IPFire-SCM April 2015

ipfire-scm@lists.ipfire.org

1 participants
88 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1245aa72df932f3764be1ba7c5ce09b89b79ac5e
by git＠ipfire.org 19 Apr '15

19 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 1245aa72df932f3764be1ba7c5ce09b89b79ac5e (commit) via 2805275ecca612fc88319f44a4395802150ce17a (commit) from dc127e0faab368273aca09a57cc79f8186547189 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1245aa72df932f3764be1ba7c5ce09b89b79ac5e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Apr 19 11:58:50 2015 +0200 openssl: Fix build by updating the patches commit 2805275ecca612fc88319f44a4395802150ce17a Author: Matthias Fischer <fischerm(a)ipfire.org> Date: Sun Apr 19 00:49:26 2015 +0200 openssl: Update to 1.0.2a ----------------------------------------------------------------------- Summary of changes: lfs/openssl | 10 +++---- ...pmbuild.patch => openssl-1.0.2a-rpmbuild.patch} | 32 ++++++++-------------- 2 files changed, 16 insertions(+), 26 deletions(-) rename src/patches/{openssl-1.0.1e-rpmbuild.patch => openssl-1.0.2a-rpmbuild.patch} (55%) Difference in files: diff --git a/lfs/openssl b/lfs/openssl index 588cf04..6f31e02 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.0.1m +VER = 1.0.2a THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) ifeq "$(MACHINE)" "i586" - CONFIGURE_ARGS = linux-elf no-asm 386 + CONFIGURE_ARGS = linux-generic32 no-asm 386 endif ifeq "$(MACHINE)" "armv5tel" @@ -51,7 +51,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = d143d1555d842a069cb7cc34ba745a06 +$(DL_FILE)_MD5 = a06c547dac9044161a477211049f60ef install : $(TARGET) @@ -82,7 +82,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.0-beta5-enginesdir.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1e-rpmbuild.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.2a-rpmbuild.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.0.1m-weak-ciphers.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-disable-sslv2-sslv3.patch diff --git a/src/patches/openssl-1.0.1e-rpmbuild.patch b/src/patches/openssl-1.0.1e-rpmbuild.patch deleted file mode 100644 index b01520e..0000000 --- a/src/patches/openssl-1.0.1e-rpmbuild.patch +++ /dev/null @@ -1,63 +0,0 @@ -diff -up openssl-1.0.1e/Configure.rpmbuild openssl-1.0.1e/Configure ---- openssl-1.0.1e/Configure.rpmbuild 2014-08-13 19:19:53.211005598 +0200 -+++ openssl-1.0.1e/Configure 2014-08-13 19:29:21.704099285 +0200 -@@ -1675,7 +1676,7 @@ while (<IN>) - elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/) - { - my $sotmp = $1; -- s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/; -+ s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/; - } - elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/) - { -diff -up openssl-1.0.1e/Makefile.org.rpmbuild openssl-1.0.1e/Makefile.org ---- openssl-1.0.1e/Makefile.org.rpmbuild 2013-02-11 16:26:04.000000000 +0100 -+++ openssl-1.0.1e/Makefile.org 2014-08-13 19:19:53.218005759 +0200 -@@ -10,6 +10,7 @@ SHLIB_VERSION_HISTORY= - SHLIB_MAJOR= - SHLIB_MINOR= - SHLIB_EXT= -+SHLIB_SONAMEVER=10 - PLATFORM=dist - OPTIONS= - CONFIGURE_ARGS= -@@ -333,10 +334,9 @@ clean-shared: - link-shared: - @ set -e; for i in $(SHLIBDIRS); do \ - $(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \ -- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \ -+ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \ - LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \ - symlink.$(SHLIB_TARGET); \ -- libs="$$libs -l$$i"; \ - done - - build-shared: do_$(SHLIB_TARGET) link-shared -@@ -347,7 +347,7 @@ do_$(SHLIB_TARGET): - libs="$(LIBKRB5) $$libs"; \ - fi; \ - $(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \ -- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \ -+ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \ - LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \ - LIBDEPS="$$libs $(EX_LIBS)" \ - link_a.$(SHLIB_TARGET); \ ---- a/Configure.old 2015-03-19 18:10:45.101201021 +0000 -+++ b/Configure 2015-03-19 18:11:19.324547495 +0000 -@@ -345,14 +345,14 @@ - #### - # *-generic* is endian-neutral target, but ./config is free to - # throw in -D[BL]_ENDIAN, whichever appropriate... --"linux-generic32","gcc:-O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -+"linux-generic32","gcc:-O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_SONAMEVER)", - "linux-ppc", "gcc:-DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - # It's believed that majority of ARM toolchains predefine appropriate -march. - # If you compiler does not, do complement config command line with one! - "linux-armv4", "gcc:-O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - #### IA-32 targets... - "linux-ia32-icc", "icc:-DL_ENDIAN -O2 -no_cpprt::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", --"linux-elf", "gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -+"linux-elf", "gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_SONAMEVER)", - "linux-aout", "gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out", - #### - "linux-generic64","gcc:-O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", diff --git a/src/patches/openssl-1.0.2a-rpmbuild.patch b/src/patches/openssl-1.0.2a-rpmbuild.patch new file mode 100644 index 0000000..3cab5c2 --- /dev/null +++ b/src/patches/openssl-1.0.2a-rpmbuild.patch @@ -0,0 +1,53 @@ +diff -up openssl-1.0.1e/Configure.rpmbuild openssl-1.0.1e/Configure +--- openssl-1.0.2a.vanilla/Configure 2015-03-19 13:30:36.000000000 +0000 ++++ openssl-1.0.2a/Configure 2015-04-19 09:53:04.381491868 +0000 +@@ -348,7 +348,7 @@ + #### + # *-generic* is endian-neutral target, but ./config is free to + # throw in -D[BL]_ENDIAN, whichever appropriate... +-"linux-generic32","gcc:-O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"linux-generic32","gcc:\$(CFLAGS) -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC:\$(CFLAGS):.so.\$(SHLIB_SONAMEVER)", + "linux-ppc", "gcc:-DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc32_asm}:linux32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", + + ####################################################################### +@@ -1675,7 +1676,7 @@ while (<IN>) + elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/) + { + my $sotmp = $1; +- s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/; ++ s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SONAMEVER) .s$sotmp/; + } + elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/) + { +diff -up openssl-1.0.1e/Makefile.org.rpmbuild openssl-1.0.1e/Makefile.org +--- openssl-1.0.1e/Makefile.org.rpmbuild 2013-02-11 16:26:04.000000000 +0100 ++++ openssl-1.0.1e/Makefile.org 2014-08-13 19:19:53.218005759 +0200 +@@ -10,6 +10,7 @@ SHLIB_VERSION_HISTORY= + SHLIB_MAJOR= + SHLIB_MINOR= + SHLIB_EXT= ++SHLIB_SONAMEVER=10 + PLATFORM=dist + OPTIONS= + CONFIGURE_ARGS= +@@ -333,10 +334,9 @@ clean-shared: + link-shared: + @ set -e; for i in $(SHLIBDIRS); do \ + $(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \ +- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \ ++ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \ + LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \ + symlink.$(SHLIB_TARGET); \ +- libs="$$libs -l$$i"; \ + done + + build-shared: do_$(SHLIB_TARGET) link-shared +@@ -347,7 +347,7 @@ do_$(SHLIB_TARGET): + libs="$(LIBKRB5) $$libs"; \ + fi; \ + $(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \ +- LIBNAME=$$i LIBVERSION=$(SHLIB_MAJOR).$(SHLIB_MINOR) \ ++ LIBNAME=$$i LIBVERSION=$(SHLIB_SONAMEVER) \ + LIBCOMPATVERSIONS=";$(SHLIB_VERSION_HISTORY)" \ + LIBDEPS="$$libs $(EX_LIBS)" \ + link_a.$(SHLIB_TARGET); \ hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. dc127e0faab368273aca09a57cc79f8186547189
by git＠ipfire.org 18 Apr '15

18 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via dc127e0faab368273aca09a57cc79f8186547189 (commit) via c98b743c09cac78a865ca8ef102dacf69a5004da (commit) via f51bc66149e561868041407d4e3e447d2c84ea7b (commit) from fb245d5ec12977d91670dc04590758a4e173dfed (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit dc127e0faab368273aca09a57cc79f8186547189 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Apr 19 01:23:18 2015 +0200 Core 90: Add changed css files. commit c98b743c09cac78a865ca8ef102dacf69a5004da Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Apr 19 01:04:14 2015 +0200 firewall.cgi: Dynamically show/hide DNAT and SNAT configure elements. Fixes #10732. commit f51bc66149e561868041407d4e3e447d2c84ea7b Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Apr 19 01:15:02 2015 +0200 Core 90: Add changed ovpnmain.cgi. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/90/filelists/files | 5 +++++ html/cgi-bin/firewall.cgi | 23 ++++++++++++++++++----- html/html/themes/darkdos/include/style.css | 4 ++++ html/html/themes/ipfire-legacy/include/style.css | 4 ++++ html/html/themes/ipfire/include/css/style.css | 4 ++++ html/html/themes/maniac/include/style.css | 4 ++++ 6 files changed, 39 insertions(+), 5 deletions(-) Difference in files: diff --git a/config/rootfiles/core/90/filelists/files b/config/rootfiles/core/90/filelists/files index 63e7220..d346264 100644 --- a/config/rootfiles/core/90/filelists/files +++ b/config/rootfiles/core/90/filelists/files @@ -7,7 +7,12 @@ etc/rc.d/rcsysinit.d/S90network-trigger srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/fwhosts.cgi srv/web/ipfire/cgi-bin/geoip-block.cgi +srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi +srv/web/ipfire/html/themes/darkdos/include/style.css +srv/web/ipfire/html/themes/ipfire-legacy/include/style.css +srv/web/ipfire/html/themes/ipfire/include/css/style.css +srv/web/ipfire/html/themes/maniac/include/style.css usr/lib/firewall/firewall-lib.pl usr/lib/firewall/rules.pl usr/local/bin/xt_geoip_build diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 3e1b336..c207ec7 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -157,6 +157,19 @@ print<<END; \$("#actions").toggle(); }); + // Hide SNAT items when DNAT is selected and vice versa. + if (\$('input[name=nat]:checked').val() == 'dnat') { + \$('.snat').hide(); + } else { + \$('.dnat').hide(); + } + + // Show/Hide elements when SNAT/DNAT get changed. + \$('input[name=nat]').change(function() { + \$('.snat').toggle(); + \$('.dnat').toggle(); + }); + // Time constraints if(!\$("#USE_TIME_CONSTRAINTS").attr("checked")) { \$("#TIME_CONSTRAINTS").hide(); @@ -1643,7 +1656,7 @@ END $Lang::tr{'fwdfw use nat'} </label> <div class="NAT"> - <table width='100%' border='0'> + <table class='fw-nat' width='100%' border='0'> <tr> <td width='5%'></td> <td width='40%'> @@ -1655,9 +1668,9 @@ END END print <<END; - <td width='25%' align='right'>$Lang::tr{'dnat address'}:</td> + <td width='25%' align='right'><span class='dnat'>$Lang::tr{'dnat address'}:</span></td> <td width='30%'> - <select name='dnat' style='width: 100%;'> + <select name='dnat' class='dnat' style='width: 100%;'> <option value='AUTO' $selected{'dnat'}{'AUTO'}>- $Lang::tr{'automatic'} -</option> <option value='Default IP' $selected{'dnat'}{'Default IP'}>$Lang::tr{'red1'} ($redip)</option> END @@ -1688,9 +1701,9 @@ END $Lang::tr{'fwdfw snat'} </label> </td> - <td width='25%' align='right'>$Lang::tr{'snat new source ip address'}:</td> + <td width='25%' align='right'><span class='snat'>$Lang::tr{'snat new source ip address'}:</span></td> <td width='30%'> - <select name='snat' style='width: 100%;'> + <select name='snat' class='snat' style='width: 100%;'> END foreach my $alias (sort keys %aliases) { diff --git a/html/html/themes/darkdos/include/style.css b/html/html/themes/darkdos/include/style.css index e7140cd..cc4b3c9 100644 --- a/html/html/themes/darkdos/include/style.css +++ b/html/html/themes/darkdos/include/style.css @@ -366,6 +366,10 @@ min-width: 2.0em; max-width: 2.5em; } +table.fw-nat tbody tr td { + height: 2.25em; +} + /* LAYOUT - 3 COLUMNS */ /* Primary content */ diff --git a/html/html/themes/ipfire-legacy/include/style.css b/html/html/themes/ipfire-legacy/include/style.css index d2c458e..288a0fe 100644 --- a/html/html/themes/ipfire-legacy/include/style.css +++ b/html/html/themes/ipfire-legacy/include/style.css @@ -343,6 +343,10 @@ min-width: 2.0em; max-width: 2.5em; } +table.fw-nat tbody tr td { + height: 2.25em; +} + /* LAYOUT - 3 COLUMNS */ /* Primary content */ diff --git a/html/html/themes/ipfire/include/css/style.css b/html/html/themes/ipfire/include/css/style.css index 0e990d6..e0ac3cd 100644 --- a/html/html/themes/ipfire/include/css/style.css +++ b/html/html/themes/ipfire/include/css/style.css @@ -324,3 +324,7 @@ table { .tbl tr:last-child td { border-bottom: 1px solid lightgrey; } + +table.fw-nat tbody tr td { + height: 2.25em; +} diff --git a/html/html/themes/maniac/include/style.css b/html/html/themes/maniac/include/style.css index eca34cb..3cb2741 100644 --- a/html/html/themes/maniac/include/style.css +++ b/html/html/themes/maniac/include/style.css @@ -372,6 +372,10 @@ min-width: 2.0em; max-width: 2.5em; } +table.fw-nat tbody tr td { + height: 2.25em; +} + /* LAYOUT - 3 COLUMNS */ /* Primary content */ hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. fb245d5ec12977d91670dc04590758a4e173dfed
by git＠ipfire.org 18 Apr '15

18 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via fb245d5ec12977d91670dc04590758a4e173dfed (commit) via ab2d15486b4f874ebd832dfce84081031f42b7c5 (commit) from f14de8277aad5e57267d843e63b111e575801ab9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fb245d5ec12977d91670dc04590758a4e173dfed Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Apr 18 23:36:20 2015 +0200 core90: Add changed vpnmain.cgi commit ab2d15486b4f874ebd832dfce84081031f42b7c5 Author: Wolfgang Apolinarski <wolfgang.apolinarski(a)uni-due.de> Date: Sat Apr 18 15:15:45 2015 +0200 Added clientAuth to EKU of client certificate. Fixed the comment. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/90/filelists/files | 1 + html/cgi-bin/vpnmain.cgi | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) Difference in files: diff --git a/config/rootfiles/core/90/filelists/files b/config/rootfiles/core/90/filelists/files index 5f05eb5..63e7220 100644 --- a/config/rootfiles/core/90/filelists/files +++ b/config/rootfiles/core/90/filelists/files @@ -7,6 +7,7 @@ etc/rc.d/rcsysinit.d/S90network-trigger srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/fwhosts.cgi srv/web/ipfire/cgi-bin/geoip-block.cgi +srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/firewall/firewall-lib.pl usr/lib/firewall/rules.pl usr/local/bin/xt_geoip_build diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index b0041ef..4138f4d 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -1673,7 +1673,7 @@ END (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./; (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./; - # Create the Host certificate request + # Create the Client certificate request &General::log("ipsec", "Creating a cert..."); if (open(STDIN, "-|")) { @@ -1700,7 +1700,7 @@ END exit (0); } - # Sign the host certificate request + # Sign the client certificate request &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}..."); #No easy way for specifying the contain of subjectAltName without writing a config file... @@ -1709,6 +1709,7 @@ END basicConstraints=CA:FALSE nsComment="OpenSSL Generated Certificate" subjectKeyIdentifier=hash + extendedKeyUsage=clientAuth authorityKeyIdentifier=keyid,issuer:always END ; hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f14de8277aad5e57267d843e63b111e575801ab9
by git＠ipfire.org 18 Apr '15

18 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f14de8277aad5e57267d843e63b111e575801ab9 (commit) from 0389942c2bc24b93de68269606bcd11a4ce57dab (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f14de8277aad5e57267d843e63b111e575801ab9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Apr 18 16:42:22 2015 +0200 xtables-addon: Build all matches and targets ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/xtables-addons | 26 +++++++++++++++++++++++ config/xtables-addons/mconfig | 38 +++++++++++++++++----------------- 2 files changed, 45 insertions(+), 19 deletions(-) Difference in files: diff --git a/config/rootfiles/common/xtables-addons b/config/rootfiles/common/xtables-addons index 9053c28..f6e85ae 100644 --- a/config/rootfiles/common/xtables-addons +++ b/config/rootfiles/common/xtables-addons @@ -1,7 +1,33 @@ +lib/xtables/libxt_ACCOUNT.so +lib/xtables/libxt_CHAOS.so +lib/xtables/libxt_DELUDE.so +lib/xtables/libxt_DHCPMAC.so +lib/xtables/libxt_DNETMAP.so +lib/xtables/libxt_ECHO.so +lib/xtables/libxt_IPMARK.so +lib/xtables/libxt_LOGMARK.so +lib/xtables/libxt_TARPIT.so +lib/xtables/libxt_condition.so +lib/xtables/libxt_dhcpmac.so +lib/xtables/libxt_fuzzy.so lib/xtables/libxt_geoip.so +lib/xtables/libxt_iface.so +lib/xtables/libxt_ipp2p.so +lib/xtables/libxt_ipv4options.so +lib/xtables/libxt_length2.so +lib/xtables/libxt_lscan.so +lib/xtables/libxt_pknock.so +lib/xtables/libxt_psd.so +lib/xtables/libxt_quota2.so +#usr/lib/libxt_ACCOUNT_cl.la +#usr/lib/libxt_ACCOUNT_cl.so +usr/lib/libxt_ACCOUNT_cl.so.0 +usr/lib/libxt_ACCOUNT_cl.so.0.0.0 #usr/libexec/xtables-addons usr/libexec/xtables-addons/xt_geoip_build usr/libexec/xtables-addons/xt_geoip_dl +usr/sbin/iptaccount #usr/share/man/man1/xt_geoip_build.1 #usr/share/man/man1/xt_geoip_dl.1 +#usr/share/man/man8/iptaccount.8 #usr/share/man/man8/xtables-addons.8 diff --git a/config/xtables-addons/mconfig b/config/xtables-addons/mconfig index 92e47f0..933d717 100644 --- a/config/xtables-addons/mconfig +++ b/config/xtables-addons/mconfig @@ -1,24 +1,24 @@ # -*- Makefile -*- # -build_ACCOUNT=n -build_CHAOS=n -build_DELUDE=n -build_DHCPMAC=n -build_DNETMAP=n -build_ECHO=n -build_IPMARK=n -build_LOGMARK=n +build_ACCOUNT=m +build_CHAOS=m +build_DELUDE=m +build_DHCPMAC=m +build_DNETMAP=m +build_ECHO=m +build_IPMARK=m +build_LOGMARK=m build_SYSRQ=n -build_TARPIT=n -build_condition=n -build_fuzzy=n +build_TARPIT=m +build_condition=m +build_fuzzy=m build_geoip=m build_gradm=n -build_iface=n -build_ipp2p=n -build_ipv4options=n -build_length2=n -build_lscan=n -build_pknock=n -build_psd=n -build_quota2=n +build_iface=m +build_ipp2p=m +build_ipv4options=m +build_length2=m +build_lscan=m +build_pknock=m +build_psd=m +build_quota2=m hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0389942c2bc24b93de68269606bcd11a4ce57dab
by git＠ipfire.org 18 Apr '15

18 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0389942c2bc24b93de68269606bcd11a4ce57dab (commit) via 49b70d62a939c564bb1386d3f5b13eb1f98bd55f (commit) via db5b5de9a9cbb53b713cbc95a80021e458a5041f (commit) via 46d3a4cb16ea09393fa141f56478e7d1d247b67c (commit) via b8fe6ca756adb45f7ea92b6211204d17fc701ff1 (commit) via 30654fd82b9185597689c701c99987e02de2a959 (commit) via cbc5a4374fd19c8657792f14813da52b801fd681 (commit) via 91d6b6ef07fc9915dcb2ca8ed0147118615b690d (commit) via e6c4f090b694a8d102da5b2765dcdac871f20517 (commit) via 054d584786a60ed443d96642eb5a094e265da637 (commit) via ef4edcfb203a3610efb7e47cb6f4e3337cb2e312 (commit) via a8e59d803594f5af0ac1532e89aac6bd11600ecf (commit) via 0ff5b2b0ac39be6954e0b727e21d98c631bb051b (commit) via 64d886f53f0dcd5c6284b56b4965ad19eaf4d80a (commit) via 85abe3323a0b43976686d1c8e875861c7510abce (commit) via d9f47d9b9e5041ee9b9d5fc40471cffe67d2a35e (commit) via 1ed8aedfdb9af8deaafac797b85b68c407feb6d7 (commit) via 0bb4b135d121cec8efbae6c63b3ea6cf85eacb97 (commit) via e24668f99a053d2073de80fe2d0dc8c5d73d2cbc (commit) via 663221a256af64d3bfe8c9bc0fe534059eb7dcee (commit) via 16bbdeb988cec0e4af25a0be334e23842ad9414a (commit) via 93bfe63d55bf611887fbc25c251c6fb0ce2ab1d4 (commit) via b9ca2fa60f1ac0127d0bbddb016d0acb578e660d (commit) via 6897c329b5b323567267d364fefdf01a9bff5688 (commit) via 2e3cb8edbc9f203adf6d702cfddf465ccaf2e2d7 (commit) via bc9446c65ff048ebce8c0665cc0efe2231fb37de (commit) via d9bf6d8b2f195e8d1f0287af19cf9fed331e9377 (commit) via c0a97a0f4a9c7787801015301a34a01da39596f5 (commit) via e472a10de91406b6440add5245de388cb4ab34f5 (commit) via 1dcd87157d4b52ee304094a586674dcb4919c3ba (commit) via 4313aa18e9e3b3f6717946b88c8a67f79dea40be (commit) via 192a8266e2571a324a793fa512a9c852661ae25b (commit) via a2b7328a265fb414929d8194b509580054f5c753 (commit) via e497310ee02c7b6f2071bf021f26bc254d97f439 (commit) via 0909c0d15058ddf023369afefab634781cc2702d (commit) via 58c74d078780b88bf060fa179bd55dd483164b87 (commit) via f2d941436b9721cdbfc37f0c7769088d14621d13 (commit) via 211694e588cf65dba21b6f9eb32f1ca7fd4520eb (commit) via 593c32275adf2b5bc7a887ad1d14350863ee57e4 (commit) via cab02e2a5f77eaf0bc12f7c115348baf2a04b699 (commit) via 484e01fc3791c7cce818c4d578b5e883846b4c51 (commit) via 2285f9da225d245dda6653ce05de9665bd9a792d (commit) via ca842e182227d69ea70e90e18f5a81d458cf06d3 (commit) via cc26ba71a193700177d8bc118e79b050964562f7 (commit) via 11ad82532e54fedd2a9b55f5c4a7b2f7a62a2002 (commit) via 91634dbe88cc85a77b1b30246e527d3dac908f24 (commit) via cebb1b7cb1327b87e3fa6932eee151a26a9f85c2 (commit) via b8e0573b5c698df6ba5587da9c4fc9595288ae79 (commit) via 72074fcdd2169a4698d5a5dec288e2adeca9af67 (commit) via bf235e962cdd2d0d95d9a6ccfef0b449d181bb04 (commit) via 67716b19bb5ab806fdd63f630e53c158dabedf2d (commit) from d54a2ce45232412d2b674df51cc8012d8e2c846d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0389942c2bc24b93de68269606bcd11a4ce57dab Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Apr 18 16:16:01 2015 +0200 Update translations commit 49b70d62a939c564bb1386d3f5b13eb1f98bd55f Merge: d54a2ce db5b5de Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Apr 18 16:15:17 2015 +0200 Merge remote-tracking branch 'stevee/core-90-geoip' into next commit db5b5de9a9cbb53b713cbc95a80021e458a5041f Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Apr 16 22:00:51 2015 +0200 Core90: Update crontab. commit 46d3a4cb16ea09393fa141f56478e7d1d247b67c Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Apr 16 20:37:00 2015 +0200 Core90: Add GeoIP to update. commit b8fe6ca756adb45f7ea92b6211204d17fc701ff1 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Apr 16 19:40:53 2015 +0200 Roofile updates for GeoIP related files. commit 30654fd82b9185597689c701c99987e02de2a959 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Apr 16 19:39:11 2015 +0200 configroot: Add geoip related files. Create required empty files and install geoip-functions.pl to desired destination. commit cbc5a4374fd19c8657792f14813da52b801fd681 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Apr 16 10:51:44 2015 +0200 Revert "perl-Locale-Country: Update country codes to version 3.33." This reverts commit bf235e962cdd2d0d95d9a6ccfef0b449d181bb04. commit 91d6b6ef07fc9915dcb2ca8ed0147118615b690d Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Apr 16 10:51:03 2015 +0200 Revert roofile update for Locale-Country. This reverts commit f2d941436b9721cdbfc37f0c7769088d14621d13. commit e6c4f090b694a8d102da5b2765dcdac871f20517 Merge: 30986db 054d584 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed Apr 15 17:10:49 2015 +0200 Merge branch 'next-geoip' into core-90-geoip commit 054d584786a60ed443d96642eb5a094e265da637 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Apr 9 18:14:48 2015 +0200 de.pl: Fix umlauts in GeoIP related strings. This issue has been intruced in commit 0ff5b2b0ac39be6954e0b727e21d98c631bb051b. commit ef4edcfb203a3610efb7e47cb6f4e3337cb2e312 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed Apr 1 20:29:00 2015 +0200 crontab: Fix syntax for xt_geoip_update call. commit a8e59d803594f5af0ac1532e89aac6bd11600ecf Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Tue Mar 31 22:14:56 2015 +0200 GeoIP: Update english translation. commit 0ff5b2b0ac39be6954e0b727e21d98c631bb051b Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Tue Mar 31 19:45:15 2015 +0200 GeoIP: Add german translation. commit 64d886f53f0dcd5c6284b56b4965ad19eaf4d80a Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Tue Mar 31 18:56:32 2015 +0200 crontab: Call xt_geoip_update random once a month. commit 85abe3323a0b43976686d1c8e875861c7510abce Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Mar 22 18:53:17 2015 +0100 Add spanish translations for GeoIP related strings. A big thanks to Roberto Peña to provide them on the IPFire forum. http://forum.ipfire.org/viewtopic.php?f=52&t=11950&sid=f50fe6f51e0f45f1402c… commit d9f47d9b9e5041ee9b9d5fc40471cffe67d2a35e Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Mar 19 22:09:24 2015 +0100 xt_geoip_update: Add support for upstream proxy. commit 1ed8aedfdb9af8deaafac797b85b68c407feb6d7 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Mar 15 11:41:50 2015 +0100 fwhosts.cgi: Fix fw-reload detection when adding new entries to a geoip group. Read-in firewall config files for detection if the current group is used by at least one firewall rule and mark the firewall to need a reload if neccessary. Fixes #10771. commit 0bb4b135d121cec8efbae6c63b3ea6cf85eacb97 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Mar 8 10:09:16 2015 +0100 rules.pl: Flush GEOIPBLOCK chain when the feature will be switched off. Otherwise existing rules still remain in the chain and will be processed even geoipblock has been disabled. commit e24668f99a053d2073de80fe2d0dc8c5d73d2cbc Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Mar 7 22:39:32 2015 +0100 networking/red.up/99-geoip-database: Fix empty folder check. commit 663221a256af64d3bfe8c9bc0fe534059eb7dcee Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Mar 7 21:31:27 2015 +0100 xt_geoip_update: Fix script