IPFire-SCM April 2019

ipfire-scm@lists.ipfire.org

1 participants
62 discussions

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 6fc3f2e685d42d9c6261ca281740ce067ab6e00d
by Arne Fitzenreiter 09 Apr '19

09 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 6fc3f2e685d42d9c6261ca281740ce067ab6e00d (commit) via e7dafc3e3eb7be7e685fe0e7b3999fd6f264c80b (commit) via f0ce8b2c8853041cd708a0cef88b1bd22cbf88df (commit) via d66433fca6323940ac217d7a0834a0b178d509eb (commit) via 49ce16f9bea9f1812be5cb41ef7b390556fc2364 (commit) via 8d76eb20852a695b15e6fd32076128a25fad01d1 (commit) via bfd5cfa9c6949eca6319a774b871007c9da8fd0e (commit) via a485606c27781a5439d38fcde662a786cb5671d9 (commit) from 4fc1a0045b48b1a459256d146030279c9905a13e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6fc3f2e685d42d9c6261ca281740ce067ab6e00d Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 9 07:31:23 2019 +0200 core130: insert a core update for urgent fixes. the bigger changes for suricata and kernel need longer time for test so we insert a core with smaller but important fixes. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit e7dafc3e3eb7be7e685fe0e7b3999fd6f264c80b Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 9 07:30:26 2019 +0200 core130: ship strongswan Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit f0ce8b2c8853041cd708a0cef88b1bd22cbf88df Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 11:56:58 2019 +0100 core130: Ship perl-Net-SSLeay This was still using the old version of OpenSSL. Instead of linking the module (which we should have found earlier) the module uses dlopen :( Fixes: #12044 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d66433fca6323940ac217d7a0834a0b178d509eb Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 16:41:24 2019 +0100 strongswan: Manually install all routes for non-routed VPNs This is a regression from disabling charon.install_routes. VPNs are routing fine as long as traffic is passing through the firewall. Traps are not propertly used as long as these routes are not present and therefore we won't trigger any tunnels when traffic originates from the firewall. Fixes: #12045 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 49ce16f9bea9f1812be5cb41ef7b390556fc2364 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Apr 4 02:07:16 2019 +0100 core130: Ship updated wget Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 8d76eb20852a695b15e6fd32076128a25fad01d1 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Thu Apr 4 09:43:50 2019 +0200 wget: Update to 1.20.2 For details see: https://fossies.org/linux/wget/ChangeLog Excerpt from "NEWS": * Changes in Wget 1.20.2 ** NTLM authentication will retry under certain cases ** Fixed a buffer overflow vulnerability" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit bfd5cfa9c6949eca6319a774b871007c9da8fd0e Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Mar 27 20:54:10 2019 +0100 clamav: Update to 0.101.2 For details see: https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html "ClamAV 0.101.2 is a patch release to address a handful of security related bugs." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a485606c27781a5439d38fcde662a786cb5671d9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Mar 18 15:24:56 2019 +0000 ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/{129 => 130}/exclude | 0 .../{oldcore/120 => core/130}/filelists/Net_SSLeay | 0 config/rootfiles/core/130/filelists/files | 3 + .../core/{129 => 130}/filelists/strongswan | 0 .../{oldcore/104 => core/130}/filelists/wget | 0 config/rootfiles/core/{129 => 130}/update.sh | 2 +- config/rootfiles/packages/clamav | 6 +- lfs/clamav | 8 +- lfs/strongswan | 1 + lfs/wget | 6 +- make.sh | 4 +- src/patches/strongswan-ipfire-revert.patch | 113 +++++++++++++++++++++ src/scripts/ipsec-interfaces | 100 ++++++++++++++++++ 13 files changed, 230 insertions(+), 13 deletions(-) copy config/rootfiles/core/{129 => 130}/exclude (100%) copy config/rootfiles/{oldcore/120 => core/130}/filelists/Net_SSLeay (100%) create mode 100644 config/rootfiles/core/130/filelists/files copy config/rootfiles/core/{129 => 130}/filelists/strongswan (100%) copy config/rootfiles/{oldcore/104 => core/130}/filelists/wget (100%) copy config/rootfiles/core/{129 => 130}/update.sh (99%) create mode 100644 src/patches/strongswan-ipfire-revert.patch Difference in files: diff --git a/config/rootfiles/core/130/exclude b/config/rootfiles/core/130/exclude new file mode 100644 index 000000000..b22159878 --- /dev/null +++ b/config/rootfiles/core/130/exclude @@ -0,0 +1,28 @@ +boot/config.txt +boot/grub/grub.cfg +boot/grub/grubenv +etc/alternatives +etc/collectd.custom +etc/default/grub +etc/ipsec.conf +etc/ipsec.secrets +etc/ipsec.user.conf +etc/ipsec.user.secrets +etc/localtime +etc/shadow +etc/snort/snort.conf +etc/ssl/openssl.cnf +etc/sudoers +etc/sysconfig/firewall.local +etc/sysconfig/rc.local +etc/udev/rules.d/30-persistent-network.rules +srv/web/ipfire/html/proxy.pac +var/ipfire/dma +var/ipfire/time +var/ipfire/ovpn +var/lib/alternatives +var/log/cache +var/log/dhcpcd.log +var/log/messages +var/state/dhcp/dhcpd.leases +var/updatecache diff --git a/config/rootfiles/core/130/filelists/Net_SSLeay b/config/rootfiles/core/130/filelists/Net_SSLeay new file mode 120000 index 000000000..13fe0560c --- /dev/null +++ b/config/rootfiles/core/130/filelists/Net_SSLeay @@ -0,0 +1 @@ +../../../common/Net_SSLeay \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/files b/config/rootfiles/core/130/filelists/files new file mode 100644 index 000000000..98b8fec39 --- /dev/null +++ b/config/rootfiles/core/130/filelists/files @@ -0,0 +1,3 @@ +etc/system-release +etc/issue +usr/local/bin/ipsec-interfaces diff --git a/config/rootfiles/core/130/filelists/strongswan b/config/rootfiles/core/130/filelists/strongswan new file mode 120000 index 000000000..90c727e26 --- /dev/null +++ b/config/rootfiles/core/130/filelists/strongswan @@ -0,0 +1 @@ +../../../common/strongswan \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/wget b/config/rootfiles/core/130/filelists/wget new file mode 120000 index 000000000..fcb57dfec --- /dev/null +++ b/config/rootfiles/core/130/filelists/wget @@ -0,0 +1 @@ +../../../common/wget \ No newline at end of file diff --git a/config/rootfiles/core/130/update.sh b/config/rootfiles/core/130/update.sh new file mode 100644 index 000000000..f072e8052 --- /dev/null +++ b/config/rootfiles/core/130/update.sh @@ -0,0 +1,77 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 3 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2019 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +/usr/local/bin/backupctrl exclude >/dev/null 2>&1 + +core=130 + +# Remove old core updates from pakfire cache to save space... +for (( i=1; i<=$core; i++ )); do + rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire +done + +# Stop services +/etc/init.d/squid stop +/usr/local/bin/openvpnctrl -k +/usr/local/bin/openvpnctrl -kn2n +/usr/local/bin/ipsecctrl D +/etc/init.d/unbound stop + +# Remove files +rm -vf \ + /usr/lib/firewall/ipsec-block + +# Extract files +extract_files + +# update linker config +ldconfig + +# Update Language cache +/usr/local/bin/update-lang-cache + +# Start services +/etc/init.d/firewall restart +/etc/init.d/unbound start +/usr/local/bin/ipsecctrl S +/usr/local/bin/openvpnctrl -s +/usr/local/bin/openvpnctrl -sn2n +/etc/init.d/squid start + +# This update needs a reboot... +#touch /var/run/need_reboot + +# Finish +/etc/init.d/fireinfo start +sendprofile + +# Update grub config to display new core version +if [ -e /boot/grub/grub.cfg ]; then + grub-mkconfig -o /boot/grub/grub.cfg +fi + +sync + +# Don't report the exitcode last command +exit 0 diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index e95d4dc6e..9d6d68647 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -13,7 +13,7 @@ usr/bin/sigtool #usr/lib/libclamav.la usr/lib/libclamav.so usr/lib/libclamav.so.9 -usr/lib/libclamav.so.9.0.1 +usr/lib/libclamav.so.9.0.2 #usr/lib/libclammspack.la usr/lib/libclammspack.so usr/lib/libclammspack.so.0 @@ -21,11 +21,11 @@ usr/lib/libclammspack.so.0.1.0 #usr/lib/libclamunrar.la usr/lib/libclamunrar.so usr/lib/libclamunrar.so.9 -usr/lib/libclamunrar.so.9.0.1 +usr/lib/libclamunrar.so.9.0.2 #usr/lib/libclamunrar_iface.la usr/lib/libclamunrar_iface.so usr/lib/libclamunrar_iface.so.9 -usr/lib/libclamunrar_iface.so.9.0.1 +usr/lib/libclamunrar_iface.so.9.0.2 #usr/lib/pkgconfig/libclamav.pc usr/sbin/clamd #usr/share/man/man1/clambc.1 diff --git a/lfs/clamav b/lfs/clamav index a6e44ebf2..640691408 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.101.1 +VER = 0.101.2 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 43 +PAK_VER = 44 DEPS = "" @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 9c137d6172f6e132e08e61fe25b636f8 +$(DL_FILE)_MD5 = faeb0e286e76c2a26e2e10845e4b68db install : $(TARGET) diff --git a/lfs/strongswan b/lfs/strongswan index 4174f78fe..714537e36 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -73,6 +73,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-disable-ipv6.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire-interfaces.