IPFire-SCM November 2015

ipfire-scm@lists.ipfire.org

1 participants
27 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. c88002c48b8011dfec3aefe66f66769e786db11b
by git＠ipfire.org 07 Nov '15

07 Nov '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via c88002c48b8011dfec3aefe66f66769e786db11b (commit) from ea2b8089e69e3741ac3a3f3f24bc9f0b409d04d0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c88002c48b8011dfec3aefe66f66769e786db11b Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Nov 7 09:11:27 2015 +0100 ipset: fix build om arm. Never hardcode KVER-ipfire in any patches because on arm there is no KVER-ipfire kernel. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/ipset | 3 +-- src/patches/ipset-6.26_fix_kernel_dir_path.patch | 20 -------------------- 2 files changed, 1 insertion(+), 22 deletions(-) delete mode 100644 src/patches/ipset-6.26_fix_kernel_dir_path.patch Difference in files: diff --git a/lfs/ipset b/lfs/ipset index 0ee8c92..254b1ec 100644 --- a/lfs/ipset +++ b/lfs/ipset @@ -71,8 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./autogen.sh - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/ipset-6.26_fix_kernel_dir_path.patch - cd $(DIR_APP) && ./configure \ + cd $(DIR_APP) && KSOURCEDIR=/usr/src/linux KBUILDDIR=/usr/src/linux ./configure \ --prefix=/usr \ --disable-static diff --git a/src/patches/ipset-6.26_fix_kernel_dir_path.patch b/src/patches/ipset-6.26_fix_kernel_dir_path.patch deleted file mode 100644 index 7c20448..0000000 --- a/src/patches/ipset-6.26_fix_kernel_dir_path.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- ipset-6.26_orig/configure 2015-10-11 06:57:32.659295626 +0000 -+++ ipset-6.26/configure 2015-10-11 06:58:21.935695339 +0000 -@@ -13079,7 +13079,7 @@ - then - kbuilddir="$KBUILDDIR" - else -- kbuilddir="/lib/modules/`uname -r`/build" -+ kbuilddir="/lib/modules/`uname -r`-ipfire/build" - fi - - if test -n "$KSOURCEDIR"; then -@@ -13087,7 +13087,7 @@ - elif test -e "$kbuilddir/include/linux/netfilter/nfnetlink.h"; then - ksourcedir="$kbuilddir" - else -- ksourcedir="/lib/modules/$(uname -r)/source" -+ ksourcedir="/lib/modules/$(uname -r)-ipfire/source" - fi - if test ! -e "$ksourcedir/include/linux/netfilter/nfnetlink.h" - then hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. ea2b8089e69e3741ac3a3f3f24bc9f0b409d04d0
by git＠ipfire.org 05 Nov '15

05 Nov '15

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9ce3b858a616613539eb4319bf621a50bc8d33eb
by git＠ipfire.org 05 Nov '15

05 Nov '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 9ce3b858a616613539eb4319bf621a50bc8d33eb (commit) via 4bfec109e7ed1856c8f39de83bb8d213e9ba13a4 (commit) via 63cbd2c1df71e246a51b614a2549869168399b10 (commit) via 2913185aa487b605e38bdd5b5ac3820d1fa6f654 (commit) via a4e9b9d8e085455fce6ba632da4829a959f3cc96 (commit) from 87fb870b5edc65d6323f1ef2eb4dba8e6ef8045d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9ce3b858a616613539eb4319bf621a50bc8d33eb Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Nov 5 15:35:46 2015 +0000 core95: Ship changed mail.cgi Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4bfec109e7ed1856c8f39de83bb8d213e9ba13a4 Author: Alexander Marx <alexander.marx(a)ipfire.org> Date: Sat Oct 31 07:34:56 2015 +0100 BUG10965: only write auth.conf if username/password are set auth.conf was always written, even if no username/password provided. In this case only the ip or Hostname of the mailserver was written into auth.conf. Now the file is only filled if username/password are filled. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Tested-by: Timo Eissler <timo.eissler(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 63cbd2c1df71e246a51b614a2549869168399b10 Author: Erik Kapfer <erik.kapfer(a)ipfire.org> Date: Thu Nov 5 06:29:01 2015 +0100 ipset: New package Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 2913185aa487b605e38bdd5b5ac3820d1fa6f654 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Nov 5 11:44:57 2015 +0000 openvpn: The --up option only takes one single argument Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a4e9b9d8e085455fce6ba632da4829a959f3cc96 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Nov 5 11:44:04 2015 +0000 openvpn: Apply static routes on client site as well Fixes: #10968 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/ipset | 26 ++++++++++++++++++++++++ config/rootfiles/core/95/filelists/files | 1 + html/cgi-bin/mail.cgi | 11 ++++++---- html/cgi-bin/ovpnmain.cgi | 3 ++- lfs/{libarchive => ipset} | 21 +++++++++++-------- make.sh | 1 + src/patches/ipset-6.26_fix_kernel_dir_path.patch | 20 ++++++++++++++++++ 7 files changed, 69 insertions(+), 14 deletions(-) create mode 100644 config/rootfiles/common/ipset copy lfs/{libarchive => ipset} (87%) create mode 100644 src/patches/ipset-6.26_fix_kernel_dir_path.patch Difference in files: diff --git a/config/rootfiles/common/ipset b/config/rootfiles/common/ipset new file mode 100644 index 0000000..50ebed5 --- /dev/null +++ b/config/rootfiles/common/ipset @@ -0,0 +1,26 @@ +etc/ipset +#usr/include/libipset +#usr/include/libipset/data.h +#usr/include/libipset/errcode.h +#usr/include/libipset/linux_ip_set.h +#usr/include/libipset/linux_ip_set_bitmap.h +#usr/include/libipset/linux_ip_set_hash.h +#usr/include/libipset/linux_ip_set_list.h +#usr/include/libipset/mnl.h +#usr/include/libipset/nf_inet_addr.h +#usr/include/libipset/nfproto.h +#usr/include/libipset/parse.h +#usr/include/libipset/pfxlen.h +#usr/include/libipset/print.h +#usr/include/libipset/session.h +#usr/include/libipset/transport.h +#usr/include/libipset/types.h +#usr/include/libipset/ui.h +#usr/include/libipset/utils.h +#usr/lib/libipset.la +#usr/lib/libipset.so +usr/lib/libipset.so.3 +usr/lib/libipset.so.3.6.0 +#usr/lib/pkgconfig/libipset.pc +usr/sbin/ipset +#usr/share/man/man8/ipset.8 diff --git a/config/rootfiles/core/95/filelists/files b/config/rootfiles/core/95/filelists/files index ab8f1a8..3db6caf 100644 --- a/config/rootfiles/core/95/filelists/files +++ b/config/rootfiles/core/95/filelists/files @@ -11,6 +11,7 @@ srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/logs.cgi/firewalllogcountry.dat +srv/web/ipfire/cgi-bin/mail.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/pppsetup.cgi srv/web/ipfire/cgi-bin/routing.cgi diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi index a72f923..072888c 100755 --- a/html/cgi-bin/mail.cgi +++ b/html/cgi-bin/mail.cgi @@ -110,9 +110,12 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite $mail{'SENDER'} = $cgiparams{'txt_mailsender'}; $mail{'RECIPIENT'} = $cgiparams{'txt_recipient'}; - $auth{'AUTHNAME'} = $cgiparams{'txt_mailuser'}; - $auth{'AUTHPASS'} = $cgiparams{'txt_mailpass'}; - $auth{'AUTHHOST'} = $cgiparams{'txt_mailserver'}; + if ($cgiparams{'txt_mailuser'} && $cgiparams{'txt_mailpass'}) { + $auth{'AUTHNAME'} = $cgiparams{'txt_mailuser'}; + $auth{'AUTHPASS'} = $cgiparams{'txt_mailpass'}; + $auth{'AUTHHOST'} = $cgiparams{'txt_mailserver'}; + print TXT1 "$auth{'AUTHNAME'}|$auth{'AUTHHOST'}:$auth{'AUTHPASS'}\n"; + } $dma{'SMARTHOST'} = $cgiparams{'txt_mailserver'}; $dma{'PORT'} = $cgiparams{'txt_mailport'}; @@ -129,7 +132,7 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite print TXT "$k $v\n"; } close TXT; - print TXT1 "$auth{'AUTHNAME'}|$auth{'AUTHHOST'}:$auth{'AUTHPASS'}\n"; + close TXT1; close TXT2; }else{ diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 2eff2e0..7b75952 