path. commit 16bbdeb988cec0e4af25a0be334e23842ad9414a Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Mar 7 21:30:19 2015 +0100 networking/red.up/99-geoip-database: Fix typo. commit 93bfe63d55bf611887fbc25c251c6fb0ce2ab1d4 Merge: e60cd3a b9ca2fa Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Mar 15 11:38:45 2015 +0100 Merge branch 'seventeen-geoip' into next-geoip commit b9ca2fa60f1ac0127d0bbddb016d0acb578e660d Author: Alexander Marx <amarx(a)ipfire.org> Date: Tue Feb 17 17:01:42 2015 +0100 Add support for generating GeoIP-based firewall rules. This commit adds support to the rules.pl and firewall-lib.pl to generate correct iptables commands for inserting GeoIP-based firewall rules into the kernel. commit 6897c329b5b323567267d364fefdf01a9bff5688 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Tue Feb 17 08:41:16 2015 +0100 xt_geoip_update: Fix mktemp calls. commit 2e3cb8edbc9f203adf6d702cfddf465ccaf2e2d7 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Feb 14 19:18:27 2015 +0100 stage2: Rootfile update. commit bc9446c65ff048ebce8c0665cc0efe2231fb37de Merge: d9bf6d8 309b7de Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Feb 14 12:34:31 2015 +0100 Merge branch 'master' of ssh://git.ipfire.org/pub/git/ipfire-2.x into seventeen-geoip Conflicts: make.sh commit d9bf6d8b2f195e8d1f0287af19cf9fed331e9377 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Feb 12 20:10:05 2015 +0100 Language file update. commit c0a97a0f4a9c7787801015301a34a01da39596f5 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Feb 8 18:41:44 2015 +0100 firewall.cgi: Add support for GeoIP locations / GeoIP groups. commit e472a10de91406b6440add5245de388cb4ab34f5 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Feb 8 18:24:51 2015 +0100 geoip-block.cgi: Use geoip-functions.pl. commit 1dcd87157d4b52ee304094a586674dcb4919c3ba Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Feb 8 18:23:01 2015 +0100 geoip-functions.pl: A collection of functions dealing with GeoIP. commit 4313aa18e9e3b3f6717946b88c8a67f79dea40be Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Feb 8 13:37:06 2015 +0100 fwhosts.cgi: Add support for GeoIP groups. commit 192a8266e2571a324a793fa512a9c852661ae25b Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 14:07:06 2015 +0100 geoip-block.cgi: Requires firewall-lib.pl. commit a2b7328a265fb414929d8194b509580054f5c753 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 13:52:29 2015 +0100 Language file update. commit e497310ee02c7b6f2071bf021f26bc254d97f439 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 13:51:28 2015 +0100 Add "GeoIP Block" to firewall menu. commit 0909c0d15058ddf023369afefab634781cc2702d Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 13:40:34 2015 +0100 Automatically download and update GeoIP Databases. commit 58c74d078780b88bf060fa179bd55dd483164b87 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 13:36:06 2015 +0100 lfs/stage2: Add directory for geoip databases. commit f2d941436b9721cdbfc37f0c7769088d14621d13 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 08:23:53 2015 +0100 Rootfile update. commit 211694e588cf65dba21b6f9eb32f1ca7fd4520eb Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 01:05:45 2015 +0100 firewall: Add support for geoipblock to rules.pl. commit 593c32275adf2b5bc7a887ad1d14350863ee57e4 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 01:03:21 2015 +0100 Move "sub get_geoip_locations" to firewall-lib. commit cab02e2a5f77eaf0bc12f7c115348baf2a04b699 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 00:57:23 2015 +0100 Add "GEOIPBLOCK" chains to firewall initscript. commit 484e01fc3791c7cce818c4d578b5e883846b4c51 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 00:56:00 2015 +0100 Add default config file for geoipblock. commit 2285f9da225d245dda6653ce05de9665bd9a792d Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 00:55:17 2015 +0100 Add xt_geoip_update script. This script will download the latest available geoip database, convert it into a compatible binary format and move it to the correct destination. commit ca842e182227d69ea70e90e18f5a81d458cf06d3 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Jan 4 00:54:46 2015 +0100 xt_geoip_build: Script to convert GeoIP CSV into compatible binary databases. This is a cleaned up version of the original build script shipped by the xtables-addons source code. The following abilities have been removed: * IPv6 support * Big Endian commit cc26ba71a193700177d8bc118e79b050964562f7 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Jan 3 20:22:05 2015 +0100 header.pl: Increase maximum allowed size of hashes. The "getcgihash" function only allowed hashes with a maximum size of 512kb, which was to small for the new geoip-block.cgi. As a result of this some form data were cut-off and couldn't be processed correctly. commit 11ad82532e54fedd2a9b55f5c4a7b2f7a62a2002 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Jan 3 20:20:45 2015 +0100 Language file update for geoip blocking. commit 91634dbe88cc85a77b1b30246e527d3dac908f24 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Jan 3 20:20:10 2015 +0100 geoip-block.cgi: New CGI for managing geoip blocking. commit cebb1b7cb1327b87e3fa6932eee151a26a9f85c2 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Jan 3 20:15:28 2015 +0100 general-functions.pl: Add function to get full country name. This function will return the full name a country specified by it's country shortcut. It also will provide some additional names which are not handled by the perl locale module but are parts of ISO 3166. commit b8e0573b5c698df6ba5587da9c4fc9595288ae79 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Jan 3 14:07:49 2015 +0100 xtables-addons: New package. The xtables-addons package provides many additional filter modules for iptables. Currently we are only building the "geoip" module which can be used to create firewall rules which will do actions based on the country membership of the senders/targets address. In order to build the required kernel modules I had to change build order for several packages as well. commit 72074fcdd2169a4698d5a5dec288e2adeca9af67 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Jan 3 14:03:20 2015 +0100 perl-Text-CSV_XS: New package. This perl module is required to convert the provided geoip databases in CSV format into a useable binary format for the geoip module. commit bf235e962cdd2d0d95d9a6ccfef0b449d181bb04 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Jan 3 14:01:43 2015 +0100 perl-Locale-Country: Update country codes to version 3.33. commit 67716b19bb5ab806fdd63f630e53c158dabedf2d Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sat Dec 20 16:02:29 2014 +0100 perl-Text-CSV_XS: New package. This is a dependency for the xtables-geoip module to convert the only in the cvs provided geoip list into a compatible binary format. ----------------------------------------------------------------------- Summary of changes: config/cfgroot/general-functions.pl | 1 + config/cfgroot/geoip-functions.pl | 90 ++++ config/cfgroot/header.pl | 2 +- config/cron/crontab | 3 + config/firewall/firewall-lib.pl | 61 +++ config/firewall/geoipblock | 1 + config/firewall/rules.pl | 49 +- config/menu/50-firewall.menu | 6 + config/rootfiles/common/apache2 | 1 + config/rootfiles/common/armv5tel/initscripts | 1 + config/rootfiles/common/configroot | 3 + config/rootfiles/common/i586/initscripts | 1 + config/rootfiles/common/perl-Text-CSV_XS | 8 + config/rootfiles/common/stage2 | 4 + config/rootfiles/common/xtables-addons | 7 + config/rootfiles/core/90/exclude | 4 +- config/rootfiles/core/90/filelists/files | 12 + .../rootfiles/core/90/filelists/perl-Text-CSV_XS | 1 + config/rootfiles/core/90/filelists/xtables-addons | 1 + config/rootfiles/core/90/update.sh | 26 + config/xtables-addons/mconfig | 24 + doc/language_issues.de | 8 + doc/language_issues.en | 8 + doc/language_issues.es | 10 + doc/language_issues.fr | 14 + doc/language_issues.it | 17 + doc/language_issues.nl | 14 + doc/language_issues.pl | 10 + doc/language_issues.ru | 14 + doc/language_issues.tr | 14 + doc/language_missings | 70 +++ html/cgi-bin/firewall.cgi | 67 ++- html/cgi-bin/fwhosts.cgi | 534 ++++++++++++++++++++- html/cgi-bin/geoip-block.cgi | 263 ++++++++++ langs/de/cgi-bin/de.pl | 20 + langs/en/cgi-bin/en.pl | 20 + langs/es/cgi-bin/es.pl | 10 + lfs/configroot | 5 +- lfs/{Mail-Tools => perl-Text-CSV_XS} | 12 +- lfs/stage2 | 2 +- lfs/{kmod => xtables-addons} | 52 +- make.sh | 13 +- src/initscripts/init.d/firewall | 5 + .../init.d/networking/red.up/99-geoip-database | 23 + src/scripts/xt_geoip_build | 89 ++++ src/scripts/xt_geoip_update | 137 ++++++ 46 files changed, 1701 insertions(+), 36 deletions(-) create mode 100644 config/cfgroot/geoip-functions.pl mode change 100755 => 100644 config/firewall/firewall-lib.pl create mode 100644 config/firewall/geoipblock mode change 100755 => 100644 config/firewall/rules.pl create mode 100644 config/rootfiles/common/perl-Text-CSV_XS create mode 100644 config/rootfiles/common/xtables-addons create mode 120000 config/rootfiles/core/90/filelists/perl-Text-CSV_XS create mode 120000 config/rootfiles/core/90/filelists/xtables-addons create mode 100644 config/xtables-addons/mconfig create mode 100644 html/cgi-bin/geoip-block.cgi copy lfs/{Mail-Tools => perl-Text-CSV_XS} (93%) copy lfs/{kmod => xtables-addons} (77%) create mode 100644 src/initscripts/init.d/networking/red.up/99-geoip-database create mode 100644 src/scripts/xt_geoip_build create mode 100644 src/scripts/xt_geoip_update Difference in files: diff --git a/config/cfgroot/general-functions.pl b/config/cfgroot/general-functions.pl index 35ae7c0..29f7e8c 100644 --- a/config/cfgroot/general-functions.pl +++ b/config/cfgroot/general-functions.pl @@ -17,6 +17,7 @@ package General; use strict; use Socket; use IO::Socket; +use Locale::Country; use Net::SSLeay; use Net::IPv4Addr qw(:all); $|=1; # line buffering diff --git a/config/cfgroot/geoip-functions.pl b/config/cfgroot/geoip-functions.pl new file mode 100644 index 0000000..68b6f50 --- /dev/null +++ b/config/cfgroot/geoip-functions.pl @@ -0,0 +1,90 @@ +#!/usr/bin/perl -w +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2015 IPFire Team <info(a)ipfire.org>. # +# # +############################################################################ + +package GeoIP; + +use Locale::Country; + +# Function to get the flag icon for a specified country code. +sub get_flag_icon($) { + my ($input) = @_; + + # Webserver's root dir. (Required for generating full path) + my $webroot = "/srv/web/ipfire/html"; + + # Directory which contains the flag icons. + my $flagdir = "/images/flags"; + + # File extension of the country flags. + my $ext = "png"; + + # Remove whitespaces. + chomp($input); + + # Convert given country code to lower case. + my $ccode = lc($input); + + # Generate filename, based on the contry code in lower case + # and the defined file extension. + my $file = join('.', $ccode,$ext); + + # Generate path inside webroot to the previously generated file. + my $flag_icon = join('/', $flagdir,$file); + + # Generate absolute path to the icon file. + my $absolute_path = join('', $webroot,$flag_icon); + + # Check if the a icon file exists. + if (-e "$absolute_path") { + # Return content of flag_icon. + return $flag_icon; + } +} + +# Function to get the county name by a given country code. +sub get_full_country_name($) { + my ($input) = @_; + my $name; + + # Remove whitespaces. + chomp($input); + + # Convert input into lower case format. + my $code = lc($input); + + # Handle country codes which are not in the list. + if ($code eq "a1") { $name = "Anonymous Proxy" } + elsif ($code eq "a2") { $name = "Satellite Provider" } + elsif ($code eq "o1") { $name = "Other Country" } + elsif ($code eq "ap") { $name = "Asia/Pacific Region" } + elsif ($code eq "eu") { $name = "Europe" } + elsif ($code eq "yu") { $name = "Yugoslavia" } + else { + # Use perl built-in module to get the country code. + $name = &Locale::Country::code2country($code); + } + + return $name; +} + +1; diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl index cf895bf..974c4d8 100644 --- a/config/cfgroot/header.pl +++ b/config/cfgroot/header.pl @@ -263,7 +263,7 @@ sub getcgihash { return if ($ENV{'REQUEST_METHOD'} ne 'POST'); if (!$params->{'wantfile'}) { $CGI::DISABLE_UPLOADS = 1; - $CGI::POST_MAX = 512 * 1024; + $CGI::POST_MAX = 1024 * 1024; } else { $CGI::POST_MAX = 10 * 1024 * 1024; } diff --git a/config/cron/crontab b/config/cron/crontab index d78d08f..d5e5d7e 100644 --- a/config/cron/crontab +++ b/config/cron/crontab @@ -57,3 +57,6 @@ HOME=/ # Re-read firewall rules every Sunday in March, October and November to take care of daylight saving time 00 3 * 3 0 /usr/local/bin/timezone-transition /usr/local/bin/firewallctrl 00 2 * 10-11 0 /usr/local/bin/timezone-transition /usr/local/bin/firewallctrl + +# Update GeoIP database once a month. +%monthly,random * * * [ -f "/var/ipfire/red/active" ] && /usr/local/bin/xt_geoip_update >/dev/null 2>&1 diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl old mode 100755 new mode 100644 index f3cd67f..b389fac --- a/config/firewall/firewall-lib.pl +++ b/config/firewall/firewall-lib.pl @@ -27,6 +27,7 @@ package fwlib; my %customnetwork=(); my %customhost=(); my %customgrp=(); +my %customgeoipgrp=(); my %customservice=(); my %customservicegrp=(); my %ccdnet=(); @@ -42,6 +43,7 @@ require '/var/ipfire/general-functions.pl'; my $confignet = "${General::swroot}/fwhosts/customnetworks"; my $confighost = "${General::swroot}/fwhosts/customhosts"; my $configgrp = "${General::swroot}/fwhosts/customgroups"; +my $configgeoipgrp = "${General::swroot}/fwhosts/customgeoipgrp"; my $configsrv = "${General::swroot}/fwhosts/customservices"; my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp"; my $configccdnet = "${General::swroot}/ovpn/ccd.conf"; @@ -59,6 +61,7 @@ my $netsettings = "${General::swroot}/ethernet/settings"; &General::readhasharray("$confignet", \%customnetwork); &General::readhasharray("$confighost", \%customhost); &General::readhasharray("$configgrp", \%customgrp); +&General::readhasharray("$configgeoipgrp", \%customgeoipgrp); &General::readhasharray("$configccdnet", \%ccdnet); &General::readhasharray("$configccdhost", \%ccdhost); &General::readhasharray("$configipsec", \%ipsecconf); @@ -300,6 +303,17 @@ sub get_addresses } } } + }elsif ($addr_type ~~ ["cust_geoip_src", "cust_geoip_tgt"] && $value =~ "group:") { + $value=substr($value,6); + foreach my $grp (sort {$a <=> $b} keys %customgeoipgrp) { + if ($customgeoipgrp{$grp}[0] eq $value) { + my @address = &get_address($addr_type, $customgeoipgrp{$grp}[2], $type); + + if (@address) { + push(@addresses, @address); + } + } + } } else { my @address = &get_address($addr_type, $value, $type); @@ -414,6 +428,20 @@ sub get_address } } + # Handle rule options with GeoIP as source. + } elsif ($key eq "cust_geoip_src") { + # Get external interface. + my $external_interface = &get_external_interface(); + + push(@ret, ["-m geoip --src-cc $value", "$external_interface"]); + + # Handle rule options with GeoIP as target. + } elsif ($key eq "cust_geoip_tgt") { + # Get external interface. + my $external_interface = &get_external_interface(); + + push(@ret, ["-m geoip --dst-cc $value", "$external_interface"]); + # If nothing was selected, we assume "any". } else { push(@ret, ["0/0", ""]); @@ -552,4 +580,37 @@ sub get_internal_firewall_ip_address return 0; } +sub get_geoip_locations() { + # Path to the directory which contains the binary geoip + # databases. + my $directory="/usr/share/xt_geoip/LE"; + + # Array to store the final country list. + my @country_codes = (); + + # Open location and do a directory listing. + opendir(DIR, "$directory"); + my @locations = readdir(DIR); + closedir(DIR); + + # Loop through the directory listing, and cut of the file extensions. + foreach my $location (sort @locations) { + # skip . and .. + next if($location =~ /^\.$/); + next if($location =~ /^\.\.$/); + + # Remove whitespaces. + chomp($location); + + # Cut-off file extension. + my ($country_code, $extension) = split(/\./, $location); + + # Add country code to array. + push(@country_codes, $country_code); + } + + # Return final array. + return @country_codes; +} + return 1; diff --git a/config/firewall/geoipblock b/config/firewall/geoipblock new file mode 100644 index 0000000..4d483d3 --- /dev/null +++ b/config/firewall/geoipblock @@ -0,0 +1 @@ +GEOIPBLOCK_ENABLED=off diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl old mode 100755 new mode 100644 index 8abc675..5358996 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -60,6 +60,7 @@ my $configfwdfw = "${General::swroot}/firewall/config"; my $configinput = "${General::swroot}/firewall/input"; my $configoutgoing = "${General::swroot}/firewall/outgoing"; my $p2pfile = "${General::swroot}/firewall/p2protocols"; +my $geoipfile = "${General::swroot}/firewall/geoipblock"; my $configgrp = "${General::swroot}/fwhosts/customgroups"; my $netsettings = "${General::swroot}/ethernet/settings"; @@ -102,6 +103,9 @@ sub main { # Load P2P block rules. &p2pblock(); + # Load GeoIP block rules. + &geoipblock(); + # Reload firewall policy. run("/usr/sbin/firewall-policy"); @@ -365,13 +369,17 @@ sub buildrules { my @source_options = (); if ($source =~ /mac/) { push(@source_options, $source); - } elsif ($source) { + } elsif ($source =~ /-m geoip/) { + push(@source_options, $source); + } elsif($source) { push(@source_options, ("-s", $source)); } # Prepare destination options. my @destination_options = (); - if ($destination) { + if ($destination =~ /-m geoip/) { + push(@destination_options, $destination); + } elsif ($destination) { push(@destination_options, ("-d", $destination)); } @@ -570,6 +578,43 @@ sub p2pblock { } } +sub geoipblock { + my %geoipsettings = (); + + # Check if the geoip settings file exists + if (-e "$geoipfile") { + # Read settings file + &General::readhash("$geoipfile", \%geoipsettings); + } else { + # Drop active rules. + run("$IPTABLES -F GEOIPBLOCK"); + + # Exit submodule, go on processing the remaining script + return; + } + + # If geoip blocking is not enabled, we are finished here. + if ($geoipsettings{'GEOIPBLOCK_ENABLED'} ne "on") { + # Exit submodule. Process remaining script. + return; + } + + # Get supported locations. + my @locations = &fwlib::get_geoip_locations(); + + # Flush iptables chain. + run("$IPTABLES -F GEOIPBLOCK"); + + # Loop through all supported geoip locations and + # create iptables rules, if blocking this country + # is enabled. + foreach my $location (@locations) { + if($geoipsettings{$location} eq "on") { + run("$IPTABLES -A GEOIPBLOCK -m geoip --src-cc $location -j DROP"); + } + } +} + sub get_protocols { my $hash = shift; my $key = shift; diff --git a/config/menu/50-firewall.menu b/config/menu/50-firewall.menu index e872e64..7271b32 100644 --- a/config/menu/50-firewall.menu +++ b/config/menu/50-firewall.menu @@ -22,6 +22,12 @@ 'title' => "P2P-Block", 'enabled' => 1, }; + $subfirewall->{'50.geoipblock'} = { + 'caption' => $Lang::tr{'geoipblock'}, + 'uri' => '/cgi-bin/geoip-block.cgi', + 'title' => $Lang::tr{'geoipblock'}, + 'enabled' => 1, + }; $subfirewall->{'60.wireless'} = { 'caption' => $Lang::tr{'blue access'}, 'uri' => '/cgi-bin/wireless.cgi', diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2 index 55dd04e..8033a87 100644 --- a/config/rootfiles/common/apache2 +++ b/config/rootfiles/common/apache2 @@ -1402,6 +1402,7 @@ srv/web/ipfire/cgi-bin/extrahd.cgi srv/web/ipfire/cgi-bin/fireinfo.cgi srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/fwhosts.cgi +srv/web/ipfire/cgi-bin/geoip-block.cgi srv/web/ipfire/cgi-bin/gpl.cgi srv/web/ipfire/cgi-bin/gui.cgi srv/web/ipfire/cgi-bin/hardwaregraphs.cgi diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts index 8ddf34a..b4cd8f8 100644 --- a/config/rootfiles/common/armv5tel/initscripts +++ b/config/rootfiles/common/armv5tel/initscripts @@ -92,6 +92,7 @@ etc/rc.d/init.d/networking/red.up/50-ipsec etc/rc.d/init.d/networking/red.up/50-ovpn etc/rc.d/init.d/networking/red.up/98-leds etc/rc.d/init.d/networking/red.up/99-fireinfo +etc/rc.d/init.d/networking/red.up/99-geoip-database etc/rc.d/init.d/networking/red.up/99-pakfire-update etc/rc.d/init.d/networking/wpa_supplicant.exe #etc/rc.d/init.d/nfs-server diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index eaf1af6..f6cbb61 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -52,6 +52,7 @@ var/ipfire/extrahd var/ipfire/firewall #var/ipfire/firewall/config #var/ipfire/firewall/dmz +#var/ipfire/firewall/geoipblock #var/ipfire/firewall/input #var/ipfire/firewall/nat #var/ipfire/firewall/outgoing @@ -59,6 +60,7 @@ var/ipfire/firewall #var/ipfire/firewall/settings var/ipfire/fwhosts #var/ipfire/fwhosts/customgroups +#var/ipfire/fwhosts/customgeoipgrp #var/ipfire/fwhosts/customhosts #var/ipfire/fwhosts/customnetworks #var/ipfire/fwhosts/customservicegrp @@ -69,6 +71,7 @@ var/ipfire/fwlogs #var/ipfire/fwlogs/ipsettings #var/ipfire/fwlogs/portsettings var/ipfire/general-functions.pl +var/ipfire/geoip-functions.pl var/ipfire/graphs.pl var/ipfire/header.pl var/ipfire/isdn diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts index 3d4dd62..878ba66 100644 --- a/config/rootfiles/common/i586/initscripts +++ b/config/rootfiles/common/i586/initscripts @@ -94,6 +94,7 @@ etc/rc.d/init.d/networking/red.up/50-ipsec etc/rc.d/init.d/networking/red.up/50-ovpn etc/rc.d/init.d/networking/red.up/98-leds etc/rc.d/init.d/networking/red.up/99-fireinfo +etc/rc.d/init.d/networking/red.up/99-geoip-database etc/rc.d/init.d/networking/red.up/99-pakfire-update etc/rc.d/init.d/networking/wpa_supplicant.exe #etc/rc.d/init.d/nfs-server diff --git a/config/rootfiles/common/perl-Text-CSV_XS b/config/rootfiles/common/perl-Text-CSV_XS new file mode 100644 index 0000000..ca2f642 --- /dev/null +++ b/config/rootfiles/common/perl-Text-CSV_XS @@ -0,0 +1,8 @@ +#usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi/Text +usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi/Text/CSV_XS.pm +#usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi/auto/Text +#usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi/auto/Text/CSV_XS +#usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi/auto/Text/CSV_XS/.packlist +#usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi/auto/Text/CSV_XS/CSV_XS.bs +usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi/auto/Text/CSV_XS/CSV_XS.so +#usr/share/man/man3/Text::CSV_XS.3 diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index f506daf..90e28d9 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -101,6 +101,8 @@ usr/local/bin/timecheck usr/local/bin/timezone-transition usr/local/bin/update-bootloader usr/local/bin/update-lang-cache +usr/local/bin/xt_geoip_build +usr/local/bin/xt_geoip_update #usr/local/include #usr/local/lib #usr/local/lib/sse2 @@ -120,6 +122,7 @@ usr/local/bin/update-lang-cache #usr/local/share/man/man8 #usr/local/share/misc #usr/local/share/terminfo +#usr/local/share/xt_geoip #usr/local/share/zoneinfo #usr/local/src #usr/sbin @@ -142,6 +145,7 @@ usr/share/doc/licenses/GPLv3 #usr/share/man/man8 #usr/share/misc #usr/share/terminfo +#usr/share/xt_geoip #usr/share/zoneinfo #var #var/cache diff --git a/config/rootfiles/common/xtables-addons b/config/rootfiles/common/xtables-addons new file mode 100644 index 0000000..9053c28 --- /dev/null +++ b/config/rootfiles/common/xtables-addons @@ -0,0 +1,7 @@ +lib/xtables/libxt_geoip.so +#usr/libexec/xtables-addons +usr/libexec/xtables-addons/xt_geoip_build +usr/libexec/xtables-addons/xt_geoip_dl +#usr/share/man/man1/xt_geoip_build.1 +#usr/share/man/man1/xt_geoip_dl.1 +#usr/share/man/man8/xtables-addons.8 diff --git a/config/rootfiles/core/90/exclude b/config/rootfiles/core/90/exclude index 5be5371..56e840d 100644 --- a/config/rootfiles/core/90/exclude +++ b/config/rootfiles/core/90/exclude @@ -17,10 +17,12 @@ etc/sysconfig/modules etc/sysconfig/rc.local etc/udev/rules.d/30-persistent-network.rules srv/web/ipfire/html/proxy.pac -var/ipfire/time +var/ipfire/firewall/geoipblock +var/ipfire/fwhosts/custmgeoipgrp var/ipfire/ovpn/ccd.conf var/ipfire/ovpn/ccdroute var/ipfire/ovpn/ccdroute2 +var/ipfire/time var/log/cache var/state/dhcp/dhcpd.leases var/updatecache diff --git a/config/rootfiles/core/90/filelists/files b/config/rootfiles/core/90/filelists/files index 2ef5ded..5f05eb5 100644 --- a/config/rootfiles/core/90/filelists/files +++ b/config/rootfiles/core/90/filelists/files @@ -1,7 +1,19 @@ etc/system-release etc/issue +etc/rc.d/init.d/firewall etc/rc.d/init.d/network-trigger +etc/rc.d/init.d/networking/red.up/99-geoip-database etc/rc.d/rcsysinit.d/S90network-trigger +srv/web/ipfire/cgi-bin/firewall.cgi +srv/web/ipfire/cgi-bin/fwhosts.cgi +srv/web/ipfire/cgi-bin/geoip-block.cgi +usr/lib/firewall/firewall-lib.pl usr/lib/firewall/rules.pl +usr/local/bin/xt_geoip_build +usr/local/bin/xt_geoip_update +var/ipfire/general-functions.pl +var/ipfire/geoip-functions.pl +var/ipfire/header.pl var/ipfire/backup/include var/ipfire/langs +var/ipfire/menu.d/50-firewall.menu diff --git a/config/rootfiles/core/90/filelists/perl-Text-CSV_XS b/config/rootfiles/core/90/filelists/perl-Text-CSV_XS new file mode 120000 index 0000000..ec1202f --- /dev/null +++ b/config/rootfiles/core/90/filelists/perl-Text-CSV_XS @@ -0,0 +1 @@ +../../../common/perl-Text-CSV_XS \ No newline at end of file diff --git a/config/rootfiles/core/90/filelists/xtables-addons b/config/rootfiles/core/90/filelists/xtables-addons