IPFire-SCM August 2014

ipfire-scm@lists.ipfire.org

1 participants
43 discussions

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 93899a216f7f03b8e1d5092fdd20afd07b0bedae
by git＠ipfire.org 05 Aug '14

05 Aug '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 93899a216f7f03b8e1d5092fdd20afd07b0bedae (commit) via 156311fbcd67f00002fe658e1ee4b20154bf014a (commit) from 06dbe99dbb1c37de8fc94b6f2dc6e53ef1d7d022 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 93899a216f7f03b8e1d5092fdd20afd07b0bedae Author: Arne Fitzenreiter <arne_f(a)git.ipfire.org> Date: Tue Jul 29 21:57:07 2014 +0200 firewall: add more pscan matches and filter INVALID conntrack packages. commit 156311fbcd67f00002fe658e1ee4b20154bf014a Author: Erik Kapfer <erik.kapfer(a)ipfire.org> Date: Thu Jul 31 08:43:24 2014 +0200 OpenVPN: Added a check for empty 'CERT_NAME' field. Fixes: #10581 ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/ovpnmain.cgi | 4 +--- src/initscripts/init.d/firewall | 15 ++++++++++----- 2 files changed, 11 insertions(+), 8 deletions(-) Difference in files: diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 927616a..14308e5 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -3968,10 +3968,8 @@ if ($cgiparams{'TYPE'} eq 'net') { $errormessage = $Lang::tr{'name too long'}; goto VPNCONF_ERROR; } - if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) { + if ($cgiparams{'CERT_NAME'} eq '' || $cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) { $errormessage = $Lang::tr{'invalid input for name'}; - unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; - rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!"; goto VPNCONF_ERROR; } if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) { diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index 97186c3..23d0c23 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -64,16 +64,20 @@ iptables_init() { iptables -A BADTCP -i lo -j RETURN # Disallow packets frequently used by port-scanners - # nmap xmas - iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN - # Null - iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN - # FIN + # NMAP FIN/URG/PSH (XMAS scan) + iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN + # SYN/RST/ACK/FIN/URG + iptables -A BADTCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j PSCAN + # ALL/ALL + iptables -A BADTCP -p tcp --tcp-flags ALL ALL -j PSCAN + # FIN Stealth iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN # SYN/RST (also catches xmas variants that set SYN+RST+...) iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN # SYN/FIN (QueSO or nmap OS probe) iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN + # Null + iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN # NEW TCP without SYN iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN @@ -83,6 +87,7 @@ iptables_init() { # Connection tracking chain iptables -N CONNTRACK iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + iptables -A CONNTRACK -m conntrack --ctstate INVALID -j DROP # Fix for braindead ISP's iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 06dbe99dbb1c37de8fc94b6f2dc6e53ef1d7d022
by git＠ipfire.org 04 Aug '14

04 Aug '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 06dbe99dbb1c37de8fc94b6f2dc6e53ef1d7d022 (commit) via 1f080b34bac4fbaa88d2b460ece53d460fff6ec5 (commit) from 5fe185f83c98d86cdbca470ecbea5c1365cae3f9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 06dbe99dbb1c37de8fc94b6f2dc6e53ef1d7d022 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Aug 4 19:39:16 2014 +0200 tor: Update to 0.2.4.23 http://www.heise.de/security/meldung/Erfolgreicher-Angriff-auf-Tor-Anonymis… commit 1f080b34bac4fbaa88d2b460ece53d460fff6ec5 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jul 31 21:45:38 2014 +0200 ddns.cgi: Check for valid FQDN before doing nslookup. We now check if the used hostname is a valid FQDN before doing the nslookup to determine if a DDNS host is up do date. ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/ddns.cgi | 19 +++++++++++++++++-- lfs/tor | 6 +++--- 2 files changed, 20 insertions(+), 5 deletions(-) Difference in files: diff --git a/html/cgi-bin/ddns.cgi b/html/cgi-bin/ddns.cgi index 3072a8b..65e3bee 100644 --- a/html/cgi-bin/ddns.cgi +++ b/html/cgi-bin/ddns.cgi @@ -507,17 +507,32 @@ END chomp(@current); my @temp = split(/\,/,$line); + # Handle hostname details. Only connect the values with a dott if both are available. + my $hostname=""; + + if (($temp[1]) && ($temp[2])) { + $hostname="$temp[1].$temp[2]"; + } else { + $hostname="$temp[1]"; + } + # Generate value for enable/disable checkbox. - my $sync = ""; + my $sync = ''; my $gif = ''; my $gdesc = ''; if ($temp[7] eq "on") { $gif = 'on.gif'; $gdesc = $Lang::tr{'click to disable'}; - $sync = (&General::DyndnsServiceSync ($ip,$temp[1], $temp[2]) ? "": "") ; + + # Check if the given hostname is a FQDN before doing a nslookup. + if (&General::validfqdn($hostname)) { + $sync = (&General::DyndnsServiceSync ($ip,$temp[1], $temp[2]) ? "": "") ; + } + $toggle_enabled = 'off'; } else { + $sync = ""; $gif = 'off.gif'; $gdesc = $Lang::tr{'click to enable'}; $toggle_enabled = 'on'; diff --git a/lfs/tor b/lfs/tor index 6f9e502..0cc2957 100644 --- a/lfs/tor +++ b/lfs/tor @@ -24,7 +24,7 @@ include Config -VER = 0.2.4.22 +VER = 0.2.4.23 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 7 +PAK_VER = 8 DEPS = "libevent2" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5a7eee0d9df87233255d78b25c6f8270 +$(DL_FILE)_MD5 = 9e39928e310612c3bffee727f554c63f install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 5fe185f83c98d86cdbca470ecbea5c1365cae3f9
by git＠ipfire.org 04 Aug '14

04 Aug '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 5fe185f83c98d86cdbca470ecbea5c1365cae3f9 (commit) from b3f401fba4b69ea06a1987a971f8f7ff59b3ee33 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5fe185f83c98d86cdbca470ecbea5c1365cae3f9 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Aug 1 19:56:52 2014 +0200 ddns.cgi: Fix token auth for provider regfish.com. In the past the regfish.com auth token was stored as username similar than freedns.afraid.com. We now expected the token key stored as password, to keep compatiblity with old installations I've added some compatible code to prevent users from various issues. ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/ddns.cgi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Difference in files: diff --git a/html/cgi-bin/ddns.cgi b/html/cgi-bin/ddns.cgi index 7be9a50..3072a8b 100644 --- a/html/cgi-bin/ddns.cgi +++ b/html/cgi-bin/ddns.cgi @@ -187,7 +187,7 @@ if (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang:: # Check if a password has been typed in. # freedns.afraid.org does not require this field. - if (($settings{'PASSWORD'} eq '') && ($settings{'SERVICE'} ne 'freedns.afraid.org')) { + if (($settings{'PASSWORD'} eq '') && ($settings{'SERVICE'} ne 'freedns.afraid.org') && ($settings{'SERVICE'} ne 'regfish.com')) { $errormessage = $Lang::tr{'password not set'}; } @@ -650,8 +650,8 @@ sub GenerateDDNSConfigFile { if ($provider ~~ ["dns.lightningwirelabs.com", "entrydns.net", "regfish.com"] && $username eq "token") { $use_token = 1; - # Handle token auth for freedns.afraid.org. - } elsif ($provider eq "freedns.afraid.org" && $password eq "") { + # Handle token auth for freedns.afraid.org and regfish.com. + } elsif ($provider ~~ ["freedns.afraid.org", "regfish.com"] && $password eq "") { $use_token = 1; $password = $username; hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM August 2014