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -926,7 +926,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n"; print SERVERCONF "# Client Gateway Network\n"; print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n"; - print SERVERCONF "up /etc/init.d/static-routes start\n"; + print SERVERCONF "up \"/etc/init.d/static-routes start\"\n"; print SERVERCONF "# tun Device\n"; print SERVERCONF "dev tun\n"; print SERVERCONF "#Logfile for statistics\n"; @@ -1026,6 +1026,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n"; print CLIENTCONF "# Server Gateway Network\n"; print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n"; + print CLIENTCONF "up \"/etc/init.d/static-routes start\"\n"; print CLIENTCONF "# tun Device\n"; print CLIENTCONF "dev tun\n"; print CLIENTCONF "# Port and Protokol\n"; diff --git a/lfs/ipset b/lfs/ipset new file mode 100644 index 0000000..0ee8c92 --- /dev/null +++ b/lfs/ipset @@ -0,0 +1,88 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2015 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 6.26 + +THISAPP = ipset-$(VER) +DL_FILE = $(THISAPP).tar.bz2 +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 5ec4e79053a30fb6d72e0549d7d09343 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./autogen.sh + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/ipset-6.26_fix_kernel_dir_path.patch + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --disable-static + + # Add configuration directory + -mkdir -pv /etc/ipset + chmod 750 /etc/ipset + chown root:root /etc/ipset + + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index ed902c9..47e07b2 100755 --- a/make.sh +++ b/make.sh @@ -850,6 +850,7 @@ buildipfire() { ipfiremake perl-Text-CSV_XS ipfiremake swconfig ipfiremake haproxy + ipfiremake ipset } buildinstaller() { diff --git a/src/patches/ipset-6.26_fix_kernel_dir_path.patch b/src/patches/ipset-6.26_fix_kernel_dir_path.patch new file mode 100644 index 0000000..7c20448 --- /dev/null +++ b/src/patches/ipset-6.26_fix_kernel_dir_path.patch @@ -0,0 +1,20 @@ +--- ipset-6.26_orig/configure 2015-10-11 06:57:32.659295626 +0000 ++++ ipset-6.26/configure 2015-10-11 06:58:21.935695339 +0000 +@@ -13079,7 +13079,7 @@ + then + kbuilddir="$KBUILDDIR" + else +- kbuilddir="/lib/modules/`uname -r`/build" ++ kbuilddir="/lib/modules/`uname -r`-ipfire/build" + fi + + if test -n "$KSOURCEDIR"; then +@@ -13087,7 +13087,7 @@ + elif test -e "$kbuilddir/include/linux/netfilter/nfnetlink.h"; then + ksourcedir="$kbuilddir" + else +- ksourcedir="/lib/modules/$(uname -r)/source" ++ ksourcedir="/lib/modules/$(uname -r)-ipfire/source" + fi + if test ! -e "$ksourcedir/include/linux/netfilter/nfnetlink.h" + then hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 87fb870b5edc65d6323f1ef2eb4dba8e6ef8045d
by git＠ipfire.org 04 Nov '15

04 Nov '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 87fb870b5edc65d6323f1ef2eb4dba8e6ef8045d (commit) via b6f571fa88735dcde1dfa8b4c584220fb14bf143 (commit) via 6411f1baa6e3d1a89df72327b7c8b5cb2fa8202a (commit) via b22d8aaf4ad26840cc6907580e6bd0cfea73b160 (commit) via 71af643cda77f02a006613f3fcc1a223a88f01a6 (commit) via 3045d6abde3e8eff0d1dac4fe8afe397f65f66cd (commit) via 93a08fe26132b91bc3d47d83e13bf79a3b4c5c77 (commit) from 123205fdbf2624a78449044c11cff5e77dd3f8e3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 87fb870b5edc65d6323f1ef2eb4dba8e6ef8045d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Nov 4 21:18:13 2015 +0000 core95: Ship updated packages Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b6f571fa88735dcde1dfa8b4c584220fb14bf143 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sun Nov 1 15:30:01 2015 +0100 snort: Update to 2.9.7.6 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 6411f1baa6e3d1a89df72327b7c8b5cb2fa8202a Author: Erik Kapfer <erik.kapfer(a)ipfire.org> Date: Tue Jul 7 13:13:36 2015 +0200 lzo: Update to version 2.09 Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b22d8aaf4ad26840cc6907580e6bd0cfea73b160 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Oct 30 15:47:22 2015 +0000 openvpn: Embed the certificate and key file into configuration This will allow to import just the configuration file into iOS and establish the VPN connection. Also works with many other OpenVPN clients. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 71af643cda77f02a006613f3fcc1a223a88f01a6 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Oct 30 15:47:21 2015 +0000 openvpn: Add option to download a client package with PEM files This patch adds the option to download a client package that comes with a regular PEM and key file instead of a PKCS12 file which is easier to use with clients that don't support PKCS12 (like iOS) opposed to converting the file manually. This requires that the connection is created without using a password for the certificate. Then the certificate is already stored in an insecure way. This patch also adds this to the Core Update 95 updater. Fixes: #10966 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> CC: Alexander Marx <alexander.marx(a)ipfire.org> commit 3045d6abde3e8eff0d1dac4fe8afe397f65f66cd Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Oct 30 16:00:28 2015 +0000 openvpn: Apply static routes when N2N connection comes up Fixes: #10968 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 93a08fe26132b91bc3d47d83e13bf79a3b4c5c77 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Tue Nov 3 18:51:32 2015 +0100 dma: Update to 0.10 Sorry, I borked the PATCH from yesterday...second try: dma: Update to 0.10 Changes: dns.c, do not treat unreachable DNS server as permanent error See: https://github.com/corecode/dma/commit/1a1306df018bd62cf1c5feb2e6e664f656bc… Deleted unnecessary blank lines in 'mail.cgi' Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/lzo | 17 ++-- .../{oldcore/94 => core/95}/filelists/dma | 0 config/rootfiles/core/95/filelists/files | 2 + .../{oldcore/81 => core/95}/filelists/lzo | 0 .../{oldcore/89 => core/95}/filelists/snort | 0 html/cgi-bin/ids.cgi | 6 +- html/cgi-bin/mail.cgi | 15 --- html/cgi-bin/ovpnmain.cgi | 110 ++++++++++++++++++++- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + lfs/dma | 6 +- lfs/lzo | 15 ++- lfs/snort | 8 +- 13 files changed, 138 insertions(+), 43 deletions(-) copy config/rootfiles/{oldcore/94 => core/95}/filelists/dma (100%) copy config/rootfiles/{oldcore/81 => core/95}/filelists/lzo (100%) copy config/rootfiles/{oldcore/89 => core/95}/filelists/snort (100%) Difference in files: diff --git a/config/rootfiles/common/lzo b/config/rootfiles/common/lzo index 6d746bd..4ebc05c 100644 --- a/config/rootfiles/common/lzo +++ b/config/rootfiles/common/lzo @@ -12,16 +12,15 @@ #usr/include/lzo/lzoconf.h #usr/include/lzo/lzodefs.h #usr/include/lzo/lzoutil.h -#usr/lib/liblzo2.a #usr/lib/liblzo2.la usr/lib/liblzo2.so usr/lib/liblzo2.so.2 usr/lib/liblzo2.so.2.0.0 -#usr/share/doc/lzo -#usr/share/doc/lzo/AUTHORS -#usr/share/doc/lzo/COPYING -#usr/share/doc/lzo/LZO.FAQ -#usr/share/doc/lzo/LZO.TXT -#usr/share/doc/lzo/LZOAPI.TXT -#usr/share/doc/lzo/NEWS -#usr/share/doc/lzo/THANKS +#usr/share/doc/lzo-2.09 +#usr/share/doc/lzo-2.09/AUTHORS +#usr/share/doc/lzo-2.09/COPYING +#usr/share/doc/lzo-2.09/LZO.FAQ +#usr/share/doc/lzo-2.09/LZO.TXT +#usr/share/doc/lzo-2.09/LZOAPI.TXT +#usr/share/doc/lzo-2.09/NEWS +#usr/share/doc/lzo-2.09/THANKS diff --git a/config/rootfiles/core/95/filelists/dma b/config/rootfiles/core/95/filelists/dma new file mode 120000 index 0000000..60f4682 --- /dev/null +++ b/config/rootfiles/core/95/filelists/dma @@ -0,0 +1 @@ +../../../common/dma \ No newline at end of file diff --git a/config/rootfiles/core/95/filelists/files b/config/rootfiles/core/95/filelists/files index d9aeaa7..ab8f1a8 100644 --- a/config/rootfiles/core/95/filelists/files +++ b/config/rootfiles/core/95/filelists/files @@ -9,7 +9,9 @@ srv/web/ipfire/cgi-bin/connections.cgi srv/web/ipfire/cgi-bin/credits.cgi srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/firewall.cgi +srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/logs.cgi/firewalllogcountry.dat +srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/pppsetup.cgi srv/web/ipfire/cgi-bin/routing.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi diff --git a/config/rootfiles/core/95/filelists/lzo b/config/rootfiles/core/95/filelists/lzo new file mode 120000 index 0000000..8e11e78 --- /dev/null +++ b/config/rootfiles/core/95/filelists/lzo @@ -0,0 +1 @@ +../../../common/lzo \ No newline at end of file diff --git a/config/rootfiles/core/95/filelists/snort b/config/rootfiles/core/95/filelists/snort new file mode 120000 index 0000000..9406ce0 --- /dev/null +++ b/config/rootfiles/core/95/filelists/snort @@ -0,0 +1 @@ +../../../common/snort \ No newline at end of file diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 5ada911..f17b16a 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2013 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -263,9 +263,9 @@ if (-e "/etc/snort/snort.conf") { ####################### End added for snort rules control ################################# if ($snortsettings{'RULES'} eq 'subscripted') { - $url=" https://www.snort.org/rules/snortrules-snapshot-2970.tar.gz?oinkcode=$snort…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-2976.tar.gz?oinkcode=$snort…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url=" https://www.snort.org/rules/snortrules-snapshot-2970.tar.gz?oinkcode=$snort…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-2976.tar.gz?oinkcode=$snort…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'community') { $url=" https://www.snort.org/rules/community"; } else { diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi index be663a6..a72f923 100755 --- a/html/cgi-bin/mail.cgi +++ b/html/cgi-bin/mail.cgi @@ -328,18 +328,3 @@ sub error { &Header::closebox(); } } - - - - - - - - - - - - - - - diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 9e252a9..2eff2e0 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -926,6 +926,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n"; print SERVERCONF "# Client Gateway Network\n"; print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n"; + print SERVERCONF "up /etc/init.d/static-routes start\n"; print SERVERCONF "# tun Device\n"; print SERVERCONF "dev tun\n"; print SERVERCONF "#Logfile for statistics\n"; @@ -2265,9 +2266,41 @@ else print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n"; } + my $file_crt = new File::Temp( UNLINK => 1 ); + my $file_key = new File::Temp( UNLINK => 1 ); + my $include_certs = 0; + if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") { - print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n"; - $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n"; + if ($cgiparams{'MODE'} eq 'insecure') { + $include_certs = 1; + + # Add the CA + print CLIENTCONF ";ca cacert.pem\r\n"; + $zip->addFile("${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n"; + + # Extract the certificate + system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", + '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:'); + if ($?) { + die "openssl error: $?"; + } + + $zip->addFile("$file_crt", "$confighash{$cgiparams{'KEY'}}[1].pem") or die; + print