new file mode 120000 index 0000000..2e24c42 --- /dev/null +++ b/config/rootfiles/core/90/filelists/xtables-addons @@ -0,0 +1 @@ +../../../common/xtables-addons \ No newline at end of file diff --git a/config/rootfiles/core/90/update.sh b/config/rootfiles/core/90/update.sh index 6af052c..5e09240 100644 --- a/config/rootfiles/core/90/update.sh +++ b/config/rootfiles/core/90/update.sh @@ -159,6 +159,32 @@ if [ $BOOTSPACE -lt 1000 ]; then esac fi +# Create GeoIP related files if they do not exist yet. +if [ ! -e "/var/ipfire/firewall/geoipblock" ]; then + touch /var/ipfire/firewall/geoipblock + chown nobody:nobody /var/ipfire/firewall/geoipblock + + # Insert default value into file. + echo "GEOIPBLOCK_ENABLED=off" >> /var/ipfire/firewall/geoipblock +fi +if [ ! -e "/var/ipfire/fwhosts/customgeoipgrp" ]; then + touch /var/ipfire/fwhosts/customgeoipgrp + chown nobody:nobody /var/ipfire/fwhosts/customgeoipgrp +fi + +# Download/Update GeoIP databases. +/usr/local/bin/xt_geoip_update + +# Update crontab +grep -q /usr/local/bin/xt_geoip_update /var/spool/cron/root.orig || cat <<EOF >> /var/spool/cron/root.orig + +# Update GeoIP database once a month. +%monthly,random * * * [ -f "/var/ipfire/red/active" ] && /usr/local/bin/xt_geoip_update >/dev/null 2>&1 +EOF + +fcrontab -z &>/dev/null + + # Update Language cache perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang" diff --git a/config/xtables-addons/mconfig b/config/xtables-addons/mconfig new file mode 100644 index 0000000..92e47f0 --- /dev/null +++ b/config/xtables-addons/mconfig @@ -0,0 +1,24 @@ +# -*- Makefile -*- +# +build_ACCOUNT=n +build_CHAOS=n +build_DELUDE=n +build_DHCPMAC=n +build_DNETMAP=n +build_ECHO=n +build_IPMARK=n +build_LOGMARK=n +build_SYSRQ=n +build_TARPIT=n +build_condition=n +build_fuzzy=n +build_geoip=m +build_gradm=n +build_iface=n +build_ipp2p=n +build_ipv4options=n +build_length2=n +build_lscan=n +build_pknock=n +build_psd=n +build_quota2=n diff --git a/doc/language_issues.de b/doc/language_issues.de index 3a31661..1ccc654 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -75,6 +75,7 @@ WARNING: translation string unused: bad characters in WARNING: translation string unused: behind a proxy WARNING: translation string unused: bitrate WARNING: translation string unused: bleeding rules +WARNING: translation string unused: block WARNING: translation string unused: blue access use hint WARNING: translation string unused: blue interface WARNING: translation string unused: cache management @@ -243,6 +244,7 @@ WARNING: translation string unused: fwhost Standard Network WARNING: translation string unused: fwhost attention WARNING: translation string unused: fwhost blue WARNING: translation string unused: fwhost changeremark +WARNING: translation string unused: fwhost cust geoip WARNING: translation string unused: fwhost err addrgrp WARNING: translation string unused: fwhost err hostorip WARNING: translation string unused: fwhost err mac @@ -258,6 +260,9 @@ WARNING: translation string unused: fwhost wo subnet WARNING: translation string unused: gen static key WARNING: translation string unused: generate WARNING: translation string unused: genkey +WARNING: translation string unused: geoipblock country code +WARNING: translation string unused: geoipblock country name +WARNING: translation string unused: geoipblock flag WARNING: translation string unused: green interface WARNING: translation string unused: gz with key WARNING: translation string unused: hint @@ -576,6 +581,8 @@ WARNING: translation string unused: transfer limits WARNING: translation string unused: transparent on WARNING: translation string unused: umount WARNING: translation string unused: umount removable media before to unplug +WARNING: translation string unused: unblock +WARNING: translation string unused: unblock all WARNING: translation string unused: unencrypted WARNING: translation string unused: update transcript WARNING: translation string unused: updates @@ -632,6 +639,7 @@ WARNING: untranslated string: bytes WARNING: untranslated string: community rules WARNING: untranslated string: dead peer detection WARNING: untranslated string: emerging rules +WARNING: untranslated string: fwhost cust geoipgrp WARNING: untranslated string: fwhost err hostip WARNING: untranslated string: ike lifetime should be between 1 and 8 hours WARNING: untranslated string: no data diff --git a/doc/language_issues.en b/doc/language_issues.en index da14d97..b7be862 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -93,6 +93,7 @@ WARNING: translation string unused: bewan adsl pci st WARNING: translation string unused: bewan adsl usb WARNING: translation string unused: bitrate WARNING: translation string unused: bleeding rules +WARNING: translation string unused: block WARNING: translation string unused: blue access use hint WARNING: translation string unused: blue interface WARNING: translation string unused: cache management @@ -266,6 +267,7 @@ WARNING: translation string unused: fwhost Standard Network WARNING: translation string unused: fwhost attention WARNING: translation string unused: fwhost blue WARNING: translation string unused: fwhost changeremark +WARNING: translation string unused: fwhost cust geoip WARNING: translation string unused: fwhost err addrgrp WARNING: translation string unused: fwhost err hostorip WARNING: translation string unused: fwhost err mac @@ -283,6 +285,9 @@ WARNING: translation string unused: g.lite WARNING: translation string unused: gen static key WARNING: translation string unused: generate WARNING: translation string unused: genkey +WARNING: translation string unused: geoipblock country code +WARNING: translation string unused: geoipblock country name +WARNING: translation string unused: geoipblock flag WARNING: translation string unused: green interface WARNING: translation string unused: gz with key WARNING: translation string unused: hint @@ -609,6 +614,8 @@ WARNING: translation string unused: transfer limits WARNING: translation string unused: transparent on WARNING: translation string unused: umount WARNING: translation string unused: umount removable media before to unplug +WARNING: translation string unused: unblock +WARNING: translation string unused: unblock all WARNING: translation string unused: unencrypted WARNING: translation string unused: update transcript WARNING: translation string unused: updates @@ -664,6 +671,7 @@ WARNING: translation string unused: year-graph WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: Scan for Songs WARNING: untranslated string: bytes +WARNING: untranslated string: fwhost cust geoipgrp WARNING: untranslated string: fwhost err hostip WARNING: untranslated string: ike lifetime should be between 1 and 8 hours WARNING: untranslated string: no data diff --git a/doc/language_issues.es b/doc/language_issues.es index f76cd5e..086dfbd 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -233,6 +233,9 @@ WARNING: translation string unused: g.lite WARNING: translation string unused: gen static key WARNING: translation string unused: generate WARNING: translation string unused: genkey +WARNING: translation string unused: geoipblock country code +WARNING: translation string unused: geoipblock country name +WARNING: translation string unused: geoipblock flag WARNING: translation string unused: green interface WARNING: translation string unused: gz with key WARNING: translation string unused: hint @@ -650,6 +653,7 @@ WARNING: untranslated string: ccd none WARNING: untranslated string: ccd routes WARNING: untranslated string: ccd subnet WARNING: untranslated string: ccd used +WARNING: untranslated string: check all WARNING: untranslated string: count WARNING: untranslated string: countries WARNING: untranslated string: country codes and flags @@ -794,6 +798,7 @@ WARNING: untranslated string: fwdfw wd_thu WARNING: untranslated string: fwdfw wd_tue WARNING: untranslated string: fwdfw wd_wed WARNING: untranslated string: fwhost OpenVPN N-2-N +WARNING: untranslated string: fwhost addgeoipgrp WARNING: untranslated string: fwhost addgrp WARNING: untranslated string: fwhost addgrpname WARNING: untranslated string: fwhost addhost @@ -806,6 +811,9 @@ WARNING: untranslated string: fwhost ccdhost WARNING: untranslated string: fwhost ccdnet WARNING: untranslated string: fwhost change WARNING: untranslated string: fwhost cust addr +WARNING: untranslated string: fwhost cust geoipgroup +WARNING: untranslated string: fwhost cust geoipgrp +WARNING: untranslated string: fwhost cust geoiplocation WARNING: untranslated string: fwhost cust grp WARNING: untranslated string: fwhost cust net WARNING: untranslated string: fwhost cust service @@ -845,6 +853,7 @@ WARNING: untranslated string: fwhost ip_mac WARNING: untranslated string: fwhost ipsec net WARNING: untranslated string: fwhost menu WARNING: untranslated string: fwhost netaddress +WARNING: untranslated string: fwhost newgeoipgrp WARNING: untranslated string: fwhost newgrp WARNING: untranslated string: fwhost newhost WARNING: untranslated string: fwhost newnet @@ -1025,6 +1034,7 @@ WARNING: untranslated string: tor traffic limit hard WARNING: untranslated string: tor traffic limit soft WARNING: untranslated string: tor traffic read written WARNING: untranslated string: tor use exit nodes +WARNING: untranslated string: uncheck all WARNING: untranslated string: uplink WARNING: untranslated string: upload dh key WARNING: untranslated string: uptime load average diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 178ddff..47ee3fb 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -660,6 +660,7 @@ WARNING: untranslated string: ccd none WARNING: untranslated string: ccd routes WARNING: untranslated string: ccd subnet WARNING: untranslated string: ccd used +WARNING: untranslated string: check all WARNING: untranslated string: count WARNING: untranslated string: countries WARNING: untranslated string: country codes and flags @@ -805,6 +806,7 @@ WARNING: untranslated string: fwdfw wd_thu WARNING: untranslated string: fwdfw wd_tue WARNING: untranslated string: fwdfw wd_wed WARNING: untranslated string: fwhost OpenVPN N-2-N +WARNING: untranslated string: fwhost addgeoipgrp WARNING: untranslated string: fwhost addgrp WARNING: untranslated string: fwhost addgrpname WARNING: untranslated string: fwhost addhost @@ -817,6 +819,9 @@ WARNING: untranslated string: fwhost ccdhost WARNING: untranslated string: fwhost ccdnet WARNING: untranslated string: fwhost change WARNING: untranslated string: fwhost cust addr +WARNING: untranslated string: fwhost cust geoipgroup +WARNING: untranslated string: fwhost cust geoipgrp +WARNING: untranslated string: fwhost cust geoiplocation WARNING: untranslated string: fwhost cust grp WARNING: untranslated string: fwhost cust net WARNING: untranslated string: fwhost cust service @@ -856,6 +861,7 @@ WARNING: untranslated string: fwhost ip_mac WARNING: untranslated string: fwhost ipsec net WARNING: untranslated string: fwhost menu WARNING: untranslated string: fwhost netaddress +WARNING: untranslated string: fwhost newgeoipgrp WARNING: untranslated string: fwhost newgrp WARNING: untranslated string: fwhost newhost WARNING: untranslated string: fwhost newnet @@ -872,6 +878,13 @@ WARNING: untranslated string: fwhost used WARNING: untranslated string: fwhost welcome WARNING: untranslated string: gen dh WARNING: untranslated string: generate dh key +WARNING: untranslated string: geoip +WARNING: untranslated string: geoipblock +WARNING: untranslated string: geoipblock block countries +WARNING: untranslated string: geoipblock configuration +WARNING: untranslated string: geoipblock country is allowed +WARNING: untranslated string: geoipblock country is blocked +WARNING: untranslated string: geoipblock enable feature WARNING: untranslated string: grouptype WARNING: untranslated string: hardware support WARNING: untranslated string: ike lifetime should be between 1 and 8 hours @@ -1033,6 +1046,7 @@ WARNING: untranslated string: tor traffic limit hard WARNING: untranslated string: tor traffic limit soft WARNING: untranslated string: tor traffic read written WARNING: untranslated string: tor use exit nodes +WARNING: untranslated string: uncheck all WARNING: untranslated string: uplink WARNING: untranslated string: upload dh key WARNING: untranslated string: upload new ruleset diff --git a/doc/language_issues.it b/doc/language_issues.it index 0f69ce8..098f440 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -672,13 +672,26 @@ WARNING: untranslated string: advproxy basic authentication WARNING: untranslated string: advproxy group access control WARNING: untranslated string: advproxy group required WARNING: untranslated string: bytes +WARNING: untranslated string: check all WARNING: untranslated string: fwdfw err concon WARNING: untranslated string: fwdfw err ratecon WARNING: untranslated string: fwdfw limitconcon WARNING: untranslated string: fwdfw maxconcon WARNING: untranslated string: fwdfw numcon WARNING: untranslated string: fwdfw ratelimit +WARNING: untranslated string: fwhost addgeoipgrp +WARNING: untranslated string: fwhost cust geoipgroup +WARNING: untranslated string: fwhost cust geoipgrp +WARNING: untranslated string: fwhost cust geoiplocation WARNING: untranslated string: fwhost err hostip +WARNING: untranslated string: fwhost newgeoipgrp +WARNING: untranslated string: geoip +WARNING: untranslated string: geoipblock +WARNING: untranslated string: geoipblock block countries +WARNING: untranslated string: geoipblock configuration +WARNING: untranslated string: geoipblock country is allowed +WARNING: untranslated string: geoipblock country is blocked +WARNING: untranslated string: geoipblock enable feature WARNING: untranslated string: ike lifetime should be between 1 and 8 hours WARNING: untranslated string: incoming compression in bytes per second WARNING: untranslated string: incoming overhead in bytes per second @@ -700,3 +713,7 @@ WARNING: untranslated string: routing config changed WARNING: untranslated string: routing table WARNING: untranslated string: samba join a domain WARNING: untranslated string: samba join domain +WARNING: untranslated string: uncheck all +WARNING: untranslated string: vpn statistic n2n +WARNING: untranslated string: vpn statistic rw +WARNING: untranslated string: vpn statistics n2n diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 1053474..602441d 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -671,6 +671,7 @@ WARNING: untranslated string: advproxy group required WARNING: untranslated string: atm device WARNING: untranslated string: bytes WARNING: untranslated string: capabilities +WARNING: untranslated string: check all WARNING: untranslated string: default WARNING: untranslated string: dh WARNING: untranslated string: dh key move failed @@ -691,9 +692,21 @@ WARNING: untranslated string: fwdfw limitconcon WARNING: untranslated string: fwdfw maxconcon WARNING: untranslated string: fwdfw numcon WARNING: untranslated string: fwdfw ratelimit +WARNING: untranslated string: fwhost addgeoipgrp +WARNING: untranslated string: fwhost cust geoipgroup +WARNING: untranslated string: fwhost cust geoipgrp +WARNING: untranslated string: fwhost cust geoiplocation WARNING: untranslated string: fwhost err hostip +WARNING: untranslated string: fwhost newgeoipgrp WARNING: untranslated string: gen dh WARNING: untranslated string: generate dh key +WARNING: untranslated string: geoip +WARNING: untranslated string: geoipblock +WARNING: untranslated string: geoipblock block countries +WARNING: untranslated string: geoipblock configuration +WARNING: untranslated string: geoipblock country is allowed +WARNING: untranslated string: geoipblock country is blocked +WARNING: untranslated string: geoipblock enable feature WARNING: untranslated string: ike lifetime should be between 1 and 8 hours WARNING: untranslated string: imei WARNING: untranslated string: imsi @@ -747,6 +760,7 @@ WARNING: untranslated string: show tls-auth key WARNING: untranslated string: software version WARNING: untranslated string: source ip country WARNING: untranslated string: ta key +WARNING: untranslated string: uncheck all WARNING: untranslated string: upload dh key WARNING: untranslated string: vendor WARNING: untranslated string: vpn statistic n2n diff --git a/doc/language_issues.pl b/doc/language_issues.pl index f76cd5e..086dfbd 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -233,6 +233,9 @@ WARNING: translation string unused: g.lite WARNING: translation string unused: gen static key WARNING: translation string unused: generate WARNING: translation string unused: genkey +WARNING: translation string unused: geoipblock country code +WARNING: translation string unused: geoipblock country name +WARNING: translation string unused: geoipblock flag WARNING: translation string unused: green interface WARNING: translation string unused: gz with key WARNING: translation string unused: hint @@ -650,6 +653,7 @@ WARNING: untranslated string: ccd none WARNING: untranslated string: ccd routes WARNING: untranslated string: ccd subnet WARNING: untranslated string: ccd used +WARNING: untranslated string: check all WARNING: untranslated string: count WARNING: untranslated string: countries WARNING: untranslated string: country codes and flags @@ -794,6 +798,7 @@ WARNING: untranslated string: fwdfw wd_thu WARNING: untranslated string: fwdfw wd_tue WARNING: untranslated string: fwdfw wd_wed WARNING: untranslated string: fwhost OpenVPN N-2-N +WARNING: untranslated string: fwhost addgeoipgrp WARNING: untranslated string: fwhost addgrp WARNING: untranslated string: fwhost addgrpname WARNING: untranslated string: fwhost addhost @@ -806,6 +811,9 @@ WARNING: untranslated string: fwhost ccdhost WARNING: untranslated string: fwhost ccdnet WARNING: untranslated string: fwhost change WARNING: untranslated string: fwhost cust addr +WARNING: untranslated string: fwhost cust geoipgroup +WARNING: untranslated string: fwhost cust geoipgrp +WARNING: untranslated string: fwhost cust geoiplocation WARNING: untranslated string: fwhost cust grp WARNING: untranslated string: fwhost cust net WARNING: untranslated string: fwhost cust service @@ -845,6 +853,7 @@ WARNING: untranslated string: fwhost ip_mac WARNING: untranslated string: fwhost ipsec net WARNING: untranslated string: fwhost menu WARNING: untranslated string: fwhost netaddress +WARNING: untranslated string: fwhost newgeoipgrp WARNING: untranslated string: fwhost newgrp WARNING: untranslated string: fwhost newhost WARNING: untranslated string: fwhost newnet @@ -1025,6 +1034,7 @@ WARNING: untranslated string: tor traffic limit hard WARNING: untranslated string: tor traffic limit soft WARNING: untranslated string: tor traffic read written WARNING: untranslated string: tor use exit nodes +WARNING: untranslated string: uncheck all WARNING: untranslated string: uplink WARNING: untranslated string: upload dh key WARNING: untranslated string: uptime load average diff --git a/doc/language_issues.ru b/doc/language_issues.ru index f524498..94724d4 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -653,6 +653,7 @@ WARNING: untranslated string: ccd none WARNING: untranslated string: ccd routes WARNING: untranslated string: ccd subnet WARNING: untranslated string: ccd used +WARNING: untranslated string: check all WARNING: untranslated string: community rules WARNING: untranslated string: count WARNING: untranslated string: countries @@ -789,6 +790,7 @@ WARNING: untranslated string: fwdfw wd_thu WARNING: untranslated string: fwdfw wd_tue WARNING: untranslated string: fwdfw wd_wed WARNING: untranslated string: fwhost OpenVPN N-2-N +WARNING: untranslated string: fwhost addgeoipgrp WARNING: untranslated string: fwhost addgrp WARNING: untranslated string: fwhost addgrpname WARNING: untranslated string: fwhost addhost @@ -801,6 +803,9 @@ WARNING: untranslated string: fwhost ccdhost WARNING: untranslated string: fwhost ccdnet WARNING: untranslated string: fwhost change WARNING: untranslated string: fwhost cust addr +WARNING: untranslated string: fwhost cust geoipgroup +WARNING: untranslated string: fwhost cust geoipgrp +WARNING: untranslated string: fwhost cust geoiplocation WARNING: untranslated string: fwhost cust grp WARNING: untranslated string: fwhost cust net WARNING: untranslated string: fwhost cust service @@ -840,6 +845,7 @@ WARNING: untranslated string: fwhost ip_mac WARNING: untranslated string: fwhost ipsec net WARNING: untranslated string: fwhost menu WARNING: untranslated string: fwhost netaddress +WARNING: untranslated string: fwhost newgeoipgrp WARNING: untranslated string: fwhost newgrp WARNING: untranslated string: fwhost newhost WARNING: untranslated string: fwhost newnet @@ -856,6 +862,13 @@ WARNING: untranslated string: fwhost used WARNING: untranslated string: fwhost welcome WARNING: untranslated string: gen dh WARNING: untranslated string: generate dh key +WARNING: untranslated string: geoip +WARNING: untranslated string: geoipblock +WARNING: untranslated string: geoipblock block countries +WARNING: untranslated string: geoipblock configuration +WARNING: untranslated string: geoipblock country is allowed +WARNING: untranslated string: geoipblock country is blocked +WARNING: untranslated string: geoipblock enable feature WARNING: untranslated string: grouptype WARNING: untranslated string: hardware support WARNING: untranslated string: ike lifetime should be between 1 and 8 hours @@ -1014,6 +1027,7 @@ WARNING: untranslated string: tor traffic limit hard WARNING: untranslated string: tor traffic limit soft WARNING: untranslated string: tor traffic read written WARNING: untranslated string: tor use exit nodes +WARNING: untranslated string: uncheck all WARNING: untranslated string: uplink WARNING: untranslated string: upload dh key WARNING: untranslated string: uptime load average diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 310b636..6f846c7 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -664,7 +664,20 @@ WARNING: translation string unused: year-graph WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: Scan for Songs WARNING: untranslated string: bytes +WARNING: untranslated string: check all +WARNING: untranslated string: fwhost addgeoipgrp +WARNING: untranslated string: fwhost cust geoipgroup +WARNING: untranslated string: fwhost cust geoipgrp +WARNING: untranslated string: fwhost cust geoiplocation WARNING: untranslated string: fwhost err hostip +WARNING: untranslated string: fwhost newgeoipgrp +WARNING: untranslated string: geoip +WARNING: untranslated string: geoipblock +WARNING: untranslated string: geoipblock block countries +WARNING: untranslated string: geoipblock configuration +WARNING: untranslated string: geoipblock country is allowed +WARNING: untranslated string: geoipblock country is blocked +WARNING: untranslated string: geoipblock enable feature WARNING: untranslated string: ike lifetime should be between 1 and 8 hours WARNING: untranslated string: incoming compression in bytes per second WARNING: untranslated string: incoming overhead in bytes per second @@ -677,6 +690,7 @@ WARNING: untranslated string: route config changed WARNING: untranslated string: routing config added WARNING: untranslated string: routing config changed WARNING: untranslated string: routing table +WARNING: untranslated string: uncheck all WARNING: untranslated string: vpn statistic n2n WARNING: untranslated string: vpn statistic rw WARNING: untranslated string: vpn statistics n2n diff --git a/doc/language_missings b/doc/language_missings index 0d73d2a..9fdc0d2 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -29,6 +29,7 @@ < atm device < attention < bit +< block < capabilities < ccd add < ccd choose net @@ -70,6 +71,7 @@ < ccd routes < ccd subnet < ccd used +< check all < ConnSched dial < ConnSched hangup < ConnSched reboot @@ -233,6 +235,7 @@ < fwdfw wd_tue < fwdfw wd_wed < fwdfw xt access +< fwhost addgeoipgrp < fwhost addgrp < fwhost addgrpname < fwhost addhost @@ -248,6 +251,9 @@ < fwhost change < fwhost changeremark < fwhost cust addr +< fwhost cust geoip +< fwhost cust geoipgroup +< fwhost cust geoiplocation < fwhost cust grp < fwhost cust net < fwhost Custom Host @@ -298,6 +304,7 @@ < fwhost IpSec Network < fwhost menu < fwhost netaddress +< fwhost newgeoipgrp < fwhost newgrp < fwhost newhost < fwhost newnet @@ -327,6 +334,16 @@ < fw settings ruletable < gen dh < generate dh key +< geoip +< geoipblock +< geoipblock block countries +< geoipblock configuration +< geoipblock country code +< geoipblock country is allowed +< geoipblock country is blocked +< geoipblock country name +< geoipblock enable feature +< geoipblock flag < grouptype < hardware support < imei @@ -496,6 +513,9 @@ < tor traffic limit soft < tor traffic read written < tor use exit nodes +< unblock +< unblock all +< uncheck all < updxlrtr sources < updxlrtr standard view < uplink @@ -589,6 +609,7 @@ < atm device < attention < bit +< block < capabilities < ccd add < ccd choose net @@ -630,6 +651,7 @@ < ccd routes < ccd subnet < ccd used +< check all < ConnSched dial < ConnSched hangup < ConnSched reboot @@ -792,6 +814,7 @@ < fwdfw wd_tue < fwdfw wd_wed < fwdfw xt access +< fwhost addgeoipgrp < fwhost addgrp < fwhost addgrpname < fwhost addhost @@ -807,6 +830,9 @@ < fwhost change < fwhost changeremark < fwhost cust addr +< fwhost cust geoip +< fwhost cust geoipgroup +< fwhost cust geoiplocation < fwhost cust grp < fwhost cust net < fwhost Custom Host @@ -857,6 +883,7 @@ < fwhost IpSec Network < fwhost menu < fwhost netaddress +< fwhost newgeoipgrp < fwhost newgrp < fwhost newhost < fwhost newnet @@ -1071,6 +1098,9 @@ < tor traffic limit soft < tor traffic read written < tor use exit nodes +< unblock +< unblock all +< uncheck all < updxlrtr sources < updxlrtr standard view < uplink @@ -1140,6 +1170,7 @@ < atm device < attention < bit +< block < capabilities < ccd add < ccd choose net @@ -1181,6 +1212,7 @@ < ccd routes < ccd subnet < ccd used +< check all < ConnSched dial < ConnSched hangup < ConnSched reboot @@ -1335,6 +1367,7 @@ < fwdfw wd_tue < fwdfw wd_wed < fwdfw xt access +< fwhost addgeoipgrp < fwhost addgrp < fwhost addgrpname < fwhost addhost @@ -1350,6 +1383,9 @@ < fwhost change < fwhost changeremark < fwhost cust addr +< fwhost cust geoip +< fwhost cust geoipgroup +< fwhost cust geoiplocation < fwhost cust grp < fwhost cust net < fwhost Custom Host @@ -1400,6 +1436,7 @@ < fwhost IpSec Network < fwhost menu < fwhost netaddress +< fwhost newgeoipgrp < fwhost newgrp < fwhost newhost < fwhost newnet @@ -1429,6 +1466,16 @@ < fw settings ruletable < gen dh < generate dh key +< geoip +< geoipblock +< geoipblock block countries +< geoipblock configuration +< geoipblock country code +< geoipblock country is allowed +< geoipblock country is blocked +< geoipblock country name +< geoipblock enable feature +< geoipblock flag < grouptype < hardware support < imei @@ -1598,6 +1645,9 @@ < tor traffic limit soft < tor traffic read written < tor use exit nodes +< unblock +< unblock all +< uncheck all < updxlrtr sources < updxlrtr standard view < uplink @@ -1668,6 +1718,7 @@ < atm device < attention < bit +< block < capabilities < ccd add < ccd choose net @@ -1709,6 +1760,7 @@ < ccd routes < ccd subnet < ccd used +< check all < ConnSched dial < ConnSched hangup < ConnSched reboot @@ -1867,6 +1919,7 @@ < fwdfw wd_tue < fwdfw wd_wed < fwdfw xt access +< fwhost addgeoipgrp < fwhost addgrp < fwhost addgrpname < fwhost addhost @@ -1882,6 +1935,9 @@ < fwhost change < fwhost changeremark < fwhost cust addr +< fwhost cust geoip +< fwhost cust geoipgroup +< fwhost cust geoiplocation < fwhost cust grp < fwhost cust net < fwhost Custom Host @@ -1932,6 +1988,7 @@ < fwhost IpSec Network < fwhost menu < fwhost netaddress +< fwhost newgeoipgrp < fwhost newgrp < fwhost newhost < fwhost newnet @@ -1961,6 +2018,16 @@ < fw settings ruletable < gen dh < generate dh key +< geoip +< geoipblock +< geoipblock block countries +< geoipblock configuration +< geoipblock country code +< geoipblock country is allowed +< geoipblock country is blocked +< geoipblock country name +< geoipblock enable feature +< geoipblock flag < grouptype < hardware support < hour-graph @@ -2130,6 +2197,9 @@ < tor traffic limit soft < tor traffic read written < tor use exit nodes +< unblock +< unblock all +< uncheck all < updxlrtr sources < updxlrtr standard view < uplink diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 39b732c..3e1b336 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -33,6 +33,7 @@ no warnings 'uninitialized'; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; require "/usr/lib/firewall/firewall-lib.pl"; unless (-d "${General::swroot}/firewall") { system("mkdir ${General::swroot}/firewall"); } @@ -47,6 +48,7 @@ my %defaultNetworks=(); my %netsettings=(); my %customhost=(); my %customgrp=(); +my %customgeoipgrp=(); my %customnetworks=(); my %customservice=(); my %customservicegrp=(); @@ -74,6 +76,7 @@ my $color; my $confignet = "${General::swroot}/fwhosts/customnetworks"; my $confighost = "${General::swroot}/fwhosts/customhosts"; my $configgrp = "${General::swroot}/fwhosts/customgroups"; +my $configgeoipgrp = "${General::swroot}/fwhosts/customgeoipgrp"; my $configsrv = "${General::swroot}/fwhosts/customservices"; my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp"; my $configccdnet = "${General::swroot}/ovpn/ccd.conf"; @@ -1060,6 +1063,54 @@ END } print"</select></td>"; } + # geoip locations / groups. + my @geoip_locations = &fwlib::get_geoip_locations(); + + print "<tr>\n"; + print "<td valign='top'><input type='radio' name='$grp' id='cust_geoip_$srctgt' value='cust_geoip_$srctgt' $checked{$grp}{'cust_geoip_'.$srctgt}></td>\n"; + print "<td>$Lang::tr{'geoip'}</td>\n"; + print "<td align='right'><select name='cust_geoip_$srctgt' style='width:200px;'>\n"; + + # Add GeoIP groups to dropdown. + if (!-z $configgeoipgrp) { + print "<optgroup label='$Lang::tr{'fwhost cust geoipgroup'}'>\n"; + foreach my $key (sort { ncmp($customgeoipgrp{$a}[0],$customgeoipgrp{$b}[0]) } keys %customgeoipgrp) { + my $selected; + + # Generate stored value for select detection. + my $stored = join(':', "group",$customgeoipgrp{$key}[0]); + + # Only show a group once and group with elements. + if($helper ne $customgeoipgrp{$key}[0] && $customgeoipgrp{$key}[2] ne 'none') { + # Mark current entry as selected. + if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $stored) { + $selected = "selected='selected'"; + } + print"<option $selected value='group:$customgeoipgrp{$key}[0]'>$customgeoipgrp{$key}[0]</option>\n"; + } + $helper=$customgeoipgrp{$key}[0]; + } + print "</optgroup>\n"; + } + + # Add locations. + print "<optgroup label='$Lang::tr{'fwhost cust geoiplocation'}'>\n"; + foreach my $location (@geoip_locations) { + # Get country name. + my $country_name = &GeoIP::get_full_country_name($location); + + # Mark current entry as selected. + my $selected; + if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $location) { + $selected = "selected='selected'"; + } + print "<option $selected value='$location'>$location - $country_name</option>\n"; + } + print "</optgroup>\n"; + + # Close GeoIP dropdown. + print "</select></td>\n"; + #End left table. start right table (vpn) print"</tr></table></td><td valign='top'><table width='95%' border='0' align='right'><tr>"; # CCD networks @@ -1397,6 +1448,7 @@ sub newrule &General::readhasharray("$confighost", \%customhost); &General::readhasharray("$configccdhost", \%ccdhost); &General::readhasharray("$configgrp", \%customgrp); + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp); &General::readhasharray("$configipsec", \%ipsecconf); &General::get_aliases(\%aliases); my %checked=(); @@ -2525,6 +2577,13 @@ END }else{ print $$hash{$key}[4]; } + }elsif ($$hash{$key}[3] eq 'cust_geoip_src') { + my ($split1,$split2) = split(":", $$hash{$key}[4]); + if ($split2) { + print "$split2\n"; + }else{ + print "$Lang::tr{'geoip'}: $$hash{$key}[4]\n"; + } }elsif ($$hash{$key}[4] eq 'RED1'){ print "$ipfireiface $Lang::tr{'fwdfw red'}"; }elsif ($$hash{$key}[4] eq 'ALL'){ @@ -2601,6 +2660,13 @@ END }else{ print $$hash{$key}[6]; } + }elsif ($$hash{$key}[5] eq 'cust_geoip_tgt') { + my ($split1,$split2) = split(":", $$hash{$key}[6]); + if ($split2) { + print "$split2\n"; + }else{ + print "$Lang::tr{'geoip'}: $$hash{$key}[6]\n"; + } }elsif ($$hash{$key}[5] eq 'tgt_addr'){ my ($split1,$split2) = split("/",$$hash{$key}[6]); if ($split2 eq '32'){ @@ -2618,7 +2684,6 @@ END #RULE ACTIVE if($$hash{$key}[2] eq 'ON'){ $gif="/images/on.gif" - }else{ $gif="/images/off.gif" } diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi index f42947e..994a50a 100644 --- a/html/cgi-bin/fwhosts.cgi +++ b/html/cgi-bin/fwhosts.cgi @@ -27,6 +27,8 @@ use Sort::Naturally; use CGI::Carp 'fatalsToBrowser'; no warnings 'uninitialized'; require '/var/ipfire/general-functions.pl'; +require "/var/ipfire/geoip-functions.pl"; +require "/usr/lib/firewall/firewall-lib.pl"; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; @@ -36,6 +38,7 @@ my %customhost=(); my %customgrp=(); my %customservice=(); my %customservicegrp=(); +my %customgeoipgrp=(); my %ccdnet=(); my %ccdhost=(); my %ipsecconf=(); @@ -62,6 +65,7 @@ my $configccdhost = "${General::swroot}/ovpn/ovpnconfig"; my $configipsec = "${General::swroot}/vpn/config"; my $configsrv = "${General::swroot}/fwhosts/customservices"; my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp"; +my $configgeoipgrp = "${General::swroot}/fwhosts/customgeoipgrp"; my $fwconfigfwd = "${General::swroot}/firewall/config"; my $fwconfiginp = "${General::swroot}/firewall/input"; my $fwconfigout = "${General::swroot}/firewall/outgoing"; @@ -73,6 +77,7 @@ unless (-e $confighost) { system("touch $confighost"); } unless (-e $configgrp) { system("touch $configgrp"); } unless (-e $configsrv) { system("touch $configsrv"); } unless (-e $configsrvgrp) { system("touch $configsrvgrp"); } +unless (-e $configgeoipgrp) { system("touch $configgeoipgrp"); } &General::readhash("${General::swroot}/main/settings", \%mainsettings); &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color); @@ -671,6 +676,87 @@ if ($fwhostsettings{'ACTION'} eq 'savegrp') &addgrp; &viewtablegrp; } +if ($fwhostsettings{'ACTION'} eq 'savegeoipgrp') +{ + my $grp=$fwhostsettings{'grp_name'}; + my $rem=$fwhostsettings{'remark'}; + my $count; + my $type; + my @target; + my @newgrp; + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp); + &General::readhasharray("$fwconfigfwd", \%fwfwd); + &General::readhasharray("$fwconfiginp", \%fwinp); + &General::readhasharray("$fwconfigout", \%fwout); + + # Check for existing group name. + if (!&checkgroup($grp) && $fwhostsettings{'update'} ne 'on'){ + $errormessage = $Lang::tr{'fwhost err grpexist'}; + } + + # Check remark. + if ($rem ne '' && !&validremark($rem) && $fwhostsettings{'update'} ne 'on'){ + $errormessage = $Lang::tr{'fwhost err remark'}; + } + + if ($fwhostsettings{'update'} eq 'on'){ + @target=$fwhostsettings{'COUNTRY_CODE'}; + $type='GeoIP Group'; + + #check if host/net exists in grp + my $test="$grp,$fwhostsettings{'oldremark'},@target"; + foreach my $key (keys %customgeoipgrp) { + my $test1="$customgeoipgrp{$key}[0],$customgeoipgrp{$key}[1],$customgeoipgrp{$key}[2]"; + if ($test1 eq $test){ + $errormessage=$Lang::tr{'fwhost err isingrp'}; + $fwhostsettings{'update'} = 'on'; + } + } + } + + if (!$errormessage){ + #on first save, we have an empty @target, so fill it with nothing + my $targetvalues=@target; + if ($targetvalues == '0'){ + @target="none"; + } + #on update, we have to delete the dummy entry + foreach my $key (keys %customgeoipgrp){ + if ($customgeoipgrp{$key}[0] eq $grp && $customgeoipgrp{$key}[2] eq "none"){ + delete $customgeoipgrp{$key}; + last; + } + } + &General::writehasharray("$configgeoipgrp", \%customgeoipgrp); + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp); + #create array with new lines + foreach my $line (@target){ + push (@newgrp,"$grp,$rem,$line"); + } + #append new entries + my $key = &General::findhasharraykey (\%customgeoipgrp); + foreach my $line (@newgrp){ + foreach my $i (0 .. 3) { $customgeoipgrp{$key}[$i] = "";} + my ($a,$b,$c,$d) = split (",",$line); + $customgeoipgrp{$key}[0] = $a; + $customgeoipgrp{$key}[1] = $b; + $customgeoipgrp{$key}[2] = $c; + $customgeoipgrp{$key}[3] = $type; + } + &General::writehasharray("$configgeoipgrp", \%customgeoipgrp); + #update counter in Host/Net + $fwhostsettings{'update'}='on'; + } + #check if ruleupdate is needed + my $geoipgrpcount=0; + $geoipgrpcount=&getgeoipcount($grp); + if($geoipgrpcount > 0 ) + { + &General::firewall_config_changed(); + } + &addgeoipgrp; + &viewtablegeoipgrp; +} if ($fwhostsettings{'ACTION'} eq 'saveservice') { my $ICMP; @@ -798,6 +884,12 @@ if ($fwhostsettings{'ACTION'} eq 'editgrp') &addgrp; &viewtablegrp; } +if ($fwhostsettings{'ACTION'} eq 'editgeoipgrp') +{ + $fwhostsettings{'update'}='on'; + &addgeoipgrp; + &viewtablegeoipgrp; +} if ($fwhostsettings{'ACTION'} eq 'editservice') { $fwhostsettings{'updatesrv'}='on'; @@ -830,6 +922,12 @@ if ($fwhostsettings{'ACTION'} eq 'resetgrp') $fwhostsettings{'remark'} =""; &showmenu; } +if ($fwhostsettings{'ACTION'} eq 'resetgeoipgrp') +{ + $fwhostsettings{'grp_name'} =""; + $fwhostsettings{'remark'} =""; + &showmenu; +} # delete if ($fwhostsettings{'ACTION'} eq 'delnet') { @@ -887,6 +985,37 @@ if ($fwhostsettings{'ACTION'} eq 'deletegrphost') &addgrp; &viewtablegrp; } +if ($fwhostsettings{'ACTION'} eq 'deletegeoipgrpentry') +{ + my $grpremark; + my $grpname; + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp); + foreach my $key (keys %customgeoipgrp){ + if($customgeoipgrp{$key}[0].",".$customgeoipgrp{$key}[1].",".$customgeoipgrp{$key}[2].",".$customgeoipgrp{$key}[3] eq $fwhostsettings{'delentry'}){ + $grpname=$customgeoipgrp{$key}[0]; + $grpremark=$customgeoipgrp{$key}[1]; + #check if we delete the last entry, then generate dummy + if ($fwhostsettings{'last'} eq 'on'){ + $customgeoipgrp{$key}[1] = ''; + $customgeoipgrp{$key}[2] = 'none'; + $customgeoipgrp{$key}[3] = ''; + $fwhostsettings{'last'}=''; + last; + }else{ + delete $customgeoipgrp{$key}; + } + } + } + &General::writehasharray("$configgeoipgrp", \%customgeoipgrp); + &General::firewall_config_changed(); + if ($fwhostsettings{'update'} eq 'on'){ + $fwhostsettings{'remark'}= $grpremark; + $fwhostsettings{'grp_name'}=$grpname; + } + &addgeoipgrp; + &viewtablegeoipgrp; +} + if ($fwhostsettings{'ACTION'} eq 'delgrp') { &General::readhasharray("$configgrp", \%customgrp); @@ -903,6 +1032,22 @@ if ($fwhostsettings{'ACTION'} eq 'delgrp') &addgrp; &viewtablegrp; } +if ($fwhostsettings{'ACTION'} eq 'delgeoipgrp') +{ + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp); + &decrease($fwhostsettings{'grp_name'}); + foreach my $key (sort keys %customgeoipgrp) + { + if($customgeoipgrp{$key}[0] eq $fwhostsettings{'grp_name'}) + { + delete $customgeoipgrp{$key}; + } + } + &General::writehasharray("$configgeoipgrp", \%customgeoipgrp); + $fwhostsettings{'grp_name'}=''; + &addgeoipgrp; + &viewtablegeoipgrp; +} if ($fwhostsettings{'ACTION'} eq 'delservice') { &General::readhasharray("$configsrv", \%customservice); @@ -977,6 +1122,11 @@ if ($fwhostsettings{'ACTION'} eq $Lang::tr{'fwhost newgrp'}) &addgrp; &viewtablegrp; } +if ($fwhostsettings{'ACTION'} eq $Lang::tr{'fwhost newgeoipgrp'}) +{ + &addgeoipgrp; + &viewtablegeoipgrp; +} if ($fwhostsettings{'ACTION'} eq $Lang::tr{'fwhost newservice'}) { &addservice; @@ -1011,6 +1161,31 @@ if ($fwhostsettings{'ACTION'} eq 'changegrpremark') &addgrp; &viewtablegrp; } +if ($fwhostsettings{'ACTION'} eq 'changegeoipgrpremark') +{ + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp); + if ($fwhostsettings{'oldrem'} ne $fwhostsettings{'newrem'} && (&validremark($fwhostsettings{'newrem'}) || $fwhostsettings{'newrem'} eq '')){ + foreach my $key (sort keys %customgeoipgrp) + { + if($customgeoipgrp{$key}[0] eq $fwhostsettings{'grp'} && $customgeoipgrp{$key}[1] eq $fwhostsettings{'oldrem'}) + { + $customgeoipgrp{$key}[1]=''; + $customgeoipgrp{$key}[1]=$fwhostsettings{'newrem'}; + } + } + &General::writehasharray("$configgeoipgrp", \%customgeoipgrp); + $fwhostsettings{'update'}='on'; + $fwhostsettings{'remark'}=$fwhostsettings{'newrem'}; + }else{ + $errormessage=$Lang::tr{'fwhost err remark'}; + $fwhostsettings{'remark'}=$fwhostsettings{'oldrem'}; + $fwhostsettings{'grp_name'}=$fwhostsettings{'grp'}; + $fwhostsettings{'update'} = 'on'; + } + $fwhostsettings{'grp_name'}=$fwhostsettings{'grp'}; + &addgeoipgrp; + &viewtablegeoipgrp; +} if ($fwhostsettings{'ACTION'} eq 'changesrvgrpremark') { &General::readhasharray("$configsrvgrp", \%customservicegrp ); @@ -1085,6 +1260,29 @@ if ($fwhostsettings{'ACTION'} eq 'changegrpname') &addgrp; &viewtablegrp; } +if ($fwhostsettings{'ACTION'} eq 'changegeoipgrpname') +{ + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp ); + if ($fwhostsettings{'oldgrpname'} ne $fwhostsettings{'grp'}){ + #Check new groupname + if (!&validhostname($fwhostsettings{'grp'})){ + $errormessage.=$Lang::tr{'fwhost err name'}."<br>"; + } + if (!$errormessage){ + # Rename group. + foreach my $key (keys %customgeoipgrp) { + if($customgeoipgrp{$key}[0] eq $fwhostsettings{'oldgrpname'}){ + $customgeoipgrp{$key}[0]=$fwhostsettings{'grp'}; + } + } + &General::writehasharray("$configgeoipgrp", \%customgeoipgrp ); + #change name in FW Rules + &changenameinfw($fwhostsettings{'oldgrpname'},$fwhostsettings{'grp'},6); + } + } + &addgeoipgrp; + &viewtablegeoipgrp; +} ### VIEW ### if($fwhostsettings{'ACTION'} eq '') { @@ -1096,7 +1294,7 @@ sub showmenu { print "$Lang::tr{'fwhost welcome'}"; print<<END; <br><br><table border='0' width='100%'> - <tr><td><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newnet'}' ><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newhost'}' ><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newgrp'}' ></form></td> + <tr><td><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newnet'}' ><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newhost'}' ><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newgrp'}' ><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newgeoipgrp'}' ></form></td> <td align='right'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newservice'}' ><input type='submit' name='ACTION' value='$Lang::tr{'fwhost newservicegrp'}' ></form></td></tr> <tr><td colspan='6'></td></tr></table> END @@ -1381,6 +1579,113 @@ END print"<tr><td style='text-align:right;'><input type='submit' value='$Lang::tr{'add'}' style='min-width:100px;' /><input type='hidden' name='oldremark' value='$fwhostsettings{'oldremark'}'><input type='hidden' name='update' value=\"$fwhostsettings{'update'}\"><input type='hidden' name='ACTION' value='savegrp' ></form><form method='post' style='display:inline'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value='resetgrp'></form></td></table>"; &Header::closebox(); } +sub addgeoipgrp +{ + &hint; + &error; + &showmenu; + &Header::openbox('100%', 'left', $Lang::tr{'fwhost addgeoipgrp'}); + + my %checked=(); + my $show=''; + $checked{'check1'}{'off'} = ''; + $checked{'check1'}{'on'} = ''; + $checked{'grp2'}{$fwhostsettings{'grp2'}} = 'CHECKED'; + $fwhostsettings{'oldremark'}=$fwhostsettings{'remark'}; + $fwhostsettings{'oldgrpname'}=$fwhostsettings{'grp_name'}; + my $grp=$fwhostsettings{'grp_name'}; + my $rem=$fwhostsettings{'remark'}; + if ($fwhostsettings{'update'} eq ''){ + print<<END; + <table width='100%' border='0'> + <tr> + <td style='width:15%;'>$Lang::tr{'fwhost addgrpname'}</td> + <td><form method='post'><input type='TEXT' name='grp_name' value='$fwhostsettings{'grp_name'}' size='30'></td> + </tr> + <tr> + <td>$Lang::tr{'remark'}:</td> + <td ><input type='TEXT' name='remark' value='$fwhostsettings{'remark'}' style='width: 99%;'></td> + </tr> + <tr> + <td colspan='2'><br></td> + </tr> + </table> +END + } else { + print<<END; + <table width='100%' border='0'> + <form method='post'><tr> + <td style='width:15%;'>$Lang::tr{'fwhost addgrpname'}</td> + <td style='width:30%;'><input type='TEXT' name='grp' value='$fwhostsettings{'grp_name'}' size='30'></td> + <td> + <input type='submit' value='$Lang::tr{'fwhost change'}'> + <input type='hidden' name='oldgrpname' value='$fwhostsettings{'oldgrpname'}'> + <input type='hidden' name='ACTION' value='changegeoipgrpname'> + </td> + <td></td> + </tr></form> + <tr><form method='post' style='display:inline'> + <td>$Lang::tr{'remark'}:</td> + <td colspan='2' style='width:98%;'> + <input type='TEXT' name='newrem' value='$fwhostsettings{'remark'}' style='width:98%;'> + </td> + <td align='right'> + <input type='submit' value='$Lang::tr{'fwhost change'}'> + <input type='hidden' name='grp' value='$fwhostsettings{'grp_name'}'> + <input type='hidden' name='oldrem' value='$fwhostsettings{'oldremark'}'> + <input type='hidden' name='ACTION' value='changegeoipgrpremark'> + </td> + </tr></form> + </table> + <br><br> +END + } + if ($fwhostsettings{'update'} eq 'on') { + my @geoip_locations = &fwlib::get_geoip_locations(); + + print<<END; + <form method='post'> + <input type='hidden' name='remark' value='$rem'> + <input type='hidden' name='grp_name' value='$grp'> + + <table width='100%' border='0'> + <tr> + <td style='text-align:left;'> + <select name='COUNTRY_CODE' style='width:16em;'>"; +END + foreach my $location (@geoip_locations) { + # Get full country name. + my $fullname = &GeoIP::get_full_country_name($location); + + print"<option value='$location'>$location - $fullname</option>\n"; + } + print <<END; + </select> + </td> + </tr> + </table> + <br><br> +END + } + print <<END; + <table width='100%'> + <tr><td style='text-align:right;'> + <input type='submit' value='$Lang::tr{'add'}' style='min-width:100px;' /> + <input type='hidden' name='oldremark' value='$fwhostsettings{'oldremark'}'> + <input type='hidden' name='update' value=\"$fwhostsettings{'update'}\"> + <input type='hidden' name='ACTION' value='savegeoipgrp' > + </form> + + <form method='post' style='display:inline'> + + <input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'> + <input type='hidden' name='ACTION' value='resetgeoipgrp'> + + </form> + </td></tr></table> +END + &Header::closebox(); +} sub addservice { &error; @@ -1839,6 +2144,195 @@ sub viewtablegrp } } +sub viewtablegeoipgrp +{ + # If our filesize is "zero" there is nothing to read-in. + if (-z "$configgeoipgrp") { + return; + } + + &Header::openbox('100%', 'left', $Lang::tr{'fwhost cust geoipgrp'}); + &General::readhasharray("$configgeoipgrp", \%customgeoipgrp); + &General::readhasharray("$fwconfigfwd", \%fwfwd); + &General::readhasharray("$fwconfiginp", \%fwinp); + &General::readhasharray("$fwconfigout", \%fwout); + my @grp=(); + my $helper=''; + my $count=1; + my $country_code; + my $grpname; + my $remark; + my $number; + my $delflag; + my @counter; + my %hash; + + # If there are no groups we are finished here. + if (!keys %customgeoipgrp) { + print "<center><b>$Lang::tr{'fwhost err emptytable'}</b>"; + return; + } + + # Put all groups in a hash. + foreach my $key (sort { ncmp($customgeoipgrp{$a}[0],$customgeoipgrp{$b}[0]) } + sort { ncmp($customgeoipgrp{$a}[2],$customgeoipgrp{$b}[2]) } keys %customgeoipgrp) { + push (@counter,$customgeoipgrp{$key}[0]); + } + + # Increase current used key. + foreach my $key1 (@counter) { + $hash{$key1}++ ; + } + + # Sort hash. + foreach my $key (sort { ncmp($customgeoipgrp{$a}[0],$customgeoipgrp{$b}[0]) } + sort { ncmp($customgeoipgrp{$a}[2],$customgeoipgrp{$b}[2]) } keys %customgeoipgrp) { + $count++; + if ($helper ne $customgeoipgrp{$key}[0]) { + $delflag='0'; + + foreach my $key1 (sort { ncmp($customgeoipgrp{$a}[0],$customgeoipgrp{$b}[0]) } + sort { ncmp($customgeoipgrp{$a}[2],$customgeoipgrp{$b}[2]) } keys %customgeoipgrp) { + + if ($customgeoipgrp{$key}[0] eq $customgeoipgrp{$key1}[0]) + { + $delflag++; + } + if($delflag > 1){ + last; + } + } + + $number=1; + + # Groupname. + $grpname=$customgeoipgrp{$key}[0]; + + # Group remark. + $remark="$customgeoipgrp{$key}[1]"; + + # Country code. + $country_code="$customgeoipgrp{$key}[2]"; + + if ($count gt 1){ + print"</table>"; + $count=1; + } + + # Display groups header. + print "<br><b><u>$grpname</u></b>   \n"; + print "<b>$Lang::tr{'remark'}:</b>&nbsp $remark &nbsp\n" if ($remark ne ''); + + # Get group count. + my $geoipgrpcount=&getgeoipcount($grpname); + print "<b>$Lang::tr{'used'}:</b> $geoipgrpcount x"; + + # Only display delete icon, if the group is not used by a firewall rule. + if($geoipgrpcount == '0') { + print"<form method='post' style='display:inline'>\n"; + print"<input type='image' src='/images/delete.gif' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' align='right' />\n"; + print"<input type='hidden' name='grp_name' value='$grpname' >\n"; + print"<input type='hidden' name='ACTION' value='delgeoipgrp'>\n"; + print"</form>"; + } + + # Icon for group editing. +print <<END; + <form method='post' style='display:inline'> + <input type='image' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' align='right'/> + <input type='hidden' name='grp_name' value='$grpname' > + <input type='hidden' name='remark' value='$remark' > + <input type='hidden' name='ACTION' value='editgeoipgrp'> + </form> + + <table width='100%' cellspacing='0' class='tbl'> +END + # Display headlines if the group contains any entries. + if ($country_code ne "none") { +print <<END; + <tr> + <td width='10%' align='center'> + <b>$Lang::tr{'flag'}</b> + </td> + + <td width='10%'align='center'> + <b>$Lang::tr{'countrycode'}</b> + </td> + + <td width='70%'align='left'> + <b>$Lang::tr{'country'}</b> + </td> + + <td width='10%' align='right'></td> + </tr> +END + } + } + + # Check if our group contains any entries. + if ($country_code eq "none") { + print "<tr><td>$Lang::tr{'fwhost err emptytable'}</td></tr>\n"; + } else { + # Check if we are currently editing a group and assign column backgound colors. + my $col=''; + if ( ($fwhostsettings{'ACTION'} eq 'editgeoipgrp' || $fwhostsettings{'update'} ne '') + && $fwhostsettings{'grp_name'} eq $customgeoipgrp{$key}[0]) { + $col="bgcolor='${Header::colouryellow}'"; + } elsif ($count %2 == 0){ + $col="bgcolor='$color{'color20'}'"; + } else { + $col="bgcolor='$color{'color22'}'"; + } + + # Get country flag. + my $icon = &GeoIP::get_flag_icon($customgeoipgrp{$key}[2]); + + # Print column with flag icon. + my $col_content; + if ($icon) { + $col_content = "<img src='$icon' alt='$customgeoipgrp{$key}[2]' title='$customgeoipgrp{$key}[2]'>"; + } else { + $col_content = "<b>N/A</b>"; + } + + print "<td align='center' $col>$col_content</td>\n"; + + # Print column with country code. + print "<td align='center' $col>$customgeoipgrp{$key}[2]</td>\n"; + + # Print column with full country name. + my $country_name = &GeoIP::get_full_country_name($customgeoipgrp{$key}[2]); + print "<td align='left' $col>$country_name</td>\n"; + + # Generate from for removing entries from a group. + print "<td align='right' width='1%' $col><form