IPFire-SCM May 2019

ipfire-scm@lists.ipfire.org

1 participants
60 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 939f227e0b5275ac7deea30256a3a11b2b81e99a
by Michael Tremer 08 May '19

08 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 939f227e0b5275ac7deea30256a3a11b2b81e99a (commit) via 1dcf513a4134080e68bf845177d076ee3f60bbf5 (commit) via a49417497985c3675f4aa59367a40eda0d90fd82 (commit) from d2b54a312f520291539637ac891b874dd34ef436 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 939f227e0b5275ac7deea30256a3a11b2b81e99a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed May 8 12:14:46 2019 +0100 core132: Ship VLAN GUI Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 1dcf513a4134080e68bf845177d076ee3f60bbf5 Author: Florian Bührle <florian.buehrle(a)ipfire.org> Date: Wed May 8 11:56:18 2019 +0100 webif: Add a GUI for configuring VLAN interfaces This patch adds a new CGI file which allows users to edit the VLAN configuration as well as configuring zones as bridges. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit a49417497985c3675f4aa59367a40eda0d90fd82 Author: Florian Bührle <florian.buehrle(a)ipfire.org> Date: Wed May 8 11:43:11 2019 +0100 udev: Accept MAC addresses for PARENT_DEV This allows us to create VLAN interfaces even when the name of the parent interface might vary. This patch also appends the VLAN tag to interfaces when the zone is in bridge mode. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/network-functions.pl | 42 +++ config/menu/30-network.menu | 5 + config/rootfiles/core/132/filelists/files | 3 + config/udev/network-hotplug-vlan | 27 +- doc/language_issues.de | 13 + doc/language_issues.en | 1 + doc/language_issues.es | 1 + doc/language_issues.fr | 1 + doc/language_issues.it | 1 + doc/language_issues.nl | 1 + doc/language_issues.pl | 1 + doc/language_issues.ru | 1 + doc/language_issues.tr | 1 + doc/language_missings | 98 +++++++ html/cgi-bin/zoneconf.cgi | 444 ++++++++++++++++++++++++++++++ langs/de/cgi-bin/de.pl | 14 + langs/en/cgi-bin/en.pl | 14 + 17 files changed, 660 insertions(+), 8 deletions(-) create mode 100644 html/cgi-bin/zoneconf.cgi Difference in files: diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index 2902aabb0..8649d0502 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -402,6 +402,48 @@ sub get_hardware_address($) { return $ret; } +sub get_nic_property { + my $nicname = shift; + my $property = shift; + my $result; + + open(FILE, "/sys/class/net/$nicname/$property") or die("Could not read property"); + $result = <FILE>; + close(FILE); + + chomp($result); + + return $result; +} + +sub valid_mac($) { + my $mac = shift; + + return $mac =~ /^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$/; +} + +sub random_mac { + my $address = "02"; + + for my $i (0 .. 4) { + $address = sprintf("$address:%02x", int(rand(255))); + } + + return $address; +} + +sub get_mac_by_name($) { + my $mac = shift; + + if ((!&valid_mac($mac)) && ($mac ne "")) { + if (-e "/sys/class/net/$mac/") { + $mac = get_nic_property($mac, "address"); + } + } + + return $mac; +} + 1; # Remove the next line to enable the testsuite diff --git a/config/menu/30-network.menu b/config/menu/30-network.menu index 9b27de872..629411786 100644 --- a/config/menu/30-network.menu +++ b/config/menu/30-network.menu @@ -3,6 +3,11 @@ 'title' => "$Lang::tr{'net config'}", 'enabled' => 0, }; + $subnetwork->{'11.zoneconf'} = {'caption' => "$Lang::tr{'zoneconf title'}", + 'uri' => '/cgi-bin/zoneconf.cgi', + 'title' => "$Lang::tr{'zoneconf title'}", + 'enabled' => 1, + }; $subnetwork->{'20.proxy'} = {'caption' => "$Lang::tr{'web proxy'}", 'uri' => '/cgi-bin/proxy.cgi', 'title' => "$Lang::tr{'web proxy'}", diff --git a/config/rootfiles/core/132/filelists/files b/config/rootfiles/core/132/filelists/files index 1411d6c90..9efd7a429 100644 --- a/config/rootfiles/core/132/filelists/files +++ b/config/rootfiles/core/132/filelists/files @@ -8,7 +8,10 @@ opt/pakfire/pakfire srv/web/ipfire/cgi-bin/credits.cgi srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/proxy.cgi +srv/web/ipfire/cgi-bin/zoneconf.cgi usr/lib/firewall/rules.pl usr/sbin/convert-snort var/ipfire/ids-functions.pl var/ipfire/langs +var/ipfire/menu.d/30-network.menu +var/ipfire/network-functions.pl diff --git a/config/udev/network-hotplug-vlan b/config/udev/network-hotplug-vlan index f7b6a9de1..178e1a67b 100644 --- a/config/udev/network-hotplug-vlan +++ b/config/udev/network-hotplug-vlan @@ -23,40 +23,51 @@ [ -n "${INTERFACE}" ] || exit 2 -CONFIG_FILE="/var/ipfire/ethernet/vlans" +VLAN_CONFIG_FILE="/var/ipfire/ethernet/vlans" +MAIN_CONFIG_FILE="/var/ipfire/ethernet/settings" -# Skip immediately if no configuration file has been found. -[ -e "${CONFIG_FILE}" ] || exit 0 +# Skip immediately if a configuration file is missing. +[ -e "${VLAN_CONFIG_FILE}" ] && [ -e "${MAIN_CONFIG_FILE}" ] || exit 0 -eval $(/usr/local/bin/readhash ${CONFIG_FILE}) +eval $(/usr/local/bin/readhash ${VLAN_CONFIG_FILE}) +eval $(/usr/local/bin/readhash ${MAIN_CONFIG_FILE}) for interface in green0 red0 blue0 orange0; do case "${interface}" in green*) + ZONE_MODE=${GREEN_MODE} PARENT_DEV=${GREEN_PARENT_DEV} VLAN_ID=${GREEN_VLAN_ID} MAC_ADDRESS=${GREEN_MAC_ADDRESS} ;; red*) + ZONE_MODE=${RED_MODE} PARENT_DEV=${RED_PARENT_DEV} VLAN_ID=${RED_VLAN_ID} MAC_ADDRESS=${RED_MAC_ADDRESS} ;; blue*) + ZONE_MODE=${BLUE_MODE} PARENT_DEV=${BLUE_PARENT_DEV} VLAN_ID=${BLUE_VLAN_ID} MAC_ADDRESS=${BLUE_MAC_ADDRESS} ;; orange*) + ZONE_MODE=${ORANGE_MODE} PARENT_DEV=${ORANGE_PARENT_DEV} VLAN_ID=${ORANGE_VLAN_ID} MAC_ADDRESS=${ORANGE_MAC_ADDRESS} ;; esac - # If the parent device does not match the interface that + # If the parent device (MAC or name) does not match the interface that # has just come up, we will go on for the next one. - [ "${PARENT_DEV}" = "${INTERFACE}" ] || continue + [ "${PARENT_DEV}" = "${INTERFACE}" ] || [ "${PARENT_DEV}" = "$(</sys/class/net/${INTERFACE}/address)" ] || continue + + # If the current zone is operating in bridge mode, give the VLAN interface a generic name (e.g. eth0.99 for VLAN 99 on eth0) + if [ "${ZONE_MODE}" = "bridge" ]; then + interface="${INTERFACE}.${VLAN_ID}" + fi # Check if the interface does already exists. # If so, we skip creating it. @@ -71,7 +82,7 @@ for interface in green0 red0 blue0 orange0; do fi # Build command line. - command="ip link add link ${PARENT_DEV} name ${interface}" + command="ip link add link ${INTERFACE} name ${interface}" if [ -n "${MAC_ADDRESS}" ]; then command="${command} address ${MAC_ADDRESS}" fi @@ -81,7 +92,7 @@ for interface in green0 red0 blue0 orange0; do ${command} # Bring up the parent device. - ip link set ${PARENT_DEV} up + ip link set ${INTERFACE} up done exit 0 diff --git a/doc/language_issues.de b/doc/language_issues.de index 5f7bf7b5f..b250a35e9 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -237,6 +237,7 @@ WARNING: translation string unused: err rs 1 WARNING: translation string unused: err rs 6 decrypt WARNING: translation string unused: err rs 7 untartst WARNING: translation string unused: err rs 8 untar +WARNING: translation string unused: error WARNING: translation string unused: error config WARNING: translation string unused: error external access WARNING: translation string unused: esp encryption @@ -734,6 +735,18 @@ WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert WARNING: translation string unused: year-graph WARNING: translation string unused: yearly firewallhits +WARNING: translation string unused: zoneconf access native +WARNING: translation string unused: zoneconf access none +WARNING: translation string unused: zoneconf access vlan +WARNING: translation string unused: zoneconf nic assignment +WARNING: translation string unused: zoneconf nicmode bridge +WARNING: translation string unused: zoneconf nicmode default +WARNING: translation string unused: zoneconf nicmode macvtap +WARNING: translation string unused: zoneconf val native assignment error +WARNING: translation string unused: zoneconf val ppp assignment error +WARNING: translation string unused: zoneconf val vlan amount assignment error +WARNING: translation string unused: zoneconf val vlan tag assignment error +WARNING: translation string unused: zoneconf warning incorrect configuration WARNING: untranslated string: Scan for Songs = unknown string WARNING: untranslated string: addons = Addons WARNING: untranslated string: bytes = unknown string diff --git a/doc/language_issues.en b/doc/language_issues.en index 498bf4078..f24551945 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -2199,3 +2199,4 @@ WARNING: untranslated string: yes = Yes WARNING: untranslated string: you can only define one roadwarrior connection when using pre-shared key authentication = You can only define one Roadwarrior connection when using pre-shared key authentication.