CLIENTCONF ";cert $confighash{$cgiparams{'KEY'}}[1].pem\r\n"; + + # Extract the key + system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", + '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:'); + if ($?) { + die "openssl error: $?"; + } + + $zip->addFile("$file_key", "$confighash{$cgiparams{'KEY'}}[1].key") or die; + print CLIENTCONF ";key $confighash{$cgiparams{'KEY'}}[1].key\r\n"; + } else { + print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n"; + $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n"; + } } else { print CLIENTCONF "ca cacert.pem\r\n"; print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n"; @@ -2282,6 +2315,9 @@ else print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n"; } if ($vpnsettings{'TLSAUTH'} eq 'on') { + if ($cgiparams{'MODE'} eq 'insecure') { + print CLIENTCONF ";"; + } print CLIENTCONF "tls-auth ta.key\r\n"; $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n"; } @@ -2306,6 +2342,53 @@ else print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n"; } } + + if ($include_certs) { + print CLIENTCONF "\r\n"; + + # CA + open(FILE, "<${General::swroot}/ovpn/ca/cacert.pem"); + print CLIENTCONF "<ca>\r\n"; + while (<FILE>) { + chomp($_); + print CLIENTCONF "$_\r\n"; + } + print CLIENTCONF "</ca>\r\n\r\n"; + close(FILE); + + # Cert + open(FILE, "<$file_crt"); + print CLIENTCONF "<cert>\r\n"; + while (<FILE>) { + chomp($_); + print CLIENTCONF "$_\r\n"; + } + print CLIENTCONF "</cert>\r\n\r\n"; + close(FILE); + + # Key + open(FILE, "<$file_key"); + print CLIENTCONF "<key>\r\n"; + while (<FILE>) { + chomp($_); + print CLIENTCONF "$_\r\n"; + } + print CLIENTCONF "</key>\r\n\r\n"; + close(FILE); + + # TLS auth + if ($vpnsettings{'TLSAUTH'} eq 'on') { + open(FILE, "<${General::swroot}/ovpn/certs/ta.key"); + print CLIENTCONF "<tls-auth>\r\n"; + while (<FILE>) { + chomp($_); + print CLIENTCONF "$_\r\n"; + } + print CLIENTCONF "</tls-auth>\r\n\r\n"; + close(FILE); + } + } + # Print client.conf.local if entries exist to client.ovpn if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') { open (LCC, "$local_clientconf"); @@ -4251,6 +4334,10 @@ if ($cgiparams{'TYPE'} eq 'net') { $confighash{$key}[39] = $cgiparams{'DAUTH'}; $confighash{$key}[40] = $cgiparams{'DCIPHER'}; + if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) { + $confighash{$key}[41] = "no-pass"; + } + &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); if ($cgiparams{'CHECK1'} ){ @@ -5127,7 +5214,7 @@ END <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th> <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th> <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th> - <th width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></th> + <th width='5%' class='boldbase' colspan='7' align='center'><b>$Lang::tr{'action'}</b></th> </tr> END } @@ -5141,7 +5228,7 @@ END <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th> <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th> <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th> - <th width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></th> + <th width='5%' class='boldbase' colspan='7' align='center'><b>$Lang::tr{'action'}</b></th> </tr> END } @@ -5240,6 +5327,21 @@ END </td></form> END ; + + if ($confighash{$key}[41] eq "no-pass") { + print <<END; + <form method='post' name='frm${key}g'><td align='center' $col> + <input type='image' name='$Lang::tr{'dl client arch insecure'}' src='/images/openvpn.png' + alt='$Lang::tr{'dl client arch insecure'}' title='$Lang::tr{'dl client arch insecure'}' border='0' /> + <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' /> + <input type='hidden' name='MODE' value='insecure' /> + <input