/flask.h> -+#include <selinux/get_context_list.h> -+ -+/* Wrapper around is_selinux_enabled() to log its return value once only */ -+int -+ssh_selinux_enabled(void) -+{ -+ static int enabled = -1; -+ -+ if (enabled == -1) { -+ enabled = (is_selinux_enabled() == 1); -+ debug("SELinux support %s", enabled ? "enabled" : "disabled"); -+ } -+ -+ return (enabled); -+} -+ -+void -+ssh_selinux_setfscreatecon(const char *path) -+{ -+ security_context_t context; -+ -+ if (!ssh_selinux_enabled()) -+ return; -+ if (path == NULL) { -+ setfscreatecon(NULL); -+ return; -+ } -+ if (matchpathcon(path, 0700, &context) == 0) -+ setfscreatecon(context); -+} -+ -+#endif /* WITH_SELINUX */ -+ -+#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */ diff --git a/openssh/patches/openssh-5.9p1-vendor.patch b/openssh/patches/openssh-5.9p1-vendor.patch deleted file mode 100644 index 3e63d3b..0000000 --- a/openssh/patches/openssh-5.9p1-vendor.patch +++ /dev/null @@ -1,157 +0,0 @@ -diff -up openssh-5.9p0/configure.ac.vendor openssh-5.9p0/configure.ac ---- openssh-5.9p0/configure.ac.vendor 2011-09-03 20:24:29.899501572 +0200 -+++ openssh-5.9p0/configure.ac 2011-09-03 20:24:39.153501595 +0200 -@@ -4131,6 +4131,12 @@ AC_ARG_WITH([lastlog], - fi - ] - ) -+AC_ARG_ENABLE(vendor-patchlevel, -+ [ --enable-vendor-patchlevel=TAG specify a vendor patch level], -+ [AC_DEFINE_UNQUOTED(SSH_VENDOR_PATCHLEVEL,[SSH_RELEASE "-" "$enableval"],[Define to your vendor patch level, if it has been modified from the upstream source release.]) -+ SSH_VENDOR_PATCHLEVEL="$enableval"], -+ [AC_DEFINE(SSH_VENDOR_PATCHLEVEL,SSH_RELEASE,[Define to your vendor patch level, if it has been modified from the upstream source release.]) -+ SSH_VENDOR_PATCHLEVEL=none]) - - dnl lastlog, [uw]tmpx? detection - dnl NOTE: set the paths in the platform section to avoid the -@@ -4357,6 +4363,7 @@ echo " Translate v4 in v6 hack - echo " BSD Auth support: $BSD_AUTH_MSG" - echo " Random number source: $RAND_MSG" - echo " Privsep sandbox style: $SANDBOX_STYLE" -+echo " Vendor patch level: $SSH_VENDOR_PATCHLEVEL" - - echo "" - -diff -up openssh-5.9p0/servconf.c.vendor openssh-5.9p0/servconf.c ---- openssh-5.9p0/servconf.c.vendor 2011-09-03 20:24:29.080500853 +0200 -+++ openssh-5.9p0/servconf.c 2011-09-03 20:27:15.727564566 +0200 -@@ -130,6 +130,7 @@ initialize_server_options(ServerOptions - options->max_authtries = -1; - options->max_sessions = -1; - options->banner = NULL; -+ options->show_patchlevel = -1; - options->use_dns = -1; - options->client_alive_interval = -1; - options->client_alive_count_max = -1; -@@ -300,6 +301,8 @@ fill_default_server_options(ServerOption - options->ip_qos_interactive = IPTOS_LOWDELAY; - if (options->ip_qos_bulk == -1) - options->ip_qos_bulk = IPTOS_THROUGHPUT; -+ if (options->show_patchlevel == -1) -+ options->show_patchlevel = 0; - - /* Turn privilege separation on by default */ - if (use_privsep == -1) -@@ -338,7 +341,7 @@ typedef enum { - sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, - sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, - sMaxStartups, sMaxAuthTries, sMaxSessions, -- sBanner, sUseDNS, sHostbasedAuthentication, -+ sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication, - sHostbasedUsesNameFromPacketOnly, sTwoFactorAuthentication, - sSecondPubkeyAuthentication, sSecondGssAuthentication, - sSecondPasswordAuthentication, sSecondKbdInteractiveAuthentication, -@@ -470,6 +473,7 @@ static struct { - { "maxauthtries", sMaxAuthTries, SSHCFG_ALL }, - { "maxsessions", sMaxSessions, SSHCFG_ALL }, - { "banner", sBanner, SSHCFG_ALL }, -+ { "showpatchlevel", sShowPatchLevel, SSHCFG_GLOBAL }, - { "usedns", sUseDNS, SSHCFG_GLOBAL }, - { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL }, - { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL }, -@@ -1152,6 +1156,10 @@ process_server_config_line(ServerOptions - multistate_ptr = multistate_privsep; - goto parse_multistate; - -+ case sShowPatchLevel: -+ intptr = &options->show_patchlevel; -+ goto parse_flag; -+ - case sAllowUsers: - while ((arg = strdelim(&cp)) && *arg != '\0') { - if (options->num_allow_users >= MAX_ALLOW_USERS) -@@ -1849,6 +1857,7 @@ dump_config(ServerOptions *o) - dump_cfg_fmtint(sUseLogin, o->use_login); - dump_cfg_fmtint(sCompression, o->compression); - dump_cfg_fmtint(sGatewayPorts, o->gateway_ports); -+ dump_cfg_fmtint(sShowPatchLevel, o->show_patchlevel); - dump_cfg_fmtint(sUseDNS, o->use_dns); - dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding); - dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); -diff -up openssh-5.9p0/servconf.h.vendor openssh-5.9p0/servconf.h ---- openssh-5.9p0/servconf.h.vendor 2011-09-03 20:24:29.179632045 +0200 -+++ openssh-5.9p0/servconf.h 2011-09-03 20:24:39.426502323 +0200 -@@ -148,6 +148,7 @@ typedef struct { - int max_authtries; - int max_sessions; - char *banner; /* SSH-2 banner message */ -+ int show_patchlevel; /* Show vendor patch level to clients */ - int use_dns; - int client_alive_interval; /* - * poke the client this often to -diff -up openssh-5.9p0/sshd.c.vendor openssh-5.9p0/sshd.c ---- openssh-5.9p0/sshd.c.vendor 2011-09-03 20:24:35.987501565 +0200 -+++ openssh-5.9p0/sshd.c 2011-09-03 20:24:39.542501643 +0200 -@@ -431,7 +431,7 @@ sshd_exchange_identification(int sock_in - minor = PROTOCOL_MINOR_1; - } - snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor, -- SSH_VERSION, newline); -+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION, newline); - server_version_string = xstrdup(buf); - - /* Send our protocol version identification. */ -@@ -1627,7 +1627,8 @@ main(int ac, char **av) - exit(1); - } - -- debug("sshd version %.100s", SSH_RELEASE); -+ debug("sshd version %.100s", -+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_RELEASE); - - /* Store privilege separation user for later use if required. */ - if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) { -diff -up openssh-5.9p0/sshd_config.0.vendor openssh-5.9p0/sshd_config.0 ---- openssh-5.9p0/sshd_config.0.vendor 2011-09-03 20:24:37.524438185 +0200 -+++ openssh-5.9p0/sshd_config.0 2011-09-03 20:24:39.677508255 +0200 -@@ -556,6 +556,11 @@ DESCRIPTION - Defines the number of bits in the ephemeral protocol version 1 - server key. The minimum value is 512, and the default is 1024. - -+ ShowPatchLevel -+ Specifies whether sshd will display the specific patch level of -+ the binary in the server identification string. The patch level -+ is set at compile-time. The default is M-bM-^@M-^\noM-bM-^@M-^]. -+ - StrictModes - Specifies whether sshd(8) should check file modes and ownership - of the user's files and home directory before accepting login. -diff -up openssh-5.9p0/sshd_config.5.vendor openssh-5.9p0/sshd_config.5 ---- openssh-5.9p0/sshd_config.5.vendor 2011-09-03 20:24:37.640442022 +0200 -+++ openssh-5.9p0/sshd_config.5 2011-09-03 20:24:40.176544206 +0200 -@@ -952,6 +952,14 @@ This option applies to protocol version - .It Cm ServerKeyBits - Defines the number of bits in the ephemeral protocol version 1 server key. - The minimum value is 512, and the default is 1024. -+.It Cm ShowPatchLevel -+Specifies whether -+.Nm sshd -+will display the patch level of the binary in the identification string. -+The patch level is set at compile-time. -+The default is -+.Dq no . -+This option applies to protocol version 1 only. - .It Cm StrictModes - Specifies whether - .Xr sshd 8 -diff -up openssh-5.9p0/sshd_config.vendor openssh-5.9p0/sshd_config ---- openssh-5.9p0/sshd_config.vendor 2011-09-03 20:24:37.770439735 +0200 -+++ openssh-5.9p0/sshd_config 2011-09-03 20:24:40.278628002 +0200 -@@ -120,6 +120,7 @@ X11Forwarding yes - #Compression delayed - #ClientAliveInterval 0 - #ClientAliveCountMax 3 -+#ShowPatchLevel no - #UseDNS yes - #PidFile /var/run/sshd.pid - #MaxStartups 10 diff --git a/openssh/patches/openssh-6.0p1-entropy.patch b/openssh/patches/openssh-6.0p1-entropy.patch new file mode 100644 index 0000000..79f05f4 --- /dev/null +++ b/openssh/patches/openssh-6.0p1-entropy.patch @@ -0,0 +1,272 @@ +diff -up openssh-6.0p1/entropy.c.entropy openssh-6.0p1/entropy.c +--- openssh-6.0p1/entropy.c.entropy 2012-08-06 20:51:59.131033413 +0200 ++++ openssh-6.0p1/entropy.c 2012-08-06 20:51:59.171033257 +0200 +@@ -237,6 +237,9 @@ seed_rng(void) + memset(buf, '\0', sizeof(buf)); + + #endif /* OPENSSL_PRNG_ONLY */ ++#ifdef __linux__ ++ linux_seed(); ++#endif /* __linux__ */ + if (RAND_status() != 1) + fatal("PRNG is not seeded"); + } +diff -up openssh-6.0p1/openbsd-compat/Makefile.in.entropy openssh-6.0p1/openbsd-compat/Makefile.in +--- openssh-6.0p1/openbsd-compat/Makefile.in.entropy 2012-08-06 20:51:59.100033534 +0200 ++++ openssh-6.0p1/openbsd-compat/Makefile.in 2012-08-06 20:51:59.171033257 +0200 +@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport + + COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o + +-PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o ++PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o + + .c.o: + $(CC) $(CFLAGS) $(CPPFLAGS) -c $< +diff -up openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.0p1/openbsd-compat/port-linux-prng.c +--- openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy 2012-08-06 20:51:59.171033257 +0200 ++++ openssh-6.0p1/openbsd-compat/port-linux-prng.c 2012-08-06 20:51:59.171033257 +0200 +@@ -0,0 +1,59 @@ ++/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */ ++ ++/* ++ * Copyright (c) 2011 Jan F. Chadima <jchadima(a)redhat.com> ++ * ++ * Permission to use, copy, modify, and distribute this software for any ++ * purpose with or without fee is hereby granted, provided that the above ++ * copyright notice and this permission notice appear in all copies. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES ++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF ++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF ++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ */ ++ ++/* ++ * Linux-specific portability code - prng support ++ */ ++ ++#include "includes.h" ++ ++#include <errno.h> ++#include <stdarg.h> ++#include <string.h> ++#include <stdio.h> ++#include <openssl/rand.h> ++ ++#include "log.h" ++#include "xmalloc.h" ++#include "servconf.h" ++#include "port-linux.h" ++#include "key.h" ++#include "hostfile.h" ++#include "auth.h" ++ ++void ++linux_seed(void) ++{ ++ int len; ++ char *env = getenv("SSH_USE_STRONG_RNG"); ++ char *random = "/dev/random"; ++ size_t ienv, randlen = 6; ++ ++ if (!env || !strcmp(env, "0")) ++ random = "/dev/urandom"; ++ else if ((ienv = atoi(env)) > 6) ++ randlen = ienv; ++ ++ errno = 0; ++ if ((len = RAND_load_file(random, randlen)) != randlen) { ++ if (errno) ++ fatal ("cannot read from %s, %s", random, strerror(errno)); ++ else ++ fatal ("EOF reading %s", random); ++ } ++} +diff -up openssh-6.0p1/ssh.1.entropy openssh-6.0p1/ssh.1 +--- openssh-6.0p1/ssh.1.entropy 2012-08-06 20:51:59.139033382 +0200 ++++ openssh-6.0p1/ssh.1 2012-08-06 20:51:59.174033245 +0200 +@@ -1269,6 +1269,23 @@ For more information, see the + .Cm PermitUserEnvironment + option in + .Xr sshd_config 5 . ++.Sh ENVIRONMENT ++.Bl -tag -width Ds -compact ++.It Ev SSH_USE_STRONG_RNG ++The reseeding of the OpenSSL random generator is usually done from ++.Cm /dev/urandom . ++If the ++.Cm SSH_USE_STRONG_RNG ++environment variable is set to value other than ++.Cm 0 ++the OpenSSL random generator is reseeded from ++.Cm /dev/random . ++The number of bytes read is defined by the SSH_USE_STRONG_RNG value. ++Minimum is 6 bytes. ++This setting is not recommended on the computers without the hardware ++random generator because insufficient entropy causes the connection to ++be blocked until enough entropy is available. ++.El + .Sh FILES + .Bl -tag -width Ds -compact + .It Pa ~/.rhosts +diff -up openssh-6.1p1/ssh-add.0.entropy openssh-6.1p1/ssh-add.0 +--- openssh-6.1p1/ssh-add.0.entropy 2012-11-12 13:11:42.717393364 +0100 ++++ openssh-6.1p1/ssh-add.0 2012-11-12 13:12:46.288108790 +0100 +@@ -81,6 +81,16 @@ ENVIRONMENT + Identifies the path of a UNIX-domain socket used to communicate + with the agent. + ++ SSH_USE_STRONG_RNG ++ The reseeding of the OpenSSL random generator is usually done ++ from /dev/urandom. If the SSH_USE_STRONG_RNG environment vari- ++ able is set to value other than 0 the OpenSSL random generator is ++ reseeded from /dev/random. The number of bytes read is defined ++ by the SSH_USE_STRONG_RNG value. Minimum is 6 bytes. This set- ++ ting is not recommended on the computers without the hardware ++ random generator because insufficient entropy causes the connec- ++ tion to be blocked until enough entropy is available. ++ + FILES + ~/.ssh/identity + Contains the protocol version 1 RSA authentication identity of +diff -up openssh-6.1p1/ssh-add.1.entropy openssh-6.1p1/ssh-add.1 +--- openssh-6.1p1/ssh-add.1.entropy 2011-10-18 07:06:33.000000000 +0200 ++++ openssh-6.1p1/ssh-add.1 2012-11-12 13:11:24.711476108 +0100 +@@ -160,6 +160,20 @@ to make this work.) + Identifies the path of a + .Ux Ns -domain + socket used to communicate with the agent. ++.It Ev SSH_USE_STRONG_RNG ++The reseeding of the OpenSSL random generator is usually done from ++.Cm /dev/urandom . ++If the ++.Cm SSH_USE_STRONG_RNG ++environment variable is set to value other than ++.Cm 0 ++the OpenSSL random generator is reseeded from ++.Cm /dev/random . ++The number of bytes read is defined by the SSH_USE_STRONG_RNG value. ++Minimum is 6 bytes. ++This setting is not recommended on the computers without the hardware ++random generator because insufficient entropy causes the connection to ++be blocked until enough entropy is available. + .El + .Sh FILES + .Bl -tag -width Ds + .It Pa ~/.ssh/identity +diff -up openssh-6.0p1/ssh-agent.1.entropy openssh-6.0p1/ssh-agent.1 +--- openssh-6.0p1/ssh-agent.1.entropy 2010-12-01 01:50:35.000000000 +0100 ++++ openssh-6.0p1/ssh-agent.1 2012-08-06 20:51:59.172033253 +0200 +@@ -198,6 +198,24 @@ sockets used to contain the connection t + These sockets should only be readable by the owner. + The sockets should get automatically removed when the agent exits. + .El ++.Sh ENVIRONMENT ++.Bl -tag -width Ds -compact ++.Pp ++.It Pa SSH_USE_STRONG_RNG ++The reseeding of the OpenSSL random generator is usually done from ++.Cm /dev/urandom . ++If the ++.Cm SSH_USE_STRONG_RNG ++environment variable is set to value other than ++.Cm 0 ++the OpenSSL random generator is reseeded from ++.Cm /dev/random . ++The number of bytes read is defined by the SSH_USE_STRONG_RNG value. ++Minimum is 6 bytes. ++This setting is not recommended on the computers without the hardware ++random generator because insufficient entropy causes the connection to ++be blocked until enough entropy is available. ++.El + .Sh SEE ALSO + .Xr ssh 1 , + .Xr ssh-add 1 , +diff -up openssh-6.0p1/sshd.8.entropy openssh-6.0p1/sshd.8 +--- openssh-6.0p1/sshd.8.entropy 2012-08-06 20:51:59.139033382 +0200 ++++ openssh-6.0p1/sshd.8 2012-08-06 20:51:59.174033245 +0200 +@@ -943,6 +943,24 @@ concurrently for different ports, this c + started last). + The content of this file is not sensitive; it can be world-readable. + .El ++.Sh ENVIRONMENT ++.Bl -tag -width Ds -compact ++.Pp ++.It Pa SSH_USE_STRONG_RNG ++The reseeding of the OpenSSL random generator is usually done from ++.Cm /dev/urandom . ++If the ++.Cm SSH_USE_STRONG_RNG ++environment variable is set to value other than ++.Cm 0 ++the OpenSSL random generator is reseeded from ++.Cm /dev/random . ++The number of bytes read is defined by the SSH_USE_STRONG_RNG value. ++Minimum is 6 bytes. ++This setting is not recommended on the computers without the hardware ++random generator because insufficient entropy causes the connection to ++be blocked until enough entropy is available. ++.El + .Sh IPV6 + IPv6 address can be used everywhere where IPv4 address. In all entries must be the IPv6 address enclosed in square brackets. Note: The square brackets are metacharacters for the shell and must be escaped in shell. + .Sh SEE ALSO +diff -up openssh-6.0p1/ssh-keygen.1.entropy openssh-6.0p1/ssh-keygen.1 +--- openssh-6.0p1/ssh-keygen.1.entropy 2011-10-18 07:05:21.000000000 +0200 ++++ openssh-6.0p1/ssh-keygen.1 2012-08-06 20:51:59.173033249 +0200 +@@ -675,6 +675,24 @@ Contains Diffie-Hellman groups used for + The file format is described in + .Xr moduli 5 . + .El ++.Sh ENVIRONMENT ++.Bl -tag -width Ds -compact ++.Pp ++.It Pa SSH_USE_STRONG_RNG ++The reseeding of the OpenSSL random generator is usually done from ++.Cm /dev/urandom . ++If the ++.Cm SSH_USE_STRONG_RNG ++environment variable is set to value other than ++.Cm 0 ++the OpenSSL random generator is reseeded from ++.Cm /dev/random . ++The number of bytes read is defined by the SSH_USE_STRONG_RNG value. ++Minimum is 6 bytes. ++This setting is not recommended on the computers without the hardware ++random generator because insufficient entropy causes the connection to ++be blocked until enough entropy is available. ++.El + .Sh SEE ALSO + .Xr ssh 1 , + .Xr ssh-add 1 , +diff -up openssh-6.0p1/ssh-keysign.8.entropy openssh-6.0p1/ssh-keysign.8 +--- openssh-6.0p1/ssh-keysign.8.entropy 2010-08-31 14:41:14.000000000 +0200 ++++ openssh-6.0p1/ssh-keysign.8 2012-08-06 20:51:59.173033249 +0200 +@@ -78,6 +78,24 @@ must be set-uid root if host-based authe + If these files exist they are assumed to contain public certificate + information corresponding with the private keys above. + .El ++.Sh ENVIRONMENT ++.Bl -tag -width Ds -compact ++.Pp ++.It Pa SSH_USE_STRONG_RNG ++The reseeding of the OpenSSL random generator is usually done from ++.Cm /dev/urandom . ++If the ++.Cm SSH_USE_STRONG_RNG ++environment variable is set to value other than ++.Cm 0 ++the OpenSSL random generator is reseeded from ++.Cm /dev/random . ++The number of bytes read is defined by the SSH_USE_STRONG_RNG value. ++Minimum is 6 bytes. ++This setting is not recommended on the computers without the hardware ++random generator because insufficient entropy causes the connection to ++be blocked until enough entropy is available. ++.El + .Sh SEE ALSO + .Xr ssh 1 , + .Xr ssh-keygen 1 , diff --git a/openssh/patches/openssh-6.1p1-akc.patch b/openssh/patches/openssh-6.1p1-akc.patch new file mode 100644 index 0000000..0401ba0 --- /dev/null +++ b/openssh/patches/openssh-6.1p1-akc.patch @@ -0,0 +1,565 @@ +diff -up openssh-6.1p1/auth2-pubkey.c.akc openssh-6.1p1/auth2-pubkey.c +--- openssh-6.1p1/auth2-pubkey.c.akc 2012-11-28 17:12:43.238524384 +0100 ++++ openssh-6.1p1/auth2-pubkey.c 2012-11-28 17:12:43.263524297 +0100 +@@ -27,9 +27,13 @@ + + #include <sys/types.h> + #include <sys/stat.h> ++#include <sys/wait.h> + ++#include <errno.h> + #include <fcntl.h> ++#include <paths.h> + #include <pwd.h> ++#include <signal.h> + #include <stdio.h> + #include <stdarg.h> + #include <string.h> +@@ -260,7 +264,7 @@ match_principals_file(char *file, struct + if (strcmp(cp, cert->principals[i]) == 0) { + debug3("matched principal \"%.100s\" " + "from file \"%s\" on line %lu", +- cert->principals[i], file, linenum); ++ cert->principals[i], file, linenum); + if (auth_parse_options(pw, line_opts, + file, linenum) != 1) + continue; +@@ -273,31 +277,22 @@ match_principals_file(char *file, struct + fclose(f); + restore_uid(); + return 0; +-} ++} + +-/* return 1 if user allows given key */ ++/* ++ * Checks whether key is allowed in authorized_keys-format file, ++ * returns 1 if the key is allowed or 0 otherwise. ++ */ + static int +-user_key_allowed2(struct passwd *pw, Key *key, char *file) ++check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw) + { + char line[SSH_MAX_PUBKEY_BYTES]; + const char *reason; + int found_key = 0; +- FILE *f; + u_long linenum = 0; + Key *found; + char *fp; + +- /* Temporarily use the user's uid. */ +- temporarily_use_uid(pw); +- +- debug("trying public key file %s", file); +- f = auth_openkeyfile(file, pw, options.strict_modes); +- +- if (!f) { +- restore_uid(); +- return 0; +- } +- + found_key = 0; + found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type); + +@@ -390,8 +385,6 @@ user_key_allowed2(struct passwd *pw, Key + break; + } + } +- restore_uid(); +- fclose(f); + key_free(found); + if (!found_key) + debug2("key not found"); +@@ -453,7 +446,173 @@ user_cert_trusted_ca(struct passwd *pw, + return ret; + } + +-/* check whether given key is in .ssh/authorized_keys* */ ++/* ++ * Checks whether key is allowed in file. ++ * returns 1 if the key is allowed or 0 otherwise. ++ */ ++static int ++user_key_allowed2(struct passwd *pw, Key *key, char *file) ++{ ++ FILE *f; ++ int found_key = 0; ++ ++ /* Temporarily use the user's uid. */ ++ temporarily_use_uid(pw); ++ ++ debug("trying public key file %s", file); ++ if ((f = auth_openkeyfile(file, pw, options.strict_modes)) != NULL) { ++ found_key = check_authkeys_file(f, file, key, pw); ++ fclose(f); ++ } ++ ++ restore_uid(); ++ return found_key; ++} ++ ++/* ++ * Checks whether key is allowed in output of command. ++ * returns 1 if the key is allowed or 0 otherwise. ++ */ ++static int ++user_key_command_allowed2(struct passwd *user_pw, Key *key) ++{ ++ FILE *f; ++ int ok, found_key = 0; ++ struct passwd *pw; ++ struct stat st; ++ int status, devnull, p[2], i; ++ pid_t pid; ++ char errmsg[512]; ++ ++ if (options.authorized_keys_command == NULL || ++ options.authorized_keys_command[0] != '/') ++ return 0; ++ ++ /* If no user specified to run commands the default to target user */ ++ if (options.authorized_keys_command_user == NULL) ++ pw = user_pw; ++ else { ++ pw = getpwnam(options.authorized_keys_command_user); ++ if (pw == NULL) { ++ error("AuthorizedKeyCommandUser \"%s\" not found: %s", ++ options.authorized_keys_command, strerror(errno)); ++ return 0; ++ } ++ } ++ ++ temporarily_use_uid(pw); ++ if (stat(options.authorized_keys_command, &st) < 0) { ++ error("Could not stat AuthorizedKeysCommand \"%s\": %s", ++ options.authorized_keys_command, strerror(errno)); ++ goto out; ++ } ++ ++ if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0, ++ errmsg, sizeof(errmsg)) != 0) { ++ error("Unsafe AuthorizedKeysCommand: %s", errmsg); ++ goto out; ++ } ++ ++ /* open the pipe and read the keys */ ++ if (pipe(p) != 0) { ++ error("%s: pipe: %s", __func__, strerror(errno)); ++ goto out; ++ } ++ ++ debug3("Running AuthorizedKeysCommand: \"%s\" as \"%s\"", ++ options.authorized_keys_command, pw->pw_name); ++ ++ /* ++ * Don't want to call this in the child, where it can fatal() and ++ * run cleanup_exit() code. ++ */ ++ restore_uid(); ++ ++ switch ((pid = fork())) { ++ case -1: /* error */ ++ error("%s: fork: %s", __func__, strerror(errno)); ++ close(p[0]); ++ close(p[1]); ++ return 0; ++ case 0: /* child */ ++ for (i = 0; i < NSIG; i++) ++ signal(i, SIG_DFL); ++ ++ /* Don't use permanently_set_uid() here to avoid fatal() */ ++ if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) { ++ error("setresgid %u: %s", (u_int)pw->pw_gid, ++ strerror(errno)); ++ _exit(1); ++ } ++ if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) { ++ error("setresuid %u: %s", (u_int)pw->pw_uid, ++ strerror(errno)); ++ _exit(1); ++ } ++ ++ close(p[0]); ++ if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { ++ error("%s: open %s: %s", __func__, _PATH_DEVNULL, ++ strerror(errno)); ++ _exit(1); ++ } ++ if (dup2(devnull, STDIN_FILENO) == -1 || ++ dup2(p[1], STDOUT_FILENO) == -1 || ++ dup2(devnull, STDERR_FILENO) == -1) { ++ error("%s: dup2: %s", __func__, strerror(errno)); ++ _exit(1); ++ } ++ closefrom(STDERR_FILENO + 1); ++ ++ execl(options.authorized_keys_command, ++ options.authorized_keys_command, pw->pw_name, NULL); ++ ++ error("AuthorizedKeysCommand %s exec failed: %s", ++ options.authorized_keys_command, strerror(errno)); ++ _exit(127); ++ default: /* parent */ ++ break; ++ } ++ ++ temporarily_use_uid(pw); ++ ++ close(p[1]); ++ if ((f = fdopen(p[0], "r")) == NULL) { ++ error("%s: fdopen: %s", __func__, strerror(errno)); ++ close(p[0]); ++ /* Don't leave zombie child */ ++ while (waitpid(pid, NULL, 0) == -1 && errno == EINTR) ++ ; ++ goto out; ++ } ++ ok = check_authkeys_file(f, options.authorized_keys_command, key, pw); ++ fclose(f); ++ ++ while (waitpid(pid, &status, 0) == -1) { ++ if (errno != EINTR) { ++ error("%s: waitpid: %s", __func__, strerror(errno)); ++ goto out; ++ } ++ } ++ if (WIFSIGNALED(status)) { ++ error("AuthorizedKeysCommand %s exited on signal %d", ++ options.authorized_keys_command, WTERMSIG(status)); ++ goto out; ++ } else if (WEXITSTATUS(status) != 0) { ++ error("AuthorizedKeysCommand %s returned status %d", ++ options.authorized_keys_command, WEXITSTATUS(status)); ++ goto out; ++ } ++ found_key = ok; ++ out: ++ restore_uid(); ++ ++ return found_key; ++} ++ ++/* ++ * Check whether key authenticates and authorises the user. ++ */ + int + user_key_allowed(struct passwd *pw, Key *key) + { +@@ -469,6 +628,10 @@ user_key_allowed(struct passwd *pw, Key + if (success) + return success; + ++ success = user_key_command_allowed2(pw, key); ++ if (success > 0) ++ return success; ++ + for (i = 0; !success && i < options.num_authkeys_files; i++) { + file = expand_authorized_keys( + options.authorized_keys_files[i], pw); +diff -up openssh-6.1p1/auth.c.akc openssh-6.1p1/auth.c +--- openssh-6.1p1/auth.c.akc 2012-11-28 17:12:43.187524558 +0100 ++++ openssh-6.1p1/auth.c 2012-11-28 17:12:43.263524297 +0100 +@@ -411,39 +411,41 @@ check_key_in_hostfiles(struct passwd *pw + + + /* +- * Check a given file for security. This is defined as all components ++ * Check a given path for security. This is defined as all components + * of the path to the file must be owned by either the owner of + * of the file or root and no directories must be group or world writable. + * + * XXX Should any specific check be done for sym links ? + * +- * Takes an open file descriptor, the file name, a uid and and ++ * Takes an the file name, its stat information (preferably from fstat() to ++ * avoid races), the uid of the expected owner, their home directory and an + * error buffer plus max size as arguments. + * + * Returns 0 on success and -1 on failure + */ +-static int +-secure_filename(FILE *f, const char *file, struct passwd *pw, +- char *err, size_t errlen) ++int ++auth_secure_path(const char *name, struct stat *stp, const char *pw_dir, ++ uid_t uid, char *err, size_t errlen) + { +- uid_t uid = pw->pw_uid; + char buf[MAXPATHLEN], homedir[MAXPATHLEN]; + char *cp; + int comparehome = 0; + struct stat st; + +- if (realpath(file, buf) == NULL) { +- snprintf(err, errlen, "realpath %s failed: %s", file, ++ if (realpath(name, buf) == NULL) { ++ snprintf(err, errlen, "realpath %s failed: %s", name, + strerror(errno)); + return -1; + } +- if (realpath(pw->pw_dir, homedir) != NULL) ++ if (pw_dir != NULL && realpath(pw_dir, homedir) != NULL) + comparehome = 1; + +- /* check the open file to avoid races */ +- if (fstat(fileno(f), &st) < 0 || +- (st.st_uid != 0 && st.st_uid != uid) || +- (st.st_mode & 022) != 0) { ++ if (!S_ISREG(stp->st_mode)) { ++ snprintf(err, errlen, "%s is not a regular file", buf); ++ return -1; ++ } ++ if ((stp->st_uid != 0 && stp->st_uid != uid) || ++ (stp->st_mode & 022) != 0) { + snprintf(err, errlen, "bad ownership or modes for file %s", + buf); + return -1; +@@ -479,6 +481,31 @@ secure_filename(FILE *f, const char *fil + return 0; + } + ++/* ++ * Version of secure_path() that accepts an open file descriptor to ++ * avoid races. ++ * ++ * Returns 0 on success and -1 on failure ++ */ ++static int ++secure_filename(FILE *f, const char *file, struct passwd *pw, ++ char *err, size_t errlen) ++{ ++ uid_t uid = pw->pw_uid; ++ char buf[MAXPATHLEN], homedir[MAXPATHLEN]; ++ char *cp; ++ int comparehome = 0; ++ struct stat st; ++ ++ /* check the open file to avoid races */ ++ if (fstat(fileno(f), &st) < 0) { ++ snprintf(err, errlen, "cannot stat file %s: %s", ++ buf, strerror(errno)); ++ return -1; ++ } ++ return auth_secure_path(file, &st, pw->pw_dir, pw->pw_uid, err, errlen); ++} ++ + static FILE * + auth_openfile(const char *file, struct passwd *pw, int strict_modes, + int log_missing, char *file_type) +diff -up openssh-6.1p1/auth.h.akc openssh-6.1p1/auth.h +--- openssh-6.1p1/auth.h.akc 2012-11-28 17:12:43.239524381 +0100 ++++ openssh-6.1p1/auth.h 2012-11-28 17:12:43.263524297 +0100 +@@ -125,6 +125,10 @@ int auth_rhosts_rsa_key_allowed(struct + int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); + int user_key_allowed(struct passwd *, Key *); + ++struct stat; ++int auth_secure_path(const char *, struct stat *, const char *, uid_t, ++ char *, size_t); ++ + #ifdef KRB5 + int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *); + int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt); +diff -up openssh-6.1p1/servconf.c.akc openssh-6.1p1/servconf.c +--- openssh-6.1p1/servconf.c.akc 2012-11-28 17:12:43.198524521 +0100 ++++ openssh-6.1p1/servconf.c 2012-11-28 17:14:50.314005026 +0100 +@@ -137,6 +137,8 @@ initialize_server_options(ServerOptions + options->num_permitted_opens = -1; + options->adm_forced_command = NULL; + options->chroot_directory = NULL; ++ options->authorized_keys_command = NULL; ++ options->authorized_keys_command_user = NULL; + options->zero_knowledge_password_authentication = -1; + options->revoked_keys_file = NULL; + options->trusted_user_ca_keys = NULL; +@@ -331,6 +333,7 @@ typedef enum { + sZeroKnowledgePasswordAuthentication, sHostCertificate, + sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, + sKexAlgorithms, sIPQoS, sVersionAddendum, ++ sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, + sAuthenticationMethods, + sDeprecated, sUnsupported + } ServerOpCodes; +@@ -457,6 +460,9 @@ static struct { + { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, + { "ipqos", sIPQoS, SSHCFG_ALL }, + { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, ++ { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, ++ { "authorizedkeyscommandrunas", sAuthorizedKeysCommandUser, SSHCFG_ALL }, ++ { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL }, + { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, + { NULL, sBadOption, 0 } + }; +@@ -1520,6 +1526,26 @@ process_server_config_line(ServerOptions + } + return 0; + ++ case sAuthorizedKeysCommand: ++ len = strspn(cp, WHITESPACE); ++ if (*activep && options->authorized_keys_command == NULL) { ++ options->authorized_keys_command = xstrdup(cp + len); ++ if (*options->authorized_keys_command != '/') { ++ fatal("%.200s line %d: AuthorizedKeysCommand " ++ "must be an absolute path", ++ filename, linenum); ++ } ++ } ++ return 0; ++ ++ case sAuthorizedKeysCommandUser: ++ charptr = &options->authorized_keys_command_user; ++ ++ arg = strdelim(&cp); ++ if (*activep && *charptr == NULL) ++ *charptr = xstrdup(arg); ++ break; ++ + case sDeprecated: + logit("%s line %d: Deprecated option %s", + filename, linenum, arg); +@@ -1670,6 +1696,8 @@ copy_set_server_options(ServerOptions *d + M_CP_INTOPT(hostbased_uses_name_from_packet_only); + M_CP_INTOPT(kbd_interactive_authentication); + M_CP_INTOPT(zero_knowledge_password_authentication); ++ M_CP_STROPT(authorized_keys_command); ++ M_CP_STROPT(authorized_keys_command_user); + M_CP_INTOPT(permit_root_login); + M_CP_INTOPT(permit_empty_passwd); + +@@ -1930,6 +1958,8 @@ dump_config(ServerOptions *o) + dump_cfg_string(sAuthorizedPrincipalsFile, + o->authorized_principals_file); + dump_cfg_string(sVersionAddendum, o->version_addendum); ++ dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command); ++ dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user); + + /* string arguments requiring a lookup */ + dump_cfg_string(sLogLevel, log_level_name(o->log_level)); +diff -up openssh-6.1p1/servconf.h.akc openssh-6.1p1/servconf.h +--- openssh-6.1p1/servconf.h.akc 2012-11-28 17:12:43.000000000 +0100 ++++ openssh-6.1p1/servconf.h 2012-11-28 17:18:41.217055157 +0100 +@@ -167,6 +167,8 @@ typedef struct { + char *revoked_keys_file; + char *trusted_user_ca_keys; + char *authorized_principals_file; ++ char *authorized_keys_command; ++ char *authorized_keys_command_user; + + char *version_addendum; /* Appended to SSH banner */ + +diff -up openssh-6.1p1/sshd.c.akc openssh-6.1p1/sshd.c +--- openssh-6.1p1/sshd.c.akc 2012-11-28 17:12:43.245524360 +0100 ++++ openssh-6.1p1/sshd.c 2012-11-28 17:12:43.265524291 +0100 +@@ -366,9 +366,20 @@ main_sigchld_handler(int sig) + static void + grace_alarm_handler(int sig) + { ++ pid_t pgid; ++ + if (use_privsep && pmonitor != NULL && pmonitor->m_pid > 0) + kill(pmonitor->m_pid, SIGALRM); + ++ /* ++ * Try to kill any processes that we have spawned, E.g. authorized ++ * keys command helpers. ++ */ ++ if ((pgid = getpgid(0)) == getpid()) { ++ signal(SIGTERM, SIG_IGN); ++ killpg(pgid, SIGTERM); ++ } ++ + /* Log error and exit. */ + sigdie("Timeout before authentication for %s", get_remote_ipaddr()); + } +diff -up openssh-6.1p1/sshd_config.0.akc openssh-6.1p1/sshd_config.0 +--- openssh-6.1p1/sshd_config.0.akc 2012-08-29 02:53:04.000000000 +0200 ++++ openssh-6.1p1/sshd_config.0 2012-11-28 17:12:43.265524291 +0100 +@@ -71,6 +71,23 @@ DESCRIPTION + + See PATTERNS in ssh_config(5) for more information on patterns. + ++ AuthorizedKeysCommand ++ ++ Specifies a program to be used for lookup of the user's ++ public keys. The program will be invoked with its first ++ argument the name of the user being authorized, and should produce ++ on standard output AuthorizedKeys lines (see AUTHORIZED_KEYS ++ in sshd(8)). By default (or when set to the empty string) there is no ++ AuthorizedKeysCommand run. If the AuthorizedKeysCommand does not successfully ++ authorize the user, authorization falls through to the ++ AuthorizedKeysFile. Note that this option has an effect ++ only with PubkeyAuthentication turned on. ++ ++ AuthorizedKeysCommandRunAs ++ Specifies the user under whose account the AuthorizedKeysCommand is run. ++ Empty string (the default value) means the user being authorized ++ is used. ++ + AuthorizedKeysFile + Specifies the file that contains the public keys that can be used + for user authentication. The format is described in the +@@ -402,7 +419,8 @@ DESCRIPTION + Only a subset of keywords may be used on the lines following a + Match keyword. Available keywords are AcceptEnv, + AllowAgentForwarding, AllowGroups, AllowTcpForwarding, +- AllowUsers, AuthorizedKeysFile, AuthorizedPrincipalsFile, Banner, ++ AllowUsers, AuthorizedKeysFile, AuthorizedKeysCommand, ++ AuthorizedKeysCommandRunAs, AuthorizedPrincipalsFile, Banner, + ChrootDirectory, DenyGroups, DenyUsers, ForceCommand, + GatewayPorts, GSSAPIAuthentication, HostbasedAuthentication, + HostbasedUsesNameFromPacketOnly, KbdInteractiveAuthentication, +diff -up openssh-6.1p1/sshd_config.5.akc openssh-6.1p1/sshd_config.5 +--- openssh-6.1p1/sshd_config.5.akc 2012-11-28 17:12:43.199524517 +0100 ++++ openssh-6.1p1/sshd_config.5 2012-11-28 17:16:23.736624980 +0100 +@@ -173,6 +173,20 @@ Note that each authentication method lis + in the configuration. + The default is not to require multiple authentication; successful completion + of a single authentication method is sufficient. ++.It Cm AuthorizedKeysCommand ++Specifies a program to be used for lookup of the user's public keys. ++The program will be invoked with a single argument of the username ++being authenticated, and should produce on standard output zero or ++more lines of authorized_keys output (see AUTHORIZED_KEYS in ++.Xr sshd 8 ) ++If a key supplied by AuthorizedKeysCommand does not successfully authenticate ++and authorize the user then public key authentication continues using the usual ++.Cm AuthorizedKeysFile ++files. ++By default, no AuthorizedKeysCommand is run. ++.It Cm AuthorizedKeysCommandUser ++Specifies the user under whose account the AuthorizedKeysCommand is run. ++The default is the user being authenticated. + .It Cm AuthorizedKeysFile + Specifies the file that contains the public keys that can be used + for user authentication. +@@ -734,6 +748,8 @@ Available keywords are + .Cm AllowTcpForwarding , + .Cm AllowUsers , + .Cm AuthenticationMethods , ++.Cm AuthorizedKeysCommand , ++.Cm AuthorizedKeysCommandUser , + .Cm AuthorizedKeysFile , + .Cm AuthorizedPrincipalsFile , + .Cm Banner , +@@ -749,6 +765,7 @@ Available keywords are + .Cm KerberosAuthentication , + .Cm MaxAuthTries , + .Cm MaxSessions , ++.Cm PubkeyAuthentication , + .Cm PasswordAuthentication , + .Cm PermitEmptyPasswords , + .Cm PermitOpen , +diff -up openssh-6.1p1/sshd_config.akc openssh-6.1p1/sshd_config +--- openssh-6.1p1/sshd_config.akc 2012-07-31 04:21:34.000000000 +0200 ++++ openssh-6.1p1/sshd_config 2012-11-28 17:12:43.265524291 +0100 +@@ -49,6 +49,9 @@ + # but this is overridden so installations will only check .ssh/authorized_keys + AuthorizedKeysFile .ssh/authorized_keys + ++#AuthorizedKeysCommand none ++#AuthorizedKeysCommandUser nobody ++ + #AuthorizedPrincipalsFile none + + # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/openssh/patches/openssh-6.1p1-askpass-ld.patch b/openssh/patches/openssh-6.1p1-askpass-ld.patch new file mode 100644 index 0000000..f7a7fac --- /dev/null +++ b/openssh/patches/openssh-6.1p1-askpass-ld.patch @@ -0,0 +1,18 @@ +diff -up openssh-6.1p1/contrib/Makefile.askpass-ld openssh-6.1p1/contrib/Makefile +--- openssh-6.1p1/contrib/Makefile.askpass-ld 2012-05-19 07:24:37.000000000 +0200 ++++ openssh-6.1p1/contrib/Makefile 2012-09-14 20:35:47.565704718 +0200 +@@ -4,12 +4,12 @@ all: + @echo "Valid targets: gnome-ssh-askpass1 gnome-ssh-askpass2" + + gnome-ssh-askpass1: gnome-ssh-askpass1.c +- $(CC) `gnome-config --cflags gnome gnomeui` \ ++ $(CC) ${CFLAGS} `gnome-config --cflags gnome gnomeui` \ + gnome-ssh-askpass1.c -o gnome-ssh-askpass1 \ + `gnome-config --libs gnome gnomeui` + + gnome-ssh-askpass2: gnome-ssh-askpass2.c +- $(CC) `$(PKG_CONFIG) --cflags gtk+-2.0` \ ++ $(CC) ${CFLAGS} `$(PKG_CONFIG) --cflags gtk+-2.0` \ + gnome-ssh-askpass2.c -o gnome-ssh-askpass2 \ + `$(PKG_CONFIG) --libs gtk+-2.0 x11` + diff --git a/openssh/patches/openssh-6.1p1-authenticationmethods.patch b/openssh/patches/openssh-6.1p1-authenticationmethods.patch new file mode 100644 index 0000000..7b5a06a --- /dev/null +++ b/openssh/patches/openssh-6.1p1-authenticationmethods.patch @@ -0,0 +1,841 @@ +diff --git a/auth.c b/auth.c +index ee0cb05..1b2fc2b 100644 +--- a/auth.c ++++ b/auth.c +@@ -251,7 +251,8 @@ allowed_user(struct passwd * pw) + } + + void +-auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) ++auth_log(Authctxt *authctxt, int authenticated, int partial, ++ const char *method, const char *submethod, const char *info) + { + void (*authlog) (const char *fmt,...) = verbose; + char *authmsg; +@@ -268,12 +269,15 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) + + if (authctxt->postponed) + authmsg = "Postponed"; ++ else if (partial) ++ authmsg = "Partial"; + else + authmsg = authenticated ? "Accepted" : "Failed"; + +- authlog("%s %s for %s%.100s from %.200s port %d%s", ++ authlog("%s %s%s%s for %s%.100s from %.200s port %d%s", + authmsg, + method, ++ submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, + authctxt->valid ? "" : "invalid user ", + authctxt->user, + get_remote_ipaddr(), +@@ -303,7 +307,7 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info) + * Check whether root logins are disallowed. + */ + int +-auth_root_allowed(char *method) ++auth_root_allowed(const char *method) + { + switch (options.permit_root_login) { + case PERMIT_YES: +diff --git a/auth.h b/auth.h +index 0d786c4..29823bb 100644 +--- a/auth.h ++++ b/auth.h +@@ -64,6 +64,8 @@ struct Authctxt { + #ifdef BSD_AUTH + auth_session_t *as; + #endif ++ char **auth_methods; /* modified from server config */ ++ u_int num_auth_methods; + #ifdef KRB5 + krb5_context krb5_ctx; + krb5_ccache krb5_fwd_ccache; +@@ -142,12 +144,17 @@ void disable_forwarding(void); + void do_authentication(Authctxt *); + void do_authentication2(Authctxt *); + +-void auth_log(Authctxt *, int, char *, char *); +-void userauth_finish(Authctxt *, int, char *); ++void auth_log(Authctxt *, int, int, const char *, const char *, ++ const char *); ++void userauth_finish(Authctxt *, int, const char *, const char *); ++int auth_root_allowed(const char *); ++ + void userauth_send_banner(const char *); +-int auth_root_allowed(char *); + + char *auth2_read_banner(void); ++int auth2_methods_valid(const char *, int); ++int auth2_update_methods_lists(Authctxt *, const char *); ++int auth2_setup_methods_lists(Authctxt *); + + void privsep_challenge_enable(void); + +diff --git a/auth1.c b/auth1.c +index cc85aec..458a110 100644 +--- a/auth1.c ++++ b/auth1.c +@@ -253,7 +253,8 @@ do_authloop(Authctxt *authctxt) + if (options.use_pam && (PRIVSEP(do_pam_account()))) + #endif + { +- auth_log(authctxt, 1, "without authentication", ""); ++ auth_log(authctxt, 1, 0, "without authentication", ++ NULL, ""); + return; + } + } +@@ -352,7 +353,8 @@ do_authloop(Authctxt *authctxt) + + skip: + /* Log before sending the reply */ +- auth_log(authctxt, authenticated, get_authname(type), info); ++ auth_log(authctxt, authenticated, 0, get_authname(type), ++ NULL, info); + + if (client_user != NULL) { + xfree(client_user); +@@ -406,6 +408,11 @@ do_authentication(Authctxt *authctxt) + authctxt->pw = fakepw(); + } + ++ /* Configuration may have changed as a result of Match */ ++ if (options.num_auth_methods != 0) ++ fatal("AuthenticationMethods is not supported with SSH " ++ "protocol 1"); ++ + setproctitle("%s%s", authctxt->valid ? user : "unknown", + use_privsep ? " [net]" : ""); + +diff --git a/auth2-chall.c b/auth2-chall.c +index e6dbffe..5f7ec6d 100644 +--- a/auth2-chall.c ++++ b/auth2-chall.c +@@ -283,7 +283,7 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt) + KbdintAuthctxt *kbdintctxt; + int authenticated = 0, res; + u_int i, nresp; +- char **response = NULL, *method; ++ char *devicename = NULL, **response = NULL; + + if (authctxt == NULL) + fatal("input_userauth_info_response: no authctxt"); +@@ -329,9 +329,7 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt) + /* Failure! */ + break; + } +- +- xasprintf(&method, "keyboard-interactive/%s", kbdintctxt->device->name); +- ++ devicename = kbdintctxt->device->name; + if (!authctxt->postponed) { + if (authenticated) { + auth2_challenge_stop(authctxt); +@@ -341,8 +339,8 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt) + auth2_challenge_start(authctxt); + } + } +- userauth_finish(authctxt, authenticated, method); +- xfree(method); ++ userauth_finish(authctxt, authenticated, "keyboard-interactive", ++ devicename); + } + + void +diff --git a/auth2-gss.c b/auth2-gss.c +index 0d59b21..338c748 100644 +--- a/auth2-gss.c ++++ b/auth2-gss.c +@@ -163,7 +163,7 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt) + } + authctxt->postponed = 0; + dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); +- userauth_finish(authctxt, 0, "gssapi-with-mic"); ++ userauth_finish(authctxt, 0, "gssapi-with-mic", NULL); + } else { + if (send_tok.length != 0) { + packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN); +@@ -251,7 +251,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt) + dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); + dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL); + dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL); +- userauth_finish(authctxt, authenticated, "gssapi-with-mic"); ++ userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL); + } + + static void +@@ -291,7 +291,7 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt) + dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); + dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL); + dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL); +- userauth_finish(authctxt, authenticated, "gssapi-with-mic"); ++ userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL); + } + + Authmethod method_gssapi = { +diff --git a/auth2-jpake.c b/auth2-jpake.c +index a460e82..e4ba9aa 100644 +--- a/auth2-jpake.c ++++ b/auth2-jpake.c +@@ -556,7 +556,7 @@ input_userauth_jpake_client_confirm(int type, u_int32_t seq, void *ctxt) + authctxt->postponed = 0; + jpake_free(authctxt->jpake_ctx); + authctxt->jpake_ctx = NULL; +- userauth_finish(authctxt, authenticated, method_jpake.name); ++ userauth_finish(authctxt, authenticated, method_jpake.name, NULL); + } + + #endif /* JPAKE */ +diff --git a/auth2.c b/auth2.c +index b66bef6..ea0fd92 100644 +--- a/auth2.c ++++ b/auth2.c +@@ -96,8 +96,10 @@ static void input_service_request(int, u_int32_t, void *); + static void input_userauth_request(int, u_int32_t, void *); + + /* helper */ +-static Authmethod *authmethod_lookup(const char *); +-static char *authmethods_get(void); ++static Authmethod *authmethod_lookup(Authctxt *, const char *); ++static char *authmethods_get(Authctxt *authctxt); ++static int method_allowed(Authctxt *, const char *); ++static int list_starts_with(const char *, const char *); + + char * + auth2_read_banner(void) +@@ -255,6 +257,8 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) + if (use_privsep) + mm_inform_authserv(service, style); + userauth_banner(); ++ if (auth2_setup_methods_lists(authctxt) != 0) ++ packet_disconnect("no authentication methods enabled"); + } else if (strcmp(user, authctxt->user) != 0 || + strcmp(service, authctxt->service) != 0) { + packet_disconnect("Change of username or service not allowed: " +@@ -277,12 +281,12 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) + authctxt->server_caused_failure = 0; + + /* try to authenticate user */ +- m = authmethod_lookup(method); ++ m = authmethod_lookup(authctxt, method); + if (m != NULL && authctxt->failures < options.max_authtries) { + debug2("input_userauth_request: try method %s", method); + authenticated = m->userauth(authctxt); + } +- userauth_finish(authctxt, authenticated, method); ++ userauth_finish(authctxt, authenticated, method, NULL); + + xfree(service); + xfree(user); +@@ -290,13 +294,17 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) + } + + void +-userauth_finish(Authctxt *authctxt, int authenticated, char *method) ++userauth_finish(Authctxt *authctxt, int authenticated, const char *method, ++ const char *submethod) + { + char *methods; ++ int partial = 0; + + if (!authctxt->valid && authenticated) + fatal("INTERNAL ERROR: authenticated invalid user %s", + authctxt->user); ++ if (authenticated && authctxt->postponed) ++ fatal("INTERNAL ERROR: authenticated and postponed"); + + /* Special handling for root */ + if (authenticated && authctxt->pw->pw_uid == 0 && +@@ -307,6 +315,19 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) + #endif + } + ++ if (authenticated && options.num_auth_methods != 0) { ++ if (!auth2_update_methods_lists(authctxt, method)) { ++ authenticated = 0; ++ partial = 1; ++ } ++ } ++ ++ /* Log before sending the reply */ ++ auth_log(authctxt, authenticated, partial, method, submethod, " ssh2"); ++ ++ if (authctxt->postponed) ++ return; ++ + #ifdef USE_PAM + if (options.use_pam && authenticated) { + if (!PRIVSEP(do_pam_account())) { +@@ -325,17 +346,10 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) + #ifdef _UNICOS + if (authenticated && cray_access_denied(authctxt->user)) { + authenticated = 0; +- fatal("Access denied for user %s.",authctxt->user); ++ fatal("Access denied for user %s.", authctxt->user); + } + #endif /* _UNICOS */ + +- /* Log before sending the reply */ +- auth_log(authctxt, authenticated, method, " ssh2"); +- +- if (authctxt->postponed) +- return; +- +- /* XXX todo: check if multiple auth methods are needed */ + if (authenticated == 1) { + /* turn off userauth */ + dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore); +@@ -348,7 +362,8 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) + + /* Allow initial try of "none" auth without failure penalty */ + if (!authctxt->server_caused_failure && +- (authctxt->attempt > 1 || strcmp(method, "none") != 0)) ++ (authctxt->attempt > 1 || strcmp(method, "none") != 0) && ++ partial == 0) + authctxt->failures++; + if (authctxt->failures >= options.max_authtries) { + #ifdef SSH_AUDIT_EVENTS +@@ -356,34 +371,61 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) + #endif + packet_disconnect(AUTH_FAIL_MSG, authctxt->user); + } +- methods = authmethods_get(); ++ methods = authmethods_get(authctxt); ++ debug3("%s: failure partial=%d next methods=\"%s\"", __func__, ++ partial, methods); + packet_start(SSH2_MSG_USERAUTH_FAILURE); + packet_put_cstring(methods); +- packet_put_char(0); /* XXX partial success, unused */ ++ packet_put_char(partial); + packet_send(); + packet_write_wait(); + xfree(methods); + } + } + ++/* ++ * Checks whether method is allowed by at least one AuthenticationMethods ++ * methods list. Returns 1 if allowed, or no methods lists configured. ++ * 0 otherwise. ++ */ ++static int ++method_allowed(Authctxt *authctxt, const char *method) ++{ ++ u_int i; ++ ++ /* ++ * NB. authctxt->num_auth_methods might be zero as a result of ++ * auth2_setup_methods_lists(), so check the configuration. ++ */ ++ if (options.num_auth_methods == 0) ++ return 1; ++ for (i = 0; i < authctxt->num_auth_methods; i++) { ++ if (list_starts_with(authctxt->auth_methods[i], method)) ++ return 1; ++ } ++ return 0; ++} ++ + static char * +-authmethods_get(void) ++authmethods_get(Authctxt *authctxt) + { + Buffer b; + char *list; +- int i; ++ u_int i; + + buffer_init(&b); + for (i = 0; authmethods[i] != NULL; i++) { + if (strcmp(authmethods[i]->name, "none") == 0) + continue; +- if (authmethods[i]->enabled != NULL && +- *(authmethods[i]->enabled) != 0) { +- if (buffer_len(&b) > 0) +- buffer_append(&b, ",", 1); +- buffer_append(&b, authmethods[i]->name, +- strlen(authmethods[i]->name)); +- } ++ if (authmethods[i]->enabled == NULL || ++ *(authmethods[i]->enabled) == 0) ++ continue; ++ if (!method_allowed(authctxt, authmethods[i]->name)) ++ continue; ++ if (buffer_len(&b) > 0) ++ buffer_append(&b, ",", 1); ++ buffer_append(&b, authmethods[i]->name, ++ strlen(authmethods[i]->name)); + } + buffer_append(&b, "\0", 1); + list = xstrdup(buffer_ptr(&b)); +@@ -392,7 +434,7 @@ authmethods_get(void) + } + + static Authmethod * +-authmethod_lookup(const char *name) ++authmethod_lookup(Authctxt *authctxt, const char *name) + { + int i; + +@@ -400,10 +442,152 @@ authmethod_lookup(const char *name) + for (i = 0; authmethods[i] != NULL; i++) + if (authmethods[i]->enabled != NULL && + *(authmethods[i]->enabled) != 0 && +- strcmp(name, authmethods[i]->name) == 0) ++ strcmp(name, authmethods[i]->name) == 0 && ++ method_allowed(authctxt, authmethods[i]->name)) + return authmethods[i]; + debug2("Unrecognized authentication method name: %s", + name ? name : "NULL"); + return NULL; + } + ++/* ++ * Check a comma-separated list of methods for validity. Is need_enable is ++ * non-zero, then also require that the methods are enabled. ++ * Returns 0 on success or -1 if the methods list is invalid. ++ */ ++int ++auth2_methods_valid(const char *_methods, int need_enable) ++{ ++ char *methods, *omethods, *method; ++ u_int i, found; ++ int ret = -1; ++ ++ if (*_methods == '\0') { ++ error("empty authentication method list"); ++ return -1; ++ } ++ omethods = methods = xstrdup(_methods); ++ while ((method = strsep(&methods, ",")) != NULL) { ++ for (found = i = 0; !found && authmethods[i] != NULL; i++) { ++ if (strcmp(method, authmethods[i]->name) != 0) ++ continue; ++ if (need_enable) { ++ if (authmethods[i]->enabled == NULL || ++ *(authmethods[i]->enabled) == 0) { ++ error("Disabled method \"%s\" in " ++ "AuthenticationMethods list \"%s\"", ++ method, _methods); ++ goto out; ++ } ++ } ++ found = 1; ++ break; ++ } ++ if (!found) { ++ error("Unknown authentication method \"%s\" in list", ++ method); ++ goto out; ++ } ++ } ++ ret = 0; ++ out: ++ free(omethods); ++ return ret; ++} ++ ++/* ++ * Prune the AuthenticationMethods supplied in the configuration, removing ++ * any methods lists that include disabled methods. Note that this might ++ * leave authctxt->num_auth_methods == 0, even when multiple required auth ++ * has been requested. For this reason, all tests for whether multiple is ++ * enabled should consult options.num_auth_methods directly. ++ */ ++int ++auth2_setup_methods_lists(Authctxt *authctxt) ++{ ++ u_int i; ++ ++ if (options.num_auth_methods == 0) ++ return 0; ++ debug3("%s: checking methods", __func__); ++ authctxt->auth_methods = xcalloc(options.num_auth_methods, ++ sizeof(*authctxt->auth_methods)); ++ authctxt->num_auth_methods = 0; ++ for (i = 0; i < options.num_auth_methods; i++) { ++ if (auth2_methods_valid(options.auth_methods[i], 1) != 0) { ++ logit("Authentication methods list \"%s\" contains " ++ "disabled method, skipping", ++ options.auth_methods[i]); ++ continue; ++ } ++ debug("authentication methods list %d: %s", ++ authctxt->num_auth_methods, options.auth_methods[i]); ++ authctxt->auth_methods[authctxt->num_auth_methods++] = ++ xstrdup(options.auth_methods[i]); ++ } ++ if (authctxt->num_auth_methods == 0) { ++ error("No AuthenticationMethods left after eliminating " ++ "disabled methods"); ++ return -1; ++ } ++ return 0; ++} ++ ++static int ++list_starts_with(const char *methods, const char *method) ++{ ++ size_t l = strlen(method); ++ ++ if (strncmp(methods, method, l) != 0) ++ return 0; ++ if (methods[l] != ',' && methods[l] != '\0') ++ return 0; ++ return 1; ++} ++ ++/* ++ * Remove method from the start of a comma-separated list of methods. ++ * Returns 0 if the list of methods did not start with that method or 1 ++ * if it did. ++ */ ++static int ++remove_method(char **methods, const char *method) ++{ ++ char *omethods = *methods; ++ size_t l = strlen(method); ++ ++ if (!list_starts_with(omethods, method)) ++ return 0; ++ *methods = xstrdup(omethods + l + (omethods[l] == ',' ? 