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire-revert.patch cd $(DIR_APP) && ./configure \ --prefix="/usr" \ diff --git a/lfs/wget b/lfs/wget index b8c83d10d..ac2fa826c 100644 --- a/lfs/wget +++ b/lfs/wget @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.20.1 +VER = 1.20.2 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f6ebe9c7b375fc9832fb1b2028271fb7 +$(DL_FILE)_MD5 = 2692f6678e93601441306b5c1fc6a77a install : $(TARGET) diff --git a/make.sh b/make.sh index 3453c6719..08cf31901 100755 --- a/make.sh +++ b/make.sh @@ -25,8 +25,8 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name VERSION="2.21" # Version number -CORE="129" # Core Level (Filename) -PAKFIRE_CORE="129" # Core Level (PAKFIRE) +CORE="130" # Core Level (Filename) +PAKFIRE_CORE="130" # Core Level (PAKFIRE) GIT_BRANCH=`git rev-parse --abbrev-ref HEAD` # Git Branch SLOGAN="www.ipfire.org" # Software slogan CONFIG_ROOT=/var/ipfire # Configuration rootdir diff --git a/src/patches/strongswan-ipfire-revert.patch b/src/patches/strongswan-ipfire-revert.patch new file mode 100644 index 000000000..91c76212e --- /dev/null +++ b/src/patches/strongswan-ipfire-revert.patch @@ -0,0 +1,113 @@ +--- strongswan-5.7.2/src/_updown/_updown.in.bak 2019-04-08 16:27:08.549214441 +0100 ++++ strongswan-5.7.2/src/_updown/_updown.in 2019-04-08 16:30:30.195868788 +0100 +@@ -130,36 +130,6 @@ + # address family. + # + +-VARS=( +- id status name lefthost type ctype psk local local_id leftsubnets +- remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 +- x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22 +- route x23 mode interface_mode interface_address interface_mtu rest +-) +- +-function ip_encode() { +- local IFS=. +- +- local int=0 +- for field in $1; do +- int=$(( $(( $int << 8 )) | $field )) +- done +- +- echo $int +-} +- +-function ip_in_subnet() { +- local netmask +- netmask=$(_netmask $2) +- [ $(( $(ip_encode $1) & $netmask)) = $(( $(ip_encode ${2%/*}) & $netmask )) ] +-} +- +-function _netmask() { +- local vlsm +- vlsm=${1#*/} +- [ $vlsm -eq 0 ] && echo 0 || echo $(( -1 << $(( 32 - $vlsm )) )) +-} +- + # define a minimum PATH environment in case it is not set + PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" + export PATH +@@ -326,13 +296,6 @@ + fi + ;; + up-client:iptables) +- # Read IPsec configuration +- while IFS="," read -r "${VARS[@]}"; do +- if [ "${PLUTO_CONNECTION}" = "${name}" ]; then +- break +- fi +- done < /var/ipfire/vpn/config +- + # connection to client subnet, with (left/right)firewall=yes, coming up + # This is used only by the default updown script, not by your custom + # ones, so do not mess with it; see CAUTION comment up at top. +@@ -396,30 +359,6 @@ + logger -t $TAG -p $FAC_PRIO \ + "tunnel+ $PLUTO_PEER -- $PLUTO_ME" + fi +- +- if [ -z "${interface_mode}" ]; then +- # Add source nat so also the gateway can access the other nets +- eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) +- for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do +- ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}" +- if [ $? -eq 0 ]; then +- src=${_src} +- break +- fi +- done +- +- if [ -n "${src}" ]; then +- iptables --wait -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src +- logger -t $TAG -p $FAC_PRIO \ +- "snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src" +- else +- logger -t $TAG -p $FAC_PRIO \ +- "Cannot create NAT rule because no IP of the IPFire does match the subnet. $PLUTO_MY_CLIENT" +- fi +- fi +- +- # Flush routing cache +- ip route flush cache + ;; + down-client:iptables) + # connection to client subnet, with (left/right)firewall=yes, going down +@@ -487,28 +426,6 @@ + logger -t $TAG -p $FAC_PRIO \ + "tunnel- $PLUTO_PEER -- $PLUTO_ME" + fi +- +- # remove source nat +- eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) +- for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do +- ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}" +- if [ $? -eq 0 ]; then +- src=${_src} +- break +- fi +- done +- +- if [ -n "${src}" ]; then +- iptables --wait -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src +- logger -t $TAG -p $FAC_PRIO \ +- "snat- $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src" +- else +- logger -t $TAG -p $FAC_PRIO \ +- "Cannot remove NAT rule because no IP of the IPFire does match the subnet." +- fi +- +- # Flush routing cache +- ip route flush cache + ;; + # + # IPv6 diff --git a/src/scripts/ipsec-interfaces b/src/scripts/ipsec-interfaces index 0e43fccbc..2546f8927 100644 --- a/src/scripts/ipsec-interfaces +++ b/src/scripts/ipsec-interfaces @@ -23,9 +23,19 @@ shopt -s nullglob VPN_CONFIG="/var/ipfire/vpn/config" +ROUTE_TABLE="220" +ROUTE_TABLE_PRIO="128" + eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings) +# Get RED interface name +if [ -r "/var/ipfire/red/iface" ]; then + RED_INTF="$(</var/ipfire/red/iface)" +else + RED_INTF="red0" +fi + VARS=( id status name lefthost type ctype psk local local_id leftsubnets remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 @@ -43,6 +53,52 @@ resolve_hostname() { dig +short A "${hostname}" | tail -n1 } +ip_encode() { + local address="${1}" + + local int=0 + for field in ${address//./ }; do + int=$(( $(( ${int} << 8 )) | ${field} )) + done + + echo ${int} +} + +function ip_in_subnet() { + local address="${1}" + local subnet="${2}" + + local netmask="${subnet#*/}" + + # Convert netmask to prefix if necessary + case "${netmask}" in + [0-9]+) + ;; + *) + netmask="$(netmask2prefix "${netmask}")" + ;; + esac + + local vlsm=$(( -1 << $(( 32 - ${netmask} )) )) + + [ "$(( $(ip_encode "${address}") & ${vlsm} ))" -eq "$(( $(ip_encode "${subnet%/*}") & ${vlsm} ))" ] +} + +netmask2prefix() { + local netmask="${1}" + local mask="$(ip_encode "${netmask}")" + + local cidr=0 + local x="$(( 128 << 24 ))" # 0x80000000 + + while [ $(( ${x} & ${mask} )) -ne 0 ]; do + [ ${mask} -eq ${x} ] && mask=0 || mask=$(( ${mask} << 1 )) + cidr=$(( ${cidr} + 1 )) + done + + echo "${cidr}" +} + main() { # Register local variables local "${VARS[@]}" @@ -50,8 +106,17 @@ main() { local interfaces=() + # Flush IPsec routes + ip route flush table "${ROUTE_TABLE}" + + # Remove lookups + ip rule del lookup "${ROUTE_TABLE}" + # We are done when IPsec is not enabled if [ "${ENABLED}" = "on" ]; then + # Enable route table lookup + ip rule add lookup "${ROUTE_TABLE}" prio "${ROUTE_TABLE_PRIO}" + while IFS="," read -r "${VARS[@]}"; do # Check if the connection is enabled [ "${status}" = "on" ] || continue @@ -65,6 +130,38 @@ main() { local intf="${interface_mode}${id}" ;; *) + # Install routes + local address + + local _address + for _address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do + local leftsubnet + for leftsubnet in ${leftsubnets//\|/ }; do + if ip_in_subnet "${_address}" "${leftsubnet}"; then + address="${_address}" + break + fi + done + + # End loop when address is set + [ -n "${address}" ] && break + done + + local rightsubnet + for rightsubnet in ${rightsubnets//\|/ }; do + # Ignore default + case "${rightsubnet}" in + 0.0.0.0/*) + continue + ;; + esac + + log "Creating route to ${rightsubnet} (via ${address} and ${RED_INTF})" + ip route add table "${ROUTE_TABLE}" "${rightsubnet}" proto static \ + dev "${RED_INTF}" src "${address}" + done + + # No interface processing required continue ;; esac @@ -167,6 +264,9 @@ main() { log "Deleting interface ${intf}" ip link del "${intf}" &>/dev/null done + + # (Re-)Apply all static routes + /etc/init.d/static-routes start } main || exit $? hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 3.x development tree branch, master, updated. aa3c0f63690fa984ffd4e3e2be8786e0a494aec1
by Michael Tremer 08 Apr '19

08 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree". The branch, master has been updated via aa3c0f63690fa984ffd4e3e2be8786e0a494aec1 (commit) via 82f575cb7a3ccbddd7f9c2f505947054645b4701 (commit) via 8fa096f8cc36d2fcfbc1dabfdacc54d4bfb9e8ab (commit) via 6a396aea4c5672e1b2720e88decc4d73772931ca (commit) via 1c1050e63f661347917ae795d1d62bd71911f97a (commit) via d6bd23b5746ac18bd13ef0bc3d5d46579f93f131 (commit) via 554cdd8dfe8cfc4bd02a3c4b4a8849e48bf45ffc (commit) from 899a8a2fb7dc6b9c16a73922f193578bdb7267b3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit aa3c0f63690fa984ffd4e3e2be8786e0a494aec1 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 23:27:42 2019 +0100 oinkmaster: Drop package This will be replaced by suricata-update Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 82f575cb7a3ccbddd7f9c2f505947054645b4701 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 23:25:17 2019 +0100 clamav: Update to 0.101.2 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 8fa096f8cc36d2fcfbc1dabfdacc54d4bfb9e8ab Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 23:21:12 2019 +0100 curl: Update to 7.64.1 Also fixes linking issues with the library. Development packages that libcurl was linking against were not pulled in. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 6a396aea4c5672e1b2720e88decc4d73772931ca Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 22:29:52 2019 +0100 iperf3: New package iPerf3 is a tool for active measurements of the maximum achievable bandwidth on IP networks. It supports tuning of various parameters related to timing, buffers and protocols (TCP, UDP, SCTP with IPv4 and IPv6). For each test it reports the bandwidth, loss, and other parameters. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 1c1050e63f661347917ae795d1d62bd71911f97a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 22:18:13 2019 +0100 iperf: Update to 2.0.13 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit d6bd23b5746ac18bd13ef0bc3d5d46579f93f131 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 22:11:59 2019 +0100 libuv: New package libuv is a multi-platform support library with a focus on asynchronous I/O. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 554cdd8dfe8cfc4bd02a3c4b4a8849e48bf45ffc Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 22:10:46 2019 +0100 rhash: New package RHash (Recursive Hasher) is a console utility for calculation and verification of magnet links and various hash sums, including CRC32, CRC32C, MD4, MD5, SHA1, SHA256, SHA512, SHA3, AICH, ED2K, DC++ TTH, BitTorrent BTIH, Tiger, GOST R 34.11-94, GOST R 34.11-2012, RIPEMD-160, HAS-160, EDON-R, and Whirlpool. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: clamav/clamav.nm | 11 ++-- curl/curl.nm | 15 +++--- iperf/iperf.nm | 4 +- iperf3/iperf3.nm | 39 +++++++++++++++ libpciaccess/libpciaccess.nm => libuv/libuv.nm | 24 ++++----- oinkmaster/oinkmaster.nm | 47 ------------------ rhash/rhash.nm | 69 ++++++++++++++++++++++++++ 7 files changed, 136 insertions(+), 73 deletions(-) create mode 100644 iperf3/iperf3.nm copy libpciaccess/libpciaccess.nm => libuv/libuv.nm (56%) delete mode 100644 oinkmaster/oinkmaster.nm create mode 100644 rhash/rhash.nm Difference in files: diff --git a/clamav/clamav.nm b/clamav/clamav.nm index 5bcb7c382..9a550544e 100644 --- a/clamav/clamav.nm +++ b/clamav/clamav.nm @@ -4,7 +4,7 @@ ############################################################################### name = clamav -version = 0.99.3 +version = 0.101.2 release = 1 groups = System Environment/Daemons @@ -26,28 +26,29 @@ end source_dl = http://www.clamav.net/downloads/production/ -CFLAGS += -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -DLDAP_DEPRECATED -CXXFLAGS += -std=gnu++98 - build requires bzip2-devel curl-devel gmp-devel + json-c-devel libxml2-devel ncurses-devel openssl-devel - pcre-devel + pcre2-devel shadow-utils systemd-devel zlib-devel end + LDFLAGS += -Wl,--as-needed + configure_options += \ --with-dbdir=%{localstatedir}/lib/clamav \ --enable-clamdtop \ --with-user=clamupdate \ --with-group=clamupdate \ + --disable-rpath \ have_cv_ipv6=yes # User and group have to exist to compile the source code, diff --git a/curl/curl.nm b/curl/curl.nm index b9e5bff9d..da7512e31 100644 --- a/curl/curl.nm +++ b/curl/curl.nm @@ -4,7 +4,7 @@ ############################################################################### name = curl -version = 7.64.0 +version = 7.64.1 release = 1 groups = Application/Internet @@ -24,8 +24,6 @@ source_dl = https://curl.haxx.se/download/ build requires - autoconf - automake groff libidn-devel libssh2-devel @@ -48,10 +46,6 @@ build --enable-manual \ --enable-threaded-resolver - prepare_cmds - autoreconf -vfi - end - # The testsuite runs services which bind to ports and # sends queries to the internet. This may fail in some # occasions. @@ -73,6 +67,13 @@ packages provides curl-devel = %{thisver} end + + requires + libssh2-devel + openldap-devel + openssl-devel + zlib-devel + end end package %{name}-debuginfo diff --git a/iperf/iperf.nm b/iperf/iperf.nm index be93c9ade..97db91fb3 100644 --- a/iperf/iperf.nm +++ b/iperf/iperf.nm @@ -4,7 +4,7 @@ ############################################################################### name = iperf -version = 2.0.9 +version = 2.0.13 release = 1 groups = Applications/Internet @@ -18,7 +18,7 @@ description jitter, datagram loss. end -source_dl = http://sourceforge.net/projects/iperf2/files +source_dl = https://sourceforge.net/projects/iperf2/files build requires diff --git a/iperf3/iperf3.nm b/iperf3/iperf3.nm new file mode 100644 index 000000000..2437ed9bd --- /dev/null +++ b/iperf3/iperf3.nm @@ -0,0 +1,39 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # +############################################################################### + +name = iperf3 +version = 3.1.3 +release = 1 +thisapp = iperf-%{version} + +groups = Applications/Internet +url = https://iperf.fr +license = BSD +summary = The ultimate speed test tool for TCP, UDP and SCTP + +description + iPerf3 is a tool for active measurements of the maximum achievable + bandwidth on IP networks. It supports tuning of various parameters + related to timing, buffers and protocols (TCP, UDP, SCTP with IPv4 + and IPv6). For each test it reports the bandwidth, loss, and other + parameters. +end + +source_dl = https://iperf.fr/download/source/ +sources = %{thisapp}-source.tar.gz + +build + requires + gcc-c++ + end +end + +packages + package %{name} + + package %{name}-debuginfo + template DEBUGINFO + end +end diff --git a/libuv/libuv.nm b/libuv/libuv.nm new file mode 100644 index 000000000..09e3f8c0b --- /dev/null +++ b/libuv/libuv.nm @@ -0,0 +1,46 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # +############################################################################### + +name = libuv +version = 1.27.0 +release = 1 + +groups = Development/Tools +url = https://github.com/libuv/libuv +license = libuv +summary = Multi-platform support library with a focus on asynchronous I/O + +description + libuv is a multi-platform support library with a focus on + asynchronous I/O. +end + +source_dl = https://github.com/libuv/libuv/archive/v%{version}/ + +build + requires + autoconf + automake + end + + prepare_cmds + ./autogen.sh + end + + # The test suite requires network access and does + # not run through in pakfire. +end + +packages + package %{name} + + package %{name}-devel + template DEVEL + end + + package %{name}-debuginfo + template DEBUGINFO + end +end diff --git a/oinkmaster/oinkmaster.nm b/oinkmaster/oinkmaster.nm deleted file mode 100644 index f9f5e6dd8..000000000 --- a/oinkmaster/oinkmaster.nm +++ /dev/null @@ -1,47 +0,0 @@ -############################################################################### -# IPFire.org - An Open Source Firewall Solution # -# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # -############################################################################### - -name = oinkmaster -version = 2.0 -release = 2 -arch = noarch - -groups = Development/Libraries -url = http://oinkmaster.sourceforge.net -license = BSD -summary = A Perl interface for updating snort rules. - -description - Oinkmaster is a script that will help you update and manage your Snort rules. -end - -source_dl = - -build - requires - perl - end - - build - echo "url = http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz" >> oinkmaster.conf - echo "tmpdir = /var/tmp/" >> oinkmaster.conf - end - - install - mkdir -pv %{BUILDROOT}/usr/sbin - install -m 755 oinkmaster.pl %{BUILDROOT}/usr/sbin - mkdir -pv %{BUILDROOT}/etc - install -m 644 oinkmaster.conf %{BUILDROOT}/etc - end -end - -packages - package %{name} - - filter_requires - perl>=[0-9]\:.* - end - end -end diff --git a/rhash/rhash.nm b/rhash/rhash.nm new file mode 100644 index 000000000..ddb420dcd --- /dev/null +++ b/rhash/rhash.nm @@ -0,0 +1,69 @@ +############################################################################### +# IPFire.org - An Open Source Firewall Solution # +# Copyright (C) - IPFire Development Team <info(a)ipfire.org> # +############################################################################### + +name = rhash +version = 1.3.8 +release = 1 +thisapp = RHash-%{version} + +groups = Development/Tools +url = http://rhash.sf.net/ +license = BSD +summary = Great utility for computing hash sums + +description + RHash (Recursive Hasher) is a console utility for calculation and + verification of magnet links and various hash sums, including CRC32, + CRC32C, MD4, MD5, SHA1, SHA256, SHA512, SHA3, AICH, ED2K, DC++ TTH, + BitTorrent BTIH, Tiger, GOST R 34.11-94, GOST R 34.11-2012, RIPEMD-160, + HAS-160, EDON-R, and Whirlpool. + + Hash sums are used to ensure and verify integrity of large volumes of + data for a long-term storing or transferring. +end + +source_dl = https://github.com/rhash/RHash/archive/v%{version}.tar.gz#/ + +build + requires + gettext + openssl-devel + end + + # This package uses a non-standard configure script + configure_options = \ + --target="%{DISTRO_ARCH}-linux" \ + --prefix="%{prefix}" \ + --sysconfdir="%{sysconfdir}" \ + --libdir="%{libdir}" \ + --disable-static \ + --extra-cflags="%{CFLAGS}" \ + --extra-ldflags="%{LDFLAGS}" + + test + make test test-lib + end + + install + # Install rhash command + make install DESTDIR=%{BUILDROOT} + + # Install library + make -C librhash DESTDIR=%{BUILDROOT} \ + install-lib-headers install-lib-shared install-so-link + end +end + +packages + package %{name} + + package %{name}-devel + template DEVEL + end + + package %{name}-debuginfo + template DEBUGINFO + end +end hooks/post-receive -- IPFire 3.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. ee82349a0ea00866d731936e769fab9441690932