type='hidden' name='KEY' value='$key' /> + </td></form> +END + } else { + print "<td $col> </td>"; + } + if ($confighash{$key}[4] eq 'cert') { print <<END; <form method='post' name='frm${key}b'><td align='center' $col> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index da9b885..2bca854 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -731,6 +731,7 @@ 'display traffic at home' => 'Berechneten Traffic auf der Startseite anzeigen', 'display webinterface effects' => 'Überblendeffekte einschalten', 'dl client arch' => 'Client Paket herunterladen (zip)', +'dl client arch insecure' => 'Ungesichertes Client-Paket herunterladen (zip)', 'dmz' => 'DMZ', 'dmz pinhole configuration' => 'Einstellungen des DMZ-Schlupfloches', 'dmz pinhole rule added' => 'Regel für DMZ-Schlupfloch hinzugefügt; Starte DMZ-Schlupfloch neu', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 56238ed..4c52392 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -756,6 +756,7 @@ 'display traffic at home' => 'Display calculated traffic on startpage', 'display webinterface effects' => 'Activate effects', 'dl client arch' => 'Download Client Package (zip)', +'dl client arch insecure' => 'Download insecure Client Package (zip)', 'dmz' => 'DMZ', 'dmz pinhole configuration' => 'DMZ pinhole configuration', 'dmz pinhole rule added' => 'DMZ pinhole rule added; restarting DMZ pinhole', diff --git a/lfs/dma b/lfs/dma index 977efc8..cf264ea 100644 --- a/lfs/dma +++ b/lfs/dma @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2011 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2015 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.9.1 +VER = 0.10 THISAPP = dma-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 56afaf438ba34d4ff9c8879dc29a16b1 +$(DL_FILE)_MD5 = 91f521b0749e16f5d78e139e717245ea install : $(TARGET) diff --git a/lfs/lzo b/lfs/lzo index 19ad090..2afc89f 100644 --- a/lfs/lzo +++ b/lfs/lzo @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2015 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.06 +VER = 2.09 THISAPP = lzo-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 95380bd4081f85ef08c5209f4107e9f8 +$(DL_FILE)_MD5 = c7ffc9a103afe2d1bba0b015e7aa887f install : $(TARGET) @@ -70,9 +70,14 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/lzo-2.06-CVE-2014-4607.patch - cd $(DIR_APP) && ./configure --prefix=/usr --enable-shared + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --enable-shared \ + --disable-static \ + --docdir=/usr/share/doc/lzo-2.09 + cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/lfs/snort b/lfs/snort index 373e53c..148f539 100644 --- a/lfs/snort +++ b/lfs/snort @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2013 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.9.7.0 +VER = 2.9.7.6 THISAPP = snort-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -36,11 +36,11 @@ TARGET = $(DIR_INFO)/$(THISAPP) # Top-level Rules ############################################################################### -objects = $(DL_FILE) +objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c2a45bc56441ee9456478f219dd8d1e2 +$(DL_FILE)_MD5 = 65349f3272c4de5b3210f77f1f7ab0e6 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 3.x development tree branch, master, updated. 1c6d545816cd0ad5117bde16b8d78b4368c072d4
by git＠ipfire.org 04 Nov '15

