IPFire-SCM January 2019

ipfire-scm@lists.ipfire.org

1 participants
57 discussions

[git.ipfire.org] IPFire 2.x development tree tag, v2.21-core126, created. 98947f44fc603465178e17c59043cbfb935f157d
by Arne Fitzenreiter 16 Jan '19

16 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The tag, v2.21-core126 has been created at 98947f44fc603465178e17c59043cbfb935f157d (commit) - Log ----------------------------------------------------------------- commit 98947f44fc603465178e17c59043cbfb935f157d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Dec 11 20:43:24 2018 +0000 installer: Intialize part_boot_efi_idx This variable was not initialized on systems where EFI was not in use. Therefore the generated parted command line was not valid and caused the installation to abort. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f0092a6e3e246846caa55458364514064f2c5103
by Michael Tremer 13 Jan '19

13 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f0092a6e3e246846caa55458364514064f2c5103 (commit) via d499e86b168ca1267b6155496cbefa11ec11b916 (commit) via 5cf83d56fa06a2e04e70db4aba4a0fb4195a5157 (commit) from f622fd8ed09d60b627da3589d91b9fc8d6a77393 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f0092a6e3e246846caa55458364514064f2c5103 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 13 12:50:26 2019 +0100 keepalived: Move change of conntrack sysctl option into package The setting cannot be set on the default system because the ip_vs module is not loaded by default and there is no reason to load it just because we would be able to set the setting. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d499e86b168ca1267b6155496cbefa11ec11b916 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 13 12:28:10 2019 +0100 GeoIP: Add accidentially removed paths to database Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5cf83d56fa06a2e04e70db4aba4a0fb4195a5157 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 13 11:53:41 2019 +0100 firewall-lib.pl: Fix incorrect path to geoip-functions.pl Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/geoip-functions.pl | 3 +++ config/etc/sysctl.conf | 3 --- config/firewall/firewall-lib.pl | 2 +- lfs/keepalived | 2 +- src/initscripts/packages/keepalived | 6 ++++++ 5 files changed, 11 insertions(+), 5 deletions(-) Difference in files: diff --git a/config/cfgroot/geoip-functions.pl b/config/cfgroot/geoip-functions.pl index c8ff47d2e..d03503a3f 100644 --- a/config/cfgroot/geoip-functions.pl +++ b/config/cfgroot/geoip-functions.pl @@ -26,6 +26,9 @@ package GeoIP; use Geo::IP::PurePerl; use Locale::Codes::Country; +my $geoip_database_dir = "/var/lib/GeoIP"; +my $location_database = "GeoLite2-Country-Locations-en.csv"; + my $database; sub lookup($) { diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index dd087d2d9..4066af767 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -26,9 +26,6 @@ net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.all.log_martians = 1 -# Enable connection tracking for IPVS -net.ipv4.vs.conntrack = 1 - kernel.printk = 1 4 1 7 vm.swappiness=1 vm.mmap_min_addr = 4096 diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl index c14023e7b..2820eea65 100644 --- a/config/firewall/firewall-lib.pl +++ b/config/firewall/firewall-lib.pl @@ -39,7 +39,7 @@ my %ovpnsettings=(); my %aliases=(); require '/var/ipfire/general-functions.pl'; -require '${General::swroot}/geoip-locations.pl'; +require '/var/ipfire/geoip-functions.pl'; my $confignet = "${General::swroot}/fwhosts/customnetworks"; my $confighost = "${General::swroot}/fwhosts/customhosts"; diff --git a/lfs/keepalived b/lfs/keepalived index 4b4ae2300..8e01e979d 100644 --- a/lfs/keepalived +++ b/lfs/keepalived @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = keepalived -PAK_VER = 4 +PAK_VER = 5 DEPS = "" diff --git a/src/initscripts/packages/keepalived b/src/initscripts/packages/keepalived index baccdc15a..4dda336d5 100644 --- a/src/initscripts/packages/keepalived +++ b/src/initscripts/packages/keepalived @@ -13,6 +13,12 @@ case "${1}" in start) + # Load IPVS module + modprobe ip_vs + + # Enable connection tracking for IPVS + sysctl -w net.ipv4.vs.conntrack=1 &>/dev/null + boot_mesg "Starting keepalive daemon..." loadproc /usr/sbin/keepalived ${KEEPALIVED_OPTIONS} ;; hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f622fd8ed09d60b627da3589d91b9fc8d6a77393
by Arne Fitzenreiter 12 Jan '19

12 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f622fd8ed09d60b627da3589d91b9fc8d6a77393 (commit) from 00f9dcd91d5edbd7ae3acd0d731c0d415079bae5 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f622fd8ed09d60b627da3589d91b9fc8d6a77393 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Jan 12 20:01:00 2019 +0100 linux-initrd: fix build of uInit on aarch64 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/aarch64/linux-initrd | 2 +- lfs/linux-initrd | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) Difference in files: diff --git a/config/rootfiles/common/aarch64/linux-initrd b/config/rootfiles/common/aarch64/linux-initrd index a5a0da72e..8abbf654a 100644 --- a/config/rootfiles/common/aarch64/linux-initrd +++ b/config/rootfiles/common/aarch64/linux-initrd @@ -1,2 +1,2 @@ -#boot/uInit-KVER-ipfire +boot/uInit-KVER-ipfire boot/initramfs-KVER-ipfire.img diff --git a/lfs/linux-initrd b/lfs/linux-initrd index 3f0a80739..f5bd4527b 100644 --- a/lfs/linux-initrd +++ b/lfs/linux-initrd @@ -71,13 +71,13 @@ ifeq "$(KCFG)" "-kirkwood" endif ifeq "$(KCFG)" "-multi" -ifeq "$(BUILD_ARCH)" "aarch64" - cd /boot && mkimage -A arm64 -T ramdisk -C lzma -d initramfs-$(KVER)-$(VERSUFIX).img uInit-$(KVER)-$(VERSUFIX) - # dont remove initramfs because grub need this to boot. -else cd /boot && mkimage -A arm -T ramdisk -C lzma -d initramfs-$(KVER)-$(VERSUFIX).img uInit-$(KVER)-$(VERSUFIX) cd /boot && rm initramfs-$(KVER)-$(VERSUFIX).img endif + +ifeq "$(BUILD_ARCH)" "aarch64" + cd /boot && mkimage -A arm64 -T ramdisk -C lzma -d initramfs-$(KVER)-$(VERSUFIX).img uInit-$(KVER)-$(VERSUFIX) + # dont remove initramfs because grub need this to boot. endif endif hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 00f9dcd91d5edbd7ae3acd0d731c0d415079bae5
by Arne Fitzenreiter 12 Jan '19

12 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 00f9dcd91d5edbd7ae3acd0d731c0d415079bae5 (commit) from f69aca76ea22dfac13f41225545d8c403e5327f7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 00f9dcd91d5edbd7ae3acd0d731c0d415079bae5 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Jan 12 09:04:23 2019 +0100 core127: fix xtables kmod rootfiles for arm32 builds Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: .../127/filelists/{ => aarch64}/xtables-addons-kmod | 0 .../filelists/armv5tel/xtables-addons-kmod-kirkwood | 18 ++++++++++++++++++ .../127/filelists/armv5tel/xtables-addons-kmod-multi | 18 ++++++++++++++++++ .../core/127/filelists/{ => i586}/xtables-addons-kmod | 0 .../127/filelists/{ => x86_64}/xtables-addons-kmod | 0 5 files changed, 36 insertions(+) copy config/rootfiles/core/127/filelists/{ => aarch64}/xtables-addons-kmod (100%) create mode 100644 config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-kirkwood create mode 100644 config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-multi copy config/rootfiles/core/127/filelists/{ => i586}/xtables-addons-kmod (100%) rename config/rootfiles/core/127/filelists/{ => x86_64}/xtables-addons-kmod (100%) Difference in files: diff --git a/config/rootfiles/core/127/filelists/xtables-addons-kmod b/config/rootfiles/core/127/filelists/aarch64/xtables-addons-kmod similarity index 100% rename from config/rootfiles/core/127/filelists/xtables-addons-kmod rename to config/rootfiles/core/127/filelists/aarch64/xtables-addons-kmod diff --git a/config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-kirkwood b/config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-kirkwood new file mode 100644 index 000000000..3effb6443 --- /dev/null +++ b/config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-kirkwood @@ -0,0 +1,18 @@ +lib/modules/KVER-ipfire-kirkwood/extra/compat_xtables.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_CHAOS.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_DELUDE.