1 : 0)); ++ free(omethods); ++ return 1; ++} ++ ++/* ++ * Called after successful authentication. Will remove the successful method ++ * from the start of each list in which it occurs. If it was the last method ++ * in any list, then authentication is deemed successful. ++ * Returns 1 if the method completed any authentication list or 0 otherwise. ++ */ ++int ++auth2_update_methods_lists(Authctxt *authctxt, const char *method) ++{ ++ u_int i, found = 0; ++ ++ debug3("%s: updating methods list after \"%s\"", __func__, method); ++ for (i = 0; i < authctxt->num_auth_methods; i++) { ++ if (!remove_method(&(authctxt->auth_methods[i]), method)) ++ continue; ++ found = 1; ++ if (*authctxt->auth_methods[i] == '\0') { ++ debug2("authentication methods list %d complete", i); ++ return 1; ++ } ++ debug3("authentication methods list %d remaining: \"%s\"", ++ i, authctxt->auth_methods[i]); ++ } ++ /* This should not happen, but would be bad if it did */ ++ if (!found) ++ fatal("%s: method not in AuthenticationMethods", __func__); ++ return 0; ++} +diff --git a/monitor.c b/monitor.c +index 1dc42f5..66f3eea 100644 +--- a/monitor.c ++++ b/monitor.c +@@ -199,6 +199,7 @@ static int key_blobtype = MM_NOKEY; + static char *hostbased_cuser = NULL; + static char *hostbased_chost = NULL; + static char *auth_method = "unknown"; ++static char *auth_submethod = NULL; + static u_int session_id2_len = 0; + static u_char *session_id2 = NULL; + static pid_t monitor_child_pid; +@@ -352,7 +353,7 @@ void + monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor) + { + struct mon_table *ent; +- int authenticated = 0; ++ int authenticated = 0, partial = 0; + + debug3("preauth child monitor started"); + +@@ -379,8 +380,26 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor) + + /* The first few requests do not require asynchronous access */ + while (!authenticated) { ++ partial = 0; + auth_method = "unknown"; ++ auth_submethod = NULL; + authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1); ++ ++ /* Special handling for multiple required authentications */ ++ if (options.num_auth_methods != 0) { ++ if (!compat20) ++ fatal("AuthenticationMethods is not supported" ++ "with SSH protocol 1"); ++ if (authenticated && ++ !auth2_update_methods_lists(authctxt, ++ auth_method)) { ++ debug3("%s: method %s: partial", __func__, ++ auth_method); ++ authenticated = 0; ++ partial = 1; ++ } ++ } ++ + if (authenticated) { + if (!(ent->flags & MON_AUTHDECIDE)) + fatal("%s: unexpected authentication from %d", +@@ -403,9 +422,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor) + } + + if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) { +- auth_log(authctxt, authenticated, auth_method, ++ auth_log(authctxt, authenticated, partial, ++ auth_method, auth_submethod, + compat20 ? " ssh2" : ""); +- if (!authenticated) ++ if (!authenticated && !partial) + authctxt->failures++; + } + #ifdef JPAKE +@@ -781,7 +801,17 @@ mm_answer_pwnamallow(int sock, Buffer *m) + COPY_MATCH_STRING_OPTS(); + #undef M_CP_STROPT + #undef M_CP_STRARRAYOPT +- ++ ++ /* Create valid auth method lists */ ++ if (compat20 && auth2_setup_methods_lists(authctxt) != 0) { ++ /* ++ * The monitor will continue long enough to let the child ++ * run to it's packet_disconnect(), but it must not allow any ++ * authentication to succeed. ++ */ ++ debug("%s: no valid authentication method lists", __func__); ++ } ++ + debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed); + mm_request_send(sock, MONITOR_ANS_PWNAM, m); + +@@ -918,7 +948,11 @@ mm_answer_bsdauthrespond(int sock, Buffer *m) + debug3("%s: sending authenticated: %d", __func__, authok); + mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m); + +- auth_method = "bsdauth"; ++ if (compat20) ++ auth_method = "keyboard-interactive"; /* XXX auth_submethod */ ++ else ++ auth_method = "bsdauth"; ++ + + return (authok != 0); + } +@@ -1057,7 +1091,9 @@ mm_answer_pam_query(int sock, Buffer *m) + xfree(prompts); + if (echo_on != NULL) + xfree(echo_on); +- auth_method = "keyboard-interactive/pam"; ++ auth_method = "keyboard-interactive"; ++ auth_submethod = "pam"; ++ + mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m); + return (0); + } +@@ -1086,7 +1122,8 @@ mm_answer_pam_respond(int sock, Buffer *m) + buffer_clear(m); + buffer_put_int(m, ret); + mm_request_send(sock, MONITOR_ANS_PAM_RESPOND, m); +- auth_method = "keyboard-interactive/pam"; ++ auth_method = "keyboard-interactive"; ++ auth_submethod= "pam"; + if (ret == 0) + sshpam_authok = sshpam_ctxt; + return (0); +@@ -1100,7 +1137,8 @@ mm_answer_pam_free_ctx(int sock, Buffer *m) + (sshpam_device.free_ctx)(sshpam_ctxt); + buffer_clear(m); + mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); +- auth_method = "keyboard-interactive/pam"; ++ auth_method = "keyboard-interactive"; ++ auth_submethod = "pam"; + return (sshpam_authok == sshpam_ctxt); + } + #endif +@@ -1178,7 +1216,8 @@ mm_answer_keyallowed(int sock, Buffer *m) + hostbased_chost = chost; + } else { + /* Log failed attempt */ +- auth_log(authctxt, 0, auth_method, compat20 ? " ssh2" : ""); ++ auth_log(authctxt, 0, 0, auth_method, NULL, ++ compat20 ? " ssh2" : ""); + xfree(blob); + xfree(cuser); + xfree(chost); +diff --git a/servconf.c b/servconf.c +index 906778f..2c84993 100644 +--- a/servconf.c ++++ b/servconf.c +@@ -48,6 +48,8 @@ + #include "groupaccess.h" + #include "canohost.h" + #include "packet.h" ++#include "hostfile.h" ++#include "auth.h" + + static void add_listen_addr(ServerOptions *, char *, int); + static void add_one_listen_addr(ServerOptions *, char *, int); +@@ -329,6 +331,7 @@ typedef enum { + sZeroKnowledgePasswordAuthentication, sHostCertificate, + sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, + sKexAlgorithms, sIPQoS, sVersionAddendum, ++ sAuthenticationMethods, + sDeprecated, sUnsupported + } ServerOpCodes; + +@@ -454,6 +457,7 @@ static struct { + { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, + { "ipqos", sIPQoS, SSHCFG_ALL }, + { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, ++ { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, + { NULL, sBadOption, 0 } + }; + +@@ -1498,6 +1502,24 @@ process_server_config_line(ServerOptions *options, char *line, + } + return 0; + ++ case sAuthenticationMethods: ++ if (*activep && options->num_auth_methods == 0) { ++ while ((arg = strdelim(&cp)) && *arg != '\0') { ++ if (options->num_auth_methods >= ++ MAX_AUTH_METHODS) ++ fatal("%s line %d: " ++ "too many authentication methods.", ++ filename, linenum); ++ if (auth2_methods_valid(arg, 0) != 0) ++ fatal("%s line %d: invalid " ++ "authentication method list.", ++ filename, linenum); ++ options->auth_methods[ ++ options->num_auth_methods++] = xstrdup(arg); ++ } ++ } ++ return 0; ++ + case sDeprecated: + logit("%s line %d: Deprecated option %s", + filename, linenum, arg); +@@ -1925,6 +1947,8 @@ dump_config(ServerOptions *o) + dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups); + dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups); + dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env); ++ dump_cfg_strarray_oneline(sAuthenticationMethods, ++ o->num_auth_methods, o->auth_methods); + + /* other arguments */ + for (i = 0; i < o->num_subsystems; i++) +diff --git a/servconf.h b/servconf.h +index 096d596..ef80eef 100644 +--- a/servconf.h ++++ b/servconf.h +@@ -28,6 +28,7 @@ + #define MAX_ACCEPT_ENV 256 /* Max # of env vars. */ + #define MAX_MATCH_GROUPS 256 /* Max # of groups for Match. */ + #define MAX_AUTHKEYS_FILES 256 /* Max # of authorized_keys files. */ ++#define MAX_AUTH_METHODS 256 /* Max # of AuthenticationMethods. */ + + /* permit_root_login */ + #define PERMIT_NOT_SET -1 +@@ -168,6 +169,9 @@ typedef struct { + char *authorized_principals_file; + + char *version_addendum; /* Appended to SSH banner */ ++ ++ u_int num_auth_methods; ++ char *auth_methods[MAX_AUTH_METHODS]; + } ServerOptions; + + /* Information about the incoming connection as used by Match */ +@@ -197,6 +201,7 @@ struct connection_info { + M_CP_STRARRAYOPT(allow_groups, num_allow_groups); \ + M_CP_STRARRAYOPT(deny_groups, num_deny_groups); \ + M_CP_STRARRAYOPT(accept_env, num_accept_env); \ ++ M_CP_STRARRAYOPT(auth_methods, num_auth_methods); \ + } while (0) + + struct connection_info *get_connection_info(int, int); +diff --git a/sshd.c b/sshd.c +index d5ec4e6..cb4bdd3 100644 +--- a/sshd.c ++++ b/sshd.c +@@ -1333,6 +1333,7 @@ main(int ac, char **av) + int remote_port; + char *line; + int config_s[2] = { -1 , -1 }; ++ u_int n; + u_int64_t ibytes, obytes; + mode_t new_umask; + Key *key; +@@ -1555,6 +1556,26 @@ main(int ac, char **av) + if (options.challenge_response_authentication) + options.kbd_interactive_authentication = 1; + ++ /* ++ * Check whether there is any path through configured auth methods. ++ * Unfortunately it is not possible to verify this generally before ++ * daemonisation in the presence of Match block, but this catches ++ * and warns for trivial misconfigurations that could break login. ++ */ ++ if (options.num_auth_methods != 0) { ++ if ((options.protocol & SSH_PROTO_1)) ++ fatal("AuthenticationMethods is not supported with " ++ "SSH protocol 1"); ++ for (n = 0; n < options.num_auth_methods; n++) { ++ if (auth2_methods_valid(options.auth_methods[n], ++ 1) == 0) ++ break; ++ } ++ if (n >= options.num_auth_methods) ++ fatal("AuthenticationMethods cannot be satisfied by " ++ "enabled authentication methods"); ++ } ++ + /* set default channel AF */ + channel_set_af(options.address_family); + +diff --git a/sshd_config.5 b/sshd_config.5 +index 314ecfb..ed81ac8 100644 +--- a/sshd_config.5 ++++ b/sshd_config.5 +@@ -151,6 +151,28 @@ See + in + .Xr ssh_config 5 + for more information on patterns. ++.It Cm AuthenticationMethods ++Specifies the authentication methods that must be successfully completed ++for a user to be granted access. ++This option must be followed by one or more comma-separated lists of ++authentication method names. ++Successful authentication requires completion of every method in at least ++one of these lists. ++.Pp ++For example, an argument of ++.Dq publickey,password publickey,keyboard-interactive ++would require the user to complete public key authentication, followed by ++either password or keyboard interactive authentication. ++Only methods that are next in one or more lists are offered at each stage, ++so for this example, it would not be possible to attempt password or ++keyboard-interactive authentication before public key. ++.Pp ++This option is only available for SSH protocol 2 and will yield a fatal ++error if enabled if protocol 1 is also enabled. ++Note that each authentication method listed should also be explicitly enabled ++in the configuration. ++The default is not to require multiple authentication; successful completion ++of a single authentication method is sufficient. + .It Cm AuthorizedKeysFile + Specifies the file that contains the public keys that can be used + for user authentication. +@@ -711,6 +733,7 @@ Available keywords are + .Cm AllowGroups , + .Cm AllowTcpForwarding , + .Cm AllowUsers , ++.Cm AuthenticationMethods , + .Cm AuthorizedKeysFile , + .Cm AuthorizedPrincipalsFile , + .Cm Banner , diff --git a/openssh/patches/openssh-6.1p1-coverity.patch b/openssh/patches/openssh-6.1p1-coverity.patch new file mode 100644 index 0000000..0c8fb23 --- /dev/null +++ b/openssh/patches/openssh-6.1p1-coverity.patch @@ -0,0 +1,806 @@ +diff -up openssh-6.1p1/auth-pam.c.coverity openssh-6.1p1/auth-pam.c +--- openssh-6.1p1/auth-pam.c.coverity 2009-07-12 14:07:21.000000000 +0200 ++++ openssh-6.1p1/auth-pam.c 2012-09-14 21:16:41.264906486 +0200 +@@ -216,7 +216,12 @@ pthread_join(sp_pthread_t thread, void * + if (sshpam_thread_status != -1) + return (sshpam_thread_status); + signal(SIGCHLD, sshpam_oldsig); +- waitpid(thread, &status, 0); ++ while (waitpid(thread, &status, 0) < 0) { ++ if (errno == EINTR) ++ continue; ++ fatal("%s: waitpid: %s", __func__, ++ strerror(errno)); ++ } + return (status); + } + #endif +diff -up openssh-6.1p1/clientloop.c.coverity openssh-6.1p1/clientloop.c +--- openssh-6.1p1/clientloop.c.coverity 2012-06-20 14:31:27.000000000 +0200 ++++ openssh-6.1p1/clientloop.c 2012-09-14 21:16:41.267906501 +0200 +@@ -2006,14 +2006,15 @@ client_input_global_request(int type, u_ + char *rtype; + int want_reply; + int success = 0; ++/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */ + + rtype = packet_get_string(NULL); + want_reply = packet_get_char(); + debug("client_input_global_request: rtype %s want_reply %d", + rtype, want_reply); + if (want_reply) { +- packet_start(success ? +- SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE); ++ packet_start(/*success ? ++ SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE); + packet_send(); + packet_write_wait(); + } +diff -up openssh-6.1p1/channels.c.coverity openssh-6.1p1/channels.c +--- openssh-6.1p1/channels.c.coverity 2012-04-23 10:21:05.000000000 +0200 ++++ openssh-6.1p1/channels.c 2012-09-14 21:16:41.272906528 +0200 +@@ -232,11 +232,11 @@ channel_register_fds(Channel *c, int rfd + channel_max_fd = MAX(channel_max_fd, wfd); + channel_max_fd = MAX(channel_max_fd, efd); + +- if (rfd != -1) ++ if (rfd >= 0) + fcntl(rfd, F_SETFD, FD_CLOEXEC); +- if (wfd != -1 && wfd != rfd) ++ if (wfd >= 0 && wfd != rfd) + fcntl(wfd, F_SETFD, FD_CLOEXEC); +- if (efd != -1 && efd != rfd && efd != wfd) ++ if (efd >= 0 && efd != rfd && efd != wfd) + fcntl(efd, F_SETFD, FD_CLOEXEC); + + c->rfd = rfd; +@@ -251,11 +251,11 @@ channel_register_fds(Channel *c, int rfd + + /* enable nonblocking mode */ + if (nonblock) { +- if (rfd != -1) ++ if (rfd >= 0) + set_nonblock(rfd); +- if (wfd != -1) ++ if (wfd >= 0) + set_nonblock(wfd); +- if (efd != -1) ++ if (efd >= 0) + set_nonblock(efd); + } + } +diff -up openssh-6.1p1/key.c.coverity openssh-6.1p1/key.c +--- openssh-6.1p1/key.c.coverity 2012-06-30 12:05:02.000000000 +0200 ++++ openssh-6.1p1/key.c 2012-09-14 21:16:41.274906537 +0200 +@@ -808,8 +808,10 @@ key_read(Key *ret, char **cpp) + success = 1; + /*XXXX*/ + key_free(k); ++/*XXXX + if (success != 1) + break; ++XXXX*/ + /* advance cp: skip whitespace and data */ + while (*cp == ' ' || *cp == '\t') + cp++; +diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c +--- openssh-6.1p1/monitor.c.coverity 2012-06-30 00:33:17.000000000 +0200 ++++ openssh-6.1p1/monitor.c 2012-09-14 21:16:41.277906552 +0200 +@@ -420,7 +420,7 @@ monitor_child_preauth(Authctxt *_authctx + } + + /* Drain any buffered messages from the child */ +- while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0) ++ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0) + ; + + if (!authctxt->valid) +@@ -1159,6 +1159,10 @@ mm_answer_keyallowed(int sock, Buffer *m + break; + } + } ++ ++ debug3("%s: key %p is %s", ++ __func__, key, allowed ? "allowed" : "not allowed"); ++ + if (key != NULL) + key_free(key); + +@@ -1180,9 +1184,6 @@ mm_answer_keyallowed(int sock, Buffer *m + xfree(chost); + } + +- debug3("%s: key %p is %s", +- __func__, key, allowed ? "allowed" : "not allowed"); +- + buffer_clear(m); + buffer_put_int(m, allowed); + buffer_put_int(m, forced_command != NULL); +diff -up openssh-6.1p1/monitor_wrap.c.coverity openssh-6.1p1/monitor_wrap.c +--- openssh-6.1p1/monitor_wrap.c.coverity 2011-06-20 06:42:23.000000000 +0200 ++++ openssh-6.1p1/monitor_wrap.c 2012-09-14 21:16:41.280906568 +0200 +@@ -707,10 +707,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, + if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 || + (tmp2 = dup(pmonitor->m_recvfd)) == -1) { + error("%s: cannot allocate fds for pty", __func__); +- if (tmp1 > 0) ++ if (tmp1 >= 0) + close(tmp1); +- if (tmp2 > 0) +- close(tmp2); ++ /*DEAD CODE if (tmp2 >= 0) ++ close(tmp2);*/ + return 0; + } + close(tmp1); +diff -up openssh-6.1p1/openbsd-compat/bindresvport.c.coverity openssh-6.1p1/openbsd-compat/bindresvport.c +--- openssh-6.1p1/openbsd-compat/bindresvport.c.coverity 2010-12-03 00:50:26.000000000 +0100 ++++ openssh-6.1p1/openbsd-compat/bindresvport.c 2012-09-14 21:16:41.281906573 +0200 +@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr + struct sockaddr_in6 *in6; + u_int16_t *portp; + u_int16_t port; +- socklen_t salen; ++ socklen_t salen = sizeof(struct sockaddr_storage); + int i; + + if (sa == NULL) { +diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c +--- openssh-6.1p1/packet.c.coverity 2012-03-09 00:28:07.000000000 +0100 ++++ openssh-6.1p1/packet.c 2012-09-14 21:16:41.284906588 +0200 +@@ -1177,6 +1177,7 @@ packet_read_poll1(void) + case DEATTACK_DETECTED: + packet_disconnect("crc32 compensation attack: " + "network attack detected"); ++ break; + case DEATTACK_DOS_DETECTED: + packet_disconnect("deattack denial of " + "service detected"); +@@ -1678,7 +1679,7 @@ void + packet_write_wait(void) + { + fd_set *setp; +- int ret, ms_remain; ++ int ret, ms_remain = 0; + struct timeval start, timeout, *timeoutp = NULL; + + setp = (fd_set *)xcalloc(howmany(active_state->connection_out + 1, +diff -up openssh-6.1p1/progressmeter.c.coverity openssh-6.1p1/progressmeter.c +--- openssh-6.1p1/progressmeter.c.coverity 2006-08-05 04:39:40.000000000 +0200 ++++ openssh-6.1p1/progressmeter.c 2012-09-14 21:16:41.285906593 +0200 +@@ -65,7 +65,7 @@ static void update_progress_meter(int); + + static time_t start; /* start progress */ + static time_t last_update; /* last progress update */ +-static char *file; /* name of the file being transferred */ ++static const char *file; /* name of the file being transferred */ + static off_t end_pos; /* ending position of transfer */ + static off_t cur_pos; /* transfer position as of last refresh */ + static volatile off_t *counter; /* progress counter */ +@@ -247,7 +247,7 @@ update_progress_meter(int ignore) + } + + void +-start_progress_meter(char *f, off_t filesize, off_t *ctr) ++start_progress_meter(const char *f, off_t filesize, off_t *ctr) + { + start = last_update = time(NULL); + file = f; +diff -up openssh-6.1p1/progressmeter.h.coverity openssh-6.1p1/progressmeter.h +--- openssh-6.1p1/progressmeter.h.coverity 2006-03-26 05:30:02.000000000 +0200 ++++ openssh-6.1p1/progressmeter.h 2012-09-14 21:16:41.286906598 +0200 +@@ -23,5 +23,5 @@ + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +-void start_progress_meter(char *, off_t, off_t *); ++void start_progress_meter(const char *, off_t, off_t *); + void stop_progress_meter(void); +diff -up openssh-6.1p1/scp.c.coverity openssh-6.1p1/scp.c +--- openssh-6.1p1/scp.c.coverity 2011-09-22 13:38:01.000000000 +0200 ++++ openssh-6.1p1/scp.c 2012-09-14 21:16:41.288906608 +0200 +@@ -155,7 +155,7 @@ killchild(int signo) + { + if (do_cmd_pid > 1) { + kill(do_cmd_pid, signo ? signo : SIGTERM); +- waitpid(do_cmd_pid, NULL, 0); ++ (void) waitpid(do_cmd_pid, NULL, 0); + } + + if (signo) +diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c +--- openssh-6.1p1/servconf.c.coverity 2012-07-31 04:22:38.000000000 +0200 ++++ openssh-6.1p1/servconf.c 2012-09-14 21:16:41.291906623 +0200 +@@ -1249,7 +1249,7 @@ process_server_config_line(ServerOptions + fatal("%s line %d: Missing subsystem name.", + filename, linenum); + if (!*activep) { +- arg = strdelim(&cp); ++ /*arg =*/ (void) strdelim(&cp); + break; + } + for (i = 0; i < options->num_subsystems; i++) +@@ -1340,8 +1340,9 @@ process_server_config_line(ServerOptions + if (*activep && *charptr == NULL) { + *charptr = tilde_expand_filename(arg, getuid()); + /* increase optional counter */ +- if (intptr != NULL) +- *intptr = *intptr + 1; ++ /* DEAD CODE intptr is still NULL ;) ++ if (intptr != NULL) ++ *intptr = *intptr + 1; */ + } + break; + +diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c +--- openssh-6.1p1/serverloop.c.coverity 2012-06-20 14:31:27.000000000 +0200 ++++ openssh-6.1p1/serverloop.c 2012-09-14 21:16:41.294906638 +0200 +@@ -147,13 +147,13 @@ notify_setup(void) + static void + notify_parent(void) + { +- if (notify_pipe[1] != -1) ++ if (notify_pipe[1] >= 0) + write(notify_pipe[1], "", 1); + } + static void + notify_prepare(fd_set *readset) + { +- if (notify_pipe[0] != -1) ++ if (notify_pipe[0] >= 0) + FD_SET(notify_pipe[0], readset); + } + static void +@@ -161,8 +161,8 @@ notify_done(fd_set *readset) + { + char c; + +- if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) +- while (read(notify_pipe[0], &c, 1) != -1) ++ if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) ++ while (read(notify_pipe[0], &c, 1) >= 0) + debug2("notify_done: reading"); + } + +@@ -336,7 +336,7 @@ wait_until_can_do_something(fd_set **rea + * If we have buffered data, try to write some of that data + * to the program. + */ +- if (fdin != -1 && buffer_len(&stdin_buffer) > 0) ++ if (fdin >= 0 && buffer_len(&stdin_buffer) > 0) + FD_SET(fdin, *writesetp); + } + notify_prepare(*readsetp); +@@ -476,7 +476,7 @@ process_output(fd_set *writeset) + int len; + + /* Write buffered data to program stdin. */ +- if (!compat20 && fdin != -1 && FD_ISSET(fdin, writeset)) { ++ if (!compat20 && fdin >= 0 && FD_ISSET(fdin, writeset)) { + data = buffer_ptr(&stdin_buffer); + dlen = buffer_len(&stdin_buffer); + len = write(fdin, data, dlen); +@@ -589,7 +589,7 @@ server_loop(pid_t pid, int fdin_arg, int + set_nonblock(fdin); + set_nonblock(fdout); + /* we don't have stderr for interactive terminal sessions, see below */ +- if (fderr != -1) ++ if (fderr >= 0) + set_nonblock(fderr); + + if (!(datafellows & SSH_BUG_IGNOREMSG) && isatty(fdin)) +@@ -613,7 +613,7 @@ server_loop(pid_t pid, int fdin_arg, int + max_fd = MAX(connection_in, connection_out); + max_fd = MAX(max_fd, fdin); + max_fd = MAX(max_fd, fdout); +- if (fderr != -1) ++ if (fderr >= 0) + max_fd = MAX(max_fd, fderr); + #endif + +@@ -643,7 +643,7 @@ server_loop(pid_t pid, int fdin_arg, int + * If we have received eof, and there is no more pending + * input data, cause a real eof by closing fdin. + */ +- if (stdin_eof && fdin != -1 && buffer_len(&stdin_buffer) == 0) { ++ if (stdin_eof && fdin >= 0 && buffer_len(&stdin_buffer) == 0) { + if (fdin != fdout) + close(fdin); + else +@@ -741,15 +741,15 @@ server_loop(pid_t pid, int fdin_arg, int + buffer_free(&stderr_buffer); + + /* Close the file descriptors. */ +- if (fdout != -1) ++ if (fdout >= 0) + close(fdout); + fdout = -1; + fdout_eof = 1; +- if (fderr != -1) ++ if (fderr >= 0) + close(fderr); + fderr = -1; + fderr_eof = 1; +- if (fdin != -1) ++ if (fdin >= 0) + close(fdin); + fdin = -1; + +@@ -943,7 +943,7 @@ server_input_window_size(int type, u_int + + debug("Window change received."); + packet_check_eom(); +- if (fdin != -1) ++ if (fdin >= 0) + pty_change_window_size(fdin, row, col, xpixel, ypixel); + } + +@@ -996,7 +996,7 @@ server_request_tun(void) + } + + tun = packet_get_int(); +- if (forced_tun_device != -1) { ++ if (forced_tun_device >= 0) { + if (tun != SSH_TUNID_ANY && forced_tun_device != tun) + goto done; + tun = forced_tun_device; +diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c +--- openssh-6.1p1/sftp.c.coverity 2012-06-30 00:33:32.000000000 +0200 ++++ openssh-6.1p1/sftp.c 2012-09-14 21:16:41.297906653 +0200 +@@ -206,7 +206,7 @@ killchild(int signo) + { + if (sshpid > 1) { + kill(sshpid, SIGTERM); +- waitpid(sshpid, NULL, 0); ++ (void) waitpid(sshpid, NULL, 0); + } + + _exit(1); +@@ -316,7 +316,7 @@ local_do_ls(const char *args) + + /* Strip one path (usually the pwd) from the start of another */ + static char * +-path_strip(char *path, char *strip) ++path_strip(const char *path, const char *strip) + { + size_t len; + +@@ -334,7 +334,7 @@ path_strip(char *path, char *strip) + } + + static char * +-make_absolute(char *p, char *pwd) ++make_absolute(char *p, const char *pwd) + { + char *abs_str; + +@@ -482,7 +482,7 @@ parse_df_flags(const char *cmd, char **a + } + + static int +-is_dir(char *path) ++is_dir(const char *path) + { + struct stat sb; + +@@ -494,7 +494,7 @@ is_dir(char *path) + } + + static int +-remote_is_dir(struct sftp_conn *conn, char *path) ++remote_is_dir(struct sftp_conn *conn, const char *path) + { + Attrib *a; + +@@ -508,7 +508,7 @@ remote_is_dir(struct sftp_conn *conn, ch + + /* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */ + static int +-pathname_is_dir(char *pathname) ++pathname_is_dir(const char *pathname) + { + size_t l = strlen(pathname); + +@@ -516,7 +516,7 @@ pathname_is_dir(char *pathname) + } + + static int +-process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd, ++process_get(struct sftp_conn *conn, const char *src, const char *dst, const char *pwd, + int pflag, int rflag) + { + char *abs_src = NULL; +@@ -590,7 +590,7 @@ out: + } + + static int +-process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, ++process_put(struct sftp_conn *conn, const char *src, const char *dst, const char *pwd, + int pflag, int rflag) + { + char *tmp_dst = NULL; +@@ -695,7 +695,7 @@ sdirent_comp(const void *aa, const void + + /* sftp ls.1 replacement for directories */ + static int +-do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag) ++do_ls_dir(struct sftp_conn *conn, const char *path, const char *strip_path, int lflag) + { + int n; + u_int c = 1, colspace = 0, columns = 1; +@@ -780,7 +780,7 @@ do_ls_dir(struct sftp_conn *conn, char * + + /* sftp ls.1 replacement which handles path globs */ + static int +-do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path, ++do_globbed_ls(struct sftp_conn *conn, const char *path, const char *strip_path, + int lflag) + { + char *fname, *lname; +@@ -861,7 +861,7 @@ do_globbed_ls(struct sftp_conn *conn, ch + } + + static int +-do_df(struct sftp_conn *conn, char *path, int hflag, int iflag) ++do_df(struct sftp_conn *conn, const char *path, int hflag, int iflag) + { + struct sftp_statvfs st; + char s_used[FMT_SCALED_STRSIZE]; +diff -up openssh-6.1p1/sftp-client.c.coverity openssh-6.1p1/sftp-client.c +--- openssh-6.1p1/sftp-client.c.coverity 2012-07-02 14:15:39.000000000 +0200 ++++ openssh-6.1p1/sftp-client.c 2012-09-14 21:18:16.891332281 +0200 +@@ -149,7 +149,7 @@ get_msg(struct sftp_conn *conn, Buffer * + } + + static void +-send_string_request(struct sftp_conn *conn, u_int id, u_int code, char *s, ++send_string_request(struct sftp_conn *conn, u_int id, u_int code, const char *s, + u_int len) + { + Buffer msg; +@@ -165,7 +165,7 @@ send_string_request(struct sftp_conn *co + + static void + send_string_attrs_request(struct sftp_conn *conn, u_int id, u_int code, +- char *s, u_int len, Attrib *a) ++ const char *s, u_int len, Attrib *a) + { + Buffer msg; + +@@ -422,7 +422,7 @@ sftp_proto_version(struct sftp_conn *con + } + + int +-do_close(struct sftp_conn *conn, char *handle, u_int handle_len) ++do_close(struct sftp_conn *conn, const char *handle, u_int handle_len) + { + u_int id, status; + Buffer msg; +@@ -447,7 +447,7 @@ do_close(struct sftp_conn *conn, char *h + + + static int +-do_lsreaddir(struct sftp_conn *conn, char *path, int printflag, ++do_lsreaddir(struct sftp_conn *conn, const char *path, int printflag, + SFTP_DIRENT ***dir) + { + Buffer msg; +@@ -572,7 +572,7 @@ do_lsreaddir(struct sftp_conn *conn, cha + } + + int +-do_readdir(struct sftp_conn *conn, char *path, SFTP_DIRENT ***dir) ++do_readdir(struct sftp_conn *conn, const char *path, SFTP_DIRENT ***dir) + { + return(do_lsreaddir(conn, path, 0, dir)); + } +@@ -590,7 +590,7 @@ void free_sftp_dirents(SFTP_DIRENT **s) + } + + int +-do_rm(struct sftp_conn *conn, char *path) ++do_rm(struct sftp_conn *conn, const char *path) + { + u_int status, id; + +@@ -605,7 +605,7 @@ do_rm(struct sftp_conn *conn, char *path + } + + int +-do_mkdir(struct sftp_conn *conn, char *path, Attrib *a, int printflag) ++do_mkdir(struct sftp_conn *conn, const char *path, Attrib *a, int printflag) + { + u_int status, id; + +@@ -621,7 +621,7 @@ do_mkdir(struct sftp_conn *conn, char *p + } + + int +-do_rmdir(struct sftp_conn *conn, char *path) ++do_rmdir(struct sftp_conn *conn, const char *path) + { + u_int status, id; + +@@ -637,7 +637,7 @@ do_rmdir(struct sftp_conn *conn, char *p + } + + Attrib * +-do_stat(struct sftp_conn *conn, char *path, int quiet) ++do_stat(struct sftp_conn *conn, const char *path, int quiet) + { + u_int id; + +@@ -651,7 +651,7 @@ do_stat(struct sftp_conn *conn, char *pa + } + + Attrib * +-do_lstat(struct sftp_conn *conn, char *path, int quiet) ++do_lstat(struct sftp_conn *conn, const char *path, int quiet) + { + u_int id; + +@@ -685,7 +685,7 @@ do_fstat(struct sftp_conn *conn, char *h + #endif + + int +-do_setstat(struct sftp_conn *conn, char *path, Attrib *a) ++do_setstat(struct sftp_conn *conn, const char *path, Attrib *a) + { + u_int status, id; + +@@ -702,7 +702,7 @@ do_setstat(struct sftp_conn *conn, char + } + + int +-do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len, ++do_fsetstat(struct sftp_conn *conn, const char *handle, u_int handle_len, + Attrib *a) + { + u_int status, id; +@@ -719,7 +719,7 @@ do_fsetstat(struct sftp_conn *conn, char + } + + char * +-do_realpath(struct sftp_conn *conn, char *path) ++do_realpath(struct sftp_conn *conn, const char *path) + { + Buffer msg; + u_int type, expected_id, count, id; +@@ -768,7 +768,7 @@ do_realpath(struct sftp_conn *conn, char + } + + int +-do_rename(struct sftp_conn *conn, char *oldpath, char *newpath) ++do_rename(struct sftp_conn *conn, const char *oldpath, const char *newpath) + { + Buffer msg; + u_int status, id; +@@ -802,7 +802,7 @@ do_rename(struct sftp_conn *conn, char * + } + + int +-do_hardlink(struct sftp_conn *conn, char *oldpath, char *newpath) ++do_hardlink(struct sftp_conn *conn, const char *oldpath, const char *newpath) + { + Buffer msg; + u_int status, id; +@@ -835,7 +835,7 @@ do_hardlink(struct sftp_conn *conn, char + } + + int +-do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath) ++do_symlink(struct sftp_conn *conn, const char *oldpath, const char *newpath) + { + Buffer msg; + u_int status, id; +@@ -987,7 +987,7 @@ send_read_request(struct sftp_conn *conn + } + + int +-do_download(struct sftp_conn *conn, char *remote_path, char *local_path, ++do_download(struct sftp_conn *conn, const char *remote_path, const char *local_path, + Attrib *a, int pflag) + { + Attrib junk; +@@ -1226,7 +1226,7 @@ do_download(struct sftp_conn *conn, char + } + + static int +-download_dir_internal(struct sftp_conn *conn, char *src, char *dst, ++download_dir_internal(struct sftp_conn *conn, const char *src, const char *dst, + Attrib *dirattrib, int pflag, int printflag, int depth) + { + int i, ret = 0; +@@ -1316,7 +1316,7 @@ download_dir_internal(struct sftp_conn * + } + + int +-download_dir(struct sftp_conn *conn, char *src, char *dst, ++download_dir(struct sftp_conn *conn, const char *src, const char *dst, + Attrib *dirattrib, int pflag, int printflag) + { + char *src_canon; +@@ -1334,7 +1334,7 @@ download_dir(struct sftp_conn *conn, cha + } + + int +-do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, ++do_upload(struct sftp_conn *conn, const char *local_path, const char *remote_path, + int pflag) + { + int local_fd; +@@ -1517,7 +1517,7 @@ do_upload(struct sftp_conn *conn, char * + } + + static int +-upload_dir_internal(struct sftp_conn *conn, char *src, char *dst, ++upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst, + int pflag, int printflag, int depth) + { + int ret = 0, status; +@@ -1608,7 +1608,7 @@ upload_dir_internal(struct sftp_conn *co + } + + int +-upload_dir(struct sftp_conn *conn, char *src, char *dst, int printflag, ++upload_dir(struct sftp_conn *conn, const char *src, const char *dst, int printflag, + int pflag) + { + char *dst_canon; +@@ -1625,7 +1625,7 @@ upload_dir(struct sftp_conn *conn, char + } + + char * +-path_append(char *p1, char *p2) ++path_append(const char *p1, const char *p2) + { + char *ret; + size_t len = strlen(p1) + strlen(p2) + 2; +diff -up openssh-6.1p1/sftp-client.h.coverity openssh-6.1p1/sftp-client.h +--- openssh-6.1p1/sftp-client.h.coverity 2010-12-04 23:02:48.000000000 +0100 ++++ openssh-6.1p1/sftp-client.h 2012-09-14 21:16:41.301906674 +0200 +@@ -56,49 +56,49 @@ struct sftp_conn *do_init(int, int, u_in + u_int sftp_proto_version(struct sftp_conn *); + + /* Close file referred to by 'handle' */ +-int do_close(struct sftp_conn *, char *, u_int); ++int do_close(struct sftp_conn *, const char *, u_int); + + /* Read contents of 'path' to NULL-terminated array 'dir' */ +-int do_readdir(struct sftp_conn *, char *, SFTP_DIRENT ***); ++int do_readdir(struct sftp_conn *, const char *, SFTP_DIRENT ***); + + /* Frees a NULL-terminated array of SFTP_DIRENTs (eg. from do_readdir) */ + void free_sftp_dirents(SFTP_DIRENT **); + + /* Delete file 'path' */ +-int do_rm(struct sftp_conn *, char *); ++int do_rm(struct sftp_conn *, const char *); + + /* Create directory 'path' */ +-int do_mkdir(struct sftp_conn *, char *, Attrib *, int); ++int do_mkdir(struct sftp_conn *, const char *, Attrib *, int); + + /* Remove directory 'path' */ +-int do_rmdir(struct sftp_conn *, char *); ++int do_rmdir(struct sftp_conn *, const char *); + + /* Get file attributes of 'path' (follows symlinks) */ +-Attrib *do_stat(struct sftp_conn *, char *, int); ++Attrib *do_stat(struct sftp_conn *, const char *, int); + + /* Get file attributes of 'path' (does not follow symlinks) */ +-Attrib *do_lstat(struct sftp_conn *, char *, int); ++Attrib *do_lstat(struct sftp_conn *, const char *, int); + + /* Set file attributes of 'path' */ +-int do_setstat(struct sftp_conn *, char *, Attrib *); ++int do_setstat(struct sftp_conn *, const char *, Attrib *); + + /* Set file attributes of open file 'handle' */ +-int do_fsetstat(struct sftp_conn *, char *, u_int, Attrib *); ++int do_fsetstat(struct sftp_conn *, const char *, u_int, Attrib *); + + /* Canonicalise 'path' - caller must free result */ +-char *do_realpath(struct sftp_conn *, char *); ++char *do_realpath(struct sftp_conn *, const char *); + + /* Get statistics for filesystem hosting file at "path" */ + int do_statvfs(struct sftp_conn *, const char *, struct sftp_statvfs *, int); + + /* Rename 'oldpath' to 'newpath' */ +-int do_rename(struct sftp_conn *, char *, char *); ++int do_rename(struct sftp_conn *, const char *, const char *); + + /* Link 'oldpath' to 'newpath' */ +-int do_hardlink(struct sftp_conn *, char *, char *); ++int do_hardlink(struct sftp_conn *, const char *, const char *); + +-/* Rename 'oldpath' to 'newpath' */ +-int do_symlink(struct sftp_conn *, char *, char *); ++/* Symlink 'oldpath' to 'newpath' */ ++int do_symlink(struct sftp_conn *, const char *, const char *); + + /* XXX: add callbacks to do_download/do_upload so we can do progress meter */ + +@@ -106,27 +106,27 @@ int do_symlink(struct sftp_conn *, char + * Download 'remote_path' to 'local_path'. Preserve permissions and times + * if 'pflag' is set + */ +-int do_download(struct sftp_conn *, char *, char *, Attrib *, int); ++int do_download(struct sftp_conn *, const char *, const char *, Attrib *, int); + + /* + * Recursively download 'remote_directory' to 'local_directory'. Preserve + * times if 'pflag' is set + */ +-int download_dir(struct sftp_conn *, char *, char *, Attrib *, int, int); ++int download_dir(struct sftp_conn *, const char *, const char *, Attrib *, int, int); + + /* + * Upload 'local_path' to 'remote_path'. Preserve permissions and times + * if 'pflag' is set + */ +-int do_upload(struct sftp_conn *, char *, char *, int); ++int do_upload(struct sftp_conn *, const char *, const char *, int); + + /* + * Recursively upload 'local_directory' to 'remote_directory'. Preserve + * times if 'pflag' is set + */ +-int upload_dir(struct sftp_conn *, char *, char *, int, int); ++int upload_dir(struct sftp_conn *, const char *, const char *, int, int); + + /* Concatenate paths, taking care of slashes. Caller must free result. */ +-char *path_append(char *, char *); ++char *path_append(const char *, const char *); + + #endif +diff -up openssh-6.1p1/ssh-agent.c.coverity openssh-6.1p1/ssh-agent.c +--- openssh-6.1p1/ssh-agent.c.coverity 2011-06-03 06:14:16.000000000 +0200 ++++ openssh-6.1p1/ssh-agent.c 2012-09-14 21:16:41.303906683 +0200 +@@ -1147,8 +1147,8 @@ main(int ac, char **av) + sanitise_stdfd(); + + /* drop */ +- setegid(getgid()); +- setgid(getgid()); ++ (void) setegid(getgid()); ++ (void) setgid(getgid()); + + #if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE) + /* Disable ptrace on Linux without sgid bit */ +diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c +--- openssh-6.1p1/sshd.c.coverity 2012-07-31 04:21:34.000000000 +0200 ++++ openssh-6.1p1/sshd.c 2012-09-14 21:16:41.307906705 +0200 +@@ -682,8 +682,10 @@ privsep_preauth(Authctxt *authctxt) + if (getuid() == 0 || geteuid() == 0) + privsep_preauth_child(); + setproctitle("%s", "[net]"); +- if (box != NULL) ++ if (box != NULL) { + ssh_sandbox_child(box); ++ xfree(box); ++ } + + return 0; + } +@@ -1311,6 +1313,9 @@ server_accept_loop(int *sock_in, int *so + if (num_listen_socks < 0) + break; + } ++ ++ if (fdset != NULL) ++ xfree(fdset); + } + + +@@ -1768,7 +1773,7 @@ main(int ac, char **av) + + /* Chdir to the root directory so that the current disk can be + unmounted if desired. */ +- chdir("/"); ++ (void) chdir("/"); + + /* ignore SIGPIPE */ + signal(SIGPIPE, SIG_IGN); diff --git a/openssh/patches/openssh-6.1p1-kuserok.patch b/openssh/patches/openssh-6.1p1-kuserok.patch new file mode 100644 index 0000000..7b695e0 --- /dev/null +++ b/openssh/patches/openssh-6.1p1-kuserok.patch @@ -0,0 +1,167 @@ +diff -up openssh-6.1p1/auth-krb5.c.kuserok openssh-6.1p1/auth-krb5.c +--- openssh-6.1p1/auth-krb5.c.kuserok 2012-09-14 21:08:16.941496194 +0200 ++++ openssh-6.1p1/auth-krb5.c 2012-09-14 21:08:17.063496896 +0200 +@@ -55,6 +55,20 @@ + + extern ServerOptions options; + ++int ++ssh_krb5_kuserok(krb5_context krb5_ctx, krb5_principal krb5_user, const char *client) ++{ ++ if (options.use_kuserok) ++ return krb5_kuserok(krb5_ctx, krb5_user, client); ++ else { ++ char kuser[65]; ++ ++ if (krb5_aname_to_localname(krb5_ctx, krb5_user, sizeof(kuser), kuser)) ++ return 0; ++ return strcmp(kuser, client) == 0; ++ } ++} ++ + static int + krb5_init(void *context) + { +@@ -147,7 +161,7 @@ auth_krb5_password(Authctxt *authctxt, c + if (problem) + goto out; + +- if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) { ++ if (!ssh_krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) { + problem = -1; + goto out; + } +diff -up openssh-6.1p1/gss-serv-krb5.c.kuserok openssh-6.1p1/gss-serv-krb5.c +--- openssh-6.1p1/gss-serv-krb5.c.kuserok 2012-09-14 21:08:17.019496642 +0200 ++++ openssh-6.1p1/gss-serv-krb5.c 2012-09-14 21:08:17.065496906 +0200 +@@ -68,6 +68,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr + int); + + static krb5_context krb_context = NULL; ++extern int ssh_krb5_kuserok(krb5_context, krb5_principal, const char *); + + /* Initialise the krb5 library, for the stuff that GSSAPI won't do */ + +@@ -115,7 +116,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client + /* NOTE: .k5login and .k5users must opened as root, not the user, + * because if they are on a krb5-protected filesystem, user credentials + * to access these files aren't available yet. */ +- if (krb5_kuserok(krb_context, princ, luser) && k5login_exists) { ++ if (ssh_krb5_kuserok(krb_context, princ, luser) && k5login_exists) { + retval = 1; + logit("Authorized to %s, krb5 principal %s (krb5_kuserok)", + luser, (char *)client->displayname.value); +diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c +--- openssh-6.1p1/servconf.c.kuserok 2012-09-14 21:08:16.989496471 +0200 ++++ openssh-6.1p1/servconf.c 2012-09-14 21:09:30.864868698 +0200 +@@ -152,6 +152,7 @@ initialize_server_options(ServerOptions + options->ip_qos_interactive = -1; + options->ip_qos_bulk = -1; + options->version_addendum = NULL; ++ options->use_kuserok = -1; + } + + void +@@ -301,6 +302,8 @@ fill_default_server_options(ServerOption + options->version_addendum = xstrdup(""); + if (options->show_patchlevel == -1) + options->show_patchlevel = 0; ++ if (options->use_kuserok == -1) ++ options->use_kuserok = 1; + + /* Turn privilege separation on by default */ + if (use_privsep == -1) +@@ -327,7 +330,7 @@ typedef enum { + sPermitRootLogin, sLogFacility, sLogLevel, + sRhostsRSAAuthentication, sRSAAuthentication, + sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, +- sKerberosGetAFSToken, ++ sKerberosGetAFSToken, sKerberosUseKuserok, + sKerberosTgtPassing, sChallengeResponseAuthentication, + sPasswordAuthentication, sKbdInteractiveAuthentication, + sListenAddress, sAddressFamily, +@@ -399,11 +402,13 @@ static struct { + #else + { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, + #endif ++ { "kerberosusekuserok", sKerberosUseKuserok, SSHCFG_ALL }, + #else + { "kerberosauthentication", sUnsupported, SSHCFG_ALL }, + { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL }, + { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL }, + { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, ++ { "kerberosusekuserok", sUnsupported, SSHCFG_ALL }, + #endif + { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL }, + { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, +@@ -1486,6 +1491,10 @@ process_server_config_line(ServerOptions + *activep = value; + break; + ++ case sKerberosUseKuserok: ++ intptr = &options->use_kuserok; ++ goto parse_flag; ++ + case sPermitOpen: + arg = strdelim(&cp); + if (!arg || *arg == '\0') +@@ -1769,6 +1778,7 @@ copy_set_server_options(ServerOptions *d + M_CP_INTOPT(max_authtries); + M_CP_INTOPT(ip_qos_interactive); + M_CP_INTOPT(ip_qos_bulk); ++ M_CP_INTOPT(use_kuserok); + + /* See comment in servconf.h */ + COPY_MATCH_STRING_OPTS(); +@@ -2005,6 +2015,7 @@ dump_config(ServerOptions *o) + dump_cfg_fmtint(sUseDNS, o->use_dns); + dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding); + dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); ++ dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok); + + /* string arguments */ + dump_cfg_string(sPidFile, o->pid_file); +diff -up openssh-6.1p1/servconf.h.kuserok openssh-6.1p1/servconf.h +--- openssh-6.1p1/servconf.h.kuserok 2012-09-14 21:08:16.990496476 +0200 ++++ openssh-6.1p1/servconf.h 2012-09-14 21:08:17.071496942 +0200 +@@ -169,6 +169,7 @@ typedef struct { + + int num_permitted_opens; + ++ int use_kuserok; + char *chroot_directory; + char *revoked_keys_file; + char *trusted_user_ca_keys; +diff -up openssh-6.1p1/sshd_config.kuserok openssh-6.1p1/sshd_config +--- openssh-6.1p1/sshd_config.kuserok 2012-09-14 21:08:17.002496545 +0200 ++++ openssh-6.1p1/sshd_config 2012-09-14 21:08:17.074496957 +0200 +@@ -79,6 +79,7 @@ ChallengeResponseAuthentication no + #KerberosOrLocalPasswd yes + #KerberosTicketCleanup yes + #KerberosGetAFSToken no ++#KerberosUseKuserok yes + + # GSSAPI options + #GSSAPIAuthentication no +diff -up openssh-6.1p1/sshd_config.5.kuserok openssh-6.1p1/sshd_config.5 +--- openssh-6.1p1/sshd_config.5.kuserok 2012-09-14 21:08:17.004496556 +0200 ++++ openssh-6.1p1/sshd_config.5 2012-09-14 21:08:17.073496952 +0200 +@@ -618,6 +618,10 @@ Specifies whether to automatically destr + file on logout. + The default is + .Dq yes . ++.It Cm KerberosUseKuserok ++Specifies whether to look at .k5login file for user's aliases. ++The default is ++.Dq yes . + .It Cm KexAlgorithms + Specifies the available KEX (Key Exchange) algorithms. + Multiple algorithms must be comma-separated. +@@ -767,6 +771,7 @@ Available keywords are + .Cm HostbasedUsesNameFromPacketOnly , + .Cm KbdInteractiveAuthentication , + .Cm KerberosAuthentication , ++.Cm KerberosUseKuserok , + .Cm MaxAuthTries , + .Cm MaxSessions , + .Cm PubkeyAuthentication , diff --git a/openssh/patches/openssh-6.1p1-required-authentications.patch b/openssh/patches/openssh-6.1p1-required-authentications.patch new file mode 100644 index 0000000..bfc28ee --- /dev/null +++ b/openssh/patches/openssh-6.1p1-required-authentications.patch @@ -0,0 +1,22 @@ +diff -up openssh-6.1p1/servconf.c.required-authentication openssh-6.1p1/servconf.c +--- openssh-6.1p1/servconf.c.required-authentication 2012-11-30 21:13:14.375382453 +0100 ++++ openssh-6.1p1/servconf.c 2012-11-30 21:33:56.972017545 +0100 +@@ -495,6 +495,8 @@ static struct { + { "authorizedkeyscommandrunas", sAuthorizedKeysCommandUser, SSHCFG_ALL }, + { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL }, + { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, ++ { "requiredauthentications1", sAuthenticationMethods, SSHCFG_ALL }, ++ { "requiredauthentications2", sAuthenticationMethods, SSHCFG_ALL }, + { NULL, sBadOption, 0 } + }; + +@@ -1560,6 +1562,9 @@ process_server_config_line(ServerOptions + return 0; + + case sAuthenticationMethods: ++ if (strncasecmp(arg, "requiredauthentications", 23) == 0) ++ logit("%s line %d: Option %s is obsolete. Please use AuthenticationMethods", ++ filename, linenum, arg); + if (*activep && options->num_auth_methods == 0) { + while ((arg = strdelim(&cp)) && *arg != '\0') { + if (options->num_auth_methods >= diff --git a/openssh/patches/openssh-6.1p1-role-mls.patch b/openssh/patches/openssh-6.1p1-role-mls.patch new file mode 100644 index 0000000..4de3dae --- /dev/null +++ b/openssh/patches/openssh-6.1p1-role-mls.patch @@ -0,0 +1,934 @@ +diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c +--- openssh-6.1p1/auth1.c.role-mls 2012-11-28 17:06:43.657990103 +0100 ++++ openssh-6.1p1/auth1.c 2012-11-28 17:06:43.699989959 +0100 +@@ -384,6 +384,9 @@ do_authentication(Authctxt *authctxt) + { + u_int ulen; + char *user, *style = NULL; ++#ifdef WITH_SELINUX ++ char *role=NULL; ++#endif + + /* Get the name of the user that we wish to log in as. */ + packet_read_expect(SSH_CMSG_USER); +@@ -392,11 +395,24 @@ do_authentication(Authctxt *authctxt) + user = packet_get_cstring(&ulen); + packet_check_eom(); + ++#ifdef WITH_SELINUX ++ if ((role = strchr(user, '/')) != NULL) ++ *role++ = '\0'; ++#endif ++ + if ((style = strchr(user, ':')) != NULL) + *style++ = '\0'; ++#ifdef WITH_SELINUX ++ else ++ if (role && (style = strchr(role, ':')) != NULL) ++ *style++ = '\0'; ++#endif + + authctxt->user = user; + authctxt->style = style; ++#ifdef WITH_SELINUX ++ authctxt->role = role; ++#endif + + /* Verify that the user is a valid user. */ + if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) +diff -up openssh-6.1p1/auth2.c.role-mls openssh-6.1p1/auth2.c +--- openssh-6.1p1/auth2.c.role-mls 2012-11-28 17:06:43.661990089 +0100 ++++ openssh-6.1p1/auth2.c 2012-11-28 17:11:09.058916613 +0100 +@@ -218,6 +218,9 @@ input_userauth_request(int type, u_int32 + Authctxt *authctxt = ctxt; + Authmethod *m = NULL; + char *user, *service, *method, *style = NULL; ++#ifdef WITH_SELINUX ++ char *role = NULL; ++#endif + int authenticated = 0; + + if (authctxt == NULL) +@@ -229,6 +232,11 @@ input_userauth_request(int type, u_int32 + debug("userauth-request for user %s service %s method %s", user, service, method); + debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); + ++#ifdef WITH_SELINUX ++ if ((role = strchr(user, '/')) != NULL) ++ *role++ = 0; ++#endif ++ + if ((style = strchr(user, ':')) != NULL) + *style++ = 0; + +@@ -251,8 +259,15 @@ input_userauth_request(int type, u_int32 + use_privsep ? " [net]" : ""); + authctxt->service = xstrdup(service); + authctxt->style = style ? xstrdup(style) : NULL; +- if (use_privsep) ++#ifdef WITH_SELINUX ++ authctxt->role = role ? xstrdup(role) : NULL; ++#endif ++ if (use_privsep) { + mm_inform_authserv(service, style); ++#ifdef WITH_SELINUX ++ mm_inform_authrole(role); ++#endif ++ } + userauth_banner(); + if (auth2_setup_methods_lists(authctxt) != 0) + packet_disconnect("no authentication methods enabled"); +diff -up openssh-6.1p1/auth2-gss.c.role-mls openssh-6.1p1/auth2-gss.c +--- openssh-6.1p1/auth2-gss.c.role-mls 2011-05-05 06:04:11.000000000 +0200 ++++ openssh-6.1p1/auth2-gss.c 2012-11-28 17:06:43.700989956 +0100 +@@ -260,6 +260,7 @@ input_gssapi_mic(int type, u_int32_t ple + Authctxt *authctxt = ctxt; + Gssctxt *gssctxt; + int authenticated = 0; ++ char *micuser; + Buffer b; + gss_buffer_desc mic, gssbuf; + u_int len; +@@ -272,7 +273,13 @@ input_gssapi_mic(int type, u_int32_t ple + mic.value = packet_get_string(&len); + mic.length = len; + +- ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service, ++#ifdef WITH_SELINUX ++ if (authctxt->role && (strlen(authctxt->role) > 0)) ++ xasprintf(&micuser, "%s/%s", authctxt->user, authctxt->role); ++ else ++#endif ++ micuser = authctxt->user; ++ ssh_gssapi_buildmic(&b, micuser, authctxt->service, + "gssapi-with-mic"); + + gssbuf.value = buffer_ptr(&b); +@@ -284,6 +291,8 @@ input_gssapi_mic(int type, u_int32_t ple + logit("GSSAPI MIC check failed"); + + buffer_free(&b); ++ if (micuser != authctxt->user) ++ xfree(micuser); + xfree(mic.value); + + authctxt->postponed = 0; +diff -up openssh-6.1p1/auth2-hostbased.c.role-mls openssh-6.1p1/auth2-hostbased.c +--- openssh-6.1p1/auth2-hostbased.c.role-mls 2012-11-28 17:06:43.669990062 +0100 ++++ openssh-6.1p1/auth2-hostbased.c 2012-11-28 17:06:43.700989956 +0100 +@@ -106,7 +106,15 @@ userauth_hostbased(Authctxt *authctxt) + buffer_put_string(&b, session_id2, session_id2_len); + /* reconstruct packet */ + buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); +- buffer_put_cstring(&b, authctxt->user); ++#ifdef WITH_SELINUX ++ if (authctxt->role) { ++ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1); ++ buffer_append(&b, authctxt->user, strlen(authctxt->user)); ++ buffer_put_char(&b, '/'); ++ buffer_append(&b, authctxt->role, strlen(authctxt->role)); ++ } else ++#endif ++ buffer_put_cstring(&b, authctxt->user); + buffer_put_cstring(&b, service); + buffer_put_cstring(&b, "hostbased"); + buffer_put_string(&b, pkalg, alen); +diff -up openssh-6.1p1/auth2-pubkey.c.role-mls openssh-6.1p1/auth2-pubkey.c +--- openssh-6.1p1/auth2-pubkey.c.role-mls 2012-11-28 17:06:43.669990062 +0100 ++++ openssh-6.1p1/auth2-pubkey.c 2012-11-28 17:06:43.700989956 +0100 +@@ -121,7 +121,15 @@ userauth_pubkey(Authctxt *authctxt) + } + /* reconstruct packet */ + buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); +- buffer_put_cstring(&b, authctxt->user); ++#ifdef WITH_SELINUX ++ if (authctxt->role) { ++ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1); ++ buffer_append(&b, authctxt->user, strlen(authctxt->user)); ++ buffer_put_char(&b, '/'); ++ buffer_append(&b, authctxt->role, strlen(authctxt->role)); ++ } else ++#endif ++ buffer_put_cstring(&b, authctxt->user); + buffer_put_cstring(&b, + datafellows & SSH_BUG_PKSERVICE ? + "ssh-userauth" : +diff -up openssh-6.1p1/auth.h.role-mls openssh-6.1p1/auth.h +--- openssh-6.1p1/auth.h.role-mls 2012-11-28 17:06:43.669990062 +0100 ++++ openssh-6.1p1/auth.h 2012-11-28 17:06:43.699989959 +0100 +@@ -59,6 +59,9 @@ struct Authctxt { + char *service; + struct passwd *pw; /* set if 'valid' */ + char *style; ++#ifdef WITH_SELINUX ++ char *role; ++#endif + void *kbdintctxt; + void *jpake_ctx; + #ifdef BSD_AUTH +diff -up openssh-6.1p1/auth-pam.c.role-mls openssh-6.1p1/auth-pam.c +--- openssh-6.1p1/auth-pam.c.role-mls 2012-11-28 17:06:43.638990168 +0100 ++++ openssh-6.1p1/auth-pam.c 2012-11-28 17:06:43.699989959 +0100 +@@ -1074,7 +1074,7 @@ is_pam_session_open(void) + * during the ssh authentication process. + */ + int +-do_pam_putenv(char *name, char *value) ++do_pam_putenv(char *name, const char *value) + { + int ret = 1; + #ifdef HAVE_PAM_PUTENV +diff -up openssh-6.1p1/auth-pam.h.role-mls openssh-6.1p1/auth-pam.h +--- openssh-6.1p1/auth-pam.h.role-mls 2004-09-11 14:17:26.000000000 +0200 ++++ openssh-6.1p1/auth-pam.h 2012-11-28 17:06:43.699989959 +0100 +@@ -38,7 +38,7 @@ void do_pam_session(void); + void do_pam_set_tty(const char *); + void do_pam_setcred(int ); + void do_pam_chauthtok(void); +-int do_pam_putenv(char *, char *); ++int do_pam_putenv(char *, const char *); + char ** fetch_pam_environment(void); + char ** fetch_pam_child_environment(void); + void free_pam_environment(char **); +diff -up openssh-6.1p1/misc.c.role-mls openssh-6.1p1/misc.c +--- openssh-6.1p1/misc.c.role-mls 2011-09-22 13:34:36.000000000 +0200 ++++ openssh-6.1p1/misc.c 2012-11-28 17:06:43.701989952 +0100 +@@ -427,6 +427,7 @@ char * + colon(char *cp) + { + int flag = 0; ++ int start = 1; + + if (*cp == ':') /* Leading colon is part of file name. */ + return NULL; +@@ -442,6 +443,13 @@ colon(char *cp) + return (cp); + if (*cp == '/') + return NULL; ++ if (start) { ++ /* Slash on beginning or after dots only denotes file name. */ ++ if (*cp == '/') ++ return (0); ++ if (*cp != '.') ++ start = 0; ++ } + } + return NULL; + } +diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c +--- openssh-6.1p1/monitor.c.role-mls 2012-11-28 17:06:43.686990004 +0100 ++++ openssh-6.1p1/monitor.c 2012-11-28 17:06:43.701989952 +0100 +@@ -148,6 +148,9 @@ int mm_answer_sign(int, Buffer *); + int mm_answer_pwnamallow(int, Buffer *); + int mm_answer_auth2_read_banner(int, Buffer *); + int mm_answer_authserv(int, Buffer *); ++#ifdef WITH_SELINUX ++int mm_answer_authrole(int, Buffer *); ++#endif + int mm_answer_authpassword(int, Buffer *); + int mm_answer_bsdauthquery(int, Buffer *); + int mm_answer_bsdauthrespond(int, Buffer *); +@@ -231,6 +234,9 @@ struct mon_table mon_dispatch_proto20[] + {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, + {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, + {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, ++#ifdef WITH_SELINUX ++ {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, ++#endif + {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, + {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, + #ifdef USE_PAM +@@ -838,6 +844,9 @@ mm_answer_pwnamallow(int sock, Buffer *m + else { + /* Allow service/style information on the auth context */ + monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); ++#ifdef WITH_SELINUX ++ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); ++#endif + monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); + } + #ifdef USE_PAM +@@ -881,6 +890,25 @@ mm_answer_authserv(int sock, Buffer *m) + return (0); + } + ++#ifdef WITH_SELINUX ++int ++mm_answer_authrole(int sock, Buffer *m) ++{ ++ monitor_permit_authentications(1); ++ ++ authctxt->role = buffer_get_string(m, NULL); ++ debug3("%s: role=%s", ++ __func__, authctxt->role); ++ ++ if (strlen(authctxt->role) == 0) { ++ xfree(authctxt->role); ++ authctxt->role = NULL; ++ } ++ ++ return (0); ++} ++#endif ++ + int + mm_answer_authpassword(int sock, Buffer *m) + { +@@ -1251,7 +1279,7 @@ static int + monitor_valid_userblob(u_char *data, u_int datalen) + { + Buffer b; +- char *p; ++ char *p, *r; + u_int len; + int fail = 0; + +@@ -1277,6 +1305,8 @@ monitor_valid_userblob(u_char *data, u_i + if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) + fail++; + p = buffer_get_string(&b, NULL); ++ if ((r = strchr(p, '/')) != NULL) ++ *r = '\0'; + if (strcmp(authctxt->user, p) != 0) { + logit("wrong user name passed to monitor: expected %s != %.100s", + authctxt->user, p); +@@ -1308,7 +1338,7 @@ monitor_valid_hostbasedblob(u_char *data + char *chost) + { + Buffer b; +- char *p; ++ char *p, *r; + u_int len; + int fail = 0; + +@@ -1325,6 +1355,8 @@ monitor_valid_hostbasedblob(u_char *data + if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) + fail++; + p = buffer_get_string(&b, NULL); ++ if ((r = strchr(p, '/')) != NULL) ++ *r = '\0'; + if (strcmp(authctxt->user, p) != 0) { + logit("wrong user name passed to monitor: expected %s != %.100s", + authctxt->user, p); +diff -up openssh-6.1p1/monitor.h.role-mls openssh-6.1p1/monitor.h +--- openssh-6.1p1/monitor.h.role-mls 2012-11-28 17:06:43.686990004 +0100 ++++ openssh-6.1p1/monitor.h 2012-11-28 17:06:43.701989952 +0100 +@@ -31,6 +31,9 @@ + enum monitor_reqtype { + MONITOR_REQ_MODULI, MONITOR_ANS_MODULI, + MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, ++#ifdef WITH_SELINUX ++ MONITOR_REQ_AUTHROLE, ++#endif + MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, + MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, + MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, +diff -up openssh-6.1p1/monitor_wrap.c.role-mls openssh-6.1p1/monitor_wrap.c +--- openssh-6.1p1/monitor_wrap.c.role-mls 2012-11-28 17:06:43.686990004 +0100 ++++ openssh-6.1p1/monitor_wrap.c 2012-11-28 17:06:43.702989948 +0100 +@@ -336,6 +336,25 @@ mm_inform_authserv(char *service, char * + buffer_free(&m); + } + ++/* Inform the privileged process about role */ ++ ++#ifdef WITH_SELINUX ++void ++mm_inform_authrole(char *role) ++{ ++ Buffer m; ++ ++ debug3("%s entering", __func__); ++ ++ buffer_init(&m); ++ buffer_put_cstring(&m, role ? role : ""); ++ ++ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m); ++ ++ buffer_free(&m); ++} ++#endif ++ + /* Do the password authentication */ + int + mm_auth_password(Authctxt *authctxt, char *password) +diff -up openssh-6.1p1/monitor_wrap.h.role-mls openssh-6.1p1/monitor_wrap.h +--- openssh-6.1p1/monitor_wrap.h.role-mls 2012-11-28 17:06:43.686990004 +0100 ++++ openssh-6.1p1/monitor_wrap.h 2012-11-28 17:06:43.702989948 +0100 +@@ -42,6 +42,9 @@ int mm_is_monitor(void); + DH *mm_choose_dh(int, int, int); + int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); + void mm_inform_authserv(char *, char *); ++#ifdef WITH_SELINUX ++void mm_inform_authrole(char *); ++#endif + struct passwd *mm_getpwnamallow(const char *); + char *mm_auth2_read_banner(void); + int mm_auth_password(struct Authctxt *, char *); +diff -up openssh-6.1p1/openbsd-compat/Makefile.in.role-mls openssh-6.1p1/openbsd-compat/Makefile.in +--- openssh-6.1p1/openbsd-compat/Makefile.in.role-mls 2011-11-04 01:25:25.000000000 +0100 ++++ openssh-6.1p1/openbsd-compat/Makefile.in 2012-11-28 17:06:43.702989948 +0100 +@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport + + COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o + +-PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o ++PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o + + .c.o: + $(CC) $(CFLAGS) $(CPPFLAGS) -c $< +diff -up openssh-6.1p1/openbsd-compat/port-linux.c.role-mls openssh-6.1p1/openbsd-compat/port-linux.c +--- openssh-6.1p1/openbsd-compat/port-linux.c.role-mls 2012-03-09 00:25:18.000000000 +0100 ++++ openssh-6.1p1/openbsd-compat/port-linux.c 2012-11-28 17:06:43.702989948 +0100 +@@ -31,68 +31,271 @@ + + #include "log.h" + #include "xmalloc.h" ++#include "servconf.h" + #include "port-linux.h" ++#include "key.h" ++#include "hostfile.h" ++#include "auth.h" + + #ifdef WITH_SELINUX + #include <selinux/selinux.h> + #include <selinux/flask.h> ++#include <selinux/context.h> + #include <selinux/get_context_list.h> ++#include <selinux/get_default_type.h> ++#include <selinux/av_permissions.h> ++ ++#ifdef HAVE_LINUX_AUDIT ++#include <libaudit.h> ++#include <unistd.h> ++#endif + + #ifndef SSH_SELINUX_UNCONFINED_TYPE + # define SSH_SELINUX_UNCONFINED_TYPE ":unconfined_t:" + #endif + +-/* Wrapper around is_selinux_enabled() to log its return value once only */ +-int +-ssh_selinux_enabled(void) ++extern ServerOptions options; ++extern Authctxt *the_authctxt; ++extern int inetd_flag; ++extern int rexeced_flag; ++ ++/* Send audit message */ ++static int ++send_audit_message(int success, security_context_t default_context, ++ security_context_t selected_context) ++{ ++ int rc=0; ++#ifdef HAVE_LINUX_AUDIT ++ char *msg = NULL; ++ int audit_fd = audit_open(); ++ security_context_t default_raw=NULL; ++ security_context_t selected_raw=NULL; ++ rc = -1; ++ if (audit_fd < 0) { ++ if (errno == EINVAL || errno == EPROTONOSUPPORT || ++ errno == EAFNOSUPPORT) ++ return 0; /* No audit support in kernel */ ++ error("Error connecting to audit system."); ++ return rc; ++ } ++ if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) { ++ error("Error translating default context."); ++ default_raw = NULL; ++ } ++ if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) { ++ error("Error translating selected context."); ++ selected_raw = NULL; ++ } ++ if (asprintf(&msg, "sshd: default-context=%s selected-context=%s", ++ default_raw ? default_raw : (default_context ? default_context: "?"), ++ selected_context ? selected_raw : (selected_context ? selected_context :"?")) < 0) { ++ error("Error allocating memory."); ++ goto out; ++ } ++ if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, ++ msg, NULL, NULL, NULL, success) <= 0) { ++ error("Error sending audit message."); ++ goto out; ++ } ++ rc = 0; ++ out: ++ free(msg); ++ freecon(default_raw); ++ freecon(selected_raw); ++ close(audit_fd); ++#endif ++ return rc; ++} ++ ++static int ++mls_range_allowed(security_context_t src, security_context_t dst) + { +- static int enabled = -1; ++ struct av_decision avd; ++ int retval; ++ unsigned int bit = CONTEXT__CONTAINS; ++ ++ debug("%s: src:%s dst:%s", __func__, src, dst); ++ retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd); ++ if (retval || ((bit & avd.allowed) != bit)) ++ return 0; ++ ++ return 1; ++} ++ ++static int ++get_user_context(const char *sename, const char *role, const char *lvl, ++ security_context_t *sc) { ++#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL ++ if (lvl == NULL || lvl[0] == '\0' || get_default_context_with_level(sename, lvl, NULL, sc) != 0) { ++ /* User may have requested a level completely outside of his ++ allowed range. We get a context just for auditing as the ++ range check below will certainly fail for default context. */ ++#endif ++ if (get_default_context(sename, NULL, sc) != 0) { ++ *sc = NULL; ++ return -1; ++ } ++#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL ++ } ++#endif ++ if (role != NULL && role[0]) { ++ context_t con; ++ char *type=NULL; ++ if (get_default_type(role, &type) != 0) { ++ error("get_default_type: failed to get default type for '%s'", ++ role); ++ goto out; ++ } ++ con = context_new(*sc); ++ if (!con) { ++ goto out; ++ } ++ context_role_set(con, role); ++ context_type_set(con, type); ++ freecon(*sc); ++ *sc = strdup(context_str(con)); ++ context_free(con); ++ if (!*sc) ++ return -1; ++ } ++#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL ++ if (lvl != NULL && lvl[0]) { ++ /* verify that the requested range is obtained */ ++ context_t con; ++ security_context_t obtained_raw; ++ security_context_t requested_raw; ++ con = context_new(*sc); ++ if (!con) { ++ goto out; ++ } ++ context_range_set(con, lvl); ++ if (selinux_trans_to_raw_context(*sc, &obtained_raw) < 0) { ++ context_free(con); ++ goto out; ++ } ++ if (selinux_trans_to_raw_context(context_str(con), &requested_raw) < 0) { ++ freecon(obtained_raw); ++ context_free(con); ++ goto out; ++ } + +- if (enabled == -1) { +- enabled = (is_selinux_enabled() == 1); +- debug("SELinux support %s", enabled ? "enabled" : "disabled"); ++ debug("get_user_context: obtained context '%s' requested context '%s'", ++ obtained_raw, requested_raw); ++ if (strcmp(obtained_raw, requested_raw)) { ++ /* set the context to the real requested one but fail */ ++ freecon(requested_raw); ++ freecon(obtained_raw); ++ freecon(*sc); ++ *sc = strdup(context_str(con)); ++ context_free(con); ++ return -1; ++ } ++ freecon(requested_raw); ++ freecon(obtained_raw); ++ context_free(con); + } ++#endif ++ return 0; ++ out: ++ freecon(*sc); ++ *sc = NULL; ++ return -1; ++} + +- return (enabled); ++static void ++ssh_selinux_get_role_level(char **role, const char **level) ++{ ++ *role = NULL; ++ *level = NULL; ++ if (the_authctxt) { ++ if (the_authctxt->role != NULL) { ++ char *slash; ++ *role = xstrdup(the_authctxt->role); ++ if ((slash = strchr(*role, '/')) != NULL) { ++ *slash = '\0'; ++ *level = slash + 1; ++ } ++ } ++ } + } + + /* Return the default security context for the given username */ + static security_context_t +-ssh_selinux_getctxbyname(char *pwname) ++ssh_selinux_getctxbyname(char *pwname, ++ security_context_t *default_sc, security_context_t *user_sc) + { +- security_context_t sc = NULL; +- char *sename = NULL, *lvl = NULL; +- int r; ++ char *sename, *lvl; ++ char *role; ++ const char *reqlvl; ++ int r = 0; ++ context_t con = NULL; ++ ++ ssh_selinux_get_role_level(&role, &reqlvl); + + #ifdef HAVE_GETSEUSERBYNAME +- if (getseuserbyname(pwname, &sename, &lvl) != 0) +- return NULL; ++ if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) { ++ sename = NULL; ++ lvl = NULL; ++ } + #else + sename = pwname; +- lvl = NULL; ++ lvl = ""; + #endif + ++ if (r == 0) { + #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL +- r = get_default_context_with_level(sename, lvl, NULL, &sc); ++ r = get_default_context_with_level(sename, lvl, NULL, default_sc); + #else +- r = get_default_context(sename, NULL, &sc); ++ r = get_default_context(sename, NULL, default_sc); + #endif ++ } ++ ++ if (r == 0) { ++ /* If launched from xinetd, we must use current level */ ++ if (inetd_flag && !rexeced_flag) { ++ security_context_t sshdsc=NULL; ++ ++ if (getcon_raw(&sshdsc) < 0) ++ fatal("failed to allocate security context"); ++ ++ if ((con=context_new(sshdsc)) == NULL) ++ fatal("failed to allocate selinux context"); ++ reqlvl = context_range_get(con); ++ freecon(sshdsc); ++ if (reqlvl !=NULL && lvl != NULL && strcmp(reqlvl, lvl) == 0) ++ /* we actually don't change level */ ++ reqlvl = ""; ++ ++ debug("%s: current connection level '%s'", __func__, reqlvl); + +- if (r != 0) { +- switch (security_getenforce()) { +- case -1: +- fatal("%s: ssh_selinux_getctxbyname: " +- "security_getenforce() failed", __func__); +- case 0: +- error("%s: Failed to get default SELinux security " +- "context for %s", __func__, pwname); +- sc = NULL; +- break; +- default: +- fatal("%s: Failed to get default SELinux security " +- "context for %s (in enforcing mode)", +- __func__, pwname); + } ++ ++ if ((reqlvl != NULL && reqlvl[0]) || (role != NULL && role[0])) { ++ r = get_user_context(sename, role, reqlvl, user_sc); ++ ++ if (r == 0 && reqlvl != NULL && reqlvl[0]) { ++ security_context_t default_level_sc = *default_sc; ++ if (role != NULL && role[0]) { ++ if (get_user_context(sename, role, lvl, &default_level_sc) < 0) ++ default_level_sc = *default_sc; ++ } ++ /* verify that the requested range is contained in the user range */ ++ if (mls_range_allowed(default_level_sc, *user_sc)) { ++ logit("permit MLS level %s (user range %s)", reqlvl, lvl); ++ } else { ++ r = -1; ++ error("deny MLS level %s (user range %s)", reqlvl, lvl); ++ } ++ if (default_level_sc != *default_sc) ++ freecon(default_level_sc); ++ } ++ } else { ++ *user_sc = *default_sc; ++ } ++ } ++ if (r != 0) { ++ error("%s: Failed to get default SELinux security " ++ "context for %s", __func__, pwname); + } + + #ifdef HAVE_GETSEUSERBYNAME +@@ -102,7 +305,42 @@ ssh_selinux_getctxbyname(char *pwname) + xfree(lvl); + #endif + +- return sc; ++ if (role != NULL) ++ xfree(role); ++ if (con) ++ context_free(con); ++ ++ return (r); ++} ++ ++/* Setup environment variables for pam_selinux */ ++static int ++ssh_selinux_setup_pam_variables(void) ++{ ++ const char *reqlvl; ++ char *role; ++ char *use_current; ++ int rv; ++ ++ debug3("%s: setting execution context", __func__); ++ ++ ssh_selinux_get_role_level(&role, &reqlvl); ++ ++ rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : ""); ++ ++ if (inetd_flag && !rexeced_flag) { ++ use_current = "1"; ++ } else { ++ use_current = ""; ++ rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: ""); ++ } ++ ++ rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current); ++ ++ if (role != NULL) ++ xfree(role); ++ ++ return rv; + } + + /* Set the execution context to the default for the specified user */ +@@ -110,28 +348,71 @@ void + ssh_selinux_setup_exec_context(char *pwname) + { + security_context_t user_ctx = NULL; ++ int r = 0; ++ security_context_t default_ctx = NULL; + + if (!ssh_selinux_enabled()) + return; + ++ if (options.use_pam) { ++ /* do not compute context, just setup environment for pam_selinux */ ++ if (ssh_selinux_setup_pam_variables()) { ++ switch (security_getenforce()) { ++ case -1: ++ fatal("%s: security_getenforce() failed", __func__); ++ case 0: ++ error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.", ++ __func__); ++ break; ++ default: ++ fatal("%s: SELinux PAM variable setup failure. Aborting connection.", ++ __func__); ++ } ++ } ++ return; ++ } ++ + debug3("%s: setting execution context", __func__); + +- user_ctx = ssh_selinux_getctxbyname(pwname); +- if (setexeccon(user_ctx) != 0) { ++ r = ssh_selinux_getctxbyname(pwname, &default_ctx, &user_ctx); ++ if (r >= 0) { ++ r = setexeccon(user_ctx); ++ if (r < 0) { ++ error("%s: Failed to set SELinux execution context %s for %s", ++ __func__, user_ctx, pwname); ++ } ++#ifdef HAVE_SETKEYCREATECON ++ else if (setkeycreatecon(user_ctx) < 0) { ++ error("%s: Failed to set SELinux keyring creation context %s for %s", ++ __func__, user_ctx, pwname); ++ } ++#endif ++ } ++ if (user_ctx == NULL) { ++ user_ctx = default_ctx; ++ } ++ if (r < 0 || user_ctx != default_ctx) { ++ /* audit just the case when user changed a role or there was ++ a failure */ ++ send_audit_message(r >= 0, default_ctx, user_ctx); ++ } ++ if (r < 0) { + switch (security_getenforce()) { + case -1: + fatal("%s: security_getenforce() failed", __func__); + case 0: +- error("%s: Failed to set SELinux execution " +- "context for %s", __func__, pwname); ++ error("%s: SELinux failure. Continuing in permissive mode.", ++ __func__); + break; + default: +- fatal("%s: Failed to set SELinux execution context " +- "for %s (in enforcing mode)", __func__, pwname); ++ fatal("%s: SELinux failure. Aborting connection.", ++ __func__); + } + } +- if (user_ctx != NULL) ++ if (user_ctx != NULL && user_ctx != default_ctx) + freecon(user_ctx); ++ if (default_ctx != NULL) ++ freecon(default_ctx); + + debug3("%s: done", __func__); + } +@@ -149,7 +430,10 @@ ssh_selinux_setup_pty(char *pwname, cons + + debug3("%s: setting TTY context on %s", __func__, tty); + +- user_ctx = ssh_selinux_getctxbyname(pwname); ++ if (getexeccon(&user_ctx) < 0) { ++ error("%s: getexeccon: %s", __func__, strerror(errno)); ++ goto out; ++ } + + /* XXX: should these calls fatal() upon failure in enforcing mode? */ + +@@ -221,21 +505,6 @@ ssh_selinux_change_context(const char *n + xfree(newctx); + } + +-void +-ssh_selinux_setfscreatecon(const char *path) +-{ +- security_context_t context; +- +- if (!ssh_selinux_enabled()) +- return; +- if (path == NULL) { +- setfscreatecon(NULL); +- return; +- } +- if (matchpathcon(path, 0700, &context) == 0) +- setfscreatecon(context); +-} +- + #endif /* WITH_SELINUX */ + + #ifdef LINUX_OOM_ADJUST +diff -up openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.1p1/openbsd-compat/port-linux_part_2.c +--- openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls 2012-11-28 17:06:43.703989944 +0100 ++++ openssh-6.1p1/openbsd-compat/port-linux_part_2.c 2012-11-28 17:06:43.703989944 +0100 +@@ -0,0 +1,75 @@ ++/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */ ++ ++/* ++ * Copyright (c) 2005 Daniel Walsh <dwalsh(a)redhat.com> ++ * Copyright (c) 2006 Damien Miller <djm(a)openbsd.org> ++ * ++ * Permission to use, copy, modify, and distribute this software for any ++ * purpose with or without fee is hereby granted, provided that the above ++ * copyright notice and this permission notice appear in all copies. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES ++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF ++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF ++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ */ ++ ++/* ++ * Linux-specific portability code - just SELinux support at present ++ */ ++ ++#include "includes.h" ++ ++#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) ++#include <errno.h> ++#include <stdarg.h> ++#include <string.h> ++#include <stdio.h> ++ ++#include "log.h" ++#include "xmalloc.h" ++#include "port-linux.h" ++#include "key.h" ++#include "hostfile.h" ++#include "auth.h" ++ ++#ifdef WITH_SELINUX ++#include <selinux/selinux.h> ++#include <selinux/flask.h> ++#include <selinux/get_context_list.h> ++ ++/* Wrapper around is_selinux_enabled() to log its return value once only */ ++int ++ssh_selinux_enabled(void) ++{ ++ static int enabled = -1; ++ ++ if (enabled == -1) { ++ enabled = (is_selinux_enabled() == 1); ++ debug("SELinux support %s", enabled ? "enabled" : "disabled"); ++ } ++ ++ return (enabled); ++} ++ ++void ++ssh_selinux_setfscreatecon(const char *path) ++{ ++ security_context_t context; ++ ++ if (!ssh_selinux_enabled()) ++ return; ++ if (path == NULL) { ++ setfscreatecon(NULL); ++ return; ++ } ++ if (matchpathcon(path, 0700, &context) == 0) ++ setfscreatecon(context); ++} ++ ++#endif /* WITH_SELINUX */ ++ ++#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */ +diff -up openssh-6.1p1/sshd.c.role-mls openssh-6.1p1/sshd.c +--- openssh-6.1p1/sshd.c.role-mls 2012-11-28 17:06:43.688989996 +0100 ++++ openssh-6.1p1/sshd.c 2012-11-28 17:06:43.703989944 +0100 +@@ -2101,6 +2101,9 @@ main(int ac, char **av) + restore_uid(); + } + #endif ++#ifdef WITH_SELINUX ++ ssh_selinux_setup_exec_context(authctxt->pw->pw_name); ++#endif + #ifdef USE_PAM + if (options.use_pam) { + do_pam_setcred(1); diff --git a/openssh/patches/openssh-6.1p1-vendor.patch b/openssh/patches/openssh-6.1p1-vendor.patch new file mode 100644 index 0000000..9cb326d --- /dev/null +++ b/openssh/patches/openssh-6.1p1-vendor.patch @@ -0,0 +1,158 @@ +diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac +--- openssh-6.1p1/configure.ac.vendor 2012-09-14 20:36:49.153085211 +0200 ++++ openssh-6.1p1/configure.ac 2012-09-14 20:36:49.559088133 +0200 +@@ -4303,6 +4303,12 @@ AC_ARG_WITH([lastlog], + fi + ] + ) ++AC_ARG_ENABLE(vendor-patchlevel, ++ [ --enable-vendor-patchlevel=TAG specify a vendor patch level], ++ [AC_DEFINE_UNQUOTED(SSH_VENDOR_PATCHLEVEL,[SSH_RELEASE "-" "$enableval"],[Define to your vendor patch level, if it has been modified from the upstream source release.]) ++ SSH_VENDOR_PATCHLEVEL="$enableval"], ++ [AC_DEFINE(SSH_VENDOR_PATCHLEVEL,SSH_RELEASE,[Define to your vendor patch level, if it has been modified from the upstream source release.]) ++ SSH_VENDOR_PATCHLEVEL=none]) + + dnl lastlog, [uw]tmpx? detection + dnl NOTE: set the paths in the platform section to avoid the +@@ -4529,6 +4535,7 @@ echo " Translate v4 in v6 hack + echo " BSD Auth support: $BSD_AUTH_MSG" + echo " Random number source: $RAND_MSG" + echo " Privsep sandbox style: $SANDBOX_STYLE" ++echo " Vendor patch level: $SSH_VENDOR_PATCHLEVEL" + + echo "" + +diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c +--- openssh-6.1p1/servconf.c.vendor 2012-09-14 20:36:49.124085002 +0200 ++++ openssh-6.1p1/servconf.c 2012-09-14 20:50:34.995972516 +0200 +@@ -128,6 +128,7 @@ initialize_server_options(ServerOptions + options->max_authtries = -1; + options->max_sessions = -1; + options->banner = NULL; ++ options->show_patchlevel = -1; + options->use_dns = -1; + options->client_alive_interval = -1; + options->client_alive_count_max = -1; +@@ -289,6 +290,9 @@ fill_default_server_options(ServerOption + options->ip_qos_bulk = IPTOS_THROUGHPUT; + if (options->version_addendum == NULL) + options->version_addendum = xstrdup(""); ++ if (options->show_patchlevel == -1) ++ options->show_patchlevel = 0; ++ + /* Turn privilege separation on by default */ + if (use_privsep == -1) + use_privsep = PRIVSEP_NOSANDBOX; +@@ -326,7 +330,7 @@ typedef enum { + sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, + sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, + sMaxStartups, sMaxAuthTries, sMaxSessions, +- sBanner, sUseDNS, sHostbasedAuthentication, ++ sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication, + sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, + sClientAliveCountMax, sAuthorizedKeysFile, + sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel, +@@ -441,6 +445,7 @@ static struct { + { "maxauthtries", sMaxAuthTries, SSHCFG_ALL }, + { "maxsessions", sMaxSessions, SSHCFG_ALL }, + { "banner", sBanner, SSHCFG_ALL }, ++ { "showpatchlevel", sShowPatchLevel, SSHCFG_GLOBAL }, + { "usedns", sUseDNS, SSHCFG_GLOBAL }, + { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL }, + { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL }, +@@ -1162,6 +1167,10 @@ process_server_config_line(ServerOptions + multistate_ptr = multistate_privsep; + goto parse_multistate; + ++ case sShowPatchLevel: ++ intptr = &options->show_patchlevel; ++ goto parse_flag; ++ + case sAllowUsers: + while ((arg = strdelim(&cp)) && *arg != '\0') { + if (options->num_allow_users >= MAX_ALLOW_USERS) +@@ -1956,6 +1965,7 @@ dump_config(ServerOptions *o) + dump_cfg_fmtint(sUseLogin, o->use_login); + dump_cfg_fmtint(sCompression, o->compression); + dump_cfg_fmtint(sGatewayPorts, o->gateway_ports); ++ dump_cfg_fmtint(sShowPatchLevel, o->show_patchlevel); + dump_cfg_fmtint(sUseDNS, o->use_dns); + dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding); + dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); +diff -up openssh-6.1p1/servconf.h.vendor openssh-6.1p1/servconf.h +--- openssh-6.1p1/servconf.h.vendor 2012-09-14 20:36:49.125085009 +0200 ++++ openssh-6.1p1/servconf.h 2012-09-14 20:36:49.564088168 +0200 +@@ -140,6 +140,7 @@ typedef struct { + int max_authtries; + int max_sessions; + char *banner; /* SSH-2 banner message */ ++ int show_patchlevel; /* Show vendor patch level to clients */ + int use_dns; + int client_alive_interval; /* + * poke the client this often to +diff -up openssh-6.1p1/sshd_config.vendor openssh-6.1p1/sshd_config +--- openssh-6.1p1/sshd_config.vendor 2012-09-14 20:36:49.507087759 +0200 ++++ openssh-6.1p1/sshd_config 2012-09-14 20:36:49.565088175 +0200 +@@ -114,6 +114,7 @@ UsePrivilegeSeparation sandbox # Defaul + #Compression delayed + #ClientAliveInterval 0 + #ClientAliveCountMax 3 ++#ShowPatchLevel no + #UseDNS yes + #PidFile /var/run/sshd.pid + #MaxStartups 10 +diff -up openssh-6.1p1/sshd_config.0.vendor openssh-6.1p1/sshd_config.0 +--- openssh-6.1p1/sshd_config.0.vendor 2012-09-14 20:36:49.510087780 +0200 ++++ openssh-6.1p1/sshd_config.0 2012-09-14 20:36:49.567088190 +0200 +@@ -558,6 +558,11 @@ DESCRIPTION + Defines the number of bits in the ephemeral protocol version 1 + server key. The minimum value is 512, and the default is 1024. + ++ ShowPatchLevel ++ Specifies whether sshd will display the specific patch level of ++ the binary in the server identification string. The patch level ++ is set at compile-time. The default is M-bM-^@M-^\noM-bM-^@M-^]. ++ + StrictModes + Specifies whether sshd(8) should check file modes and ownership + of the user's files and home directory before accepting login. +diff -up openssh-6.1p1/sshd_config.5.vendor openssh-6.1p1/sshd_config.5 +--- openssh-6.1p1/sshd_config.5.vendor 2012-09-14 20:36:49.512087794 +0200 ++++ openssh-6.1p1/sshd_config.5 2012-09-14 20:36:49.568088198 +0200 +@@ -978,6 +978,14 @@ This option applies to protocol version + .It Cm ServerKeyBits + Defines the number of bits in the ephemeral protocol version 1 server key. + The minimum value is 512, and the default is 1024. ++.It Cm ShowPatchLevel ++Specifies whether ++.Nm sshd ++will display the patch level of the binary in the identification string. ++The patch level is set at compile-time. ++The default is ++.Dq no . ++This option applies to protocol version 1 only. + .It Cm StrictModes + Specifies whether + .Xr sshd 8 +diff -up openssh-6.1p1/sshd.c.vendor openssh-6.1p1/sshd.c +--- openssh-6.1p1/sshd.c.vendor 2012-09-14 20:36:49.399086981 +0200 ++++ openssh-6.1p1/sshd.c 2012-09-14 20:47:30.696088744 +0200 +@@ -433,7 +433,7 @@ sshd_exchange_identification(int sock_in + } + + xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", +- major, minor, SSH_VERSION, ++ major, minor, (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION, + *options.version_addendum == '\0' ? "" : " ", + options.version_addendum, newline); + +@@ -1635,7 +1635,8 @@ main(int ac, char **av) + exit(1); + } + +- debug("sshd version %.100s", SSH_RELEASE); ++ debug("sshd version %.100s", ++ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_RELEASE); + + /* Store privilege separation user for later use if required. */ + if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) { hooks/post-receive -- IPFire 3.x development tree

1 0

[git.ipfire.org] IPFire 3.x development tree branch, master, updated. 38309f025a1c685fd6741f6a9e2e04908f0d6fa1
by git＠ipfire.org 08 Dec '12

08 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 38309f025a1c685fd6741f6a9e2e04908f0d6fa1 (commit) via eabc5bf02cbe912b333c7550d0ddfba429c565fa (commit) via 18213b4122886d9b0dc2bbdb76c8a2568ae941c9 (commit) from 66ac8193fece9902f85504a7dba994aa2642ac60 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 38309f025a1c685fd6741f6a9e2e04908f0d6fa1 Merge: eabc5bf 18213b4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Dec 8 21:34:24 2012 +0100 Merge remote-tracking branch 'stevee/xorg-x11-server' commit eabc5bf02cbe912b333c7550d0ddfba429c565fa Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Dec 8 20:57:01 2012 +0100 strongswan: Update to 5.0.1. Fixes #10238. commit 18213b4122886d9b0dc2bbdb76c8a2568ae941c9 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Dec 8 18:25:24 2012 +0100 xorg-x11-server: Rebuild to link against new libudev. The old X11 server was linked agains libudev.so.0 which will not longer be provided from the systemd/udev. So we need to rebuild the X11 server to link it against libudev.so.1. ----------------------------------------------------------------------- Summary of changes: strongswan/strongswan.nm | 2 +- xorg-x11-server/xorg-x11-server.nm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/strongswan/strongswan.nm b/strongswan/strongswan.nm index d734b77..18b305a 100644 --- a/strongswan/strongswan.nm +++ b/strongswan/strongswan.nm @@ -4,7 +4,7 @@ ############################################################################### name = strongswan -version = 5.0.0 +version = 5.0.1 release = 1 groups = Networking/VPN diff --git a/xorg-x11-server/xorg-x11-server.nm b/xorg-x11-server/xorg-x11-server.nm index 365c9e6..bc14fa5 100644 --- a/xorg-x11-server/xorg-x11-server.nm +++ b/xorg-x11-server/xorg-x11-server.nm @@ -5,7 +5,7 @@ name = xorg-x11-server version = 1.8.2 -release = 6 +release = 7 maintainer = Stefan Schantl <stefan.schantl(a)ipfire.org> groups = X/Server hooks/post-receive -- IPFire 3.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, thirteen, updated. bec27ff2636c01c0085deddb4c848fc066533a41
by git＠ipfire.org 08 Dec '12