by Michael Tremer 08 Apr '19

08 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via ee82349a0ea00866d731936e769fab9441690932 (commit) via e4bc9b8b6fa0cc0d67d2f698e2bdd5d41af49f05 (commit) via ee53381ab167b195d2d4d94da3d2a3d4a024288d (commit) via f9de28e6f0ca455aacca3b0fc30722b88d542630 (commit) via e918b62ae223b31f459ca5843d291532f5188faf (commit) via e1f6dfcbbc3c34130027ffe113488f5f3d9c9557 (commit) from 4f30ce49b3c2375d52e7358d12a6235c3e35997d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ee82349a0ea00866d731936e769fab9441690932 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Mon Apr 8 20:20:18 2019 +0200 convert-snort: Re-order steps at end of script This will ensure that the whole IDS is configured property, if no or an empty snort config file is present. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e4bc9b8b6fa0cc0d67d2f698e2bdd5d41af49f05 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Mon Apr 8 20:02:53 2019 +0200 convert-snort: Fix logic for detecting enough free disk space. The subfunction only will return something if the check fails - so the logic of the if statement was wrong set and the downloader only was called if this check failed and to less diskspace would be available. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ee53381ab167b195d2d4d94da3d2a3d4a024288d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 20:53:47 2019 +0100 core130: Ship SSH Agent Forwarding changes Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f9de28e6f0ca455aacca3b0fc30722b88d542630 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Apr 8 16:35:00 2019 +0000 change AllowAgentForwarding in SSHD configuration if, necessary Fixes #11931 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e918b62ae223b31f459ca5843d291532f5188faf Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Apr 8 16:35:00 2019 +0000 allow SSH agent forwarding to be configured via WebUI Fixes #11931 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e1f6dfcbbc3c34130027ffe113488f5f3d9c9557 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Apr 8 16:34:00 2019 +0000 add language strings for SSH agent forwarding settings Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/131/filelists/files | 2 ++ config/suricata/convert-snort | 39 +++++++++++++++++-------------- html/cgi-bin/remote.cgi | 11 ++++++++- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + src/misc-progs/sshctrl.c | 5 ++++ 6 files changed, 40 insertions(+), 19 deletions(-) Difference in files: diff --git a/config/rootfiles/core/131/filelists/files b/config/rootfiles/core/131/filelists/files index 4924308dc..428d877c6 100644 --- a/config/rootfiles/core/131/filelists/files +++ b/config/rootfiles/core/131/filelists/files @@ -15,8 +15,10 @@ srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/logs.cgi/ids.dat srv/web/ipfire/cgi-bin/logs.cgi/log.dat srv/web/ipfire/cgi-bin/ovpnmain.cgi +srv/web/ipfire/cgi-bin/remote.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/local/bin/ipsec-interfaces +usr/local/bin/sshctrl usr/local/bin/suricatactrl usr/local/bin/update-ids-ruleset usr/sbin/convert-snort diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort index ca650b149..0ad2942b1 100644 --- a/config/suricata/convert-snort +++ b/config/suricata/convert-snort @@ -231,6 +231,9 @@ if (-f $snort_rules_tarball) { } else { # Check if enought disk space is available. if(&IDS::checkdiskspace()) { + # Print error message. + print "Could not download ruleset - Not enough free diskspace available.\n"; + } else { # Call the download function and grab the new ruleset. &IDS::downloadruleset(); } @@ -250,7 +253,24 @@ if (-f $IDS::rulestarball) { } # -## Step 8: Grab used ruleset files from snort config file and convert +## Step 8: Generate file for the HOME Net. +# + +# Call subfunction to generate the file. +&IDS::generate_home_net_file(); + +# +## Step 9: Setup automatic ruleset updates. +# + +# Check if a ruleset is configured. +if($rulessettings{"RULES"}) { + # Call suricatactrl and setup the periodic update mechanism. + &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'}); +} + +# +## Step 10: Grab used ruleset files from snort config file and convert ## them into the new format. # @@ -295,23 +315,6 @@ close(SNORTCONF); # Pass the array of enabled rule files to the subfunction and write the file. &IDS::write_used_rulefiles_file(@enabled_rule_files); -# -## Step 9: Generate file for the HOME Net. -# - -# Call subfunction to generate the file. -&IDS::generate_home_net_file(); - -# -## Step 10: Setup automatic ruleset updates. -# - -# Check if a ruleset is configured. -if($rulessettings{"RULES"}) { - # Call suricatactrl and setup the periodic update mechanism. - &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'}); -} - # ## Step 11: Start the IDS if enabled. # diff --git a/html/cgi-bin/remote.cgi b/html/cgi-bin/remote.cgi index 1b3dfed70..10d94fe99 100644 --- a/html/cgi-bin/remote.cgi +++ b/html/cgi-bin/remote.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -105,6 +105,7 @@ else { # used $remotesettings{'ENABLE_SSH_PASSWORDS'} = 'on' unless exists $remotesettings{'ENABLE_SSH_PASSWORDS'}; $remotesettings{'ENABLE_SSH_KEYS'} = 'on' unless exists $remotesettings{'ENABLE_SSH_KEYS'}; + $remotesettings{'SSH_AGENT_FORWARDING'} = 'off' unless exists $remotesettings{'SSH_AGENT_FORWARDING'}; $checked{'ENABLE_SSH'}{'off'} = ''; $checked{'ENABLE_SSH'}{'on'} = ''; @@ -121,6 +122,9 @@ $checked{'ENABLE_SSH_KEYS'}{$remotesettings{'ENABLE_SSH_KEYS'}} = "checked='chec $checked{'SSH_PORT'}{'off'} = ''; $checked{'SSH_PORT'}{'on'} = ''; $checked{'SSH_PORT'}{$remotesettings{'SSH_PORT'}} = "checked='checked'"; +$checked{'SSH_AGENT_FORWARDING'}{'off'} = ''; +$checked{'SSH_AGENT_FORWARDING'}{'on'} = ''; +$checked{'SSH_AGENT_FORWARDING'}{$remotesettings{'SSH_AGENT_FORWARDING'}} = "checked='checked'"; &Header::openpage($Lang::tr{'remote access'}, 1, ''); @@ -161,6 +165,11 @@ print <<END <td><input type='checkbox' name='SSH_PORT' $checked{'SSH_PORT'}{'on'} /></td> <td width='100%' class='base'>$Lang::tr{'ssh port'}</td> </tr> +<tr> + <td> </td> + <td><input type='checkbox' name='SSH_AGENT_FORWARDING' $checked{'SSH_AGENT_FORWARDING'}{'on'} /></td> + <td width='100%' class='base'>$Lang::tr{'ssh agent forwarding'}</td> +</tr> <tr> <td align='right' colspan='3'> <input type='submit' name='ACTION' value='$Lang::tr{'ssh tempstart15'}' /> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 88b34d23b..d63ebe6e5 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -2187,6 +2187,7 @@ 'ssh access' => 'SSH-Zugriff', 'ssh access tip' => 'IPFire SSH läuft nicht auf dem Standardport 22!', 'ssh active sessions' => 'Aktive Benutzeranmeldungen', +'ssh agent forwarding' => 'Weiterleitung des SSH-Agenten (Agent Forwarding) zulassen', 'ssh fingerprint' => 'Fingerabdruck', 'ssh host keys' => 'SSH Host Schlüssel', 'ssh is disabled' => 'Secure Shell ist deaktiviert. Halte an.', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index af0d514af..a709604b0 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2230,6 +2230,7 @@ 'ssh access' => 'SSH Access', 'ssh access tip' => 'IPFire SSH is not using default port 22!', 'ssh active sessions' => 'Active logins', +'ssh agent forwarding' => 'Enable SSH agent forwarding', 'ssh fingerprint' => 'Fingerprint', 'ssh host keys' => 'SSH Host Keys', 'ssh is disabled' => 'SSH is disabled. Stopping.', diff --git a/src/misc-progs/sshctrl.c b/src/misc-progs/sshctrl.c index 30074973d..476dbc9d5 100644 --- a/src/misc-progs/sshctrl.c +++ b/src/misc-progs/sshctrl.c @@ -76,6 +76,11 @@ int main(int argc, char *argv[]) else strlcat(command, "s/^Port .*$/Port 222/", STRING_SIZE - 1 ); + if(findkey(kv, "SSH_AGENT_FORWARDING", buffer) && !strcmp(buffer,"on")) + strlcat(command, "s/^AllowAgentForwarding .*$/AllowAgentForwarding yes/;", STRING_SIZE - 1 ); + else + strlcat(command, "s/^AllowAgentForwarding .*$/AllowAgentForwarding no/;", STRING_SIZE - 1 ); + freekeyvalues(kv); snprintf(buffer, STRING_SIZE - 1, "' /etc/ssh/sshd_config >&%d", config_fd ); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 4f30ce49b3c2375d52e7358d12a6235c3e35997d
by Arne Fitzenreiter 08 Apr '19