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_DHCPMAC.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_ECHO.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_IPMARK.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_LOGMARK.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_TARPIT.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_condition.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_fuzzy.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_geoip.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_iface.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_ipp2p.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_ipv4options.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_length2.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_lscan.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_psd.ko +lib/modules/KVER-ipfire-kirkwood/extra/xt_quota2.ko diff --git a/config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-multi b/config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-multi new file mode 100644 index 000000000..a30335d25 --- /dev/null +++ b/config/rootfiles/core/127/filelists/armv5tel/xtables-addons-kmod-multi @@ -0,0 +1,18 @@ +lib/modules/KVER-ipfire-multi/extra/compat_xtables.ko +lib/modules/KVER-ipfire-multi/extra/xt_CHAOS.ko +lib/modules/KVER-ipfire-multi/extra/xt_DELUDE.ko +lib/modules/KVER-ipfire-multi/extra/xt_DHCPMAC.ko +lib/modules/KVER-ipfire-multi/extra/xt_ECHO.ko +lib/modules/KVER-ipfire-multi/extra/xt_IPMARK.ko +lib/modules/KVER-ipfire-multi/extra/xt_LOGMARK.ko +lib/modules/KVER-ipfire-multi/extra/xt_TARPIT.ko +lib/modules/KVER-ipfire-multi/extra/xt_condition.ko +lib/modules/KVER-ipfire-multi/extra/xt_fuzzy.ko +lib/modules/KVER-ipfire-multi/extra/xt_geoip.ko +lib/modules/KVER-ipfire-multi/extra/xt_iface.ko +lib/modules/KVER-ipfire-multi/extra/xt_ipp2p.ko +lib/modules/KVER-ipfire-multi/extra/xt_ipv4options.ko +lib/modules/KVER-ipfire-multi/extra/xt_length2.ko +lib/modules/KVER-ipfire-multi/extra/xt_lscan.ko +lib/modules/KVER-ipfire-multi/extra/xt_psd.ko +lib/modules/KVER-ipfire-multi/extra/xt_quota2.ko diff --git a/config/rootfiles/core/127/filelists/i586/xtables-addons-kmod b/config/rootfiles/core/127/filelists/i586/xtables-addons-kmod new file mode 100644 index 000000000..154a5b70f --- /dev/null +++ b/config/rootfiles/core/127/filelists/i586/xtables-addons-kmod @@ -0,0 +1,18 @@ +lib/modules/KVER-ipfire/extra/compat_xtables.ko +lib/modules/KVER-ipfire/extra/xt_CHAOS.ko +lib/modules/KVER-ipfire/extra/xt_DELUDE.ko +lib/modules/KVER-ipfire/extra/xt_DHCPMAC.ko +lib/modules/KVER-ipfire/extra/xt_ECHO.ko +lib/modules/KVER-ipfire/extra/xt_IPMARK.ko +lib/modules/KVER-ipfire/extra/xt_LOGMARK.ko +lib/modules/KVER-ipfire/extra/xt_TARPIT.ko +lib/modules/KVER-ipfire/extra/xt_condition.ko +lib/modules/KVER-ipfire/extra/xt_fuzzy.ko +lib/modules/KVER-ipfire/extra/xt_geoip.ko +lib/modules/KVER-ipfire/extra/xt_iface.ko +lib/modules/KVER-ipfire/extra/xt_ipp2p.ko +lib/modules/KVER-ipfire/extra/xt_ipv4options.ko +lib/modules/KVER-ipfire/extra/xt_length2.ko +lib/modules/KVER-ipfire/extra/xt_lscan.ko +lib/modules/KVER-ipfire/extra/xt_psd.ko +lib/modules/KVER-ipfire/extra/xt_quota2.ko diff --git a/config/rootfiles/core/127/filelists/x86_64/xtables-addons-kmod b/config/rootfiles/core/127/filelists/x86_64/xtables-addons-kmod new file mode 100644 index 000000000..154a5b70f --- /dev/null +++ b/config/rootfiles/core/127/filelists/x86_64/xtables-addons-kmod @@ -0,0 +1,18 @@ +lib/modules/KVER-ipfire/extra/compat_xtables.ko +lib/modules/KVER-ipfire/extra/xt_CHAOS.ko +lib/modules/KVER-ipfire/extra/xt_DELUDE.ko +lib/modules/KVER-ipfire/extra/xt_DHCPMAC.ko +lib/modules/KVER-ipfire/extra/xt_ECHO.ko +lib/modules/KVER-ipfire/extra/xt_IPMARK.ko +lib/modules/KVER-ipfire/extra/xt_LOGMARK.ko +lib/modules/KVER-ipfire/extra/xt_TARPIT.ko +lib/modules/KVER-ipfire/extra/xt_condition.ko +lib/modules/KVER-ipfire/extra/xt_fuzzy.ko +lib/modules/KVER-ipfire/extra/xt_geoip.ko +lib/modules/KVER-ipfire/extra/xt_iface.ko +lib/modules/KVER-ipfire/extra/xt_ipp2p.ko +lib/modules/KVER-ipfire/extra/xt_ipv4options.ko +lib/modules/KVER-ipfire/extra/xt_length2.ko +lib/modules/KVER-ipfire/extra/xt_lscan.ko +lib/modules/KVER-ipfire/extra/xt_psd.ko +lib/modules/KVER-ipfire/extra/xt_quota2.ko hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f69aca76ea22dfac13f41225545d8c403e5327f7
by Michael Tremer 11 Jan '19

11 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f69aca76ea22dfac13f41225545d8c403e5327f7 (commit) from 0ca3baedfc623a968c7e38c356352b4f64c9f695 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f69aca76ea22dfac13f41225545d8c403e5327f7 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Fri Jan 11 14:41:57 2019 +0100 xtables 3.2: Fix for rootfile Found during the test builds... Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/xtables-addons | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/config/rootfiles/common/xtables-addons b/config/rootfiles/common/xtables-addons index 9e0739528..cb958ee7e 100644 --- a/config/rootfiles/common/xtables-addons +++ b/config/rootfiles/common/xtables-addons @@ -2,7 +2,6 @@ lib/xtables/libxt_ACCOUNT.so lib/xtables/libxt_CHAOS.so lib/xtables/libxt_DELUDE.so lib/xtables/libxt_DHCPMAC.so -#lib/xtables/libxt_DNETMAP.so lib/xtables/libxt_ECHO.so lib/xtables/libxt_IPMARK.so lib/xtables/libxt_LOGMARK.so @@ -26,6 +25,7 @@ usr/lib/libxt_ACCOUNT_cl.so.0.0.0 #usr/libexec/xtables-addons usr/libexec/xtables-addons/xt_geoip_build usr/libexec/xtables-addons/xt_geoip_dl +usr/local/bin/xt_geoip_build usr/sbin/iptaccount #usr/share/man/man1/xt_geoip_build.1 #usr/share/man/man1/xt_geoip_dl.1 hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0ca3baedfc623a968c7e38c356352b4f64c9f695
by Michael Tremer 11 Jan '19

11 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0ca3baedfc623a968c7e38c356352b4f64c9f695 (commit) via f107bb39c53266cd7b2f70c8875dbc07221aeeab (commit) via 035f6c75aed2165a8ecd92571c48daf07edf4ab5 (commit) from 01db691a1ebd569afdc0d9304a67b4e048708b84 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0ca3baedfc623a968c7e38c356352b4f64c9f695 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Jan 11 10:05:24 2019 +0100 Revert "geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address." Enhanching the code to fix the lookup will rapidely slow down the lookup speed. Because using the GeoIP2 module is no option ( the reasons have been described in the commit message which will now reverted), we have decided to temporary switch back to the old module until a nice solution has been found. This reverts commit ff21ff90d24de0f648d24bb906c45738b81ce67a. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f107bb39c53266cd7b2f70c8875dbc07221aeeab Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Jan 11 10:05:23 2019 +0100 Revert "GeoIP: Drop legacy GeoIP perl module." This reverts commit 9d1708e081d7e7ba490db3620509dcce29cb0ae8. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 035f6c75aed2165a8ecd92571c48daf07edf4ab5 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Fri Jan 11 01:32:37 2019 +0100 xtables-addons: Fix typo in lfs Just some typos... Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/geoip-functions.pl | 75 ++++----------------------------------- config/rootfiles/common/GeoIP | 12 +++++++ lfs/{Archive-Zip => GeoIP} | 18 ++++++---- lfs/xtables-addons | 2 +- make.sh | 1 + 5 files changed, 32 insertions(+), 76 deletions(-) create mode 100644 config/rootfiles/common/GeoIP copy lfs/{Archive-Zip => GeoIP} (84%) Difference in files: diff --git a/config/cfgroot/geoip-functions.pl b/config/cfgroot/geoip-functions.pl index 9f86a09ba..c8ff47d2e 100644 --- a/config/cfgroot/geoip-functions.pl +++ b/config/cfgroot/geoip-functions.pl @@ -23,82 +23,21 @@ package GeoIP; -require '/var/ipfire/network-functions.pl'; - +use Geo::IP::PurePerl; use Locale::Codes::Country; -# Path where all the GeoIP related databases are stored. -my $geoip_database_dir = "/var/lib/GeoIP"; - -# Database which contains all IPv4 networks. -my $address_ipv4_database = "GeoLite2-Country-Blocks-IPv4.csv"; - -# Database wich contains the locations data. -my $location_database = "GeoLite2-Country-Locations-en.csv"; +my $database; sub lookup($) { my $address = shift; - my $location_id; - my $country_code; - - # Check if the given address is valid. - unless(&Network::check_ip_address($address)) { - return; - } - - # Open the address database. - open(ADDRESS, "$geoip_database_dir/$address_ipv4_database") or die "Could not open $geoip_database_dir/$address_ipv4_database. $!