<br />Either you already have a Roadwarrior connection with pre-shared key authentication, or you're trying to add one now. WARNING: untranslated string: your department = Your department WARNING: untranslated string: your e-mail = Your e-mail address +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_issues.es b/doc/language_issues.es index f3b695f24..41833da1f 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -1371,3 +1371,4 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules! WARNING: untranslated string: wlanap ssid = SSID +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_issues.fr b/doc/language_issues.fr index af1f15ab7..46780db36 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -885,3 +885,4 @@ WARNING: untranslated string: wlanap broadcast ssid = Broadcast SSID WARNING: untranslated string: wlanap client isolation = Client Isolation WARNING: untranslated string: wlanap management frame protection = Management Frame Protection (802.11w) WARNING: untranslated string: wlanap ssid = SSID +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_issues.it b/doc/language_issues.it index 5da8a8dd7..9d3e0e808 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -1038,3 +1038,4 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules! WARNING: untranslated string: wlanap ssid = SSID +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 6be2cb6b2..69cefe1f9 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -1084,3 +1084,4 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules! WARNING: untranslated string: wlanap ssid = SSID +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_issues.pl b/doc/language_issues.pl index f3b695f24..41833da1f 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -1371,3 +1371,4 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules! WARNING: untranslated string: wlanap ssid = SSID +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 53a655c99..b769c7574 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -1366,3 +1366,4 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules! WARNING: untranslated string: wlanap ssid = SSID +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 88baad746..6a6893abe 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -901,3 +901,4 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules! WARNING: untranslated string: wlanap ssid = SSID +WARNING: untranslated string: zoneconf title = Zone Configuration diff --git a/doc/language_missings b/doc/language_missings index 354dbb32f..0f3c2a724 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -273,6 +273,7 @@ < encryption < entropy < entropy graphs +< error < fifteen minutes < fireinfo ipfire version < fireinfo is disabled @@ -846,6 +847,19 @@ < wlan client wpa mode ccmp ccmp < wlan client wpa mode ccmp tkip < wlan client wpa mode tkip tkip +< zoneconf access native +< zoneconf access none +< zoneconf access vlan +< zoneconf nic assignment +< zoneconf nicmode bridge +< zoneconf nicmode default +< zoneconf nicmode macvtap +< zoneconf title +< zoneconf val native assignment error +< zoneconf val ppp assignment error +< zoneconf val vlan amount assignment error +< zoneconf val vlan tag assignment error +< zoneconf warning incorrect configuration ############################################################################ # Checking cgi-bin translations for language: fr # ############################################################################ @@ -865,6 +879,7 @@ < dnsforward dnssec disabled < dns forwarding dnssec disabled notice < emerging pro rules +< error < generate ptr < ids apply < ids apply ruleset changes @@ -912,6 +927,19 @@ < wlanap client isolation < wlanap management frame protection < wlanap ssid +< zoneconf access native +< zoneconf access none +< zoneconf access vlan +< zoneconf nic assignment +< zoneconf nicmode bridge +< zoneconf nicmode default +< zoneconf nicmode macvtap +< zoneconf title +< zoneconf val native assignment error +< zoneconf val ppp assignment error +< zoneconf val vlan amount assignment error +< zoneconf val vlan tag assignment error +< zoneconf warning incorrect configuration ############################################################################ # Checking cgi-bin translations for language: it # ############################################################################ @@ -1027,6 +1055,7 @@ < email tls < email usemail < emerging pro rules +< error < fifteen minutes < firewall graph country < firewall graph ip @@ -1189,6 +1218,19 @@ < wlan client password < wlan client tls cipher < wlan client tls version +< zoneconf access native +< zoneconf access none +< zoneconf access vlan +< zoneconf nic assignment +< zoneconf nicmode bridge +< zoneconf nicmode default +< zoneconf nicmode macvtap +< zoneconf title +< zoneconf val native assignment error +< zoneconf val ppp assignment error +< zoneconf val vlan amount assignment error +< zoneconf val vlan tag assignment error +< zoneconf warning incorrect configuration ############################################################################ # Checking cgi-bin translations for language: nl # ############################################################################ @@ -1322,6 +1364,7 @@ < email tls < email usemail < emerging pro rules +< error < fifteen minutes < firewall graph country < firewall graph ip @@ -1524,6 +1567,19 @@ < wlan client password < wlan client tls cipher < wlan client tls version +< zoneconf access native +< zoneconf access none +< zoneconf access vlan +< zoneconf nic assignment +< zoneconf nicmode bridge +< zoneconf nicmode default +< zoneconf nicmode macvtap +< zoneconf title +< zoneconf val native assignment error +< zoneconf val ppp assignment error +< zoneconf val vlan amount assignment error +< zoneconf val vlan tag assignment error +< zoneconf warning incorrect configuration ############################################################################ # Checking cgi-bin translations for language: pl # ############################################################################ @@ -1740,6 +1796,7 @@ < encryption < entropy < entropy graphs +< error < extrahd because there is already a device mounted < extrahd cant umount < extrahd install or load driver @@ -2299,6 +2356,19 @@ < wlan client wpa mode ccmp ccmp < wlan client wpa mode ccmp tkip < wlan client wpa mode tkip tkip +< zoneconf access native +< zoneconf access none +< zoneconf access vlan +< zoneconf nic assignment +< zoneconf nicmode bridge +< zoneconf nicmode default +< zoneconf nicmode macvtap +< zoneconf title +< zoneconf val native assignment error +< zoneconf val ppp assignment error +< zoneconf val vlan amount assignment error +< zoneconf val vlan tag assignment error +< zoneconf warning incorrect configuration ############################################################################ # Checking cgi-bin translations for language: ru # ############################################################################ @@ -2519,6 +2589,7 @@ < encryption < entropy < entropy graphs +< error < extrahd because there is already a device mounted < extrahd cant umount < extrahd install or load driver @@ -3081,6 +3152,19 @@ < wlan client wpa mode ccmp tkip < wlan client wpa mode tkip tkip < year-graph +< zoneconf access native +< zoneconf access none +< zoneconf access vlan +< zoneconf nic assignment +< zoneconf nicmode bridge +< zoneconf nicmode default +< zoneconf nicmode macvtap +< zoneconf title +< zoneconf val native assignment error +< zoneconf val ppp assignment error +< zoneconf val vlan amount assignment error +< zoneconf val vlan tag assignment error +< zoneconf warning incorrect configuration ############################################################################ # Checking cgi-bin translations for language: tr # ############################################################################ @@ -3103,6 +3187,7 @@ < dnsforward forward_servers < dns forwarding dnssec disabled notice < emerging pro rules +< error < fwdfw all subnets < generate ptr < ids apply @@ -3163,3 +3248,16 @@ < wlanap neighbor scan < wlanap neighbor scan warning < wlanap ssid +< zoneconf access native +< zoneconf access none +< zoneconf access vlan +< zoneconf nic assignment +< zoneconf nicmode bridge +< zoneconf nicmode default +< zoneconf nicmode macvtap +< zoneconf title +< zoneconf val native assignment error +< zoneconf val ppp assignment error +< zoneconf val vlan amount assignment error +< zoneconf val vlan tag assignment error +< zoneconf warning incorrect configuration diff --git a/html/cgi-bin/zoneconf.cgi b/html/cgi-bin/zoneconf.cgi new file mode 100644 index 000000000..69a988bf2 --- /dev/null +++ b/html/cgi-bin/zoneconf.cgi @@ -0,0 +1,444 @@ +#!