08 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, thirteen has been updated via bec27ff2636c01c0085deddb4c848fc066533a41 (commit) via ca87aefda5375729081397aee80d0b3ab8a1aeb1 (commit) via 0413e130db2965981a620bfe54aacd708b2e574c (commit) via d7a3254acedb43995d6a6e769562576cc7ff8639 (commit) via 36e1dc20f4d763b8069a4c973ef8ff792786229e (commit) via 0965d98fe8050a4c98b1b4db1306d741d3855ad4 (commit) via 083c1258bf28023957d1b7204e4b05a5d4082998 (commit) via 2e732994a12431c6f7aa14876f358da90cfc9f32 (commit) via 82c809c7529a9cd7c9cdd6c96d5671d4e261a546 (commit) via 1075e0b5f0c08695a839462c5609e919d24b8a5c (commit) via 79d29f0082a0f97313c4cf8ec2696281785069bb (commit) via 7eb378428b21cc2dcaeee2d585da6be8950aca8a (commit) via f4819f1f76c38963382b5f9bb052a8fc366432d5 (commit) via 4cdf8b927a0e75e7046c315788bba4c3fcbc7df6 (commit) via bd54ff030eee920be813de64e8b4ffec8d57315b (commit) via e2429e8d3452e39128a8c8f2806b97314f9c9470 (commit) via ac87f37110a5cfb41ed65c1b2b83cd3d340ce125 (commit) via df9b48b753cb84e8bd5a338c593202e9aaf1d07f (commit) via 1e0419c8da24544cbadf03f7eadb320cec41e675 (commit) via 35c343da7a91824cb48b069a57594e533a2003b7 (commit) via d22cf0887658f2e0de04c24ec33f9afaa0e9f4ab (commit) via 1d8c30387e0637ac0f471e9c09d196e1d74a5de7 (commit) via 3fc50622e05bc50d9efbb72585b9e357553213da (commit) via f7fc17c38a0338a0c09e03ee34edb7823d398483 (commit) via 1870e7c50f29cae327d2db5f594a30f7b9e25d95 (commit) via 3ef99ad95a20b6cd3b99036a5f8c42dc25f763f4 (commit) via f87161948c0caad91720b4057201cf47143c6140 (commit) via 3aa175f78165640be41746b970802b5ea820ef7c (commit) via a000249ff98debdc5cd0c9a18a51beede1712d88 (commit) via fb6e700b40c070f32c68c65de5daff1c72888b8b (commit) via d46bec52993235a8b185a2f040846e9059c3f4e7 (commit) via c4e04122359ee5de775bb0f69a678b7ce28f5707 (commit) via 5068ac3822ac9afbee841ac417963b2c1343d809 (commit) via d41f9e6ee88320b8a5e0433326053e21b4b0ca49 (commit) via b368a2f84d7a99c37cf19194ffa167d30363a63d (commit) via 290007b3b07ef6bc69bc97d54825fcf96eeb9eb6 (commit) via 52d08bcbd2b5da9fbd3f002c6b686a0202e6fffe (commit) via 1647059d74d406c1b3a114b8e0578765223fd19f (commit) via 9e3b87569473bd8d63dad7175564d68707c5c881 (commit) via f2621c3190fa9f3a818a7a9b3eb1e6ff5ae6d38f (commit) via 83920cfcd52b40f718170f524287dc42b41d10ed (commit) via b228aaf09d2c769535157440430d08a0f26b0e30 (commit) via e81be1e1edb0df7e11c305938838caa6c776ae8c (commit) via a66e24bbfd09b2ab2345ece2079d7143348a3980 (commit) via 07cdb8f659667b4e03a2014febca940165e723f0 (commit) via 350f298025cf2f46ad9c25e4936e9aa9682ee452 (commit) via 7db34105f9ef59b269730e137f224e2848181ccf (commit) via 8c877a82f6a63e07e2dde8d55c6e0db4893bf73d (commit) via 2ee746be048e2667c3fd6537873eb1763aa8b7b7 (commit) via ce819132f353a4ae2103fa752ffddb3fae6f01a1 (commit) via cc8ac76307ebb11b010dd6cbc83ad14c0c0c3d83 (commit) from 7c5a318f2d8674cb5fd1aa7cae220c9ffd29e8e3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit bec27ff2636c01c0085deddb4c848fc066533a41 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Dec 8 19:16:57 2012 +0100 kernel: updated i586/i586-pae config. commit ca87aefda5375729081397aee80d0b3ab8a1aeb1 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Dec 8 19:15:59 2012 +0100 kernel: update to 3.2.35. commit 0413e130db2965981a620bfe54aacd708b2e574c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Dec 6 19:57:16 2012 +0100 updater: add core65 changes to updater. commit d7a3254acedb43995d6a6e769562576cc7ff8639 Merge: 2e73299 36e1dc2 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Dec 6 19:29:29 2012 +0100 Merge remote-tracking branch 'origin/next' into thirteen Conflicts: config/rootfiles/common/stage2 make.sh commit 2e732994a12431c6f7aa14876f358da90cfc9f32 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Dec 6 17:28:46 2012 +0100 kernel: update rpi-patchset and some sound options. ----------------------------------------------------------------------- Summary of changes: config/backup/include | 3 + config/cfgroot/general-functions.pl | 298 +++- config/cron/crontab | 2 +- config/httpd/vhosts.d/ipfire-interface-ssl.conf | 10 + .../kernel/kernel.config.armv5tel-ipfire-kirkwood | 87 +- config/kernel/kernel.config.armv5tel-ipfire-omap | 15 +- config/kernel/kernel.config.armv5tel-ipfire-rpi | 18 +- config/kernel/kernel.config.i586-ipfire | 149 +- config/kernel/kernel.config.i586-ipfire-pae | 171 ++- config/kernel/kernel.config.i586-ipfire-xen | 2 +- config/rootfiles/common/armv5tel/linux-kirkwood | 78 +- config/rootfiles/common/armv5tel/linux-omap | 4 +- config/rootfiles/common/armv5tel/linux-rpi | 6 +- config/rootfiles/common/i586/linux | 138 +- config/rootfiles/common/stage2 | 3 + config/rootfiles/core/{63 => 65}/exclude | 0 config/rootfiles/core/{61 => 65}/filelists/GeoIP | 0 config/rootfiles/core/{64 => 65}/filelists/daq | 0 config/rootfiles/core/65/filelists/files | 10 + config/rootfiles/core/{60 => 65}/meta | 0 config/rootfiles/core/{61 => 65}/update.sh | 18 +- config/rootfiles/core/{61 => 66}/filelists/GeoIP | 0 config/rootfiles/core/66/filelists/files | 18 +- config/rootfiles/core/66/update.sh | 18 +- config/rootfiles/packages/libstatgrab | 35 + config/rootfiles/packages/linux-pae | 155 +-- config/rootfiles/packages/sarg | 48 + config/rootfiles/packages/stress | 3 + config/sarg/cron.daily | 5 + config/sarg/cron.hourly | 5 + config/sarg/cron.monthly | 5 + config/sarg/cron.weekly | 5 + config/sarg/sarg.conf | 696 ++++++++++ config/sarg/update-sarg-reports | 188 +++ doc/language_issues.de | 3 + doc/language_issues.en | 2 + doc/language_issues.es | 53 + doc/language_issues.fr | 49 + doc/language_issues.pl | 53 + doc/language_issues.ru | 49 + doc/language_missings | 217 +++ html/cgi-bin/logs.cgi/calamaris.dat | 85 +- html/cgi-bin/ovpnmain.cgi | 1442 +++++++++++++++++--- html/cgi-bin/vpnmain.cgi | 8 + langs/de/cgi-bin/de.pl | 52 + langs/en/cgi-bin/en.pl | 53 +- lfs/GeoIP | 4 +- lfs/{iftop => libstatgrab} | 27 +- lfs/linux | 10 +- lfs/mediatomb | 4 +- lfs/{mediatomb => sarg} | 41 +- lfs/stage2 | 3 + lfs/{joe => stress} | 27 +- make.sh | 7 +- src/paks/{motion => sarg}/install.sh | 9 +- src/paks/{motion => sarg}/uninstall.sh | 0 src/paks/{apcupsd => sarg}/update.sh | 0 src/scripts/ovpn-ccd-convert | 48 + src/scripts/update-lang-cache | 3 + 59 files changed, 3577 insertions(+), 865 deletions(-) copy config/rootfiles/core/{63 => 65}/exclude (100%) copy config/rootfiles/core/{61 => 65}/filelists/GeoIP (100%) copy config/rootfiles/core/{64 => 65}/filelists/daq (100%) create mode 100644 config/rootfiles/core/65/filelists/files copy config/rootfiles/core/{60 => 65}/meta (100%) copy config/rootfiles/core/{61 => 65}/update.sh (89%) copy config/rootfiles/core/{61 => 66}/filelists/GeoIP (100%) create mode 100644 config/rootfiles/packages/libstatgrab create mode 100644 config/rootfiles/packages/sarg create mode 100644 config/rootfiles/packages/stress create mode 100644 config/sarg/cron.daily create mode 100644 config/sarg/cron.hourly create mode 100644 config/sarg/cron.monthly create mode 100644 config/sarg/cron.weekly create mode 100644 config/sarg/sarg.conf create mode 100644 config/sarg/update-sarg-reports mode change 100644 => 100755 html/cgi-bin/ovpnmain.cgi mode change 100644 => 100755 html/cgi-bin/vpnmain.cgi copy lfs/{iftop => libstatgrab} (54%) copy lfs/{mediatomb => sarg} (78%) copy lfs/{joe => stress} (54%) copy src/paks/{motion => sarg}/install.sh (91%) copy src/paks/{motion => sarg}/uninstall.sh (100%) copy src/paks/{apcupsd => sarg}/update.sh (100%) create mode 100644 src/scripts/ovpn-ccd-convert create mode 100644 src/scripts/update-lang-cache Difference in files: diff --git a/config/backup/include b/config/backup/include index 8806640..a1d1fbc 100644 --- a/config/backup/include +++ b/config/backup/include @@ -16,6 +16,7 @@ /var/ipfire/dhcp/* /var/ipfire/main/* /var/ipfire/outgoing/groups +/var/ipfire/outgoing/macgroups /var/ipfire/outgoing/rules /var/ipfire/outgoing/p2protocols /var/ipfire/ovpn @@ -28,6 +29,8 @@ /var/ipfire/vpn /var/log/ip-acct/* /var/log/rrd/* +/var/log/rrd/collectd +/var/log/rrd/vnstat /etc/sysconfig/firewall.local /etc/sysconfig/rc.local /root/.gitconfig diff --git a/config/cfgroot/general-functions.pl b/config/cfgroot/general-functions.pl index 567f2e1..c14f990 100644 --- a/config/cfgroot/general-functions.pl +++ b/config/cfgroot/general-functions.pl @@ -18,8 +18,7 @@ use strict; use Socket; use IO::Socket; use Net::SSLeay; -use Net::IPv4Addr; - +use Net::IPv4Addr qw(:all); $|=1; # line buffering $General::version = 'VERSION'; @@ -212,21 +211,273 @@ sub validipormask return &validmask($mask); } +sub subtocidr +{ + #gets: Subnet in decimal (255.255.255.0) + #Gives: 24 (The cidr of network) + my ($byte1, $byte2, $byte3, $byte4) = split(/\./, $_[0].".0.0.0.0"); + my $num = ($byte1 * 16777216) + ($byte2 * 65536) + ($byte3 * 256) + $byte4; + my $bin = unpack("B*", pack("N", $num)); + my $count = ($bin =~ tr/1/1/); + return $count; +} + +sub cidrtosub +{ + #gets: Cidr of network (20-30 for ccd) + #Konverts 30 to 255.255.255.252 e.g + my $cidr=$_[0]; + my $netmask = &Net::IPv4Addr::ipv4_cidr2msk($cidr); + return "$netmask"; +} + +sub iporsubtodec +{ + #Gets: Ip address or subnetmask in decimal oder CIDR + #Gives: What it gets only in CIDR format + my $subnet=$_[0]; + my $net; + my $mask; + my $full=0; + if ($subnet =~ /^(.*?)\/(.*?)$/) { + ($net,$mask) = split (/\//,$subnet); + $full=1; + return "$subnet"; + }else{ + $mask=$subnet; + } + #Subnet already in decimal and valid? + if ($mask=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1<=255 && $2<=$1 && $3<=$2 && $4<=$3 ))) { + for (my $i=8;$i<=32;$i++){ + if (&General::cidrtosub($i) eq $mask){ + if ($full == 0){return $mask;}else{ + return $net."/".$mask; + } + } + } + } + #Subnet in binary format? + if ($mask=~/^(\d{1,2})$/ && (($1<=32 && $1>=8))){ + if($full == 0){ return &General::cidrtosub($mask);}else{ + return $net."/".&General::cidrtosub($mask); + } + }else{ + return 3; + } + return 3; +} + + +sub iporsubtocidr +{ + #gets: Ip Address or subnetmask in decimal oder CIDR + #Gives: What it gets only in CIDR format + my $subnet=$_[0]; + my $net; + my $mask; + my $full=0; + if ($subnet =~ /^(.*?)\/(.*?)$/) { + ($net,$mask) = split (/\//,$subnet); + $full=1; + }else{ + $mask=$subnet; + } + #Subnet in decimal and valid? + if ($mask=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1<=255 && $2<=$1 && $3<=$2 && $4<=$3 ))) { + for (my $i=8;$i<=32;$i++){ + if (&General::cidrtosub($i) eq $mask){ + if ($full == 0){return &General::subtocidr($mask);}else{ + return $net."/".&General::subtocidr($mask); + } + } + } + } + #Subnet already in binary format? + if ($mask=~/^(\d{1,2})$/ && (($1<=32 && $1>=8))){ + if($full == 0){ return $mask;}else{ + return $net."/".$mask; + } + }else{ + return 3; + } + return 3; +} + +sub getnetworkip +{ + #Gets: IP, CIDR (10.10.10.0-255, 24) + #Gives: 10.10.10.0 + my ($ccdip,$ccdsubnet) = @_; + my $ip_address_binary = inet_aton( $ccdip ); + my $netmask_binary = ~pack("N", (2**(32-$ccdsubnet))-1); + my $network_address = inet_ntoa( $ip_address_binary & $netmask_binary ); + return $network_address; +} + +sub getccdbc +{ + #Gets: IP in Form ("192.168.0.0/24") + #Gives: Broadcastaddress of network + my $ccdnet=$_; + my ($ccdip,$ccdsubnet) = split "/",$ccdnet; + my $ip_address_binary = inet_aton( $ccdip ); + my $netmask_binary = ~pack("N", (2**(32-$ccdsubnet))-1); + my $broadcast_address = inet_ntoa( $ip_address_binary | ~$netmask_binary ); + return $broadcast_address; +} + +sub ip2dec +{ + my $ip_num; + my $ip=$_[0]; + if ( $ip =~ /(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/ ) { + $ip_num = (($1*256**3) + ($2*256**2) + ($3*256) + $4); + } else { + $ip_num = -1; + } + $ip_num = (($1*256**3) + ($2*256**2) + ($3*256) + $4); + return($ip_num); +} + +sub dec2ip +{ + my $ip; + my $ip_num=$_[0]; + my $o1=$ip_num%256; + $ip_num=int($ip_num/256); + my $o2=$ip_num%256; + $ip_num=int($ip_num/256); + my $o3=$ip_num%256; + $ip_num=int($ip_num/256); + my $o4=$ip_num%256; + $ip="$o4.$o3.$o2.$o1"; + return ($ip); +} + +sub getnextip +{ + my $decip=&ip2dec($_[0]); + $decip=$decip+4; + return &dec2ip($decip); +} + +sub getlastip +{ + my $decip=&ip2dec($_[0]); + $decip--; + return &dec2ip($decip); +} + sub validipandmask { - my $ipandmask = $_[0]; + #Gets: Ip address in 192.168.0.0/24 or 192.168.0.0/255.255.255.0 and checks if subnet valid + #Gives: True bzw 0 if success or false + my $ccdnet=$_[0]; + my $subcidr; + + if (!($ccdnet =~ /^(.*?)\/(.*?)$/)) { + return 0; + } + my ($ccdip,$ccdsubnet)=split (/\//, $ccdnet); + #IP valid? + if ($ccdip=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1>0 && $1<=255 && $2>=0 && $2<=255 && $3>=0 && $3<=255 && $4<=255 ))) { + #Subnet in decimal and valid? + if ($ccdsubnet=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1<=255 && $2<=$1 && $3<=$2 && $4<=$3 ))) { + for (my $i=8;$i<=32;$i++){ + if (&General::cidrtosub($i) eq $ccdsubnet){ + return 1; + } + } + #Subnet already in binary format? + }elsif ($ccdsubnet=~/^(\d{1,2})$/ && (($1<=32 && $1>=8))){ + return 1; + }else{ + return 0; + } + + } + return 0; +} + +sub checksubnets +{ + + my %ccdconfhash=(); + my @ccdconf=(); + my $ccdname=$_[0]; + my $ccdnet=$_[1]; + my $errormessage; + my ($ip,$cidr)=split(/\//,$ccdnet); + $cidr=&iporsubtocidr($cidr); + + + #get OVPN-Subnet (dynamic range) + my %ovpnconf=(); + &readhash("${General::swroot}/ovpn/settings", \%ovpnconf); + my ($ovpnip,$ovpncidr)= split (/\//,$ovpnconf{'DOVPN_SUBNET'}); + $ovpncidr=&iporsubtocidr($ovpncidr); + + #check if we try to use same network as ovpn server + if ("$ip/$cidr" eq "$ovpnip/$ovpncidr") { + $errormessage=$errormessage.$Lang::tr{'ccd err isovpnnet'}."<br>"; + return $errormessage; + } + + #check if we use a network-name/subnet that already exists + &readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + foreach my $key (keys %ccdconfhash) { + @ccdconf=split(/\//,$ccdconfhash{$key}[1]); + if ($ccdname eq $ccdconfhash{$key}[0]) + { + $errormessage=$errormessage.$Lang::tr{'ccd err nameexist'}."<br>"; + return $errormessage; + } + my ($newip,$newsub) = split(/\//,$ccdnet); + if (&IpInSubnet($newip,$ccdconf[0],&iporsubtodec($ccdconf[1]))) + { + $errormessage=$errormessage.$Lang::tr{'ccd err issubnet'}."<br>"; + return $errormessage; + } + + } + #check if we use a name which is already used by ovpn + + + + + + #check if we use a ipsec right network which is already defined + my %ipsecconf=(); + &General::readhasharray("${General::swroot}/vpn/config", \%ipsecconf); + foreach my $key (keys %ipsecconf){ + if ($ipsecconf{$key}[11] ne ''){ + #$errormessage="DRIN!"; + #return $errormessage; + + my ($ipsecip,$ipsecsub) = split (/\//, $ipsecconf{$key}[11]); + $ipsecsub=&iporsubtodec($ipsecsub); + + if ( &IpInSubnet ($ip,$ipsecip,$ipsecsub) ){ + $errormessage=$Lang::tr{'ccd err isipsecnet'}." Name: $ipsecconf{$key}[2]"; + return $errormessage; + } + } + } + + + #check if we use one of ipfire's networks (green,orange,blue) + my %ownnet=(); + &readhash("${General::swroot}/ethernet/settings", \%ownnet); + if (($ownnet{'GREEN_NETADDRESS'} ne '' && $ownnet{'GREEN_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ownnet{'GREEN_NETADDRESS'},$ip,&iporsubtodec($cidr))){ $errormessage=$Lang::tr{'ccd err green'};return $errormessage;} + if (($ownnet{'ORANGE_NETADDRESS'} ne '' && $ownnet{'ORANGE_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ownnet{'ORANGE_NETADDRESS'},$ip,&iporsubtodec($cidr))){ $errormessage=$Lang::tr{'ccd err orange'};return $errormessage;} + if (($ownnet{'BLUE_NETADDRESS'} ne '' && $ownnet{'BLUE_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ownnet{'BLUE_NETADDRESS'},$ip,&iporsubtodec($cidr))){ $errormessage=$Lang::tr{'ccd err blue'};return $errormessage;} + if (($ownnet{'RED_NETADDRESS'} ne '' && $ownnet{'RED_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ownnet{'RED_NETADDRESS'},$ip,&iporsubtodec($cidr))){ $errormessage=$Lang::tr{'ccd err red'};return $errormessage;} + + - # split it into number and mask. - if (!($ipandmask =~ /^(.*?)\/(.*?)$/)) { - return 0; } - my $ip = $1; - my $mask = $2; - # first part not a ip? - if (!(&validip($ip))) { - return 0; } - return &validmask($mask); } + sub validport { $_ = $_[0]; @@ -276,7 +527,7 @@ sub validhostname if (length ($hostname) < 1 || length ($hostname) > 63) { return 0;} # Only valid characters are a-z, A-Z, 0-9 and - - if ($hostname !~ /^[a-zA-Z0-9-]*$/) { + if ($hostname !~ /^[a-zA-Z0-9-\s]*$/) { return 0;} # First character can only be a letter or a digit if (substr ($hostname, 0, 1) !~ /^[a-zA-Z0-9]*$/) { @@ -407,7 +658,12 @@ sub NextIP ) ); } - +sub NextIP2 +{ + return &Socket::inet_ntoa( pack("N", 4 + unpack('N', &Socket::inet_aton(shift)) + ) + ); +} sub ipcidr { my ($ip,$cidr) = &Net::IPv4Addr::ipv4_parse(shift); @@ -465,13 +721,13 @@ sub writehasharray { open(FILE, ">$filename") or die "Unable to write to file $filename"; foreach $key (keys %$hash) { - if ($key =~ /^[0-9]+$/) { - print FILE "$key"; - foreach $i (0 .. $#{$hash->{$key}}) { - print FILE ",$hash->{$key}[$i]"; - } - print FILE "\n"; - } + if ($key =~ /^[0-9]+$/) { + print FILE "$key"; + foreach $i (0 .. $#{$hash->{$key}}) { + print FILE ",$hash->{$key}[$i]"; + } + print FILE "\n"; + } } close FILE; return; diff --git a/config/cron/crontab b/config/cron/crontab index 5cca1fa..ad90b07 100644 --- a/config/cron/crontab +++ b/config/cron/crontab @@ -11,7 +11,7 @@ HOME=/ */5 * * * * test -x /usr/local/bin/run-parts && /usr/local/bin/run-parts /etc/fcron.cyclic 01 * * * * test -x /usr/local/bin/run-parts && /usr/local/bin/run-parts /etc/fcron.hourly &nice(10),bootrun 25 1 * * * test -x /usr/local/bin/run-parts && /usr/local/bin/run-parts /etc/fcron.daily -&nice(10),bootrun 47 2 * * 0 test -x /usr/local/bin/run-parts && /usr/local/bin/run-parts /etc/fcron.weekly +&nice(10),bootrun 47 2 * * 1 test -x /usr/local/bin/run-parts && /usr/local/bin/run-parts /etc/fcron.weekly &nice(10),bootrun 52 3 1 * * test -x /usr/local/bin/run-parts && /usr/local/bin/run-parts /etc/fcron.monthly # Log rotation diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index 7b10832..cc3cb1d 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -85,4 +85,14 @@ Order deny,allow Allow from all </Directory> + + Alias /proxy-reports/ /var/log/sarg/ + <Directory /var/log/sarg> + AllowOverride None + Options None + AuthName "IPFire - Restricted" + AuthType Basic + AuthUserFile /var/ipfire/auth/users + Require user admin + </Directory> </VirtualHost> diff --git a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood index d6c96d5..715c7fa 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood +++ b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 3.2.33 Kernel Configuration +# Linux/arm 3.2.34-ipfire-kirkwood Kernel Configuration # CONFIG_ARM=y CONFIG_SYS_SUPPORTS_APM_EMULATION=y @@ -3004,7 +3004,8 @@ CONFIG_SND_MIXER_OSS=m CONFIG_SND_PCM_OSS=m CONFIG_SND_PCM_OSS_PLUGINS=y CONFIG_SND_SEQUENCER_OSS=y -# CONFIG_SND_HRTIMER is not set +CONFIG_SND_HRTIMER=m +CONFIG_SND_SEQ_HRTIMER_DEFAULT=y CONFIG_SND_DYNAMIC_MINORS=y # CONFIG_SND_SUPPORT_OLD_API is not set CONFIG_SND_VERBOSE_PROCFS=y @@ -3029,7 +3030,8 @@ CONFIG_SND_MTS64=m CONFIG_SND_SERIAL_U16550=m CONFIG_SND_MPU401=m CONFIG_SND_PORTMAN2X4=m -# CONFIG_SND_AC97_POWER_SAVE is not set +CONFIG_SND_AC97_POWER_SAVE=y +CONFIG_SND_AC97_POWER_SAVE_DEFAULT=60 CONFIG_SND_PCI=y CONFIG_SND_AD1889=m CONFIG_SND_ALS300=m @@ -3126,7 +3128,7 @@ CONFIG_SND_USB=y CONFIG_SND_USB_AUDIO=m CONFIG_SND_USB_UA101=m CONFIG_SND_USB_CAIAQ=m -# CONFIG_SND_USB_CAIAQ_INPUT is not set +CONFIG_SND_USB_CAIAQ_INPUT=y CONFIG_SND_USB_6FIRE=m CONFIG_SND_FIREWIRE=y CONFIG_SND_FIREWIRE_LIB=m @@ -3142,84 +3144,9 @@ CONFIG_SND_KIRKWOOD_SOC_I2S=m CONFIG_SND_KIRKWOOD_SOC_OPENRD=m CONFIG_SND_KIRKWOOD_SOC_T5325=m CONFIG_SND_SOC_I2C_AND_SPI=m -CONFIG_SND_SOC_ALL_CODECS=m -CONFIG_SND_SOC_88PM860X=m -CONFIG_SND_SOC_WM_HUBS=m -CONFIG_SND_SOC_AD193X=m -CONFIG_SND_SOC_AD73311=m -CONFIG_SND_SOC_ADAU1373=m -CONFIG_SND_SOC_ADAV80X=m -CONFIG_SND_SOC_ADS117X=m -CONFIG_SND_SOC_AK4535=m -CONFIG_SND_SOC_AK4641=m -CONFIG_SND_SOC_AK4642=m -CONFIG_SND_SOC_AK4671=m +# CONFIG_SND_SOC_ALL_CODECS is not set CONFIG_SND_SOC_ALC5623=m CONFIG_SND_SOC_CS42L51=m -CONFIG_SND_SOC_CS4270=m -CONFIG_SND_SOC_CS4271=m -CONFIG_SND_SOC_CX20442=m -CONFIG_SND_SOC_JZ4740_CODEC=m -CONFIG_SND_SOC_L3=m -CONFIG_SND_SOC_DA7210=m -CONFIG_SND_SOC_DFBMCS320=m -CONFIG_SND_SOC_MAX98088=m -CONFIG_SND_SOC_MAX98095=m -CONFIG_SND_SOC_MAX9850=m -CONFIG_SND_SOC_PCM3008=m -CONFIG_SND_SOC_RT5631=m -CONFIG_SND_SOC_SGTL5000=m -CONFIG_SND_SOC_SPDIF=m -CONFIG_SND_SOC_SSM2602=m -CONFIG_SND_SOC_STA32X=m -CONFIG_SND_SOC_TLV320AIC23=m -CONFIG_SND_SOC_TLV320AIC32X4=m -CONFIG_SND_SOC_TLV320AIC3X=m -CONFIG_SND_SOC_TLV320DAC33=m -CONFIG_SND_SOC_UDA134X=m -CONFIG_SND_SOC_UDA1380=m -CONFIG_SND_SOC_WM1250_EV1=m -CONFIG_SND_SOC_WM5100=m -CONFIG_SND_SOC_WM8400=m -CONFIG_SND_SOC_WM8510=m -CONFIG_SND_SOC_WM8523=m -CONFIG_SND_SOC_WM8580=m -CONFIG_SND_SOC_WM8711=m -CONFIG_SND_SOC_WM8727=m -CONFIG_SND_SOC_WM8728=m -CONFIG_SND_SOC_WM8731=m -CONFIG_SND_SOC_WM8737=m -CONFIG_SND_SOC_WM8741=m -CONFIG_SND_SOC_WM8750=m -CONFIG_SND_SOC_WM8753=m -CONFIG_SND_SOC_WM8776=m -CONFIG_SND_SOC_WM8782=m -CONFIG_SND_SOC_WM8804=m -CONFIG_SND_SOC_WM8900=m -CONFIG_SND_SOC_WM8903=m -CONFIG_SND_SOC_WM8904=m -CONFIG_SND_SOC_WM8940=m -CONFIG_SND_SOC_WM8955=m -CONFIG_SND_SOC_WM8960=m -CONFIG_SND_SOC_WM8961=m -CONFIG_SND_SOC_WM8962=m -CONFIG_SND_SOC_WM8971=m -CONFIG_SND_SOC_WM8974=m -CONFIG_SND_SOC_WM8978=m -CONFIG_SND_SOC_WM8983=m -CONFIG_SND_SOC_WM8985=m -CONFIG_SND_SOC_WM8988=m -CONFIG_SND_SOC_WM8990=m -CONFIG_SND_SOC_WM8991=m -CONFIG_SND_SOC_WM8993=m -CONFIG_SND_SOC_WM8995=m -CONFIG_SND_SOC_WM8996=m -CONFIG_SND_SOC_WM9081=m -CONFIG_SND_SOC_LM4857=m -CONFIG_SND_SOC_MAX9877=m -CONFIG_SND_SOC_TPA6130A2=m -CONFIG_SND_SOC_WM2000=m -CONFIG_SND_SOC_WM9090=m # CONFIG_SOUND_PRIME is not set CONFIG_AC97_BUS=m CONFIG_HID_SUPPORT=y diff --git a/config/kernel/kernel.config.armv5tel-ipfire-omap b/config/kernel/kernel.config.armv5tel-ipfire-omap index 8e0d2d6..ef5c5cc 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-omap +++ b/config/kernel/kernel.config.armv5tel-ipfire-omap @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 3.2.33 Kernel Configuration +# Linux/arm 3.2.34 Kernel Configuration # CONFIG_ARM=y CONFIG_HAVE_PWM=y @@ -40,8 +40,8 @@ CONFIG_LOCALVERSION="" CONFIG_HAVE_KERNEL_GZIP=y CONFIG_HAVE_KERNEL_LZMA=y CONFIG_HAVE_KERNEL_LZO=y -CONFIG_KERNEL_GZIP=y -# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_GZIP is not set +CONFIG_KERNEL_LZMA=y # CONFIG_KERNEL_LZO is not set CONFIG_DEFAULT_HOSTNAME="(none)" CONFIG_SWAP=y @@ -2539,8 +2539,9 @@ CONFIG_SND_MIXER_OSS=m CONFIG_SND_PCM_OSS=m CONFIG_SND_PCM_OSS_PLUGINS=y CONFIG_SND_SEQUENCER_OSS=y -# CONFIG_SND_HRTIMER is not set -# CONFIG_SND_DYNAMIC_MINORS is not set +CONFIG_SND_HRTIMER=m +CONFIG_SND_SEQ_HRTIMER_DEFAULT=y +CONFIG_SND_DYNAMIC_MINORS=y # CONFIG_SND_SUPPORT_OLD_API is not set CONFIG_SND_VERBOSE_PROCFS=y # CONFIG_SND_VERBOSE_PRINTK is not set @@ -2553,7 +2554,7 @@ CONFIG_SND_RAWMIDI_SEQ=m CONFIG_SND_MPU401_UART=m CONFIG_SND_DRIVERS=y CONFIG_SND_DUMMY=m -# CONFIG_SND_ALOOP is not set +CONFIG_SND_ALOOP=m CONFIG_SND_VIRMIDI=m CONFIG_SND_MTPAV=m CONFIG_SND_MTS64=m @@ -2568,7 +2569,7 @@ CONFIG_SND_USB_CAIAQ=m # CONFIG_SND_USB_CAIAQ_INPUT is not set CONFIG_SND_USB_6FIRE=m CONFIG_SND_SOC=m -# CONFIG_SND_SOC_CACHE_LZO is not set +CONFIG_SND_SOC_CACHE_LZO=y CONFIG_SND_OMAP_SOC=m CONFIG_SND_OMAP_SOC_MCBSP=m CONFIG_SND_OMAP_SOC_MCPDM=m diff --git a/config/kernel/kernel.config.armv5tel-ipfire-rpi b/config/kernel/kernel.config.armv5tel-ipfire-rpi index 5845885..1b86625 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-rpi +++ b/config/kernel/kernel.config.armv5tel-ipfire-rpi @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 3.2.33 Kernel Configuration +# Linux/arm 3.2.34-ipfire-rpi Kernel Configuration # CONFIG_ARM=y CONFIG_SYS_SUPPORTS_APM_EMULATION=y @@ -42,8 +42,8 @@ CONFIG_LOCALVERSION="" CONFIG_HAVE_KERNEL_GZIP=y CONFIG_HAVE_KERNEL_LZMA=y CONFIG_HAVE_KERNEL_LZO=y -CONFIG_KERNEL_GZIP=y -# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_GZIP is not set +CONFIG_KERNEL_LZMA=y # CONFIG_KERNEL_LZO is not set CONFIG_DEFAULT_HOSTNAME="(none)" CONFIG_SWAP=y @@ -124,9 +124,10 @@ CONFIG_PERF_USE_VMALLOC=y # CONFIG_PERF_EVENTS is not set # CONFIG_PERF_COUNTERS is not set CONFIG_VM_EVENT_COUNTERS=y +CONFIG_SLUB_DEBUG=y # CONFIG_COMPAT_BRK is not set -CONFIG_SLAB=y -# CONFIG_SLUB is not set +# CONFIG_SLAB is not set +CONFIG_SLUB=y # CONFIG_SLOB is not set # CONFIG_PROFILING is not set CONFIG_HAVE_OPROFILE=y @@ -271,6 +272,7 @@ CONFIG_MACH_BCM2708=y CONFIG_BCM2708_GPIO=y CONFIG_BCM2708_VCMEM=y # CONFIG_BCM2708_NOL2CACHE is not set +CONFIG_BCM2708_DMAER=m # # Processor Type @@ -1612,6 +1614,7 @@ CONFIG_I2C_ALGOPCA=m # I2C system bus drivers (mostly embedded / system-on-chip) # CONFIG_I2C_BCM2708=m +CONFIG_I2C_BCM2708_BAUDRATE=100000 # CONFIG_I2C_DESIGNWARE_PLATFORM is not set CONFIG_I2C_GPIO=m CONFIG_I2C_OCORES=m @@ -2219,7 +2222,7 @@ CONFIG_SND_PCM_OSS_PLUGINS=y CONFIG_SND_SEQUENCER_OSS=y CONFIG_SND_HRTIMER=m CONFIG_SND_SEQ_HRTIMER_DEFAULT=y -# CONFIG_SND_DYNAMIC_MINORS is not set +CONFIG_SND_DYNAMIC_MINORS=y CONFIG_SND_SUPPORT_OLD_API=y CONFIG_SND_VERBOSE_PROCFS=y # CONFIG_SND_VERBOSE_PRINTK is not set @@ -2947,7 +2950,8 @@ CONFIG_SCHED_DEBUG=y # CONFIG_SCHEDSTATS is not set CONFIG_TIMER_STATS=y # CONFIG_DEBUG_OBJECTS is not set -# CONFIG_DEBUG_SLAB is not set +# CONFIG_SLUB_DEBUG_ON is not set +CONFIG_SLUB_STATS=y # CONFIG_DEBUG_KMEMLEAK is not set # CONFIG_DEBUG_RT_MUTEXES is not set # CONFIG_RT_MUTEX_TESTER is not set diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 0054ffc..b881d16 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/i386 3.2.34-ipfire Kernel Configuration +# Linux/i386 3.2.35 Kernel Configuration # # CONFIG_64BIT is not set CONFIG_X86_32=y @@ -921,7 +921,9 @@ CONFIG_ATM_CLIP_NO_ICMP=y CONFIG_ATM_BR2684=m # CONFIG_ATM_BR2684_IPFILTER is not set CONFIG_L2TP=m -# CONFIG_L2TP_V3 is not set +CONFIG_L2TP_V3=y +CONFIG_L2TP_IP=m +CONFIG_L2TP_ETH=m CONFIG_STP=m CONFIG_GARP=m CONFIG_BRIDGE=m @@ -948,7 +950,7 @@ CONFIG_LLC=m # CONFIG_WAN_ROUTER is not set # CONFIG_PHONET is not set CONFIG_IEEE802154=m -# CONFIG_IEEE802154_6LOWPAN is not set +CONFIG_IEEE802154_6LOWPAN=m CONFIG_NET_SCHED=y # @@ -1003,14 +1005,15 @@ CONFIG_NET_ACT_MIRRED=m CONFIG_NET_ACT_IPT=m CONFIG_NET_ACT_NAT=m CONFIG_NET_ACT_PEDIT=m -# CONFIG_NET_ACT_SIMP is not set +CONFIG_NET_ACT_SIMP=m CONFIG_NET_ACT_SKBEDIT=m CONFIG_NET_ACT_CSUM=m CONFIG_NET_CLS_IND=y CONFIG_NET_SCH_FIFO=y # CONFIG_DCB is not set CONFIG_DNS_RESOLVER=y -# CONFIG_BATMAN_ADV is not set +CONFIG_BATMAN_ADV=m +# CONFIG_BATMAN_ADV_DEBUG is not set CONFIG_RPS=y CONFIG_RFS_ACCEL=y CONFIG_XPS=y @@ -1137,9 +1140,12 @@ CONFIG_MAC80211_LEDS=y CONFIG_RFKILL=m CONFIG_RFKILL_LEDS=y CONFIG_RFKILL_INPUT=y +CONFIG_RFKILL_REGULATOR=m # CONFIG_NET_9P is not set # CONFIG_CAIF is not set -# CONFIG_CEPH_LIB is not set +CONFIG_CEPH_LIB=m +# CONFIG_CEPH_LIB_PRETTYDEBUG is not set +# CONFIG_CEPH_LIB_USE_DNS_RESOLVER is not set # CONFIG_NFC is not set # @@ -1289,7 +1295,7 @@ CONFIG_BLK_DEV_RAM_SIZE=16384 CONFIG_ATA_OVER_ETH=m CONFIG_VIRTIO_BLK=m # CONFIG_BLK_DEV_HD is not set -# CONFIG_BLK_DEV_RBD is not set +CONFIG_BLK_DEV_RBD=m CONFIG_SENSORS_LIS3LV02D=m CONFIG_MISC_DEVICES=y # CONFIG_AD525X_DPOT is not set @@ -1301,6 +1307,9 @@ CONFIG_TIFM_CORE=m CONFIG_TIFM_7XX1=m CONFIG_ICS932S401=m CONFIG_ENCLOSURE_SERVICES=m +CONFIG_CS5535_MFGPT=m +CONFIG_CS5535_MFGPT_DEFAULT_IRQ=7 +CONFIG_CS5535_CLOCK_EVENT_SRC=m CONFIG_HP_ILO=m CONFIG_APDS9802ALS=m CONFIG_ISL29003=m @@ -2384,6 +2393,7 @@ CONFIG_SERIAL_8250_RSA=y # Non-8250 serial port support # CONFIG_SERIAL_MFD_HSU=m +CONFIG_SERIAL_UARTLITE=m CONFIG_SERIAL_CORE=y CONFIG_SERIAL_CORE_CONSOLE=y # CONFIG_SERIAL_JSM is not set @@ -2504,7 +2514,7 @@ CONFIG_I2C_EG20T=m CONFIG_I2C_DIOLAN_U2C=m CONFIG_I2C_PARPORT=m CONFIG_I2C_PARPORT_LIGHT=m -# CONFIG_I2C_TAOS_EVM is not set +CONFIG_I2C_TAOS_EVM=m CONFIG_I2C_TINY_USB=m # @@ -2541,11 +2551,11 @@ CONFIG_PPS=m # PTP clock support # CONFIG_PTP_1588_CLOCK=m -# CONFIG_DP83640_PHY is not set +CONFIG_DP83640_PHY=m CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y CONFIG_GPIOLIB=y # CONFIG_DEBUG_GPIO is not set -# CONFIG_GPIO_SYSFS is not set +CONFIG_GPIO_SYSFS=y CONFIG_GPIO_GENERIC=m CONFIG_GPIO_MAX730X=m @@ -2569,10 +2579,12 @@ CONFIG_GPIO_ADP5588=m # # PCI GPIO expanders: # +CONFIG_GPIO_CS5535=m # CONFIG_GPIO_BT8XX is not set # CONFIG_GPIO_LANGWELL is not set CONFIG_GPIO_PCH=m CONFIG_GPIO_ML_IOH=m +# CONFIG_GPIO_TIMBERDALE is not set CONFIG_GPIO_RDC321X=m # @@ -2583,10 +2595,12 @@ CONFIG_GPIO_MCP23S08=m # # AC97 GPIO expanders: # +# CONFIG_GPIO_UCB1400 is not set # # MODULbus GPIO expanders: # +CONFIG_GPIO_JANZ_TTL=m CONFIG_W1=m CONFIG_W1_CON=y @@ -2618,14 +2632,12 @@ CONFIG_POWER_SUPPLY=y # CONFIG_TEST_POWER is not set # CONFIG_BATTERY_DS2760 is not set # CONFIG_BATTERY_DS2780 is not set -CONFIG_BATTERY_DS2782=m +# CONFIG_BATTERY_DS2782 is not set # CONFIG_BATTERY_BQ20Z75 is not set -CONFIG_BATTERY_BQ27x00=m -CONFIG_BATTERY_BQ27X00_I2C=y -CONFIG_BATTERY_BQ27X00_PLATFORM=y -CONFIG_BATTERY_MAX17040=m +# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_BATTERY_MAX17040 is not set # CONFIG_BATTERY_MAX17042 is not set -CONFIG_CHARGER_PCF50633=m +# CONFIG_CHARGER_PCF50633 is not set # CONFIG_CHARGER_ISP1704 is not set # CONFIG_CHARGER_MAX8903 is not set # CONFIG_CHARGER_GPIO is not set @@ -2769,6 +2781,7 @@ CONFIG_ALIM1535_WDT=m CONFIG_ALIM7101_WDT=m CONFIG_F71808E_WDT=m CONFIG_SP5100_TCO=m +CONFIG_GEODE_WDT=m CONFIG_SC520_WDT=m CONFIG_SBC_FITPC2_WATCHDOG=m CONFIG_EUROTECH_WDT=m @@ -2851,24 +2864,44 @@ CONFIG_MFD_CORE=m CONFIG_MFD_SM501=m # CONFIG_MFD_SM501_GPIO is not set CONFIG_HTC_PASIC3=m -# CONFIG_UCB1400_CORE is not set -# CONFIG_TPS6105X is not set -# CONFIG_TPS65010 is not set -# CONFIG_TPS6507X is not set +CONFIG_UCB1400_CORE=m +CONFIG_TPS6105X=m +CONFIG_TPS65010=m +CONFIG_TPS6507X=m # CONFIG_MFD_TMIO is not set CONFIG_MFD_WM8400=m CONFIG_MFD_PCF50633=m CONFIG_PCF50633_ADC=m CONFIG_PCF50633_GPIO=m # CONFIG_ABX500_CORE is not set -# CONFIG_MFD_CS5535 is not set -# CONFIG_MFD_TIMBERDALE is not set +CONFIG_MFD_CS5535=m +CONFIG_MFD_TIMBERDALE=m CONFIG_LPC_SCH=m CONFIG_MFD_RDC321X=m -# CONFIG_MFD_JANZ_CMODIO is not set +CONFIG_MFD_JANZ_CMODIO=m CONFIG_MFD_VX855=m -# CONFIG_MFD_WL1273_CORE is not set -# CONFIG_REGULATOR is not set +CONFIG_MFD_WL1273_CORE=m +CONFIG_REGULATOR=y +# CONFIG_REGULATOR_DEBUG is not set +# CONFIG_REGULATOR_DUMMY is not set +CONFIG_REGULATOR_FIXED_VOLTAGE=m +# CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set +# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set +CONFIG_REGULATOR_GPIO=m +# CONFIG_REGULATOR_BQ24022 is not set +# CONFIG_REGULATOR_MAX1586 is not set +# CONFIG_REGULATOR_MAX8649 is not set +# CONFIG_REGULATOR_MAX8660 is not set +# CONFIG_REGULATOR_MAX8952 is not set +# CONFIG_REGULATOR_WM8400 is not set +# CONFIG_REGULATOR_PCF50633 is not set +# CONFIG_REGULATOR_LP3971 is not set +# CONFIG_REGULATOR_LP3972 is not set +# CONFIG_REGULATOR_TPS6105X is not set +# CONFIG_REGULATOR_TPS65023 is not set +# CONFIG_REGULATOR_TPS6507X is not set +# CONFIG_REGULATOR_ISL6271A is not set +# CONFIG_REGULATOR_AD5398 is not set CONFIG_MEDIA_SUPPORT=m # @@ -2888,14 +2921,14 @@ CONFIG_VIDEO_MEDIA=m CONFIG_RC_CORE=m CONFIG_LIRC=m CONFIG_RC_MAP=m -CONFIG_IR_NEC_DECODER=m -CONFIG_IR_RC5_DECODER=m -CONFIG_IR_RC6_DECODER=m -CONFIG_IR_JVC_DECODER=m -CONFIG_IR_SONY_DECODER=m -CONFIG_IR_RC5_SZ_DECODER=m -CONFIG_IR_MCE_KBD_DECODER=m -CONFIG_IR_LIRC_CODEC=m +# CONFIG_IR_NEC_DECODER is not set +# CONFIG_IR_RC5_DECODER is not set +# CONFIG_IR_RC6_DECODER is not set +# CONFIG_IR_JVC_DECODER is not set +# CONFIG_IR_SONY_DECODER is not set +# CONFIG_IR_RC5_SZ_DECODER is not set +# CONFIG_IR_MCE_KBD_DECODER is not set +# CONFIG_IR_LIRC_CODEC is not set # CONFIG_RC_ATI_REMOTE is not set # CONFIG_IR_ENE is not set # CONFIG_IR_IMON is not set @@ -2907,7 +2940,7 @@ CONFIG_IR_LIRC_CODEC=m # CONFIG_IR_STREAMZAP is not set # CONFIG_IR_WINBOND_CIR is not set # CONFIG_RC_LOOPBACK is not set -# CONFIG_MEDIA_ATTACH is not set +CONFIG_MEDIA_ATTACH=y CONFIG_MEDIA_TUNER=m # CONFIG_MEDIA_TUNER_CUSTOMISE is not set CONFIG_MEDIA_TUNER_SIMPLE=m @@ -3085,6 +3118,7 @@ CONFIG_RADIO_ADAPTERS=y # CONFIG_RADIO_TEA5764 is not set # CONFIG_RADIO_SAA7706H is not set # CONFIG_RADIO_TEF6862 is not set +# CONFIG_RADIO_TIMBERDALE is not set # CONFIG_RADIO_WL1273 is not set # @@ -3223,7 +3257,7 @@ CONFIG_DRM_TTM=m CONFIG_DRM_TDFX=m CONFIG_DRM_R128=m CONFIG_DRM_RADEON=m -# CONFIG_DRM_RADEON_KMS is not set +CONFIG_DRM_RADEON_KMS=y CONFIG_DRM_I810=m CONFIG_DRM_I915=m CONFIG_DRM_I915_KMS=y @@ -3593,7 +3627,8 @@ CONFIG_USB_HIDDEV=y # Special HID drivers # CONFIG_HID_A4TECH=m -# CONFIG_HID_ACRUX is not set +CONFIG_HID_ACRUX=m +# CONFIG_HID_ACRUX_FF is not set CONFIG_HID_APPLE=m CONFIG_HID_BELKIN=m CONFIG_HID_CHERRY=m @@ -3601,7 +3636,7 @@ CONFIG_HID_CHICONY=m CONFIG_HID_PRODIKEYS=m CONFIG_HID_CYPRESS=m CONFIG_HID_DRAGONRISE=m -CONFIG_DRAGONRISE_FF=y +# CONFIG_DRAGONRISE_FF is not set # CONFIG_HID_EMS_FF is not set CONFIG_HID_ELECOM=m CONFIG_HID_EZKEY=m @@ -3616,18 +3651,18 @@ CONFIG_HID_KENSINGTON=m CONFIG_HID_LCPOWER=m CONFIG_HID_LOGITECH=m CONFIG_HID_LOGITECH_DJ=m -CONFIG_LOGITECH_FF=y -CONFIG_LOGIRUMBLEPAD2_FF=y +# CONFIG_LOGITECH_FF is not set +# CONFIG_LOGIRUMBLEPAD2_FF is not set # CONFIG_LOGIG940_FF is not set # CONFIG_LOGIWHEELS_FF is not set -# CONFIG_HID_MAGICMOUSE is not set +CONFIG_HID_MAGICMOUSE=m CONFIG_HID_MICROSOFT=m CONFIG_HID_MONTEREY=m CONFIG_HID_MULTITOUCH=m CONFIG_HID_NTRIG=m CONFIG_HID_ORTEK=m CONFIG_HID_PANTHERLORD=m -CONFIG_PANTHERLORD_FF=y +# CONFIG_PANTHERLORD_FF is not set CONFIG_HID_PETALYNX=m CONFIG_HID_PICOLCD=m CONFIG_HID_PICOLCD_FB=y @@ -3648,17 +3683,17 @@ CONFIG_HID_SONY=m CONFIG_HID_SPEEDLINK=m CONFIG_HID_SUNPLUS=m CONFIG_HID_GREENASIA=m -CONFIG_GREENASIA_FF=y +# CONFIG_GREENASIA_FF is not set CONFIG_HID_SMARTJOYPLUS=m -CONFIG_SMARTJOYPLUS_FF=y +# CONFIG_SMARTJOYPLUS_FF is not set CONFIG_HID_TOPSEED=m CONFIG_HID_THRUSTMASTER=m -CONFIG_THRUSTMASTER_FF=y +# CONFIG_THRUSTMASTER_FF is not set CONFIG_HID_WACOM=m # CONFIG_HID_WACOM_POWER_SUPPLY is not set CONFIG_HID_WIIMOTE=m CONFIG_HID_ZEROPLUS=m -CONFIG_ZEROPLUS_FF=y +# CONFIG_ZEROPLUS_FF is not set CONFIG_HID_ZYDACRON=m CONFIG_USB_SUPPORT=y CONFIG_USB_COMMON=y @@ -3730,7 +3765,7 @@ CONFIG_USB_STORAGE=m # CONFIG_USB_STORAGE_DEBUG is not set CONFIG_USB_STORAGE_REALTEK=m CONFIG_REALTEK_AUTOPM=y -# CONFIG_USB_STORAGE_DATAFAB is not set +CONFIG_USB_STORAGE_DATAFAB=m CONFIG_USB_STORAGE_FREECOM=m CONFIG_USB_STORAGE_ISD200=m CONFIG_USB_STORAGE_USBAT=m @@ -3742,7 +3777,7 @@ CONFIG_USB_STORAGE_ONETOUCH=m CONFIG_USB_STORAGE_KARMA=m CONFIG_USB_STORAGE_CYPRESS_ATACB=m CONFIG_USB_STORAGE_ENE_UB6250=m -# CONFIG_USB_UAS is not set +CONFIG_USB_UAS=m # CONFIG_USB_LIBUSUAL is not set # @@ -3768,12 +3803,12 @@ CONFIG_USB_SERIAL_CP210X=m CONFIG_USB_SERIAL_CYPRESS_M8=m CONFIG_USB_SERIAL_EMPEG=m CONFIG_USB_SERIAL_FTDI_SIO=m -# CONFIG_USB_SERIAL_FUNSOFT is not set -# CONFIG_USB_SERIAL_VISOR is not set -# CONFIG_USB_SERIAL_IPAQ is not set -# CONFIG_USB_SERIAL_IR is not set +CONFIG_USB_SERIAL_FUNSOFT=m +CONFIG_USB_SERIAL_VISOR=m +CONFIG_USB_SERIAL_IPAQ=m +CONFIG_USB_SERIAL_IR=m CONFIG_USB_SERIAL_EDGEPORT=m -# CONFIG_USB_SERIAL_EDGEPORT_TI is not set +CONFIG_USB_SERIAL_EDGEPORT_TI=m CONFIG_USB_SERIAL_GARMIN=m CONFIG_USB_SERIAL_IPW=m CONFIG_USB_SERIAL_IUU=m @@ -3902,15 +3937,17 @@ CONFIG_LEDS_CLASS=y # CONFIG_LEDS_LM3530=m CONFIG_LEDS_NET48XX=m +CONFIG_LEDS_NET5501=m CONFIG_LEDS_WRAP=m CONFIG_LEDS_PCA9532=m -# CONFIG_LEDS_PCA9532_GPIO is not set +CONFIG_LEDS_PCA9532_GPIO=y CONFIG_LEDS_GPIO=m CONFIG_LEDS_LP3944=m CONFIG_LEDS_LP5521=m CONFIG_LEDS_LP5523=m CONFIG_LEDS_CLEVO_MAIL=m CONFIG_LEDS_PCA955X=m +CONFIG_LEDS_REGULATOR=m CONFIG_LEDS_BD2802=m CONFIG_LEDS_INTEL_SS4200=m CONFIG_LEDS_LT3593=m @@ -3946,7 +3983,7 @@ CONFIG_RTC_INTF_SYSFS=y CONFIG_RTC_INTF_PROC=y CONFIG_RTC_INTF_DEV=y # CONFIG_RTC_INTF_DEV_UIE_EMUL is not set -CONFIG_RTC_DRV_TEST=m +# CONFIG_RTC_DRV_TEST is not set # # I2C RTC drivers @@ -3963,7 +4000,7 @@ CONFIG_RTC_DRV_X1205=m CONFIG_RTC_DRV_PCF8563=m CONFIG_RTC_DRV_PCF8583=m CONFIG_RTC_DRV_M41T80=m -# CONFIG_RTC_DRV_M41T80_WDT is not set +CONFIG_RTC_DRV_M41T80_WDT=y CONFIG_RTC_DRV_BQ32K=m CONFIG_RTC_DRV_S35390A=m CONFIG_RTC_DRV_FM3130=m @@ -4096,7 +4133,7 @@ CONFIG_HYPERV_MOUSE=m # CONFIG_TOUCHSCREEN_CLEARPAD_TM1217 is not set # CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4 is not set # CONFIG_DRM_PSB is not set -# CONFIG_INTEL_MEI is not set +CONFIG_INTEL_MEI=m # CONFIG_STAGING_MEDIA is not set CONFIG_X86_PLATFORM_DEVICES=y CONFIG_ACER_WMI=m diff --git a/config/kernel/kernel.config.i586-ipfire-pae b/config/kernel/kernel.config.i586-ipfire-pae index 54e54ae..d30681a 100644 --- a/config/kernel/kernel.config.i586-ipfire-pae +++ b/config/kernel/kernel.config.i586-ipfire-pae @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/i386 3.2.34-ipfire-pae Kernel Configuration +# Linux/i386 3.2.35 Kernel Configuration # # CONFIG_64BIT is not set CONFIG_X86_32=y @@ -460,7 +460,7 @@ CONFIG_ACPI=y CONFIG_ACPI_SLEEP=y # CONFIG_ACPI_PROCFS is not set CONFIG_ACPI_PROCFS_POWER=y -# CONFIG_ACPI_EC_DEBUGFS is not set +CONFIG_ACPI_EC_DEBUGFS=m CONFIG_ACPI_PROC_EVENT=y CONFIG_ACPI_AC=m CONFIG_ACPI_BATTERY=m @@ -944,7 +944,9 @@ CONFIG_ATM_CLIP_NO_ICMP=y CONFIG_ATM_BR2684=m # CONFIG_ATM_BR2684_IPFILTER is not set CONFIG_L2TP=m -# CONFIG_L2TP_V3 is not set +CONFIG_L2TP_V3=y +CONFIG_L2TP_IP=m +CONFIG_L2TP_ETH=m CONFIG_STP=m CONFIG_GARP=m CONFIG_BRIDGE=m @@ -1026,7 +1028,7 @@ CONFIG_NET_ACT_MIRRED=m CONFIG_NET_ACT_IPT=m CONFIG_NET_ACT_NAT=m CONFIG_NET_ACT_PEDIT=m -# CONFIG_NET_ACT_SIMP is not set +CONFIG_NET_ACT_SIMP=m CONFIG_NET_ACT_SKBEDIT=m CONFIG_NET_ACT_CSUM=m CONFIG_NET_CLS_IND=y @@ -1334,19 +1336,19 @@ CONFIG_CS5535_MFGPT=m CONFIG_CS5535_MFGPT_DEFAULT_IRQ=7 CONFIG_CS5535_CLOCK_EVENT_SRC=m CONFIG_HP_ILO=m -# CONFIG_APDS9802ALS is not set +CONFIG_APDS9802ALS=m CONFIG_ISL29003=m -# CONFIG_ISL29020 is not set +CONFIG_ISL29020=m CONFIG_SENSORS_TSL2550=m -# CONFIG_SENSORS_BH1780 is not set -# CONFIG_SENSORS_BH1770 is not set -# CONFIG_SENSORS_APDS990X is not set -# CONFIG_HMC6352 is not set +CONFIG_SENSORS_BH1780=m +CONFIG_SENSORS_BH1770=m +CONFIG_SENSORS_APDS990X=m +CONFIG_HMC6352=m CONFIG_DS1682=m -# CONFIG_VMWARE_BALLOON is not set -# CONFIG_BMP085 is not set -# CONFIG_PCH_PHUB is not set -# CONFIG_USB_SWITCH_FSA9480 is not set +CONFIG_VMWARE_BALLOON=m +CONFIG_BMP085=m +CONFIG_PCH_PHUB=m +CONFIG_USB_SWITCH_FSA9480=m CONFIG_C2PORT=m CONFIG_C2PORT_DURAMAR_2150=m @@ -2338,7 +2340,7 @@ CONFIG_KEYBOARD_XTKBD=m CONFIG_INPUT_MISC=y CONFIG_INPUT_AD714X=m CONFIG_INPUT_AD714X_I2C=m -# CONFIG_INPUT_BMA150 is not set +CONFIG_INPUT_BMA150=m CONFIG_INPUT_PCSPKR=m # CONFIG_INPUT_MMA8450 is not set # CONFIG_INPUT_MPU3050 is not set @@ -2542,7 +2544,7 @@ CONFIG_I2C_EG20T=m CONFIG_I2C_DIOLAN_U2C=m CONFIG_I2C_PARPORT=m CONFIG_I2C_PARPORT_LIGHT=m -# CONFIG_I2C_TAOS_EVM is not set +CONFIG_I2C_TAOS_EVM=m CONFIG_I2C_TINY_USB=m # @@ -2623,11 +2625,12 @@ CONFIG_GPIO_MCP23S08=m # # AC97 GPIO expanders: # +# CONFIG_GPIO_UCB1400 is not set # # MODULbus GPIO expanders: # -# CONFIG_GPIO_JANZ_TTL is not set +CONFIG_GPIO_JANZ_TTL=m CONFIG_W1=m CONFIG_W1_CON=y @@ -2659,14 +2662,12 @@ CONFIG_POWER_SUPPLY=y # CONFIG_TEST_POWER is not set # CONFIG_BATTERY_DS2760 is not set # CONFIG_BATTERY_DS2780 is not set -CONFIG_BATTERY_DS2782=m +# CONFIG_BATTERY_DS2782 is not set # CONFIG_BATTERY_BQ20Z75 is not set -CONFIG_BATTERY_BQ27x00=m -CONFIG_BATTERY_BQ27X00_I2C=y -CONFIG_BATTERY_BQ27X00_PLATFORM=y -CONFIG_BATTERY_MAX17040=m +# CONFIG_BATTERY_BQ27x00 is not set +# CONFIG_BATTERY_MAX17040 is not set # CONFIG_BATTERY_MAX17042 is not set -CONFIG_CHARGER_PCF50633=m +# CONFIG_CHARGER_PCF50633 is not set # CONFIG_CHARGER_ISP1704 is not set # CONFIG_CHARGER_MAX8903 is not set # CONFIG_CHARGER_GPIO is not set @@ -2797,7 +2798,7 @@ CONFIG_SENSORS_ACPI_POWER=m CONFIG_SENSORS_ATK0110=m CONFIG_THERMAL=y CONFIG_WATCHDOG=y -# CONFIG_WATCHDOG_CORE is not set +CONFIG_WATCHDOG_CORE=y # CONFIG_WATCHDOG_NOWAYOUT is not set # @@ -2894,7 +2895,7 @@ CONFIG_MFD_CORE=m CONFIG_MFD_SM501=m # CONFIG_MFD_SM501_GPIO is not set CONFIG_HTC_PASIC3=m -# CONFIG_UCB1400_CORE is not set +CONFIG_UCB1400_CORE=m CONFIG_TPS6105X=m CONFIG_TPS65010=m CONFIG_TPS6507X=m @@ -2910,7 +2911,7 @@ CONFIG_LPC_SCH=m CONFIG_MFD_RDC321X=m CONFIG_MFD_JANZ_CMODIO=m CONFIG_MFD_VX855=m -# CONFIG_MFD_WL1273_CORE is not set +CONFIG_MFD_WL1273_CORE=m CONFIG_REGULATOR=y # CONFIG_REGULATOR_DEBUG is not set # CONFIG_REGULATOR_DUMMY is not set @@ -2951,26 +2952,26 @@ CONFIG_VIDEO_MEDIA=m CONFIG_RC_CORE=m CONFIG_LIRC=m CONFIG_RC_MAP=m -CONFIG_IR_NEC_DECODER=m -CONFIG_IR_RC5_DECODER=m -CONFIG_IR_RC6_DECODER=m -CONFIG_IR_JVC_DECODER=m -CONFIG_IR_SONY_DECODER=m -CONFIG_IR_RC5_SZ_DECODER=m -CONFIG_IR_MCE_KBD_DECODER=m -CONFIG_IR_LIRC_CODEC=m -CONFIG_RC_ATI_REMOTE=m -CONFIG_IR_ENE=m -CONFIG_IR_IMON=m -CONFIG_IR_MCEUSB=m -CONFIG_IR_ITE_CIR=m -CONFIG_IR_FINTEK=m -CONFIG_IR_NUVOTON=m -CONFIG_IR_REDRAT3=m -CONFIG_IR_STREAMZAP=m -CONFIG_IR_WINBOND_CIR=m -CONFIG_RC_LOOPBACK=m -# CONFIG_MEDIA_ATTACH is not set +# CONFIG_IR_NEC_DECODER is not set +# CONFIG_IR_RC5_DECODER is not set +# CONFIG_IR_RC6_DECODER is not set +# CONFIG_IR_JVC_DECODER is not set +# CONFIG_IR_SONY_DECODER is not set +# CONFIG_IR_RC5_SZ_DECODER is not set +# CONFIG_IR_MCE_KBD_DECODER is not set +# CONFIG_IR_LIRC_CODEC is not set +# CONFIG_RC_ATI_REMOTE is not set +# CONFIG_IR_ENE is not set +# CONFIG_IR_IMON is not set +# CONFIG_IR_MCEUSB is not set +# CONFIG_IR_ITE_CIR is not set +# CONFIG_IR_FINTEK is not set +# CONFIG_IR_NUVOTON is not set +# CONFIG_IR_REDRAT3 is not set +# CONFIG_IR_STREAMZAP is not set +# CONFIG_IR_WINBOND_CIR is not set +# CONFIG_RC_LOOPBACK is not set +CONFIG_MEDIA_ATTACH=y CONFIG_MEDIA_TUNER=m # CONFIG_MEDIA_TUNER_CUSTOMISE is not set CONFIG_MEDIA_TUNER_SIMPLE=m @@ -3287,7 +3288,7 @@ CONFIG_DRM_TTM=m CONFIG_DRM_TDFX=m CONFIG_DRM_R128=m CONFIG_DRM_RADEON=m -# CONFIG_DRM_RADEON_KMS is not set +CONFIG_DRM_RADEON_KMS=y CONFIG_DRM_I810=m CONFIG_DRM_I915=m CONFIG_DRM_I915_KMS=y @@ -3581,7 +3582,7 @@ CONFIG_SND_HDA_PREALLOC_SIZE=64 CONFIG_SND_HDA_HWDEP=y CONFIG_SND_HDA_RECONFIG=y CONFIG_SND_HDA_INPUT_BEEP=y -CONFIG_SND_HDA_INPUT_BEEP_MODE=1 +CONFIG_SND_HDA_INPUT_BEEP_MODE=2 CONFIG_SND_HDA_INPUT_JACK=y CONFIG_SND_HDA_PATCH_LOADER=y CONFIG_SND_HDA_CODEC_REALTEK=y @@ -3658,7 +3659,8 @@ CONFIG_USB_HIDDEV=y # Special HID drivers # CONFIG_HID_A4TECH=m -# CONFIG_HID_ACRUX is not set +CONFIG_HID_ACRUX=m +# CONFIG_HID_ACRUX_FF is not set CONFIG_HID_APPLE=m CONFIG_HID_BELKIN=m CONFIG_HID_CHERRY=m @@ -3666,7 +3668,7 @@ CONFIG_HID_CHICONY=m CONFIG_HID_PRODIKEYS=m CONFIG_HID_CYPRESS=m CONFIG_HID_DRAGONRISE=m -CONFIG_DRAGONRISE_FF=y +# CONFIG_DRAGONRISE_FF is not set # CONFIG_HID_EMS_FF is not set CONFIG_HID_ELECOM=m CONFIG_HID_EZKEY=m @@ -3681,10 +3683,10 @@ CONFIG_HID_KENSINGTON=m CONFIG_HID_LCPOWER=m CONFIG_HID_LOGITECH=m CONFIG_HID_LOGITECH_DJ=m -CONFIG_LOGITECH_FF=y -CONFIG_LOGIRUMBLEPAD2_FF=y +# CONFIG_LOGITECH_FF is not set +# CONFIG_LOGIRUMBLEPAD2_FF is not set # CONFIG_LOGIG940_FF is not set -CONFIG_LOGIWHEELS_FF=y +# CONFIG_LOGIWHEELS_FF is not set CONFIG_HID_MAGICMOUSE=m CONFIG_HID_MICROSOFT=m CONFIG_HID_MONTEREY=m @@ -3692,7 +3694,7 @@ CONFIG_HID_MULTITOUCH=m CONFIG_HID_NTRIG=m CONFIG_HID_ORTEK=m CONFIG_HID_PANTHERLORD=m -CONFIG_PANTHERLORD_FF=y +# CONFIG_PANTHERLORD_FF is not set CONFIG_HID_PETALYNX=m CONFIG_HID_PICOLCD=m CONFIG_HID_PICOLCD_FB=y @@ -3713,17 +3715,17 @@ CONFIG_HID_SONY=m CONFIG_HID_SPEEDLINK=m CONFIG_HID_SUNPLUS=m CONFIG_HID_GREENASIA=m -CONFIG_GREENASIA_FF=y +# CONFIG_GREENASIA_FF is not set CONFIG_HID_SMARTJOYPLUS=m -CONFIG_SMARTJOYPLUS_FF=y +# CONFIG_SMARTJOYPLUS_FF is not set CONFIG_HID_TOPSEED=m CONFIG_HID_THRUSTMASTER=m -CONFIG_THRUSTMASTER_FF=y +# CONFIG_THRUSTMASTER_FF is not set CONFIG_HID_WACOM=m # CONFIG_HID_WACOM_POWER_SUPPLY is not set CONFIG_HID_WIIMOTE=m CONFIG_HID_ZEROPLUS=m -CONFIG_ZEROPLUS_FF=y +# CONFIG_ZEROPLUS_FF is not set CONFIG_HID_ZYDACRON=m CONFIG_USB_SUPPORT=y CONFIG_USB_COMMON=y @@ -3794,8 +3796,8 @@ CONFIG_USB_TMC=m CONFIG_USB_STORAGE=m # CONFIG_USB_STORAGE_DEBUG is not set CONFIG_USB_STORAGE_REALTEK=m -# CONFIG_REALTEK_AUTOPM is not set -# CONFIG_USB_STORAGE_DATAFAB is not set +CONFIG_REALTEK_AUTOPM=y +CONFIG_USB_STORAGE_DATAFAB=m CONFIG_USB_STORAGE_FREECOM=m CONFIG_USB_STORAGE_ISD200=m CONFIG_USB_STORAGE_USBAT=m @@ -3807,7 +3809,7 @@ CONFIG_USB_STORAGE_ONETOUCH=m CONFIG_USB_STORAGE_KARMA=m CONFIG_USB_STORAGE_CYPRESS_ATACB=m CONFIG_USB_STORAGE_ENE_UB6250=m -# CONFIG_USB_UAS is not set +CONFIG_USB_UAS=m # CONFIG_USB_LIBUSUAL is not set # @@ -3833,12 +3835,12 @@ CONFIG_USB_SERIAL_CP210X=m CONFIG_USB_SERIAL_CYPRESS_M8=m CONFIG_USB_SERIAL_EMPEG=m CONFIG_USB_SERIAL_FTDI_SIO=m -# CONFIG_USB_SERIAL_FUNSOFT is not set -# CONFIG_USB_SERIAL_VISOR is not set -# CONFIG_USB_SERIAL_IPAQ is not set -# CONFIG_USB_SERIAL_IR is not set +CONFIG_USB_SERIAL_FUNSOFT=m +CONFIG_USB_SERIAL_VISOR=m +CONFIG_USB_SERIAL_IPAQ=m +CONFIG_USB_SERIAL_IR=m CONFIG_USB_SERIAL_EDGEPORT=m -# CONFIG_USB_SERIAL_EDGEPORT_TI is not set +CONFIG_USB_SERIAL_EDGEPORT_TI=m CONFIG_USB_SERIAL_GARMIN=m CONFIG_USB_SERIAL_IPW=m CONFIG_USB_SERIAL_IUU=m @@ -3970,7 +3972,7 @@ CONFIG_LEDS_NET48XX=m CONFIG_LEDS_NET5501=m CONFIG_LEDS_WRAP=m CONFIG_LEDS_PCA9532=m -# CONFIG_LEDS_PCA9532_GPIO is not set +CONFIG_LEDS_PCA9532_GPIO=y CONFIG_LEDS_GPIO=m CONFIG_LEDS_LP3944=m CONFIG_LEDS_LP5521=m @@ -4130,14 +4132,12 @@ CONFIG_USBIP_HOST=m # CONFIG_COMEDI is not set # CONFIG_ASUS_OLED is not set # CONFIG_PANEL is not set -CONFIG_R8187SE=m -CONFIG_RTL8192U=m +# CONFIG_R8187SE is not set +# CONFIG_RTL8192U is not set # CONFIG_RTL8192E is not set -CONFIG_R8712U=m -CONFIG_RTS_PSTOR=m -# CONFIG_RTS_PSTOR_DEBUG is not set -CONFIG_RTS5139=m -# CONFIG_RTS5139_DEBUG is not set +# CONFIG_R8712U is not set +# CONFIG_RTS_PSTOR is not set +# CONFIG_RTS5139 is not set # CONFIG_TRANZPORT is not set # CONFIG_POHMELFS is not set CONFIG_IDE_PHISON=m @@ -4181,6 +4181,7 @@ CONFIG_HYPERV_MOUSE=m # CONFIG_TOUCHSCREEN_CLEARPAD_TM1217 is not set # CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4 is not set # CONFIG_DRM_PSB is not set +CONFIG_INTEL_MEI=m # CONFIG_STAGING_MEDIA is not set CONFIG_X86_PLATFORM_DEVICES=y CONFIG_ACER_WMI=m @@ -4270,24 +4271,16 @@ CONFIG_SIGMA=m # # File systems # -CONFIG_EXT2_FS=m -CONFIG_EXT2_FS_XATTR=y -CONFIG_EXT2_FS_POSIX_ACL=y -CONFIG_EXT2_FS_SECURITY=y -# CONFIG_EXT2_FS_XIP is not set -CONFIG_EXT3_FS=m -# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set -CONFIG_EXT3_FS_XATTR=y -CONFIG_EXT3_FS_POSIX_ACL=y -CONFIG_EXT3_FS_SECURITY=y -CONFIG_EXT4_FS=m +# CONFIG_EXT2_FS is not set +# CONFIG_EXT3_FS is not set +CONFIG_EXT4_FS=y +CONFIG_EXT4_USE_FOR_EXT23=y CONFIG_EXT4_FS_XATTR=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set -CONFIG_JBD=m -CONFIG_JBD2=m -CONFIG_FS_MBCACHE=m +CONFIG_JBD2=y +CONFIG_FS_MBCACHE=y CONFIG_REISERFS_FS=m # CONFIG_REISERFS_CHECK is not set CONFIG_REISERFS_PROC_INFO=y @@ -4786,7 +4779,7 @@ CONFIG_RAID6_PQ=m CONFIG_BITREVERSE=y CONFIG_GENERIC_FIND_FIRST_BIT=y CONFIG_CRC_CCITT=m -CONFIG_CRC16=m +CONFIG_CRC16=y CONFIG_CRC_T10DIF=m CONFIG_CRC_ITU_T=m CONFIG_CRC32=y diff --git a/config/kernel/kernel.config.i586-ipfire-xen b/config/kernel/kernel.config.i586-ipfire-xen index 17e4494..8fedba4 100644 --- a/config/kernel/kernel.config.i586-ipfire-xen +++ b/config/kernel/kernel.config.i586-ipfire-xen @@ -1,7 +1,7 @@ # # Automatically generated make config: don't edit # Linux kernel version: 2.6.32.60 -# Wed Dec 5 04:32:07 2012 +# Sat Dec 8 11:41:33 2012 # # CONFIG_64BIT is not set CONFIG_X86_32=y diff --git a/config/rootfiles/common/armv5tel/linux-kirkwood b/config/rootfiles/common/armv5tel/linux-kirkwood index 404d7af..87652a5 100644 --- a/config/rootfiles/common/armv5tel/linux-kirkwood +++ b/config/rootfiles/common/armv5tel/linux-kirkwood @@ -3,7 +3,6 @@ boot/System.map-KVER-ipfire-kirkwood boot/config-KVER-ipfire-kirkwood boot/uImage-ipfire-kirkwood boot/vmlinuz-KVER-ipfire-kirkwood -#boot/vmlinuz-ipfire-kirkwood etc/modprobe.d/framebuffer etc/modprobe.d/ipv6 etc/modprobe.d/isdn @@ -1659,7 +1658,6 @@ lib/modules/KVER-ipfire-kirkwood #lib/modules/KVER-ipfire-kirkwood/kernel/net/ipv6/esp6.ko #lib/modules/KVER-ipfire-kirkwood/kernel/net/ipv6/ip6_tunnel.ko #lib/modules/KVER-ipfire-kirkwood/kernel/net/ipv6/ipcomp6.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/net/ipv6/ipv6.ko #lib/modules/KVER-ipfire-kirkwood/kernel/net/ipv6/mip6.ko #lib/modules/KVER-ipfire-kirkwood/kernel/net/ipv6/netfilter #lib/modules/KVER-ipfire-kirkwood/kernel/net/ipv6/netfilter/ip6_queue.ko @@ -1880,6 +1878,7 @@ lib/modules/KVER-ipfire-kirkwood #lib/modules/KVER-ipfire-kirkwood/kernel/sound/core/seq/snd-seq-midi.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/core/seq/snd-seq-virmidi.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/core/seq/snd-seq.ko +#lib/modules/KVER-ipfire-kirkwood/kernel/sound/core/snd-hrtimer.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/core/snd-hwdep.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/core/snd-page-alloc.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/core/snd-pcm.ko @@ -2023,83 +2022,8 @@ lib/modules/KVER-ipfire-kirkwood #lib/modules/KVER-ipfire-kirkwood/kernel/sound/pcmcia/vx/snd-vxpocket.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc #lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-88pm860x.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ad193x.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ad73311.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-adau1373.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-adav80x.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ads117x.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ak4535.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ak4641.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ak4642.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ak4671.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-alc5623.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-cs4270.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-cs4271.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-cs42l51.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-cx20442.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-da7210.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-dfbmcs320.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-jz4740-codec.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-l3.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-lm4857.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-max98088.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-max98095.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-max9850.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-max9877.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-pcm3008.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-rt5631.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-sgtl5000.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-spdif.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-ssm2602.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-sta32x.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-tlv320aic23.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-tlv320aic32x4.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-tlv320aic3x.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-tlv320dac33.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-tpa6130a2.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-uda134x.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-uda1380.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm-hubs.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm1250-ev1.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm2000.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm5100.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8400.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8510.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8523.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8580.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8711.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8727.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8728.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8731.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8737.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8741.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8750.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8753.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8776.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8782.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8804.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8900.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8903.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8904.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8940.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8955.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8960.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8961.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8962.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8971.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8974.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8978.