\n"; - - # Loop through the file. - while(my $line = <ADDRESS>) { - # Remove newlines. - chomp($line); - - # Split the line content. - my ($network, $geoname_id, $registered_country_geoname_id, $represented_country_geoname_id, $is_anonymous_proxy, $is_satellite_provider) = split(/\,/, $line); - # Check if the given address is part of the current processed network. - if (&Network::ip_address_in_network($address, $network)) { - # Store the geoname_id for this address. - $location_id = $geoname_id; - - # Break loop. - last; - } + # Load the database into memory if not already done + if (!$database) { + $database = Geo::IP::PurePerl->new(GEOIP_MEMORY_CACHE); } - # Return nothing if no location_id could be found. - return unless($location_id); - - # Close filehandle. - close(ADDRESS); - - # Open the location database. - open(LOCATION, "$geoip_database_dir/$location_database") or die "Could not open $geoip_database_dir/$location_database. $!\n"; - - # Loop through the file. - while(my $line = <LOCATION>) { - # Remove newlines. - chomp($line); - - # Split the line content. - my ($geoname_id, $locale_code, $continent_code, $continent_name, $country_iso_code, $country_name, $is_in_european_union) = split(/\,/, $line); - - # Check if the correct location_id has been found. - if ($geoname_id eq $location_id) { - # Store the county code. - $country_code = $country_iso_code; - - # Break loop. - last; - } - } - - # Close filehandle. - close(LOCATION); - - # Return the obtained country code. - return $country_code; + # Return the name of the country + return $database->country_code_by_name($address); } # Function to get the flag icon for a specified country code. diff --git a/config/rootfiles/common/GeoIP b/config/rootfiles/common/GeoIP new file mode 100644 index 000000000..d76ba645e --- /dev/null +++ b/config/rootfiles/common/GeoIP @@ -0,0 +1,12 @@ +#usr/bin/geoip-lookup +#usr/lib/perl5/site_perl/5.12.3/Geo +#usr/lib/perl5/site_perl/5.12.3/Geo/IP +usr/lib/perl5/site_perl/5.12.3/Geo/IP/PurePerl.pm +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP/PurePerl +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP/PurePerl/.packlist +#usr/share/GeoIP +usr/share/GeoIP/GeoIP.dat +#usr/share/man/man1/geoip-lookup.1 +#usr/share/man/man3/Geo::IP::PurePerl.3 diff --git a/lfs/GeoIP b/lfs/GeoIP new file mode 100644 index 000000000..ce758d8a5 --- /dev/null +++ b/lfs/GeoIP @@ -0,0 +1,84 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.25 +DATVER = 30062018 + +THISAPP = Geo-IP-PurePerl-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) GeoIP.dat-$(DATVER).gz + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) +GeoIP.dat-$(DATVER).gz = $(DL_FROM)/GeoIP.dat-$(DATVER).gz + +$(DL_FILE)_MD5 = a47a1b71f7cd7c46cca9efcc448e0726 +GeoIP.dat-$(DATVER).gz_MD5 = d538e57ad9268fdc7955c6cf9a37c4a9 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/geoip_1_25_change_database_path.patch + cd $(DIR_APP) && perl Makefile.PL + cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) + cd $(DIR_APP) && make install + cd $(DIR_APP) && mkdir -p /usr/share/GeoIP && \ + zcat $(DIR_DL)/GeoIP.dat-$(DATVER).gz > /usr/share/GeoIP/GeoIP.dat + cd $(DIR_APP) && chmod 777 /srv/web/ipfire/html/images/flags + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/lfs/xtables-addons b/lfs/xtables-addons index da67aa761..260820955 100644 --- a/lfs/xtables-addons +++ b/lfs/xtables-addons @@ -96,7 +96,7 @@ ifeq "$(USPACE)" "1" cd $(DIR_APP) && make install # Install xt_geoip_build. - cd $(DIR_APP) && install -m 755 GeoIP/xt_geoip_build \ + cd $(DIR_APP) && install -m 755 geoip/xt_geoip_build \ /usr/local/bin/ else cd $(DIR_APP) && ./configure \ diff --git a/make.sh b/make.sh index 1d9163dce..601f1675b 100755 --- a/make.sh +++ b/make.sh @@ -1305,6 +1305,7 @@ buildipfire() { lfsmake2 python-daemon lfsmake2 python-ipaddress lfsmake2 glib + lfsmake2 GeoIP lfsmake2 ntp lfsmake2 openssh lfsmake2 fontconfig hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 01db691a1ebd569afdc0d9304a67b4e048708b84
by Michael Tremer 10 Jan '19

10 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 01db691a1ebd569afdc0d9304a67b4e048708b84 (commit) via 06fd3467d1fce5aa56dd255a686c2e46090e2edf (commit) from a04ec923897debb91c72b4c6223586ca0f1c7486 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 01db691a1ebd569afdc0d9304a67b4e048708b84 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Jan 10 22:48:25 2019 +0000 Bump kernel version to ship a new PAE kernel Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 06fd3467d1fce5aa56dd255a686c2e46090e2edf Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Jan 10 22:46:31 2019 +0000 core127: Ship updated kernel modules for xtables Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: .../rootfiles/core/127/filelists/xtables-addons-kmod | 18 ++++++++++++++++++ config/rootfiles/core/127/update.sh | 3 +++ lfs/linux | 2 +- 3 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 config/rootfiles/core/127/filelists/xtables-addons-kmod Difference in files: diff --git a/config/rootfiles/core/127/filelists/xtables-addons-kmod b/config/rootfiles/core/127/filelists/xtables-addons-kmod new file mode 100644 index 000000000..154a5b70f --- /dev/null +++ b/config/rootfiles/core/127/filelists/xtables-addons-kmod @@ -0,0 +1,18 @@ +lib/modules/KVER-ipfire/extra/compat_xtables.ko +lib/modules/KVER-ipfire/extra/xt_CHAOS.ko +lib/modules/KVER-ipfire/extra/xt_DELUDE.ko +lib/modules/KVER-ipfire/extra/xt_DHCPMAC.ko +lib/modules/KVER-ipfire/extra/xt_ECHO.ko +lib/modules/KVER-ipfire/extra/xt_IPMARK.ko +lib/modules/KVER-ipfire/extra/xt_LOGMARK.ko +lib/modules/KVER-ipfire/extra/xt_TARPIT.ko +lib/modules/KVER-ipfire/extra/xt_condition.ko +lib/modules/KVER-ipfire/extra/xt_fuzzy.ko +lib/modules/KVER-ipfire/extra/xt_geoip.ko +lib/modules/KVER-ipfire/extra/xt_iface.ko +lib/modules/KVER-ipfire/extra/xt_ipp2p.ko +lib/modules/KVER-ipfire/extra/xt_ipv4options.ko +lib/modules/KVER-ipfire/extra/xt_length2.ko +lib/modules/KVER-ipfire/extra/xt_lscan.ko +lib/modules/KVER-ipfire/extra/xt_psd.ko +lib/modules/KVER-ipfire/extra/xt_quota2.ko diff --git a/config/rootfiles/core/127/update.sh b/config/rootfiles/core/127/update.sh index 1b4ce2918..4fe045ec9 100644 --- a/config/rootfiles/core/127/update.sh +++ b/config/rootfiles/core/127/update.sh @@ -55,6 +55,9 @@ sudo -u nobody /srv/web/ipfire/cgi-bin/proxy.cgi # Reload sysctl.conf sysctl -p +# Re-run depmod +depmod -a + # Finish /etc/init.d/fireinfo start sendprofile diff --git a/lfs/linux b/lfs/linux index 645ebb9e1..7aac547f9 100644 --- a/lfs/linux +++ b/lfs/linux @@ -34,7 +34,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) CFLAGS = CXXFLAGS = -PAK_VER = 79 +PAK_VER = 80 DEPS = "" HEADERS_ARCH = $(BUILD_PLATFORM) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a04ec923897debb91c72b4c6223586ca0f1c7486
by Michael Tremer 10 Jan '19

