IPFire-SCM October 2017

ipfire-scm@lists.ipfire.org

1 participants
57 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a016c0ce6a1daa791353c8bb54383fb9b71be6ef
by git＠ipfire.org 29 Oct '17

29 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a016c0ce6a1daa791353c8bb54383fb9b71be6ef (commit) from 7dadc138292897979fd7b42dcaae3ea19f24dae0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a016c0ce6a1daa791353c8bb54383fb9b71be6ef Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Oct 29 18:33:03 2017 +0000 wget: Update to 1.19.2 Fixes CVE-2017-13089 A stack-based buffer overflow when processing chunked, encoded HTTP responses was found in wget. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/wget | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/lfs/wget b/lfs/wget index 8d3d13c..2c750bf 100644 --- a/lfs/wget +++ b/lfs/wget @@ -24,7 +24,7 @@ include Config -VER = 1.19.1 +VER = 1.19.2 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = d30d82186b93fcabb4116ff513bfa9bd +$(DL_FILE)_MD5 = caabf9727fa429626316619a6369fffa install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 7dadc138292897979fd7b42dcaae3ea19f24dae0
by git＠ipfire.org 28 Oct '17

28 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 7dadc138292897979fd7b42dcaae3ea19f24dae0 (commit) via bf24eeec200ef75eaefd93be32a6e878a6c2b998 (commit) from 63420a96b6707866d2271715e6fae691f16650c4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7dadc138292897979fd7b42dcaae3ea19f24dae0 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Oct 28 13:36:27 2017 +0100 core116: Ship updated apache Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit bf24eeec200ef75eaefd93be32a6e878a6c2b998 Author: Wolfgang Apolinarski <wolfgang.apolinarski(a)googlemail.com> Date: Sat Oct 28 12:52:03 2017 +0200 Update to Apache 2.4.29 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/apache2 | 2 ++ config/rootfiles/{oldcore/114 => core/116}/filelists/apache2 | 0 config/rootfiles/core/116/update.sh | 1 + lfs/apache2 | 4 ++-- 4 files changed, 5 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/114 => core/116}/filelists/apache2 (100%) Difference in files: diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2 index 040b482..64faa79 100644 --- a/config/rootfiles/common/apache2 +++ b/config/rootfiles/common/apache2 @@ -1115,6 +1115,8 @@ srv/web/ipfire/html/captive #srv/web/ipfire/manual/mod/mpmt_os2.html #srv/web/ipfire/manual/mod/mpmt_os2.html.en #srv/web/ipfire/manual/mod/mpmt_os2.html.fr +#srv/web/ipfire/manual/mod/overrides.html +#srv/web/ipfire/manual/mod/overrides.html.en #srv/web/ipfire/manual/mod/prefork.html #srv/web/ipfire/manual/mod/prefork.html.de #srv/web/ipfire/manual/mod/prefork.html.en diff --git a/config/rootfiles/core/116/filelists/apache2 b/config/rootfiles/core/116/filelists/apache2 new file mode 120000 index 0000000..eef95ef --- /dev/null +++ b/config/rootfiles/core/116/filelists/apache2 @@ -0,0 +1 @@ +../../../common/apache2 \ No newline at end of file diff --git a/config/rootfiles/core/116/update.sh b/config/rootfiles/core/116/update.sh index 7a4d765..7a5512c 100644 --- a/config/rootfiles/core/116/update.sh +++ b/config/rootfiles/core/116/update.sh @@ -44,6 +44,7 @@ ldconfig #/usr/local/bin/update-lang-cache # Start services +/etc/init.d/apache restart /etc/init.d/snort start # This update need a reboot... diff --git a/lfs/apache2 b/lfs/apache2 index 4276a88..28855fd 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.4.28 +VER = 2.4.29 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 49007ffe8e37a0834255b279810edf24 +$(DL_FILE)_MD5 = 0c599404ef6b69eee95bcd9fcd094407 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core115, updated. 8f67534ae1a76837a976cdd5b8daa95c704ef7ec
by git＠ipfire.org 23 Oct '17

23 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core115 has been updated via 8f67534ae1a76837a976cdd5b8daa95c704ef7ec (commit) from e4e488bef6c40d532ec2ed347a446c3ef943c0d7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 8f67534ae1a76837a976cdd5b8daa95c704ef7ec Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 23 17:50:52 2017 +0200 core115: fix path to setup binary Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/115/filelists/files | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/config/rootfiles/core/115/filelists/files b/config/rootfiles/core/115/filelists/files index d88d4a1..12bed48 100644 --- a/config/rootfiles/core/115/filelists/files +++ b/config/rootfiles/core/115/filelists/files @@ -15,7 +15,7 @@ srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi srv/web/ipfire/html/captive usr/bin/captive-cleanup -usr/bin/setup +usr/sbin/setup usr/local/bin/backupiso usr/local/bin/captivectrl usr/local/bin/wirelessctrl hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 63420a96b6707866d2271715e6fae691f16650c4
by git＠ipfire.org 23 Oct '17

23 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 63420a96b6707866d2271715e6fae691f16650c4 (commit) via c4b12981e207e169c1bc0369e1c3ca7fda48964d (commit) via b47d4bc1eae6b94b2efb8ae1ce85c3ca6bbb967b (commit) via 49f7ee5d72f1dde61875a7e15add7f4d901afe0b (commit) via cd8a7fc1eb437a411e0a84266c8d3eaf9612d814 (commit) via a809d7fa6832f2ec46fe965069283b7b89f723e8 (commit) from 9064ba72fe03d324478b8c321f4368192e8f551c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 63420a96b6707866d2271715e6fae691f16650c4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 23 16:29:09 2017 +0100 core116: Ship updated proxy.cgi Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c4b12981e207e169c1bc0369e1c3ca7fda48964d Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Fri Oct 13 22:29:20 2017 +0200 proxy.cgi: Even more cosmetics Another clickable link for 'proxy.cgi', this time for 'Cache Manager Interface' - this one opens in a new window. And: This time - hopefully - with correct '_blank'-attribute (deleted the backslashes) - based on current 'next'. Plus: Deleted some "blind" tabs - found by chance. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b47d4bc1eae6b94b2efb8ae1ce85c3ca6bbb967b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 23 16:26:39 2017 +0100 core116: Ship snort Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 49f7ee5d72f1dde61875a7e15add7f4d901afe0b Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Fri Oct 13 22:23:25 2017 +0200 snort: Update to 2.9.11 For details see: Release notes: https://snort.org/downloads/snort/release_notes_2.9.11.txt Changelog: https://snort.org/downloads/snort/changelog_2.9.11.txt Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit cd8a7fc1eb437a411e0a84266c8d3eaf9612d814 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Oct 23 16:24:10 2017 +0100 Start Core Update 116 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a809d7fa6832f2ec46fe965069283b7b89f723e8 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Thu Oct 19 21:16:02 2017 +0200 xz: Update to 5.2.3 For details see: https://git.tukaani.org/?p=xz.git;a=blob;f=NEWS;hb=HEAD Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/snort | 9 +++++---- config/rootfiles/common/xz | 2 +- config/rootfiles/core/{115 => 116}/exclude | 0 config/rootfiles/core/116/filelists/files | 3 +++ config/rootfiles/{oldcore/104 => core/116}/filelists/snort | 0 config/rootfiles/{oldcore/100 => core/116}/filelists/xz | 0 config/rootfiles/core/{115 => 116}/meta | 0 config/rootfiles/{oldcore/112 => core/116}/update.sh | 13 +++++-------- config/rootfiles/{core => oldcore}/115/exclude | 0 config/rootfiles/{core => oldcore}/115/filelists/apache2 | 0 config/rootfiles/{core => oldcore}/115/filelists/bootstrap | 0 config/rootfiles/{core => oldcore}/115/filelists/files | 0 config/rootfiles/{core => oldcore}/115/filelists/logrotate | 0 config/rootfiles/{core => oldcore}/115/filelists/openvpn | 0 .../rootfiles/{core => oldcore}/115/filelists/perl-Font-TTF | 0 .../{core => oldcore}/115/filelists/perl-IO-String | 0 .../rootfiles/{core => oldcore}/115/filelists/perl-PDF-API2 | 0 .../{core => oldcore}/115/filelists/ubuntu-font-family | 0 .../{core => oldcore}/115/filelists/wpa_supplicant | 0 config/rootfiles/{core => oldcore}/115/meta | 0 config/rootfiles/{core => oldcore}/115/update.sh | 0 html/cgi-bin/ids.cgi | 4 ++-- html/cgi-bin/proxy.cgi | 8 ++++---- lfs/snort | 6 +++--- lfs/xz | 7 +++---- make.sh | 2 +- 26 files changed, 27 insertions(+), 27 deletions(-) copy config/rootfiles/core/{115 => 116}/exclude (100%) create mode 100644 config/rootfiles/core/116/filelists/files copy config/rootfiles/{oldcore/104 => core/116}/filelists/snort (100%) copy config/rootfiles/{oldcore/100 => core/116}/filelists/xz (100%) copy config/rootfiles/core/{115 => 116}/meta (100%) copy config/rootfiles/{oldcore/112 => core/116}/update.sh (93%) rename config/rootfiles/{core => oldcore}/115/exclude (100%) rename config/rootfiles/{core => oldcore}/115/filelists/apache2 (100%) rename config/rootfiles/{core => oldcore}/115/filelists/bootstrap (100%) rename config/rootfiles/{core => oldcore}/115/filelists/files (100%) rename config/rootfiles/{core => oldcore}/115/filelists/logrotate (100%) rename config/rootfiles/{core => oldcore}/115/filelists/openvpn (100%) rename config/rootfiles/{core => oldcore}/115/filelists/perl-Font-TTF (100%) rename config/rootfiles/{core => oldcore}/115/filelists/perl-IO-String (100%) rename config/rootfiles/{core => oldcore}/115/filelists/perl-PDF-API2 (100%) rename config/rootfiles/{core => oldcore}/115/filelists/ubuntu-font-family (100%) rename config/rootfiles/{core => oldcore}/115/filelists/wpa_supplicant (100%) rename config/rootfiles/{core => oldcore}/115/meta (100%) rename config/rootfiles/{core => oldcore}/115/update.sh (100%) Difference in files: diff --git a/config/rootfiles/common/snort b/config/rootfiles/common/snort index ea29593..c83b156 100644 --- a/config/rootfiles/common/snort +++ b/config/rootfiles/common/snort @@ -27,10 +27,10 @@ usr/bin/u2spewfoo #usr/include/snort/dynamic_output/snort_debug.h #usr/include/snort/dynamic_output/stream_api.h #usr/include/snort/dynamic_preproc +#usr/include/snort/dynamic_preproc/appdata_adjuster.h #usr/include/snort/dynamic_preproc/bitop.h #usr/include/snort/dynamic_preproc/cpuclock.h #usr/include/snort/dynamic_preproc/file_api.h -#usr/include/snort/dynamic_preproc/file_mail_common.h #usr/include/snort/dynamic_preproc/idle_processing.h #usr/include/snort/dynamic_preproc/ipv6_port.h #usr/include/snort/dynamic_preproc/mempool.h @@ -40,6 +40,8 @@ usr/bin/u2spewfoo #usr/include/snort/dynamic_preproc/perf_indicators.h #usr/include/snort/dynamic_preproc/preprocids.h #usr/include/snort/dynamic_preproc/profiler.h +#usr/include/snort/dynamic_preproc/reg_test.h +#usr/include/snort/dynamic_preproc/reload_api.h #usr/include/snort/dynamic_preproc/segment_mem.h #usr/include/snort/dynamic_preproc/session_api.h #usr/include/snort/dynamic_preproc/sfPolicy.h @@ -60,14 +62,12 @@ usr/bin/u2spewfoo #usr/include/snort/dynamic_preproc/sf_snort_plugin_api.h #usr/include/snort/dynamic_preproc/sfcommon.h #usr/include/snort/dynamic_preproc/sfcontrol.h -#usr/include/snort/dynamic_preproc/sfdebug.h #usr/include/snort/dynamic_preproc/sfrt.h #usr/include/snort/dynamic_preproc/sfrt_dir.h #usr/include/snort/dynamic_preproc/sfrt_flat.h #usr/include/snort/dynamic_preproc/sfrt_flat_dir.h #usr/include/snort/dynamic_preproc/sfrt_trie.h #usr/include/snort/dynamic_preproc/sidechannel_define.h -#usr/include/snort/dynamic_preproc/sip_common.h #usr/include/snort/dynamic_preproc/snort_bounds.h #usr/include/snort/dynamic_preproc/snort_debug.h #usr/include/snort/dynamic_preproc/ssl.h @@ -88,6 +88,8 @@ usr/lib/snort/dynamic_output usr/lib/snort/dynamic_preproc #usr/lib/snort/dynamic_preproc/libsf_dynamic_preproc.a #usr/lib/snort/dynamic_preproc/libsf_dynamic_preproc.la +#usr/lib/snort/dynamic_preproc/libsf_dynamic_utils.a +#usr/lib/snort/dynamic_preproc/libsf_dynamic_utils.la usr/lib/snort_dynamicengine #usr/lib/snort_dynamicengine/libsf_engine.a #usr/lib/snort_dynamicengine/libsf_engine.la @@ -215,7 +217,6 @@ usr/sbin/snort #usr/share/doc/snort/README.reload #usr/share/doc/snort/README.reputation #usr/share/doc/snort/README.sensitive_data -#usr/share/doc/snort/README.session #usr/share/doc/snort/README.sfportscan #usr/share/doc/snort/README.sip #usr/share/doc/snort/README.ssh diff --git a/config/rootfiles/common/xz b/config/rootfiles/common/xz index 8b71758..5684a19 100644 --- a/config/rootfiles/common/xz +++ b/config/rootfiles/common/xz @@ -41,7 +41,7 @@ usr/bin/xzmore #usr/lib/liblzma.la usr/lib/liblzma.so usr/lib/liblzma.so.5 -usr/lib/liblzma.so.5.2.2 +usr/lib/liblzma.so.5.2.3 #usr/lib/pkgconfig/liblzma.pc #usr/share/doc/xz #usr/share/doc/xz/AUTHORS diff --git a/config/rootfiles/core/115/exclude b/config/rootfiles/core/116/exclude similarity index 100% rename from config/rootfiles/core/115/exclude rename to config/rootfiles/core/116/exclude diff --git a/config/rootfiles/core/116/filelists/files b/config/rootfiles/core/116/filelists/files new file mode 100644 index 0000000..d3c27e8 --- /dev/null +++ b/config/rootfiles/core/116/filelists/files @@ -0,0 +1,3 @@ +etc/system-release +etc/issue +srv/web/ipfire/cgi-bin/proxy.cgi diff --git a/config/rootfiles/core/116/filelists/snort b/config/rootfiles/core/116/filelists/snort new file mode 120000 index 0000000..9406ce0 --- /dev/null +++ b/config/rootfiles/core/116/filelists/snort @@ -0,0 +1 @@ +../../../common/snort \ No newline at end of file diff --git a/config/rootfiles/core/116/filelists/xz b/config/rootfiles/core/116/filelists/xz new file mode 120000 index 0000000..734e926 --- /dev/null +++ b/config/rootfiles/core/116/filelists/xz @@ -0,0 +1 @@ +../../../common/xz \ No newline at end of file diff --git a/config/rootfiles/core/115/meta b/config/rootfiles/core/116/meta similarity index 100% rename from config/rootfiles/core/115/meta rename to config/rootfiles/core/116/meta diff --git a/config/rootfiles/core/116/update.sh b/config/rootfiles/core/116/update.sh new file mode 100644 index 0000000..7a4d765 --- /dev/null +++ b/config/rootfiles/core/116/update.sh @@ -0,0 +1,64 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 3 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2017 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +/usr/local/bin/backupctrl exclude >/dev/null 2>&1 + +core=116 + +# Remove old core updates from pakfire cache to save space... +for (( i=1; i<=$core; i++ )); do + rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire +done + +# Stop services +/etc/init.d/snort stop + +# Extract files +extract_files + +# update linker config +ldconfig + +# Update Language cache +#/usr/local/bin/update-lang-cache + +# Start services +/etc/init.d/snort start + +# This update need a reboot... +#touch /var/run/need_reboot + +# Finish +/etc/init.d/fireinfo start +sendprofile + +# Update grub config to display new core version +if [ -e /boot/grub/grub.cfg ]; then + grub-mkconfig -o /boot/grub/grub.cfg +fi + +sync + +# Don't report the exitcode last command +exit 0 diff --git a/config/rootfiles/oldcore/115/exclude b/config/rootfiles/oldcore/115/exclude new file mode 100644 index 0000000..d6fd053 --- /dev/null +++ b/config/rootfiles/oldcore/115/exclude @@ -0,0 +1,30 @@ +boot/config.txt +boot/grub/grub.cfg +boot/grub/grubenv +etc/alternatives +etc/collectd.custom +etc/default/grub +etc/ipsec.conf +etc/ipsec.secrets +etc/ipsec.user.conf +etc/ipsec.user.secrets +etc/localtime +etc/shadow +etc/snort/snort.conf +etc/ssh/ssh_config +etc/ssh/sshd_config +etc/ssl/openssl.cnf +etc/sudoers +etc/sysconfig/firewall.local +etc/sysconfig/rc.local +etc/udev/rules.d/30-persistent-network.rules +srv/web/ipfire/html/proxy.pac +var/ipfire/dma +var/ipfire/time +var/ipfire/ovpn +var/lib/alternatives +var/log/cache +var/log/dhcpcd.log +var/log/messages +var/state/dhcp/dhcpd.leases +var/updatecache diff --git a/config/rootfiles/core/115/filelists/apache2 b/config/rootfiles/oldcore/115/filelists/apache2 similarity index 100% rename from config/rootfiles/core/115/filelists/apache2 rename to config/rootfiles/oldcore/115/filelists/apache2 diff --git a/config/rootfiles/core/115/filelists/bootstrap b/config/rootfiles/oldcore/115/filelists/bootstrap similarity index 100% rename from config/rootfiles/core/115/filelists/bootstrap rename to config/rootfiles/oldcore/115/filelists/bootstrap diff --git a/config/rootfiles/core/115/filelists/files b/config/rootfiles/oldcore/115/filelists/files similarity index 100% rename from config/rootfiles/core/115/filelists/files rename to config/rootfiles/oldcore/115/filelists/files diff --git a/config/rootfiles/core/115/filelists/logrotate b/config/rootfiles/oldcore/115/filelists/logrotate similarity index 100% rename from config/rootfiles/core/115/filelists/logrotate rename to config/rootfiles/oldcore/115/filelists/logrotate diff --git a/config/rootfiles/core/115/filelists/openvpn b/config/rootfiles/oldcore/115/filelists/openvpn similarity index 100% rename from config/rootfiles/core/115/filelists/openvpn rename to config/rootfiles/oldcore/115/filelists/openvpn diff --git a/config/rootfiles/core/115/filelists/perl-Font-TTF b/config/rootfiles/oldcore/115/filelists/perl-Font-TTF similarity index 100% rename from config/rootfiles/core/115/filelists/perl-Font-TTF rename to config/rootfiles/oldcore/115/filelists/perl-Font-TTF diff --git a/config/rootfiles/core/115/filelists/perl-IO-String b/config/rootfiles/oldcore/115/filelists/perl-IO-String similarity index 100% rename from config/rootfiles/core/115/filelists/perl-IO-String rename to config/rootfiles/oldcore/115/filelists/perl-IO-String diff --git a/config/rootfiles/core/115/filelists/perl-PDF-API2 b/config/rootfiles/oldcore/115/filelists/perl-PDF-API2 similarity index 100% rename from config/rootfiles/core/115/filelists/perl-PDF-API2 rename to config/rootfiles/oldcore/115/filelists/perl-PDF-API2 diff --git a/config/rootfiles/core/115/filelists/ubuntu-font-family b/config/rootfiles/oldcore/115/filelists/ubuntu-font-family similarity index 100% rename from config/rootfiles/core/115/filelists/ubuntu-font-family rename to config/rootfiles/oldcore/115/filelists/ubuntu-font-family diff --git a/config/rootfiles/core/115/filelists/wpa_supplicant b/config/rootfiles/oldcore/115/filelists/wpa_supplicant similarity index 100% rename from config/rootfiles/core/115/filelists/wpa_supplicant rename to config/rootfiles/oldcore/115/filelists/wpa_supplicant diff --git a/config/rootfiles/oldcore/115/meta b/config/rootfiles/oldcore/115/meta new file mode 100644 index 0000000..d547fa8 --- /dev/null +++ b/config/rootfiles/oldcore/115/meta @@ -0,0 +1 @@ +DEPS="" diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/oldcore/115/update.sh similarity index 100% rename from config/rootfiles/core/115/update.sh rename to config/rootfiles/oldcore/115/update.sh diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 3d95197..ff48333 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -259,9 +259,9 @@ if ($snortsettings{'OINKCODE'} ne "") { if (!