method='post'>\n"; + + if ($delflag > 0){ + print"<input type='image' src='/images/delete.gif' align='middle' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}'/>\n"; + + # Check if this group only has a single entry. + foreach my $key2 (keys %hash) { + if ($hash{$key2}<2 && $key2 eq $customgeoipgrp{$key}[0]){ + print "<input type='hidden' name='last' value='on'>" ; + } + } + } + + print "<input type='hidden' name='ACTION' value='deletegeoipgrpentry'>\n"; + print "<input type='hidden' name='update' value='$fwhostsettings{'update'}'>\n"; + print "<input type='hidden' name='delentry' value='$grpname,$remark,$customgeoipgrp{$key}[2],$customgeoipgrp{$key}[3]'>\n"; + print "</form>\n"; + print "</td>\n"; + print "</tr>\n"; + } + + $helper=$customgeoipgrp{$key}[0]; + $number++; + } + + print"</table>\n"; + &Header::closebox(); +} sub viewtableservice { my $count=0; @@ -2196,6 +2690,44 @@ sub gethostcount } return $srvcounter; } +sub getgeoipcount +{ + my $groupname=shift; + my $counter=0; + + # GeoIP groups are stored as "group:groupname" in the + # firewall settings files. + my $searchstring = join(':', "group",$groupname); + + # Count services used in firewall - forward + foreach my $key1 (keys %fwfwd) { + if($fwfwd{$key1}[4] eq $searchstring){ + $counter++; + } + if($fwfwd{$key1}[6] eq $searchstring){ + $counter++; + } + } + #Count services used in firewall - input + foreach my $key2 (keys %fwinp) { + if($fwinp{$key2}[4] eq $searchstring){ + $counter++; + } + if($fwinp{$key2}[6] eq $searchstring){ + $counter++; + } + } + #Count services used in firewall - outgoing + foreach my $key3 (keys %fwout) { + if($fwout{$key3}[4] eq $searchstring){ + $counter++; + } + if($fwout{$key3}[6] eq $searchstring){ + $counter++; + } + } + return $counter; +} sub getnetcount { my $searchstring=shift; diff --git a/html/cgi-bin/geoip-block.cgi b/html/cgi-bin/geoip-block.cgi new file mode 100644 index 0000000..ccbfa92 --- /dev/null +++ b/html/cgi-bin/geoip-block.cgi @@ -0,0 +1,263 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2014 IPFire Developemnt Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; +# enable only the following on debugging purpose +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/geoip-functions.pl"; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; +require "/usr/lib/firewall/firewall-lib.pl"; + +my $notice; +my $settingsfile = "${General::swroot}/firewall/geoipblock"; + +my %color = (); +my %mainsettings = (); +my %settings = (); +my %cgiparams = (); + +# Read configuration file. +&General::readhash("$settingsfile", \%settings); + +&General::readhash("${General::swroot}/main/settings", \%mainsettings); +&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color); + +&Header::showhttpheaders(); + +#Get GUI values +&Header::getcgihash(\%cgiparams); + +# Call subfunction to get all available locations. +my @locations = &fwlib::get_geoip_locations(); + +if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { + # Check if we want to disable geoipblock. + if (exists $cgiparams{'GEOIPBLOCK_ENABLED'}) { + $settings{'GEOIPBLOCK_ENABLED'} = "on"; + } else { + $settings{'GEOIPBLOCK_ENABLED'} = "off"; + } + + # Loop through our locations array to prevent from + # non existing countries or code. + foreach my $cn (@locations) { + # Check if blocking for this country should be enabled/disabled. + if (exists $cgiparams{$cn}) { + $settings{$cn} = "on"; + } else { + $settings{$cn} = "off"; + } + } + + &General::writehash("$settingsfile", \%settings); + + # Mark the firewall config as changed. + &General::firewall_config_changed(); + + # Assign reload notice. We directly can use + # the notice from p2p block. + $notice = $Lang::tr{'p2p block save notice'}; +} + +&Header::openpage($Lang::tr{'geoipblock configuration'}, 1, ''); + +# Print notice that a firewall reload is required. +if ($notice) { + &Header::openbox('100%', 'left', $Lang::tr{'notice'}); + print "<font class='base'>$notice</font>"; + &Header::closebox(); +} + +# Checkbox pre-selection. +my $checked; +if ($settings{'GEOIPBLOCK_ENABLED'} eq "on") { + $checked = "checked='checked'"; +} + +# Print box to enable/disable geoipblock. +print"<form method='POST' action='$ENV{'SCRIPT_NAME'}'>\n"; + +&Header::openbox('100%', 'center', $Lang::tr{'geoipblock'}); +print <<END; + <table width='95%'> + <tr> + <td width='25%' class='base'>$Lang::tr{'geoipblock enable feature'} + <td><input type='checkbox' name='GEOIPBLOCK_ENABLED' $checked></td> + </tr> + <tr> + <td colspan='2'><br></td> + </tr> + </table> + + <hr> + + <table width='95%'> + <tr> + <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}'></td> + </tr> + </table> +END + +&Header::closebox(); + +&Header::openbox('100%', 'center', $Lang::tr{'geoipblock block countries'}); +### JAVA SCRIPT ### +print <<END; +<script> + // Function to allow checking all checkboxes at once. + function check_all() { + \$("#countries").find(":checkbox").prop("checked", true); + } + + function uncheck_all() { + \$("#countries").find(":checkbox").prop("checked", false); + } +</script> + +<table width='95%' class='tbl' id="countries"> + <tr> + <td width='5%' align='center' bgcolor='$color{'color20'}'></td> + <td width='5%' align='center' bgcolor='$color{'color20'}'> + <b>$Lang::tr{'flag'}</b> + </td> + <td width='5%' align='center' bgcolor='$color{'color20'}'> + <b>$Lang::tr{'countrycode'}</b> + </td> + <td with='35%' align='left' bgcolor='$color{'color20'}'> + <b>$Lang::tr{'country'}</b> + </td> + + <td width='5%' bgcolor='$color{'color20'}'> </td> + + <td width='5%' align='center' bgcolor='$color{'color20'}'></td> + <td width='5%' align='center' bgcolor='$color{'color20'}'> + <b>$Lang::tr{'flag'}</b> + </td> + <td width='5%' align='center' bgcolor='$color{'color20'}'> + <b>$Lang::tr{'countrycode'}</b> + </td> + <td with='35%' align='left' bgcolor='$color{'color20'}'> + <b>$Lang::tr{'country'}</b> + </td> + </tr> +END + +my $lines; +my $lines2; +my $col; +foreach my $location (@locations) { + # Country code in upper case. (DE) + my $ccode_uc = $location; + + # County code in lower case. (de) + my $ccode_lc = lc($location); + + # Full name of the country based on the country code. + my $cname = &GeoIP::get_full_country_name($ccode_lc); + + # Get flag icon for of the country. + my $flag_icon = &GeoIP::get_flag_icon($ccode_uc); + + my $flag; + # Check if a flag for the country is available. + if ($flag_icon) { + $flag="<img src='$flag_icon' alt='$ccode_uc' title='$ccode_uc'>"; + } else { + $flag="<b>N/A</b>"; + } + + # Checkbox pre-selection. + my $checked; + if ($settings{$ccode_uc} eq "on") { + $checked = "checked='checked'"; + } + + # Colour lines. + if ($lines % 2) { + $col="bgcolor='$color{'color20'}'"; + } else { + $col="bgcolor='$color{'color22'}'"; + } + + # Grouping elements. + my $line_start; + my $line_end; + if ($lines2 % 2) { + # Increase lines (background color by once. + $lines++; + + # Add empty column in front. + $line_start="<td $col> </td>"; + + # When the line number can be diveded by "2", + # we are going to close the line. + $line_end="</tr>"; + } else { + # When the line number is not divideable by "2", + # we are starting a new line. + $line_start="<tr>"; + $line_end; + } + + print "$line_start<td align='center' $col><input type='checkbox' name='$ccode_uc' $checked></td>\n"; + print "<td align='center' $col>$flag</td>\n"; + print "<td align='center' $col>$ccode_uc</td>\n"; + print "<td align='left' $col>$cname</td>$line_end\n"; + +$lines2++; +} + +print <<END; +</table> + +<table width='95%'> + <tr> + <td align='right'> + <a href="javascript:check_all()">$Lang::tr{'check all'}</a> / + <a href="javascript:uncheck_all()">$Lang::tr{'uncheck all'}</a> + </td> + </tr> + <tr> + <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}'></td> + </tr> +</table> + +<hr> + +<table width='70%'> + <tr> + <td width='5%'><img src='/images/on.gif'></td> + <td>$Lang::tr{'geoipblock country is blocked'}</td> + <td width='5%'><img src='/images/off.gif'></td> + <td>$Lang::tr{'geoipblock country is allowed'}</td> + </tr> +</table> +END + +&Header::closebox(); +print"</form>\n"; + +&Header::closebigbox(); +&Header::closepage(); diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index fe4a200..e295412 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -416,6 +416,7 @@ 'bit' => 'Bit', 'bitrate' => 'Bitrate', 'bleeding rules' => 'Bleeding Edge Snort Rules', +'block' => 'Blocken', 'blue' => 'BLAU', 'blue access' => 'Zugriff auf Blau', 'blue access use hint' => 'Sie müssen mindestens die MAC- oder die IP-Adresse für ein Gerät angeben. Optional können Sie sowohl MAC- als auch IP-Adresse angeben.', @@ -532,6 +533,7 @@ 'chain' => 'Verknüpfung', 'change passwords' => 'Passwörter ändern', 'change share' => 'Freigabeeinstellungen ändern', +'check all' => 'Alle auswählen', 'check for net traffic update' => 'Prüfe auf Net-Traffic-Updates', 'check vpn lr' => 'Überprüfen', 'choose config' => 'Konfiguration auswählen', @@ -1067,6 +1069,7 @@ 'fwhost OpenVPN static host' => 'OpenVPN statischer Host', 'fwhost OpenVPN static network' => 'OpenVPN statisches Netzwerk', 'fwhost Standard Network' => 'Standard-Netzwerk', +'fwhost addgeoipgrp' => 'Neue GeoIP-Gruppe hinzufügen', 'fwhost addgrp' => 'Neue Gruppe hinzufügen', 'fwhost addgrpname' => 'Gruppenname:', 'fwhost addhost' => 'Neuen Host hinzufügen', @@ -1082,6 +1085,9 @@ 'fwhost change' => 'Ändern', 'fwhost changeremark' => 'Es wurde nur die Bemerkung angepasst.', 'fwhost cust addr' => 'Hosts', +'fwhost cust geoip' => 'GeoIP-Gruppen', +'fwhost cust geoipgroup' => 'GeoIP-Gruppen', +'fwhost cust geoiplocation' => 'GeoIP Ländercodes', 'fwhost cust grp' => 'Gruppen', 'fwhost cust net' => 'Netzwerke', 'fwhost cust service' => 'Dienste', @@ -1128,6 +1134,7 @@ 'fwhost ipsec net' => 'IPsec-Netzwerke:', 'fwhost menu' => 'Firewallgruppen', 'fwhost netaddress' => 'Netzwerkadresse', +'fwhost newgeoipgrp' => 'GeoIP-Gruppen', 'fwhost newgrp' => 'Netzwerk-/Hostgruppen', 'fwhost newhost' => 'Hosts', 'fwhost newnet' => 'Netzwerke', @@ -1162,6 +1169,16 @@ 'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient' => 'Die Erzeugung der Root- und Host-Zertifikate kann lange Zeit dauern. Auf älterer Hardware kann es mehrere Minuten lang dauern. Bitte haben Sie etwas Geduld.', 'genkey' => 'PSK erzeugen', 'genre' => 'Genre', +'geoip' => 'GeoIP', +'geoipblock' => 'GeoIP Block', +'geoipblock block countries' => 'Länderfilter', +'geoipblock configuration' => 'GeoIP Konfiguration', +'geoipblock country code' => 'Ländercode', +'geoipblock country is allowed' => 'Eingehende Verbindungen aus diesem Land sind erlaubt.', +'geoipblock country is blocked' => 'Eingehende Verbindungen aus diesem Land werden blockiert.', +'geoipblock country name' => 'Ländername', +'geoipblock enable feature' => 'GeoIP basierte Filterung aktivieren:', +'geoipblock flag' => 'Flagge', 'global settings' => 'Globale Einstellungen', 'gpl i accept these terms and conditions' => 'Ich akzeptiere diese Bedingungen und Konditionen', 'gpl license agreement' => 'Lizenz-Vereinbarung', @@ -2216,6 +2233,9 @@ 'umount removable media before to unplug' => 'Wechselmedien vor dem Entfernen unbedingt abmelden', 'unable to alter profiles while red is active' => 'Profile können nicht geändert werden, solange ROT aktiv ist.', 'unable to contact' => 'Kann nicht erreicht werden', +'unblock' => 'Entblocken', +'unblock all' => 'Alle entblocken', +'uncheck all' => 'Alle abwählen', 'unencrypted' => 'Nicht verschlüsselt', 'uninstall' => 'Deinstallieren', 'unix charset' => 'UNIX-Charset', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 174300e..80c0552 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -435,6 +435,7 @@ 'bit' => 'bit', 'bitrate' => 'Bitrate', 'bleeding rules' => 'Bleeding Edge Snort Rules', +'block' => 'Block', 'blue' => 'BLUE', 'blue access' => 'Blue Access', 'blue access use hint' => 'You have to enter the MAC or the IP Address for a device. To enter both is also possible', @@ -550,6 +551,7 @@ 'chain' => 'Chain', 'change passwords' => 'Change passwords', 'change share' => 'edit share options', +'check all' => 'Check all', 'check for net traffic update' => 'Check for Net-Traffic updates', 'check vpn lr' => 'Check', 'choose config' => 'Choose config', @@ -1094,6 +1096,7 @@ 'fwhost OpenVPN static host' => 'OpenVPN static host', 'fwhost OpenVPN static network' => 'OpenVPN static network', 'fwhost Standard Network' => 'Standard network', +'fwhost addgeoipgrp' => 'Add new GeoIP group', 'fwhost addgrp' => 'Add new network/host group', 'fwhost addgrpname' => 'Group name:', 'fwhost addhost' => 'Add new host', @@ -1109,6 +1112,9 @@ 'fwhost change' => 'Modify', 'fwhost changeremark' => 'You modified just the remark', 'fwhost cust addr' => 'Hosts', +'fwhost cust geoip' => 'GeoIP Groups', +'fwhost cust geoipgroup' => 'GeoIP Groups', +'fwhost cust geoiplocation' => 'GeoIP Locations', 'fwhost cust grp' => 'Network/Host Groups', 'fwhost cust net' => 'Networks', 'fwhost cust service' => 'Services', @@ -1155,6 +1161,7 @@ 'fwhost ipsec net' => 'IPsec networks:', 'fwhost menu' => 'Firewall Groups', 'fwhost netaddress' => 'Network address', +'fwhost newgeoipgrp' => 'GeoIP Groups', 'fwhost newgrp' => 'Network/Host Groups', 'fwhost newhost' => 'Hosts', 'fwhost newnet' => 'Networks', @@ -1191,6 +1198,16 @@ 'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient' => 'Generating the root and host certificates may take a long time. It can take up to several minutes on older hardware. Please be patient.', 'genkey' => 'Generate PSK', 'genre' => 'Genre', +'geoip' => 'GeoIP', +'geoipblock' => 'GeoIP Block', +'geoipblock block countries' => 'Block countries', +'geoipblock configuration' => 'GeoIP Configuration', +'geoipblock country code' => 'Country Code', +'geoipblock country is allowed' => 'Incoming traffic from this country is allowed', +'geoipblock country is blocked' => 'Incoming traffic from this country will be blocked', +'geoipblock country name' => 'Country Name', +'geoipblock enable feature' => 'Enable GeoIP based blocking:', +'geoipblock flag' => 'Flag', 'global settings' => 'Global Settings', 'gpl i accept these terms and conditions' => 'I accept these terms and conditions', 'gpl license agreement' => 'License Agreement', @@ -2255,6 +2272,9 @@ 'umount removable media before to unplug' => 'Umount removable media before unplugging the device', 'unable to alter profiles while red is active' => 'Unable to alter profiles while RED is active.', 'unable to contact' => 'Unable to contact', +'unblock' => 'Unblock', +'unblock all' => 'Unblock all', +'uncheck all' => 'Uncheck all', 'unencrypted' => 'Unencrypted', 'uninstall' => 'Uninstall', 'unix charset' => 'UNIX Charset', diff --git a/langs/es/cgi-bin/es.pl b/langs/es/cgi-bin/es.pl index b7c50ff..90f4237 100644 --- a/langs/es/cgi-bin/es.pl +++ b/langs/es/cgi-bin/es.pl @@ -866,6 +866,16 @@ 'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient' => 'Generar los certificador root y host puede tomar mucho tiempo. Puede durar varios minutos en equipos antiguos. Por favor sea paciente.', 'genkey' => 'Generar PSK', 'genre' => 'Género', +'geoip' => 'GeoIP', +'geoipblock' => 'GeoIP Block', +'geoipblock block countries' => 'Países bloqueados', +'geoipblock configuration' => 'Configuración GeoIP', +'geoipblock country code' => 'Código del País', +'geoipblock country is allowed' => 'Se permite el tráfico procedente de este País', +'geoipblock country is blocked' => 'Se deniega el tráfico procedente de este País', +'geoipblock country name' => 'Nombre del País', +'geoipblock enable feature' => 'Habilitar bloqueo basado GeoIP:', +'geoipblock flag' => 'Bandera', 'global settings' => 'Configuraciones globales', 'gpl i accept these terms and conditions' => 'I accept these terms and conditions', 'gpl license agreement' => 'License Agreement', diff --git a/lfs/configroot b/lfs/configroot index e0bb346..601cdf6 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -64,8 +64,8 @@ $(TARGET) : for i in auth/users backup/include.user backup/exclude.user \ certs/index.txt ddns/config ddns/noipsettings ddns/settings ddns/ipcache dhcp/settings \ dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \ - ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/input firewall/outgoing \ - fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwlogs/ipsettings fwlogs/portsettings \ + ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \ + fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \ isdn/settings mac/settings main/disable_nf_sip main/hosts main/routing main/settings net-traffic/settings optionsfw/settings \ ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \ ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \ @@ -78,6 +78,7 @@ $(TARGET) : cp $(DIR_SRC)/config/cfgroot/header.pl $(CONFIG_ROOT)/ cp $(DIR_SRC)/config/cfgroot/general-functions.pl $(CONFIG_ROOT)/ cp $(DIR_SRC)/config/cfgroot/network-functions.pl $(CONFIG_ROOT)/ + cp $(DIR_SRC)/config/cfgroot/geoip-functions.pl $(CONFIG_ROOT)/ cp $(DIR_SRC)/config/cfgroot/lang.pl $(CONFIG_ROOT)/ cp $(DIR_SRC)/config/cfgroot/countries.pl $(CONFIG_ROOT)/ cp $(DIR_SRC)/config/cfgroot/graphs.pl $(CONFIG_ROOT)/ diff --git a/lfs/perl-Text-CSV_XS b/lfs/perl-Text-CSV_XS new file mode 100644 index 0000000..f94593f --- /dev/null +++ b/lfs/perl-Text-CSV_XS @@ -0,0 +1,77 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2014 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + + +############################################################################### +# Definitions +############################################################################### + +include Config +VER = 1.12 + +THISAPP = Text-CSV_XS-$(VER) +DL_FILE = ${THISAPP}.tgz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = b91f2d806054b68c2a29d3da5821fe87 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && perl Makefile.PL + cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/lfs/stage2 b/lfs/stage2 index 53f81d1..3203983 100644 --- a/lfs/stage2 +++ b/lfs/stage2 @@ -55,7 +55,7 @@ $(TARGET) : -install -dv -m 1777 /tmp /var/tmp -mkdir -pv /usr/{,local/}{bin,include,lib{,/sse2},sbin,src} -mkdir -pv /usr/{,local/}share/{doc,info,locale,man} - -mkdir -v /usr/{,local/}share/{misc,terminfo,zoneinfo} + -mkdir -v /usr/{,local/}share/{misc,terminfo,xt_geoip,zoneinfo} -mkdir -pv /usr/{,local/}share/man/man{1..8} #-for dir in /usr /usr/local; do \ # ln -sv share/{man,doc,info} $$dir; \ diff --git a/lfs/xtables-addons b/lfs/xtables-addons new file mode 100644 index 0000000..1848dc9 --- /dev/null +++ b/lfs/xtables-addons @@ -0,0 +1,110 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VERSUFIX = ipfire$(KCFG) +MODPATH = /lib/modules/$(KVER)-$(VERSUFIX)/extra/ + +VER = 2.6 + +THISAPP = xtables-addons-$(VER) +DL_FILE = $(THISAPP).tar.xz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) + +ifeq "$(USPACE)" "1" + TARGET = $(DIR_INFO)/$(THISAPP) +else + TARGET = $(DIR_INFO)/$(THISAPP)-kmod-$(KVER)-$(VERSUFIX) +endif + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 087835ba7e564481b6fd398692268340 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + $(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + + # Only build the specified modules. + cp -avf $(DIR_SRC)/config/xtables-addons/mconfig \ + $(DIR_APP)/mconfig + +# Check if we build the modules for a kernel or the userspace parts. +ifeq "$(USPACE)" "1" + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --without-kbuild + + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install +else + cd $(DIR_APP) && ./configure \ + --with-kbuild=/usr/src/linux-$(KVER)/ + + cd $(DIR_APP) && make $(MAKETUNING) + + # Install the built kernel modules. + cd $(DIR_APP) && for f in $$(ls extensions/*.ko); do \ + install -m 644 $$f $(MODPATH); \ + done +endif + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 316917e..6662096 100755 --- a/make.sh +++ b/make.sh @@ -383,6 +383,7 @@ buildipfire() { export LOGFILE ipfiremake configroot ipfiremake backup + ipfiremake pkg-config ipfiremake libusb ipfiremake libusbx ipfiremake libpcap @@ -403,6 +404,8 @@ buildipfire() { ipfiremake multipath-tools ipfiremake freetype ipfiremake grub + ipfiremake libmnl + ipfiremake iptables case "${TARGET_ARCH}" in i586) @@ -413,6 +416,7 @@ buildipfire() { ipfiremake e1000e KCFG="-pae" # ipfiremake igb KCFG="-pae" ipfiremake ixgbe KCFG="-pae" + ipfiremake xtables-addons KCFG="-pae" ipfiremake linux-initrd KCFG="-pae" # x86 kernel build @@ -422,6 +426,7 @@ buildipfire() { ipfiremake e1000e KCFG="" # ipfiremake igb KCFG="" ipfiremake ixgbe KCFG="" + ipfiremake xtables-addons KCFG="" ipfiremake linux-initrd KCFG="" ;; @@ -430,6 +435,7 @@ buildipfire() { ipfiremake linux KCFG="-rpi" ipfiremake backports KCFG="-rpi" ipfiremake cryptodev KCFG="-rpi" + ipfiremake xtables-addons KCFG="-rpi" ipfiremake linux-initrd KCFG="-rpi" # arm multi platform (Panda, Wandboard ...) kernel build @@ -439,6 +445,7 @@ buildipfire() { ipfiremake e1000e KCFG="-multi" # ipfiremake igb KCFG="-multi" ipfiremake ixgbe KCFG="-multi" + ipfiremake xtables-addons KCFG="-multi" ipfiremake linux-initrd KCFG="-multi" # arm-kirkwood (Dreamplug, ICY-Box ...) kernel build @@ -448,10 +455,11 @@ buildipfire() { ipfiremake e1000e KCFG="-kirkwood" # ipfiremake igb KCFG="-kirkwood" ipfiremake ixgbe KCFG="-kirkwood" + ipfiremake xtables-addons KCFG="-kirkwood" ipfiremake linux-initrd KCFG="-kirkwood" ;; esac - ipfiremake pkg-config + ipfiremake xtables-addons USPACE="1" ipfiremake openssl ipfiremake openssl-compat ipfiremake libgpg-error @@ -526,8 +534,6 @@ buildipfire() { ipfiremake mtools ipfiremake initscripts ipfiremake whatmask - ipfiremake libmnl - ipfiremake iptables ipfiremake conntrack-tools ipfiremake libupnp ipfiremake ipaddr @@ -810,6 +816,7 @@ buildipfire() { ipfiremake squid-accounting ipfiremake pigz ipfiremake tmux + ipfiremake perl-Text-CSV_XS ipfiremake swconfig ipfiremake haproxy } diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index c383652..8ca02bc 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -179,6 +179,11 @@ iptables_init() { iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT fi + # GeoIP block + iptables -N GEOIPBLOCK + iptables -A INPUT -j GEOIPBLOCK + iptables -A FORWARD -j GEOIPBLOCK + # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything iptables -N IPSECINPUT iptables -N IPSECFORWARD diff --git a/src/initscripts/init.d/networking/red.up/99-geoip-database b/src/initscripts/init.d/networking/red.up/99-geoip-database new file mode 100644 index 0000000..4bd3ee2 --- /dev/null +++ b/src/initscripts/init.d/networking/red.up/99-geoip-database @@ -0,0 +1,23 @@ +#!/bin/bash + +# Get the GeoIP database if no one exists yet. + +DIR="/usr/share/xt_geoip/*" + +found=false + +# Check if the directory contains any data. +for i in $DIR; do + # Ignore "." and ".." + if [ -d "$i" ]; then + found=true + break + fi +done + +# Download ruleset if none has been found. +if ! ${found}; then + /usr/local/bin/xt_geoip_update >/dev/null 2>&1 +fi + +exit 0 diff --git a/src/scripts/xt_geoip_build b/src/scripts/xt_geoip_build new file mode 100644 index 0000000..202156f --- /dev/null +++ b/src/scripts/xt_geoip_build @@ -0,0 +1,89 @@ +#!/usr/bin/perl +# +# Converter for MaxMind CSV database to binary, for xt_geoip +# Copyright © Jan Engelhardt, 2008-2011 +# +use Getopt::Long; +use IO::Handle; +use Text::CSV_XS; # or trade for Text::CSV +use strict; + +my $csv = Text::CSV_XS->new({ + allow_whitespace => 1, + binary => 1, + eol => $/, +}); # or Text::CSV +my $target_dir = "."; + +&Getopt::Long::Configure(qw(bundling)); +&GetOptions( + "D=s" => \$target_dir, +); + +if (!-d $target_dir) { + print STDERR "Target directory $target_dir does not exist.\n"; + exit 1; +} + +my $dir = "$target_dir/LE"; +if (!-e $dir && !mkdir($dir)) { + print STDERR "Could not mkdir $dir: $!\n"; + exit 1; +} + +&dump(&collect()); + +sub collect +{ + my %country; + + while (my $row = $csv->getline(*ARGV)) { + if (!defined($country{$row->[4]})) { + $country{$row->[4]} = { + name => $row->[5], + pool_v4 => [], + pool_v6 => [], + }; + } + my $c = $country{$row->[4]}; + + push(@{$c->{pool_v4}}, [$row->[2], $row->[3]]); + + if ($. % 4096 == 0) { + print STDERR "\r\e[2K$. entries"; + } + } + + print STDERR "\r\e[2K$. entries total\n"; + return \%country; +} + +sub dump +{ + my $country = shift @_; + + foreach my $iso_code (sort keys %$country) { + &dump_one($iso_code, $country->{$iso_code}); + } +} + +sub dump_one +{ + my($iso_code, $country) = @_; + my($file, $fh_le, $fh_be); + + printf "%5u IPv4 ranges for %s %s\n", + scalar(@{$country->{pool_v4}}), + $iso_code, $country->{name}; + + $file = "$target_dir/LE/".uc($iso_code).".iv4"; + if (!open($fh_le, "> $file")) { + print STDERR "Error opening $file: $!\n"; + exit 1; + } + foreach my $range (@{$country->{pool_v4}}) { + print $fh_le pack("VV", $range->[0], $range->[1]); + #print $fh_be pack("NN", $range->[0], $range->[1]); + } + close $fh_le; +} diff --git a/src/scripts/xt_geoip_update b/src/scripts/xt_geoip_update new file mode 100644 index 0000000..0ee7744 --- /dev/null +++ b/src/scripts/xt_geoip_update @@ -0,0 +1,137 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2014 IPFire Development Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +TMP_PATH=$(mktemp -d) +TMP_FILE=$(mktemp -p $TMP_PATH) + +SCRIPT_PATH=/usr/local/bin +DEST_PATH=/usr/share/xt_geoip + +DL_URL=http://geolite.maxmind.com/download/geoip/database +DL_FILE=GeoIPCountryCSV.zip + +CSV_FILE=GeoIPCountryWhois.csv + +ARCH=LE + +eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings) + +function download() { + echo "Downloading latest GeoIP ruleset..." + + # Create temporary directory. + mkdir -pv $TMP_PATH + + # Proxy settings. + # Check if a proxy should be used. + if [[ $UPSTREAM_PROXY ]]; then + PROXYSETTINGS="-e http_proxy=http://" + + # Check if authentication against the proxy is configured. + if [[ $UPSTREAM_USER && $UPSTREAM_PASSWORD ]]; then + PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_USER:$UPSTREAM_PASSWORD@" + fi + + # Add proxy server. + PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_PROXY" + fi + + # Get the latest GeoIP database from server. + wget $DL_URL/$DL_FILE $PROXYSETTINGS -O $TMP_FILE + + # Extract files. + unzip $TMP_FILE -d $TMP_PATH + + return 0 +} + +function build() { + echo "Convert database..." + + # Check if the csv file exists. + if [ ! -e $TMP_PATH/$CSV_FILE ]; then + echo "$TMP_PATH/$CSV_FILE not found. Exiting." + return 1 + fi + + # Run script to convert the CSV file into several xtables + # compatible binary files. + if ! $SCRIPT_PATH/xt_geoip_build $TMP_PATH/$CSV_FILE -D $TMP_PATH; then + echo "Could not convert ruleset. Aborting." >&2 + return 1 + fi + + return 0 +} + +function install() { + echo "Install databases..." + + # Check if our destination exist. + if [ ! -e "$DEST_PATH" ]; then + mkdir -p $DEST_PATH &>/dev/null + fi + + # Install databases. + if ! cp -af $TMP_PATH/$ARCH $DEST_PATH &>/dev/null; then + echo "Could not copy files. Aborting." >&2 + return 1 + fi + + return 0 +} + +function cleanup() { + echo "Cleaning up temporary files..." + if ! rm -rf $TMP_PATH &>/dev/null; then + echo "Could not remove files. Aborting." >&2 + return 1 + fi + + return 0 +} + +function main() { + # Download ruleset. + download || exit $? + + # Convert the ruleset. + if ! build; then + # Do cleanup. + cleanup || exit $? + exit 1 + fi + + # Install the converted ruleset. + if ! install; then + # Do cleanup. + cleanup || exit $? + exit 1 + fi + + # Finaly remove temporary files. + cleanup || exit $? + + return 0 +} + +# Run the main function. +main hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. d54a2ce45232412d2b674df51cc8012d8e2c846d