10 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a04ec923897debb91c72b4c6223586ca0f1c7486 (commit) via 8ff42d82c4ab2d5743b1fdcd076249c7b2e51794 (commit) via 30c59cbb0b370a0fd1470087a94d91b35d4e54a3 (commit) from e3429b4aad01ad011792d00570a3190d0058e7ff (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a04ec923897debb91c72b4c6223586ca0f1c7486 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Jan 10 22:43:45 2019 +0000 core127: Ship updated firewall functions library Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 8ff42d82c4ab2d5743b1fdcd076249c7b2e51794 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 20:40:04 2019 +0100 firewall-lib.pl: Use get_geoip_locations from geoip-functions.pl Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 30c59cbb0b370a0fd1470087a94d91b35d4e54a3 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 20:40:03 2019 +0100 geoip-locations.pl: Add get_geoip_locations(). This function is used to get all available GeoIP locations. The functions returns them as array, sorted in alphabetical order. Reference #11959 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/geoip-functions.pl | 33 +++++++++++++++++++++++++++++++ config/firewall/firewall-lib.pl | 32 ++---------------------------- config/rootfiles/core/127/filelists/files | 1 + 3 files changed, 36 insertions(+), 30 deletions(-) Difference in files: diff --git a/config/cfgroot/geoip-functions.pl b/config/cfgroot/geoip-functions.pl index e8ce8377f..9f86a09ba 100644 --- a/config/cfgroot/geoip-functions.pl +++ b/config/cfgroot/geoip-functions.pl @@ -178,4 +178,37 @@ sub get_full_country_name($) { return $name; } +# Function to get all available GeoIP locations. +sub get_geoip_locations() { + my @locations; + + # Open the location database. + open(LOCATION, "$geoip_database_dir/$location_database") or die "Could not open $geoip_database_dir/$location_database. $!\n"; + + # Loop through the file. + while(my $line = <LOCATION>) { + # Remove newlines. + chomp($line); + + # Split the line content. + my ($geoname_id, $locale_code, $continent_code, $continent_name, $country_iso_code, $country_name, $is_in_european_union) = split(/\,/, $line); + + # Check if the country_iso_code is upper case. + if($country_iso_code =~ /[A-Z]/) { + # Add the current ISO code. + push(@locations, $country_iso_code); + } + } + + # Close filehandle. + close(LOCATION); + + # Sort locations array in alphabetical order. + my @sorted_locations = sort(@locations); + + # Return the array.. + return @sorted_locations; +} + + 1; diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl index 9b7f55c9d..c14023e7b 100644 --- a/config/firewall/firewall-lib.pl +++ b/config/firewall/firewall-lib.pl @@ -39,6 +39,7 @@ my %ovpnsettings=(); my %aliases=(); require '/var/ipfire/general-functions.pl'; +require '${General::swroot}/geoip-locations.pl'; my $confignet = "${General::swroot}/fwhosts/customnetworks"; my $confighost = "${General::swroot}/fwhosts/customhosts"; @@ -591,36 +592,7 @@ sub get_internal_firewall_ip_address } sub get_geoip_locations() { - # Path to the directory which contains the binary geoip - # databases. - my $directory="/usr/share/xt_geoip/LE"; - - # Array to store the final country list. - my @country_codes = (); - - # Open location and do a directory listing. - opendir(DIR, "$directory"); - my @locations = readdir(DIR); - closedir(DIR); - - # Loop through the directory listing, and cut of the file extensions. - foreach my $location (sort @locations) { - # skip . and .. - next if($location =~ /^\.$/); - next if($location =~ /^\.\.$/); - - # Remove whitespaces. - chomp($location); - - # Cut-off file extension. - my ($country_code, $extension) = split(/\./, $location); - - # Add country code to array. - push(@country_codes, $country_code); - } - - # Return final array. - return @country_codes; + return &GeoIP::get_geoip_locations(); } return 1; diff --git a/config/rootfiles/core/127/filelists/files b/config/rootfiles/core/127/filelists/files index 6126e32e1..4b001af63 100644 --- a/config/rootfiles/core/127/filelists/files +++ b/config/rootfiles/core/127/filelists/files @@ -15,5 +15,6 @@ srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi +usr/lib/firewall/firewall-lib.pl var/ipfire/backup/include var/ipfire/geoip-functions.pl hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. e3429b4aad01ad011792d00570a3190d0058e7ff
by Michael Tremer 10 Jan '19

10 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via e3429b4aad01ad011792d00570a3190d0058e7ff (commit) via 11de35622f930cdf9cd64a786a832076ee251672 (commit) via 042a5fe60a51277d3d1c717c207858dce1d28ff1 (commit) via d381c56dc82e10ce01e68bb24b197dce0fa10580 (commit) via ff21ff90d24de0f648d24bb906c45738b81ce67a (commit) via 9d1708e081d7e7ba490db3620509dcce29cb0ae8 (commit) via b76a8a008dca77f8ea9b68c95b2d04e074dfef64 (commit) via a77870146fcf1e4575a9a0e59a85a10674599e91 (commit) via 9f6849b3adfcc8eb91549427f531bdeb89f6d750 (commit) via 4ed2162324a40bc19faf9e3cf698b8f03d256434 (commit) via 045d54c324ac17edc9074b14c5a1a3187b78c2c3 (commit) via 985741db6140464fe2f74ab76bc94223862eb6ce (commit) via af2cc3be64d82d35978590b316a46b5b206afa0d (commit) from 5321fcbff33f69e98f87bd0a354bab53e2a830bf (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e3429b4aad01ad011792d00570a3190d0058e7ff Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Thu Jan 10 15:30:49 2019 +0100 clamav: Update to 0.101.1 For details see: https://blog.clamav.net/2019/01/clamav-01011-patch-has-been-released.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 11de35622f930cdf9cd64a786a832076ee251672 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Jan 7 01:32:46 2019 +0000 core127: Ship updated tar Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 042a5fe60a51277d3d1c717c207858dce1d28ff1 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Thu Jan 10 14:29:22 2019 +0100 tar: Update to 1.31, including fix for bug #11958 For details see: http://savannah.gnu.org/forum/forum.php?forum_id=9344 "- Fix heap-buffer-overrun with --one-top-level. - Support for zstd compression. - The -K option interacts properly with member names given in the command line. - Fix CVE-2018-20482" This patch was reverted because 'tar 1.31' crashed when installing PakFire packages with the option '--no-overwrite-dir'. See: https://bugzilla.ipfire.org/show_bug.cgi?id=11958 Included is now a patch from https://savannah.gnu.org/bugs/?55413, which seems to fix this issue. The test cases given in https://savannah.gnu.org/bugs/?55413#comment1 ran without problems. As always, please check and confirm. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d381c56dc82e10ce01e68bb24b197dce0fa10580 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Jan 7 01:28:38 2019 +0000 core127: Ship updated GeoIP functions Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ff21ff90d24de0f648d24bb906c45738b81ce67a Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 13:00:17 2019 +0100 geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address. Drop the usage of the old legacy GeoIP perl module which was not able to handle the new GeoLite2 databases. Write some code to directly access the databases and extract the required data. Usage of the GeoIP2 perl module would provide a lot of more functionality which is not used/needed. Unfortunately ir requires at lot of additional perl modules which are not available on IPFire and would only be build and shipped for this module. Buildig all of them will slow down the entire build process, mess up the system and requires a lot more space on disk. Fixes #11962. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 9d1708e081d7e7ba490db3620509dcce29cb0ae8 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 13:00:16 2019 +0100 GeoIP: Drop legacy GeoIP perl module. The legacy GeoIP perl module cannot handle the new GeoLite2 databases provided from maxmind and therefore needs to be dropped. Reference #11960 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b76a8a008dca77f8ea9b68c95b2d04e074dfef64 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 13:00:15 2019 +0100 xt_geoip_update: Adjust script to download and use the GeoLite2 database Fixes #11961. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a77870146fcf1e4575a9a0e59a85a10674599e91 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 13:00:14 2019 +0100 xtables-addons: Use shipped xt_geoip_build Use the shipped xt_geoip_build directly instead of holding a copy in our GIT. Reference #11959 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 9f6849b3adfcc8eb91549427f531bdeb89f6d750 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 13:00:13 2019 +0100 xtables-addons: Update to 3.2 Reference #11959 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4ed2162324a40bc19faf9e3cf698b8f03d256434 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Jan 7 00:34:30 2019 +0000 perl-Net-CIDR-Lite: Make rootfile work on other arches Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 045d54c324ac17edc9074b14c5a1a3187b78c2c3 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Jan 7 00:31:46 2019 +0000 perl-Net-CIDR-Lite: Fix whitespace Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 985741db6140464fe2f74ab76bc94223862eb6ce Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 10 13:00:12 2019 +0100 perl-Net-CIDR-Lite: New package. This is a runtime dependency of the xt_geoip_build perl script shipped by xtables-addons in version 3.2. Reference #11960. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit af2cc3be64d82d35978590b316a46b5b206afa0d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 6 21:33:43 2019 +0000 IPVS: Enable connection tracking by default Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/geoip-functions.pl | 75 ++++++++++++++++-- config/etc/sysctl.conf | 3 + config/rootfiles/common/GeoIP | 12 --- .../common/{HTML-Tagset => perl-Net-CIDR-Lite} | 12 +-- config/rootfiles/core/127/filelists/files | 2 + .../core/127/filelists/perl-Net-CIDR-Lite | 1 + .../{oldcore/121 => core/127}/filelists/tar | 0 .../121 => core/127}/filelists/xtables-addons | 0 config/rootfiles/core/127/update.sh | 3 + config/rootfiles/packages/clamav | 7 +- lfs/GeoIP | 84 -------------------- lfs/clamav | 6 +- lfs/{perl-Sort-Naturally => perl-Net-CIDR-Lite} | 12 +-- lfs/tar | 7 +- lfs/xtables-addons | 8 +- make.sh | 2 +- src/patches/tar/01_extract.c.patch | 12 +++ src/scripts/xt_geoip_build | 89 ---------------------- src/scripts/xt_geoip_update | 63 +++++++-------- 19 files changed, 148 insertions(+), 250 deletions(-) delete mode 100644 config/rootfiles/common/GeoIP copy config/rootfiles/common/{HTML-Tagset => perl-Net-CIDR-Lite} (52%) create mode 120000 config/rootfiles/core/127/filelists/perl-Net-CIDR-Lite copy config/rootfiles/{oldcore/121 => core/127}/filelists/tar (100%) copy config/rootfiles/{oldcore/121 => core/127}/filelists/xtables-addons (100%) delete mode 100644 lfs/GeoIP copy lfs/{perl-Sort-Naturally => perl-Net-CIDR-Lite} (95%) create mode 100644 src/patches/tar/01_extract.c.patch delete mode 100644 src/scripts/xt_geoip_build Difference in files: diff --git a/config/cfgroot/geoip-functions.pl b/config/cfgroot/geoip-functions.pl index be50d5e14..e8ce8377f 100644 --- a/config/cfgroot/geoip-functions.pl +++ b/config/cfgroot/geoip-functions.pl @@ -23,21 +23,82 @@ package GeoIP; -use Geo::IP::PurePerl; +require '/var/ipfire/network-functions.pl'; + use Locale::Codes::Country; -my $database; +# Path where all the GeoIP related databases are stored. +my $geoip_database_dir = "/var/lib/GeoIP"; + +# Database which contains all IPv4 networks. +my $address_ipv4_database = "GeoLite2-Country-Blocks-IPv4.csv"; + +# Database wich contains the locations data. +my $location_database = "GeoLite2-Country-Locations-en.csv"; sub lookup($) { my $address = shift; + my $location_id; + my $country_code; + + # Check if the given address is valid. + unless(&Network::check_ip_address($address)) { + return; + } + + # Open the address database. + open(ADDRESS, "$geoip_database_dir/$address_ipv4_database") or die "Could not open $geoip_database_dir/$address_ipv4_database. $!\n"; + + # Loop through the file. + while(my $line = <ADDRESS>) { + # Remove newlines. + chomp($line); + + # Split the line content. + my ($network, $geoname_id, $registered_country_geoname_id, $represented_country_geoname_id, $is_anonymous_proxy, $is_satellite_provider) = split(/\,/, $line); + + # Check if the given address is part of the current processed network. + if (&Network::ip_address_in_network($address, $network)) { + # Store the geoname_id for this address. + $location_id = $geoname_id; + + # Break loop. + last; + } + } + + # Return nothing if no location_id could be found. + return unless($location_id); + + # Close filehandle. + close(ADDRESS); + + # Open the location database. + open(LOCATION, "$geoip_database_dir/$location_database") or die "Could not open $geoip_database_dir/$location_database. $!\n"; - # Load the database into memory if not already done - if (!$database) { - $database = Geo::IP::PurePerl->new(GEOIP_MEMORY_CACHE); + # Loop through the file. + while(my $line = <LOCATION>) { + # Remove newlines. + chomp($line); + + # Split the line content. + my ($geoname_id, $locale_code, $continent_code, $continent_name, $country_iso_code, $country_name, $is_in_european_union) = split(/\,/, $line); + + # Check if the correct location_id has been found. + if ($geoname_id eq $location_id) { + # Store the county code. + $country_code = $country_iso_code; + + # Break loop. + last; + } } - # Return the name of the country - return $database->country_code_by_name($address); + # Close filehandle. + close(LOCATION); + + # Return the obtained country code. + return $country_code; } # Function to get the flag icon for a specified country code. diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 4066af767..dd087d2d9 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -26,6 +26,9 @@ net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.all.log_martians = 1 +# Enable connection tracking for IPVS +net.ipv4.vs.conntrack = 1 + kernel.printk = 1 4 1 7 vm.swappiness=1 vm.mmap_min_addr = 4096 diff --git a/config/rootfiles/common/GeoIP b/config/rootfiles/common/GeoIP deleted file mode 100644 index d76ba645e..000000000 --- a/config/rootfiles/common/GeoIP +++ /dev/null @@ -1,12 +0,0 @@ -#usr/bin/geoip-lookup -#usr/lib/perl5/site_perl/5.12.3/Geo -#usr/lib/perl5/site_perl/5.12.3/Geo/IP -usr/lib/perl5/site_perl/5.12.3/Geo/IP/PurePerl.pm -#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo -#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP -#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP/PurePerl -#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Geo/IP/PurePerl/.packlist -#usr/share/GeoIP -usr/share/GeoIP/GeoIP.dat -#usr/share/man/man1/geoip-lookup.1 -#usr/share/man/man3/Geo::IP::PurePerl.3 diff --git a/config/rootfiles/common/perl-Net-CIDR-Lite b/config/rootfiles/common/perl-Net-CIDR-Lite new file mode 100644 index 000000000..691a7693f --- /dev/null +++ b/config/rootfiles/common/perl-Net-CIDR-Lite @@ -0,0 +1,6 @@ +#usr/lib/perl5/site_perl/5.12.3/Net/CIDR +usr/lib/perl5/site_perl/5.12.3/Net/CIDR/Lite.pm +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Net/CIDR +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Net/CIDR/Lite +#usr/lib/perl5/site_perl/5.12.3/MACHINE-linux-thread-multi/auto/Net/CIDR/Lite/.packlist +#usr/share/man/man3/Net::CIDR::Lite.3 diff --git a/config/rootfiles/core/127/filelists/files b/config/rootfiles/core/127/filelists/files index d3de58f52..6126e32e1 100644 --- a/config/rootfiles/core/127/filelists/files +++ b/config/rootfiles/core/127/filelists/files @@ -9,9 +9,11 @@ etc/rc.d/init.d/unbound etc/rc.d/rc0.d/K77conntrackd etc/rc.d/rc3.d/S22conntrackd etc/rc.d/rc6.d/K77conntrackd +etc/sysctl.conf srv/web/ipfire/cgi-bin/dnsforward.cgi srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi var/ipfire/backup/include +var/ipfire/geoip-functions.pl diff --git a/config/rootfiles/core/127/filelists/perl-Net-CIDR-Lite b/config/rootfiles/core/127/filelists/perl-Net-CIDR-Lite new file mode 120000 index 000000000..a51cf8773 --- /dev/null +++ b/config/rootfiles/core/127/filelists/perl-Net-CIDR-Lite @@ -0,0 +1 @@ +../../../common/perl-Net-CIDR-Lite \ No newline at end of file diff --git a/config/rootfiles/core/127/filelists/tar b/config/rootfiles/core/127/filelists/tar new file mode 120000 index 000000000..3e585d2eb --- /dev/null +++ b/config/rootfiles/core/127/filelists/tar @@ -0,0 +1 @@ +../../../common/tar \ No newline at end of file diff --git a/config/rootfiles/core/127/filelists/xtables-addons b/config/rootfiles/core/127/filelists/xtables-addons new file mode 120000 index 000000000..2e24c4298 --- /dev/null +++ b/config/rootfiles/core/127/filelists/xtables-addons @@ -0,0 +1 @@ +../../../common/xtables-addons \ No newline at end of file diff --git a/config/rootfiles/core/127/update.sh b/config/rootfiles/core/127/update.sh index a8a206eab..1b4ce2918 100644 --- a/config/rootfiles/core/127/update.sh +++ b/config/rootfiles/core/127/update.sh @@ -52,6 +52,9 @@ sudo -u nobody /srv/web/ipfire/cgi-bin/proxy.cgi /etc/init.d/unbound restart /etc/init.d/squid start +# Reload sysctl.conf +sysctl -p + # Finish /etc/init.d/fireinfo start sendprofile diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index 3f35f9b17..e95d4dc6e 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -8,11 +8,12 @@ usr/bin/clamscan usr/bin/clamsubmit usr/bin/freshclam usr/bin/sigtool +#usr/include/clamav-types.h #usr/include/clamav.h #usr/lib/libclamav.la usr/lib/libclamav.so usr/lib/libclamav.so.9 -usr/lib/libclamav.so.9.0.0 +usr/lib/libclamav.so.9.0.1 #usr/lib/libclammspack.la usr/lib/libclammspack.so usr/lib/libclammspack.so.0 @@ -20,11 +21,11 @@ usr/lib/libclammspack.so.0.1.0 #usr/lib/libclamunrar.la usr/lib/libclamunrar.so usr/lib/libclamunrar.so.9 -usr/lib/libclamunrar.so.9.0.0 +usr/lib/libclamunrar.so.9.0.1 #usr/lib/libclamunrar_iface.la usr/lib/libclamunrar_iface.so usr/lib/libclamunrar_iface.so.9 -usr/lib/libclamunrar_iface.so.9.0.0 +usr/lib/libclamunrar_iface.so.9.0.1 #usr/lib/pkgconfig/libclamav.pc usr/sbin/clamd #usr/share/man/man1/clambc.1 diff --git a/lfs/clamav b/lfs/clamav index 20ff9ddf3..a6e44ebf2 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.101.0 +VER = 0.101.1 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 42 +PAK_VER = 43 DEPS = "" @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 47c36d13ac814b9e29ed6f5fc1691373 +$(DL_FILE)_MD5 = 9c137d6172f6e132e08e61fe25b636f8 install : $(TARGET) diff --git a/lfs/GeoIP b/lfs/perl-Net-CIDR-Lite similarity index 83% rename from lfs/GeoIP rename to lfs/perl-Net-CIDR-Lite index ce758d8a5..a3c20b42b 100644 --- a/lfs/GeoIP +++ b/lfs/perl-Net-CIDR-Lite @@ -24,11 +24,10 @@ include Config -VER = 1.25 -DATVER = 30062018 +VER = 0.21 -THISAPP = Geo-IP-PurePerl-$(VER) -DL_FILE = $(THISAPP).tar.gz +THISAPP = Net-CIDR-Lite-$(VER) +DL_FILE = ${THISAPP}.tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -37,13 +36,11 @@ TARGET = $(DIR_INFO)/$(THISAPP) # Top-level Rules ############################################################################### -objects = $(DL_FILE) GeoIP.dat-$(DATVER).gz +objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -GeoIP.dat-$(DATVER).gz = $(DL_FROM)/GeoIP.dat-$(DATVER).gz -$(DL_FILE)_MD5 = a47a1b71f7cd7c46cca9efcc448e0726 -GeoIP.dat-$(DATVER).gz_MD5 = d538e57ad9268fdc7955c6cf9a37c4a9 +$(DL_FILE)_MD5 = 12280b3754886b876918f03f53aee4f5 install : $(TARGET) @@ -53,6 +50,9 @@ download :$(patsubst %,$(DIR_DL)/%,$(objects)) md5 : $(subst %,%_MD5,$(objects)) +dist: + @$(PAK) + ############################################################################### # Downloading, checking, md5sum ############################################################################### @@ -73,12 +73,8 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/geoip_1_25_change_database_path.patch cd $(DIR_APP) && perl Makefile.PL cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP) && make install - cd $(DIR_APP) && mkdir -p /usr/share/GeoIP && \ - zcat $(DIR_DL)/GeoIP.dat-$(DATVER).gz > /usr/share/GeoIP/GeoIP.dat - cd $(DIR_APP) && chmod 777 /srv/web/ipfire/html/images/flags @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/lfs/tar b/lfs/tar index cbab6c2a9..953613d51 100644 --- a/lfs/tar +++ b/lfs/tar @@ -24,7 +24,7 @@ include Config -VER = 1.30 +VER = 1.31 THISAPP = tar-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8404e4c1fc5a3000228ab2b8ad674a65 +$(DL_FILE)_MD5 = 77afa35b696c8d760331fa0e12c2fac9 install : $(TARGET) @@ -80,6 +80,9 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) + + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/tar/01_extract.c.patch + cd $(DIR_APP) && ./configure $(EXTRA_CONFIG) FORCE_UNSAFE_CONFIGURE=1 cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/lfs/xtables-addons b/lfs/xtables-addons index af2784c1a..da67aa761 100644 --- a/lfs/xtables-addons +++ b/lfs/xtables-addons @@ -27,7 +27,7 @@ include Config VERSUFIX = ipfire$(KCFG) MODPATH = /lib/modules/$(KVER)-$(VERSUFIX)/extra/ -VER = 2.13 +VER = 3.2 THISAPP = xtables-addons-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = be20b0b9c4b001b364431a836e361d33 +$(DL_FILE)_MD5 = 80ea89ba8d5a001a8d71c7f05b2f0141 install : $(TARGET) @@ -94,6 +94,10 @@ ifeq "$(USPACE)" "1" cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install + + # Install xt_geoip_build. + cd $(DIR_APP) && install -m 755 GeoIP/xt_geoip_build \ + /usr/local/bin/ else cd $(DIR_APP) && ./configure \ --with-kbuild=/usr/src/linux-$(KVER)/ diff --git a/make.sh b/make.sh index fd626a999..1d9163dce 100755 --- a/make.sh +++ b/make.sh @@ -1305,7 +1305,6 @@ buildipfire() { lfsmake2 python-daemon lfsmake2 python-ipaddress lfsmake2 glib - lfsmake2 GeoIP lfsmake2 ntp lfsmake2 openssh lfsmake2 fontconfig @@ -1434,6 +1433,7 @@ buildipfire() { lfsmake2 mpd lfsmake2 libmpdclient lfsmake2 mpc + lfsmake2 perl-Net-CIDR-Lite lfsmake2 perl-Net-SMTP-SSL lfsmake2 perl-MIME-Base64 lfsmake2 perl-Authen-SASL diff --git a/src/patches/tar/01_extract.c.patch b/src/patches/tar/01_extract.c.patch new file mode 100644 index 000000000..21c3cd86f --- /dev/null +++ b/src/patches/tar/01_extract.c.patch @@ -0,0 +1,12 @@ +--- tar-1.31/src/extract.c 2019-01-02 18:07:48.000000000 +0000 ++++ tar-1.31.patched/src/extract.c 2019-01-09 16:17:20.368612005 +0000 +@@ -782,7 +782,8 @@ + case OVERWRITE_OLD_FILES: + if (0 < remove_any_file (file_name, ORDINARY_REMOVE_OPTION)) + return RECOVER_OK; +- break; ++ errno = e; ++ return RECOVER_NO; + + case UNLINK_FIRST_OLD_FILES: + break; diff --git a/src/scripts/xt_geoip_build b/src/scripts/xt_geoip_build deleted file mode 100644 index 202156f13..000000000 --- a/src/scripts/xt_geoip_build +++ /dev/null @@ -1,89 +0,0 @@ -#!/usr/bin/perl -# -# Converter for MaxMind CSV database to binary, for xt_geoip -# Copyright © Jan Engelhardt, 2008-2011 -# -use Getopt::Long; -use IO::Handle; -use Text::CSV_XS; # or trade for Text::CSV -use strict; - -my $csv = Text::CSV_XS->new({ - allow_whitespace => 1, - binary => 1, - eol => $/, -}); # or Text::CSV -my $target_dir = "."; - -&Getopt::Long::Configure(qw(bundling)); -&GetOptions( - "D=s" => \$target_dir, -); - -if (!-d $target_dir) { - print STDERR "Target directory $target_dir does not exist.\n"; - exit 1; -} - -my $dir = "$target_dir/LE"; -if (!-e $dir && !mkdir($dir)) { - print STDERR "Could not mkdir $dir: $!\n"; - exit 1; -} - -&dump(&collect()); - -sub collect -{ - my %country; - - while (my $row = $csv->getline(*ARGV)) { - if (!defined($country{$row->[4]})) { - $country{$row->[4]} = { - name => $row->[5], - pool_v4 => [], - pool_v6 => [], - }; - } - my $c = $country{$row->[4]}; - - push(@{$c->{pool_v4}}, [$row->[2], $row->[3]]); - - if ($. % 4096 == 0) { - print STDERR "\r\e[2K$. entries"; - } - } - - print STDERR "\r\e[2K$. entries total\n"; - return \%country; -} - -sub dump -{ - my $country = shift @_; - - foreach my $iso_code (sort keys %$country) { - &dump_one($iso_code, $country->{$iso_code}); - } -} - -sub dump_one -{ - my($iso_code, $country) = @_; - my($file, $fh_le, $fh_be); - - printf "%5u IPv4 ranges for %s %s\n", - scalar(@{$country->{pool_v4}}), - $iso_code, $country->{name}; - - $file = "$target_dir/LE/".uc($iso_code).".iv4"; - if (!open($fh_le, "> $file")) { - print STDERR "Error opening $file: $!\n"; - exit 1; - } - foreach my $range (@{$country->{pool_v4}}) { - print $fh_le pack("VV", $range->[0], $range->[1]); - #print $fh_be pack("NN", $range->[0], $range->[1]); - } - close $fh_le; -} diff --git a/src/scripts/xt_geoip_update b/src/scripts/xt_geoip_update index 0aea4d03e..73484c7a0 100644 --- a/src/scripts/xt_geoip_update +++ b/src/scripts/xt_geoip_update @@ -24,13 +24,10 @@ TMP_FILE=$(mktemp -p $TMP_PATH) SCRIPT_PATH=/usr/local/bin DEST_PATH=/usr/share/xt_geoip +DB_PATH=/var/lib/GeoIP -DL_URL=https://geolite.maxmind.com/download/geoip/database -DL_FILE=GeoIPCountryCSV.zip - -CSV_FILE=GeoIPCountryWhois.csv - -ARCH=LE +DL_URL=http://geolite.maxmind.com/download/geoip/database/ +DL_FILE=GeoLite2-Country-CSV.zip eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings) @@ -57,42 +54,41 @@ function download() { # Get the latest GeoIP database from server. wget $DL_URL/$DL_FILE $PROXYSETTINGS -O $TMP_FILE - # Extract files. + # Extract files to database path. unzip $TMP_FILE -d $TMP_PATH return 0 } -function build() { - echo "Convert database..." +function install() { + echo "Install CSV database..." - # Check if the csv file exists. - if [ ! -e $TMP_PATH/$CSV_FILE ]; then - echo "$TMP_PATH/$CSV_FILE not found. Exiting." - return 1 + # Check if the database dir