04 Nov '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via 1c6d545816cd0ad5117bde16b8d78b4368c072d4 (commit) from 9896be8714769816c50305711bd64a9e13bfb92b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1c6d545816cd0ad5117bde16b8d78b4368c072d4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Nov 3 23:39:27 2015 +0000 pdns: Update to version 3.4.7 Ths patch also enables the testsuite. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: pdns/pdns.nm | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) Difference in files: diff --git a/pdns/pdns.nm b/pdns/pdns.nm index 3c25e9d..21e9984 100644 --- a/pdns/pdns.nm +++ b/pdns/pdns.nm @@ -4,8 +4,8 @@ ############################################################################### name = pdns -version = 3.3.1 -release = 2 +version = 3.4.7 +release = 1 groups = Networking/DNS url = http://powerdns.com/ @@ -20,6 +20,7 @@ description end source_dl = http://downloads.powerdns.com/releases/ +sources = %{thisapp}.tar.bz2 build requires @@ -38,18 +39,22 @@ build configure_options += \ --sysconfdir=%{sysconfdir}/pdns \ - --libdir=%{libdir}/powerdns \ --with-system-polarssl \ --with-modules="" \ --with-dynmodules="pipe geo gsqlite3" \ --with-lua \ --enable-tools \ - --disable-static + --disable-static \ + --enable-unit-tests prepare_cmds %{create_user} end + test + make -C pdns check + end + install_cmds # Create directories for pdns sqlite db. mkdir -p %{BUILDROOT}%{datadir}/pdns/ @@ -78,7 +83,7 @@ build chrpath --delete %{BUILDROOT}/usr/bin/pdns_control chrpath --delete %{BUILDROOT}/usr/bin/zone2sql chrpath --delete %{BUILDROOT}/usr/sbin/pdns_server - chrpath --delete %{BUILDROOT}%{libdir}/powerdns/*.so + chrpath --delete %{BUILDROOT}%{libdir}/pdns/*.so chrpath --delete %{BUILDROOT}/usr/bin/dnsreplay chrpath --delete %{BUILDROOT}/usr/bin/pdnssec end hooks/post-receive -- IPFire 3.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 123205fdbf2624a78449044c11cff5e77dd3f8e3
by git＠ipfire.org 01 Nov '15

01 Nov '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 123205fdbf2624a78449044c11cff5e77dd3f8e3 (commit) from 60fcb2410e4db68625ef080bdf3d99d79e7b5abb (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 123205fdbf2624a78449044c11cff5e77dd3f8e3 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Nov 1 21:49:22 2015 +0100 core95: add upadated backup exclude list. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/95/filelists/files | 1 + 1 file changed, 1 insertion(+) Difference in files: diff --git a/config/rootfiles/core/95/filelists/files b/config/rootfiles/core/95/filelists/files index e81de5a..d9aeaa7 100644 --- a/config/rootfiles/core/95/filelists/files +++ b/config/rootfiles/core/95/filelists/files @@ -16,4 +16,5 @@ srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/firewall/firewall-lib.pl usr/lib/firewall/ipsec-block usr/local/bin/ipsecctrl +var/ipfire/backup/exclude var/ipfire/langs hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 60fcb2410e4db68625ef080bdf3d99d79e7b5abb
by git＠ipfire.org 01 Nov '15

01 Nov '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 60fcb2410e4db68625ef080bdf3d99d79e7b5abb (commit) from 843ca290e1be08ddf614cb087b7ddc24d1dada1c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 60fcb2410e4db68625ef080bdf3d99d79e7b5abb Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Nov 1 11:20:56 2015 +0100 firewall: fix disable MASQERADE in green only mode. using MASQERADE_GREEN="off" will not work because "NETWORK_GREEN" is not correctly defined in green only mode. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: src/initscripts/init.d/firewall | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index 2d462d7..6622071 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -352,8 +352,8 @@ iptables_red_up() { # Outgoing masquerading (don't masqerade IPSEC (mark 50)) iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN - if [ "$IFACE" = "$GREEN_DEV" ]; then - MASQUERADE_GREEN="off" + if [ "${IFACE}" = "${GREEN_DEV}" ]; then + iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN fi local NO_MASQ_NETWORKS hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM November 2015