by git＠ipfire.org 18 Apr '15

18 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via d54a2ce45232412d2b674df51cc8012d8e2c846d (commit) from 4d9e31ab78dbcf8d6c7cd5720d7cdf410281d778 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d54a2ce45232412d2b674df51cc8012d8e2c846d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Apr 18 16:11:29 2015 +0200 dnsmasq: Import more patches from upstream ----------------------------------------------------------------------- Summary of changes: .../{oldcore/84 => core/90}/filelists/dnsmasq | 0 lfs/dnsmasq | 7 ++ ...newline-at-the-end-of-example-config-file.patch | 2 +- ...artup-when-an-empty-suffix-is-supplied-to.patch | 2 +- .../0003-Debian-build-fixes-for-kFreeBSD.patch | 2 +- ...04-Set-conntrack-mark-before-connect-call.patch | 2 +- .../dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch | 2 +- .../dnsmasq/0006-Fit-example-conf-file-typo.patch | 2 +- ...-compliance-when-unable-to-supply-address.patch | 2 +- .../0008-Fix-conntrack-with-bind-interfaces.patch | 2 +- ...9-Use-inotify-instead-of-polling-on-Linux.patch | 2 +- ...Teach-the-new-inotify-code-about-symlinks.patch | 2 +- ...ve-floor-on-EDNS0-packet-size-with-DNSSEC.patch | 2 +- .../dnsmasq/0012-CHANGELOG-re.-inotify.patch | 2 +- ...ix-breakage-of-domain-domain-subnet-local.patch | 2 +- ...ve-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch | 2 +- ...Pv6-privacy-addresses-from-interface-name.patch | 2 +- ...-width-in-cache-dump-to-avoid-truncating-.patch | 2 +- ...n-DNSSEC-code-when-attempting-to-verify-l.patch | 2 +- ...g-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch | 2 +- ...x-problems-validating-NSEC3-and-wildcards.patch | 2 +- .../dnsmasq/0020-Initialise-return-value.patch | 2 +- .../dnsmasq/0021-Add-ignore-address-option.patch | 2 +- .../dnsmasq/0022-Bad-packet-protection.patch | 2 +- ...-build-failure-in-new-inotify-code-on-BSD.patch | 2 +- ...t-makefile-dependencies-on-COPTS-variable.patch | 2 +- ...0025-Fix-race-condition-issue-in-makefile.patch | 2 +- ...op-down-search-for-limit-of-secure-delega.patch | 2 +- ...ries-extra-option-for-more-complete-loggi.patch | 2 +- .../dnsmasq/0028-Add-min-cache-ttl-option.patch | 2 +- ...ort-of-requestor-when-doing-extra-logging.patch | 2 +- ...r-from-cache-RRsets-from-wildcards-as-we-.patch | 2 +- .../0031-Logs-for-DS-records-consistent.patch | 2 +- ...ultiple-interfaces-with-the-same-LL-addre.patch | 2 +- ...n-t-treat-SERVFAIL-as-a-recoverable-error.patch | 2 +- .../0034-Add-dhcp-hostsdir-config-option.patch | 2 +- .../dnsmasq/0035-Update-German-translation.patch | 2 +- ...-to-DHCPv6-SOLICIT-messages-when-not-conf.patch | 2 +- ...fy-to-be-disabled-at-compile-time-on-Linu.patch | 2 +- ...ify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch | 2 +- .../0039-Update-copyrights-for-dawn-of-2015.patch | 2 +- .../0040-inotify-documentation-updates.patch | 2 +- .../0041-Fix-broken-ECDSA-DNSSEC-signatures.patch | 2 +- src/patches/dnsmasq/0042-BSD-make-support.patch | 2 +- .../0043-Fix-build-failure-on-openBSD.patch | 2 +- src/patches/dnsmasq/0044-Manpage-typo-fix.patch | 2 +- ...configs-after-reading-extra-hostfiles-wit.patch | 2 +- .../0046-Extra-logging-for-inotify-code.patch | 2 +- src/patches/dnsmasq/0047-man-page-typo.patch | 2 +- ...sion-script-which-returned-wrong-tag-in-s.patch | 2 +- src/patches/dnsmasq/0049-Typos.patch | 2 +- ...ynamic-hosts-files-work-when-no-hosts-set.patch | 2 +- ...-trivial-memory-leaks-to-quieten-valgrind.patch | 2 +- ...ninitialized-value-used-in-get_client_mac.patch | 2 +- ...-Log-parsing-utils-in-contrib-reverse-dns.patch | 2 +- ...-Add-dnssec-timestamp-option-and-facility.patch | 2 +- ...mmit-to-not-crash-if-uid-changing-not-con.patch | 2 +- .../0056-New-version-of-contrib-reverse-dns.patch | 2 +- ...C-timestamp-code-to-create-file-later-rem.patch | 2 +- ...late-code-for-re-running-system-calls-on-.patch | 2 +- ...s-example.com-equivalent-to-server-exampl.patch | 2 +- ...tbound-interface-via-cmsg-in-unicast-repl.patch | 2 +- ...DNSSEC-when-a-signed-CNAME-dangles-into-a.patch | 2 +- ...Return-SERVFAIL-when-validation-abandoned.patch | 2 +- ...3-Protect-against-broken-DNSSEC-upstreams.patch | 2 +- ...EC-fix-for-non-ascii-characters-in-labels.patch | 2 +- ...ol-characters-in-names-in-the-cache-handl.patch | 2 +- .../dnsmasq/0066-Fix-crash-in-last-commit.patch | 2 +- .../dnsmasq/0067-Merge-message-translations.patch | 2 +- ...-tftp-no-fail-to-ignore-missing-tftp-root.patch | 2 +- src/patches/dnsmasq/0069-Whitespace-fixes.patch | 2 +- ...CURE-rather-than-BOGUS-when-DS-proved-not.patch | 2 +- ...ompiler-warning-when-not-including-DNSSEC.patch | 2 +- ...aused-by-looking-up-servers.bind-when-man.patch | 54 ++++++++++ ...n-receipt-of-certain-malformed-DNS-reques.patch | 61 +++++++++++ ...crash-in-auth-code-with-odd-configuration.patch | 113 +++++++++++++++++++++ ...rect-replies-to-NS-and-SOA-in-.arpa-zones.patch | 106 +++++++++++++++++++ ...rk-induced-crash-in-new-tftp_no_fail-code.patch | 36 +++++++ src/patches/dnsmasq/0077-Note-CVE-2015-3294.patch | 26 +++++ ...-when-reporting-DNSSEC-validation-failure.patch | 59 +++++++++++ 80 files changed, 533 insertions(+), 71 deletions(-) copy config/rootfiles/{oldcore/84 => core/90}/filelists/dnsmasq (100%) create mode 100644 src/patches/dnsmasq/0072-Fix-crash-caused-by-looking-up-servers.bind-when-man.patch create mode 100644 src/patches/dnsmasq/0073-Fix-crash-on-receipt-of-certain-malformed-DNS-reques.patch create mode 100644 src/patches/dnsmasq/0074-Fix-crash-in-auth-code-with-odd-configuration.patch create mode 100644 src/patches/dnsmasq/0075-Auth-correct-replies-to-NS-and-SOA-in-.arpa-zones.patch create mode 100644 src/patches/dnsmasq/0076-Fix-srk-induced-crash-in-new-tftp_no_fail-code.patch create mode 100644 src/patches/dnsmasq/0077-Note-CVE-2015-3294.patch create mode 100644 src/patches/dnsmasq/0078-Log-domain-when-reporting-DNSSEC-validation-failure.patch Difference in files: diff --git a/config/rootfiles/core/90/filelists/dnsmasq b/config/rootfiles/core/90/filelists/dnsmasq new file mode 120000 index 0000000..d469c74 --- /dev/null +++ b/config/rootfiles/core/90/filelists/dnsmasq @@ -0,0 +1 @@ +../../../common/dnsmasq \ No newline at end of file diff --git a/lfs/dnsmasq b/lfs/dnsmasq index 15a86a5..665f424 100644 --- a/lfs/dnsmasq +++ b/lfs/dnsmasq @@ -144,6 +144,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0069-Whitespace-fixes.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0070-Return-INSECURE-rather-than-BOGUS-when-DS-proved-not.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0071-Fix-compiler-warning-when-not-including-DNSSEC.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0072-Fix-crash-caused-by-looking-up-servers.bind-when-man.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0073-Fix-crash-on-receipt-of-certain-malformed-DNS-reques.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0074-Fix-crash-in-auth-code-with-odd-configuration.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0075-Auth-correct-replies-to-NS-and-SOA-in-.arpa-zones.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0076-Fix-srk-induced-crash-in-new-tftp_no_fail-code.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0077-Note-CVE-2015-3294.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq/0078-Log-domain-when-reporting-DNSSEC-validation-failure.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/dnsmasq-Add-support-to-read-ISC-DHCP-lease-file.patch cd $(DIR_APP) && sed -i src/config.h \ -e 's|/\* #define HAVE_IDN \*/|#define HAVE_IDN|g' \ diff --git a/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch b/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch index 09e3858..a9d5a92 100644 --- a/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch +++ b/src/patches/dnsmasq/0001-Add-newline-at-the-end-of-example-config-file.patch @@ -1,7 +1,7 @@ From f2658275b25ebfe691cdcb9fede85a3088cca168 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Thu, 25 Sep 2014 21:51:25 +0100 -Subject: [PATCH 01/71] Add newline at the end of example config file. +Subject: [PATCH 01/78] Add newline at the end of example config file. --- dnsmasq.conf.example | 2 +- diff --git a/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch b/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch index bcaac85..a4041ea 100644 --- a/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch +++ b/src/patches/dnsmasq/0002-crash-at-startup-when-an-empty-suffix-is-supplied-to.patch @@ -1,7 +1,7 @@ From 00cd9d551998307225312fd21f761cfa8868bd2c Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Thu, 2 Oct 2014 21:44:21 +0100 -Subject: [PATCH 02/71] crash at startup when an empty suffix is supplied to +Subject: [PATCH 02/78] crash at startup when an empty suffix is supplied to --conf-dir --- diff --git a/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch b/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch index a7ef611..ca62340 100644 --- a/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch +++ b/src/patches/dnsmasq/0003-Debian-build-fixes-for-kFreeBSD.patch @@ -1,7 +1,7 @@ From 6ac3bc0452a74e16e3d620a0757b0f8caab182ec Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Fri, 3 Oct 2014 08:48:11 +0100 -Subject: [PATCH 03/71] Debian build fixes for kFreeBSD +Subject: [PATCH 03/78] Debian build fixes for kFreeBSD --- src/tables.c | 6 +++++- diff --git a/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch b/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch index e64e314..2504e62 100644 --- a/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch +++ b/src/patches/dnsmasq/0004-Set-conntrack-mark-before-connect-call.patch @@ -1,7 +1,7 @@ From e9828b6f66b22ce8873f8d30a773137d1aef1b92 Mon Sep 17 00:00:00 2001 From: Karl Vogel <karl.vogel(a)gmail.com> Date: Fri, 3 Oct 2014 21:45:15 +0100 -Subject: [PATCH 04/71] Set conntrack mark before connect() call. +Subject: [PATCH 04/78] Set conntrack mark before connect() call. SO_MARK has to be done before issuing the connect() call on the TCP socket. diff --git a/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch b/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch index 48ed92e..bec87bc 100644 --- a/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch +++ b/src/patches/dnsmasq/0005-Fix-typo-in-new-Dbus-code.patch @@ -1,7 +1,7 @@ From 17b475912f6a4e72797a543dad59d4d5dde6bb1b Mon Sep 17 00:00:00 2001 From: Daniel Collins <daniel.collins(a)smoothwall.net> Date: Fri, 3 Oct 2014 21:58:43 +0100 -Subject: [PATCH 05/71] Fix typo in new Dbus code. +Subject: [PATCH 05/78] Fix typo in new Dbus code. Simon's fault. --- diff --git a/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch b/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch index c8c5169..6b5345f 100644 --- a/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch +++ b/src/patches/dnsmasq/0006-Fit-example-conf-file-typo.patch @@ -1,7 +1,7 @@ From 3d9d2dd0018603a2ae4b9cd65ac6ff959f4fd8c7 Mon Sep 17 00:00:00 2001 From: Tomas Hozza <thozza(a)redhat.com> Date: Mon, 6 Oct 2014 10:46:48 +0100 -Subject: [PATCH 06/71] Fit example conf file typo. +Subject: [PATCH 06/78] Fit example conf file typo. --- dnsmasq.conf.example | 2 +- diff --git a/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch b/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch index c21ece4..ffad3b2 100644 --- a/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch +++ b/src/patches/dnsmasq/0007-Improve-RFC-compliance-when-unable-to-supply-address.patch @@ -1,7 +1,7 @@ From b9ff5c8f435173cfa616e3c398bdc089ef690a07 Mon Sep 17 00:00:00 2001 From: Vladislav Grishenko <themiron(a)mail.ru> Date: Mon, 6 Oct 2014 14:34:24 +0100 -Subject: [PATCH 07/71] Improve RFC-compliance when unable to supply addresses +Subject: [PATCH 07/78] Improve RFC-compliance when unable to supply addresses in DHCPv6 While testing https://github.com/sbyx/odhcp6c client I have noticed it diff --git a/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch b/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch index 227cab7..671a70e 100644 --- a/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch +++ b/src/patches/dnsmasq/0008-Fix-conntrack-with-bind-interfaces.patch @@ -1,7 +1,7 @@ From 98906275a02ae260fe3f82133bd79054f8315f06 Mon Sep 17 00:00:00 2001 From: Hans Dedecker <dedeckeh(a)gmail.com> Date: Tue, 9 Dec 2014 22:22:53 +0000 -Subject: [PATCH 08/71] Fix conntrack with --bind-interfaces +Subject: [PATCH 08/78] Fix conntrack with --bind-interfaces Make sure dst_addr is assigned the correct address in receive_query when OPTNOWILD is enabled so the assigned mark can be correctly retrieved and set in forward_query when diff --git a/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch b/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch index 7773e0b..e9c51f8 100644 --- a/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch +++ b/src/patches/dnsmasq/0009-Use-inotify-instead-of-polling-on-Linux.patch @@ -1,7 +1,7 @@ From 193de4abf59e49c6b70d54cfe9720fcb95ca2f71 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Wed, 10 Dec 2014 17:32:16 +0000 -Subject: [PATCH 09/71] Use inotify instead of polling on Linux. +Subject: [PATCH 09/78] Use inotify instead of polling on Linux. This should solve problems people are seeing when a file changes twice within a second and thus is missed for polling. diff --git a/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch b/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch index f5e0ccd..2f8574e 100644 --- a/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch +++ b/src/patches/dnsmasq/0010-Teach-the-new-inotify-code-about-symlinks.patch @@ -1,7 +1,7 @@ From 857973e6f7e0a3d03535a9df7f9373fd7a0b65cc Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 15 Dec 2014 15:58:13 +0000 -Subject: [PATCH 10/71] Teach the new inotify code about symlinks. +Subject: [PATCH 10/78] Teach the new inotify code about symlinks. --- src/inotify.c | 43 +++++++++++++++++++++++++++---------------- diff --git a/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch b/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch index 800cfb6..66b6331 100644 --- a/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch +++ b/src/patches/dnsmasq/0011-Remove-floor-on-EDNS0-packet-size-with-DNSSEC.patch @@ -1,7 +1,7 @@ From 800c5cc1e7438818fd80f08c2d472df249a6942d Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 15 Dec 2014 17:50:15 +0000 -Subject: [PATCH 11/71] Remove floor on EDNS0 packet size with DNSSEC. +Subject: [PATCH 11/78] Remove floor on EDNS0 packet size with DNSSEC. --- CHANGELOG | 6 +++++- diff --git a/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch b/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch index 1a0925a..3df5076 100644 --- a/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch +++ b/src/patches/dnsmasq/0012-CHANGELOG-re.-inotify.patch @@ -1,7 +1,7 @@ From ad946d555dce44eb690c7699933b6ff40ab85bb6 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 15 Dec 2014 17:52:22 +0000 -Subject: [PATCH 12/71] CHANGELOG re. inotify. +Subject: [PATCH 12/78] CHANGELOG re. inotify. --- CHANGELOG | 4 ++++ diff --git a/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch b/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch index d467a9e..c80a3a2 100644 --- a/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch +++ b/src/patches/dnsmasq/0013-Fix-breakage-of-domain-domain-subnet-local.patch @@ -1,7 +1,7 @@ From 3ad3f3bbd4ee716a7d2fb1e115cf89bd1b1a5de9 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Tue, 16 Dec 2014 18:25:17 +0000 -Subject: [PATCH 13/71] Fix breakage of --domain=<domain>,<subnet>,local +Subject: [PATCH 13/78] Fix breakage of --domain=<domain>,<subnet>,local --- CHANGELOG | 4 ++++ diff --git a/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch b/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch index b77acce..e322168 100644 --- a/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch +++ b/src/patches/dnsmasq/0014-Remove-redundant-IN6_IS_ADDR_ULA-a-macro-defn.patch @@ -1,7 +1,7 @@ From bd9520b7ade7098ee423acc38965376aa57feb07 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Tue, 16 Dec 2014 20:41:29 +0000 -Subject: [PATCH 14/71] Remove redundant IN6_IS_ADDR_ULA(a) macro defn. +Subject: [PATCH 14/78] Remove redundant IN6_IS_ADDR_ULA(a) macro defn. --- src/network.c | 4 ---- diff --git a/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch b/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch index 0680423..afa5f0f 100644 --- a/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch +++ b/src/patches/dnsmasq/0015-Eliminate-IPv6-privacy-addresses-from-interface-name.patch @@ -1,7 +1,7 @@ From 476693678e778886b64d0b56e27eb7695cbcca99 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Wed, 17 Dec 2014 12:41:56 +0000 -Subject: [PATCH 15/71] Eliminate IPv6 privacy addresses from --interface-name +Subject: [PATCH 15/78] Eliminate IPv6 privacy addresses from --interface-name answers. --- diff --git a/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch b/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch index 6b35378..e669a50 100644 --- a/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch +++ b/src/patches/dnsmasq/0016-Tweak-field-width-in-cache-dump-to-avoid-truncating-.patch @@ -1,7 +1,7 @@ From 3267804598047bd1781cab91508d1bc516e5ddbb Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Wed, 17 Dec 2014 20:38:20 +0000 -Subject: [PATCH 16/71] Tweak field width in cache dump to avoid truncating +Subject: [PATCH 16/78] Tweak field width in cache dump to avoid truncating IPv6 addresses. --- diff --git a/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch b/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch index 01095a2..2fe233d 100644 --- a/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch +++ b/src/patches/dnsmasq/0017-Fix-crash-in-DNSSEC-code-when-attempting-to-verify-l.patch @@ -1,7 +1,7 @@ From 094b5c3d904bae9aeb3206d9f3b8348926b84975 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 21 Dec 2014 16:11:52 +0000 -Subject: [PATCH 17/71] Fix crash in DNSSEC code when attempting to verify +Subject: [PATCH 17/78] Fix crash in DNSSEC code when attempting to verify large RRs. --- diff --git a/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch b/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch index 49adf85..2ec47e6 100644 --- a/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch +++ b/src/patches/dnsmasq/0018-Make-caching-work-for-CNAMEs-pointing-to-A-AAAA-reco.patch @@ -1,7 +1,7 @@ From cbc652423403e3cef00e00240f6beef713142246 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 21 Dec 2014 21:21:53 +0000 -Subject: [PATCH 18/71] Make caching work for CNAMEs pointing to A/AAAA records +Subject: [PATCH 18/78] Make caching work for CNAMEs pointing to A/AAAA records shadowed in /etc/hosts If the answer to an upstream query is a CNAME which points to an diff --git a/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch b/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch index 33e5180..7e6f821 100644 --- a/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch +++ b/src/patches/dnsmasq/0019-Fix-problems-validating-NSEC3-and-wildcards.patch @@ -1,7 +1,7 @@ From fbc5205702c7f6f431d9f1043c553d7fb62ddfdb Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Tue, 23 Dec 2014 15:46:08 +0000 -Subject: [PATCH 19/71] Fix problems validating NSEC3 and wildcards. +Subject: [PATCH 19/78] Fix problems validating NSEC3 and wildcards. --- src/dnssec.c | 253 ++++++++++++++++++++++++++++++----------------------------- diff --git a/src/patches/dnsmasq/0020-Initialise-return-value.patch b/src/patches/dnsmasq/0020-Initialise-return-value.patch index c0493df..362c596 100644 --- a/src/patches/dnsmasq/0020-Initialise-return-value.patch +++ b/src/patches/dnsmasq/0020-Initialise-return-value.patch @@ -1,7 +1,7 @@ From 83d2ed09fc0216b567d7fb2197e4ff3eae150b0d Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Tue, 23 Dec 2014 18:42:38 +0000 -Subject: [PATCH 20/71] Initialise return value. +Subject: [PATCH 20/78] Initialise return value. --- src/dnssec.c | 7 +++++-- diff --git a/src/patches/dnsmasq/0021-Add-ignore-address-option.patch b/src/patches/dnsmasq/0021-Add-ignore-address-option.patch index e5422a1..b8ef47d 100644 --- a/src/patches/dnsmasq/0021-Add-ignore-address-option.patch +++ b/src/patches/dnsmasq/0021-Add-ignore-address-option.patch @@ -1,7 +1,7 @@ From 32fc6dbe03569d70dd394420ceb73532cf303c33 Mon Sep 17 00:00:00 2001 From: Glen Huang <curvedmark(a)gmail.com> Date: Sat, 27 Dec 2014 15:28:12 +0000 -Subject: [PATCH 21/71] Add --ignore-address option. +Subject: [PATCH 21/78] Add --ignore-address option. --- CHANGELOG | 8 ++++++++ diff --git a/src/patches/dnsmasq/0022-Bad-packet-protection.patch b/src/patches/dnsmasq/0022-Bad-packet-protection.patch index 1fbe54c..749195f 100644 --- a/src/patches/dnsmasq/0022-Bad-packet-protection.patch +++ b/src/patches/dnsmasq/0022-Bad-packet-protection.patch @@ -1,7 +1,7 @@ From 0b1008d367d44e77352134a4c5178f896f0db3e7 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 27 Dec 2014 15:33:32 +0000 -Subject: [PATCH 22/71] Bad packet protection. +Subject: [PATCH 22/78] Bad packet protection. --- src/dnssec.c | 2 +- diff --git a/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch b/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch index 6e57877..28fe61a 100644 --- a/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch +++ b/src/patches/dnsmasq/0023-Fix-build-failure-in-new-inotify-code-on-BSD.patch @@ -1,7 +1,7 @@ From d310ab7ecbffce79d3d90debba621e0222f9bced Mon Sep 17 00:00:00 2001 From: Matthias Andree <matthias.andree(a)gmx.de> Date: Sat, 27 Dec 2014 15:36:38 +0000 -Subject: [PATCH 23/71] Fix build failure in new inotify code on BSD. +Subject: [PATCH 23/78] Fix build failure in new inotify code on BSD. --- src/inotify.c | 4 ++-- diff --git a/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch b/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch index 867a95d..31535dc 100644 --- a/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch +++ b/src/patches/dnsmasq/0024-Implement-makefile-dependencies-on-COPTS-variable.patch @@ -1,7 +1,7 @@ From 81c538efcebfce2ce4a1d3a420b6c885b8f08df9 Mon Sep 17 00:00:00 2001 From: Yousong Zhou <yszhou4tech(a)gmail.com> Date: Sat, 3 Jan 2015 16:36:14 +0000 -Subject: [PATCH 24/71] Implement makefile dependencies on COPTS variable. +Subject: [PATCH 24/78] Implement makefile dependencies on COPTS variable. --- .gitignore | 2 +- diff --git a/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch b/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch index 4a379c1..a99656d 100644 --- a/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch +++ b/src/patches/dnsmasq/0025-Fix-race-condition-issue-in-makefile.patch @@ -1,7 +1,7 @@ From d8dbd903d024f84a149dac2f8a674a68dfed47a3 Mon Sep 17 00:00:00 2001 From: Yousong Zhou <yszhou4tech(a)gmail.com> Date: Mon, 5 Jan 2015 17:03:35 +0000 -Subject: [PATCH 25/71] Fix race condition issue in makefile. +Subject: [PATCH 25/78] Fix race condition issue in makefile. --- Makefile | 4 +++- diff --git a/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch b/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch index 