$errormessage) { if ($snortsettings{'RULES'} eq 'subscripted') { - $url=" https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=$snort…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-29110.tar.gz?oinkcode=$snor…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'registered') { - $url=" https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=$snort…'OINKCODE'}"; + $url=" https://www.snort.org/rules/snortrules-snapshot-29110.tar.gz?oinkcode=$snor…'OINKCODE'}"; } elsif ($snortsettings{'RULES'} eq 'community') { $url=" https://www.snort.org/rules/community"; } else { diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index dd83bba..6aa14e1 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -359,7 +359,7 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'} $errormessage = $Lang::tr{'advproxy errmsg cache'}." ".$proxysettings{'CACHE_MEM'}." > ".$proxysettings{'CACHE_SIZE'}; goto ERROR; } - + if (!(&General::validport($proxysettings{'PROXY_PORT'}))) { $errormessage = $Lang::tr{'advproxy errmsg invalid proxy port'}; @@ -695,7 +695,7 @@ ERROR: system ('/usr/bin/touch', "${General::swroot}/proxy/transparent_blue"); } if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) { system('/usr/local/bin/squidctrl restart >/dev/null 2>&1'); } - if ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}) { system('/usr/local/bin/squidctrl reconfigure >/dev/null 2>&1'); } + if ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}) { system('/usr/local/bin/squidctrl reconfigure >/dev/null 2>&1'); } } } @@ -1118,7 +1118,7 @@ print <<END <td colspan='4'><b>$Lang::tr{'advproxy cache management'}</b></td> </tr> <tr> - <td class='base'>$Lang::tr{'proxy cachemgr'}:</td> + <td class='base'><a href='/cgi-bin/cachemgr.cgi' target='_blank'>$Lang::tr{'proxy cachemgr'}:</td> <td><input type='checkbox' name='CACHEMGR' $checked{'CACHEMGR'}{'on'} /></td> <td class='base'>$Lang::tr{'advproxy admin mail'}:</td> <td><input type='text' name='ADMIN_MAIL_ADDRESS' value='$proxysettings{'ADMIN_MAIL_ADDRESS'}' /></td> @@ -3206,7 +3206,7 @@ END if ($proxysettings{'OFFLINE_MODE'} eq 'on') { print FILE "offline_mode on\n\n"; } if ($proxysettings{'CACHE_DIGESTS'} eq 'on') { print FILE "digest_generation on\n\n"; } else { print FILE "digest_generation off\n\n"; } - + if ((!($proxysettings{'MEM_POLICY'} eq 'LRU')) || (!($proxysettings{'CACHE_POLICY'} eq 'LRU'))) { if (!($proxysettings{'MEM_POLICY'} eq 'LRU')) diff --git a/lfs/snort b/lfs/snort index 032ce30..f66bf01 100644 --- a/lfs/snort +++ b/lfs/snort @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2016 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.9.9.0 +VER = 2.9.11 THISAPP = snort-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = fd3012bf36710481d66b40ad046b231d +$(DL_FILE)_MD5 = 4f3ee0c2ad330e487273016efd0c9d64 install : $(TARGET) diff --git a/lfs/xz b/lfs/xz index c09cb34..a0da50a 100644 --- a/lfs/xz +++ b/lfs/xz @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2012 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 5.2.2 +VER = 5.2.3 THISAPP = xz-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e26772b69940085c0632589ab1d52e64 +$(DL_FILE)_MD5 = 60fb79cab777e3f71ca43d298adacbd5 install : $(TARGET) @@ -77,7 +77,6 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && sed -e '/mf\.buffer = NULL/a next->coder->mf.size = 0;' -i src/liblzma/lz/lz_encoder.c cd $(DIR_APP) && ./configure --prefix=$(PREFIX) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/make.sh b/make.sh index f4a651a..f5f4741 100755 --- a/make.sh +++ b/make.sh @@ -25,7 +25,7 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name VERSION="2.19" # Version number -CORE="115" # Core Level (Filename) +CORE="116" # Core Level (Filename) PAKFIRE_CORE="115" # Core Level (PAKFIRE) GIT_BRANCH=`git rev-parse --abbrev-ref HEAD` # Git Branch SLOGAN="www.ipfire.org" # Software slogan hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core115, updated. e4e488bef6c40d532ec2ed347a446c3ef943c0d7
by git＠ipfire.org 23 Oct '17

23 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core115 has been updated via e4e488bef6c40d532ec2ed347a446c3ef943c0d7 (commit) via c21d6eb8ed05ccf66e5fe8e6a4feb3111db67e10 (commit) via df6399241509586e6ea86fb88bdf0fc01190fea4 (commit) from 9064ba72fe03d324478b8c321f4368192e8f551c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e4e488bef6c40d532ec2ed347a446c3ef943c0d7 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 23 16:14:25 2017 +0200 core115: add setup to update this fix admin passwort set problem. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit c21d6eb8ed05ccf66e5fe8e6a4feb3111db67e10 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 23 16:13:09 2017 +0200 core115: add patch of openvpnctrl Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit df6399241509586e6ea86fb88bdf0fc01190fea4 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Oct 23 16:11:36 2017 +0200 core115: fix typo at apache start Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/115/filelists/files | 1 + config/rootfiles/core/115/update.sh | 10 +++++----- 2 files changed, 6 insertions(+), 5 deletions(-) Difference in files: diff --git a/config/rootfiles/core/115/filelists/files b/config/rootfiles/core/115/filelists/files index d3e2958..d88d4a1 100644 --- a/config/rootfiles/core/115/filelists/files +++ b/config/rootfiles/core/115/filelists/files @@ -15,6 +15,7 @@ srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi srv/web/ipfire/html/captive usr/bin/captive-cleanup +usr/bin/setup usr/local/bin/backupiso usr/local/bin/captivectrl usr/local/bin/wirelessctrl diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/core/115/update.sh index 91bb808..2806984 100644 --- a/config/rootfiles/core/115/update.sh +++ b/config/rootfiles/core/115/update.sh @@ -32,8 +32,8 @@ for (( i=1; i<=$core; i++ )); do done # Stop services -openvpnctrl -k -openvpnctrl -kn2n +/usr/local/bin/openvpnctrl -k +/usr/local/bin/openvpnctrl -kn2n /etc/rc.d/init.d/apache stop # Extract files @@ -51,9 +51,9 @@ ldconfig /usr/local/bin/update-lang-cache # Start services -/etc/rc.d/init.d/apache2 start -openvpnctrl -s -openvpnctrl -sn2n +/etc/rc.d/init.d/apache start +/usr/local/bin/openvpnctrl -s +/usr/local/bin/openvpnctrl -sn2n grep -q "captivectrl" /var/spool/cron/root.orig || cat <<EOF >> /var/spool/cron/root.orig # Cleanup captive clients hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree tag, v2.19-core115, created. 9064ba72fe03d324478b8c321f4368192e8f551c