exists. + if [ ! -e "$DB_PATH" ]; then + mkdir -p $DB_PATH &>/dev/null fi - # Run script to convert the CSV file into several xtables - # compatible binary files. - if ! $SCRIPT_PATH/xt_geoip_build $TMP_PATH/$CSV_FILE -D $TMP_PATH; then - echo "Could not convert ruleset. Aborting." >&2 + # Check if the directory for binary databases exists. + if [ ! -e "$DEST_PATH" ]; then + mkdir -p $DEST_PATH &>/dev/null + fi + + # Install CSV databases. + if ! cp -af $TMP_PATH/*/* $DB_PATH &>/dev/null; then + echo "Could not copy files. Aborting." >&2 return 1 fi return 0 } -function install() { - echo "Install databases..." - - # Check if our destination exist. - if [ ! -e "$DEST_PATH" ]; then - mkdir -p $DEST_PATH &>/dev/null - fi +function build() { + echo "Convert database..." - # Install databases. - if ! cp -af $TMP_PATH/$ARCH $DEST_PATH &>/dev/null; then - echo "Could not copy files. Aborting." >&2 + # Run script to convert the CSV file into several xtables + # compatible binary files. + if ! $SCRIPT_PATH/xt_geoip_build -S $DB_PATH -D $DEST_PATH; then + echo "Could not convert ruleset. Aborting." >&2 return 1 fi @@ -113,23 +109,18 @@ function main() { # Download ruleset. download || exit $? - # Convert the ruleset. - if ! build; then - # Do cleanup. - cleanup || exit $? - exit 1 - fi - - # Install the converted ruleset. if ! install; then # Do cleanup. cleanup || exit $? exit 1 fi - # Finaly remove temporary files. + # Remove temporary files. cleanup || exit $? + # Convert the ruleset. + build || exit $? + return 0 } hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5321fcbff33f69e98f87bd0a354bab53e2a830bf
by Michael Tremer 08 Jan '19

08 Jan '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 5321fcbff33f69e98f87bd0a354bab53e2a830bf (commit) via 7d5caee6bdbb44b688b579f9b1836bd5a3d0d619 (commit) via ae5b9c5ad5fafbb42e2d7f8201f4cbcc995bfcc4 (commit) via e26a5c488556579d1bd639b50adbc31da450e70c (commit) from e0c4ed1783d665d6f341d00e506395c507198807 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5321fcbff33f69e98f87bd0a354bab53e2a830bf Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 6 09:00:47 2019 +0000 Backup conntrackd's configuration file Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 7d5caee6bdbb44b688b579f9b1836bd5a3d0d619 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 6 08:59:25 2019 +0000 Add initscript for conntrackd The daemon will be started by default when a configuration file exists. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ae5b9c5ad5fafbb42e2d7f8201f4cbcc995bfcc4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Sun Jan 6 07:03:08 2019 +0000 Update translations Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e26a5c488556579d1bd639b50adbc31da450e70c Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Tue Jan 8 14:14:41 2019 +0100 Fix typo in 'html/cgi-bin/logs.cgi/log.dat' Translation string uses capital letter: 'Captive' => 'Captive Portal', Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/backup/include | 1 + config/rootfiles/common/aarch64/initscripts | 4 +++ config/rootfiles/common/armv5tel/initscripts | 4 +++ config/rootfiles/common/i586/initscripts | 4 +++ config/rootfiles/common/x86_64/initscripts | 4 +++ config/rootfiles/core/127/filelists/files | 5 ++++ doc/language_issues.de | 1 - doc/language_issues.en | 1 - doc/language_issues.es | 1 - doc/language_issues.fr | 1 - doc/language_issues.it | 1 - doc/language_issues.nl | 1 - doc/language_issues.pl | 1 - doc/language_issues.ru | 1 - doc/language_issues.tr | 1 - html/cgi-bin/logs.cgi/log.dat | 2 +- lfs/initscripts | 3 ++ src/initscripts/system/conntrackd | 41 ++++++++++++++++++++++++++++ 18 files changed, 67 insertions(+), 10 deletions(-) create mode 100755 src/initscripts/system/conntrackd Difference in files: diff --git a/config/backup/include b/config/backup/include index 75bd85807..6c7affa20 100644 --- a/config/backup/include +++ b/config/backup/include @@ -1,3 +1,4 @@ +/etc/conntrackd/conntrackd.conf /etc/group /etc/hosts* /etc/httpd/server.crt diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts index 18adeea21..367a0a725 100644 --- a/config/rootfiles/common/aarch64/initscripts +++ b/config/rootfiles/common/aarch64/initscripts @@ -12,6 +12,7 @@ etc/rc.d/init.d/checkfs etc/rc.d/init.d/cleanfs etc/rc.d/init.d/collectd etc/rc.d/init.d/connectd +etc/rc.d/init.d/conntrackd etc/rc.d/init.d/console etc/rc.d/init.d/dhcp etc/rc.d/init.d/dhcrelay @@ -103,6 +104,7 @@ etc/rc.d/rc0.d/K45random etc/rc.d/rc0.d/K47setclock etc/rc.d/rc0.d/K49cyrus-sasl etc/rc.d/rc0.d/K51vnstat +etc/rc.d/rc0.d/K77conntrackd etc/rc.d/rc0.d/K78snort etc/rc.d/rc0.d/K79leds etc/rc.d/rc0.d/K79unbound @@ -131,6 +133,7 @@ etc/rc.d/rc3.d/S19smartenabler etc/rc.d/rc3.d/S19wlanclient etc/rc.d/rc3.d/S20network etc/rc.d/rc3.d/S21leds +etc/rc.d/rc3.d/S22conntrackd etc/rc.d/rc3.d/S24cyrus-sasl etc/rc.d/rc3.d/S30sshd etc/rc.d/rc3.d/S32apache @@ -154,6 +157,7 @@ etc/rc.d/rc6.d/K45random etc/rc.d/rc6.d/K47setclock etc/rc.d/rc6.d/K49cyrus-sasl etc/rc.d/rc6.d/K51vnstat +etc/rc.d/rc6.d/K77conntrackd etc/rc.d/rc6.d/K78snort etc/rc.d/rc6.d/K79leds etc/rc.d/rc6.d/K79unbound diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts index 18adeea21..367a0a725 100644 --- a/config/rootfiles/common/armv5tel/initscripts +++ b/config/rootfiles/common/armv5tel/initscripts @@ -12,6 +12,7 @@ etc/rc.d/init.d/checkfs etc/rc.d/init.d/cleanfs etc/rc.d/init.d/collectd etc/rc.d/init.d/connectd +etc/rc.d/init.d/conntrackd etc/rc.d/init.d/console etc/rc.d/init.d/dhcp etc/rc.d/init.d/dhcrelay @@ -103,6 +104,7 @@ etc/rc.d/rc0.d/K45random etc/rc.d/rc0.d/K47setclock etc/rc.d/rc0.d/K49cyrus-sasl etc/rc.d/rc0.d/K51vnstat +etc/rc.d/rc0.d/K77conntrackd etc/rc.d/rc0.d/K78snort etc/rc.d/rc0.d/K79leds etc/rc.d/rc0.d/K79unbound @@ -131,6 +133,7 @@ etc/rc.d/rc3.d/S19smartenabler etc/rc.d/rc3.d/S19wlanclient etc/rc.d/rc3.d/S20network etc/rc.d/rc3.d/S21leds +etc/rc.d/rc3.d/S22conntrackd etc/rc.d/rc3.d/S24cyrus-sasl etc/rc.d/rc3.d/S30sshd etc/rc.d/rc3.d/S32apache @@ -154,6 +157,7 @@ etc/rc.d/rc6.d/K45random etc/rc.d/rc6.d/K47setclock etc/rc.d/rc6.d/K49cyrus-sasl etc/rc.d/rc6.d/K51vnstat +etc/rc.d/rc6.d/K77conntrackd etc/rc.d/rc6.d/K78snort etc/rc.d/rc6.d/K79leds etc/rc.d/rc6.d/K79unbound diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts index 7b2c1c5f4..6f9868ec3 100644 --- a/config/rootfiles/common/i586/initscripts +++ b/config/rootfiles/common/i586/initscripts @@ -12,6 +12,7 @@ etc/rc.d/init.d/checkfs etc/rc.d/init.d/cleanfs etc/rc.d/init.d/collectd etc/rc.d/init.d/connectd +etc/rc.d/init.d/conntrackd etc/rc.d/init.d/console etc/rc.d/init.d/dhcp etc/rc.d/init.d/dhcrelay @@ -102,6 +103,7 @@ etc/rc.d/rc0.d/K45random etc/rc.d/rc0.d/K47setclock etc/rc.d/rc0.d/K49cyrus-sasl etc/rc.d/rc0.d/K51vnstat +etc/rc.d/rc0.d/K77conntrackd etc/rc.d/rc0.d/K78snort etc/rc.d/rc0.d/K79leds etc/rc.d/rc0.d/K79unbound @@ -130,6 +132,7 @@ etc/rc.d/rc3.d/S19wlanclient etc/rc.d/rc3.d/S20network etc/rc.d/rc3.d/S11unbound etc/rc.d/rc3.d/S21leds +etc/rc.d/rc3.d/S22conntrackd etc/rc.d/rc3.d/S24cyrus-sasl etc/rc.d/rc3.d/S30sshd etc/rc.d/rc3.d/S32apache @@ -153,6 +156,7 @@ etc/rc.d/rc6.d/K45random etc/rc.d/rc6.d/K47setclock etc/rc.d/rc6.d/K49cyrus-sasl etc/rc.d/rc6.d/K51vnstat +etc/rc.d/rc6.d/K77conntrackd etc/rc.d/rc6.d/K78snort etc/rc.d/rc6.d/K79leds etc/rc.d/rc6.d/K79unbound diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index 7b2c1c5f4..6f9868ec3 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -12,6 +12,7 @@ etc/rc.d/init.d/checkfs etc/rc.d/init.d/cleanfs etc/rc.d/init.d/collectd etc/rc.d/init.d/connectd +etc/rc.d/init.d/conntrackd etc/rc.d/init.d/console etc/rc.d/init.d/dhcp etc/rc.d/init.d/dhcrelay @@ -102,6 +103,7 @@ etc/rc.d/rc0.d/K45random etc/rc.d/rc0.d/K47setclock etc/rc.d/rc0.d/K49cyrus-sasl etc/rc.d/rc0.d/K51vnstat +etc/rc.d/rc0.d/K77conntrackd etc/rc.d/rc0.d/K78snort etc/rc.d/rc0.d/K79leds etc/rc.d/rc0.d/K79unbound @@ -130,6 +132,7 @@ etc/rc.d/rc3.d/S19wlanclient etc/rc.d/rc3.d/S20network etc/rc.d/rc3.d/S11unbound etc/rc.d/rc3.d/S21leds +etc/rc.d/rc3.d/S22conntrackd etc/rc.d/rc3.d/S24cyrus-sasl etc/rc.d/rc3.d/S30sshd etc/rc.d/rc3.d/S32apache @@ -153,6 +156,7 @@ etc/rc.d/rc6.d/K45random etc/rc.d/rc6.d/K47setclock etc/rc.d/rc6.d/K49cyrus-sasl