08 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 4f30ce49b3c2375d52e7358d12a6235c3e35997d (commit) via f2afd5e70dc1c95c13aa75b0acf3da072d714af8 (commit) via 47204d12f1387502612e8a66b4a1a8a853e33ebf (commit) via 5f9bf17d76e43b1ee0bb4b880a9aa001844e4d4a (commit) from 918ee4a4cf5bb8d2a3ade16aac0dd643215c47e2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4f30ce49b3c2375d52e7358d12a6235c3e35997d Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Apr 8 21:49:20 2019 +0200 rename core130 -> core131 we need to insert a core update to fix urgent bugs Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit f2afd5e70dc1c95c13aa75b0acf3da072d714af8 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Apr 8 21:47:23 2019 +0200 kernel: update to 4.14.111 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 47204d12f1387502612e8a66b4a1a8a853e33ebf Merge: 5f9bf17d7 918ee4a4c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Apr 8 21:47:12 2019 +0200 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 5f9bf17d76e43b1ee0bb4b880a9aa001844e4d4a Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Apr 8 16:18:00 2019 +0200 core130: update pakfire database after version change Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.armv5tel-ipfire-kirkwood | 2 +- config/kernel/kernel.config.armv5tel-ipfire-multi | 2 +- config/kernel/kernel.config.i586-ipfire | 2 +- config/kernel/kernel.config.i586-ipfire-pae | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/core/{130 => 131}/exclude | 0 config/rootfiles/core/{130 => 131}/filelists/Net_SSLeay | 0 config/rootfiles/core/{130 => 131}/filelists/aarch64/linux | 0 config/rootfiles/core/{130 => 131}/filelists/aarch64/linux-initrd | 0 config/rootfiles/core/{130 => 131}/filelists/apache2 | 0 .../core/{130 => 131}/filelists/armv5tel/linux-initrd-kirkwood | 0 .../core/{130 => 131}/filelists/armv5tel/linux-initrd-multi | 0 .../rootfiles/core/{130 => 131}/filelists/armv5tel/linux-kirkwood | 0 config/rootfiles/core/{130 => 131}/filelists/armv5tel/linux-multi | 0 config/rootfiles/core/{130 => 131}/filelists/collectd | 0 config/rootfiles/core/{130 => 131}/filelists/files | 0 config/rootfiles/core/{130 => 131}/filelists/gnutls | 0 config/rootfiles/core/{130 => 131}/filelists/i586/linux | 0 config/rootfiles/core/{130 => 131}/filelists/i586/linux-initrd | 0 config/rootfiles/core/{130 => 131}/filelists/ids-ruleset-sources | 0 config/rootfiles/core/{130 => 131}/filelists/libcap-ng | 0 config/rootfiles/core/{130 => 131}/filelists/libhtp | 0 config/rootfiles/core/{130 => 131}/filelists/lua | 0 config/rootfiles/core/{130 => 131}/filelists/nettle | 0 config/rootfiles/core/{130 => 131}/filelists/ntp | 0 config/rootfiles/core/{130 => 131}/filelists/oinkmaster | 0 config/rootfiles/core/{130 => 131}/filelists/rrdtool | 0 config/rootfiles/core/{130 => 131}/filelists/suricata | 0 config/rootfiles/core/{130 => 131}/filelists/unbound | 0 config/rootfiles/core/{130 => 131}/filelists/wget | 0 config/rootfiles/core/{130 => 131}/filelists/x86_64/linux | 0 config/rootfiles/core/{130 => 131}/filelists/x86_64/linux-initrd | 0 config/rootfiles/core/{130 => 131}/filelists/yaml | 0 config/rootfiles/core/{130 => 131}/update.sh | 5 ++++- lfs/linux | 6 +++--- 36 files changed, 13 insertions(+), 10 deletions(-) rename config/rootfiles/core/{130 => 131}/exclude (100%) rename config/rootfiles/core/{130 => 131}/filelists/Net_SSLeay (100%) rename config/rootfiles/core/{130 => 131}/filelists/aarch64/linux (100%) rename config/rootfiles/core/{130 => 131}/filelists/aarch64/linux-initrd (100%) rename config/rootfiles/core/{130 => 131}/filelists/apache2 (100%) rename config/rootfiles/core/{130 => 131}/filelists/armv5tel/linux-initrd-kirkwood (100%) rename config/rootfiles/core/{130 => 131}/filelists/armv5tel/linux-initrd-multi (100%) rename config/rootfiles/core/{130 => 131}/filelists/armv5tel/linux-kirkwood (100%) rename config/rootfiles/core/{130 => 131}/filelists/armv5tel/linux-multi (100%) rename config/rootfiles/core/{130 => 131}/filelists/collectd (100%) rename config/rootfiles/core/{130 => 131}/filelists/files (100%) rename config/rootfiles/core/{130 => 131}/filelists/gnutls (100%) rename config/rootfiles/core/{130 => 131}/filelists/i586/linux (100%) rename config/rootfiles/core/{130 => 131}/filelists/i586/linux-initrd (100%) rename config/rootfiles/core/{130 => 131}/filelists/ids-ruleset-sources (100%) rename config/rootfiles/core/{130 => 131}/filelists/libcap-ng (100%) rename config/rootfiles/core/{130 => 131}/filelists/libhtp (100%) rename config/rootfiles/core/{130 => 131}/filelists/lua (100%) rename config/rootfiles/core/{130 => 131}/filelists/nettle (100%) rename config/rootfiles/core/{130 => 131}/filelists/ntp (100%) rename config/rootfiles/core/{130 => 131}/filelists/oinkmaster (100%) rename config/rootfiles/core/{130 => 131}/filelists/rrdtool (100%) rename config/rootfiles/core/{130 => 131}/filelists/suricata (100%) rename config/rootfiles/core/{130 => 131}/filelists/unbound (100%) rename config/rootfiles/core/{130 => 131}/filelists/wget (100%) rename config/rootfiles/core/{130 => 131}/filelists/x86_64/linux (100%) rename config/rootfiles/core/{130 => 131}/filelists/x86_64/linux-initrd (100%) rename config/rootfiles/core/{130 => 131}/filelists/yaml (100%) rename config/rootfiles/core/{130 => 131}/update.sh (98%) Difference in files: diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index c48cc541b..3944b0eba 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.14.110-ipfire Kernel Configuration +# Linux/arm64 4.14.111-ipfire Kernel Configuration # CONFIG_ARM64=y CONFIG_64BIT=y diff --git a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood index ceda6d989..ad9c07ecc 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood +++ b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.110-ipfire-kirkwood Kernel Configuration +# Linux/arm 4.14.111-ipfire-kirkwood Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index efb20624e..2969e2344 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.110-ipfire-multi Kernel Configuration +# Linux/arm 4.14.111-ipfire-multi Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 004b3895f..8065f4088 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.14.110-ipfire-pae Kernel Configuration +# Linux/x86 4.14.111-ipfire Kernel Configuration # # CONFIG_64BIT is not set CONFIG_X86_32=y diff --git a/config/kernel/kernel.config.i586-ipfire-pae b/config/kernel/kernel.config.i586-ipfire-pae index e29e67cc3..f7dec8e1f 100644 --- a/config/kernel/kernel.config.i586-ipfire-pae +++ b/config/kernel/kernel.config.i586-ipfire-pae @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.14.110-ipfire-pae Kernel Configuration +# Linux/x86 4.14.111-ipfire-pae Kernel Configuration # # CONFIG_64BIT is not set CONFIG_X86_32=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index e4dee86ed..92f8c862c 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 4.14.110-ipfire Kernel Configuration +# Linux/x86 4.14.111-ipfire Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y diff --git a/config/rootfiles/core/130/exclude b/config/rootfiles/core/131/exclude similarity index 100% rename from config/rootfiles/core/130/exclude rename to config/rootfiles/core/131/exclude diff --git a/config/rootfiles/core/130/filelists/Net_SSLeay b/config/rootfiles/core/131/filelists/Net_SSLeay similarity index 100% rename from config/rootfiles/core/130/filelists/Net_SSLeay rename to config/rootfiles/core/131/filelists/Net_SSLeay diff --git a/config/rootfiles/core/130/filelists/aarch64/linux b/config/rootfiles/core/131/filelists/aarch64/linux similarity index 100% rename from config/rootfiles/core/130/filelists/aarch64/linux rename to config/rootfiles/core/131/filelists/aarch64/linux diff --git a/config/rootfiles/core/130/filelists/aarch64/linux-initrd b/config/rootfiles/core/131/filelists/aarch64/linux-initrd similarity index 100% rename from config/rootfiles/core/130/filelists/aarch64/linux-initrd rename to config/rootfiles/core/131/filelists/aarch64/linux-initrd diff --git a/config/rootfiles/core/130/filelists/apache2 b/config/rootfiles/core/131/filelists/apache2 similarity index 100% rename from config/rootfiles/core/130/filelists/apache2 rename to config/rootfiles/core/131/filelists/apache2 diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-kirkwood b/config/rootfiles/core/131/filelists/armv5tel/linux-initrd-kirkwood similarity index 100% rename from config/rootfiles/core/130/filelists/armv5tel/linux-initrd-kirkwood rename to config/rootfiles/core/131/filelists/armv5tel/linux-initrd-kirkwood diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-multi b/config/rootfiles/core/131/filelists/armv5tel/linux-initrd-multi similarity index 100% rename from config/rootfiles/core/130/filelists/armv5tel/linux-initrd-multi rename to config/rootfiles/core/131/filelists/armv5tel/linux-initrd-multi diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-kirkwood b/config/rootfiles/core/131/filelists/armv5tel/linux-kirkwood similarity index 100% rename from config/rootfiles/core/130/filelists/armv5tel/linux-kirkwood rename to config/rootfiles/core/131/filelists/armv5tel/linux-kirkwood diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-multi b/config/rootfiles/core/131/filelists/armv5tel/linux-multi similarity index 100% rename from config/rootfiles/core/130/filelists/armv5tel/linux-multi rename to config/rootfiles/core/131/filelists/armv5tel/linux-multi diff --git a/config/rootfiles/core/130/filelists/collectd b/config/rootfiles/core/131/filelists/collectd similarity index 100% rename from config/rootfiles/core/130/filelists/collectd rename to config/rootfiles/core/131/filelists/collectd diff --git a/config/rootfiles/core/130/filelists/files b/config/rootfiles/core/131/filelists/files similarity index 100% rename from config/rootfiles/core/130/filelists/files rename to config/rootfiles/core/131/filelists/files diff --git a/config/rootfiles/core/130/filelists/gnutls b/config/rootfiles/core/131/filelists/gnutls similarity index 100% rename from config/rootfiles/core/130/filelists/gnutls rename to config/rootfiles/core/131/filelists/gnutls diff --git a/config/rootfiles/core/130/filelists/i586/linux b/config/rootfiles/core/131/filelists/i586/linux