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8983.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8985.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8988.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8990.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8991.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8993.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8995.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm8996.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm9081.ko -#lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/codecs/snd-soc-wm9090.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/kirkwood #lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/kirkwood/snd-soc-kirkwood-i2s.ko #lib/modules/KVER-ipfire-kirkwood/kernel/sound/soc/kirkwood/snd-soc-kirkwood.ko diff --git a/config/rootfiles/common/armv5tel/linux-omap b/config/rootfiles/common/armv5tel/linux-omap index 0311524..0d0007f 100644 --- a/config/rootfiles/common/armv5tel/linux-omap +++ b/config/rootfiles/common/armv5tel/linux-omap @@ -3,7 +3,6 @@ boot/System.map-KVER-ipfire-omap boot/config-KVER-ipfire-omap boot/uImage-ipfire-omap boot/vmlinuz-KVER-ipfire-omap -#boot/vmlinuz-ipfire-omap lib/modules/KVER-ipfire-omap #lib/modules/KVER-ipfire-omap/build #lib/modules/KVER-ipfire-omap/kernel @@ -1032,7 +1031,6 @@ lib/modules/KVER-ipfire-omap #lib/modules/KVER-ipfire-omap/kernel/net/ipv6/esp6.ko #lib/modules/KVER-ipfire-omap/kernel/net/ipv6/ip6_tunnel.ko #lib/modules/KVER-ipfire-omap/kernel/net/ipv6/ipcomp6.ko -#lib/modules/KVER-ipfire-omap/kernel/net/ipv6/ipv6.ko #lib/modules/KVER-ipfire-omap/kernel/net/ipv6/mip6.ko #lib/modules/KVER-ipfire-omap/kernel/net/ipv6/netfilter #lib/modules/KVER-ipfire-omap/kernel/net/ipv6/netfilter/ip6_queue.ko @@ -1253,6 +1251,7 @@ lib/modules/KVER-ipfire-omap #lib/modules/KVER-ipfire-omap/kernel/sound/core/seq/snd-seq-midi.ko #lib/modules/KVER-ipfire-omap/kernel/sound/core/seq/snd-seq-virmidi.ko #lib/modules/KVER-ipfire-omap/kernel/sound/core/seq/snd-seq.ko +#lib/modules/KVER-ipfire-omap/kernel/sound/core/snd-hrtimer.ko #lib/modules/KVER-ipfire-omap/kernel/sound/core/snd-hwdep.ko #lib/modules/KVER-ipfire-omap/kernel/sound/core/snd-page-alloc.ko #lib/modules/KVER-ipfire-omap/kernel/sound/core/snd-pcm.ko @@ -1263,6 +1262,7 @@ lib/modules/KVER-ipfire-omap #lib/modules/KVER-ipfire-omap/kernel/sound/drivers/mpu401 #lib/modules/KVER-ipfire-omap/kernel/sound/drivers/mpu401/snd-mpu401-uart.ko #lib/modules/KVER-ipfire-omap/kernel/sound/drivers/mpu401/snd-mpu401.ko +#lib/modules/KVER-ipfire-omap/kernel/sound/drivers/snd-aloop.ko #lib/modules/KVER-ipfire-omap/kernel/sound/drivers/snd-dummy.ko #lib/modules/KVER-ipfire-omap/kernel/sound/drivers/snd-mtpav.ko #lib/modules/KVER-ipfire-omap/kernel/sound/drivers/snd-mts64.ko diff --git a/config/rootfiles/common/armv5tel/linux-rpi b/config/rootfiles/common/armv5tel/linux-rpi index ee4668d..bfb4e8b 100644 --- a/config/rootfiles/common/armv5tel/linux-rpi +++ b/config/rootfiles/common/armv5tel/linux-rpi @@ -3,11 +3,14 @@ boot/System.map-KVER-ipfire-rpi boot/config-KVER-ipfire-rpi boot/kernel.img boot/vmlinuz-KVER-ipfire-rpi -#boot/vmlinuz-ipfire-rpi #lib/modules lib/modules/KVER-ipfire-rpi #lib/modules/KVER-ipfire-rpi/build #lib/modules/KVER-ipfire-rpi/kernel +#lib/modules/KVER-ipfire-rpi/kernel/arch +#lib/modules/KVER-ipfire-rpi/kernel/arch/arm +#lib/modules/KVER-ipfire-rpi/kernel/arch/arm/mach-bcm2708 +#lib/modules/KVER-ipfire-rpi/kernel/arch/arm/mach-bcm2708/dmaer.ko #lib/modules/KVER-ipfire-rpi/kernel/crypto #lib/modules/KVER-ipfire-rpi/kernel/crypto/aes_generic.ko #lib/modules/KVER-ipfire-rpi/kernel/crypto/af_alg.ko @@ -923,7 +926,6 @@ lib/modules/KVER-ipfire-rpi #lib/modules/KVER-ipfire-rpi/kernel/net/ipv6/esp6.ko #lib/modules/KVER-ipfire-rpi/kernel/net/ipv6/ip6_tunnel.ko #lib/modules/KVER-ipfire-rpi/kernel/net/ipv6/ipcomp6.ko -#lib/modules/KVER-ipfire-rpi/kernel/net/ipv6/ipv6.ko #lib/modules/KVER-ipfire-rpi/kernel/net/ipv6/mip6.ko #lib/modules/KVER-ipfire-rpi/kernel/net/ipv6/netfilter #lib/modules/KVER-ipfire-rpi/kernel/net/ipv6/netfilter/ip6_queue.ko diff --git a/config/rootfiles/common/i586/linux b/config/rootfiles/common/i586/linux index a581993..5ff2d8d 100644 --- a/config/rootfiles/common/i586/linux +++ b/config/rootfiles/common/i586/linux @@ -1,4 +1,4 @@ -boot/System.map-KVER-ipfire +boot/System.map-3.2.35-ipfire boot/System.map-ipfire boot/config-KVER-ipfire boot/vmlinuz-KVER-ipfire @@ -213,6 +213,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/block/floppy.ko #lib/modules/KVER-ipfire/kernel/drivers/block/nbd.ko #lib/modules/KVER-ipfire/kernel/drivers/block/osdblk.ko +#lib/modules/KVER-ipfire/kernel/drivers/block/rbd.ko #lib/modules/KVER-ipfire/kernel/drivers/block/sx8.ko #lib/modules/KVER-ipfire/kernel/drivers/block/virtio_blk.ko #lib/modules/KVER-ipfire/kernel/drivers/bluetooth @@ -275,6 +276,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/char/scx200_gpio.ko #lib/modules/KVER-ipfire/kernel/drivers/char/toshiba.ko #lib/modules/KVER-ipfire/kernel/drivers/clocksource +#lib/modules/KVER-ipfire/kernel/drivers/clocksource/cs5535-clockevt.ko #lib/modules/KVER-ipfire/kernel/drivers/clocksource/scx200_hrt.ko #lib/modules/KVER-ipfire/kernel/drivers/connector #lib/modules/KVER-ipfire/kernel/drivers/connector/cn.ko @@ -324,8 +326,10 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/firmware/sigma.ko #lib/modules/KVER-ipfire/kernel/drivers/gpio #lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-adp5588.ko +#lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-cs5535.ko #lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-generic.ko #lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-it8761e.ko +#lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-janz-ttl.ko #lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-max7300.ko #lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-max730x.ko #lib/modules/KVER-ipfire/kernel/drivers/gpio/gpio-max732x.ko @@ -370,6 +374,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/hid #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-a4tech.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-apple.ko +#lib/modules/KVER-ipfire/kernel/drivers/hid/hid-axff.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-belkin.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-cherry.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-chicony.ko @@ -385,6 +390,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-lcpower.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-logitech-dj.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-logitech.ko +#lib/modules/KVER-ipfire/kernel/drivers/hid/hid-magicmouse.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-microsoft.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-monterey.ko #lib/modules/KVER-ipfire/kernel/drivers/hid/hid-multitouch.ko @@ -572,6 +578,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/i2c/busses/i2c-sis630.ko #lib/modules/KVER-ipfire/kernel/drivers/i2c/busses/i2c-sis96x.ko #lib/modules/KVER-ipfire/kernel/drivers/i2c/busses/i2c-stub.ko +#lib/modules/KVER-ipfire/kernel/drivers/i2c/busses/i2c-taos-evm.ko #lib/modules/KVER-ipfire/kernel/drivers/i2c/busses/i2c-tiny-usb.ko #lib/modules/KVER-ipfire/kernel/drivers/i2c/busses/i2c-via.ko #lib/modules/KVER-ipfire/kernel/drivers/i2c/busses/i2c-viapro.ko @@ -707,8 +714,10 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/leds/leds-lp5523.ko #lib/modules/KVER-ipfire/kernel/drivers/leds/leds-lt3593.ko #lib/modules/KVER-ipfire/kernel/drivers/leds/leds-net48xx.ko +#lib/modules/KVER-ipfire/kernel/drivers/leds/leds-net5501.ko #lib/modules/KVER-ipfire/kernel/drivers/leds/leds-pca9532.ko #lib/modules/KVER-ipfire/kernel/drivers/leds/leds-pca955x.ko +#lib/modules/KVER-ipfire/kernel/drivers/leds/leds-regulator.ko #lib/modules/KVER-ipfire/kernel/drivers/leds/leds-ss4200.ko #lib/modules/KVER-ipfire/kernel/drivers/leds/leds-wrap.ko #lib/modules/KVER-ipfire/kernel/drivers/leds/ledtrig-backlight.ko @@ -767,14 +776,6 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/media/dvb/dvb-core/dvb-core.ko #lib/modules/KVER-ipfire/kernel/drivers/media/media.ko #lib/modules/KVER-ipfire/kernel/drivers/media/rc -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-jvc-decoder.ko -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-lirc-codec.ko -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-mce_kbd-decoder.ko -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-nec-decoder.ko -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-rc5-decoder.ko -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-rc5-sz-decoder.ko -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-rc6-decoder.ko -#lib/modules/KVER-ipfire/kernel/drivers/media/rc/ir-sony-decoder.ko #lib/modules/KVER-ipfire/kernel/drivers/media/rc/keymaps #lib/modules/KVER-ipfire/kernel/drivers/media/rc/keymaps/rc-adstech-dvb-t-pci.ko #lib/modules/KVER-ipfire/kernel/drivers/media/rc/keymaps/rc-alink-dtu-m.ko @@ -892,7 +893,9 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/message/fusion/mptscsih.ko #lib/modules/KVER-ipfire/kernel/drivers/message/fusion/mptspi.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd +#lib/modules/KVER-ipfire/kernel/drivers/mfd/cs5535-mfd.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/htc-pasic3.ko +#lib/modules/KVER-ipfire/kernel/drivers/mfd/janz-cmodio.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/lpc_sch.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/mfd-core.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/pcf50633-adc.ko @@ -900,7 +903,13 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/mfd/pcf50633.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/rdc321x-southbridge.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/sm501.ko +#lib/modules/KVER-ipfire/kernel/drivers/mfd/timberdale.ko +#lib/modules/KVER-ipfire/kernel/drivers/mfd/tps6105x.ko +#lib/modules/KVER-ipfire/kernel/drivers/mfd/tps65010.ko +#lib/modules/KVER-ipfire/kernel/drivers/mfd/tps6507x.ko +#lib/modules/KVER-ipfire/kernel/drivers/mfd/ucb1400_core.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/vx855.ko +#lib/modules/KVER-ipfire/kernel/drivers/mfd/wl1273-core.ko #lib/modules/KVER-ipfire/kernel/drivers/mfd/wm8400-core.ko #lib/modules/KVER-ipfire/kernel/drivers/misc #lib/modules/KVER-ipfire/kernel/drivers/misc/apds9802als.ko @@ -913,6 +922,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/misc/c2port/core.ko #lib/modules/KVER-ipfire/kernel/drivers/misc/cb710 #lib/modules/KVER-ipfire/kernel/drivers/misc/cb710/cb710.ko +#lib/modules/KVER-ipfire/kernel/drivers/misc/cs5535-mfgpt.ko #lib/modules/KVER-ipfire/kernel/drivers/misc/ds1682.ko #lib/modules/KVER-ipfire/kernel/drivers/misc/eeprom #lib/modules/KVER-ipfire/kernel/drivers/misc/eeprom/at24.ko @@ -1218,6 +1228,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/net/phy/broadcom.ko #lib/modules/KVER-ipfire/kernel/drivers/net/phy/cicada.ko #lib/modules/KVER-ipfire/kernel/drivers/net/phy/davicom.ko +#lib/modules/KVER-ipfire/kernel/drivers/net/phy/dp83640.ko #lib/modules/KVER-ipfire/kernel/drivers/net/phy/et1011c.ko #lib/modules/KVER-ipfire/kernel/drivers/net/phy/icplus.ko #lib/modules/KVER-ipfire/kernel/drivers/net/phy/lxt.ko @@ -1366,15 +1377,13 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/platform/x86/toshiba_bluetooth.ko #lib/modules/KVER-ipfire/kernel/drivers/platform/x86/wmi.ko #lib/modules/KVER-ipfire/kernel/drivers/platform/x86/xo15-ebook.ko -#lib/modules/KVER-ipfire/kernel/drivers/power -#lib/modules/KVER-ipfire/kernel/drivers/power/bq27x00_battery.ko -#lib/modules/KVER-ipfire/kernel/drivers/power/ds2782_battery.ko -#lib/modules/KVER-ipfire/kernel/drivers/power/max17040_battery.ko -#lib/modules/KVER-ipfire/kernel/drivers/power/pcf50633-charger.ko #lib/modules/KVER-ipfire/kernel/drivers/pps #lib/modules/KVER-ipfire/kernel/drivers/pps/pps_core.ko #lib/modules/KVER-ipfire/kernel/drivers/ptp #lib/modules/KVER-ipfire/kernel/drivers/ptp/ptp.ko +#lib/modules/KVER-ipfire/kernel/drivers/regulator +#lib/modules/KVER-ipfire/kernel/drivers/regulator/fixed.ko +#lib/modules/KVER-ipfire/kernel/drivers/regulator/gpio-regulator.ko #lib/modules/KVER-ipfire/kernel/drivers/rtc #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-bq32k.ko #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-bq4802.ko @@ -1406,7 +1415,6 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-rx8581.ko #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-s35390a.ko #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-stk17ta8.ko -#lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-test.ko #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-v3020.ko #lib/modules/KVER-ipfire/kernel/drivers/rtc/rtc-x1205.ko #lib/modules/KVER-ipfire/kernel/drivers/scsi @@ -1553,6 +1561,8 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/staging/hv/hv_mouse.ko #lib/modules/KVER-ipfire/kernel/drivers/staging/hv/hv_netvsc.ko #lib/modules/KVER-ipfire/kernel/drivers/staging/hv/hv_storvsc.ko +#lib/modules/KVER-ipfire/kernel/drivers/staging/mei +#lib/modules/KVER-ipfire/kernel/drivers/staging/mei/mei.ko #lib/modules/KVER-ipfire/kernel/drivers/staging/phison #lib/modules/KVER-ipfire/kernel/drivers/staging/phison/phison.ko #lib/modules/KVER-ipfire/kernel/drivers/staging/slicoss @@ -1578,6 +1588,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/tty/serial/pch_uart.ko #lib/modules/KVER-ipfire/kernel/drivers/tty/serial/serial_cs.ko #lib/modules/KVER-ipfire/kernel/drivers/tty/serial/timbuart.ko +#lib/modules/KVER-ipfire/kernel/drivers/tty/serial/uartlite.ko #lib/modules/KVER-ipfire/kernel/drivers/tty/serial/xilinx_uartps.ko #lib/modules/KVER-ipfire/kernel/drivers/uio #lib/modules/KVER-ipfire/kernel/drivers/uio/uio.ko @@ -1643,10 +1654,14 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/digi_acceleport.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/empeg.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/ftdi_sio.ko +#lib/modules/KVER-ipfire/kernel/drivers/usb/serial/funsoft.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/garmin_gps.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/hp4x.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/io_edgeport.ko +#lib/modules/KVER-ipfire/kernel/drivers/usb/serial/io_ti.ko +#lib/modules/KVER-ipfire/kernel/drivers/usb/serial/ipaq.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/ipw.ko +#lib/modules/KVER-ipfire/kernel/drivers/usb/serial/ir-usb.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/iuu_phoenix.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/keyspan_pda.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/mct_u232.ko @@ -1668,12 +1683,15 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/ti_usb_3410_5052.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/usb_wwan.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/usbserial.ko +#lib/modules/KVER-ipfire/kernel/drivers/usb/serial/visor.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/vivopay-serial.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/whiteheat.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/serial/zio.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/storage +#lib/modules/KVER-ipfire/kernel/drivers/usb/storage/uas.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/storage/ums-alauda.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/storage/ums-cypress.ko +#lib/modules/KVER-ipfire/kernel/drivers/usb/storage/ums-datafab.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/storage/ums-eneub6250.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/storage/ums-freecom.ko #lib/modules/KVER-ipfire/kernel/drivers/usb/storage/ums-isd200.ko @@ -1806,6 +1824,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/drivers/watchdog/cpu5wdt.ko #lib/modules/KVER-ipfire/kernel/drivers/watchdog/eurotechwdt.ko #lib/modules/KVER-ipfire/kernel/drivers/watchdog/f71808e_wdt.ko +#lib/modules/KVER-ipfire/kernel/drivers/watchdog/geodewdt.ko #lib/modules/KVER-ipfire/kernel/drivers/watchdog/hpwdt.ko #lib/modules/KVER-ipfire/kernel/drivers/watchdog/i6300esb.ko #lib/modules/KVER-ipfire/kernel/drivers/watchdog/iTCO_wdt.ko @@ -1908,6 +1927,8 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/net/atm/br2684.ko #lib/modules/KVER-ipfire/kernel/net/atm/clip.ko #lib/modules/KVER-ipfire/kernel/net/atm/pppoatm.ko +#lib/modules/KVER-ipfire/kernel/net/batman-adv +#lib/modules/KVER-ipfire/kernel/net/batman-adv/batman-adv.ko #lib/modules/KVER-ipfire/kernel/net/bluetooth #lib/modules/KVER-ipfire/kernel/net/bluetooth/bluetooth.ko #lib/modules/KVER-ipfire/kernel/net/bluetooth/bnep @@ -1943,7 +1964,10 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/net/bridge/netfilter/ebtable_filter.ko #lib/modules/KVER-ipfire/kernel/net/bridge/netfilter/ebtable_nat.ko #lib/modules/KVER-ipfire/kernel/net/bridge/netfilter/ebtables.ko +#lib/modules/KVER-ipfire/kernel/net/ceph +#lib/modules/KVER-ipfire/kernel/net/ceph/libceph.ko #lib/modules/KVER-ipfire/kernel/net/ieee802154 +#lib/modules/KVER-ipfire/kernel/net/ieee802154/6lowpan.ko #lib/modules/KVER-ipfire/kernel/net/ieee802154/af_802154.ko #lib/modules/KVER-ipfire/kernel/net/ieee802154/ieee802154.ko #lib/modules/KVER-ipfire/kernel/net/ipv4 @@ -2048,6 +2072,9 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/net/key/af_key.ko #lib/modules/KVER-ipfire/kernel/net/l2tp #lib/modules/KVER-ipfire/kernel/net/l2tp/l2tp_core.ko +#lib/modules/KVER-ipfire/kernel/net/l2tp/l2tp_eth.ko +#lib/modules/KVER-ipfire/kernel/net/l2tp/l2tp_ip.ko +#lib/modules/KVER-ipfire/kernel/net/l2tp/l2tp_netlink.ko #lib/modules/KVER-ipfire/kernel/net/l2tp/l2tp_ppp.ko #lib/modules/KVER-ipfire/kernel/net/llc #lib/modules/KVER-ipfire/kernel/net/llc/llc.ko @@ -2138,6 +2165,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/net/netfilter/xt_time.ko #lib/modules/KVER-ipfire/kernel/net/netfilter/xt_u32.ko #lib/modules/KVER-ipfire/kernel/net/rfkill +#lib/modules/KVER-ipfire/kernel/net/rfkill/rfkill-regulator.ko #lib/modules/KVER-ipfire/kernel/net/rfkill/rfkill.ko #lib/modules/KVER-ipfire/kernel/net/rxrpc #lib/modules/KVER-ipfire/kernel/net/rxrpc/af-rxrpc.ko @@ -2150,6 +2178,7 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/net/sched/act_nat.ko #lib/modules/KVER-ipfire/kernel/net/sched/act_pedit.ko #lib/modules/KVER-ipfire/kernel/net/sched/act_police.ko +#lib/modules/KVER-ipfire/kernel/net/sched/act_simple.ko #lib/modules/KVER-ipfire/kernel/net/sched/act_skbedit.ko #lib/modules/KVER-ipfire/kernel/net/sched/cls_basic.ko #lib/modules/KVER-ipfire/kernel/net/sched/cls_flow.ko @@ -2421,85 +2450,6 @@ lib/modules/KVER-ipfire #lib/modules/KVER-ipfire/kernel/sound/pcmcia/pdaudiocf/snd-pdaudiocf.ko #lib/modules/KVER-ipfire/kernel/sound/pcmcia/vx #lib/modules/KVER-ipfire/kernel/sound/pcmcia/vx/snd-vxpocket.ko -#lib/modules/KVER-ipfire/kernel/sound/soc -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ad193x.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ad73311.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-adau1373.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-adav80x.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ads117x.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ak4535.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ak4641.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ak4642.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ak4671.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-alc5623.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-cs4270.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-cs4271.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-cs42l51.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-cx20442.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-da7210.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-dfbmcs320.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-jz4740-codec.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-l3.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-lm4857.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-max98088.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-max98095.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-max9850.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-max9877.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-pcm3008.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-rt5631.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-sgtl5000.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-spdif.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-ssm2602.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-sta32x.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-tlv320aic23.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-tlv320aic32x4.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-tlv320aic3x.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-tlv320dac33.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-tpa6130a2.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-uda134x.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-uda1380.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm-hubs.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm1250-ev1.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm2000.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm5100.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8400.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8510.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8523.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8580.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8711.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8727.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8728.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8731.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8737.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8741.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8750.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8753.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8776.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8782.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8804.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8900.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8903.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8904.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8940.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8955.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8960.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8961.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8962.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8971.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8974.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8978.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8983.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8985.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8988.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8990.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8991.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8993.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8995.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm8996.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm9081.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/codecs/snd-soc-wm9090.ko -#lib/modules/KVER-ipfire/kernel/sound/soc/snd-soc-core.ko #lib/modules/KVER-ipfire/kernel/sound/soundcore.ko #lib/modules/KVER-ipfire/kernel/sound/synth #lib/modules/KVER-ipfire/kernel/sound/synth/emux diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index 7fa4a43..e10c649 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -84,6 +84,8 @@ usr/local/bin/scanhd usr/local/bin/setddns.pl usr/local/bin/settime usr/local/bin/timecheck +#usr/local/bin/uname +usr/local/bin/update-lang-cache #usr/local/include #usr/local/lib #usr/local/sbin @@ -105,6 +107,7 @@ usr/local/bin/timecheck #usr/local/share/zoneinfo #usr/local/src #usr/sbin +usr/sbin/ovpn-ccd-convert #usr/share #usr/share/doc #usr/share/doc/licenses diff --git a/config/rootfiles/core/65/exclude b/config/rootfiles/core/65/exclude new file mode 100644 index 0000000..b6a8d1d --- /dev/null +++ b/config/rootfiles/core/65/exclude @@ -0,0 +1,13 @@ +srv/web/ipfire/html/proxy.pac +etc/udev/rules.d/30-persistent-network.rules +etc/ipsec.conf +etc/ipsec.secrets +etc/ipsec.user.conf +etc/ipsec.user.secrets +var/updatecache +etc/localtime +var/ipfire/ovpn +etc/ssh/ssh_config +etc/ssh/sshd_config +etc/ssl/openssl.cnf +var/state/dhcp/dhcpd.leases diff --git a/config/rootfiles/core/65/filelists/GeoIP b/config/rootfiles/core/65/filelists/GeoIP new file mode 100644 index 0000000..0258236 --- /dev/null +++ b/config/rootfiles/core/65/filelists/GeoIP @@ -0,0 +1 @@ +usr/local/share/GeoIP/GeoIP.dat diff --git a/config/rootfiles/core/65/filelists/daq b/config/rootfiles/core/65/filelists/daq new file mode 120000 index 0000000..d0e0956 --- /dev/null +++ b/config/rootfiles/core/65/filelists/daq @@ -0,0 +1 @@ +../../../common/daq \ No newline at end of file diff --git a/config/rootfiles/core/65/filelists/files b/config/rootfiles/core/65/filelists/files new file mode 100644 index 0000000..67bd0b3 --- /dev/null +++ b/config/rootfiles/core/65/filelists/files @@ -0,0 +1,10 @@ +etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf +etc/system-release +etc/issue +srv/web/ipfire/cgi-bin/logs.cgi/calamaris.dat +srv/web/ipfire/cgi-bin/ovpnmain.cgi +srv/web/ipfire/cgi-bin/vpnmain.cgi +usr/sbin/ovpn-ccd-convert +var/ipfire/general-functions.pl +var/ipfire/langs +var/ipfire/backup/include diff --git a/config/rootfiles/core/65/meta b/config/rootfiles/core/65/meta new file mode 100644 index 0000000..d547fa8 --- /dev/null +++ b/config/rootfiles/core/65/meta @@ -0,0 +1 @@ +DEPS="" diff --git a/config/rootfiles/core/65/update.sh b/config/rootfiles/core/65/update.sh new file mode 100644 index 0000000..88f5b36 --- /dev/null +++ b/config/rootfiles/core/65/update.sh @@ -0,0 +1,91 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 3 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2012 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +/usr/local/bin/backupctrl exclude >/dev/null 2>&1 + +# +# Remove old core updates from pakfire cache to save space... +core=65 +for (( i=1; i<=$core; i++ )) +do + rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire +done + +# +#Stop services + +# +#Extract files +extract_files + +# +#Start services + +# +#Update Language cache +perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang" + +# Convert OpenVPN RW connections. +/usr/sbin/ovpn-ccd-convert + +# Update crontab. +sed -i /var/spool/cron/root.orig \ + -e 's@^.*fcron.weekly.*$@\&nice(10),bootrun 47 2 \* \* 1\ttest -x /usr/local/bin/run-parts \&\& /usr/local/bin/run-parts /etc/fcron.weekly@' +fcrontab -z &>/dev/null + +# Reload apache configuration. +/etc/init.d/apache reload &>/dev/null + +#Rebuild module dep's +#arch=`uname -m` +#if [ ${arch::3} == "arm" ]; then +# depmod -a 2.6.32.45-ipfire-versatile >/dev/null 2>&1 +# depmod -a 2.6.32.45-ipfire-kirkwood >/dev/null 2>&1 +#else +# depmod -a 2.6.32.45-ipfire >/dev/null 2>&1 +# depmod -a 2.6.32.45-ipfire-pae >/dev/null 2>&1 +# depmod -a 2.6.32.45-ipfire-xen >/dev/null 2>&1 +#fi + + +#Rebuild initrd's because some compat-wireless modules are inside +#/sbin/dracut --force --verbose /boot/ipfirerd-2.6.32.45.img 2.6.32.45-ipfire +#if [ -e /boot/ipfirerd-2.6.32.45-pae.img ]; then +#/sbin/dracut --force --verbose /boot/ipfirerd-2.6.32.45-pae.img 2.6.32.45-ipfire-pae +#fi +#if [ -e /boot/ipfirerd-2.6.32.45-xen.img ]; then +#/sbin/dracut --force --verbose /boot/ipfirerd-2.6.32.45-xen.img 2.6.32.45-ipfire-xen +#fi + +sync + +# This update need a reboot... +#touch /var/run/need_reboot + +# +#Finish +/etc/init.d/fireinfo start +sendprofile +#Don't report the exitcode last command +exit 0 diff --git a/config/rootfiles/core/66/filelists/GeoIP b/config/rootfiles/core/66/filelists/GeoIP new file mode 100644 index 0000000..0258236 --- /dev/null +++ b/config/rootfiles/core/66/filelists/GeoIP @@ -0,0 +1 @@ +usr/local/share/GeoIP/GeoIP.dat diff --git a/config/rootfiles/core/66/filelists/files b/config/rootfiles/core/66/filelists/files index 8e7ba71..d923c5b 100644 --- a/config/rootfiles/core/66/filelists/files +++ b/config/rootfiles/core/66/filelists/files @@ -1,8 +1,5 @@ -etc/system-release +etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf etc/issue -etc/sysctl.conf -etc/securetty -opt/pakfire/etc/pakfire.conf etc/rc.d/init.d/firewall etc/rc.d/init.d/fsresize etc/rc.d/init.d/halt @@ -17,17 +14,26 @@ etc/rc.d/init.d/udev etc/rc.d/init.d/udev_retry etc/rc.d/rc0.d/K47setclock etc/rc.d/rc6.d/K47setclock +etc/securetty +etc/sysctl.conf +etc/system-release opt/pakfire/db/core/mine +opt/pakfire/etc/pakfire.conf opt/pakfire/lib/functions.sh srv/web/ipfire/cgi-bin/credits.cgi srv/web/ipfire/cgi-bin/ids.cgi +srv/web/ipfire/cgi-bin/logs.cgi/calamaris.dat +srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/qos.cgi srv/web/ipfire/cgi-bin/services.cgi srv/web/ipfire/cgi-bin/updatexlrator.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/bin/watch +usr/local/bin/readhash +usr/local/bin/scanhd +usr/sbin/ovpn-ccd-convert +var/ipfire/backup/include +var/ipfire/general-functions.pl var/ipfire/langs var/ipfire/outgoing/bin/outgoingfw.pl var/ipfire/qos/bin/makeqosscripts.pl -usr/local/bin/readhash -usr/local/bin/scanhd diff --git a/config/rootfiles/core/66/update.sh b/config/rootfiles/core/66/update.sh index e48c673..bb0aca9 100644 --- a/config/rootfiles/core/66/update.sh +++ b/config/rootfiles/core/66/update.sh @@ -78,7 +78,7 @@ fi # # -KVER="3.2.34" +KVER="3.2.35" MOUNT=`grep "kernel" /boot/grub/grub.conf 2>/dev/null | tail -n 1 ` # Nur den letzten Parameter verwenden echo $MOUNT > /dev/null @@ -171,6 +171,8 @@ esac /etc/init.d/snort stop /etc/init.d/squid stop /etc/init.d/ipsec stop +/etc/init.d/apache stop + #Remove old snort, zoneinfo and ncurses-libs(wrong path). rm -rf /etc/snort @@ -201,6 +203,7 @@ if [ $BOOTSPACE -lt 1000 ]; then * ) /usr/bin/logger -p syslog.emerg -t ipfire \ "core-update-$core: FATAL-ERROR space run out on boot. System is not bootable..." + /etc/init.d/apache start exit 4 ;; esac @@ -213,9 +216,18 @@ telinit u # Regenerate ipsec configuration files. /srv/web/ipfire/cgi-bin/vpnmain.cgi +# Convert OpenVPN RW connections. +/usr/sbin/ovpn-ccd-convert + +# Update crontab. +sed -i /var/spool/cron/root.orig \ + -e 's@^.*fcron.weekly.*$@\&nice(10),bootrun 47 2 \* \* 1\ttest -x /usr/local/bin/run-parts \&\& /usr/local/bin/run-parts /etc/fcron.weekly@' +fcrontab -z &>/dev/null + # # Start services # +/etc/init.d/apache start /etc/init.d/squid start /etc/init.d/snort start if [ `grep "ENABLED=on" /var/ipfire/vpn/settings` ]; then @@ -301,8 +313,8 @@ if [ ! "$(grep "^flags.* pae " /proc/cpuinfo)" == "" ]; then "core-update-$core: WARNING not enough space for pae kernel." else echo "Name: linux-pae" > /opt/pakfire/db/installed/meta-linux-pae - echo "ProgVersion: 3.2.34" >> /opt/pakfire/db/installed/meta-linux-pae - echo "Release: 23" >> /opt/pakfire/db/installed/meta-linux-pae + echo "ProgVersion: 3.2.35" >> /opt/pakfire/db/installed/meta-linux-pae + echo "Release: 24" >> /opt/pakfire/db/installed/meta-linux-pae fi fi diff --git a/config/rootfiles/packages/libstatgrab b/config/rootfiles/packages/libstatgrab new file mode 100644 index 0000000..2c61411 --- /dev/null +++ b/config/rootfiles/packages/libstatgrab @@ -0,0 +1,35 @@ +usr/bin/saidar +usr/bin/statgrab +#usr/bin/statgrab-make-mrtg-config +#usr/bin/statgrab-make-mrtg-index +#usr/include/statgrab.h +#usr/include/statgrab_deprecated.h +#usr/lib/libstatgrab.a +#usr/lib/libstatgrab.la +#usr/lib/libstatgrab.so +usr/lib/libstatgrab.so.6 +usr/lib/libstatgrab.so.6.2.3 +#usr/lib/pkgconfig/libstatgrab.pc +#usr/share/man/man1/saidar.1 +#usr/share/man/man1/statgrab-make-mrtg-config.1 +#usr/share/man/man1/statgrab-make-mrtg-index.1 +#usr/share/man/man1/statgrab.1 +#usr/share/man/man3/sg_get_cpu_percents.3 +#usr/share/man/man3/sg_get_cpu_stats.3 +#usr/share/man/man3/sg_get_cpu_stats_diff.3 +#usr/share/man/man3/sg_get_disk_io_stats.3 +#usr/share/man/man3/sg_get_disk_io_stats_diff.3 +#usr/share/man/man3/sg_get_fs_stats.3 +#usr/share/man/man3/sg_get_host_info.3 +#usr/share/man/man3/sg_get_load_stats.3 +#usr/share/man/man3/sg_get_mem_stats.3 +#usr/share/man/man3/sg_get_network_iface_stats.3 +#usr/share/man/man3/sg_get_network_io_stats.3 +#usr/share/man/man3/sg_get_network_io_stats_diff.3 +#usr/share/man/man3/sg_get_page_stats.3 +#usr/share/man/man3/sg_get_page_stats_diff.3 +#usr/share/man/man3/sg_get_process_count.3 +#usr/share/man/man3/sg_get_process_stats.3 +#usr/share/man/man3/sg_get_swap_stats.3 +#usr/share/man/man3/sg_get_user_stats.3 +#usr/share/man/man3/statgrab.3 diff --git a/config/rootfiles/packages/linux-pae b/config/rootfiles/packages/linux-pae index c22d0b5..5537af7 100644 --- a/config/rootfiles/packages/linux-pae +++ b/config/rootfiles/packages/linux-pae @@ -100,6 +100,7 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/acpi/battery.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/acpi/button.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/acpi/container.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/acpi/ec_sys.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/acpi/fan.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/acpi/pci_slot.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/acpi/processor.ko @@ -324,6 +325,7 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/gpio/gpio-cs5535.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/gpio/gpio-generic.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/gpio/gpio-it8761e.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/gpio/gpio-janz-ttl.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/gpio/gpio-max7300.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/gpio/gpio-max730x.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/gpio/gpio-max732x.ko @@ -368,6 +370,7 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/hid #lib/modules/KVER-ipfire-pae/kernel/drivers/hid/hid-a4tech.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/hid/hid-apple.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/hid/hid-axff.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/hid/hid-belkin.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/hid/hid-cherry.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/hid/hid-chicony.ko @@ -571,6 +574,7 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/i2c/busses/i2c-sis630.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/i2c/busses/i2c-sis96x.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/i2c/busses/i2c-stub.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/i2c/busses/i2c-taos-evm.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/i2c/busses/i2c-tiny-usb.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/i2c/busses/i2c-via.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/i2c/busses/i2c-viapro.ko @@ -613,6 +617,7 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/input/misc/ad714x.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/input/misc/apanel.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/input/misc/ati_remote2.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/input/misc/bma150.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/input/misc/cm109.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/input/misc/keyspan_remote.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/input/misc/pcf50633-input.ko @@ -768,19 +773,6 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/media/dvb/dvb-core/dvb-core.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/media.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ati_remote.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ene_ir.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/fintek-cir.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/imon.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-jvc-decoder.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-lirc-codec.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-mce_kbd-decoder.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-nec-decoder.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-rc5-decoder.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-rc5-sz-decoder.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-rc6-decoder.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ir-sony-decoder.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/ite-cir.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/keymaps #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/keymaps/rc-adstech-dvb-t-pci.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/keymaps/rc-alink-dtu-m.ko @@ -875,13 +867,7 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/keymaps/rc-winfast-usbii-deluxe.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/keymaps/rc-winfast.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/lirc_dev.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/mceusb.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/nuvoton-cir.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/rc-core.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/rc-loopback.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/redrat3.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/streamzap.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/media/rc/winbond-cir.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/video #lib/modules/KVER-ipfire-pae/kernel/drivers/media/video/ir-kbd-i2c.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/media/video/v4l2-common.ko @@ -918,9 +904,16 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/mfd/tps6105x.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/mfd/tps65010.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/mfd/tps6507x.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/mfd/ucb1400_core.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/mfd/vx855.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/mfd/wl1273-core.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/mfd/wm8400-core.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/apds9802als.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/apds990x.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/bh1770glc.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/bh1780gli.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/bmp085.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/c2port #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/c2port/c2port-duramar2150.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/c2port/core.ko @@ -934,18 +927,23 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/eeprom/eeprom_93cx6.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/eeprom/max6875.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/enclosure.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/fsa9480.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/hmc6352.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/hpilo.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/ics932s401.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/isl29003.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/isl29020.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/iwmc3200top #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/iwmc3200top/iwmc3200top.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/lis3lv02d #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/lis3lv02d/lis3lv02d.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/pch_phub.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/ti-st #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/ti-st/st_drv.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/tifm_7xx1.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/tifm_core.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/misc/tsl2550.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/misc/vmw_balloon.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/mmc #lib/modules/KVER-ipfire-pae/kernel/drivers/mmc/card #lib/modules/KVER-ipfire-pae/kernel/drivers/mmc/card/mmc_block.ko @@ -1379,11 +1377,6 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/platform/x86/toshiba_bluetooth.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/platform/x86/wmi.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/platform/x86/xo15-ebook.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/power -#lib/modules/KVER-ipfire-pae/kernel/drivers/power/bq27x00_battery.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/power/ds2782_battery.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/power/max17040_battery.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/power/pcf50633-charger.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/pps #lib/modules/KVER-ipfire-pae/kernel/drivers/pps/pps_core.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/ptp @@ -1568,18 +1561,10 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/hv/hv_mouse.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/hv/hv_netvsc.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/hv/hv_storvsc.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/mei +#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/mei/mei.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/phison #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/phison/phison.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rtl8187se -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rtl8187se/r8187se.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rtl8192u -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rtl8192u/r8192u_usb.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rtl8712 -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rtl8712/r8712u.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rts5139 -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rts5139/rts5139.ko -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rts_pstor -#lib/modules/KVER-ipfire-pae/kernel/drivers/staging/rts_pstor/rts_pstor.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/slicoss #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/slicoss/slicoss.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/staging/usbip @@ -1669,10 +1654,14 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/digi_acceleport.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/empeg.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/ftdi_sio.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/funsoft.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/garmin_gps.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/hp4x.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/io_edgeport.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/io_ti.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/ipaq.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/ipw.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/ir-usb.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/iuu_phoenix.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/keyspan_pda.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/mct_u232.ko @@ -1694,12 +1683,15 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/ti_usb_3410_5052.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/usb_wwan.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/usbserial.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/visor.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/vivopay-serial.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/whiteheat.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/serial/zio.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage +#lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage/uas.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage/ums-alauda.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage/ums-cypress.ko +#lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage/ums-datafab.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage/ums-eneub6250.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage/ums-freecom.ko #lib/modules/KVER-ipfire-pae/kernel/drivers/usb/storage/ums-isd200.ko @@ -1885,12 +1877,6 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/fs/ecryptfs/ecryptfs.ko #lib/modules/KVER-ipfire-pae/kernel/fs/exportfs #lib/modules/KVER-ipfire-pae/kernel/fs/exportfs/exportfs.ko -#lib/modules/KVER-ipfire-pae/kernel/fs/ext2 -#lib/modules/KVER-ipfire-pae/kernel/fs/ext2/ext2.ko -#lib/modules/KVER-ipfire-pae/kernel/fs/ext3 -#lib/modules/KVER-ipfire-pae/kernel/fs/ext3/ext3.ko -#lib/modules/KVER-ipfire-pae/kernel/fs/ext4 -#lib/modules/KVER-ipfire-pae/kernel/fs/ext4/ext4.ko #lib/modules/KVER-ipfire-pae/kernel/fs/fat #lib/modules/KVER-ipfire-pae/kernel/fs/fat/fat.ko #lib/modules/KVER-ipfire-pae/kernel/fs/fat/vfat.ko @@ -1901,17 +1887,12 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/fs/fuse/fuse.ko #lib/modules/KVER-ipfire-pae/kernel/fs/isofs #lib/modules/KVER-ipfire-pae/kernel/fs/isofs/isofs.ko -#lib/modules/KVER-ipfire-pae/kernel/fs/jbd -#lib/modules/KVER-ipfire-pae/kernel/fs/jbd/jbd.ko -#lib/modules/KVER-ipfire-pae/kernel/fs/jbd2 -#lib/modules/KVER-ipfire-pae/kernel/fs/jbd2/jbd2.ko #lib/modules/KVER-ipfire-pae/kernel/fs/jffs2 #lib/modules/KVER-ipfire-pae/kernel/fs/jffs2/jffs2.ko #lib/modules/KVER-ipfire-pae/kernel/fs/jfs #lib/modules/KVER-ipfire-pae/kernel/fs/jfs/jfs.ko #lib/modules/KVER-ipfire-pae/kernel/fs/lockd #lib/modules/KVER-ipfire-pae/kernel/fs/lockd/lockd.ko -#lib/modules/KVER-ipfire-pae/kernel/fs/mbcache.ko #lib/modules/KVER-ipfire-pae/kernel/fs/nfs #lib/modules/KVER-ipfire-pae/kernel/fs/nfs/nfs.ko #lib/modules/KVER-ipfire-pae/kernel/fs/nfs_common @@ -1935,7 +1916,6 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/lib/crc-ccitt.ko #lib/modules/KVER-ipfire-pae/kernel/lib/crc-itu-t.ko #lib/modules/KVER-ipfire-pae/kernel/lib/crc-t10dif.ko -#lib/modules/KVER-ipfire-pae/kernel/lib/crc16.ko #lib/modules/KVER-ipfire-pae/kernel/lib/crc7.ko #lib/modules/KVER-ipfire-pae/kernel/lib/crc8.ko #lib/modules/KVER-ipfire-pae/kernel/lib/libcrc32c.ko @@ -2102,6 +2082,9 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/net/key/af_key.ko #lib/modules/KVER-ipfire-pae/kernel/net/l2tp #lib/modules/KVER-ipfire-pae/kernel/net/l2tp/l2tp_core.ko +#lib/modules/KVER-ipfire-pae/kernel/net/l2tp/l2tp_eth.ko +#lib/modules/KVER-ipfire-pae/kernel/net/l2tp/l2tp_ip.ko +#lib/modules/KVER-ipfire-pae/kernel/net/l2tp/l2tp_netlink.ko #lib/modules/KVER-ipfire-pae/kernel/net/l2tp/l2tp_ppp.ko #lib/modules/KVER-ipfire-pae/kernel/net/llc #lib/modules/KVER-ipfire-pae/kernel/net/llc/llc.ko @@ -2205,6 +2188,7 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/net/sched/act_nat.ko #lib/modules/KVER-ipfire-pae/kernel/net/sched/act_pedit.ko #lib/modules/KVER-ipfire-pae/kernel/net/sched/act_police.ko +#lib/modules/KVER-ipfire-pae/kernel/net/sched/act_simple.ko #lib/modules/KVER-ipfire-pae/kernel/net/sched/act_skbedit.ko #lib/modules/KVER-ipfire-pae/kernel/net/sched/cls_basic.ko #lib/modules/KVER-ipfire-pae/kernel/net/sched/cls_flow.ko @@ -2476,85 +2460,6 @@ lib/modules/KVER-ipfire-pae #lib/modules/KVER-ipfire-pae/kernel/sound/pcmcia/pdaudiocf/snd-pdaudiocf.ko #lib/modules/KVER-ipfire-pae/kernel/sound/pcmcia/vx #lib/modules/KVER-ipfire-pae/kernel/sound/pcmcia/vx/snd-vxpocket.