etc/rc.d/rc6.d/K51vnstat +etc/rc.d/rc6.d/K77conntrackd etc/rc.d/rc6.d/K78snort etc/rc.d/rc6.d/K79leds etc/rc.d/rc6.d/K79unbound diff --git a/config/rootfiles/core/127/filelists/files b/config/rootfiles/core/127/filelists/files index cb705e3c1..d3de58f52 100644 --- a/config/rootfiles/core/127/filelists/files +++ b/config/rootfiles/core/127/filelists/files @@ -4,9 +4,14 @@ etc/modprobe.d/framebuffer.conf srv/web/ipfire/cgi-bin/credits.cgi var/ipfire/langs etc/rc.d/init.d/aws +etc/rc.d/init.d/conntrackd etc/rc.d/init.d/unbound +etc/rc.d/rc0.d/K77conntrackd +etc/rc.d/rc3.d/S22conntrackd +etc/rc.d/rc6.d/K77conntrackd srv/web/ipfire/cgi-bin/dnsforward.cgi srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi +var/ipfire/backup/include diff --git a/doc/language_issues.de b/doc/language_issues.de index f8b84c651..c5dad0168 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -732,7 +732,6 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: Scan for Songs = unknown string WARNING: untranslated string: addons = Addons WARNING: untranslated string: bytes = unknown string -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: community rules = Snort/VRT GPLv2 Community Rules WARNING: untranslated string: dead peer detection = Dead Peer Detection WARNING: untranslated string: emerging rules = Emergingthreats.net Community Rules diff --git a/doc/language_issues.en b/doc/language_issues.en index 6dcf03929..3e16e2180 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -404,7 +404,6 @@ WARNING: untranslated string: capsclosed = DISCONNECTED WARNING: untranslated string: capsopen = CONNECTED WARNING: untranslated string: capswarning = WARNING WARNING: untranslated string: caption = Caption -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: ccd add = Add network WARNING: untranslated string: ccd choose net = Choose network WARNING: untranslated string: ccd client options = Advanced client options diff --git a/doc/language_issues.es b/doc/language_issues.es index 6485fccbc..236248d55 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -715,7 +715,6 @@ WARNING: untranslated string: bit = bit WARNING: untranslated string: block = Block WARNING: untranslated string: bytes = unknown string WARNING: untranslated string: capabilities = Capabilities -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: ccd add = Add network WARNING: untranslated string: ccd choose net = Choose network WARNING: untranslated string: ccd client options = Advanced client options diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 06f5a0f55..e2f20eb5c 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -770,7 +770,6 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: Captive clients = unknown string WARNING: untranslated string: Scan for Songs = unknown string WARNING: untranslated string: bytes = unknown string -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: dnsforward forward_servers = Nameservers WARNING: untranslated string: fwhost cust geoipgrp = unknown string WARNING: untranslated string: fwhost err hostip = unknown string diff --git a/doc/language_issues.it b/doc/language_issues.it index ba746410a..5500eedc9 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -786,7 +786,6 @@ WARNING: untranslated string: advproxy group required = Required group WARNING: untranslated string: application layer gateways = Application Layer Gateways WARNING: untranslated string: block = Block WARNING: untranslated string: bytes = unknown string -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: check all = Check all WARNING: untranslated string: crypto error = Cryptographic error WARNING: untranslated string: crypto warning = Cryptographic warning diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 883c6ba02..64778ffd7 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -783,7 +783,6 @@ WARNING: untranslated string: atm device = Device: WARNING: untranslated string: block = Block WARNING: untranslated string: bytes = unknown string WARNING: untranslated string: capabilities = Capabilities -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: check all = Check all WARNING: untranslated string: crypto error = Cryptographic error WARNING: untranslated string: crypto warning = Cryptographic warning diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 6485fccbc..236248d55 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -715,7 +715,6 @@ WARNING: untranslated string: bit = bit WARNING: untranslated string: block = Block WARNING: untranslated string: bytes = unknown string WARNING: untranslated string: capabilities = Capabilities -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: ccd add = Add network WARNING: untranslated string: ccd choose net = Choose network WARNING: untranslated string: ccd client options = Advanced client options diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 88ba126a1..810b16f50 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -717,7 +717,6 @@ WARNING: untranslated string: bit = bit WARNING: untranslated string: block = Block WARNING: untranslated string: bytes = unknown string WARNING: untranslated string: capabilities = Capabilities -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: ccd add = Add network WARNING: untranslated string: ccd choose net = Choose network WARNING: untranslated string: ccd client options = Advanced client options diff --git a/doc/language_issues.tr b/doc/language_issues.tr index f4aca5b7e..140658346 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -770,7 +770,6 @@ WARNING: translation string unused: yearly firewallhits WARNING: untranslated string: Captive clients = unknown string WARNING: untranslated string: Scan for Songs = unknown string WARNING: untranslated string: bytes = unknown string -WARNING: untranslated string: captive = unknown string WARNING: untranslated string: crypto error = Cryptographic error WARNING: untranslated string: crypto warning = Cryptographic warning WARNING: untranslated string: dnsforward forward_servers = Nameservers diff --git a/html/cgi-bin/logs.cgi/log.dat b/html/cgi-bin/logs.cgi/log.dat index f241365a1..153ffb5f0 100644 --- a/html/cgi-bin/logs.cgi/log.dat +++ b/html/cgi-bin/logs.cgi/log.dat @@ -78,7 +78,7 @@ my %sections = ( my %trsections = ( 'auth' => "$Lang::tr{'loginlogout'}", 'wio' => 'Who Is Online?', - 'captive' => $Lang::tr{'captive'}, + 'captive' => $Lang::tr{'Captive'}, 'clamav' => 'ClamAV', 'collectd' => 'Collectd', 'cron' => 'Cron', diff --git a/lfs/initscripts b/lfs/initscripts index bdab03dfe..c053b7115 100644 --- a/lfs/initscripts +++ b/lfs/initscripts @@ -155,6 +155,9 @@ $(TARGET) : ln -sf ../init.d/leds /etc/rc.d/rc3.d/S21leds ln -sf ../init.d/leds /etc/rc.d/rc6.d/K79leds ln -sf ../init.d/fireinfo /etc/rc.d/rc3.d/S15fireinfo + ln -sf ../init.d/conntrackd /etc/rc.d/rc0.d/K77conntrackd + ln -sf ../init.d/conntrackd /etc/rc.d/rc3.d/S22conntrackd + ln -sf ../init.d/conntrackd /etc/rc.d/rc6.d/K77conntrackd ln -sf ../init.d/mountkernfs /etc/rc.d/rcsysinit.d/S00mountkernfs ln -sf ../init.d/sysctl /etc/rc.d/rcsysinit.d/S01sysctl ln -sf ../init.d/modules /etc/rc.d/rcsysinit.d/S05modules diff --git a/src/initscripts/system/conntrackd b/src/initscripts/system/conntrackd new file mode 100755 index 000000000..2e7a2678b --- /dev/null +++ b/src/initscripts/system/conntrackd @@ -0,0 +1,41 @@ +#!/bin/sh +######################################################################## +# Begin $rc_base/init.d/conntrackd +######################################################################## + +. /etc/sysconfig/rc +. ${rc_functions} + +case "${1}" in + start) + # Don't attempt to launch the daemon when we have no configuration + if [ ! -s "/etc/conntrackd/conntrackd.conf" ]; then + exit 0 + fi + + boot_mesg "Starting Connection Tracking Daemon..." + loadproc /usr/sbin/conntrackd -d + ;; + + stop) + boot_mesg "Stopping Connection Tracking Daemon..." + killproc /usr/sbin/conntrackd + ;; + + restart) + ${0} stop + sleep 1 + ${0} start + ;; + + status) + statusproc /usr/sbin/conntrackd + ;; + + *) + echo "Usage: ${0} {start|stop|restart|status}" + exit 1 + ;; +esac + +# End $rc_base/init.d/conntrackd hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM January 2019