similarity index 100% rename from config/rootfiles/core/130/filelists/i586/linux rename to config/rootfiles/core/131/filelists/i586/linux diff --git a/config/rootfiles/core/130/filelists/i586/linux-initrd b/config/rootfiles/core/131/filelists/i586/linux-initrd similarity index 100% rename from config/rootfiles/core/130/filelists/i586/linux-initrd rename to config/rootfiles/core/131/filelists/i586/linux-initrd diff --git a/config/rootfiles/core/130/filelists/ids-ruleset-sources b/config/rootfiles/core/131/filelists/ids-ruleset-sources similarity index 100% rename from config/rootfiles/core/130/filelists/ids-ruleset-sources rename to config/rootfiles/core/131/filelists/ids-ruleset-sources diff --git a/config/rootfiles/core/130/filelists/libcap-ng b/config/rootfiles/core/131/filelists/libcap-ng similarity index 100% rename from config/rootfiles/core/130/filelists/libcap-ng rename to config/rootfiles/core/131/filelists/libcap-ng diff --git a/config/rootfiles/core/130/filelists/libhtp b/config/rootfiles/core/131/filelists/libhtp similarity index 100% rename from config/rootfiles/core/130/filelists/libhtp rename to config/rootfiles/core/131/filelists/libhtp diff --git a/config/rootfiles/core/130/filelists/lua b/config/rootfiles/core/131/filelists/lua similarity index 100% rename from config/rootfiles/core/130/filelists/lua rename to config/rootfiles/core/131/filelists/lua diff --git a/config/rootfiles/core/130/filelists/nettle b/config/rootfiles/core/131/filelists/nettle similarity index 100% rename from config/rootfiles/core/130/filelists/nettle rename to config/rootfiles/core/131/filelists/nettle diff --git a/config/rootfiles/core/130/filelists/ntp b/config/rootfiles/core/131/filelists/ntp similarity index 100% rename from config/rootfiles/core/130/filelists/ntp rename to config/rootfiles/core/131/filelists/ntp diff --git a/config/rootfiles/core/130/filelists/oinkmaster b/config/rootfiles/core/131/filelists/oinkmaster similarity index 100% rename from config/rootfiles/core/130/filelists/oinkmaster rename to config/rootfiles/core/131/filelists/oinkmaster diff --git a/config/rootfiles/core/130/filelists/rrdtool b/config/rootfiles/core/131/filelists/rrdtool similarity index 100% rename from config/rootfiles/core/130/filelists/rrdtool rename to config/rootfiles/core/131/filelists/rrdtool diff --git a/config/rootfiles/core/130/filelists/suricata b/config/rootfiles/core/131/filelists/suricata similarity index 100% rename from config/rootfiles/core/130/filelists/suricata rename to config/rootfiles/core/131/filelists/suricata diff --git a/config/rootfiles/core/130/filelists/unbound b/config/rootfiles/core/131/filelists/unbound similarity index 100% rename from config/rootfiles/core/130/filelists/unbound rename to config/rootfiles/core/131/filelists/unbound diff --git a/config/rootfiles/core/130/filelists/wget b/config/rootfiles/core/131/filelists/wget similarity index 100% rename from config/rootfiles/core/130/filelists/wget rename to config/rootfiles/core/131/filelists/wget diff --git a/config/rootfiles/core/130/filelists/x86_64/linux b/config/rootfiles/core/131/filelists/x86_64/linux similarity index 100% rename from config/rootfiles/core/130/filelists/x86_64/linux rename to config/rootfiles/core/131/filelists/x86_64/linux diff --git a/config/rootfiles/core/130/filelists/x86_64/linux-initrd b/config/rootfiles/core/131/filelists/x86_64/linux-initrd similarity index 100% rename from config/rootfiles/core/130/filelists/x86_64/linux-initrd rename to config/rootfiles/core/131/filelists/x86_64/linux-initrd diff --git a/config/rootfiles/core/130/filelists/yaml b/config/rootfiles/core/131/filelists/yaml similarity index 100% rename from config/rootfiles/core/130/filelists/yaml rename to config/rootfiles/core/131/filelists/yaml diff --git a/config/rootfiles/core/130/update.sh b/config/rootfiles/core/131/update.sh similarity index 98% rename from config/rootfiles/core/130/update.sh rename to config/rootfiles/core/131/update.sh index a3a888663..c809ed0ef 100644 --- a/config/rootfiles/core/130/update.sh +++ b/config/rootfiles/core/131/update.sh @@ -24,7 +24,7 @@ . /opt/pakfire/lib/functions.sh /usr/local/bin/backupctrl exclude >/dev/null 2>&1 -core=130 +core=131 exit_with_error() { # Set last succesfull installed core. @@ -130,6 +130,9 @@ rm -rfv \ /etc/init.d/unbound restart /etc/init.d/suricata start +# Update pakfire database +/usr/local/bin/pakfire update --force + # Search sensors again after reboot into the new kernel rm -f /etc/sysconfig/lm_sensors diff --git a/lfs/linux b/lfs/linux index 042cd3f32..ef612fe10 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,8 +24,8 @@ include Config -VER = 4.14.110 -ARM_PATCHES = 4.14.110-ipfire0 +VER = 4.14.111 +ARM_PATCHES = 4.14.111-ipfire0 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.xz @@ -82,7 +82,7 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_MD5 = ce0b04955349ba75bfb8afa83abe6de8 +$(DL_FILE)_MD5 = d1ef2ffcf41ca1cb58ba4fd6f2872ccf arm-multi-patches-$(ARM_PATCHES).patch.xz_MD5 = ed976ae7954c36b715fdb6b83630d0b6 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 918ee4a4cf5bb8d2a3ade16aac0dd643215c47e2
by Michael Tremer 08 Apr '19

08 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 918ee4a4cf5bb8d2a3ade16aac0dd643215c47e2 (commit) from c557356ea4878f7f6d0d9431246bfc8e75018672 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 918ee4a4cf5bb8d2a3ade16aac0dd643215c47e2 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 16:41:24 2019 +0100 strongswan: Manually install all routes for non-routed VPNs This is a regression from disabling charon.install_routes. VPNs are routing fine as long as traffic is passing through the firewall. Traps are not propertly used as long as these routes are not present and therefore we won't trigger any tunnels when traffic originates from the firewall. Fixes: #12045 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/strongswan | 1 + src/patches/strongswan-ipfire-revert.patch | 113 +++++++++++++++++++++++++++++ src/scripts/ipsec-interfaces | 97 +++++++++++++++++++++++++ 3 files changed, 211 insertions(+) create mode 100644 src/patches/strongswan-ipfire-revert.patch Difference in files: diff --git a/lfs/strongswan b/lfs/strongswan index 4174f78fe..714537e36 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -73,6 +73,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-disable-ipv6.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire-interfaces.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire-revert.patch cd $(DIR_APP) && ./configure \ --prefix="/usr" \ diff --git a/src/patches/strongswan-ipfire-revert.patch b/src/patches/strongswan-ipfire-revert.patch new file mode 100644 index 000000000..91c76212e --- /dev/null +++ b/src/patches/strongswan-ipfire-revert.patch @@ -0,0 +1,113 @@ +--- strongswan-5.7.2/src/_updown/_updown.in.bak 2019-04-08 16:27:08.549214441 +0100 ++++ strongswan-5.7.2/src/_updown/_updown.in 2019-04-08 16:30:30.195868788 +0100 +@@ -130,36 +130,6 @@ + # address family. + # + +-VARS=( +- id status name lefthost type ctype psk local local_id leftsubnets +- remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 +- x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22 +- route x23 mode interface_mode interface_address interface_mtu rest +-) +- +-function ip_encode() { +- local IFS=. +- +- local int=0 +- for field in $1; do +- int=$(( $(( $int << 8 )) | $field )) +- done +- +- echo $int +-} +- +-function ip_in_subnet() { +- local netmask +- netmask=$(_netmask $2) +- [ $(( $(ip_encode $1) & $netmask)) = $(( $(ip_encode ${2%/*}) & $netmask )) ] +-} +- +-function _netmask() { +- local vlsm +- vlsm=${1#*/} +- [ $vlsm -eq 0 ] && echo 0 || echo $(( -1 << $(( 32 - $vlsm )) )) +-} +- + # define a minimum PATH environment in case it is not set + PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin" + export PATH +@@ -326,13 +296,6 @@ + fi + ;; + up-client:iptables) +- # Read IPsec configuration +- while IFS="," read -r "${VARS[@]}"; do +- if [ "${PLUTO_CONNECTION}" = "${name}" ]; then +- break +- fi +- done < /var/ipfire/vpn/config +- + # connection to client subnet, with (left/right)firewall=yes, coming up + # This is used only by the default updown script, not by your custom + # ones, so do not mess with it; see CAUTION comment up at top. +@@ -396,30 +359,6 @@ + logger -t $TAG -p $FAC_PRIO \ + "tunnel+ $PLUTO_PEER -- $PLUTO_ME" + fi +- +- if [ -z "${interface_mode}" ]; then +- # Add source nat so also the gateway can access the other nets +- eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) +- for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do +- ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}" +- if [ $? -eq 0 ]; then +- src=${_src} +- break +- fi +- done +- +- if [ -n "${src}" ]; then +- iptables --wait -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src +- logger -t $TAG -p $FAC_PRIO \ +- "snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src" +- else +- logger -t $TAG -p $FAC_PRIO \ +- "Cannot create NAT rule because no IP of the IPFire does match the subnet. $PLUTO_MY_CLIENT" +- fi +- fi +- +- # Flush routing cache +- ip route flush cache + ;; + down-client:iptables) + # connection