by git＠ipfire.org 22 Oct '17

22 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The tag, v2.19-core115 has been created at 9064ba72fe03d324478b8c321f4368192e8f551c (commit) - Log ----------------------------------------------------------------- commit 9064ba72fe03d324478b8c321f4368192e8f551c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Oct 22 15:50:38 2017 +0200 drop httpscert and merge to apache initskript Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9064ba72fe03d324478b8c321f4368192e8f551c
by git＠ipfire.org 22 Oct '17

22 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 9064ba72fe03d324478b8c321f4368192e8f551c (commit) from 0d6b6a219ff9dc2735f4b4b6213f9936f4a239d7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9064ba72fe03d324478b8c321f4368192e8f551c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Oct 22 15:50:38 2017 +0200 drop httpscert and merge to apache initskript Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/stage2 | 1 - config/rootfiles/common/x86_64/stage2 | 1 - config/rootfiles/core/115/filelists/files | 2 +- config/rootfiles/core/115/update.sh | 8 ++-- src/initscripts/system/apache | 60 +++++++++++++++++++++++++----- src/scripts/httpscert | 61 ------------------------------- 6 files changed, 54 insertions(+), 79 deletions(-) delete mode 100644 src/scripts/httpscert Difference in files: diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index 8c6dd40..a5ba6ae 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -91,7 +91,6 @@ usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-ovpn usr/local/bin/hddshutdown -usr/local/bin/httpscert usr/local/bin/makegraphs usr/local/bin/qosd usr/local/bin/readhash diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index 2897adc..70a33d6 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -93,7 +93,6 @@ usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-ovpn usr/local/bin/hddshutdown -usr/local/bin/httpscert usr/local/bin/makegraphs usr/local/bin/qosd usr/local/bin/readhash diff --git a/config/rootfiles/core/115/filelists/files b/config/rootfiles/core/115/filelists/files index 72c5e5f..d3e2958 100644 --- a/config/rootfiles/core/115/filelists/files +++ b/config/rootfiles/core/115/filelists/files @@ -3,6 +3,7 @@ etc/issue etc/httpd/conf/vhosts.d/captive.conf etc/httpd/conf/vhosts.d/ipfire-interface.conf etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf +etc/rc.d/init.d/apache etc/rc.d/init.d/firewall srv/web/ipfire/cgi-bin/captive/index.cgi srv/web/ipfire/cgi-bin/captive/logo.cgi @@ -16,7 +17,6 @@ srv/web/ipfire/html/captive usr/bin/captive-cleanup usr/local/bin/backupiso usr/local/bin/captivectrl -usr/local/bin/httpscert usr/local/bin/wirelessctrl var/ipfire/backup/include var/ipfire/captive diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/core/115/update.sh index 20f870d..91bb808 100644 --- a/config/rootfiles/core/115/update.sh +++ b/config/rootfiles/core/115/update.sh @@ -34,13 +34,14 @@ done # Stop services openvpnctrl -k openvpnctrl -kn2n - +/etc/rc.d/init.d/apache stop # Extract files extract_files # Remove files rm -vf \ + /usr/local/bin/httpscert \ /srv/web/ipfire/html/dial.cgi # update linker config @@ -49,11 +50,8 @@ ldconfig # Update Language cache /usr/local/bin/update-lang-cache -# generate ECDSA key on existing installations to prevent Apache from crashing -/usr/local/bin/httpscert new - # Start services -/etc/rc.d/init.d/apache2 restart +/etc/rc.d/init.d/apache2 start openvpnctrl -s openvpnctrl -sn2n diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache index 5dd39f9..541141e 100644 --- a/src/initscripts/system/apache +++ b/src/initscripts/system/apache @@ -7,18 +7,58 @@ . /etc/sysconfig/rc . $rc_functions +generate_certificates() { + if [ ! -f "/etc/httpd/server.key" ]; then + boot_mesg "Generating HTTPS RSA server key (this will take a moment)..." + openssl genrsa -out /etc/httpd/server.key 4096 &>/dev/null + evaluate_retval + fi + + if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then + boot_mesg "Generating HTTPS ECDSA server key..." + openssl ecparam -genkey -name secp384r1 -noout \ + -out /etc/httpd/server-ecdsa.key &>/dev/null + evaluate_retval + fi + + # Generate RSA CSR + if [ ! -f "/etc/httpd/server.csr" ]; then + sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ + openssl req -new -key /etc/httpd/server.key \ + -out /etc/httpd/server.csr &>/dev/null + fi + + # Generate ECDSA CSR + if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then + sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ + openssl req -new -key /etc/httpd/server-ecdsa.key \ + -out /etc/httpd/server-ecdsa.csr &>/dev/null + fi + + if [ ! -f "/etc/httpd/server.crt" ]; then + boot_mesg "Signing RSA certificate..." + openssl x509 -req -days 999999 -sha256 \ + -in /etc/httpd/server.csr \ + -signkey /etc/httpd/server.key \ + -out /etc/httpd/server.crt &>/dev/null + evaluate_retval + fi + + if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then + boot_mesg "Signing ECDSA certificate..." + openssl x509 -req -days 999999 -sha256 \ + -in /etc/httpd/server-ecdsa.csr \ + -signkey /etc/httpd/server-ecdsa.key \ + -out /etc/httpd/server-ecdsa.crt &>/dev/null + evaluate_retval + fi +} + case "$1" in start) - if [ -f /etc/httpd/server.key -a -f /etc/httpd/server.crt -a -f /etc/httpd/server.csr ]; then - /usr/local/bin/httpscert read >/dev/null 2>&1 - else - boot_mesg "Generating HTTPS host certificate (may take a couple of minutes)..." - /usr/local/bin/httpscert new >/dev/null 2>&1 - evaluate_retval - - # Make sure that the key is written to disk. - sync - fi + # Generate all required certificates + generate_certificates + boot_mesg "Starting Apache daemon..." /usr/sbin/apachectl -k start evaluate_retval diff --git a/src/scripts/httpscert b/src/scripts/httpscert deleted file mode 100644 index cae39fb..0000000 --- a/src/scripts/httpscert +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/sh -# -# new : generate new certificate -# read: read issuer in certificate and verify if it is the same as hostname - -# See how we were called. -case "$1" in - new) - if [ ! -f /etc/httpd/server.key ]; then - echo "Generating HTTPS RSA server key." - /usr/bin/openssl genrsa -out /etc/httpd/server.key 4096 - fi - if [ ! -f /etc/httpd/server-ecdsa.key ]; then - echo "Generating HTTPS ECDSA server key." - /usr/bin/openssl ecparam -genkey -name secp384r1 | openssl ec -out /etc/httpd/server-ecdsa.key - fi - - echo "Generating CSRs" - if [ ! -f /etc/httpd/server.csr ]; then - /bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/openssl \ - req -new -key /etc/httpd/server.key -out /etc/httpd/server.csr - fi - if [ ! -f /etc/httpd/server-ecdsa.csr ]; then - /bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/openssl \ - req -new -key /etc/httpd/server-ecdsa.key -out /etc/httpd/server-ecdsa.csr - fi - - echo "Signing certificates" - if [ ! -f /etc/httpd/server.crt ]; then - /usr/bin/openssl x509 -req -days 999999 -sha256 -in \ - /etc/httpd/server.csr -signkey /etc/httpd/server.key -out \ - /etc/httpd/server.crt - fi - if [ ! -f /etc/httpd/server-ecdsa.crt ]; then - /usr/bin/openssl x509 -req -days 999999 -sha256 -in \ - /etc/httpd/server-ecdsa.csr -signkey /etc/httpd/server-ecdsa.key -out \ - /etc/httpd/server-ecdsa.crt - fi - ;; - read) - if [ -f /etc/httpd/server.key -a -f /etc/httpd/server.crt -a -f /etc/httpd/server.csr ]; then - ISSUER=`openssl x509 -in /etc/httpd/server.crt -text -noout | grep Issuer | /usr/bin/cut -f2 -d '='` - HOSTNAME=`/bin/hostname -f` - if [ "$ISSUER" != "$HOSTNAME" ]; then - echo "Certificate issuer '$ISSUER' is not the same as the hostname '$HOSTNAME'" - echo "Probably host or domain name has been changed in setup" - echo "You could remake server certificate with '/usr/local/bin/httpscert new'" - exit 1 - else - echo "https certificate issuer match $HOSTNAME" - fi - else - echo "Certificate not found" - exit 1 - fi - ;; - *) - /bin/echo "Usage: $0 {read|new}" - exit 1 - ;; -esac hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 9064ba72fe03d324478b8c321f4368192e8f551c
by git＠ipfire.org 22 Oct '17

22 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 9064ba72fe03d324478b8c321f4368192e8f551c (commit) via 0d6b6a219ff9dc2735f4b4b6213f9936f4a239d7 (commit) from cf361ef4b55134254150b5070069f9d25b201bd1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9064ba72fe03d324478b8c321f4368192e8f551c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Oct 22 15:50:38 2017 +0200 drop httpscert and merge to apache initskript Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/stage2 | 1 - config/rootfiles/common/x86_64/stage2 | 1 - config/rootfiles/core/115/filelists/files | 2 +- config/rootfiles/core/115/update.sh | 8 ++-- src/initscripts/system/apache | 60 +++++++++++++++++++++++++----- src/scripts/httpscert | 61 ------------------------------- 6 files changed, 54 insertions(+), 79 deletions(-) delete mode 100644 src/scripts/httpscert Difference in files: diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index 8c6dd40..a5ba6ae 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -91,7 +91,6 @@ usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-ovpn usr/local/bin/hddshutdown -usr/local/bin/httpscert usr/local/bin/makegraphs usr/local/bin/qosd usr/local/bin/readhash diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index 2897adc..70a33d6 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -93,7 +93,6 @@ usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-ovpn usr/local/bin/hddshutdown -usr/local/bin/httpscert usr/local/bin/makegraphs usr/local/bin/qosd usr/local/bin/readhash diff --git a/config/rootfiles/core/115/filelists/files b/config/rootfiles/core/115/filelists/files index 72c5e5f..d3e2958 100644 --- a/config/rootfiles/core/115/filelists/files +++ b/config/rootfiles/core/115/filelists/files @@ -3,6 +3,7 @@ etc/issue etc/httpd/conf/vhosts.d/captive.conf etc/httpd/conf/vhosts.d/ipfire-interface.conf etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf +etc/rc.d/init.d/apache etc/rc.d/init.d/firewall srv/web/ipfire/cgi-bin/captive/index.cgi srv/web/ipfire/cgi-bin/captive/logo.cgi @@ -16,7 +17,6 @@ srv/web/ipfire/html/captive usr/bin/captive-cleanup usr/local/bin/backupiso usr/local/bin/captivectrl -usr/local/bin/httpscert usr/local/bin/wirelessctrl var/ipfire/backup/include var/ipfire/captive diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/core/115/update.sh index 61634a7..91bb808 100644 --- a/config/rootfiles/core/115/update.sh +++ b/config/rootfiles/core/115/update.sh @@ -34,13 +34,14 @@ done # Stop services openvpnctrl -k openvpnctrl -kn2n - +/etc/rc.d/init.d/apache stop # Extract files extract_files # Remove files rm -vf \ + /usr/local/bin/httpscert \ /srv/web/ipfire/html/dial.cgi # update linker config @@ -49,11 +50,8 @@ ldconfig # Update Language cache /usr/local/bin/update-lang-cache -# generate ECDSA key on existing installations to prevent Apache from crashing -/usr/local/bin/httpscert - # Start services -/etc/rc.d/init.d/apache2 restart +/etc/rc.d/init.d/apache2 start openvpnctrl -s openvpnctrl -sn2n diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache index 5dd39f9..541141e 100644 --- a/src/initscripts/system/apache +++ b/src/initscripts/system/apache @@ -7,18 +7,58 @@ . /etc/sysconfig/rc . $rc_functions +generate_certificates() { + if [ ! -f "/etc/httpd/server.key" ]; then + boot_mesg "Generating HTTPS RSA server key (this will take a moment)..." + openssl genrsa -out /etc/httpd/server.key 4096 &>/dev/null + evaluate_retval + fi + + if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then + boot_mesg "Generating HTTPS ECDSA server key..." + openssl ecparam -genkey -name secp384r1 -noout \ + -out /etc/httpd/server-ecdsa.key &>/dev/null + evaluate_retval + fi + + # Generate RSA CSR + if [ ! -f "/etc/httpd/server.csr" ]; then + sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ + openssl req -new -key /etc/httpd/server.key \ + -out /etc/httpd/server.csr &>/dev/null + fi + + # Generate ECDSA CSR + if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then + sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ + openssl req -new -key /etc/httpd/server-ecdsa.key \ + -out /etc/httpd/server-ecdsa.csr &>/dev/null + fi + + if [ ! -f "/etc/httpd/server.crt" ]; then + boot_mesg "Signing RSA certificate..." + openssl x509 -req -days 999999 -sha256 \ + -in /etc/httpd/server.csr \ + -signkey /etc/httpd/server.key \ + -out /etc/httpd/server.crt &>/dev/null + evaluate_retval + fi + + if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then + boot_mesg "Signing ECDSA certificate..." + openssl x509 -req -days 999999 -sha256 \ + -in /etc/httpd/server-ecdsa.csr \ + -signkey /etc/httpd/server-ecdsa.key \ + -out /etc/httpd/server-ecdsa.crt &>/dev/null + evaluate_retval + fi +} + case "$1" in start) - if [ -f /etc/httpd/server.key -a -f /etc/httpd/server.crt -a -f /etc/httpd/server.csr ]; then - /usr/local/bin/httpscert read >/dev/null 2>&1 - else - boot_mesg "Generating HTTPS host certificate (may take a couple of minutes)..." - /usr/local/bin/httpscert new >/dev/null 2>&1 - evaluate_retval - - # Make sure that the key is written to disk. - sync - fi + # Generate all required certificates + generate_certificates + boot_mesg "Starting Apache daemon..." /usr/sbin/apachectl -k start evaluate_retval diff --git a/src/scripts/httpscert b/src/scripts/httpscert deleted file mode 100644 index cae39fb..0000000 --- a/src/scripts/httpscert +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/sh -# -# new : generate new certificate -# read: read issuer in certificate and verify if it is the same as hostname - -# See how we were called. -case "$1" in - new) - if [ ! -f /etc/httpd/server.key ]; then - echo "Generating HTTPS RSA server key." - /usr/bin/openssl genrsa -out /etc/httpd/server.key 4096 - fi - if [ ! -f /etc/httpd/server-ecdsa.key ]; then - echo "Generating HTTPS ECDSA server key." - /usr/bin/openssl ecparam -genkey -name secp384r1 | openssl ec -out /etc/httpd/server-ecdsa.key - fi - - echo "Generating CSRs" - if [ ! -f /etc/httpd/server.csr ]; then - /bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/openssl \ - req -new -key /etc/httpd/server.key -out /etc/httpd/server.csr - fi - if [ ! -f /etc/httpd/server-ecdsa.csr ]; then - /bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/openssl \ - req -new -key /etc/httpd/server-ecdsa.key -out /etc/httpd/server-ecdsa.csr - fi - - echo "Signing certificates" - if [ ! -f /etc/httpd/server.crt ]; then - /usr/bin/openssl x509 -req -days 999999 -sha256 -in \ - /etc/httpd/server.csr -signkey /etc/httpd/server.key -out \ - /etc/httpd/server.crt - fi - if [ ! -f /etc/httpd/server-ecdsa.crt ]; then - /usr/bin/openssl x509 -req -days 999999 -sha256 -in \ - /etc/httpd/server-ecdsa.csr -signkey /etc/httpd/server-ecdsa.key -out \ - /etc/httpd/server-ecdsa.crt - fi - ;; - read) - if [ -f /etc/httpd/server.key -a -f /etc/httpd/server.crt -a -f /etc/httpd/server.csr ]; then - ISSUER=`openssl x509 -in /etc/httpd/server.crt -text -noout | grep Issuer | /usr/bin/cut -f2 -d '='` - HOSTNAME=`/bin/hostname -f` - if [ "$ISSUER" != "$HOSTNAME" ]; then - echo "Certificate issuer '$ISSUER' is not the same as the hostname '$HOSTNAME'" - echo "Probably host or domain name has been changed in setup" - echo "You could remake server certificate with '/usr/local/bin/httpscert new'" - exit 1 - else - echo "https certificate issuer match $HOSTNAME" - fi - else - echo "Certificate not found" - exit 1 - fi - ;; - *) - /bin/echo "Usage: $0 {read|new}" - exit 1 - ;; -esac hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core115, updated. 9064ba72fe03d324478b8c321f4368192e8f551c
by git＠ipfire.org 22 Oct '17

22 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core115 has been updated via 9064ba72fe03d324478b8c321f4368192e8f551c (commit) via 0d6b6a219ff9dc2735f4b4b6213f9936f4a239d7 (commit) from cf361ef4b55134254150b5070069f9d25b201bd1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9064ba72fe03d324478b8c321f4368192e8f551c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Oct 22 15:50:38 2017 +0200 drop httpscert and merge to apache initskript Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/stage2 | 1 - config/rootfiles/common/x86_64/stage2 | 1 - config/rootfiles/core/115/filelists/files | 2 +- config/rootfiles/core/115/update.sh | 8 ++-- src/initscripts/system/apache | 60 +++++++++++++++++++++++++----- src/scripts/httpscert | 61 ------------------------------- 6 files changed, 54 insertions(+), 79 deletions(-) delete mode 100644 src/scripts/httpscert Difference in files: diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2 index 8c6dd40..a5ba6ae 100644 --- a/config/rootfiles/common/stage2 +++ b/config/rootfiles/common/stage2 @@ -91,7 +91,6 @@ usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-ovpn usr/local/bin/hddshutdown -usr/local/bin/httpscert usr/local/bin/makegraphs usr/local/bin/qosd usr/local/bin/readhash diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index 2897adc..70a33d6 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -93,7 +93,6 @@ usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-ovpn usr/local/bin/hddshutdown -usr/local/bin/httpscert usr/local/bin/makegraphs usr/local/bin/qosd usr/local/bin/readhash diff --git a/config/rootfiles/core/115/filelists/files b/config/rootfiles/core/115/filelists/files index 72c5e5f..d3e2958 100644 --- a/config/rootfiles/core/115/filelists/files +++ b/config/rootfiles/core/115/filelists/files @@ -3,6 +3,7 @@ etc/issue etc/httpd/conf/vhosts.d/captive.conf etc/httpd/conf/vhosts.d/ipfire-interface.conf etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf +etc/rc.d/init.d/apache etc/rc.d/init.d/firewall srv/web/ipfire/cgi-bin/captive/index.cgi srv/web/ipfire/cgi-bin/captive/logo.cgi @@ -16,7 +17,6 @@ srv/web/ipfire/html/captive usr/bin/captive-cleanup usr/local/bin/backupiso usr/local/bin/captivectrl -usr/local/bin/httpscert usr/local/bin/wirelessctrl var/ipfire/backup/include var/ipfire/captive diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/core/115/update.sh index 61634a7..91bb808 100644 --- a/config/rootfiles/core/115/update.sh +++ b/config/rootfiles/core/115/update.sh @@ -34,13 +34,14 @@ done # Stop services openvpnctrl -k openvpnctrl -kn2n - +/etc/rc.d/init.d/apache stop # Extract files extract_files # Remove files rm -vf \ + /usr/local/bin/httpscert \ /srv/web/ipfire/html/dial.cgi # update linker config @@ -49,11 +50,8 @@ ldconfig # Update Language cache /usr/local/bin/update-lang-cache -# generate ECDSA key on existing installations to prevent Apache from crashing -/usr/local/bin/httpscert - # Start services -/etc/rc.d/init.d/apache2 restart +/etc/rc.d/init.d/apache2 start openvpnctrl -s openvpnctrl -sn2n diff --git a/src/initscripts/system/apache b/src/initscripts/system/apache index 5dd39f9..541141e 100644 --- a/src/initscripts/system/apache +++ b/src/initscripts/system/apache @@ -7,18 +7,58 @@ . /etc/sysconfig/rc . $rc_functions +generate_certificates() { + if [ ! -f "/etc/httpd/server.key" ]; then + boot_mesg "Generating HTTPS RSA server key (this will take a moment)..." + openssl genrsa -out /etc/httpd/server.key 4096 &>/dev/null + evaluate_retval + fi + + if [ ! -f "/etc/httpd/server-ecdsa.key" ]; then + boot_mesg "Generating HTTPS ECDSA server key..." + openssl ecparam -genkey -name secp384r1 -noout \ + -out /etc/httpd/server-ecdsa.key &>/dev/null + evaluate_retval + fi + + # Generate RSA CSR + if [ ! -f "/etc/httpd/server.csr" ]; then + sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ + openssl req -new -key /etc/httpd/server.key \ + -out /etc/httpd/server.csr &>/dev/null + fi + + # Generate ECDSA CSR + if [ ! -f "/etc/httpd/server-ecdsa.csr" ]; then + sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \ + openssl req -new -key /etc/httpd/server-ecdsa.key \ + -out /etc/httpd/server-ecdsa.csr &>/dev/null + fi + + if [ ! -f "/etc/httpd/server.crt" ]; then + boot_mesg "Signing RSA certificate..." + openssl x509 -req -days 999999 -sha256 \ + -in /etc/httpd/server.csr \ + -signkey /etc/httpd/server.key \ + -out /etc/httpd/server.crt &>/dev/null + evaluate_retval + fi + + if [ ! -f "/etc/httpd/server-ecdsa.crt" ]; then + boot_mesg "Signing ECDSA certificate..." + openssl x509 -req -days 999999 -sha256 \ + -in /etc/httpd/server-ecdsa.csr \ + -signkey /etc/httpd/server-ecdsa.key \ + -out /etc/httpd/server-ecdsa.crt &>/dev/null + evaluate_retval + fi +} + case "$1" in start) - if [ -f /etc/httpd/server.key -a -f /etc/httpd/server.crt -a -f /etc/httpd/server.csr ]; then - /usr/local/bin/httpscert read >/dev/null 2>&1 - else - boot_mesg "Generating HTTPS host certificate (may take a couple of minutes)..." - /usr/local/bin/httpscert new >/dev/null 2>&1 - evaluate_retval - - # Make sure that the key is written to disk. - sync - fi + # Generate all required certificates + generate_certificates + boot_mesg "Starting Apache daemon..." /usr/sbin/apachectl -k start evaluate_retval diff --git a/src/scripts/httpscert b/src/scripts/httpscert deleted file mode 100644 index cae39fb..0000000 --- a/src/scripts/httpscert +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/sh -# -# new : generate new certificate -# read: read issuer in certificate and verify if it is the same as hostname - -# See how we were called. -case "$1" in - new) - if [ ! -f /etc/httpd/server.key ]; then - echo "Generating HTTPS RSA server key." - /usr/bin/openssl genrsa -out /etc/httpd/server.key 4096 - fi - if [ ! -f /etc/httpd/server-ecdsa.key ]; then - echo "Generating HTTPS ECDSA server key." - /usr/bin/openssl ecparam -genkey -name secp384r1 | openssl ec -out /etc/httpd/server-ecdsa.key - fi - - echo "Generating CSRs" - if [ ! -f /etc/httpd/server.csr ]; then - /bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/openssl \ - req -new -key /etc/httpd/server.key -out /etc/httpd/server.csr - fi - if [ ! -f /etc/httpd/server-ecdsa.csr ]; then - /bin/cat /etc/certparams | sed "s/HOSTNAME/`hostname -f`/" | /usr/bin/openssl \ - req -new -key /etc/httpd/server-ecdsa.key -out /etc/httpd/server-ecdsa.csr - fi - - echo "Signing certificates" - if [ ! -f /etc/httpd/server.crt ]; then - /usr/bin/openssl x509 -req -days 999999 -sha256 -in \ - /etc/httpd/server.csr -signkey /etc/httpd/server.key -out \ - /etc/httpd/server.crt - fi - if [ ! -f /etc/httpd/server-ecdsa.crt ]; then - /usr/bin/openssl x509 -req -days 999999 -sha256 -in \ - /etc/httpd/server-ecdsa.csr -signkey /etc/httpd/server-ecdsa.key -out \ - /etc/httpd/server-ecdsa.crt - fi - ;; - read) - if [ -f /etc/httpd/server.key -a -f /etc/httpd/server.crt -a -f /etc/httpd/server.csr ]; then - ISSUER=`openssl x509 -in /etc/httpd/server.crt -text -noout | grep Issuer | /usr/bin/cut -f2 -d '='` - HOSTNAME=`/bin/hostname -f` - if [ "$ISSUER" != "$HOSTNAME" ]; then - echo "Certificate issuer '$ISSUER' is not the same as the hostname '$HOSTNAME'" - echo "Probably host or domain name has been changed in setup" - echo "You could remake server certificate with '/usr/local/bin/httpscert new'" - exit 1 - else - echo "https certificate issuer match $HOSTNAME" - fi - else - echo "Certificate not found" - exit 1 - fi - ;; - *) - /bin/echo "Usage: $0 {read|new}" - exit 1 - ;; -esac hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0d6b6a219ff9dc2735f4b4b6213f9936f4a239d7
by git＠ipfire.org 21 Oct '17

21 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0d6b6a219ff9dc2735f4b4b6213f9936f4a239d7 (commit) from cf361ef4b55134254150b5070069f9d25b201bd1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0d6b6a219ff9dc2735f4b4b6213f9936f4a239d7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sat Oct 21 11:20:02 2017 +0100 core115: Add missing parameter to actually generate new certificates Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/115/update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/config/rootfiles/core/115/update.sh b/config/rootfiles/core/115/update.sh index 61634a7..20f870d 100644 --- a/config/rootfiles/core/115/update.sh +++ b/config/rootfiles/core/115/update.sh @@ -50,7 +50,7 @@ ldconfig /usr/local/bin/update-lang-cache # generate ECDSA key on existing installations to prevent Apache from crashing -/usr/local/bin/httpscert +/usr/local/bin/httpscert new # Start services /etc/rc.d/init.d/apache2 restart hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM October 2017