837c124..e0c8374 100644 --- a/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch +++ b/src/patches/dnsmasq/0026-DNSSEC-do-top-down-search-for-limit-of-secure-delega.patch @@ -1,7 +1,7 @@ From 97e618a0e3f29465acc689d87288596b006f197e Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Wed, 7 Jan 2015 21:55:43 +0000 -Subject: [PATCH 26/71] DNSSEC: do top-down search for limit of secure +Subject: [PATCH 26/78] DNSSEC: do top-down search for limit of secure delegation. --- diff --git a/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch b/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch index 23b9471..8812bba 100644 --- a/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch +++ b/src/patches/dnsmasq/0027-Add-log-queries-extra-option-for-more-complete-loggi.patch @@ -1,7 +1,7 @@ From 25cf5e373eb41c088d4ee5e625209c4cf6a5659e Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Fri, 9 Jan 2015 15:53:03 +0000 -Subject: [PATCH 27/71] Add --log-queries=extra option for more complete +Subject: [PATCH 27/78] Add --log-queries=extra option for more complete logging. --- diff --git a/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch b/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch index 6f7f27c..2f60995 100644 --- a/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch +++ b/src/patches/dnsmasq/0028-Add-min-cache-ttl-option.patch @@ -1,7 +1,7 @@ From 28de38768e2c7d763b9aa5b7a4d251d5e56bab0b Mon Sep 17 00:00:00 2001 From: RinSatsuki <aa65535(a)live.com> Date: Sat, 10 Jan 2015 15:22:21 +0000 -Subject: [PATCH 28/71] Add --min-cache-ttl option. +Subject: [PATCH 28/78] Add --min-cache-ttl option. --- CHANGELOG | 7 +++++++ diff --git a/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch b/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch index 4834269..3288ce8 100644 --- a/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch +++ b/src/patches/dnsmasq/0029-Log-port-of-requestor-when-doing-extra-logging.patch @@ -1,7 +1,7 @@ From 9f79ee4ae34886c0319f06d8f162b81ef79d62fb Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 12 Jan 2015 20:18:18 +0000 -Subject: [PATCH 29/71] Log port of requestor when doing extra logging. +Subject: [PATCH 29/78] Log port of requestor when doing extra logging. --- src/cache.c | 6 +++--- diff --git a/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch b/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch index fef0e11..81b5eb2 100644 --- a/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch +++ b/src/patches/dnsmasq/0030-Don-t-answer-from-cache-RRsets-from-wildcards-as-we-.patch @@ -1,7 +1,7 @@ From 5e321739db381a1d7b5964d76e9c81471d2564c9 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 12 Jan 2015 23:16:56 +0000 -Subject: [PATCH 30/71] Don't answer from cache RRsets from wildcards, as we +Subject: [PATCH 30/78] Don't answer from cache RRsets from wildcards, as we don't have NSECs. --- diff --git a/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch b/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch index 8ebe469..ead984e 100644 --- a/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch +++ b/src/patches/dnsmasq/0031-Logs-for-DS-records-consistent.patch @@ -1,7 +1,7 @@ From ae4624bf46b5e37ff1a9a2ba3c927e0dede95adb Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 12 Jan 2015 23:22:08 +0000 -Subject: [PATCH 31/71] Logs for DS records consistent. +Subject: [PATCH 31/78] Logs for DS records consistent. --- src/rfc1035.c | 2 +- diff --git a/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch b/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch index 60a44b9..f571501 100644 --- a/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch +++ b/src/patches/dnsmasq/0032-Cope-with-multiple-interfaces-with-the-same-LL-addre.patch @@ -1,7 +1,7 @@ From 393415597c8b5b09558b789ab9ac238dbe3db65d Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 18 Jan 2015 22:11:10 +0000 -Subject: [PATCH 32/71] Cope with multiple interfaces with the same LL address. +Subject: [PATCH 32/78] Cope with multiple interfaces with the same LL address. --- CHANGELOG | 4 ++++ diff --git a/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch b/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch index f426e8f..f381635 100644 --- a/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch +++ b/src/patches/dnsmasq/0033-Don-t-treat-SERVFAIL-as-a-recoverable-error.patch @@ -1,7 +1,7 @@ From 2ae195f5a71f7c5a75717845de1bd72fc7dd67f3 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 18 Jan 2015 22:20:48 +0000 -Subject: [PATCH 33/71] Don't treat SERVFAIL as a recoverable error..... +Subject: [PATCH 33/78] Don't treat SERVFAIL as a recoverable error..... --- src/forward.c | 2 +- diff --git a/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch b/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch index 53780b2..86401c9 100644 --- a/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch +++ b/src/patches/dnsmasq/0034-Add-dhcp-hostsdir-config-option.patch @@ -1,7 +1,7 @@ From 5f4dc5c6ca50655ab14f572c7e30815ed74cd51a Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Tue, 20 Jan 2015 20:51:02 +0000 -Subject: [PATCH 34/71] Add --dhcp-hostsdir config option. +Subject: [PATCH 34/78] Add --dhcp-hostsdir config option. --- CHANGELOG | 5 +++ diff --git a/src/patches/dnsmasq/0035-Update-German-translation.patch b/src/patches/dnsmasq/0035-Update-German-translation.patch index 2d18e76..cd9ec56 100644 --- a/src/patches/dnsmasq/0035-Update-German-translation.patch +++ b/src/patches/dnsmasq/0035-Update-German-translation.patch @@ -1,7 +1,7 @@ From fbf01f7046e75f9aa73fd4aab2a94e43386d9052 Mon Sep 17 00:00:00 2001 From: Conrad Kostecki <ck(a)conrad-kostecki.de> Date: Tue, 20 Jan 2015 21:07:56 +0000 -Subject: [PATCH 35/71] Update German translation. +Subject: [PATCH 35/78] Update German translation. --- po/de.po | 101 +++++++++++++++++++++++++++++---------------------------------- diff --git a/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch b/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch index ffe4cf6..144a254 100644 --- a/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch +++ b/src/patches/dnsmasq/0036-Don-t-reply-to-DHCPv6-SOLICIT-messages-when-not-conf.patch @@ -1,7 +1,7 @@ From 61b838dd574c51d96fef100285a0d225824534f9 Mon Sep 17 00:00:00 2001 From: Win King Wan <pinwing+dnsmasq(a)gmail.com> Date: Wed, 21 Jan 2015 20:41:48 +0000 -Subject: [PATCH 36/71] Don't reply to DHCPv6 SOLICIT messages when not +Subject: [PATCH 36/78] Don't reply to DHCPv6 SOLICIT messages when not configured for statefull DHCPv6. --- diff --git a/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch b/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch index 3cd7999..99606cc 100644 --- a/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch +++ b/src/patches/dnsmasq/0037-Allow-inotify-to-be-disabled-at-compile-time-on-Linu.patch @@ -1,7 +1,7 @@ From 0491805d2ff6e7727f0272c94fd97d9897d1e22c Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 26 Jan 2015 11:23:43 +0000 -Subject: [PATCH 37/71] Allow inotify to be disabled at compile time on Linux. +Subject: [PATCH 37/78] Allow inotify to be disabled at compile time on Linux. --- CHANGELOG | 4 +++- diff --git a/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch b/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch index 08eb5b5..db0d4fc 100644 --- a/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch +++ b/src/patches/dnsmasq/0038-Expand-inotify-code-to-dhcp-hostsdir-dhcp-optsdir-an.patch @@ -1,7 +1,7 @@ From 70d1873dd9e70041ed4bb88c69d5b886b7cc634c Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 31 Jan 2015 19:59:29 +0000 -Subject: [PATCH 38/71] Expand inotify code to dhcp-hostsdir, dhcp-optsdir and +Subject: [PATCH 38/78] Expand inotify code to dhcp-hostsdir, dhcp-optsdir and hostsdir. --- diff --git a/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch b/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch index 7303df4..28282c2 100644 --- a/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch +++ b/src/patches/dnsmasq/0039-Update-copyrights-for-dawn-of-2015.patch @@ -1,7 +1,7 @@ From aff3396280e944833f0e23d834aa6acd5fe2605a Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 31 Jan 2015 20:13:40 +0000 -Subject: [PATCH 39/71] Update copyrights for dawn of 2015. +Subject: [PATCH 39/78] Update copyrights for dawn of 2015. --- Makefile | 2 +- diff --git a/src/patches/dnsmasq/0040-inotify-documentation-updates.patch b/src/patches/dnsmasq/0040-inotify-documentation-updates.patch index 9c3ac9c..2fb831c 100644 --- a/src/patches/dnsmasq/0040-inotify-documentation-updates.patch +++ b/src/patches/dnsmasq/0040-inotify-documentation-updates.patch @@ -1,7 +1,7 @@ From 3d04f46334d0e345f589eda1372e638b946fe637 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 31 Jan 2015 21:59:13 +0000 -Subject: [PATCH 40/71] inotify documentation updates. +Subject: [PATCH 40/78] inotify documentation updates. --- man/dnsmasq.8 | 11 +++++++++-- diff --git a/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch b/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch index 1fc1c73..68e1ca6 100644 --- a/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch +++ b/src/patches/dnsmasq/0041-Fix-broken-ECDSA-DNSSEC-signatures.patch @@ -1,7 +1,7 @@ From 6ef15b34ca83c62a939f69356d5c3f7a6bfef3d0 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 31 Jan 2015 22:44:26 +0000 -Subject: [PATCH 41/71] Fix broken ECDSA DNSSEC signatures. +Subject: [PATCH 41/78] Fix broken ECDSA DNSSEC signatures. --- CHANGELOG | 2 ++ diff --git a/src/patches/dnsmasq/0042-BSD-make-support.patch b/src/patches/dnsmasq/0042-BSD-make-support.patch index 750f113..ced5868 100644 --- a/src/patches/dnsmasq/0042-BSD-make-support.patch +++ b/src/patches/dnsmasq/0042-BSD-make-support.patch @@ -1,7 +1,7 @@ From 106266761828a0acb006346ae47bf031dee46a5d Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 1 Feb 2015 00:15:16 +0000 -Subject: [PATCH 42/71] BSD make support +Subject: [PATCH 42/78] BSD make support --- Makefile | 6 ++++-- diff --git a/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch b/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch index aa55fe2..2aa543d 100644 --- a/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch +++ b/src/patches/dnsmasq/0043-Fix-build-failure-on-openBSD.patch @@ -1,7 +1,7 @@ From 8d8a54ec79d9f96979fabbd97b1dd2ddebc7d78f Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 1 Feb 2015 21:48:46 +0000 -Subject: [PATCH 43/71] Fix build failure on openBSD. +Subject: [PATCH 43/78] Fix build failure on openBSD. --- src/tables.c | 2 +- diff --git a/src/patches/dnsmasq/0044-Manpage-typo-fix.patch b/src/patches/dnsmasq/0044-Manpage-typo-fix.patch index bbc4d48..ef606e8 100644 --- a/src/patches/dnsmasq/0044-Manpage-typo-fix.patch +++ b/src/patches/dnsmasq/0044-Manpage-typo-fix.patch @@ -1,7 +1,7 @@ From d36b732c4cfa91ea09af64b5dc0f3a85a075e5bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thi=C3=A9baud=20Weksteen?= <thiebaud(a)weksteen.fr> Date: Mon, 2 Feb 2015 21:37:27 +0000 -Subject: [PATCH 44/71] Manpage typo fix. +Subject: [PATCH 44/78] Manpage typo fix. --- man/dnsmasq.8 | 2 +- diff --git a/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch b/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch index 2d43b93..1f87a9e 100644 --- a/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch +++ b/src/patches/dnsmasq/0045-Fixup-dhcp-configs-after-reading-extra-hostfiles-wit.patch @@ -1,7 +1,7 @@ From 2941d3ac898cf84b544e47c9735c5e4111711db1 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 2 Feb 2015 22:36:42 +0000 -Subject: [PATCH 45/71] Fixup dhcp-configs after reading extra hostfiles with +Subject: [PATCH 45/78] Fixup dhcp-configs after reading extra hostfiles with inotify. --- diff --git a/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch b/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch index 8b173f2..754d0a8 100644 --- a/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch +++ b/src/patches/dnsmasq/0046-Extra-logging-for-inotify-code.patch @@ -1,7 +1,7 @@ From f9c863708c6b0aea31ff7a466647685dc739de50 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Tue, 3 Feb 2015 21:52:48 +0000 -Subject: [PATCH 46/71] Extra logging for inotify code. +Subject: [PATCH 46/78] Extra logging for inotify code. --- src/cache.c | 9 ++++----- diff --git a/src/patches/dnsmasq/0047-man-page-typo.patch b/src/patches/dnsmasq/0047-man-page-typo.patch index 9710dfb..9fdd87e 100644 --- a/src/patches/dnsmasq/0047-man-page-typo.patch +++ b/src/patches/dnsmasq/0047-man-page-typo.patch @@ -1,7 +1,7 @@ From efb8b5566aafc1f3ce18514a2df93af5a2e4998c Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 7 Feb 2015 22:36:34 +0000 -Subject: [PATCH 47/71] man page typo. +Subject: [PATCH 47/78] man page typo. --- man/dnsmasq.8 | 1 + diff --git a/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch b/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch index fb7753c..fd0da9b 100644 --- a/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch +++ b/src/patches/dnsmasq/0048-Fix-get-version-script-which-returned-wrong-tag-in-s.patch @@ -1,7 +1,7 @@ From f4f400776b3c1aa303d1a0fcd500f0ab5bc970f2 Mon Sep 17 00:00:00 2001 From: Shantanu Gadgil <shantanugadgil(a)yahoo.com> Date: Wed, 11 Feb 2015 20:16:59 +0000 -Subject: [PATCH 48/71] Fix get-version script which returned wrong tag in some +Subject: [PATCH 48/78] Fix get-version script which returned wrong tag in some situations. --- diff --git a/src/patches/dnsmasq/0049-Typos.patch b/src/patches/dnsmasq/0049-Typos.patch index c843bf2..ab57c77 100644 --- a/src/patches/dnsmasq/0049-Typos.patch +++ b/src/patches/dnsmasq/0049-Typos.patch @@ -1,7 +1,7 @@ From 8ff70de618eb7de9147dbfbd4deca4a2dd62f0cb Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 14 Feb 2015 20:02:37 +0000 -Subject: [PATCH 49/71] Typos. +Subject: [PATCH 49/78] Typos. --- src/inotify.c | 3 ++- diff --git a/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch b/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch index 7b9a1b3..df3bf18 100644 --- a/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch +++ b/src/patches/dnsmasq/0050-Make-dynamic-hosts-files-work-when-no-hosts-set.patch @@ -1,7 +1,7 @@ From caeea190f12efd20139f694aac4942d1ac00019f Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 14 Feb 2015 20:08:56 +0000 -Subject: [PATCH 50/71] Make dynamic hosts files work when --no-hosts set. +Subject: [PATCH 50/78] Make dynamic hosts files work when --no-hosts set. --- src/cache.c | 21 +++++++++++---------- diff --git a/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch b/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch index a65ed21..ad7ecd7 100644 --- a/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch +++ b/src/patches/dnsmasq/0051-Fix-trivial-memory-leaks-to-quieten-valgrind.patch @@ -1,7 +1,7 @@ From 28b879ac47b872af6e8c5e86d76806c69338434d Mon Sep 17 00:00:00 2001 From: Chen Wei <weichen302(a)icloud.com> Date: Tue, 17 Feb 2015 22:07:35 +0000 -Subject: [PATCH 51/71] Fix trivial memory leaks to quieten valgrind. +Subject: [PATCH 51/78] Fix trivial memory leaks to quieten valgrind. --- src/dnsmasq.c | 2 ++ diff --git a/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch b/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch index 69aeb92..9556f3b 100644 --- a/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch +++ b/src/patches/dnsmasq/0052-Fix-uninitialized-value-used-in-get_client_mac.patch @@ -1,7 +1,7 @@ From 0705a7e2d57654b27c7e14f35ca77241c1821f4d Mon Sep 17 00:00:00 2001 From: Tomas Hozza <thozza(a)redhat.com> Date: Mon, 23 Feb 2015 21:26:26 +0000 -Subject: [PATCH 52/71] Fix uninitialized value used in get_client_mac() +Subject: [PATCH 52/78] Fix uninitialized value used in get_client_mac() --- src/dhcp6.c | 4 +++- diff --git a/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch b/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch index b37498e..03d20f6 100644 --- a/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch +++ b/src/patches/dnsmasq/0053-Log-parsing-utils-in-contrib-reverse-dns.patch @@ -1,7 +1,7 @@ From 47b9ac59c715827252ae6e6732903c3dabb697fb Mon Sep 17 00:00:00 2001 From: Joachim Zobel <jz-2014(a)heute-morgen.de> Date: Mon, 23 Feb 2015 21:38:11 +0000 -Subject: [PATCH 53/71] Log parsing utils in contrib/reverse-dns +Subject: [PATCH 53/78] Log parsing utils in contrib/reverse-dns --- contrib/reverse-dns/README | 18 ++++++++++++++++++ diff --git a/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch b/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch index 5073440..2d47566 100644 --- a/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch +++ b/src/patches/dnsmasq/0054-Add-dnssec-timestamp-option-and-facility.patch @@ -1,7 +1,7 @@ From f6e62e2af96f5fa0d1e3d93167a93a8f09bf6e61 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 1 Mar 2015 18:17:54 +0000 -Subject: [PATCH 54/71] Add --dnssec-timestamp option and facility. +Subject: [PATCH 54/78] Add --dnssec-timestamp option and facility. --- CHANGELOG | 6 +++++ diff --git a/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch b/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch index 768e14a..ba48df3 100644 --- a/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch +++ b/src/patches/dnsmasq/0055-Fix-last-commit-to-not-crash-if-uid-changing-not-con.patch @@ -1,7 +1,7 @@ From 9003b50b13da624ca45f3e0cf99abb623b8d026b Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 2 Mar 2015 22:47:23 +0000 -Subject: [PATCH 55/71] Fix last commit to not crash if uid changing not +Subject: [PATCH 55/78] Fix last commit to not crash if uid changing not configured. --- diff --git a/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch b/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch index d39a058..dc52d90 100644 --- a/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch +++ b/src/patches/dnsmasq/0056-New-version-of-contrib-reverse-dns.patch @@ -1,7 +1,7 @@ From 4c960fa90a975d20f75a1ecabd217247f1922c8f Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Wed, 4 Mar 2015 20:32:26 +0000 -Subject: [PATCH 56/71] New version of contrib/reverse-dns +Subject: [PATCH 56/78] New version of contrib/reverse-dns --- contrib/reverse-dns/README | 22 +++--- diff --git a/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch b/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch index 462d572..d17d23f 100644 --- a/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch +++ b/src/patches/dnsmasq/0057-Tweak-DNSSEC-timestamp-code-to-create-file-later-rem.patch @@ -1,7 +1,7 @@ From 360f2513ab12a9bf1e262d388dd2ea8a566590a3 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 7 Mar 2015 18:28:06 +0000 -Subject: [PATCH 57/71] Tweak DNSSEC timestamp code to create file later, +Subject: [PATCH 57/78] Tweak DNSSEC timestamp code to create file later, removing need to chown it. --- diff --git a/src/patches/dnsmasq/0058-Fix-boilerplate-code-for-re-running-system-calls-on-.patch b/src/patches/dnsmasq/0058-Fix-boilerplate-code-for-re-running-system-calls-on-.patch index aa30241..4dd9568 100644 --- a/src/patches/dnsmasq/0058-Fix-boilerplate-code-for-re-running-system-calls-on-.patch +++ b/src/patches/dnsmasq/0058-Fix-boilerplate-code-for-re-running-system-calls-on-.patch @@ -1,7 +1,7 @@ From ff841ebf5a5d6864ff48571f607c32ce80dbb75a Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Wed, 11 Mar 2015 21:36:30 +0000 -Subject: [PATCH 58/71] Fix boilerplate code for re-running system calls on +Subject: [PATCH 58/78] Fix boilerplate code for re-running system calls on EINTR and EAGAIN etc. The nasty code with static variable in retry_send() which diff --git a/src/patches/dnsmasq/0059-Make-address-example.com-equivalent-to-server-exampl.patch b/src/patches/dnsmasq/0059-Make-address-example.com-equivalent-to-server-exampl.patch index 6a2a0f4..a072474 100644 --- a/src/patches/dnsmasq/0059-Make-address-example.com-equivalent-to-server-exampl.patch +++ b/src/patches/dnsmasq/0059-Make-address-example.com-equivalent-to-server-exampl.patch @@ -1,7 +1,7 @@ From 979fe86bc8693f660eddea232ae39cbbb50b294c Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Thu, 19 Mar 2015 22:50:22 +0000 -Subject: [PATCH 59/71] Make --address=/example.com/ equivalent to +Subject: [PATCH 59/78] Make --address=/example.com/ equivalent to --server=/example.com/ --- diff --git a/src/patches/dnsmasq/0060-dhcp-set-outbound-interface-via-cmsg-in-unicast-repl.patch b/src/patches/dnsmasq/0060-dhcp-set-outbound-interface-via-cmsg-in-unicast-repl.patch index 1eb504b..429f56a 100644 --- a/src/patches/dnsmasq/0060-dhcp-set-outbound-interface-via-cmsg-in-unicast-repl.patch +++ b/src/patches/dnsmasq/0060-dhcp-set-outbound-interface-via-cmsg-in-unicast-repl.patch @@ -1,7 +1,7 @@ From 65c721200023ef0023114459a8d12f8b0a24cfd8 Mon Sep 17 00:00:00 2001 From: Lung-Pin Chang <changlp(a)cs.nctu.edu.tw> Date: Thu, 19 Mar 2015 23:22:21 +0000 -Subject: [PATCH 60/71] dhcp: set outbound interface via cmsg in unicast reply +Subject: [PATCH 60/78] dhcp: set outbound interface via cmsg in unicast reply If multiple routes to the same network exist, Linux blindly picks the first interface (route) based on destination address, which might not be diff --git a/src/patches/dnsmasq/0061-Don-t-fail-DNSSEC-when-a-signed-CNAME-dangles-into-a.patch b/src/patches/dnsmasq/0061-Don-t-fail-DNSSEC-when-a-signed-CNAME-dangles-into-a.patch index b566ebf..aece6fa 100644 --- a/src/patches/dnsmasq/0061-Don-t-fail-DNSSEC-when-a-signed-CNAME-dangles-into-a.patch +++ b/src/patches/dnsmasq/0061-Don-t-fail-DNSSEC-when-a-signed-CNAME-dangles-into-a.patch @@ -1,7 +1,7 @@ From 8805283088d670baecb92569252c01cf754cda51 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Thu, 26 Mar 2015 21:15:43 +0000 -Subject: [PATCH 61/71] Don't fail DNSSEC when a signed CNAME dangles into an +Subject: [PATCH 61/78] Don't fail DNSSEC when a signed CNAME dangles into an unsigned zone. --- diff --git a/src/patches/dnsmasq/0062-Return-SERVFAIL-when-validation-abandoned.patch b/src/patches/dnsmasq/0062-Return-SERVFAIL-when-validation-abandoned.patch index a660450..81280dc 100644 --- a/src/patches/dnsmasq/0062-Return-SERVFAIL-when-validation-abandoned.patch +++ b/src/patches/dnsmasq/0062-Return-SERVFAIL-when-validation-abandoned.patch @@ -1,7 +1,7 @@ From 150162bc37170a6edae9d488435e836b1e4e3a4e Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Fri, 27 Mar 2015 09:58:26 +0000 -Subject: [PATCH 62/71] Return SERVFAIL when validation abandoned. +Subject: [PATCH 62/78] Return SERVFAIL when validation abandoned. --- src/forward.c | 11 +++++++++-- diff --git a/src/patches/dnsmasq/0063-Protect-against-broken-DNSSEC-upstreams.patch b/src/patches/dnsmasq/0063-Protect-against-broken-DNSSEC-upstreams.patch index 93161d0..bd79a1a 100644 --- a/src/patches/dnsmasq/0063-Protect-against-broken-DNSSEC-upstreams.patch +++ b/src/patches/dnsmasq/0063-Protect-against-broken-DNSSEC-upstreams.patch @@ -1,7 +1,7 @@ From 0b8a5a30a77331974ba24a04e43e720585dfbc61 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Fri, 27 Mar 2015 11:44:55 +0000 -Subject: [PATCH 63/71] Protect against broken DNSSEC upstreams. +Subject: [PATCH 63/78] Protect against broken DNSSEC upstreams. --- src/dnssec.c | 7 +++++-- diff --git a/src/patches/dnsmasq/0064-DNSSEC-fix-for-non-ascii-characters-in-labels.patch b/src/patches/dnsmasq/0064-DNSSEC-fix-for-non-ascii-characters-in-labels.patch index 389beee..c020af5 100644 --- a/src/patches/dnsmasq/0064-DNSSEC-fix-for-non-ascii-characters-in-labels.patch +++ b/src/patches/dnsmasq/0064-DNSSEC-fix-for-non-ascii-characters-in-labels.patch @@ -1,7 +1,7 @@ From 1e153945def3c50d1e59ceea6a768db0ac770f98 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sat, 28 Mar 2015 21:34:07 +0000 -Subject: [PATCH 64/71] DNSSEC fix for non-ascii characters in labels. +Subject: [PATCH 64/78] DNSSEC fix for non-ascii characters in labels. --- src/dnssec.c | 34 +++++++++++++++++----------------- diff --git a/src/patches/dnsmasq/0065-Allow-control-characters-in-names-in-the-cache-handl.patch b/src/patches/dnsmasq/0065-Allow-control-characters-in-names-in-the-cache-handl.patch index 69f6081..a9b6f40 100644 --- a/src/patches/dnsmasq/0065-Allow-control-characters-in-names-in-the-cache-handl.patch +++ b/src/patches/dnsmasq/0065-Allow-control-characters-in-names-in-the-cache-handl.patch @@ -1,7 +1,7 @@ From 394ff492da6af5da7e7d356be9586683bc5fc011 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 29 Mar 2015 22:17:14 +0100 -Subject: [PATCH 65/71] Allow control characters in names in the cache, handle +Subject: [PATCH 65/78] Allow control characters in names in the cache, handle when logging. --- diff --git a/src/patches/dnsmasq/0066-Fix-crash-in-last-commit.patch b/src/patches/dnsmasq/0066-Fix-crash-in-last-commit.patch index 04a865f..8a496b0 100644 --- a/src/patches/dnsmasq/0066-Fix-crash-in-last-commit.patch +++ b/src/patches/dnsmasq/0066-Fix-crash-in-last-commit.patch @@ -1,7 +1,7 @@ From 794fccca7ffebfba4468bfffc6276b68bbf6afd9 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Sun, 29 Mar 2015 22:35:44 +0100 -Subject: [PATCH 66/71] Fix crash in last commit. +Subject: [PATCH 66/78] Fix crash in last commit. --- src/cache.c | 7 ++++--- diff --git a/src/patches/dnsmasq/0067-Merge-message-translations.patch b/src/patches/dnsmasq/0067-Merge-message-translations.patch index 090da5c..f6c5225 100644 --- a/src/patches/dnsmasq/0067-Merge-message-translations.patch +++ b/src/patches/dnsmasq/0067-Merge-message-translations.patch @@ -1,7 +1,7 @@ From fd6ad9e481ab7c812a6b1515244908818cbb0442 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Mon, 30 Mar 2015 07:52:21 +0100 -Subject: [PATCH 67/71] Merge message translations. +Subject: [PATCH 67/78] Merge message translations. --- po/de.po | 803 +++++++++++++++++++++++++++++++++-------------------------- diff --git a/src/patches/dnsmasq/0068-add-tftp-no-fail-to-ignore-missing-tftp-root.patch b/src/patches/dnsmasq/0068-add-tftp-no-fail-to-ignore-missing-tftp-root.patch index 3439cc1..cf1f2af 100644 --- a/src/patches/dnsmasq/0068-add-tftp-no-fail-to-ignore-missing-tftp-root.patch +++ b/src/patches/dnsmasq/0068-add-tftp-no-fail-to-ignore-missing-tftp-root.patch @@ -1,7 +1,7 @@ From 30d0879ed55cb67b1b735beab3d93f3bb3ef1dd2 Mon Sep 17 00:00:00 2001 From: Stefan Tomanek <stefan.tomanek+dnsmasq(a)wertarbyte.de> Date: Tue, 31 Mar 2015 22:32:11 +0100 -Subject: [PATCH 68/71] add --tftp-no-fail to ignore missing tftp root +Subject: [PATCH 68/78] add --tftp-no-fail to ignore missing tftp root --- CHANGELOG | 3 +++ diff --git a/src/patches/dnsmasq/0069-Whitespace-fixes.patch b/src/patches/dnsmasq/0069-Whitespace-fixes.patch index 6784ee3..a18c6be 100644 --- a/src/patches/dnsmasq/0069-Whitespace-fixes.patch +++ b/src/patches/dnsmasq/0069-Whitespace-fixes.patch @@ -1,7 +1,7 @@ From 7aa970e2c7043201663d86a4b5d8cd5c592cef39 Mon Sep 17 00:00:00 2001 From: Stefan Tomanek <stefan.tomanek+dnsmasq(a)wertarbyte.de> Date: Wed, 1 Apr 2015 17:55:07 +0100 -Subject: [PATCH 69/71] Whitespace fixes. +Subject: [PATCH 69/78] Whitespace fixes. --- src/dnsmasq.c | 14 +++++++------- diff --git a/src/patches/dnsmasq/0070-Return-INSECURE-rather-than-BOGUS-when-DS-proved-not.patch b/src/patches/dnsmasq/0070-Return-INSECURE-rather-than-BOGUS-when-DS-proved-not.patch index 1350ca6..b021aab 100644 --- a/src/patches/dnsmasq/0070-Return-INSECURE-rather-than-BOGUS-when-DS-proved-not.patch +++ b/src/patches/dnsmasq/0070-Return-INSECURE-rather-than-BOGUS-when-DS-proved-not.patch @@ -1,7 +1,7 @@ From fe3992f9fa69fa975ea31919c53933b5f6a63527 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Fri, 3 Apr 2015 21:25:05 +0100 -Subject: [PATCH 70/71] Return INSECURE, rather than BOGUS when DS proved not +Subject: [PATCH 70/78] Return INSECURE, rather than BOGUS when DS proved not to exist. Return INSECURE when validating DNS replies which have RRSIGs, but diff --git a/src/patches/dnsmasq/0071-Fix-compiler-warning-when-not-including-DNSSEC.patch b/src/patches/dnsmasq/0071-Fix-compiler-warning-when-not-including-DNSSEC.patch index 83cdb0c..b8e5cf8 100644 --- a/src/patches/dnsmasq/0071-Fix-compiler-warning-when-not-including-DNSSEC.patch +++ b/src/patches/dnsmasq/0071-Fix-compiler-warning-when-not-including-DNSSEC.patch @@ -1,7 +1,7 @@ From 982faf402487e265ed11ac03524531d42b03c966 Mon Sep 17 00:00:00 2001 From: Simon Kelley <simon(a)thekelleys.org.uk> Date: Fri, 3 Apr 2015 21:42:30 +0100 -Subject: [PATCH 71/71] Fix compiler warning when not including DNSSEC. +Subject: [PATCH 71/78] Fix compiler warning when not including DNSSEC. --- src/forward.c | 3 ++- diff --git a/src/patches/dnsmasq/0072-Fix-crash-caused-by-looking-up-servers.bind-when-man.patch b/src/patches/dnsmasq/0072-Fix-crash-caused-by-looking-up-servers.bind-when-man.patch new file mode 100644 index 0000000..e03606c --- /dev/null +++ b/src/patches/dnsmasq/0072-Fix-crash-caused-by-looking-up-servers.bind-when-man.patch @@ -0,0 +1,54 @@ +From 04b0ac05377936d121a36873bb63d492cde292c9 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Mon, 6 Apr 2015 17:19:13 +0100 +Subject: [PATCH 72/78] Fix crash caused by looking up servers.bind when many + servers defined. + +--- + CHANGELOG | 7 ++++++- + src/cache.c | 4 ++-- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/CHANGELOG b/CHANGELOG +index 34432ae4807f..6aa3d851a297 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -75,7 +75,12 @@ version 2.73 + + Add --tftp-no-fail option. Thanks to Stefan Tomanek for + the patch. +- ++ ++ Fix crash caused by looking up servers.bind, CHAOS text record, ++ when more than about five --servers= lines are in the dnsmasq ++ config. This causes memory corruption which causes a crash later. ++ Thanks to Matt Coddington for sterling work chasing this down. ++ + + version 2.72 + Add ra-advrouter mode, for RFC-3775 mobile IPv6 support. +diff --git a/src/cache.c b/src/cache.c +index d7bea574c0d8..178d654ca92e 100644 +--- a/src/cache.c ++++ b/src/cache.c +@@ -1367,7 +1367,7 @@ int cache_make_stat(struct txt_record *t) + } + port = prettyprint_addr(&serv->addr, daemon->addrbuff); + lenp = p++; /* length */ +- bytes_avail = (p - buff) + bufflen; ++ bytes_avail = bufflen - (p - buff ); + bytes_needed = snprintf(p, bytes_avail, "%s#%d %u %u", daemon->addrbuff, port, queries, failed_queries); + if (bytes_needed >= bytes_avail) + { +@@ -1381,7 +1381,7 @@ int cache_make_stat(struct txt_record *t) + lenp = p - 1; + buff = new; + bufflen = newlen; +- bytes_avail = (p - buff) + bufflen; ++ bytes_avail = bufflen - (p - buff ); + bytes_needed = snprintf(p, bytes_avail, "%s#%d %u %u", daemon->addrbuff, port, queries, failed_queries); + } + *lenp = bytes_needed; +-- +2.1.0 + diff --git a/src/patches/dnsmasq/0073-Fix-crash-on-receipt-of-certain-malformed-DNS-reques.patch b/src/patches/dnsmasq/0073-Fix-crash-on-receipt-of-certain-malformed-DNS-reques.patch new file mode 100644 index 0000000..c333e66 --- /dev/null +++ b/src/patches/dnsmasq/0073-Fix-crash-on-receipt-of-certain-malformed-DNS-reques.patch @@ -0,0 +1,61 @@ +From ad4a8ff7d9097008d7623df8543df435bfddeac8 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Thu, 9 Apr 2015 21:48:00 +0100 +Subject: [PATCH 73/78] Fix crash on receipt of certain malformed DNS requests. + +--- + CHANGELOG | 3 +++ + src/rfc1035.c | 9 ++++++--- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/CHANGELOG b/CHANGELOG +index 6aa3d851a297..9af617056f1f 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -125,6 +125,9 @@ version 2.72 + Fix problem with --local-service option on big-endian platforms + Thanks to Richard Genoud for the patch. + ++ Fix crash on receipt of certain malformed DNS requests. Thanks ++ to Nick Sampanis for spotting the problem. ++ + + version 2.71 + Subtle change to error handling to help DNSSEC validation +diff --git a/src/rfc1035.c b/src/rfc1035.c +index 7a07b0cee906..a995ab50d74a 100644 +--- a/src/rfc1035.c ++++ b/src/rfc1035.c +@@ -1198,7 +1198,10 @@ unsigned int extract_request(struct dns_header *header, size_t qlen, char *name, + size_t setup_reply(struct dns_header *header, size_t qlen, + struct all_addr *addrp, unsigned int flags, unsigned long ttl) + { +- unsigned char *p = skip_questions(header, qlen); ++ unsigned char *p; ++ ++ if (!(p = skip_questions(header, qlen))) ++ return 0; + + /* clear authoritative and truncated flags, set QR flag */ + header->hb3 = (header->hb3 & ~(HB3_AA | HB3_TC)) | HB3_QR; +@@ -1214,7 +1217,7 @@ size_t setup_reply(struct dns_header *header, size_t qlen, + SET_RCODE(header, NOERROR); /* empty domain */ + else if (flags == F_NXDOMAIN) + SET_RCODE(header, NXDOMAIN); +- else if (p && flags == F_IPV4) ++ else if (flags == F_IPV4) + { /* we know the address */ + SET_RCODE(header, NOERROR); + header->ancount = htons(1); +@@ -1222,7 +1225,7 @@ size_t setup_reply(struct dns_header *header, size_t qlen, + add_resource_record(header, NULL, NULL, sizeof(struct dns_header), &p, ttl, NULL, T_A, C_IN, "4", addrp); + } + #ifdef HAVE_IPV6 +- else if (p && flags == F_IPV6) ++ else if (flags == F_IPV6) + { + SET_RCODE(header, NOERROR); + header->ancount = htons(1); +-- +2.1.0 + diff --git a/src/patches/dnsmasq/0074-Fix-crash-in-auth-code-with-odd-configuration.patch b/src/patches/dnsmasq/0074-Fix-crash-in-auth-code-with-odd-configuration.patch new file mode 100644 index 0000000..4a9cee0 --- /dev/null +++ b/src/patches/dnsmasq/0074-Fix-crash-in-auth-code-with-odd-configuration.patch @@ -0,0 +1,113 @@ +From 38440b204db65f9be16c4c3daa7e991e4356f6ed Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Sun, 12 Apr 2015 21:52:47 +0100 +Subject: [PATCH 74/78] Fix crash in auth code with odd configuration. + +--- + CHANGELOG | 32 +++++++++++++++++++++----------- + src/auth.c | 13 ++++++++----- + 2 files changed, 29 insertions(+), 16 deletions(-) + +diff --git a/CHANGELOG b/CHANGELOG +index 9af617056f1f..f2142c71cbdc 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -68,18 +68,31 @@ version 2.73 + Fix broken DNSSEC validation of ECDSA signatures. + + Add --dnssec-timestamp option, which provides an automatic +- way to detect when the system time becomes valid after boot +- on systems without an RTC, whilst allowing DNS queries before the +- clock is valid so that NTP can run. Thanks to +- Kevin Darbyshire-Bryant for developing this idea. ++ way to detect when the system time becomes valid after ++ boot on systems without an RTC, whilst allowing DNS ++ queries before the clock is valid so that NTP can run. ++ Thanks to Kevin Darbyshire-Bryant for developing this idea. + + Add --tftp-no-fail option. Thanks to Stefan Tomanek for + the patch. + +- Fix crash caused by looking up servers.bind, CHAOS text record, +- when more than about five --servers= lines are in the dnsmasq +- config. This causes memory corruption which causes a crash later. +- Thanks to Matt Coddington for sterling work chasing this down. ++ Fix crash caused by looking up servers.bind, CHAOS text ++ record, when more than about five --servers= lines are ++ in the dnsmasq config. This causes memory corruption ++ which causes a crash later. Thanks to Matt Coddington for ++ sterling work chasing this down. ++ ++ Fix crash on receipt of certain malformed DNS requests. ++ Thanks to Nick Sampanis for spotting the problem. ++ ++ Fix crash in authoritative DNS code, if a .arpa zone ++ is declared as authoritative, and then a PTR query which ++ is not to be treated as authoritative arrived. Normally, ++ directly declaring .arpa zone as authoritative is not ++ done, so this crash wouldn't be seen. Instead the ++ relevant .arpa zone should be specified as a subnet ++ in the auth-zone declaration. Thanks to Johnny S. Lee ++ for the bugreport and initial patch. + + + version 2.72 +@@ -125,10 +138,7 @@ version 2.72 + Fix problem with --local-service option on big-endian platforms + Thanks to Richard Genoud for the patch. + +- Fix crash on receipt of certain malformed DNS requests. Thanks +- to Nick Sampanis for spotting the problem. + +- + version 2.71 + Subtle change to error handling to help DNSSEC validation + when servers fail to provide NODATA answers for +diff --git a/src/auth.c b/src/auth.c +index 15721e52793f..4a5c39fc5c07 100644 +--- a/src/auth.c ++++ b/src/auth.c +@@ -141,7 +141,7 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n + for (zone = daemon->auth_zones; zone; zone = zone->next) + if ((subnet = find_subnet(zone, flag, &addr))) + break; +- ++ + if (!zone) + { + auth = 0; +@@ -186,7 +186,7 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n + + if (intr) + { +- if (in_zone(zone, intr->name, NULL)) ++ if (local_query || in_zone(zone, intr->name, NULL)) + { + found = 1; + log_query(flag | F_REVERSE | F_CONFIG, intr->name, &addr, NULL); +@@ -208,8 +208,11 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n + *p = 0; /* must be bare name */ + + /* add external domain */ +- strcat(name, "."); +- strcat(name, zone->domain); ++ if (zone) ++ { ++ strcat(name, "."); ++ strcat(name, zone->domain); ++ } + log_query(flag | F_DHCP | F_REVERSE, name, &addr, record_source(crecp->uid)); + found = 1; + if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, +@@ -217,7 +220,7 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n + T_PTR, C_IN, "d", name)) + anscount++; + } +- else if (crecp->flags & (F_DHCP | F_HOSTS) && in_zone(zone, name, NULL)) ++ else if (crecp->flags & (F_DHCP | F_HOSTS) && (local_query || in_zone(zone, name, NULL))) + { + log_query(crecp->flags & ~F_FORWARD, name, &addr, record_source(crecp->uid)); + found = 1; +-- +2.1.0 + diff --git a/src/patches/dnsmasq/0075-Auth-correct-replies-to-NS-and-SOA-in-.arpa-zones.patch b/src/patches/dnsmasq/0075-Auth-correct-replies-to-NS-and-SOA-in-.arpa-zones.patch new file mode 100644 index 0000000..705229f --- /dev/null +++ b/src/patches/dnsmasq/0075-Auth-correct-replies-to-NS-and-SOA-in-.arpa-zones.patch @@ -0,0 +1,106 @@ +From 78c6184752dce27849e36cce4360abc27b8d76d2 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Thu, 16 Apr 2015 15:05:30 +0100 +Subject: [PATCH 75/78] Auth: correct replies to NS and SOA in .arpa zones. + +--- + CHANGELOG | 8 ++++++++ + src/auth.c | 51 ++++++++++++++++++++++++++++++--------------------- + 2 files changed, 38 insertions(+), 21 deletions(-) + +diff --git a/CHANGELOG b/CHANGELOG +index f2142c71cbdc..0619788e9cef 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -94,6 +94,14 @@ version 2.73 + in the auth-zone declaration. Thanks to Johnny S. Lee + for the bugreport and initial patch. + ++ Fix authoritative DNS code to correctly reply to NS ++ and SOA queries for .arpa zones for which we are ++ declared authoritative by means of a subnet in auth-zone. ++ Previously we provided correct answers to PTR queries ++ in such zones (including NS and SOA) but not direct ++ NS and SOA queries. Thanks to Johnny S. Lee for ++ pointing out the problem. ++ + + version 2.72 + Add ra-advrouter mode, for RFC-3775 mobile IPv6 support. +diff --git a/src/auth.c b/src/auth.c +index 4a5c39fc5c07..2b0b7d6b052d 100644 +--- a/src/auth.c ++++ b/src/auth.c +@@ -131,24 +131,27 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n + continue; + } + +- if (qtype == T_PTR) ++ if ((qtype == T_PTR || qtype == T_SOA || qtype == T_NS) && ++ (flag = in_arpa_name_2_addr(name, &addr)) && ++ !local_query) + { +- if (!(flag = in_arpa_name_2_addr(name, &addr))) +- continue; +- +- if (!local_query) ++ for (zone = daemon->auth_zones; zone; zone = zone->next) ++ if ((subnet = find_subnet(zone, flag, &addr))) ++ break; ++ ++ if (!zone) + { +- for (zone = daemon->auth_zones; zone; zone = zone->next) +- if ((subnet = find_subnet(zone, flag, &addr))) +- break; +- +- if (!zone) +- { +- auth = 0; +- continue; +- } ++ auth = 0; ++ continue; + } ++ else if (qtype == T_SOA) ++ soa = 1, found = 1; ++ else if (qtype == T_NS) ++ ns = 1, found = 1; ++ } + ++ if (qtype == T_PTR && flag) ++ { + intr = NULL; + + if (flag == F_IPV4) +@@ -243,14 +246,20 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n + } + + cname_restart: +- for (zone = daemon->auth_zones; zone; zone = zone->next) +- if (in_zone(zone, name, &cut)) +- break; +- +- if (!zone) ++ if (found) ++ /* NS and SOA .arpa requests have set found above. */ ++ cut = NULL; ++ else + { +- auth = 0; +- continue; ++ for (zone = daemon->auth_zones; zone; zone = zone->next) ++ if (in_zone(zone, name, &cut)) ++ break; ++ ++ if (!zone) ++ { ++ auth = 0; ++ continue; ++ } + } + + for (rec = daemon->mxnames; rec; rec = rec->next) +-- +2.1.0 + diff --git a/src/patches/dnsmasq/0076-Fix-srk-induced-crash-in-new-tftp_no_fail-code.patch b/src/patches/dnsmasq/0076-Fix-srk-induced-crash-in-new-tftp_no_fail-code.patch new file mode 100644 index 0000000..e42dfb0 --- /dev/null +++ b/src/patches/dnsmasq/0076-Fix-srk-induced-crash-in-new-tftp_no_fail-code.patch @@ -0,0 +1,36 @@ +From b4c0f092d8ce63ea4763c0ac17aa8d24318ad301 Mon Sep 17 00:00:00 2001 +From: Stefan Tomanek <stefan.tomanek+dnsmasq(a)wertarbyte.de> +Date: Thu, 16 Apr 2015 15:20:59 +0100 +Subject: [PATCH 76/78] Fix (srk induced) crash in new tftp_no_fail code. + +--- + src/dnsmasq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/dnsmasq.c b/src/dnsmasq.c +index a7c5da8fbd01..20b15c05103a 100644 +--- a/src/dnsmasq.c ++++ b/src/dnsmasq.c +@@ -655,7 +655,8 @@ int main (int argc, char **argv) + _exit(0); + } + } +- closedir(dir); ++ else ++ closedir(dir); + } + + for (p = daemon->if_prefix; p; p = p->next) +@@ -670,7 +671,8 @@ int main (int argc, char **argv) + _exit(0); + } + } +- closedir(dir); ++ else ++ closedir(dir); + } + } + #endif +-- +2.1.0 + diff --git a/src/patches/dnsmasq/0077-Note-CVE-2015-3294.patch b/src/patches/dnsmasq/0077-Note-CVE-2015-3294.patch new file mode 100644 index 0000000..15f3a4d --- /dev/null +++ b/src/patches/dnsmasq/0077-Note-CVE-2015-3294.patch @@ -0,0 +1,26 @@ +From 0df29f5e23fd2f16181847db1fcf3a8b392d869a Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Thu, 16 Apr 2015 15:24:52 +0100 +Subject: [PATCH 77/78] Note CVE-2015-3294 + +--- + CHANGELOG | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/CHANGELOG b/CHANGELOG +index 0619788e9cef..7f2b1e002e9e 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -84,6 +84,9 @@ version 2.73 + + Fix crash on receipt of certain malformed DNS requests. + Thanks to Nick Sampanis for spotting the problem. ++ Note that this is could allow the dnsmasq process's ++ memory to be read by an attacker under certain ++ circumstances, so it has a CVE, CVE-2015-3294 + + Fix crash in authoritative DNS code, if a .arpa zone + is declared as authoritative, and then a PTR query which +-- +2.1.0 + diff --git a/src/patches/dnsmasq/0078-Log-domain-when-reporting-DNSSEC-validation-failure.patch b/src/patches/dnsmasq/0078-Log-domain-when-reporting-DNSSEC-validation-failure.patch new file mode 100644 index 0000000..2f7fa0a --- /dev/null +++ b/src/patches/dnsmasq/0078-Log-domain-when-reporting-DNSSEC-validation-failure.patch @@ -0,0 +1,59 @@ +From 554b580e970275d5a869cb4fbfb2716f92b2f664 Mon Sep 17 00:00:00 2001 +From: Simon Kelley <simon(a)thekelleys.org.uk> +Date: Fri, 17 Apr 2015 22:50:20 +0100 +Subject: [PATCH 78/78] Log domain when reporting DNSSEC validation failure. + +--- + src/forward.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/src/forward.c b/src/forward.c +index 3f6b9a23b6ab..1c7da3f5655c 100644 +--- a/src/forward.c ++++ b/src/forward.c +@@ -1014,7 +1014,7 @@ void reply_query(int fd, int family, time_t now) + header->hb3 |= HB3_TC; + else + { +- char *result; ++ char *result, *domain = "result"; + + if (forward->work_counter == 0) + { +@@ -1024,7 +1024,10 @@ void reply_query(int fd, int family, time_t now) + else + result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS")); + +- log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result); ++ if (status == STAT_BOGUS && extract_request(header, n, daemon->namebuff, NULL)) ++ domain = daemon->namebuff; ++ ++ log_query(F_KEYTAG | F_SECSTAT, domain, NULL, result); + } + + if (status == STAT_SECURE) +@@ -1975,7 +1978,7 @@ unsigned char *tcp_request(int confd, time_t now, + { + int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */ + int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount); +- char *result; ++ char *result, *domain = "result"; + + if (status == STAT_INSECURE_DS) + { +@@ -1993,8 +1996,10 @@ unsigned char *tcp_request(int confd, time_t now, + } + else + result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS")); +- +- log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result); ++ if (status == STAT_BOGUS && extract_request(header, m, daemon->namebuff, NULL)) ++ domain = daemon->namebuff; ++ ++ log_query(F_KEYTAG | F_SECSTAT, domain, NULL, result); + + if (status == STAT_BOGUS) + { +-- +2.1.0 + hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core89, updated. 1ca4d1d2ae9c983fa89ec16e2765223008743637
by git＠ipfire.org 18 Apr '15

18 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core89 has been updated via 1ca4d1d2ae9c983fa89ec16e2765223008743637 (commit) via 9ba3be2bebcc589243a626d7b958be96b82ba3aa (commit) from 5167bb0dbf6e05a0f66e1012550f323004b740f4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1ca4d1d2ae9c983fa89ec16e2765223008743637 Merge: 5167bb0 9ba3be2 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Apr 18 14:27:13 2015 +0200 Merge remote-tracking branch 'origin/master' into core89 ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/89/update.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Difference in files: diff --git a/config/rootfiles/core/89/update.sh b/config/rootfiles/core/89/update.sh index 665bf43..ade1343 100644 --- a/config/rootfiles/core/89/update.sh +++ b/config/rootfiles/core/89/update.sh @@ -75,15 +75,17 @@ chown nobody.nobody \ /var/run/ovpnserver.log # Update OpenVPN/collectd configuration -# Update OpenVPN/collectd configuration for i in /var/ipfire/ovpn/n2nconf/*/*.conf; do + name="${i##*/}" + name="${name%*.conf}" + if ! grep -qE "^status-version" ${i}; then echo "# Logfile" >> ${i} echo "status-version 1" >> ${i} fi if ! grep -qE "^status " ${i}; then - echo "status /var/run/openvpn/${i##*/}-n2n 10" >> ${i} + echo "status /var/run/openvpn/${name}-n2n 10" >> ${i} fi done hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 9ba3be2bebcc589243a626d7b958be96b82ba3aa
by git＠ipfire.org 18 Apr '15

18 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 9ba3be2bebcc589243a626d7b958be96b82ba3aa (commit) from 3a2e08b29df2e8a7899e8512adad45659a379a0d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9ba3be2bebcc589243a626d7b958be96b82ba3aa Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Apr 18 12:40:41 2015 +0200 core89: Fix update script again for OpenVPN configuration update ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/89/update.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Difference in files: diff --git a/config/rootfiles/core/89/update.sh b/config/rootfiles/core/89/update.sh index 196e78b..13c645a 100644 --- a/config/rootfiles/core/89/update.sh +++ b/config/rootfiles/core/89/update.sh @@ -75,15 +75,17 @@ chown nobody.nobody \ /var/run/ovpnserver.log # Update OpenVPN/collectd configuration -# Update OpenVPN/collectd configuration for i in /var/ipfire/ovpn/n2nconf/*/*.conf; do + name="${i##*/}" + name="${name%*.conf}" + if ! grep -qE "^status-version" ${i}; then echo "# Logfile" >> ${i} echo "status-version 1" >> ${i} fi if ! grep -qE "^status " ${i}; then - echo "status /var/run/openvpn/${i##*/}-n2n 10" >> ${i} + echo "status /var/run/openvpn/${name}-n2n 10" >> ${i} fi done hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core89, updated. 5167bb0dbf6e05a0f66e1012550f323004b740f4
by git＠ipfire.org 17 Apr '15

17 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core89 has been updated via 5167bb0dbf6e05a0f66e1012550f323004b740f4 (commit) via 3a2e08b29df2e8a7899e8512adad45659a379a0d (commit) from 04c1f70d0bf9d40b370c83248e5bce1e11947dbe (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5167bb0dbf6e05a0f66e1012550f323004b740f4 Merge: 04c1f70 3a2e08b Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Apr 17 22:19:21 2015 +0200 Merge remote-tracking branch 'origin/master' into core89 ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/89/update.sh | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) Difference in files: diff --git a/config/rootfiles/core/89/update.sh b/config/rootfiles/core/89/update.sh index d98fe7e..665bf43 100644 --- a/config/rootfiles/core/89/update.sh +++ b/config/rootfiles/core/89/update.sh @@ -75,15 +75,15 @@ chown nobody.nobody \ /var/run/ovpnserver.log # Update OpenVPN/collectd configuration -files=`find /var/ipfire/ovpn/n2nconf/ -type d` -for i in $files; -do - if ! grep -q "status-version" $i/${i##*/}.conf; then - echo "# Logfile" >> $i/${i##*/}.conf - echo "status-version 1" >> $i/${i##*/}.conf +# Update OpenVPN/collectd configuration +for i in /var/ipfire/ovpn/n2nconf/*/*.conf; do + if ! grep -qE "^status-version" ${i}; then + echo "# Logfile" >> ${i} + echo "status-version 1" >> ${i} fi - if ! grep -q "status " $i/${i##*/}.conf; then - echo "status /var/run/openvpn/${i##*/}-n2n 10" >> $i/${i##*/}.conf + + if ! grep -qE "^status " ${i}; then + echo "status /var/run/openvpn/${i##*/}-n2n 10" >> ${i} fi done hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 3a2e08b29df2e8a7899e8512adad45659a379a0d
by git＠ipfire.org 17 Apr '15

17 Apr '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 3a2e08b29df2e8a7899e8512adad45659a379a0d (commit) from c02327515412b1b3ffe147275623b8475fe03b1c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3a2e08b29df2e8a7899e8512adad45659a379a0d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Apr 17 18:20:40 2015 +0200 core89: Fix script that updates OpenVPN configuration files ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/89/update.sh | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) Difference in files: diff --git a/config/rootfiles/core/89/update.sh b/config/rootfiles/core/89/update.sh index 90a6d77..196e78b 100644 --- a/config/rootfiles/core/89/update.sh +++ b/config/rootfiles/core/89/update.sh @@ -75,15 +75,15 @@ chown nobody.nobody \ /var/run/ovpnserver.log # Update OpenVPN/collectd configuration -files=`find /var/ipfire/ovpn/n2nconf/ -type d` -for i in $files; -do - if ! grep -q "status-version" $i/${i##*/}.conf; then - echo "# Logfile" >> $i/${i##*/}.conf - echo "status-version 1" >> $i/${i##*/}.conf +# Update OpenVPN/collectd configuration +for i in /var/ipfire/ovpn/n2nconf/*/*.conf; do + if ! grep -qE "^status-version" ${i}; then + echo "# Logfile" >> ${i} + echo "status-version 1" >> ${i} fi - if ! grep -q "status " $i/${i##*/}.conf; then - echo "status /var/run/openvpn/${i##*/}-n2n 10" >> $i/${i##*/}.conf + + if ! grep -qE "^status " ${i}; then + echo "status /var/run/openvpn/${i##*/}-n2n 10" >> ${i} fi done hooks/post-receive -- IPFire 2.x development tree

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM April 2015