to client subnet, with (left/right)firewall=yes, going down +@@ -487,28 +426,6 @@ + logger -t $TAG -p $FAC_PRIO \ + "tunnel- $PLUTO_PEER -- $PLUTO_ME" + fi +- +- # remove source nat +- eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) +- for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do +- ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}" +- if [ $? -eq 0 ]; then +- src=${_src} +- break +- fi +- done +- +- if [ -n "${src}" ]; then +- iptables --wait -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src +- logger -t $TAG -p $FAC_PRIO \ +- "snat- $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src" +- else +- logger -t $TAG -p $FAC_PRIO \ +- "Cannot remove NAT rule because no IP of the IPFire does match the subnet." +- fi +- +- # Flush routing cache +- ip route flush cache + ;; + # + # IPv6 diff --git a/src/scripts/ipsec-interfaces b/src/scripts/ipsec-interfaces index cb55fdf79..2546f8927 100644 --- a/src/scripts/ipsec-interfaces +++ b/src/scripts/ipsec-interfaces @@ -23,9 +23,19 @@ shopt -s nullglob VPN_CONFIG="/var/ipfire/vpn/config" +ROUTE_TABLE="220" +ROUTE_TABLE_PRIO="128" + eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings) +# Get RED interface name +if [ -r "/var/ipfire/red/iface" ]; then + RED_INTF="$(</var/ipfire/red/iface)" +else + RED_INTF="red0" +fi + VARS=( id status name lefthost type ctype psk local local_id leftsubnets remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 @@ -43,6 +53,52 @@ resolve_hostname() { dig +short A "${hostname}" | tail -n1 } +ip_encode() { + local address="${1}" + + local int=0 + for field in ${address//./ }; do + int=$(( $(( ${int} << 8 )) | ${field} )) + done + + echo ${int} +} + +function ip_in_subnet() { + local address="${1}" + local subnet="${2}" + + local netmask="${subnet#*/}" + + # Convert netmask to prefix if necessary + case "${netmask}" in + [0-9]+) + ;; + *) + netmask="$(netmask2prefix "${netmask}")" + ;; + esac + + local vlsm=$(( -1 << $(( 32 - ${netmask} )) )) + + [ "$(( $(ip_encode "${address}") & ${vlsm} ))" -eq "$(( $(ip_encode "${subnet%/*}") & ${vlsm} ))" ] +} + +netmask2prefix() { + local netmask="${1}" + local mask="$(ip_encode "${netmask}")" + + local cidr=0 + local x="$(( 128 << 24 ))" # 0x80000000 + + while [ $(( ${x} & ${mask} )) -ne 0 ]; do + [ ${mask} -eq ${x} ] && mask=0 || mask=$(( ${mask} << 1 )) + cidr=$(( ${cidr} + 1 )) + done + + echo "${cidr}" +} + main() { # Register local variables local "${VARS[@]}" @@ -50,8 +106,17 @@ main() { local interfaces=() + # Flush IPsec routes + ip route flush table "${ROUTE_TABLE}" + + # Remove lookups + ip rule del lookup "${ROUTE_TABLE}" + # We are done when IPsec is not enabled if [ "${ENABLED}" = "on" ]; then + # Enable route table lookup + ip rule add lookup "${ROUTE_TABLE}" prio "${ROUTE_TABLE_PRIO}" + while IFS="," read -r "${VARS[@]}"; do # Check if the connection is enabled [ "${status}" = "on" ] || continue @@ -65,6 +130,38 @@ main() { local intf="${interface_mode}${id}" ;; *) + # Install routes + local address + + local _address + for _address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do + local leftsubnet + for leftsubnet in ${leftsubnets//\|/ }; do + if ip_in_subnet "${_address}" "${leftsubnet}"; then + address="${_address}" + break + fi + done + + # End loop when address is set + [ -n "${address}" ] && break + done + + local rightsubnet + for rightsubnet in ${rightsubnets//\|/ }; do + # Ignore default + case "${rightsubnet}" in + 0.0.0.0/*) + continue + ;; + esac + + log "Creating route to ${rightsubnet} (via ${address} and ${RED_INTF})" + ip route add table "${ROUTE_TABLE}" "${rightsubnet}" proto static \ + dev "${RED_INTF}" src "${address}" + done + + # No interface processing required continue ;; esac hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. c557356ea4878f7f6d0d9431246bfc8e75018672
by Michael Tremer 08 Apr '19

08 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via c557356ea4878f7f6d0d9431246bfc8e75018672 (commit) from 0265f51e9f5b2635e9df6243f913d6043cde0af6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c557356ea4878f7f6d0d9431246bfc8e75018672 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 8 11:56:58 2019 +0100 core130: Ship perl-Net-SSLeay This was still using the old version of OpenSSL. Instead of linking the module (which we should have found earlier) the module uses dlopen :( Fixes: #12044 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/120 => core/130}/filelists/Net_SSLeay | 0 1 file changed, 0 insertions(+), 0 deletions(-) copy config/rootfiles/{oldcore/120 => core/130}/filelists/Net_SSLeay (100%) Difference in files: diff --git a/config/rootfiles/core/130/filelists/Net_SSLeay b/config/rootfiles/core/130/filelists/Net_SSLeay new file mode 120000 index 000000000..13fe0560c --- /dev/null +++ b/config/rootfiles/core/130/filelists/Net_SSLeay @@ -0,0 +1 @@ +../../../common/Net_SSLeay \ No newline at end of file hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0265f51e9f5b2635e9df6243f913d6043cde0af6
by Arne Fitzenreiter 07 Apr '19

07 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0265f51e9f5b2635e9df6243f913d6043cde0af6 (commit) from ca7af382032b3542584fb07b3fabe3976063e551 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0265f51e9f5b2635e9df6243f913d6043cde0af6 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Apr 7 18:19:50 2019 +0200 core130: remove lm_sensors config the sensor search has to redone after boot the new kernel. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/130/update.sh | 3 +++ 1 file changed, 3 insertions(+) Difference in files: diff --git a/config/rootfiles/core/130/update.sh b/config/rootfiles/core/130/update.sh index 33bcafa23..a3a888663 100644 --- a/config/rootfiles/core/130/update.sh +++ b/config/rootfiles/core/130/update.sh @@ -130,6 +130,9 @@ rm -rfv \ /etc/init.d/unbound restart /etc/init.d/suricata start +# Search sensors again after reboot into the new kernel +rm -f /etc/sysconfig/lm_sensors + # Upadate Kernel version uEnv.txt if [ -e /boot/uEnv.txt ]; then sed -i -e "s/KVER=.*/KVER=${KVER}/g" /boot/uEnv.txt hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. ca7af382032b3542584fb07b3fabe3976063e551
by Arne Fitzenreiter 07 Apr '19

07 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via ca7af382032b3542584fb07b3fabe3976063e551 (commit) via 44b0afe0298941eaeca862ad14c0f965103e158c (commit) from 83c956c3c8d0bc60c2c6fa23f53bd68f6ac6d3ff (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ca7af382032b3542584fb07b3fabe3976063e551 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Apr 7 17:24:46 2019 +0200 core130: ship setup binary The setup contain a IPFire version string. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 44b0afe0298941eaeca862ad14c0f965103e158c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Apr 7 17:13:43 2019 +0200 core130: ship pakfire version update Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/130/filelists/files | 4 +++- src/pakfire/pakfire.conf | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) Difference in files: diff --git a/config/rootfiles/core/130/filelists/files b/config/rootfiles/core/130/filelists/files index 00d3cdde6..4924308dc 100644 --- a/config/rootfiles/core/130/filelists/files +++ b/config/rootfiles/core/130/filelists/files @@ -1,7 +1,6 @@ etc/system-release etc/issue srv/web/ipfire/cgi-bin/credits.cgi -var/ipfire/langs etc/collectd.conf etc/logrotate.conf etc/rc.d/init.d/collectd @@ -9,6 +8,7 @@ etc/rc.d/init.d/firewall etc/rc.d/init.d/networking/red.up/23-suricata etc/rc.d/init.d/suricata etc/syslog.conf +opt/pakfire/etc/pakfire.conf srv/web/ipfire/cgi-bin/aliases.cgi srv/web/ipfire/cgi-bin/dnsforward.cgi srv/web/ipfire/cgi-bin/ids.cgi @@ -21,10 +21,12 @@ usr/local/bin/suricatactrl usr/local/bin/update-ids-ruleset usr/sbin/convert-snort usr/sbin/unbound-dhcp-leases-bridge +usr/sbin/setup var/ipfire/backup/bin/backup.pl var/ipfire/backup/include var/ipfire/general-functions.pl var/ipfire/geoip-functions.pl var/ipfire/ids-functions.pl +var/ipfire/langs var/ipfire/menu.d/40-services.menu var/ipfire/menu.d/50-firewall.menu diff --git a/src/pakfire/pakfire.conf b/src/pakfire/pakfire.conf index 2f8f9cd6d..cfe48f575 100644 --- a/src/pakfire/pakfire.conf +++ b/src/pakfire/pakfire.conf @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 83c956c3c8d0bc60c2c6fa23f53bd68f6ac6d3ff
by Arne Fitzenreiter 07 Apr '19