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ad193x.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ad73311.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-adau1373.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-adav80x.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ads117x.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ak4535.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ak4641.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ak4642.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ak4671.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-alc5623.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-cs4270.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-cs4271.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-cs42l51.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-cx20442.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-da7210.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-dfbmcs320.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-jz4740-codec.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-l3.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-lm4857.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-max98088.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-max98095.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-max9850.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-max9877.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-pcm3008.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-rt5631.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-sgtl5000.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-spdif.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-ssm2602.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-sta32x.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-tlv320aic23.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-tlv320aic32x4.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-tlv320aic3x.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-tlv320dac33.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-tpa6130a2.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-uda134x.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-uda1380.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm-hubs.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm1250-ev1.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm2000.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm5100.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8400.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8510.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8523.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8580.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8711.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8727.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8728.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8731.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8737.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8741.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8750.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8753.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8776.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8782.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8804.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8900.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8903.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8904.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8940.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8955.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8960.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8961.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8962.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8971.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8974.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8978.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8983.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8985.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8988.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8990.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8991.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8993.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8995.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm8996.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm9081.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/codecs/snd-soc-wm9090.ko -#lib/modules/KVER-ipfire-pae/kernel/sound/soc/snd-soc-core.ko #lib/modules/KVER-ipfire-pae/kernel/sound/soundcore.ko #lib/modules/KVER-ipfire-pae/kernel/sound/synth #lib/modules/KVER-ipfire-pae/kernel/sound/synth/emux diff --git a/config/rootfiles/packages/sarg b/config/rootfiles/packages/sarg new file mode 100644 index 0000000..9a0672c --- /dev/null +++ b/config/rootfiles/packages/sarg @@ -0,0 +1,48 @@ +etc/fcron.daily/sarg-reports +etc/fcron.hourly/sarg-reports +etc/fcron.monthly/sarg-reports +etc/fcron.weekly/sarg-reports +etc/sarg +etc/sarg/css.tpl +etc/sarg/exclude_codes +etc/sarg/sarg.conf +#etc/sarg/sarg.conf.default +etc/sarg/user_limit_block +usr/bin/sarg +usr/sbin/update-sarg-reports +usr/share/locale/bg/LC_MESSAGES/sarg.mo +usr/share/locale/ca/LC_MESSAGES/sarg.mo +usr/share/locale/cs/LC_MESSAGES/sarg.mo +usr/share/locale/da/LC_MESSAGES/sarg.mo +usr/share/locale/de/LC_MESSAGES/sarg.mo +usr/share/locale/el/LC_MESSAGES/sarg.mo +usr/share/locale/es/LC_MESSAGES/sarg.mo +usr/share/locale/fr/LC_MESSAGES/sarg.mo +usr/share/locale/hu/LC_MESSAGES/sarg.mo +usr/share/locale/id/LC_MESSAGES/sarg.mo +usr/share/locale/it/LC_MESSAGES/sarg.mo +usr/share/locale/ja/LC_MESSAGES/sarg.mo +usr/share/locale/lv/LC_MESSAGES/sarg.mo +usr/share/locale/nl/LC_MESSAGES/sarg.mo +usr/share/locale/pl/LC_MESSAGES/sarg.mo +usr/share/locale/pt/LC_MESSAGES/sarg.mo +usr/share/locale/pt_BR/LC_MESSAGES/sarg.mo +usr/share/locale/ro/LC_MESSAGES/sarg.mo +usr/share/locale/ru/LC_MESSAGES/sarg.mo +usr/share/locale/sk/LC_MESSAGES/sarg.mo +usr/share/locale/sr/LC_MESSAGES/sarg.mo +usr/share/locale/tr/LC_MESSAGES/sarg.mo +usr/share/locale/uk/LC_MESSAGES/sarg.mo +usr/share/locale/zh_CN/LC_MESSAGES/sarg.mo +#usr/share/man/man1/sarg.1 +usr/share/sarg +usr/share/sarg/fonts +usr/share/sarg/fonts/DejaVuSans.ttf +usr/share/sarg/fonts/FreeSans.ttf +usr/share/sarg/fonts/README +usr/share/sarg/fonts/license +usr/share/sarg/images +usr/share/sarg/images/datetime.png +usr/share/sarg/images/graph.png +usr/share/sarg/images/sarg-squidguard-block.png +usr/share/sarg/images/sarg.png diff --git a/config/rootfiles/packages/stress b/config/rootfiles/packages/stress new file mode 100644 index 0000000..2b0a000 --- /dev/null +++ b/config/rootfiles/packages/stress @@ -0,0 +1,3 @@ +usr/bin/stress +#usr/share/info/stress.info +#usr/share/man/man1/stress.1 \ No newline at end of file diff --git a/config/sarg/cron.daily b/config/sarg/cron.daily new file mode 100644 index 0000000..8ae1b1b --- /dev/null +++ b/config/sarg/cron.daily @@ -0,0 +1,5 @@ +#!/bin/bash + +/usr/sbin/update-sarg-reports daily >/dev/null 2>&1 + +exit 0 diff --git a/config/sarg/cron.hourly b/config/sarg/cron.hourly new file mode 100644 index 0000000..1e7b5ff --- /dev/null +++ b/config/sarg/cron.hourly @@ -0,0 +1,5 @@ +#!/bin/bash + +/usr/sbin/update-sarg-reports today >/dev/null 2>&1 + +exit 0 diff --git a/config/sarg/cron.monthly b/config/sarg/cron.monthly new file mode 100644 index 0000000..07b9efc --- /dev/null +++ b/config/sarg/cron.monthly @@ -0,0 +1,5 @@ +#!/bin/bash + +/usr/sbin/update-sarg-reports monthly >/dev/null 2>&1 + +exit 0 diff --git a/config/sarg/cron.weekly b/config/sarg/cron.weekly new file mode 100644 index 0000000..1f8287c --- /dev/null +++ b/config/sarg/cron.weekly @@ -0,0 +1,5 @@ +#!/bin/bash + +/usr/sbin/update-sarg-reports weekly >/dev/null 2>&1 + +exit 0 diff --git a/config/sarg/sarg.conf b/config/sarg/sarg.conf new file mode 100644 index 0000000..6331aaf --- /dev/null +++ b/config/sarg/sarg.conf @@ -0,0 +1,696 @@ +# sarg.conf +# +# TAG: access_log file +# Where is the access.log file +# sarg -l file +# +access_log /var/log/squid/access.log + +# TAG: graphs yes|no +# Use graphics where is possible. +# graph_days_bytes_bar_color blue|green|yellow|orange|brown|red +# +graphs yes +graph_days_bytes_bar_color orange + +# TAG: graph_font +# The full path to the TTF font file to use to create the graphs. It is required +# if graphs is set to yes. +# +graph_font /usr/share/sarg/fonts/DejaVuSans.ttf + +# TAG: title +# Especify the title for html page. +# +title "Squid User Access Reports" + +# TAG: font_face +# Especify the font for html page. +# +font_face Tahoma,Verdana,Arial + +# TAG: header_color +# Especify the header color +# +header_color darkblue + +# TAG: header_bgcolor +# Especify the header bgcolor +# +header_bgcolor blanchedalmond + +# TAG: font_size +# Especify the text font size +# +font_size 12px + +# TAG: header_font_size +# Especify the header font size +# +header_font_size 12px + +# TAG: title_font_size +# Especify the title font size +# +title_font_size 12px + +# TAG: background_color +# TAG: background_color +# Html page background color +# +# background_color white + +# TAG: text_color +# Html page text color +# +text_color #000000 + +# TAG: text_bgcolor +# Html page text background color +# +text_bgcolor lavender + +# TAG: title_color +# Html page title color +# +#title_color green + +# TAG: logo_image +# Html page logo. +# +#logo_image none + +# TAG: logo_text +# Html page logo text. +# +#logo_text "" + +# TAG: logo_text_color +# Html page logo texti color. +# +#logo_text_color #000000 + +# TAG: logo_image_size +# Html page logo image size. +# width height +# +#image_size 80 45 + +# TAG: background_image +# Html page background image +# +#background_image none + +# TAG: password +# User password file used by Squid authentication scheme +# If used, generate reports just for that users. +# +#password none + +# TAG: temporary_dir +# Temporary directory name for work files +# sarg -w dir +# +#temporary_dir /tmp + +# TAG: output_dir +# The reports will be saved in that directory +# sarg -o dir +# +output_dir /srv/web/ipfire/html/sarg + +# TAG: output_email +# Email address to send the reports. If you use this tag, no html reports will be generated. +# sarg -e email +# +#output_email none + +# TAG: resolve_ip yes/no +# Convert ip address to dns name +# sarg -n +resolve_ip no + +# TAG: user_ip yes/no +# Use Ip Address instead userid in reports. +# sarg -p +#user_ip no + +# TAG: topuser_sort_field field normal/reverse +# Sort field for the Topuser Report. +# Allowed fields: USER CONNECT BYTES TIME +# +#topuser_sort_field BYTES reverse + +# TAG: user_sort_field field normal/reverse +# Sort field for the User Report. +# Allowed fields: SITE CONNECT BYTES TIME +# +#user_sort_field BYTES reverse + +# TAG: exclude_users file +# users within the file will be excluded from reports. +# you can use indexonly to have only index.html file. +# +#exclude_users none + +# TAG: exclude_hosts file +# Hosts, domains or subnets will be excluded from reports. +# +# Eg.: 192.168.10.10 - exclude ip address only +# 192.168.10.0/24 - exclude full C class +# s1.acme.foo - exclude hostname only +# *.acme.foo - exclude full domain name +# +#exclude_hosts none + +# TAG: useragent_log file +# useragent.log file patch to generate useragent report. +# +#useragent_log /var/log/squid/user_agent.log + +# TAG: date_format +# Date format in reports: e (European=dd/mm/yy), u (American=mm/dd/yy), w (Weekly=yy.ww) +# +date_format e + +# TAG: per_user_limit file MB +# Saves userid on file if download exceed n MB. +# This option allow you to disable user access if user exceed a download limit. +# +#per_user_limit none + +# TAG: lastlog n +# How many reports files must be keept in reports directory. +# The oldest report file will be automatically removed. +# 0 - no limit. +# +#lastlog 0 + +# TAG: remove_temp_files yes +# Remove temporary files: geral, usuarios, top, periodo from root report directory. +# +#remove_temp_files yes + +# TAG: index yes|no|only +# Generate the main index.html. +# only - generate only the main index.html +# +#index yes + +# TAG: index_tree date|file +# How to generate the index. +# +#index_tree file + +# TAG: overwrite_report yes|no +# yes - if report date already exist then will be overwrited. +# no - if report date already exist then will be renamed to filename.n, filename.n+1 +# +overwrite_report yes + +# TAG: records_without_userid ignore|ip|everybody +# What can I do with records without user id (no authentication) in access.log file ? +# +# ignore - This record will be ignored. +# ip - Use ip address instead. (default) +# everybody - Use "everybody" instead. +# +#records_without_userid ip + +# TAG: use_comma no|yes +# Use comma instead point in reports. +# Eg.: use_comma yes => 23,450,110 +# use_comma no => 23.450.110 +# +#use_comma no + +# TAG: mail_utility +# Mail command to use to send reports via SMTP. Sarg calls it like this: +# mail_utility -s "SARG report, date" "output_email" <"mail_content" +# +# Therefore, it is possible to add more arguments to the command by specifying them +# here. +# +# If you need too, you can use a shell script to process the content of /dev/stdin +# (/dev/stdin is the mail_content passed by sarg to the script) and call whatever +# command you like. It is not limited to mailing the report via SMTP. +# +# Don't forget to quote the command if necessary (i.e. if the path contains +# characters that must be quoted). +# +#mail_utility mailx + +# TAG: topsites_num n +# How many sites in topsites report. +# +#topsites_num 100 + +# TAG: topsites_sort_order CONNECT|BYTES A|D +# Sort for topsites report, where A=Ascendent, D=Descendent +# +#topsites_sort_order CONNECT D + +# TAG: index_sort_order A/D +# Sort for index.html, where A=Ascendent, D=Descendent +# +#index_sort_order D + +# TAG: exclude_codes file +# Ignore records with these codes. Eg.: NONE/400 +# Write one code per line. Lines starting with a # are ignored. +# Only codes matching exactly one of the line is rejected. The +# comparison is not case sensitive. +# +#exclude_codes /usr/local/sarg/exclude_codes + +# TAG: replace_index string +# Replace "index.html" in the main index file with this string +# If null "index.html" is used +# +#replace_index <?php echo str_replace(".", "_", $REMOTE_ADDR); echo ".html"; ?> + +# TAG: max_elapsed milliseconds +# If elapsed time is recorded in log is greater than max_elapsed use 0 for elapsed time. +# Use 0 for no checking +# +#max_elapsed 28800000 +# 8 Hours + +# TAG: report_type type +# What kind of reports to generate. +# topusers - users, sites, times, bytes, connects, links to accessed sites, etc +# topsites - site, connect and bytes report +# sites_users - users and sites report +# users_sites - accessed sites by the user report +# date_time - bytes used per day and hour report +# denied - denied sites with full URL report +# auth_failures - autentication failures report +# site_user_time_date - sites, dates, times and bytes report +# downloads - downloads per user report +# +# Eg.: report_type topsites denied +# +report_type topusers topsites sites_users users_sites date_time denied auth_failures site_user_time_date downloads + +# TAG: usertab filename +# You can change the "userid" or the "ip address" to be a real user name on the reports. +# If resolve_ip is active, the ip address is resolved before being looked up into this +# file. That is, if you want to map the ip address, be sure to set resolv_ip to no or +# the resolved name will be looked into the file instead of the ip address. Note that +# it can be used to resolve any ip address known to the dns and then map the unresolved +# ip addresses to a name found in the usertab file. +# Table syntax: +# userid name or ip address name +# Eg: +# SirIsaac Isaac Newton +# vinci Leonardo da Vinci +# 192.168.10.1 Karol Wojtyla +# +# Each line must be terminated with '\n' +# If usertab have value "ldap" (case ignoring), user names +# will be taken from LDAP server. This method as approaches for reception +# of usernames from Active Didectory +# +#usertab none + +# TAG: LDAPHost hostname +# FQDN or IP address of host with LDAP service or AD DC +# default is '127.0.0.1' +#LDAPHost 127.0.0.1 + +# TAG: LDAPPort port +# LDAP service port number +# default is '389' +#LDAPPort 389 + +# TAG: LDAPBindDN CN=username,OU=group,DC=mydomain,DC=com +# DN of LDAP user, who is authorized to read user's names from LDAP base +# default is empty line +#LDAPBindDN cn=proxy,dc=mydomain,dc=local + +# TAG: LDAPBindPW secret +# Password of DN, who is authorized to read user's names from LDAP base +# default is empty line +#LDAPBindPW secret + +# TAG: LDAPBaseSearch OU=users,DC=mydomain,DC=com +# LDAP search base +# default is empty line +#LDAPBaseSearch ou=users,dc=mydomain,dc=local + +# TAG: LDAPFilterSearch (uid=%s) +# User search filter by user's logins in LDAP +# First founded record will be used +# %s - will be changed to userlogins from access.log file +# filter string can have up to 5 '%s' tags +# default value is '(uid=%s)' +#LDAPFilterSearch (uid=%s) + +# TAG: LDAPTargetAttr attributename +# Name of the attribute containing a name of the user +# default value is 'cn' +#LDAPTargetAttr cn + +# TAG: long_url yes|no +# If yes, the full url is showed in report. +# If no, only the site will be showed +# +# YES option generate very big sort files and reports. +# +#long_url no + +# TAG: date_time_by bytes|elap +# Date/Time reports show the downloaded volume or the elapsed time or both. +# +#date_time_by bytes + +# TAG: charset name +# ISO 8859 is a full series of 10 standardized multilingual single-byte coded (8bit) +# graphic character sets for writing in alphabetic languages +# You can use the following charsets: +# Latin1 - West European +# Latin2 - East European +# Latin3 - South European +# Latin4 - North European +# Cyrillic +# Arabic +# Greek +# Hebrew +# Latin5 - Turkish +# Latin6 +# Windows-1251 +# Japan +# Koi8-r +# UTF-8 +# +#charset Latin1 + +# TAG: user_invalid_char "&/" +# Records that contain invalid characters in userid will be ignored by Sarg. +# +#user_invalid_char "&/" + +# TAG: privacy yes|no +# privacy_string "***.***.***.***" +# privacy_string_color blue +# In some countries the sysadm cannot see the visited sites by a restrictive law. +# Using privacy yes the visited url will be changes by privacy_string and the link +# will be removed from reports. +# +#privacy no +#privacy_string "***.***.***.***" +#privacy_string_color blue + +# TAG: include_users "user1:user2:...:usern" +# Reports will be generated only for listed users. +# +#include_users none + +# TAG: exclude_string "string1:string2:...:stringn" +# Records from access.log file that contain one of listed strings will be ignored. +# +#exclude_string none + +# TAG: show_successful_message yes|no +# Shows "Successful report generated on dir" at end of process. +# +#show_successful_message yes + +# TAG: show_read_statistics yes|no +# Shows some reading statistics. +# +show_read_statistics yes + +# TAG: topuser_fields +# Which fields must be in Topuser report. +# +#topuser_fields NUM DATE_TIME USERID CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE + +# TAG: user_report_fields +# Which fields must be in User report. +# +#user_report_fields CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE + +# TAG: bytes_in_sites_users_report yes|no +# Bytes field must be in Site & Users Report ? +# +#bytes_in_sites_users_report no + +# TAG: topuser_num n +# How many users in topsites report. 0 = no limit +# +#topuser_num 0 + +# TAG: datafile file +# Save the report results in a file to populate some database +# +#datafile none + +# TAG: datafile_delimiter ";" +# ascii character to use as a field separator in datafile +# +#datafile_delimiter ";" + +# TAG: datafile_fields all +# Which data fields must be in datafile +# user;date;time;url;connect;bytes;in_cache;out_cache;elapsed +# +#datafile_fields user;date;time;url;connect;bytes;in_cache;out_cache;elapsed + +# TAG: datafile_url ip|name +# Saves the URL as ip or name in datafile +# +#datafile_url ip + +# TAG: weekdays +# The weekdays to take into account ( Sunday->0, Saturday->6 ) +# Example: +#weekdays 1-3,5 +# Default: +#weekdays 0-6 + +# TAG: hours +# The hours to take into account +# Example: +#hours 7-12,14,16,18-20 +# Default: +#hours 0-23 + +# TAG: dansguardian_conf file +# DansGuardian.conf file path +# Generate reports from DansGuardian logs. +# Use 'none' to disable it. +# dansguardian_conf /usr/dansguardian/dansguardian.conf +# +#dansguardian_conf none + +# TAG: dansguardian_filter_out_date on|off +# This option replaces dansguardian_ignore_date whose name was not appropriate with respect to its action. +# Note the change of parameter value compared with the old option. +# 'off' use the record even if its date is outside of the range found in the input log file. +# 'on' use the record only if its date is in the range found in the input log file. +# +#dansguardian_filter_out_date on + +# TAG: squidguard_conf file +# path to squidGuard.conf file +# Generate reports from SquidGuard logs. +# Use 'none' to disable. +# You can use sarg -L filename to use an alternate squidGuard log. +# squidguard_conf /usr/local/squidGuard/squidGuard.conf +# +#squidguard_conf none + +# TAG: redirector_log file +# the location of the web proxy redirector log such as one created by squidGuard or Rejik. The option +# may be repeated up to 64 times to read multiple files. +# If this option is specified, it takes precedence over squidguard_conf. +# The command line option -L override this option. +# +#redirector_log /usr/local/squidGuard/var/logs/urls.log + +# TAG: redirector_filter_out_date on|off +# This option replaces squidguard_ignore_date and redirector_ignore_date whose names were not +# appropriate with respect to their action. +# Note the change of parameter value compared with the old options. +# 'off' use the record even if its date is outside of the range found in the input log file. +# 'on' use the record only if its date is in the range found in the input log file. +# +#redirector_filter_out_date on + +# TAG: redirector_log_format +# Format string for web proxy redirector logs. +# This option was named squidguard_log_format before sarg 2.3. +# REJIK #year#-#mon#-#day# #hour# #list#:#tmp# #ip# #user# #tmp#/#tmp#/#url#/#end# +# SQUIDGUARD #year#-#mon#-#day# #hour# #tmp#/#list#/#tmp#/#tmp#/#url#/#tmp# #ip#/#tmp# #user# #end# +#redirector_log_format #year#-#mon#-#day# #hour# #tmp#/#list#/#tmp#/#tmp#/#url#/#tmp# #ip#/#tmp# #user# #end# + +# TAG: show_sarg_info yes|no +# shows sarg information and site path on each report bottom +# +#show_sarg_info yes + +# TAG: show_sarg_logo yes|no +# shows sarg logo +# +#show_sarg_logo yes + +# TAG: parsed_output_log directory +# Saves the processed log in a sarg format after parsing the squid log file. +# This is a way to dump all of the data structures out, after parsing from +# the logs (presumably this data will be much smaller than the log files themselves), +# and pull them back in for later processing and merging with data from previous logs. +# +#parsed_output_log none + +# TAG: parsed_output_log_compress /bin/gzip|/usr/bin/bzip2|nocompress +# Command to run to compress sarg parsed output log. It may contain +# options (such as -f to overwrite existing target file). The name of +# the file to compresse is provided at the end of this +# command line. Don't forget to quote things appropriately. +# +#parsed_output_log_compress /bin/gzip + +# TAG: displayed_values bytes|abbreviation +# how the values will be displayed in reports. +# eg. bytes - 209.526 +# abbreviation - 210K +# +#displayed_values bytes + +# Report limits +# TAG: authfail_report_limit n +# TAG: denied_report_limit n +# TAG: siteusers_report_limit n +# TAG: squidguard_report_limit n +# TAG: user_report_limit n +# TAG: dansguardian_report_limit n +# TAG: download_report_limit n +# report limits (lines). +# '0' no limit +# +#authfail_report_limit 10 +#denied_report_limit 10 +#siteusers_report_limit 0 +#squidguard_report_limit 10 +#dansguardian_report_limit 10 +#user_report_limit 10 +#user_report_limit 50 + +# TAG: www_document_root dir +# Where is your Web DocumentRoot +# Sarg will create sarg-php directory with some PHP modules: +# - sarg-squidguard-block.php - add urls from user reports to squidGuard DB +# +#www_document_root /var/www/html + +# TAG: block_it module_url +# This tag allow you to pass urls from user reports to a cgi or php module, +# to be blocked by some Squid acl +# +# Eg.: block_it /sarg-php/sarg-block-it.php +# sarg-block-it is a php that will append a url to a flat file. +# You must change /var/www/html/sarg-php/sarg-block-it to point to your file +# in $filename variable, and chown to a httpd owner. +# +# sarg will pass http://module_url?url=url +# +#block_it none + +# TAG: external_css_file path +# Provide the path to an external css file to link into the HTML reports instead of +# the inline css written by sarg when this option is not set. +# +# In versions prior to 2.3, this used to be an absolute file name to +# a file to include verbatim in each HTML page but, as it takes a lot of +# space, version 2.3 switched to a link to an external css file. +# Therefore, this option must contain the HTTP server path on which a client +# browser may find the css file. +# +# Sarg use theses style classes: +# .logo logo class +# .info sarg information class, align=center +# .title_c title class, align=center +# .header_c header class, align:center +# .header_l header class, align:left +# .header_r header class, align:right +# .text text class, align:right +# .data table text class, align:right +# .data2 table text class, align:left +# .data3 table text class, align:center +# .link link class +# +# Sarg can be instructed to output the internal css it inline +# into the reports with this command: +# +# sarg --css +# +# You can redirect the output to a file of your choice and edit +# it to your liking. +# +#external_css_file none + +# TAG: user_authentication yes|no +# Allow user authentication in User Reports using .htaccess +# Parameters: +# AuthUserTemplateFile - The template to use to create the +# .htaccess file. In the template, %u is replaced by the +# user's ID for which the report is generated. The path of the +# template is relative to the directory containing sarg +# configuration file. +# +# user_authentication no +# AuthUserTemplateFile sarg_htaccess + +# TAG: download_suffix "suffix,suffix,...,suffix" +# file suffix to be considered as "download" in Download report. +# Use 'none' to disable. +# +download_suffix "zip,arj,bzip,gz,ace,doc,iso,adt,bin,cab,com,dot,drv$,lha,lzh,mdb,mso,ppt,rtf,src,shs,sys,exe,dll,mp3,avi,mpg,mpeg" + +# TAG: ulimit n +# The maximum number of open file descriptors to avoid "Too many open files" error message. +# You need to run sarg as root to use ulimit tag. +# If you run sarg with a low privilege user, set to 'none' to disable ulimit +# +#ulimit 20000 + +# TAG: ntlm_user_format username|domainname+username +# NTLM users format. +# +#ntlm_user_format domainname+username + +# TAG: realtime_refresh_time num sec +# How many time to auto refresh the realtime report +# 0 = disable +# +# realtime_refresh_time 3 + +# TAG: realtime_access_log_lines num +# How many last lines to get from access.log file +# +# realtime_access_log_lines 1000 + +# TAG: realtime_types: GET,PUT,CONNECT,ICP_QUERY,POST +# Which records must be in realtime report. +# +# realtime_types GET,PUT,CONNECT + +# TAG: realtime_unauthenticated_records: ignore|show +# What to do with unauthenticated records in realtime report. +# +# realtime_unauthenticated_records: show + +# TAG: byte_cost value no_cost_limit +# Cost per byte. +# Eg. byte_cost 0.01 100000000 +# per byte cost = 0.01 +# bytes with no cost = 100 Mb +# 0 = disable +# +# byte_cost 0.01 50000000 + +# TAG: squid24 on|off +# Compatilibity with squid version <= 2.4 when using emulate_http_log on +# +# squid24 off diff --git a/config/sarg/update-sarg-reports b/config/sarg/update-sarg-reports new file mode 100644 index 0000000..9f2ab4c --- /dev/null +++ b/config/sarg/update-sarg-reports @@ -0,0 +1,188 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) 2012 Michael Tremer # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +export LC_ALL=C + +SARG_CONFIG="/etc/sarg/sarg.conf" +SQUID_LOG="/var/log/squid/access.log" +REPORTS_PATH="/var/log/sarg" + +function date_calc() { + local when + local range="false" + + case "${1}" in + month) + when="1 month ago" + range="true" + ;; + week) + when="1 week ago" + ;; + yesterday) + when="1 day ago" + ;; + today) + when="today" + ;; + *) + return 1 + ;; + esac + + if [ "${range}" = "true" ]; then + echo "$(date --date "${when}" +01/%m/%Y)-$(date --date "${when}" +31/%m/%Y)" + else + date --date "${when}" +%d/%m/%Y + fi + + return 0 +} + +function compile_report() { + local interval=${1} + + local date + case "${interval}" in + today) + date=$(date_calc today) + ;; + daily) + date=$(date_calc yesterday) + ;; + weekly) + date="$(date_calc week)-$(date_calc yesterday)" + ;; + monthly) + date="$(date_calc month)" + ;; + esac + [ -n "${date}" ] || return 1 + + # Determine max. number of archived log files to search. + local max_logs + case "${interval}" in + today|daily) + max_logs=3 + ;; + weekly) + max_logs=14 + ;; + monthly) + max_logs=40 + ;; + esac + + # Create reports_path, if not exists. + local reports_path="${REPORTS_PATH}/${interval}" + mkdir -p ${reports_path} + + # Remove already existant data on today's reports. + case "${interval}" in + today) + rm -rf ${reports_path}/* + ;; + esac + + # Run SARG. + get_logs ${max_logs} | sarg -f ${SARG_CONFIG} -l - -d ${date} -o ${reports_path} +} + +function get_logs() { + local max=${1} + + if [ -z "${max}" ]; then + max=10000 + fi + + local idx=0 + while [ ${idx} -le ${max} ]; do + file=$(search_log_file ${idx}) + + # If no log file could be opened, we are done. + [ -z "${file}" ] && break + + case "${file}" in + # Logs in plain text. + *.log) + cat ${file} + ;; + + # GZip compressed log files. + *.gz) + gzip -d < ${file} + ;; + + # XZ compressed log files. + *.xz) + xz -d < ${file} + ;; + + # Unhandled stuff. + *) + echo "Unhandled file type: ${file}" >&2 + ;; + esac + + idx=$(( ${idx} + 1 )) + done + + return 0 +} + +function search_log_file() { + local idx=${1} + + if [ "${idx}" = "0" ] && [ -e "${SQUID_LOG}" ]; then + echo "${SQUID_LOG}" + return 0 + fi + + local algo + for algo in gz xz; do + file="${SQUID_LOG}.${idx}.${algo}" + + if [ -e "${file}" ]; then + echo "${file}" + return 0 + fi + done + + return 1 +} + +# Main. + +case "${1}" in + today|daily|weekly|monthly) + compile_report ${1} + ;; + *) + echo "${0} - Squid proxy reports creation tool" + echo + echo "Usage: ${0} [interval]" + echo " interval: today, daily, weekly, monthly" + echo + exit 0 + ;; +esac + +exit 0 diff --git a/doc/language_issues.de b/doc/language_issues.de index 5a42ae5..137217c 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -68,6 +68,9 @@ WARNING: translation string unused: cache size WARNING: translation string unused: calamaris report interval (in minutes) WARNING: translation string unused: calc traffic all x minutes WARNING: translation string unused: capsinactive +WARNING: translation string unused: ccd err iroute +WARNING: translation string unused: ccd err netadr +WARNING: translation string unused: ccd maxclients WARNING: translation string unused: cfg restart WARNING: translation string unused: check for net traffic update WARNING: translation string unused: choose config diff --git a/doc/language_issues.en b/doc/language_issues.en index 6d6a2a6..68fef77 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -87,6 +87,8 @@ WARNING: translation string unused: cache size WARNING: translation string unused: calamaris report interval (in minutes) WARNING: translation string unused: calc traffic all x minutes WARNING: translation string unused: capsinactive +WARNING: translation string unused: ccd err iroute +WARNING: translation string unused: ccd err netadr WARNING: translation string unused: cfg restart WARNING: translation string unused: check for net traffic update WARNING: translation string unused: choose config diff --git a/doc/language_issues.es b/doc/language_issues.es index 6bcbf86..eca067d 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -500,7 +500,43 @@ WARNING: untranslated string: Async logging enabled WARNING: untranslated string: Scan for Songs WARNING: untranslated string: Set time on boot WARNING: untranslated string: advproxy errmsg invalid upstream proxy +WARNING: untranslated string: attention WARNING: untranslated string: bytes +WARNING: untranslated string: ccd add +WARNING: untranslated string: ccd choose net +WARNING: untranslated string: ccd client options +WARNING: untranslated string: ccd clientip +WARNING: untranslated string: ccd dynrange +WARNING: untranslated string: ccd err blue +WARNING: untranslated string: ccd err green +WARNING: untranslated string: ccd err hostinnet +WARNING: untranslated string: ccd err inuse +WARNING: untranslated string: ccd err invalidname +WARNING: untranslated string: ccd err invalidnet +WARNING: untranslated string: ccd err irouteexist +WARNING: untranslated string: ccd err isipsecnet +WARNING: untranslated string: ccd err isovpnnet +WARNING: untranslated string: ccd err issubnet +WARNING: untranslated string: ccd err name +WARNING: untranslated string: ccd err nameexist +WARNING: untranslated string: ccd err netadrexist +WARNING: untranslated string: ccd err orange +WARNING: untranslated string: ccd err red +WARNING: untranslated string: ccd err routeovpn +WARNING: untranslated string: ccd err routeovpn2 +WARNING: untranslated string: ccd hint +WARNING: untranslated string: ccd invalid +WARNING: untranslated string: ccd iroute +WARNING: untranslated string: ccd iroute2 +WARNING: untranslated string: ccd iroutehint +WARNING: untranslated string: ccd modify +WARNING: untranslated string: ccd name +WARNING: untranslated string: ccd net +WARNING: untranslated string: ccd noaddnet +WARNING: untranslated string: ccd none +WARNING: untranslated string: ccd routes +WARNING: untranslated string: ccd subnet +WARNING: untranslated string: ccd used WARNING: untranslated string: deprecated fs warn WARNING: untranslated string: fireinfo ipfire version WARNING: untranslated string: fireinfo is disabled @@ -546,11 +582,28 @@ WARNING: untranslated string: outgoing firewall p2p description 2 WARNING: untranslated string: outgoing firewall p2p description 3 WARNING: untranslated string: outgoing firewall reserved groupname WARNING: untranslated string: outgoing firewall view group +WARNING: untranslated string: ovpn errmsg green already pushed +WARNING: untranslated string: ovpn errmsg invalid ip or mask +WARNING: untranslated string: ovpn mtu-disc +WARNING: untranslated string: ovpn mtu-disc and mtu not 1500 +WARNING: untranslated string: ovpn mtu-disc maybe +WARNING: untranslated string: ovpn mtu-disc no +WARNING: untranslated string: ovpn mtu-disc off +WARNING: untranslated string: ovpn mtu-disc with mssfix or fragment +WARNING: untranslated string: ovpn mtu-disc yes +WARNING: untranslated string: ovpn routes push +WARNING: untranslated string: ovpn routes push options WARNING: untranslated string: pakfire ago +WARNING: untranslated string: proxy reports +WARNING: untranslated string: proxy reports daily +WARNING: untranslated string: proxy reports monthly +WARNING: untranslated string: proxy reports today +WARNING: untranslated string: proxy reports weekly WARNING: untranslated string: route config changed WARNING: untranslated string: routing config added WARNING: untranslated string: routing config changed WARNING: untranslated string: routing table +WARNING: untranslated string: server restart WARNING: untranslated string: static routes WARNING: untranslated string: system information WARNING: untranslated string: visit us at diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 189932f..91beb6f 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -499,7 +499,43 @@ WARNING: translation string unused: year-graph WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: Scan for Songs WARNING: untranslated string: advproxy errmsg invalid upstream proxy +WARNING: untranslated string: attention WARNING: untranslated string: bytes +WARNING: untranslated string: ccd add +WARNING: untranslated string: ccd choose net +WARNING: untranslated string: ccd client options +WARNING: untranslated string: ccd clientip +WARNING: untranslated string: ccd dynrange +WARNING: untranslated string: ccd err blue +WARNING: untranslated string: ccd err green +WARNING: untranslated string: ccd err hostinnet +WARNING: untranslated string: ccd err inuse +WARNING: untranslated string: ccd err invalidname +WARNING: untranslated string: ccd err invalidnet +WARNING: untranslated string: ccd err irouteexist +WARNING: untranslated string: ccd err isipsecnet +WARNING: untranslated string: ccd err isovpnnet +WARNING: untranslated string: ccd err issubnet +WARNING: untranslated string: ccd err name +WARNING: untranslated string: ccd err nameexist +WARNING: untranslated string: ccd err netadrexist +WARNING: untranslated string: ccd err orange +WARNING: untranslated string: ccd err red +WARNING: untranslated string: ccd err routeovpn +WARNING: untranslated string: ccd err routeovpn2 +WARNING: untranslated string: ccd hint +WARNING: untranslated string: ccd invalid +WARNING: untranslated string: ccd iroute +WARNING: untranslated string: ccd iroute2 +WARNING: untranslated string: ccd iroutehint +WARNING: untranslated string: ccd modify +WARNING: untranslated string: ccd name +WARNING: untranslated string: ccd net +WARNING: untranslated string: ccd noaddnet +WARNING: untranslated string: ccd none +WARNING: untranslated string: ccd routes +WARNING: untranslated string: ccd subnet +WARNING: untranslated string: ccd used WARNING: untranslated string: deprecated fs warn WARNING: untranslated string: dns address deleted txt WARNING: untranslated string: fireinfo ipfire version @@ -534,11 +570,24 @@ WARNING: untranslated string: openvpn subnet is used WARNING: untranslated string: other WARNING: untranslated string: our donors WARNING: untranslated string: outgoing firewall reserved groupname +WARNING: untranslated string: ovpn mtu-disc +WARNING: untranslated string: ovpn mtu-disc and mtu not 1500 +WARNING: untranslated string: ovpn mtu-disc maybe +WARNING: untranslated string: ovpn mtu-disc no +WARNING: untranslated string: ovpn mtu-disc off +WARNING: untranslated string: ovpn mtu-disc with mssfix or fragment +WARNING: untranslated string: ovpn mtu-disc yes WARNING: untranslated string: pakfire ago +WARNING: untranslated string: proxy reports +WARNING: untranslated string: proxy reports daily +WARNING: untranslated string: proxy reports monthly +WARNING: untranslated string: proxy reports today +WARNING: untranslated string: proxy reports weekly WARNING: untranslated string: route config changed WARNING: untranslated string: routing config added WARNING: untranslated string: routing config changed WARNING: untranslated string: routing table +WARNING: untranslated string: server restart WARNING: untranslated string: snort working WARNING: untranslated string: static routes WARNING: untranslated string: system information diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 6bcbf86..eca067d 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -500,7 +500,43 @@ WARNING: untranslated string: Async logging enabled WARNING: untranslated string: Scan for Songs WARNING: untranslated string: Set time on boot WARNING: untranslated string: advproxy errmsg invalid upstream proxy +WARNING: untranslated string: attention WARNING: untranslated string: bytes +WARNING: untranslated string: ccd add +WARNING: untranslated string: ccd choose net +WARNING: untranslated string: ccd client options +WARNING: untranslated string: ccd clientip +WARNING: untranslated string: ccd dynrange +WARNING: untranslated string: ccd err blue +WARNING: untranslated string: ccd err green +WARNING: untranslated string: ccd err hostinnet +WARNING: untranslated string: ccd err inuse +WARNING: untranslated string: ccd err invalidname +WARNING: untranslated string: ccd err invalidnet +WARNING: untranslated string: ccd err irouteexist +WARNING: untranslated string: ccd err isipsecnet +WARNING: untranslated string: ccd err isovpnnet +WARNING: untranslated string: ccd err issubnet +WARNING: untranslated string: ccd err name +WARNING: untranslated string: ccd err nameexist +WARNING: untranslated string: ccd err netadrexist +WARNING: untranslated string: ccd err orange +WARNING: untranslated string: ccd err red +WARNING: untranslated string: ccd err routeovpn +WARNING: untranslated string: ccd err routeovpn2 +WARNING: untranslated string: ccd hint +WARNING: untranslated string: ccd invalid +WARNING: untranslated string: ccd iroute +WARNING: untranslated string: ccd iroute2 +WARNING: untranslated string: ccd iroutehint +WARNING: untranslated string: ccd modify +WARNING: untranslated string: ccd name +WARNING: untranslated string: ccd net +WARNING: untranslated string: ccd noaddnet +WARNING: untranslated string: ccd none +WARNING: untranslated string: ccd routes +WARNING: untranslated string: ccd subnet +WARNING: untranslated string: ccd used WARNING: untranslated string: deprecated fs warn WARNING: untranslated string: fireinfo ipfire version WARNING: untranslated string: fireinfo is disabled @@ -546,11 +582,28 @@ WARNING: untranslated string: outgoing firewall p2p description 2 WARNING: untranslated string: outgoing firewall p2p description 3 WARNING: untranslated string: outgoing firewall reserved groupname WARNING: untranslated string: outgoing firewall view group +WARNING: untranslated string: ovpn errmsg green already pushed +WARNING: untranslated string: ovpn errmsg invalid ip or mask +WARNING: untranslated string: ovpn mtu-disc +WARNING: untranslated string: ovpn mtu-disc and mtu not 1500 +WARNING: untranslated string: ovpn mtu-disc maybe +WARNING: untranslated string: ovpn mtu-disc no +WARNING: untranslated string: ovpn mtu-disc off +WARNING: untranslated string: ovpn mtu-disc with mssfix or fragment +WARNING: untranslated string: ovpn mtu-disc yes +WARNING: untranslated string: ovpn routes push +WARNING: untranslated string: ovpn routes push options WARNING: untranslated string: pakfire ago +WARNING: untranslated string: proxy reports +WARNING: untranslated string: proxy reports daily +WARNING: untranslated string: proxy reports monthly +WARNING: untranslated string: proxy reports today +WARNING: untranslated string: proxy reports weekly WARNING: untranslated string: route config changed WARNING: untranslated string: routing config added WARNING: untranslated string: routing config changed WARNING: untranslated string: routing table +WARNING: untranslated string: server restart WARNING: untranslated string: static routes WARNING: untranslated string: system information WARNING: untranslated string: visit us at diff --git a/doc/language_issues.ru b/doc/language_issues.ru index e25d81d..e36449a 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -491,7 +491,43 @@ WARNING: untranslated string: Add a route WARNING: untranslated string: Edit an existing route WARNING: untranslated string: Scan for Songs WARNING: untranslated string: advproxy errmsg invalid upstream proxy +WARNING: untranslated string: attention WARNING: untranslated string: bytes +WARNING: untranslated string: ccd add +WARNING: untranslated string: ccd choose net +WARNING: untranslated string: ccd client options +WARNING: untranslated string: ccd clientip +WARNING: untranslated string: ccd dynrange +WARNING: untranslated string: ccd err blue +WARNING: untranslated string: ccd err green +WARNING: untranslated string: ccd err hostinnet +WARNING: untranslated string: ccd err inuse +WARNING: untranslated string: ccd err invalidname +WARNING: untranslated string: ccd err invalidnet +WARNING: untranslated string: ccd err irouteexist +WARNING: untranslated string: ccd err isipsecnet +WARNING: untranslated string: ccd err isovpnnet +WARNING: untranslated string: ccd err issubnet +WARNING: untranslated string: ccd err name +WARNING: untranslated string: ccd err nameexist +WARNING: untranslated string: ccd err netadrexist +WARNING: untranslated string: ccd err orange +WARNING: untranslated string: ccd err red +WARNING: untranslated string: ccd err routeovpn +WARNING: untranslated string: ccd err routeovpn2 +WARNING: untranslated string: ccd hint +WARNING: untranslated string: ccd invalid +WARNING: untranslated string: ccd iroute +WARNING: untranslated string: ccd iroute2 +WARNING: untranslated string: ccd iroutehint +WARNING: untranslated string: ccd modify +WARNING: untranslated string: ccd name +WARNING: untranslated string: ccd net +WARNING: untranslated string: ccd noaddnet +WARNING: untranslated string: ccd none +WARNING: untranslated string: ccd routes +WARNING: untranslated string: ccd subnet +WARNING: untranslated string: ccd used WARNING: untranslated string: deprecated fs warn WARNING: untranslated string: disk access per WARNING: untranslated string: extrahd because there is already a device mounted @@ -516,10 +552,23 @@ WARNING: untranslated string: other WARNING: untranslated string: our donors WARNING: untranslated string: outgoing firewall reserved groupname WARNING: untranslated string: outgoing traffic in bytes per second +WARNING: untranslated string: ovpn mtu-disc +WARNING: untranslated string: ovpn mtu-disc and mtu not 1500 +WARNING: untranslated string: ovpn mtu-disc maybe +WARNING: untranslated string: ovpn mtu-disc no +WARNING: untranslated string: ovpn mtu-disc off +WARNING: untranslated string: ovpn mtu-disc with mssfix or fragment +WARNING: untranslated string: ovpn mtu-disc yes +WARNING: untranslated string: proxy reports +WARNING: untranslated string: proxy reports daily +WARNING: untranslated string: proxy reports monthly +WARNING: untranslated string: proxy reports today +WARNING: untranslated string: proxy reports weekly WARNING: untranslated string: route config changed WARNING: untranslated string: routing config added WARNING: untranslated string: routing config changed WARNING: untranslated string: routing table +WARNING: untranslated string: server restart WARNING: untranslated string: static routes WARNING: untranslated string: visit us at WARNING: untranslated string: vpn keyexchange diff --git a/doc/language_missings b/doc/language_missings index 55e0e40..83fbf90 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -4,6 +4,7 @@ ############################################################################ # Checking cgi-bin translations for language: en # ############################################################################ +< ccd maxclients ############################################################################ # Checking install/setup translations for language: fr # ############################################################################ @@ -11,6 +12,45 @@ # Checking cgi-bin translations for language: fr # ############################################################################ < advproxy errmsg invalid upstream proxy +< attention +< ccd add +< ccd choose net +< ccd clientip +< ccd client options +< ccd dynrange +< ccd err blue +< ccd err green +< ccd err hostinnet +< ccd err inuse +< ccd err invalidname +< ccd err invalidnet +< ccd err iroute +< ccd err irouteexist +< ccd err isipsecnet +< ccd err isovpnnet +< ccd err issubnet +< ccd err name +< ccd err nameexist +< ccd err netadr +< ccd err netadrexist +< ccd err orange +< ccd err red +< ccd err routeovpn +< ccd err routeovpn2 +< ccd hint +< ccd invalid +< ccd iroute +< ccd iroute2 +< ccd iroutehint +< ccd maxclients +< ccd modify +< ccd name +< ccd net +< ccd noaddnet +< ccd none +< ccd routes +< ccd subnet +< ccd used < deprecated fs warn < dns address deleted txt < fireinfo ipfire version @@ -45,6 +85,19 @@ < openvpn subnet is used < other < our donors +< ovpn mtu-disc +< ovpn mtu-disc and mtu not 1500 +< ovpn mtu-disc maybe +< ovpn mtu-disc no +< ovpn mtu-disc off +< ovpn mtu-disc with mssfix or fragment +< ovpn mtu-disc yes +< proxy reports +< proxy reports daily +< proxy reports monthly +< proxy reports today +< proxy reports weekly +< server restart < snort working < static routes < system information @@ -81,6 +134,45 @@ ############################################################################ < advproxy errmsg invalid upstream proxy < Async logging enabled +< attention +< ccd add +< ccd choose net +< ccd clientip +< ccd client options +< ccd dynrange +< ccd err blue +< ccd err green +< ccd err hostinnet +< ccd err inuse +< ccd err invalidname +< ccd err invalidnet +< ccd err iroute +< ccd err irouteexist +< ccd err isipsecnet +< ccd err isovpnnet +< ccd err issubnet +< ccd err name +< ccd err nameexist +< ccd err netadr +< ccd err netadrexist +< ccd err orange +< ccd err red +< ccd err routeovpn +< ccd err routeovpn2 +< ccd hint +< ccd invalid +< ccd iroute +< ccd iroute2 +< ccd iroutehint +< ccd maxclients +< ccd modify +< ccd name +< ccd net +< ccd noaddnet +< ccd none +< ccd routes +< ccd subnet +< ccd used < deprecated fs warn < fireinfo ipfire version < fireinfo is disabled @@ -126,6 +218,23 @@ < outgoing firewall p2p description 2 < outgoing firewall p2p description 3 < outgoing firewall view group +< ovpn errmsg green already pushed +< ovpn errmsg invalid ip or mask +< ovpn mtu-disc +< ovpn mtu-disc and mtu not 1500 +< ovpn mtu-disc maybe +< ovpn mtu-disc no +< ovpn mtu-disc off +< ovpn mtu-disc with mssfix or fragment +< ovpn mtu-disc yes +< ovpn routes push +< ovpn routes push options +< proxy reports +< proxy reports daily +< proxy reports monthly +< proxy reports today +< proxy reports weekly +< server restart < Set time on boot < static routes < system information @@ -138,6 +247,45 @@ # Checking cgi-bin translations for language: pl # ############################################################################ < advproxy errmsg invalid upstream proxy +< attention +< ccd add +< ccd choose net +< ccd clientip +< ccd client options +< ccd dynrange +< ccd err blue +< ccd err green +< ccd err hostinnet +< ccd err inuse +< ccd err invalidname +< ccd err invalidnet +< ccd err iroute +< ccd err irouteexist +< ccd err isipsecnet +< ccd err isovpnnet +< ccd err issubnet +< ccd err name +< ccd err nameexist +< ccd err netadr +< ccd err netadrexist +< ccd err orange +< ccd err red +< ccd err routeovpn +< ccd err routeovpn2 +< ccd hint +< ccd invalid +< ccd iroute +< ccd iroute2 +< ccd iroutehint +< ccd maxclients +< ccd modify +< ccd name +< ccd net +< ccd noaddnet +< ccd none +< ccd routes +< ccd subnet +< ccd used < deprecated fs warn < extrahd because there is already a device mounted < extrahd cant umount @@ -161,6 +309,23 @@ < openvpn subnet is used < other < our donors +< ovpn errmsg green already pushed +< ovpn errmsg invalid ip or mask +< ovpn mtu-disc +< ovpn mtu-disc and mtu not 1500 +< ovpn mtu-disc maybe +< ovpn mtu-disc no +< ovpn mtu-disc off +< ovpn mtu-disc with mssfix or fragment +< ovpn mtu-disc yes +< ovpn routes push +< ovpn routes push options +< proxy reports +< proxy reports daily +< proxy reports monthly +< proxy reports today +< proxy reports weekly +< server restart < static routes < visit us at < vpn keyexchange @@ -172,6 +337,45 @@ ############################################################################ < Add a route < advproxy errmsg invalid upstream proxy +< attention +< ccd add +< ccd choose net +< ccd clientip +< ccd client options +< ccd dynrange +< ccd err blue +< ccd err green +< ccd err hostinnet +< ccd err inuse +< ccd err invalidname +< ccd err invalidnet +< ccd err iroute +< ccd err irouteexist +< ccd err isipsecnet +< ccd err isovpnnet +< ccd err issubnet +< ccd err name +< ccd err nameexist +< ccd err netadr +< ccd err netadrexist +< ccd err orange +< ccd err red +< ccd err routeovpn +< ccd err routeovpn2 +< ccd hint +< ccd invalid +< ccd iroute +< ccd iroute2 +< ccd iroutehint +< ccd maxclients +< ccd modify +< ccd name +< ccd net +< ccd noaddnet +< ccd none +< ccd routes +< ccd subnet +< ccd used < day-graph < deprecated fs warn < disk access per @@ -203,6 +407,19 @@ < other < our donors < outgoing traffic in bytes per second +< ovpn mtu-disc +< ovpn mtu-disc and mtu not 1500 +< ovpn mtu-disc maybe +< ovpn mtu-disc no +< ovpn mtu-disc off +< ovpn mtu-disc with mssfix or fragment +< ovpn mtu-disc yes +< proxy reports +< proxy reports daily +< proxy reports monthly +< proxy reports today +< proxy reports weekly +< server restart < static routes < visit us at < vpn keyexchange diff --git a/html/cgi-bin/logs.cgi/calamaris.dat b/html/cgi-bin/logs.cgi/calamaris.dat index 19a3693..07fdf8a 100644 --- a/html/cgi-bin/logs.cgi/calamaris.dat +++ b/html/cgi-bin/logs.cgi/calamaris.dat @@ -24,6 +24,7 @@ my $unique=time; my $squidlogdir = "/var/log/squid"; my $reportdir = "${General::swroot}/proxy/calamaris/reports"; +my $sargdir = "/var/log/sarg"; unless (-e $reportdir) { mkdir($reportdir) } @@ -98,6 +99,7 @@ if ($reportsettings{'ACTION'} eq $Lang::tr{'calamaris create report'}) delete $reportsettings{'DAY_END'}; delete $reportsettings{'MONTH_END'}; delete $reportsettings{'YEAR_END'}; + delete $reportsettings{'REPORT'}; &General::writehash("${General::swroot}/proxy/calamaris/settings", \%reportsettings); @@ -240,6 +242,86 @@ if ($errormessage) { &Header::closebox(); } +# Link sarg reports. +if (-e $sargdir) { + &Header::openbox('100%', 'left', "$Lang::tr{'proxy reports'}:"); + + print <<END; + <table width="100%"> + <tr> +END + + # Today. + if (-e "$sargdir/today") { + print <<END; + <td width="25%" align="center"> + <a href="/proxy-reports/today" target="_blank">$Lang::tr{'proxy reports today'}</a> + </td> +END + } else { + print <<END; + <td width="25%" align="center"> + $Lang::tr{'proxy reports today'} + </td> +END + } + + # Daily. + if (-e "$sargdir/daily") { + print <<END; + <td width="25%" align="center"> + <a href="/proxy-reports/daily" target="_blank">$Lang::tr{'proxy reports daily'}</a> + </td> +END + } else { + print <<END; + <td width="25%" align="center"> + $Lang::tr{'proxy reports daily'} + </td> +END + } + + # Weekly. + if (-e "$sargdir/weekly") { + print <<END; + <td width="25%" align="center"> + <a href="/proxy-reports/weekly" target="_blank">$Lang::tr{'proxy reports weekly'}</a> + </td> +END + } else { + print <<END; + <td width="25%" align="center"> + $Lang::tr{'proxy reports weekly'} + </td> +END + } + + # Monthly. + if (-e "$sargdir/monthly") { + print <<END; + <td width="25%" align="center"> + <a href="/proxy-reports/monthly" target="_blank">$Lang::tr{'proxy reports monthly'}</a> + </td> +END + } else { + print <<END; + <td width="25%" align="center"> + $Lang::tr{'proxy reports monthly'} + </td> +END + } + + print <<END; + </tr> + </table> + + <br><br> +END + + &Header::closebox(); +} + + &Header::openbox('100%', 'left', "$Lang::tr{'settings'}:"); print <<END @@ -493,12 +575,11 @@ END if (@reports) { print "<td><select name='REPORT' size='5'>\n"; - my $n=0; foreach (@reports) { @reportdata=split(/#/); print "\t<option "; - if ($n eq '0') { print "selected "; $reportsettings{'REPORT'}=$reportdata[1]; $n++} + if ($reportsettings{'REPORT'} eq $reportdata[1]) { print "selected ";} print "value='$reportdata[1]'>$reportdata[2]  -  $reportdata[3]</option>\n"; } print "</select></td>\n"; diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi old mode 100644 new mode 100755 index 990fe66..2b0c4ba --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -36,10 +36,10 @@ require "${General::swroot}/header.pl"; require "${General::swroot}/countries.pl"; # enable only the following on debugging purpose -use warnings; -use CGI::Carp 'fatalsToBrowser'; +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; #workaround to suppress a warning when a variable is used only once -my @dummy = ( ${Header::colourgreen} ); +my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} ); undef (@dummy); my %color = (); @@ -50,6 +50,9 @@ my %mainsettings = (); ### ### Initialize variables ### +my %ccdconfhash=(); +my %ccdroutehash=(); +my %ccdroute2hash=(); my %netsettings=(); my %cgiparams=(); my %vpnsettings=(); @@ -61,6 +64,10 @@ my $warnmessage = ''; my $errormessage = ''; my %settings=(); my $routes_push_file = ''; +my $confighost="${General::swroot}/fwhosts/customhosts"; +my $configgrp="${General::swroot}/fwhosts/customgroups"; +my $customnet="${General::swroot}/fwhosts/customnetworks"; +my $name; &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); $cgiparams{'ENABLED'} = 'off'; $cgiparams{'ENABLED_BLUE'} = 'off'; @@ -77,8 +84,13 @@ $cgiparams{'DHCP_WINS'} = ''; $cgiparams{'ROUTES_PUSH'} = ''; $cgiparams{'DCOMPLZO'} = 'off'; $cgiparams{'MSSFIX'} = ''; +$cgiparams{'number'} = ''; +$cgiparams{'PMTU_DISCOVERY'} = ''; $routes_push_file = "${General::swroot}/ovpn/routes_push"; unless (-e $routes_push_file) { system("touch $routes_push_file"); } +unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); } +unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); } +unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); } &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'}); @@ -313,7 +325,6 @@ sub disallowreserved return; } - sub writeserverconf { my %sovpnsettings = (); my @temp = (); @@ -329,7 +340,6 @@ sub writeserverconf { print CONF "#DAN prepare OpenVPN for listening on blue and orange\n"; print CONF ";local $sovpnsettings{'VPN_IP'}\n"; print CONF "dev $sovpnsettings{'DDEVICE'}\n"; - print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; print CONF "proto $sovpnsettings{'DPROTOCOL'}\n"; print CONF "port $sovpnsettings{'DDEST_PORT'}\n"; print CONF "script-security 3 system\n"; @@ -342,18 +352,48 @@ sub writeserverconf { print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n"; my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'}); print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n"; - print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n"; - + #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n"; + + # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500. + # If we doesn't use one of them, we can use the configured mtu value. + if ($sovpnsettings{'MSSFIX'} eq 'on') + { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; } + elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') + { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; } + elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') || + ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') || + ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) + { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; } + else + { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; } + if ($vpnsettings{'ROUTES_PUSH'} ne '') { - @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'}); - foreach (@temp) - { - @tempovpnsubnet = split("\/",&General::ipcidr2msk($_)); - print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n"; + @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'}); + foreach (@temp) + { + @tempovpnsubnet = split("\/",&General::ipcidr2msk($_)); + print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n"; + } } - } +# a.marx ccd + my %ccdconfhash=(); + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + foreach my $key (keys %ccdconfhash) { + my $a=$ccdconfhash{$key}[1]; + my ($b,$c) = split (/\//, $a); + print CONF "route $b ".&General::cidrtosub($c)."\n"; + } + my %ccdroutehash=(); + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + foreach my $key (keys %ccdroutehash) { + foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){ + my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]); + print CONF "route $a $b\n"; + } + } +# ccd end - if ($sovpnsettings{CLIENT2CLIENT} eq 'on') { + if ($sovpnsettings{CLIENT2CLIENT} eq 'on') { print CONF "client-to-client\n"; } if ($sovpnsettings{MSSFIX} eq 'on') { @@ -362,6 +402,14 @@ sub writeserverconf { if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') { print CONF "fragment $sovpnsettings{'FRAGMENT'}\n"; } + + # Check if a valid operating mode has been choosen and use it. + if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') || + ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') || + ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) { + print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n"; + } + if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) { print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n"; } @@ -407,7 +455,7 @@ sub writeserverconf { close(CONF); } -# + sub emptyserverlog{ if (open(FILE, ">/var/log/ovpnserver.log")) { flock FILE, 2; @@ -417,6 +465,274 @@ sub emptyserverlog{ } +sub delccdnet +{ + my %ccdconfhash = (); + my %ccdhash = (); + my $ccdnetname=$_[0]; + if (-f "${General::swroot}/ovpn/ovpnconfig"){ + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash); + foreach my $key (keys %ccdhash) { + if ($ccdhash{$key}[32] eq $ccdnetname) { + $errormessage=$Lang::tr{'ccd err hostinnet'}; + return; + } + } + } + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + foreach my $key (keys %ccdconfhash) { + if ($ccdconfhash{$key}[0] eq $ccdnetname){ + delete $ccdconfhash{$key}; + } + } + &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + + &writeserverconf; + return 0; +} + +sub addccdnet +{ + my %ccdconfhash=(); + my @ccdconf=(); + my $ccdname=$_[0]; + my $ccdnet=$_[1]; + my $subcidr; + my @ip2=(); + my $checkup; + my $ccdip; + my $baseaddress; + + + #check name + if ($ccdname eq '') + { + $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>"; + return + } + + if(!&General::validhostname($ccdname)) + { + $errormessage=$Lang::tr{'ccd err invalidname'}; + return; + } + + ($ccdip,$subcidr) = split (/\//,$ccdnet); + $subcidr=&General::iporsubtocidr($subcidr); + #check subnet + if ($subcidr > 30) + { + $errormessage=$Lang::tr{'ccd err invalidnet'}; + return; + } + #check ip + if (!&General::validipandmask($ccdnet)){ + $errormessage=$Lang::tr{'ccd err invalidnet'}; + return; + } + + $errormessage=&General::checksubnets($ccdname,$ccdnet); + + + if (!$errormessage) { + my %ccdconfhash=(); + $baseaddress=&General::getnetworkip($ccdip,$subcidr); + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + my $key = &General::findhasharraykey (\%ccdconfhash); + foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";} + $ccdconfhash{$key}[0] = $ccdname; + $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr; + &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + &writeserverconf; + $cgiparams{'ccdname'}=''; + $cgiparams{'ccdsubnet'}=''; + return 1; + } +} + +sub modccdnet +{ + + my $newname=$_[0]; + my $oldname=$_[1]; + my %ccdconfhash=(); + my %ccdhash=(); + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + foreach my $key (keys %ccdconfhash) { + if ($ccdconfhash{$key}[0] eq $oldname) { + foreach my $key1 (keys %ccdconfhash) { + if ($ccdconfhash{$key1}[0] eq $newname){ + $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'}; + return; + }else{ + $ccdconfhash{$key}[0]= $newname; + &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + last; + } + } + } + } + + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash); + foreach my $key (keys %ccdhash) { + if ($ccdhash{$key}[32] eq $oldname) { + $ccdhash{$key}[32]=$newname; + &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash); + last; + } + } + + return 0; +} +sub ccdmaxclients +{ + my $ccdnetwork=$_[0]; + my @octets=(); + my @subnet=(); + @octets=split("\/",$ccdnetwork); + @subnet= split /\./, &General::cidrtosub($octets[1]); + my ($a,$b,$c,$d,$e); + $a=256-$subnet[0]; + $b=256-$subnet[1]; + $c=256-$subnet[2]; + $d=256-$subnet[3]; + $e=($a*$b*$c*$d)/4; + return $e-1; +} + +sub getccdadresses +{ + my $ipin=$_[0]; + my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin; + my $cidr=$_[1]; + chomp($cidr); + my $count=$_[2]; + my $hasip=$_[3]; + chomp($hasip); + my @iprange=(); + my %ccdhash=(); + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash); + $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2; + for (my $i=1;$i<=$count;$i++) { + my $tmpip=$iprange[$i-1]; + my $stepper=$i*4; + $iprange[$i]= &General::getnextip($tmpip,4); + } + my $r=0; + foreach my $key (keys %ccdhash) { + $r=0; + foreach my $tmp (@iprange){ + my ($net,$sub) = split (/\//,$ccdhash{$key}[33]); + if ($net eq $tmp) { + if ( $hasip ne $ccdhash{$key}[33] ){ + splice (@iprange,$r,1); + } + } + $r++; + } + } + return @iprange; +} + +sub fillselectbox +{ + my $boxname=$_[1]; + my ($ccdip,$subcidr) = split("/",$_[0]); + my $tz=$_[2]; + my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz); + print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >"; + foreach (@allccdips) { + my $ip=$_."/30"; + chomp($ip); + print "<option value='$ip' "; + if ( $ip eq $cgiparams{$boxname} ){ + print"selected"; + } + print ">$ip</option>"; + } + print "</select>"; +} + +sub hostsinnet +{ + my $name=$_[0]; + my %ccdhash=(); + my $i=0; + &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash); + foreach my $key (keys %ccdhash) { + if ($ccdhash{$key}[32] eq $name){ $i++;} + } + return $i; +} + +sub check_routes_push +{ + my $val=$_[0]; + my ($ip,$cidr) = split (/\//, $val); + ##check for existing routes in routes_push + if (-e "${General::swroot}/ovpn/routes_push") { + open(FILE,"${General::swroot}/ovpn/routes_push"); + while (<FILE>) { + $_=~s/\s*$//g; + + my ($ip2,$cidr2) = split (/\//,"$_"); + my $val2=$ip2."/".&General::iporsubtodec($cidr2); + + if($val eq $val2){ + return 0; + } + #subnetcheck + if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){ + return 0; + } + }; + close(FILE); + } + return 1; +} + +sub check_ccdroute +{ + my %ccdroutehash=(); + my $val=$_[0]; + my ($ip,$cidr) = split (/\//, $val); + #check for existing routes in ccdroute + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + foreach my $key (keys %ccdroutehash) { + foreach my $i (1 .. $#{$ccdroutehash{$key}}) { + if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){ + return 0; + } + my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]); + #subnetcheck + if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){ + return 0; + } + } + } + return 1; +} +sub check_ccdconf +{ + my %ccdconfhash=(); + my $val=$_[0]; + my ($ip,$cidr) = split (/\//, $val); + #check for existing routes in ccdroute + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + foreach my $key (keys %ccdconfhash) { + if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){ + return 0; + } + my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]); + #subnetcheck + if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){ + return 0; + } + + } + return 1; +} + ### # m.a.d net2net ### @@ -451,6 +767,7 @@ sub read_routepushfile while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ }; close(FILE); $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'}; + } } @@ -490,11 +807,11 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} || &emptyserverlog(); } # #restart openvpn server - if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){ +# if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){ #workarund, till SIGHUP also works when running as nobody - system('/usr/local/bin/openvpnctrl', '-r'); - &emptyserverlog(); - } +# system('/usr/local/bin/openvpnctrl', '-r'); +# &emptyserverlog(); +# } } ### @@ -516,6 +833,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'}; $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'}; $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'}; + $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'}; my @temp=(); if ($cgiparams{'FRAGMENT'} eq '') { @@ -533,6 +851,17 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { } else { $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'}; } + + if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') || + ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') || + ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) { + + if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) { + $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'}; + goto ADV_ERROR; + } + } + if ($cgiparams{'DHCP_DOMAIN'} ne ''){ unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) { $errormessage = $Lang::tr{'invalid input for dhcp domain'}; @@ -554,24 +883,47 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { if ($cgiparams{'ROUTES_PUSH'} ne ''){ @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'}); undef $vpnsettings{'ROUTES_PUSH'}; - foreach (@temp) + + foreach my $tmpip (@temp) { s/^\s+//g; s/\s+$//g; - if ($_) + + if ($tmpip) { - unless (&General::validipandmask($_)) { - $errormessage = $Lang::tr{'ovpn errmsg invalid ip or mask'}; - goto ADV_ERROR; + $tmpip=~s/\s*$//g; + unless (&General::validipandmask($tmpip)) { + $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'}; + goto ADV_ERROR; } - my ($ip, $cidr) = split("\/",&General::ipcidr2msk($_)); + my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip)); + if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) { $errormessage = $Lang::tr{'ovpn errmsg green already pushed'}; - goto ADV_ERROR; + goto ADV_ERROR; } - $vpnsettings{'ROUTES_PUSH'} .= $_."\n"; +# a.marx ccd + my %ccdroutehash=(); + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + foreach my $key (keys %ccdroutehash) { + foreach my $i (1 .. $#{$ccdroutehash{$key}}) { + if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){ + $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ; + goto ADV_ERROR; + } + my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]); + if (&General::IpInSubnet ($ip,$ip2,$cidr2)){ + $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ; + goto ADV_ERROR; + } + } + } + +# ccd end + + $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n"; } - } - &write_routepushfile; + } + &write_routepushfile; undef $vpnsettings{'ROUTES_PUSH'}; } else { @@ -656,6 +1008,17 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";} if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; }; } + + # Check if a valid operating mode has been choosen and use it. + if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') || + ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') || + ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) { + if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) { + if($cgiparams{'MTU'} eq '1500') { + print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n"; + } + } + } print SERVERCONF "# Auth. Server\n"; print SERVERCONF "tls-server\n"; print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n"; @@ -734,6 +1097,17 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";} if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; }; } + + # Check if a valid operating mode has been choosen and use it. + if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') || + ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') || + ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) { + if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) { + if ($cgiparams{'MTU'} eq '1500') { + print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n"; + } + } + } print CLIENTCONF "ns-cert-type server\n"; print CLIENTCONF "# Auth. Client\n"; @@ -1571,29 +1945,26 @@ END my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`; if ($confighash{$cgiparams{'KEY'}}) { + if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') { + $confighash{$cgiparams{'KEY'}}[0] = 'on'; + &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - - if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') { - $confighash{$cgiparams{'KEY'}}[0] = 'on'; - &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - - if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ + if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]); - } - - } else { + } + } else { - $confighash{$cgiparams{'KEY'}}[0] = 'off'; - &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); + $confighash{$cgiparams{'KEY'}}[0] = 'off'; + &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ + if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ if ($n2nactive ne ''){ - system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]); - } + system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]); + } - } else { + } else { $errormessage = $Lang::tr{'invalid key'}; - } + } } } @@ -1665,6 +2036,15 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";} if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} } + if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') || + ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') || + ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) { + if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) { + if ($tunmtu eq '1500' ) { + print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n"; + } + } + } print CLIENTCONF "ns-cert-type server\n"; print CLIENTCONF "# Auth. Client\n"; print CLIENTCONF "tls-client\n"; @@ -1718,12 +2098,26 @@ else my $zip = Archive::Zip->new(); - print CLIENTCONF "#OpenVPN Server conf\r\n"; + print CLIENTCONF "#OpenVPN Client conf\r\n"; print CLIENTCONF "tls-client\r\n"; print CLIENTCONF "client\r\n"; + print CLIENTCONF "nobind\n"; print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n"; print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n"; - print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; + + # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500 + # or use configured value. + if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) + { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; } + elsif ($vpnsettings{MSSFIX} eq 'on') + { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; } + elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') || + ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') || + ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) + { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; } + else + { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; } + if ( $vpnsettings{'ENABLED'} eq 'on'){ print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n"; if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){ @@ -1767,6 +2161,15 @@ else if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) { print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n"; } + + # Check if a valid operating mode has been choosen and use it. + if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') || + ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') || + ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) { + if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) { + print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\n"; + } + } close(CLIENTCONF); $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n"; @@ -1814,10 +2217,41 @@ else } unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem"); - unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); + unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); + +# A.Marx CCD delete ccd files and routes + + + if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]") + { + unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]"; + } + + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + foreach my $key (keys %ccdroutehash) { + if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){ + delete $ccdroutehash{$key}; + } + } + &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + + &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); + foreach my $key (keys %ccdroute2hash) { + if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){ + delete $ccdroute2hash{$key}; + } + } + &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); + &writeserverconf; + + +# CCD end + + delete $confighash{$cgiparams{'KEY'}}; my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); + #&writeserverconf(); } else { $errormessage = $Lang::tr{'invalid key'}; @@ -1884,9 +2318,11 @@ else %cgiparams = (); %cahash = (); %confighash = (); + my $disabled; &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams); read_routepushfile; - + + # if ($cgiparams{'CLIENT2CLIENT'} eq '') { # $cgiparams{'CLIENT2CLIENT'} = 'on'; # } @@ -1913,6 +2349,7 @@ ADV_ERROR: $checked{'MSSFIX'}{'off'} = ''; $checked{'MSSFIX'}{'on'} = ''; $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED'; + $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\''; $selected{'LOG_VERB'}{'1'} = ''; $selected{'LOG_VERB'}{'2'} = ''; $selected{'LOG_VERB'}{'3'} = ''; @@ -1926,9 +2363,7 @@ ADV_ERROR: $selected{'LOG_VERB'}{'11'} = ''; $selected{'LOG_VERB'}{'0'} = ''; $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED'; - - - + &Header::showhttpheaders(); &Header::openpage($Lang::tr{'status ovpn'}, 1, ''); &Header::openbigbox('100%', 'LEFT', '', $errormessage); @@ -1940,8 +2375,8 @@ ADV_ERROR: } &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'}); print <<END - <form method='post' enctype='multipart/form-data'> - <table width='100%'> + <form method='post' enctype='multipart/form-data' disabled> + <table width='100%' border=0> <tr> <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td> </tr> @@ -1950,7 +2385,7 @@ ADV_ERROR: </tr> <tr> <td class='base'>Domain</td> - <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td> + <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td> </tr> <tr> <td class='base'>DNS</td> @@ -1975,7 +2410,7 @@ if ($cgiparams{'ROUTES_PUSH'} ne '') print $cgiparams{'ROUTES_PUSH'}; } -print <<END +print <<END; </textarea></td> </tr> </tr> @@ -1986,7 +2421,7 @@ print <<END <td class'base'><b>$Lang::tr{'misc-options'}</b></td> </tr> <tr> - <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td> + <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td> </tr> <tr> <td class='base'>Client-To-Client</td> @@ -2015,7 +2450,15 @@ print <<END <td class='base'>mssfix</td> <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td> <td>Default: on</td> - </tr> + </tr> + + <tr> + <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td> + <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td> + <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td> + <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td> + <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td> + </tr> </table> <!-- @@ -2057,8 +2500,30 @@ print <<END <option value='10' $selected{'LOG_VERB'}{'10'}>10</option> <option value='11' $selected{'LOG_VERB'}{'11'}>11</option> <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td> -</table> -<hr size='1'> +</table><hr> +END + +if ( -e "/var/run/openvpn.pid"){ +print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br> + $Lang::tr{'server restart'}<br><br> + <hr>"; + print<<END +<table width='100%'> +<tr> + <td> </td> + <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td> + <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td> + <td> </td> +</tr> +</table> +</form> +END +; + + +}else{ + +print<<END <table width='100%'> <tr> <td> </td> @@ -2070,13 +2535,135 @@ print <<END </form> END ; - +} &Header::closebox(); # print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>"; &Header::closebigbox(); &Header::closepage(); exit(0); + +# A.Marx CCD Add,delete or edit CCD net + +} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} || + $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} || + $cgiparams{'ACTION'} eq "kill" || + $cgiparams{'ACTION'} eq "edit" || + $cgiparams{'ACTION'} eq 'editsave'){ + &Header::showhttpheaders(); + &Header::openpage($Lang::tr{'ccd net'}, 1, ''); + &Header::openbigbox('100%', 'LEFT', '', ''); + + if ($cgiparams{'ACTION'} eq "kill"){ + &delccdnet($cgiparams{'net'}); + } + + if ($cgiparams{'ACTION'} eq 'editsave'){ + my ($a,$b) =split (/\|/,$cgiparams{'ccdname'}); + if ( $a ne $b){ &modccdnet($a,$b);} + $cgiparams{'ccdname'}=''; + $cgiparams{'ccdsubnet'}=''; + } + + if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) { + &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'}); + } + if ($errormessage) { + &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'}); + print "<class name='base'>$errormessage"; + print " </class>"; + &Header::closebox(); + } +if ($cgiparams{'ACTION'} eq "edit"){ + + &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'}); + + print <<END + <table width='100%' border=0> + <tr><form method='post'> + <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td> + <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr> + <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/> + <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' /> + </td></tr> + </table></form> +END +; + &Header::closebox(); + + &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} ); + print <<END + <table width='100%' border='0' cellpadding='0' cellspacing='1'> + <tr> + <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr> +END +; +} +else{ + if (! -e "/var/run/openvpn.pid"){ + &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'}); + print <<END; + <table width='100%' border='0'> + <tr><form method='post'> + <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr> + <tr> + <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td> + <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr> + <tr><td colspan=4><hr /></td></tr><tr> + <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr> + </table></form> +END + + &Header::closebox(); +} + &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} ); + if ( -e "/var/run/openvpn.pid"){ + print "<b>$Lang::tr{'attention'}:</b><br>"; + print "$Lang::tr{'ccd noaddnet'}<br><hr>"; + } + + print <<END + <table width='100%' border='0' cellpadding='0' cellspacing='1'> + <tr> + <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr> +END +; +} + my %ccdconfhash=(); + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + my @ccdconf=(); + my $count=0; + foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) { + @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]); + $count++; + my $ccdhosts = &hostsinnet($ccdconf[0]); + if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";} + else{ print" <tr bgcolor='$color{'color20'}'>";} + print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>"; +print <<END + <form method='post' /> + <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} /> + <input type='hidden' name='ACTION' value='edit'/> + <input type='hidden' name='ccdname' value='$ccdconf[0]' /> + <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' /> + </form></td> + <form method='post' /> + <td><input type='hidden' name='ACTION' value='kill'/> + <input type='hidden' name='number' value='$count' /> + <input type='hidden' name='net' value='$ccdconf[0]' /> + <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr> +END +; + } + print "</table></form>"; + &Header::closebox(); + print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>"; + &Header::closebigbox(); + &Header::closepage(); + exit(0); + +#END CCD + ### ### Openvpn Connections Statistics ### @@ -2284,7 +2871,7 @@ if ( -s "${General::swroot}/ovpn/settings") { print <<END <b>$Lang::tr{'connection type'}:</b><br /> - <table><form method='post' ENCTYPE="multipart/form-data"> + <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data"> <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr> <tr><td><input type='radio' name='TYPE' value='net' /></td> @@ -2293,21 +2880,21 @@ if ( -s "${General::swroot}/ovpn/settings") { <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr> <tr><td> </td><td class='base'><input type='file' name='FH' size='30'></td></tr> <tr><td> </td><td>Import Connection Name <img src='/blob.gif' /></td></tr> - <tr><td> </td><td class='base'><input type='text' name='n2nname' size='30'><td class='base'>Default : Client Packagename</td></td></tr> + <tr><td> </td><td class='base'><input type='text' name='n2nname' size='30'>Default : Client Packagename</td></tr> <tr><td colspan='3'><hr /></td></tr> - <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr> - <tr><td> </td></tr> + <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr> <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' /> $Lang::tr{'this field may be blank'}</td></tr> </form></table> END ; + } else { print <<END <b>$Lang::tr{'connection type'}:</b><br /> - <table><form method='post' ENCTYPE="multipart/form-data"> + <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data"> <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr> - <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr> + <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr> </form></table> END ; @@ -2450,6 +3037,7 @@ END my $complzoactive; my $mssfixactive; my $n2nfragment; +my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);; my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]); my @n2nproto = split(/-/, $n2nproto2[1]); my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]); @@ -2484,6 +3072,7 @@ $n2nremsub[2] =~ s/\n|\r//g; $n2nlocalsub[2] =~ s/\n|\r//g; $n2nfragment[1] =~ s/\n|\r//g; $n2nmgmt[2] =~ s/\n|\r//g; +$n2nmtudisc[1] =~ s/\n|\r//g; chomp ($complzoactive); chomp ($mssfixactive); @@ -2537,26 +3126,28 @@ foreach my $dkey (keys %confighash) { $key = &General::findhasharraykey (\%confighash); - foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";} + foreach my $i (0 .. 39) { $confighash{$key}[$i] = "";} + $confighash{$key}[0] = 'off'; $confighash{$key}[1] = $n2nname[0]; - $confighash{$key}[2] = $n2nname[0]; + $confighash{$key}[2] = $n2nname[0]; $confighash{$key}[3] = 'net'; $confighash{$key}[4] = 'cert'; $confighash{$key}[6] = 'client'; $confighash{$key}[8] = $n2nlocalsub[2]; - $confighash{$key}[10] = $n2nremote[1]; - $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]"; + $confighash{$key}[10] = $n2nremote[1]; + $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]"; $confighash{$key}[22] = $n2nmgmt[2]; - $confighash{$key}[23] = $mssfixactive; + $confighash{$key}[23] = $mssfixactive; $confighash{$key}[24] = $n2nfragment[1]; - $confighash{$key}[25] = 'IPFire n2n Client'; + $confighash{$key}[25] = 'IPFire n2n Client'; $confighash{$key}[26] = 'red'; - $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0"; - $confighash{$key}[28] = $n2nproto[0]; - $confighash{$key}[29] = $n2nport[1]; - $confighash{$key}[30] = $complzoactive; - $confighash{$key}[31] = $n2ntunmtu[1]; + $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0"; + $confighash{$key}[28] = $n2nproto[0]; + $confighash{$key}[29] = $n2nport[1]; + $confighash{$key}[30] = $complzoactive; + $confighash{$key}[31] = $n2ntunmtu[1]; + $confighash{$key}[38] = $n2nmtudisc[1]; &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); @@ -2594,6 +3185,7 @@ foreach my $dkey (keys %confighash) { <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr> <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr> <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr> + <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td><td><b>$confighash{$key}[38]</b></td></tr> <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr> <tr><td> </td><td> </td></tr> </table> @@ -2655,45 +3247,216 @@ if ($confighash{$cgiparams{'KEY'}}) { } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) || ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) || ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) { - + &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash); &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) { - if (! $confighash{$cgiparams{'KEY'}}[0]) { - $errormessage = $Lang::tr{'invalid key'}; - goto VPNCONF_END; - } - $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0]; - $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1]; - $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3]; - $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4]; - $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5]; - $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6]; - $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8]; - $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10]; - $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11]; -# n2n m.a.d new fields - $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22]; - $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23]; - $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24]; - $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25]; - $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26]; -#new fields - $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27]; - $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28]; - $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29]; - $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30]; - $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31]; - -#new fields -#ab hiere error uebernehmen - - } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { + if (! $confighash{$cgiparams{'KEY'}}[0]) { + $errormessage = $Lang::tr{'invalid key'}; + goto VPNCONF_END; + } + $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0]; + $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1]; + $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3]; + $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4]; + $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5]; + $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6]; + $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8]; + $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10]; + $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11]; + $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22]; + $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23]; + $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24]; + $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25]; + $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26]; + $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27]; + $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28]; + $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29]; + $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30]; + $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31]; + $cgiparams{'CHECK1'} = $confighash{$cgiparams{'KEY'}}[32]; + $name=$cgiparams{'CHECK1'} ; + $cgiparams{$name} = $confighash{$cgiparams{'KEY'}}[33]; + $cgiparams{'RG'} = $confighash{$cgiparams{'KEY'}}[34]; + $cgiparams{'CCD_DNS1'} = $confighash{$cgiparams{'KEY'}}[35]; + $cgiparams{'CCD_DNS2'} = $confighash{$cgiparams{'KEY'}}[36]; + $cgiparams{'CCD_WINS'} = $confighash{$cgiparams{'KEY'}}[37]; + $cgiparams{'PMTU_DISCOVERY'} = $confighash{$cgiparams{'KEY'}}[38]; + } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'}); - if ($cgiparams{'TYPE'} !~ /^(host|net)$/) { +#A.Marx CCD check iroute field and convert it to decimal +if ($cgiparams{'TYPE'} eq 'host') { + my @temp=(); + my %ccdroutehash=(); + my $keypoint=0; + my $ip; + my $cidr; + if ($cgiparams{'IR'} ne ''){ + @temp = split("\n",$cgiparams{'IR'}); + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + #find key to use + foreach my $key (keys %ccdroutehash) { + if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) { + $keypoint=$key; + delete $ccdroutehash{$key}; + }else{ + $keypoint = &General::findhasharraykey (\%ccdroutehash); + } + } + $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'}; + my $i=1; + my $val=0; + foreach $val (@temp){ + chomp($val); + $val=~s/\s*$//g; + #check if iroute exists in ccdroute or if new iroute is part of an existing one + foreach my $key (keys %ccdroutehash) { + foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){ + if ($ccdroutehash{$key}[$oldiroute] eq "$val") { + $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'}; + goto VPNCONF_ERROR; + } + my ($ip1,$cidr1) = split (/\//, $val); + $ip1 = &General::getnetworkip($ip1,&General::iporsubtocidr($cidr1)); + my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]); + if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){ + $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'}; + goto VPNCONF_ERROR; + } + + } + } + if (!&General::validipandmask($val)){ + $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)"; + goto VPNCONF_ERROR; + }else{ + ($ip,$cidr) = split(/\//,$val); + $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr)); + $cidr=&General::iporsubtodec($cidr); + $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr; + + } + + #check for existing network IP's + if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0') + { + $errormessage=$Lang::tr{'ccd err green'}; + goto VPNCONF_ERROR; + }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0') + { + $errormessage=$Lang::tr{'ccd err red'}; + goto VPNCONF_ERROR; + }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '') + { + $errormessage=$Lang::tr{'ccd err blue'}; + goto VPNCONF_ERROR; + }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' ) + { + $errormessage=$Lang::tr{'ccd err orange'}; + goto VPNCONF_ERROR; + } + + if (&General::validipandmask($val)){ + $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr; + }else{ + $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)"; + goto VPNCONF_ERROR; + } + $i++; + } + &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + &writeserverconf; + }else{ + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + foreach my $key (keys %ccdroutehash) { + if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) { + delete $ccdroutehash{$key}; + &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + &writeserverconf; + } + } + } + undef @temp; + #check route field and convert it to decimal + my $val=0; + my $i=1; + &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); + #find key to use + foreach my $key (keys %ccdroute2hash) { + if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) { + $keypoint=$key; + delete $ccdroute2hash{$key}; + }else{ + $keypoint = &General::findhasharraykey (\%ccdroute2hash); + &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + &writeserverconf; + } + } + $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'}; + if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};} + @temp = split(/\|/,$cgiparams{'IFROUTE'}); + my %ownnet=(); + &General::readhash("${General::swroot}/ethernet/settings", \%ownnet); + foreach $val (@temp){ + chomp($val); + $val=~s/\s*$//g; + if ($val eq $Lang::tr{'green'}) + { + $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK}; + } + if ($val eq $Lang::tr{'blue'}) + { + $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK}; + } + if ($val eq $Lang::tr{'orange'}) + { + $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK}; + } + my ($ip,$cidr) = split (/\//, $val); + + if ($val ne $Lang::tr{'ccd none'}) + { + if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;} + if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;} + if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;} + if (&General::validipandmask($val)){ + $val=$ip."