07 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 83c956c3c8d0bc60c2c6fa23f53bd68f6ac6d3ff (commit) from f40cd26de2a0353fca1fdee407cfce153b16c76d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 83c956c3c8d0bc60c2c6fa23f53bd68f6ac6d3ff Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Apr 7 17:01:08 2019 +0200 core130: add kernel to updater Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: .../124 => core/130}/filelists/aarch64/linux | 0 .../130}/filelists/aarch64/linux-initrd | 0 .../130}/filelists/armv5tel/linux-initrd-kirkwood | 0 .../130}/filelists/armv5tel/linux-initrd-multi | 0 .../130}/filelists/armv5tel/linux-kirkwood | 0 .../130}/filelists/armv5tel/linux-multi | 0 .../{oldcore/100 => core/130}/filelists/i586/linux | 0 .../100 => core/130}/filelists/i586/linux-initrd | 0 .../100 => core/130}/filelists/x86_64/linux | 0 .../100 => core/130}/filelists/x86_64/linux-initrd | 0 config/rootfiles/core/130/update.sh | 86 +++++++++++++++++++++- 11 files changed, 84 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/124 => core/130}/filelists/aarch64/linux (100%) copy config/rootfiles/{oldcore/124 => core/130}/filelists/aarch64/linux-initrd (100%) copy config/rootfiles/{oldcore/121 => core/130}/filelists/armv5tel/linux-initrd-kirkwood (100%) copy config/rootfiles/{oldcore/121 => core/130}/filelists/armv5tel/linux-initrd-multi (100%) copy config/rootfiles/{oldcore/100 => core/130}/filelists/armv5tel/linux-kirkwood (100%) copy config/rootfiles/{oldcore/100 => core/130}/filelists/armv5tel/linux-multi (100%) copy config/rootfiles/{oldcore/100 => core/130}/filelists/i586/linux (100%) copy config/rootfiles/{oldcore/100 => core/130}/filelists/i586/linux-initrd (100%) copy config/rootfiles/{oldcore/100 => core/130}/filelists/x86_64/linux (100%) copy config/rootfiles/{oldcore/100 => core/130}/filelists/x86_64/linux-initrd (100%) Difference in files: diff --git a/config/rootfiles/core/130/filelists/aarch64/linux b/config/rootfiles/core/130/filelists/aarch64/linux new file mode 120000 index 000000000..3a2532bc7 --- /dev/null +++ b/config/rootfiles/core/130/filelists/aarch64/linux @@ -0,0 +1 @@ +../../../../common/aarch64/linux \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/aarch64/linux-initrd b/config/rootfiles/core/130/filelists/aarch64/linux-initrd new file mode 120000 index 000000000..8acdb0f31 --- /dev/null +++ b/config/rootfiles/core/130/filelists/aarch64/linux-initrd @@ -0,0 +1 @@ +../../../../common/aarch64/linux-initrd \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-kirkwood b/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-kirkwood new file mode 120000 index 000000000..39c5591b7 --- /dev/null +++ b/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-kirkwood @@ -0,0 +1 @@ +../../../../common/armv5tel/linux-initrd-kirkwood \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-multi b/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-multi new file mode 120000 index 000000000..0b1b4530a --- /dev/null +++ b/config/rootfiles/core/130/filelists/armv5tel/linux-initrd-multi @@ -0,0 +1 @@ +../../../../common/armv5tel/linux-initrd-multi \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-kirkwood b/config/rootfiles/core/130/filelists/armv5tel/linux-kirkwood new file mode 120000 index 000000000..72171071e --- /dev/null +++ b/config/rootfiles/core/130/filelists/armv5tel/linux-kirkwood @@ -0,0 +1 @@ +../../../../common/armv5tel/linux-kirkwood \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/armv5tel/linux-multi b/config/rootfiles/core/130/filelists/armv5tel/linux-multi new file mode 120000 index 000000000..204eb4c43 --- /dev/null +++ b/config/rootfiles/core/130/filelists/armv5tel/linux-multi @@ -0,0 +1 @@ +../../../../common/armv5tel/linux-multi \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/i586/linux b/config/rootfiles/core/130/filelists/i586/linux new file mode 120000 index 000000000..693ec4bbf --- /dev/null +++ b/config/rootfiles/core/130/filelists/i586/linux @@ -0,0 +1 @@ +../../../../common/i586/linux \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/i586/linux-initrd b/config/rootfiles/core/130/filelists/i586/linux-initrd new file mode 120000 index 000000000..32a03e6a9 --- /dev/null +++ b/config/rootfiles/core/130/filelists/i586/linux-initrd @@ -0,0 +1 @@ +../../../../common/i586/linux-initrd \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/x86_64/linux b/config/rootfiles/core/130/filelists/x86_64/linux new file mode 120000 index 000000000..0615b5b9a --- /dev/null +++ b/config/rootfiles/core/130/filelists/x86_64/linux @@ -0,0 +1 @@ +../../../../common/x86_64/linux \ No newline at end of file diff --git a/config/rootfiles/core/130/filelists/x86_64/linux-initrd b/config/rootfiles/core/130/filelists/x86_64/linux-initrd new file mode 120000 index 000000000..1b9fff70f --- /dev/null +++ b/config/rootfiles/core/130/filelists/x86_64/linux-initrd @@ -0,0 +1 @@ +../../../../common/x86_64/linux-initrd \ No newline at end of file diff --git a/config/rootfiles/core/130/update.sh b/config/rootfiles/core/130/update.sh index f2252ccd8..33bcafa23 100644 --- a/config/rootfiles/core/130/update.sh +++ b/config/rootfiles/core/130/update.sh @@ -26,11 +26,59 @@ core=130 +exit_with_error() { + # Set last succesfull installed core. + echo $(($core-1)) > /opt/pakfire/db/core/mine + # don't start pakfire again at error + killall -KILL pak_update + /usr/bin/logger -p syslog.emerg -t ipfire \ + "core-update-${core}: $1" + exit $2 +} + # Remove old core updates from pakfire cache to save space... for (( i=1; i<=$core; i++ )); do rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire done +KVER="xxxKVERxxx" + +# Backup uEnv.txt if exist +if [ -e /boot/uEnv.txt ]; then + cp -vf /boot/uEnv.txt /boot/uEnv.txt.org +fi + +# Do some sanity checks. +case $(uname -r) in + *-ipfire*) + # Ok. + ;; + *) + exit_with_error "ERROR cannot update. No IPFire Kernel." 1 + ;; +esac + +# Check diskspace on root +ROOTSPACE=`df / -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1` + +if [ $ROOTSPACE -lt 80000 ]; then + exit_with_error "ERROR cannot update because not enough free space on root." 2 + exit 2 +fi + +# Remove the old kernel +rm -rf /boot/System.map-* +rm -rf /boot/config-* +rm -rf /boot/ipfirerd-* +rm -rf /boot/initramfs-* +rm -rf /boot/vmlinuz-* +rm -rf /boot/uImage-*-ipfire-* +rm -rf /boot/zImage-*-ipfire-* +rm -rf /boot/uInit-*-ipfire-* +rm -rf /boot/dtb-*-ipfire-* +rm -rf /lib/modules +rm -f /etc/sysconfig/lm_sensors + # Stop services /etc/init.d/snort stop if [ -e "/etc/init.d/suricata" ]; then @@ -82,8 +130,42 @@ rm -rfv \ /etc/init.d/unbound restart /etc/init.d/suricata start -# This update needs a reboot... -touch /var/run/need_reboot +# Upadate Kernel version uEnv.txt +if [ -e /boot/uEnv.txt ]; then + sed -i -e "s/KVER=.*/KVER=${KVER}/g" /boot/uEnv.txt +fi + +# call user update script (needed for some arm boards) +if [ -e /boot/pakfire-kernel-update ]; then + /boot/pakfire-kernel-update ${KVER} +fi + +case "$(uname -m)" in + i?86) + # Force (re)install pae kernel if pae is supported + rm -rf /opt/pakfire/db/installed/meta-linux-pae + rm -rf /opt/pakfire/db/rootfiles/linux-pae + if [ ! "$(grep "^flags.* pae " /proc/cpuinfo)" == "" ]; then + ROOTSPACE=`df / -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1` + BOOTSPACE=`df /boot -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1` + if [ $BOOTSPACE -lt 22000 -o $ROOTSPACE -lt 120000 ]; then + /usr/bin/logger -p syslog.emerg -t ipfire \ + "core-update-${core}: WARNING not enough space for pae kernel." + touch /var/run/need_reboot + else + echo "Name: linux-pae" > /opt/pakfire/db/installed/meta-linux-pae + echo "ProgVersion: 0" >> /opt/pakfire/db/installed/meta-linux-pae + echo "Release: 0" >> /opt/pakfire/db/installed/meta-linux-pae + fi + else + touch /var/run/need_reboot + fi + ;; + *) + # This update needs a reboot... + touch /var/run/need_reboot + ;; +esac # Finish /etc/init.d/fireinfo start hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f40cd26de2a0353fca1fdee407cfce153b16c76d
by Michael Tremer 06 Apr '19

06 Apr '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via f40cd26de2a0353fca1fdee407cfce153b16c76d (commit) via ee44d509b61eea858e38e8a4f1f57db6f9940cf3 (commit) from f903d3a6f0c4a3f2e5251fda7ea2d1b788606294 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f40cd26de2a0353fca1fdee407cfce153b16c76d Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Apr 6 06:04:00 2019 +0000 Postfix: update to 3.4.5 See http://www.postfix.org/announcements/postfix-3.4.5.html for release notes. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit ee44d509b61eea858e38e8a4f1f57db6f9940cf3 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Fri Apr 5 21:55:12 2019 +0200 wget: Update to 1.20.3 For details see: https://fossies.org/linux/wget/ChangeLog Excerpt from "NEWS": "2019-04-05 Tim Ruehsen <tim.ruehsen(a)gmx.de> Fix a buffer overflow vulnerability * src/iri.c(do_conversion): Reallocate the output buffer to a larger size if it is already full" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/postfix | 6 +++--- lfs/wget | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) Difference in files: diff --git a/lfs/postfix b/lfs/postfix index c34162d41..41ac90879 100644 --- a/lfs/postfix +++ b/lfs/postfix @@ -24,7 +24,7 @@ include Config -VER = 3.4.3 +VER = 3.4.5 THISAPP = postfix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = postfix -PAK_VER = 19 +PAK_VER = 20 DEPS = "" @@ -66,7 +66,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 7f539d5497f4cb0c3f5b66227aaeb561 +$(DL_FILE)_MD5 = 093109941095390562166de766d4720d install : $(TARGET) diff --git a/lfs/wget b/lfs/wget index ac2fa826c..00ca75033 100644 --- a/lfs/wget +++ b/lfs/wget @@ -24,7 +24,7 @@ include Config -VER = 1.20.2 +VER = 1.20.3 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2692f6678e93601441306b5c1fc6a77a +$(DL_FILE)_MD5 = db4e6dc7977cbddcd543b240079a4899 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM April 2019