/".&General::iporsubtodec($cidr); + $ccdroute2hash{$keypoint}[$i] = $val; + }else{ + $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)"; + goto VPNCONF_ERROR; + } + }else{ + $ccdroute2hash{$keypoint}[$i]=''; + } + $i++; + } + &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); + + #check dns1 ip + if ($cgiparams{'CCD_DNS1'} ne '' && ! &General::validip($cgiparams{'CCD_DNS1'})) { + $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1"; + goto VPNCONF_ERROR; + } + #check dns2 ip + if ($cgiparams{'CCD_DNS2'} ne '' && ! &General::validip($cgiparams{'CCD_DNS2'})) { + $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2"; + goto VPNCONF_ERROR; + } + #check wins ip + if ($cgiparams{'CCD_WINS'} ne '' && ! &General::validip($cgiparams{'CCD_WINS'})) { + $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'}; + goto VPNCONF_ERROR; + } +} + +#CCD End + + + if ($cgiparams{'TYPE'} !~ /^(host|net)$/) { $errormessage = $Lang::tr{'connection type is invalid'}; if ($cgiparams{'TYPE'} eq 'net') { unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; @@ -2771,6 +3534,22 @@ if ($cgiparams{'TYPE'} eq 'net') { goto VPNCONF_ERROR; } + if ($cgiparams{'PMTU_DISCOVERY'} ne 'off') { + if (($cgiparams{'FRAGMENT'} ne '') || ($cgiparams{'MSSFIX'} eq 'on')) { + $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'}; + unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; + rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!"; + goto VPNCONF_ERROR; + } + } + + if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') && ($cgiparams{'MTU'} ne '1500')) { + $errormessage = $Lang::tr{'ovpn mtu-disc and mtu not 1500'}; + unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; + rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!"; + goto VPNCONF_ERROR; + } + if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) { $errormessage = $Lang::tr{'openvpn prefix local subnet'}; unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; @@ -3143,45 +3922,124 @@ if ($cgiparams{'TYPE'} eq 'net') { # Save the config my $key = $cgiparams{'KEY'}; + if (! $key) { $key = &General::findhasharraykey (\%confighash); - foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";} + foreach my $i (0 .. 38) { $confighash{$key}[$i] = "";} } - $confighash{$key}[0] = $cgiparams{'ENABLED'}; - $confighash{$key}[1] = $cgiparams{'NAME'}; + $confighash{$key}[0] = $cgiparams{'ENABLED'}; + $confighash{$key}[1] = $cgiparams{'NAME'}; if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') { - $confighash{$key}[2] = $cgiparams{'CERT_NAME'}; + $confighash{$key}[2] = $cgiparams{'CERT_NAME'}; } - $confighash{$key}[3] = $cgiparams{'TYPE'}; + + $confighash{$key}[3] = $cgiparams{'TYPE'}; if ($cgiparams{'AUTH'} eq 'psk') { - $confighash{$key}[4] = 'psk'; - $confighash{$key}[5] = $cgiparams{'PSK'}; + $confighash{$key}[4] = 'psk'; + $confighash{$key}[5] = $cgiparams{'PSK'}; } else { - $confighash{$key}[4] = 'cert'; + $confighash{$key}[4] = 'cert'; } if ($cgiparams{'TYPE'} eq 'net') { - $confighash{$key}[6] = $cgiparams{'SIDE'}; - $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'}; + $confighash{$key}[6] = $cgiparams{'SIDE'}; + $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'}; } - $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'}; - $confighash{$key}[10] = $cgiparams{'REMOTE'}; + $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'}; + $confighash{$key}[10] = $cgiparams{'REMOTE'}; if ($cgiparams{'OVPN_MGMT'} eq '') { - $confighash{$key}[22] = $confighash{$key}[29]; + $confighash{$key}[22] = $confighash{$key}[29]; } else { - $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'}; + $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'}; } - $confighash{$key}[23] = $cgiparams{'MSSFIX'}; - $confighash{$key}[24] = $cgiparams{'FRAGMENT'}; - $confighash{$key}[25] = $cgiparams{'REMARK'}; - $confighash{$key}[26] = $cgiparams{'INTERFACE'}; + $confighash{$key}[23] = $cgiparams{'MSSFIX'}; + $confighash{$key}[24] = $cgiparams{'FRAGMENT'}; + $confighash{$key}[25] = $cgiparams{'REMARK'}; + $confighash{$key}[26] = $cgiparams{'INTERFACE'}; # new fields - $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'}; - $confighash{$key}[28] = $cgiparams{'PROTOCOL'}; - $confighash{$key}[29] = $cgiparams{'DEST_PORT'}; - $confighash{$key}[30] = $cgiparams{'COMPLZO'}; - $confighash{$key}[31] = $cgiparams{'MTU'}; -# new fileds + $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'}; + $confighash{$key}[28] = $cgiparams{'PROTOCOL'}; + $confighash{$key}[29] = $cgiparams{'DEST_PORT'}; + $confighash{$key}[30] = $cgiparams{'COMPLZO'}; + $confighash{$key}[31] = $cgiparams{'MTU'}; + $confighash{$key}[32] = $cgiparams{'CHECK1'}; + $name=$cgiparams{'CHECK1'}; + $confighash{$key}[33] = $cgiparams{$name}; + $confighash{$key}[34] = $cgiparams{'RG'}; + $confighash{$key}[35] = $cgiparams{'CCD_DNS1'}; + $confighash{$key}[36] = $cgiparams{'CCD_DNS2'}; + $confighash{$key}[37] = $cgiparams{'CCD_WINS'}; + $confighash{$key}[38] = $cgiparams{'PMTU_DISCOVERY'}; + + &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); + + if ($cgiparams{'CHECK1'} ){ + + my ($ccdip,$ccdsub)=split "/",$cgiparams{$name}; + my ($a,$b,$c,$d) = split (/\./,$ccdip); + if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){ + unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}"; + } + open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!"; + print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n"; + if($cgiparams{'CHECK1'} eq 'dynamic'){ + print CCDRWCONF "#This client uses the dynamic pool\n"; + }else{ + print CCDRWCONF "#Ip address client and server\n"; + print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n"; + } + if ($confighash{$key}[34] eq 'on'){ + print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n"; + print CCDRWCONF "push redirect-gateway\n"; + } + &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + if ($cgiparams{'IR'} ne ''){ + print CCDRWCONF "\n#Client routes these networks (behind Client)\n"; + foreach my $key (keys %ccdroutehash){ + if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){ + foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){ + my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]); + print CCDRWCONF "iroute $a $b\n"; + } + } + } + } + if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';} + if ($cgiparams{'IFROUTE'} ne ''){ + print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n"; + foreach my $key (keys %ccdroute2hash){ + if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){ + foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){ + if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){ + my %blue=(); + &General::readhash("${General::swroot}/ethernet/settings", \%blue); + print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n"; + }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){ + my %orange=(); + &General::readhash("${General::swroot}/ethernet/settings", \%orange); + print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS} $orange{ORANGE_NETMASK}\n"; + }else{ + my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]); + print CCDRWCONF "push \"route $a $b\"\n"; + } + } + } + } + } + if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';} + if($cgiparams{'CCD_DNS1'} ne ''){ + print CCDRWCONF "\n#Client gets these nameservers\n"; + print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n"; + } + if($cgiparams{'CCD_DNS2'} ne ''){ + print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n"; + } + if($cgiparams{'CCD_WINS'} ne ''){ + print CCDRWCONF "\n#Client gets this WINS server\n"; + print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n"; + } + close CCDRWCONF; + } ### # m.a.d n2n begin @@ -3221,6 +4079,7 @@ if ($cgiparams{'TYPE'} eq 'net') { ### $cgiparams{'MSSFIX'} = 'on'; $cgiparams{'FRAGMENT'} = '1300'; + $cgiparams{'PMTU_DISCOVERY'} = 'off'; ### # m.a.d n2n end ### @@ -3280,6 +4139,8 @@ if ($cgiparams{'TYPE'} eq 'net') { $checked{'MSSFIX'}{'on'} = ''; $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED'; + $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\''; + if (1) { &Header::showhttpheaders(); @@ -3308,12 +4169,17 @@ if ($cgiparams{'TYPE'} eq 'net') { } &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:"); - print "<table width='100%'>\n"; - print "<tr><td width='25%' class='boldbase'>$Lang::tr{'name'}:</td>"; + print "<table width='100%' border='0'>\n"; + + + + print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}: </td>"; + if ($cgiparams{'TYPE'} eq 'host') { if ($cgiparams{'KEY'}) { - print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>\n"; + print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>"; } else { + print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>"; } # print "<tr><td>$Lang::tr{'interface'}</td>"; @@ -3333,6 +4199,9 @@ if ($cgiparams{'TYPE'} eq 'net') { } else { print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>"; } + + + print <<END <td width='25%'> </td> <td width='25%'> </td></tr> @@ -3373,47 +4242,73 @@ if ($cgiparams{'TYPE'} eq 'net') { <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td> <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td> + <tr> + <td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td> + <td colspan='3'> + <input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'} + <input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'} + <input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'} + <input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'} + </td> + </tr> + END - ; +; } - +#jumper print "<tr><td class='boldbase'>$Lang::tr{'remark title'} <img src='/blob.gif' /></td>"; - print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr>"; + print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>"; if ($cgiparams{'TYPE'} eq 'host') { + print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>"; + } - print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>\n"; - } - -# if ($cgiparams{'KEY'}) { -# print "<td colspan='3'> </td></tr></table>"; -# } else { -# print "<td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</tr></table>"; -# } -# }else{ - print "<td colspan='3'> </td></tr></table>"; -# } - - - + print"</tr></table><br><br>"; +#A.Marx CCD new client +if ($cgiparams{'TYPE'} eq 'host') { + print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>"; + my %vpnnet=(); + my $vpnip; + &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet); + $vpnip=$vpnnet{'DOVPN_SUBNET'}; + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); + my @ccdconf=(); + my $count=0; + my $checked; + $checked{'check1'}{'off'} = ''; + $checked{'check1'}{'on'} = ''; + $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED'; + print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>"; + print"</td></tr></table><br><br>"; + my $name=$cgiparams{'CHECK1'}; + $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED'; + + if (! -z "${General::swroot}/ovpn/ccd.conf"){ + print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>"; + foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) { + $count++; + @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]); + if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";} + print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>"; + &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name}); + print"</td></tr>"; + } + print "</table><br><br><hr><br><br>"; + } +} +# ccd end &Header::closebox(); - if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') { - # &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'}); - # print <<END - # <table width='100%' cellpadding='0' cellspacing='5' border='0'> - # <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td> - # <td class='base' width='50%'><input type='text' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr> - # </table> -END - # ; - # &Header::closebox(); - } elsif (! $cgiparams{'KEY'}) { + + } elsif (! $cgiparams{'KEY'}) { + + my $disabled=''; my $cakeydisabled=''; my $cacrtdisabled=''; if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" }; if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" }; + &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'}); @@ -3510,8 +4405,127 @@ END ### ; &Header::closebox(); + } +#A.Marx CCD new client +if ($cgiparams{'TYPE'} eq 'host') { + print"<br><br>"; + &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:"); + + + print <<END; + <table border='0' width='100%'> + <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr> + <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr> + <tr><td colspan='4'>&nbsp</td></tr> + <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'> +END + + if ($cgiparams{'IR'} ne ''){ + print $cgiparams{'IR'}; + }else{ + &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); + foreach my $key (keys %ccdroutehash) { + if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){ + foreach my $i (1 .. $#{$ccdroutehash{$key}}) { + if ($ccdroutehash{$key}[$i] ne ''){ + print $ccdroutehash{$key}[$i]."\n"; + } + $cgiparams{'IR'} .= $ccdroutehash{$key}[$i]; + } + } + } + } + + print <<END; +</textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr> + <tr><td colspan='4'><br></td></tr> + <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple> +END + + my $set=0; + my $selorange=0; + my $selblue=0; + my $selgreen=0; + my $helpblue=0; + my $helporange=0; + my $other=0; + my $none=0; + my @temp=(); + + our @current = (); + open(FILE, "${General::swroot}/main/routing") ; + @current = <FILE>; + close (FILE); + &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash); + #check for "none" + foreach my $key (keys %ccdroute2hash) { + if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){ + if ($ccdroute2hash{$key}[1] eq ''){ + $none=1; + last; + } + } + } + if ($none ne '1'){ + print"<option>$Lang::tr{'ccd none'}</option>"; + }else{ + print"<option selected>$Lang::tr{'ccd none'}</option>"; + } + #check if static routes are defined for client + foreach my $line (@current) { + chomp($line); + $line=~s/\s*$//g; # remove newline + @temp=split(/\,/,$line); + $temp[1] = '' unless defined $temp[1]; # not always populated + my ($a,$b) = split(/\//,$temp[1]); + $temp[1] = $a."/".&General::iporsubtocidr($b); + foreach my $key (keys %ccdroute2hash) { + if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){ + foreach my $i (1 .. $#{$ccdroute2hash{$key}}) { + if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){ + $set=1; + } + } + } + } + if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";} + } + #check if green,blue,orange are defined for client + foreach my $key (keys %ccdroute2hash) { + if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){ + $other=1; + foreach my $i (1 .. $#{$ccdroute2hash{$key}}) { + if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){ + $selgreen=1; + } + if (&haveBlueNet()){ + if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) { + $selblue=1; + } + } + if (&haveOrangeNet()){ + if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) { + $selorange=1; + } + } + } + } + } + if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";} + if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";} + if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";}; + + print<<END + </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr> + <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr> + <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr> + +END +; + &Header::closebox(); +} print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />"; if ($cgiparams{'KEY'}) { # print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />"; @@ -3538,24 +4552,21 @@ END my @status = `/bin/cat /var/log/ovpnserver.log`; if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") { - if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) { - my $ipaddr = <IPADDR>; - close IPADDR; - chomp ($ipaddr); - $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0]; - if ($cgiparams{'VPN_IP'} eq '') { - $cgiparams{'VPN_IP'} = $ipaddr; - } - } + if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) { + my $ipaddr = <IPADDR>; + close IPADDR; + chomp ($ipaddr); + $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0]; + if ($cgiparams{'VPN_IP'} eq '') { + $cgiparams{'VPN_IP'} = $ipaddr; + } + } } #default setzen if ($cgiparams{'DCIPHER'} eq '') { $cgiparams{'DCIPHER'} = 'BF-CBC'; } -# if ($cgiparams{'DCOMPLZO'} eq '') { -# $cgiparams{'DCOMPLZO'} = 'on'; -# } if ($cgiparams{'DDEST_PORT'} eq '') { $cgiparams{'DDEST_PORT'} = '1194'; } @@ -3565,8 +4576,7 @@ END if ($cgiparams{'DOVPN_SUBNET'} eq '') { $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0'; } - - $checked{'ENABLED'}{'off'} = ''; + $checked{'ENABLED'}{'off'} = ''; $checked{'ENABLED'}{'on'} = ''; $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED'; $checked{'ENABLED_BLUE'}{'off'} = ''; @@ -3626,8 +4636,8 @@ END $activeonrun = "disabled='disabled'"; } &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'}); - print <<END - <table width='100%'> + print <<END + <table width='100%' border=0> <form method='post'> <td width='25%'> </td> <td width='25%'> </td> @@ -3635,7 +4645,7 @@ END <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td> <td align='left'>$sactive</td> <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td> - <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td> + <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td> END ; if (&haveBlueNet()) { @@ -3674,18 +4684,20 @@ END <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option> <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option> <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option> - <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td> + <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td></tr> + <tr><td colspan='4'><hr /></td></tr> END ; if ( $srunning eq "yes" ) { - print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' /></td>"; - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' disabled='disabled'/></td>"; - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td>"; - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>"; + print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />"; + print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />"; + print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />"; + print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>"; } else{ - print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>"; - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' /></td>"; + print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />"; + print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />"; + print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />"; if (( -e "${General::swroot}/ovpn/ca/cacert.pem" && -e "${General::swroot}/ovpn/ca/dh1024.pem" && -e "${General::swroot}/ovpn/certs/servercert.pem" && @@ -3693,11 +4705,9 @@ END (( $cgiparams{'ENABLED'} eq 'on') || ( $cgiparams{'ENABLED_BLUE'} eq 'on') || ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){ - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td>"; - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>"; + print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>"; } else { - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td>"; - print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' disabled='disabled' /></td></tr>"; + print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>"; } } print "</form></table>"; @@ -3829,18 +4839,19 @@ END </tr> </table> END - ; +; } - print <<END - <form method='post' enctype='multipart/form-data'> - <table width='100%' border='0' cellspacing='1' cellpadding='0'> - <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td> - <td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' /> - <td nowrap='nowrap'><input type='file' name='FH' size='30' /></td> - <td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /><br /><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td> - </tr></table></form> + +print <<END +<form method='post' enctype='multipart/form-data'> +<table width='100%' border='0'> +<tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td><td nowrap='nowrap' width='8%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'/></td><td nowrap='nowrap' align='right'><input type='file' name='FH' size='25' /><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td></tr> +<tr><td colspan='4'><hr /></td></tr> +<tr align='right'><td colspan='4' align='right' width='80%'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td></tr> +</table> END - ; +; + &Header::closebox(); if ( $srunning eq "yes" ) { @@ -3863,8 +4874,7 @@ END <tr> <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td> <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td> - <td width='18%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></td> - <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'valid till'}</b></td> + <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'network'}</b></td> <td width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td> <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td> <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td> @@ -3883,15 +4893,17 @@ END } print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>"; print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>"; - if ($confighash{$key}[4] eq 'cert') { - print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>"; - } else { - print "<td align='left'> </td>"; - } + #if ($confighash{$key}[4] eq 'cert') { + #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>"; + #} else { + #print "<td align='left'> </td>"; + #} my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`; $cavalid =~ /Not After : (.*)[\n]/; $cavalid = $1; - print "<td align='center'>$cavalid</td>"; + if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]="net-2-net";} + if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'host' ){$confighash{$key}[32]="dynamic";} + print "<td align='center'>$confighash{$key}[32]</td>"; print "<td align='center'>$confighash{$key}[25]</td>"; my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>"; @@ -4029,7 +5041,7 @@ END # If the config file contains entries, print Key to action icons if ( $id ) { print <<END - <table> + <table border='0'> <tr> <td class='boldbase'>  <b>$Lang::tr{'legend'}:</b></td> <td>  <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td> @@ -4050,7 +5062,7 @@ END <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td> <td class='base'>$Lang::tr{'dl client arch'}</td> </tr> - </table> + </table><hr> END ; } @@ -4058,8 +5070,8 @@ END print <<END <table width='100%'> <form method='post'> - <tr><td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td> - <td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr> + <tr><td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /> + <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr> </form> </table> END diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi old mode 100644 new mode 100755 index eaf6f48..e9d114b --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -1367,6 +1367,14 @@ END goto VPNCONF_ERROR; } + + if ($cgiparams{'TYPE'} eq 'net'){ + $errormessage=&General::checksubnets($cgiparams{'NAME'},$cgiparams{'REMOTE_SUBNET'}); + if ($errormessage ne ''){ + goto VPNCONF_ERROR; + } + + } if ($cgiparams{'AUTH'} eq 'psk') { if (! length($cgiparams{'PSK'}) ) { $errormessage = $Lang::tr{'pre-shared key is too short'}; diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index f686c30..05e1d85 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -351,6 +351,7 @@ 'arp table entries' => 'Einträge der ARP-Tabelle:', 'artist' => 'Künstler', 'attemps' => 'Versuche', +'attention' => 'ACHTUNG', 'august' => 'August', 'authentication' => 'Authentifizierung:', 'automatic' => 'Automatisch', @@ -455,6 +456,44 @@ 'capsopen' => 'VERBUNDEN', 'capswarning' => 'WARNUNG', 'caption' => 'Legende', +'ccd add' => 'Netzwerk hinzufügen', +'ccd choose net' => 'Netzwerk auswählen', +'ccd client options' => 'Erweiterte Client-Optionen', +'ccd clientip' => 'Hostadresse', +'ccd dynrange' => 'Dynamischer OpenVPN IP-Addressen-Pool', +'ccd err blue' => 'Das ist das BLAUE Subnetz.', +'ccd err green' => 'Das ist das GRÜNE Subnetz.', +'ccd err hostinnet' => 'Das Netzwerk kann nicht gelöscht werden, da sich in ihm noch Clients befinden.', +'ccd err inuse' => 'Wird bereits von einem anderen Client genutzt.', +'ccd err invalidname' => 'Ungültiger Name. Erlaubte Zeichen: A-Z, a-z, Bindestrich und Leerzeichen.', +'ccd err invalidnet' => 'Ungültige IP-Addresse. Format: 192.168.0.0/24 oder 192.168.0.0/255.255.255.0.', +'ccd err iroute' => 'Netzadresse für Route ungültig.', +'ccd err irouteexist' => 'Diese Route wird bereits verwendet.', +'ccd err isipsecnet' => 'Diese Subnetzadresse wird bereits für ein IPsec-Netzwerk verwendet.', +'ccd err isovpnnet' => 'Subnetzadresse wird für bereits für den OpenVPN-Server verwendet!', +'ccd err issubnet' => 'Subnetzadresse wird bereits verwendet.', +'ccd err name' => 'Es muss ein Name angegeben werden.', +'ccd err nameexist' => 'Name existiert bereits.', +'ccd err netadr' => 'Subnetzadresse ist ungültig oder Bereich zu groß.', +'ccd err netadrexist' => 'Netwerk existiert bereits.', +'ccd err orange' => 'Das ist das ORANGE Subnetz.', +'ccd err red' => 'Das ist das ROTE Subnetz.', +'ccd err routeovpn' => 'Wird vom OpenVPN-Server genutzt.', +'ccd err routeovpn2' => 'Wird bereits vom OpenVPN-Server verteilt.', +'ccd hint' => 'Auf dieser Seite können statische Netzwerke definiert werden, von denen Roadwarrior-Clients feste Adressen zugewiesen bekommen können.', +'ccd invalid' => 'ist ungültig.', +'ccd iroute' => 'IPFire hat Zugriff auf diese Netzwerke auf Clientseite: ', +'ccd iroute2' => 'Client hat Zugriff auf diese Netzwerke auf IPFire-Seite: ', +'ccd iroutehint' => 'Achtung! Wenn Sie diese Einstellungen ändern, muss der OpenVPN Server neu gestartet werden!', +'ccd maxclients' => 'Mögliche Adressen', +'ccd modify' => 'Netzwerk ändern', +'ccd name' => 'Name', +'ccd net' => 'Statische IP-Adressen-Pools', +'ccd noaddnet' => 'Neue statische Netze können erst erstellt werden, wenn der openVPN Server gestoppt wurde.', +'ccd none' => 'Keine', +'ccd routes' => 'Routen:', +'ccd subnet' => 'Subnetz', +'ccd used' => 'Genutzte Adressen', 'cert' => 'Zertifikat', 'certificate' => 'Zertifikat', 'certificate authorities' => 'Zertifizierungsstellen (CAs)', @@ -1350,6 +1389,13 @@ 'ovpn errmsg green already pushed' => 'Route für grünes Netzwerk wird immer gesetzt', 'ovpn errmsg invalid ip or mask' => 'Ungültige Netzwerk-Adresse oder Subnetzmaske', 'ovpn log' => 'OVPN-Log', +'ovpn mtu-disc' => 'Path MTU Discovery', +'ovpn mtu-disc and mtu not 1500' => 'Path MTU Discovery benötigt eine MTU von 1500.', +'ovpn mtu-disc maybe' => 'Optional', +'ovpn mtu-disc no' => 'Niemals', +'ovpn mtu-disc off' => 'Deaktiviert', +'ovpn mtu-disc with mssfix or fragment' => 'Path MTU Discovery kann nicht gemeinsam mit mssfix oder fragment verwendet werden.', +'ovpn mtu-disc yes' => 'Forciert', 'ovpn on blue' => 'OpenVPN auf BLAU', 'ovpn on orange' => 'OpenVPN auf ORANGE', 'ovpn on red' => 'OpenVPN auf ROT', @@ -1468,6 +1514,11 @@ 'proxy no proxy local' => 'Lokalen Proxy auf blauen/grünen Netzwerken verhindern', 'proxy port' => 'Proxy-Port', 'proxy reconfigure' => 'Speichern und Laden', +'proxy reports' => 'Proxyberichte', +'proxy reports daily' => 'Tägliche Berichte', +'proxy reports monthly' => 'Monatliche Berichte', +'proxy reports today' => 'Heute', +'proxy reports weekly' => 'Wöchentliche Berichte', 'psk' => 'PSK', 'pulse' => 'Puls', 'pulse dial' => 'Pulswahl:', @@ -1568,6 +1619,7 @@ 'september' => 'September', 'serial' => 'serielle', 'server reserved' => 'The connection name server is reserved and not allowed', +'server restart' => 'Änderungen können nicht gespeichert werden, solange der OpenVPN-Server läuft.', 'server string' => 'Server String', 'service' => 'Dienst', 'service added' => 'Benutzerdefinierter Netzwerkdienst wurde hinzugefügt', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 5fe2391..f0fa2c2 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -353,6 +353,7 @@ 'arp table entries' => 'ARP Table Entries:', 'artist' => 'Artist', 'attemps' => 'Attempts', +'attention' => 'ATTENTION', 'august' => 'August', 'authentication' => 'Authentication:', 'automatic' => 'Automatic', @@ -474,6 +475,43 @@ 'capsopen' => 'CONNECTED', 'capswarning' => 'WARNING', 'caption' => 'Caption', +'ccd add' => 'Add network', +'ccd choose net' => 'Choose network', +'ccd client options' => 'Advanced client options', +'ccd clientip' => 'Host address', +'ccd dynrange' => 'Dynamic OpenVPN IP address pool', +'ccd err blue' => 'This is the BLUE subnet.', +'ccd err green' => 'This is the GREEN subnet.', +'ccd err hostinnet' => 'You are not able to delete this network, while it still contains clients.', +'ccd err inuse' => 'Already used by another client.', +'ccd err invalidname' => 'Invalid name. Allowed characters are A-Z, a-z, dash and space.', +'ccd err invalidnet' => 'Invalid IP address. Format: 192.168.0.0/24 or 192.168.0.0/255.255.255.0.', +'ccd err iroute' => 'Network address for route is invalid.', +'ccd err irouteexist' => 'This route is already in use.', +'ccd err isipsecnet' => 'The given subnet address already used by an IPsec network.', +'ccd err isovpnnet' => 'Subnet address already in use for OpenVPN Server.', +'ccd err issubnet' => 'Subnet address already in use.', +'ccd err name' => 'Please choose a name.', +'ccd err nameexist' => 'Name already exists.', +'ccd err netadr' => 'Subnet address is invalid or range is too large.', +'ccd err netadrexist' => 'Network already exists.', +'ccd err orange' => 'This is the ORANGE subnet.', +'ccd err red' => 'This is the RED subnet.', +'ccd err routeovpn' => 'Already used by OpenVPN server.', +'ccd err routeovpn2' => 'Already pushed from OpenVPN server.', +'ccd hint' => 'On this page you are able to define static networks from which the roadwarrior clients can get fixed IP address assignments.', +'ccd invalid' => 'Invalid.', +'ccd iroute' => 'IPFire has access to these networks on the client\'s site', +'ccd iroute2' => 'Client has access to these networks on IPFire\'s site', +'ccd iroutehint' => 'Attention! If you change these settings, you have to restart the OpenVPN server that the changes take effect!', +'ccd modify' => 'Change network', +'ccd name' => 'Name', +'ccd net' => 'Static IP address pools', +'ccd noaddnet' => 'You can only add new static networks when OpenVPN server is stopped.', +'ccd none' => 'None', +'ccd routes' => 'Routing:', +'ccd subnet' => 'Subnet', +'ccd used' => 'Used addresses', 'cert' => 'Certificate', 'certificate' => 'Certificate', 'certificate authorities' => 'Certificate Authorities', @@ -895,7 +933,7 @@ 'gpl unofficial translation of the general public license v3' => 'Unofficial translation of the General Public License v3', 'graph' => 'Graph', 'graph per' => 'per', -'green' => 'Green', +'green' => 'GREEN', 'green interface' => 'Green Interface', 'guaranteed bandwith' => 'Guaranteed bandwith', 'guardian alertfile' => 'Alertfile', @@ -1378,6 +1416,13 @@ 'ovpn errmsg green already pushed' => 'Route for green network is always set', 'ovpn errmsg invalid ip or mask' => 'Invalid network-address or subnetmask', 'ovpn log' => 'OVPN-Log', +'ovpn mtu-disc' => 'Path MTU Discovery', +'ovpn mtu-disc and mtu not 1500' => 'Path MTU Discovery requires a MTU of 1500.', +'ovpn mtu-disc maybe' => 'Optionally', +'ovpn mtu-disc no' => 'Never', +'ovpn mtu-disc off' => 'Disabled', +'ovpn mtu-disc with mssfix or fragment' => 'Path MTU Discovery cannot be used with mssfix or fragment.', +'ovpn mtu-disc yes' => 'Forced', 'ovpn on blue' => 'OpenVPN on BLUE', 'ovpn on orange' => 'OpenVPN on ORANGE', 'ovpn on red' => 'OpenVPN on RED', @@ -1496,6 +1541,11 @@ 'proxy no proxy local' => 'Disallow local proxying on BLUE/GREEN networks', 'proxy port' => 'Proxy Port', 'proxy reconfigure' => 'Save and Reload', +'proxy reports' => 'Proxy Reports', +'proxy reports daily' => 'Daily reports', +'proxy reports monthly' => 'Monthly reports', +'proxy reports today' => 'Today', +'proxy reports weekly' => 'Weekly reports', 'psk' => 'PSK', 'pulse' => 'Pulse', 'pulse dial' => 'Pulse dial:', @@ -1598,6 +1648,7 @@ 'september' => 'September', 'serial' => 'Serial', 'server reserved' => 'The connection name server is reserved and not allowed', +'server restart' => 'You are not able to save any changes while the OpenVPN server is running.', 'server string' => 'Server String', 'service' => 'Service', 'service added' => 'Custom network service added', diff --git a/lfs/GeoIP b/lfs/GeoIP index 68254a7..7e1dc9a 100644 --- a/lfs/GeoIP +++ b/lfs/GeoIP @@ -25,7 +25,7 @@ include Config VER = 1.17 -DATVER = 06112012 +DATVER = 05122012 THISAPP = Geo-IP-PurePerl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ $(DL_FILE) = $(DL_FROM)/$(DL_FILE) GeoIP.dat-$(DATVER).gz = $(DL_FROM)/GeoIP.dat-$(DATVER).gz $(DL_FILE)_MD5 = 42a6b9d4dd2563a20c8998556216e1de -GeoIP.dat-$(DATVER).gz_MD5 = a8677695b0abecb69707ebe2444e64f9 +GeoIP.dat-$(DATVER).gz_MD5 = ab0f52a35128d1aced906ac4cbfbed9c install : $(TARGET) diff --git a/lfs/libstatgrab b/lfs/libstatgrab new file mode 100644 index 0000000..8bcb133 --- /dev/null +++ b/lfs/libstatgrab @@ -0,0 +1,69 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 0.17 + +THISAPP = libstatgrab-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = libstatgrab +PAK_VER = 1 + +DEPS = "" + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 58385c9392898be3b09ffc5e3ebe8717 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./configure --prefix=/usr + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) \ No newline at end of file diff --git a/lfs/linux b/lfs/linux index d6c9555..547ae9b 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,9 +24,9 @@ include Config -VER = 3.2.34 +VER = 3.2.35 -RPI_PATCHES = linux-3.2.27-9245b4c +RPI_PATCHES = linux-3.2.27-ada8b44 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.bz2 @@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) CFLAGS = CXXFLAGS = -PAK_VER = 24 +PAK_VER = 25 DEPS = "" VERSUFIX=ipfire$(KCFG) @@ -71,8 +71,8 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) rpi-patches-$(RPI_PATCHES).patch.xz = $(URL_IPFIRE)/rpi-patches-$(RPI_PATCHES).patch.xz -$(DL_FILE)_MD5 = a16ecee73774d4f73388870fb593d811 -rpi-patches-$(RPI_PATCHES).patch.xz_MD5 = c20baa8dc2527ce89a302862c3fc7f58 +$(DL_FILE)_MD5 = 4566af86b5ae8f9dfce2442ccac79cc3 +rpi-patches-$(RPI_PATCHES).patch.xz_MD5 = 966687ff27e450e04ff50e0da829dc00 install : $(TARGET) diff --git a/lfs/mediatomb b/lfs/mediatomb index 2bfde66..7de579e 100644 --- a/lfs/mediatomb +++ b/lfs/mediatomb @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007 Michael Tremer & Christian Schmidt # +# Copyright (C) 2007-2012 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -34,7 +34,7 @@ TARGET = $(DIR_INFO)/$(THISAPP) PROG = mediatomb PAK_VER = 4 -DEPS = "sqlite taglib ffmpeg-libs" +DEPS = "ffmpeg-libs libexif sqlite taglib " ############################################################################### # Top-level Rules diff --git a/lfs/sarg b/lfs/sarg new file mode 100644 index 0000000..c8794fe --- /dev/null +++ b/lfs/sarg @@ -0,0 +1,100 @@ +############################################################################### +# # +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) 2012 Michael Tremer # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 2.3.3 + +THISAPP = sarg-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = sarg +PAK_VER = 1 + +DEPS = "" + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 09dba9a960d500acd7f17802de62512c + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --sysconfdir=/etc/sarg + cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) + cd $(DIR_APP) && make $(EXTRA_INSTALL) install + + # Install configuration file. + cp -v $(DIR_SRC)/config/sarg/sarg.conf /etc/sarg/sarg.conf + + # Install helper script. + install -m 755 $(DIR_SRC)/config/sarg/update-sarg-reports \ + /usr/sbin/update-sarg-reports + + # Install cron job. + for i in hourly daily weekly monthly; do \ + install -m 754 -v $(DIR_SRC)/config/sarg/cron.$${i} \ + /etc/fcron.$${i}/sarg-reports; \ + done + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/lfs/stage2 b/lfs/stage2 index 43edd86..beb0abb 100644 --- a/lfs/stage2 +++ b/lfs/stage2 @@ -95,6 +95,9 @@ $(TARGET) : chmod 755 /usr/local/bin/`basename $$i`; \ done + # Move script to correct place. + mv -vf /usr/local/bin/ovpn-ccd-convert /usr/sbin/ + # Nobody user -mkdir -p /home/nobody chown -R nobody:nobody /home/nobody diff --git a/lfs/stress b/lfs/stress new file mode 100644 index 0000000..166d840 --- /dev/null +++ b/lfs/stress @@ -0,0 +1,69 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.0.4 + +THISAPP = stress-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = stress +PAK_VER = 1 + +DEPS = "" + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = a607afa695a511765b40993a64c6e2f4 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./configure --prefix=/usr + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 049bc0e..0934909 100755 --- a/make.sh +++ b/make.sh @@ -25,8 +25,8 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name VERSION="2.13" # Version number -CORE="64" # Core Level (Filename) -PAKFIRE_CORE="64" # Core Level (PAKFIRE) +CORE="65" # Core Level (Filename) +PAKFIRE_CORE="65" # Core Level (PAKFIRE) GIT_BRANCH=`git status | head -n1 | cut -d" " -f4` # Git Branch SLOGAN="www.ipfire.org" # Software slogan CONFIG_ROOT=/var/ipfire # Configuration rootdir @@ -747,6 +747,9 @@ buildipfire() { ipfiremake gpgme ipfiremake pygpgme ipfiremake pakfire3 + ipfiremake stress + ipfiremake libstatgrab + ipfiremake sarg echo Build on $HOSTNAME > $BASEDIR/build/var/ipfire/firebuild cat /proc/version >> $BASEDIR/build/var/ipfire/firebuild echo >> $BASEDIR/build/var/ipfire/firebuild diff --git a/src/paks/sarg/install.sh b/src/paks/sarg/install.sh new file mode 100644 index 0000000..d3b17a9 --- /dev/null +++ b/src/paks/sarg/install.sh @@ -0,0 +1,34 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +extract_files +restore_backup ${NAME} + +# Create data directory. +[ -d "/var/log/sarg" ] || mkdir /var/log/sarg + +# Create initial report. +/usr/sbin/update-sarg-reports today >/dev/null 2>&1 + +exit 0 diff --git a/src/paks/sarg/uninstall.sh b/src/paks/sarg/uninstall.sh new file mode 100644 index 0000000..66f4344 --- /dev/null +++ b/src/paks/sarg/uninstall.sh @@ -0,0 +1,26 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +make_backup ${NAME} +remove_files diff --git a/src/paks/sarg/update.sh b/src/paks/sarg/update.sh new file mode 100644 index 0000000..89c40d0 --- /dev/null +++ b/src/paks/sarg/update.sh @@ -0,0 +1,26 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +./uninstall.sh +./install.sh diff --git a/src/scripts/ovpn-ccd-convert b/src/scripts/ovpn-ccd-convert new file mode 100644 index 0000000..86b7c94 --- /dev/null +++ b/src/scripts/ovpn-ccd-convert @@ -0,0 +1,48 @@ +#!/usr/bin/perl + +my %net=(); +my %ovpnconfig=(); +my @serverconf=(); +my $greennet; +my $greensubnet; +my $running='off'; +require '/var/ipfire/general-functions.pl'; + +if ( -e "/var/run/openvpn.pid"){ + $running='on'; + system('/usr/local/bin/openvpnctrl', '-k'); +} + +&General::readhash("/var/ipfire/ethernet/settings", \%net); + $greennet=$net{'GREEN_NETADDRESS'}; + $greensubnet=$net{'GREEN_NETMASK'}; +open(FILE,"/var/ipfire/ovpn/server.conf"); + while (<FILE>) { + $_=~s/\s*$//g; + if ($_ ne "route $greennet $greensubnet"){ + push (@serverconf,$_."\n"); + }else{ + print"\nFound ROUTE >>route $greennet $greensubnet<< in server.conf.. Deleted!"; + } + } + +&General::readhasharray("/var/ipfire/ovpn/ovpnconfig", \%ovpnconfig); +foreach my $key (keys %ovpnconfig){ + if($ovpnconfig{$key}[32] eq '' && $ovpnconfig{$key}[3] eq 'host'){ + open ( CCDRWCONF,'>',"/var/ipfire/ovpn/ccd/$ovpnconfig{$key}[2]") or die "Unable to create clientconfigfile $!"; + print CCDRWCONF "# OpenVPN Clientconfig from CCD extension by Copymaster#\n\n"; + print CCDRWCONF "#This client uses the dynamic pool\n\n"; + print CCDRWCONF "\n#Client gets routes to these Networks (behind IPFIRE)\n"; + print CCDRWCONF "push \"route $greennet $greensubnet\"\n"; + close CCDRWCONF; + print"Client $ovpnconfig{$key}[2] converted! \n"; + }else{ + print "Client $ovpnconfig{$key}[2] NOT converted!\n"; + } + $ovpnconfig{$key}[32] = 'dynamic'; +} +&General::writehasharray("/var/ipfire/ovpn/ovpnconfig", \%ovpnconfig); +if ($running eq 'on') +{ + system('/usr/local/bin/openvpnctrl', '-s'); +} diff --git a/src/scripts/update-lang-cache b/src/scripts/update-lang-cache new file mode 100644 index 0000000..971664e --- /dev/null +++ b/src/scripts/update-lang-cache @@ -0,0 +1,3 @@ +#!/bin/sh +perl -e "require '//var/ipfire/lang.pl'; &Lang::BuildCacheLang" + hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1d0fcb09edd3929dda72d23afd3a8d16f7713794
by git＠ipfire.org 07 Dec '12

07 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 1d0fcb09edd3929dda72d23afd3a8d16f7713794 (commit) from 36e1dc20f4d763b8069a4c973ef8ff792786229e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1d0fcb09edd3929dda72d23afd3a8d16f7713794 Author: Alexander Marx <amarx(a)ipfire.org> Date: Fri Dec 7 17:00:46 2012 +0100 OpenVPN ccd: fix creation of ccd directory via ovpn-ccd-convert script Fixes #10263. ----------------------------------------------------------------------- Summary of changes: src/scripts/ovpn-ccd-convert | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Difference in files: diff --git a/src/scripts/ovpn-ccd-convert b/src/scripts/ovpn-ccd-convert index 86b7c94..c54e256 100644 --- a/src/scripts/ovpn-ccd-convert +++ b/src/scripts/ovpn-ccd-convert @@ -1,13 +1,15 @@ #!/usr/bin/perl - +# Converter script for old openvpn clients my %net=(); my %ovpnconfig=(); my @serverconf=(); my $greennet; my $greensubnet; my $running='off'; -require '/var/ipfire/general-functions.pl'; +require '/var/ipfire/general-functions.pl'; +unless (-d "${General::swroot}/ovpn/ccd") { system("mkdir ${General::swroot}/ovpn/ccd"); } +system ("chown nobody.nobody ${General::swroot}/ovpn/ccd"); if ( -e "/var/run/openvpn.pid"){ $running='on'; system('/usr/local/bin/openvpnctrl', '-k'); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 36e1dc20f4d763b8069a4c973ef8ff792786229e
by git＠ipfire.org 06 Dec '12

06 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 36e1dc20f4d763b8069a4c973ef8ff792786229e (commit) from 0965d98fe8050a4c98b1b4db1306d741d3855ad4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 36e1dc20f4d763b8069a4c973ef8ff792786229e Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Dec 6 19:18:50 2012 +0100 core65: close core65. ----------------------------------------------------------------------- Summary of changes: make.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/make.sh b/make.sh index 1165c09..6fb2d94 100755 --- a/make.sh +++ b/make.sh @@ -26,7 +26,7 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name VERSION="2.11" # Version number CORE="65" # Core Level (Filename) -PAKFIRE_CORE="64" # Core Level (PAKFIRE) +PAKFIRE_CORE="65" # Core Level (PAKFIRE) GIT_BRANCH=`git status | head -n1 | cut -d" " -f4` # Git Branch SLOGAN="www.ipfire.org" # Software slogan CONFIG_ROOT=/var/ipfire # Configuration rootdir hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0965d98fe8050a4c98b1b4db1306d741d3855ad4
by git＠ipfire.org 06 Dec '12

06 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0965d98fe8050a4c98b1b4db1306d741d3855ad4 (commit) from 083c1258bf28023957d1b7204e4b05a5d4082998 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0965d98fe8050a4c98b1b4db1306d741d3855ad4 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Dec 6 19:13:29 2012 +0100 GeoIP: updated 05122012. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/{61 => 65}/filelists/GeoIP | 0 lfs/GeoIP | 4 ++-- 2 files changed, 2 insertions(+), 2 deletions(-) copy config/rootfiles/core/{61 => 65}/filelists/GeoIP (100%) Difference in files: diff --git a/config/rootfiles/core/65/filelists/GeoIP b/config/rootfiles/core/65/filelists/GeoIP new file mode 100644 index 0000000..0258236 --- /dev/null +++ b/config/rootfiles/core/65/filelists/GeoIP @@ -0,0 +1 @@ +usr/local/share/GeoIP/GeoIP.dat diff --git a/lfs/GeoIP b/lfs/GeoIP index 68254a7..7e1dc9a 100644 --- a/lfs/GeoIP +++ b/lfs/GeoIP @@ -25,7 +25,7 @@ include Config VER = 1.17 -DATVER = 06112012 +DATVER = 05122012 THISAPP = Geo-IP-PurePerl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ $(DL_FILE) = $(DL_FROM)/$(DL_FILE) GeoIP.dat-$(DATVER).gz = $(DL_FROM)/GeoIP.dat-$(DATVER).gz $(DL_FILE)_MD5 = 42a6b9d4dd2563a20c8998556216e1de -GeoIP.dat-$(DATVER).gz_MD5 = a8677695b0abecb69707ebe2444e64f9 +GeoIP.dat-$(DATVER).gz_MD5 = ab0f52a35128d1aced906ac4cbfbed9c install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 083c1258bf28023957d1b7204e4b05a5d4082998
by git＠ipfire.org 06 Dec '12

06 Dec '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 083c1258bf28023957d1b7204e4b05a5d4082998 (commit) from 82c809c7529a9cd7c9cdd6c96d5671d4e261a546 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 083c1258bf28023957d1b7204e4b05a5d4082998 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Dec 6 18:59:30 2012 +0100 backup: add vnstat,collectd and outgoingfw-macgroups to backup. fixes #10251 and additional the missing macgroups. ----------------------------------------------------------------------- Summary of changes: config/backup/include | 3 +++ config/rootfiles/core/65/filelists/files | 1 + 2 files changed, 4 insertions(+) Difference in files: diff --git a/config/backup/include b/config/backup/include index 8806640..a1d1fbc 100644 --- a/config/backup/include +++ b/config/backup/include @@ -16,6 +16,7 @@ /var/ipfire/dhcp/* /var/ipfire/main/* /var/ipfire/outgoing/groups +/var/ipfire/outgoing/macgroups /var/ipfire/outgoing/rules /var/ipfire/outgoing/p2protocols /var/ipfire/ovpn @@ -28,6 +29,8 @@ /var/ipfire/vpn /var/log/ip-acct/* /var/log/rrd/* +/var/log/rrd/collectd +/var/log/rrd/vnstat /etc/sysconfig/firewall.local /etc/sysconfig/rc.local /root/.gitconfig diff --git a/config/rootfiles/core/65/filelists/files b/config/rootfiles/core/65/filelists/files index 6c88a31..67bd0b3 100644 --- a/config/rootfiles/core/65/filelists/files +++ b/config/rootfiles/core/65/filelists/files @@ -7,3 +7,4 @@ srv/web/ipfire/cgi-bin/vpnmain.cgi usr/sbin/ovpn-ccd-convert var/ipfire/general-functions.pl var/ipfire/langs +var/ipfire/backup/include hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM December 2012