/usr/bin/perl +############################################################################### +# # +# VLAN Management for IPFire # +# Copyright (C) 2019 Florian Bührle <fbuehrle(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; +use Scalar::Util qw(looks_like_number); + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + +my $css = <<END +<style> + table { + width: 100%; + } + + tr { + height: 4em; + } + + td:first-child { + width: 1px; + } + + td { + padding: 5px; + padding-left: 10px; + padding-right: 10px; + border: 0.5px solid black; + } + + table { + border-collapse: collapse; + } + + td.h { + background-color: grey; + color: white; + font-weight: 800; + } + + td.green { + background-color: $Header::colourgreen; + } + + td.red { + background-color: $Header::colourred; + } + + td.blue { + background-color: $Header::colourblue; + } + + td.orange { + background-color: $Header::colourorange; + } + + td.topleft { + background-color: white; + border-top-style: none; + border-left-style: none; + } + + td.disabled { + background-color: #cccccc; + } + + td.textcenter { + text-align: center; + } + + #submit-container { + display: flex; + width: 100%; + justify-content: space-between; + padding-top: 20px; + text-align: left; + } + + #submit-container.input { + margin-left: auto; + } + + button { + margin-top: 1em; + } + +</style> +END +; + +my %ethsettings = (); +my %vlansettings = (); +my %cgiparams = (); + +&General::readhash("${General::swroot}/ethernet/settings",\%ethsettings); +&General::readhash("${General::swroot}/ethernet/vlans",\%vlansettings); + +&Header::getcgihash(\%cgiparams); +&Header::showhttpheaders(); + +# Define all zones we will check for NIC assignment +my @zones = ("green", "red", "orange", "blue"); + +# Get all physical NICs present +opendir(my $dh, "/sys/class/net/"); +my @nics = (); + +while (my $nic = readdir($dh)) { + if (-e "/sys/class/net/$nic/device") { # Indicates that the NIC is physical + push(@nics, [&Network::get_nic_property($nic, "address"), $nic, 0]); + } +} + +closedir($dh); + +@nics = sort {$a->[0] cmp $b->[0]} @nics; # Sort nics by their MAC address + +# Name the physical NICs +# Even though they may not be really named like this, we will name them ethX or wlanX +my $ethcount = 0; +my $wlancount = 0; + +foreach (@nics) { + my $nic = $_->[1]; + + if (-e "/sys/class/net/$nic/wireless") { + $_->[1] = "wlan$wlancount"; + $_->[2] = 1; + $wlancount++; + } else { + $_->[1] = "eth$ethcount"; + $ethcount++; + } +} + +&Header::openpage($Lang::tr{"zoneconf title"}, 1, $css); +&Header::openbigbox('100%', 'center'); + +### Evaluate POST parameters ### + +if ($cgiparams{"ACTION"} eq $Lang::tr{"save"}) { + my %VALIDATE_nic_check = (); + my $VALIDATE_error = ""; + + foreach (@zones) { + my $uc = uc $_; + my $slave_string = ""; + my $zone_mode = $cgiparams{"MODE $uc"}; + my $VALIDATE_vlancount = 0; + + $ethsettings{"${uc}_MACADDR"} = ""; + $ethsettings{"${uc}_MODE"} = ""; + $ethsettings{"${uc}_SLAVES"} = ""; + $vlansettings{"${uc}_PARENT_DEV"} = ""; + $vlansettings{"${uc}_VLAN_ID"} = ""; + $vlansettings{"${uc}_MAC_ADDRESS"} = ""; + + # If RED is not in DHCP or static mode, we only set its MACADDR property + if ($uc eq "RED" && ! $cgiparams{"PPPACCESS"} eq "") { + foreach (@nics) { + my $mac = $_->[0]; + + if ($mac eq $cgiparams{"PPPACCESS"}) { + $ethsettings{"${uc}_MACADDR"} = $mac; + + # Check if this interface is already accessed by any other zone + # If this is the case, show an error message + if ($VALIDATE_nic_check{"ACC $mac"}) { + $VALIDATE_error = $Lang::tr{"zoneconf val ppp assignment error"}; + } + + $VALIDATE_nic_check{"RESTRICT $mac"} = 1; + last; + } + } + + next; + } + + foreach (@nics) { + my $mac = $_->[0]; + my $nic_access = $cgiparams{"ACCESS $uc $mac"}; + + if (! ($nic_access eq "NONE")) { + if ($VALIDATE_nic_check{"RESTRICT $mac"}) { # If this interface is already assigned to RED in PPP mode, throw an error + $VALIDATE_error = $Lang::tr{"zoneconf val ppp assignment error"}; + next; + } + + $VALIDATE_nic_check{"ACC $mac"} = 1; + } + + if ($nic_access eq "NATIVE") { + if ($VALIDATE_nic_check{"NATIVE $mac"}) { + $VALIDATE_error = $Lang::tr{"zoneconf val native assignment error"}; + next; + } + + $VALIDATE_nic_check{"NATIVE $mac"} = 1; + + if ($zone_mode eq "BRIDGE") { + $slave_string = "${slave_string}${mac} "; + } else { + $ethsettings{"${uc}_MACADDR"} = $mac; + } + } elsif ($nic_access eq "VLAN") { + my $vlan_tag = $cgiparams{"TAG $uc $mac"}; + + if ($VALIDATE_nic_check{"VLAN $mac $vlan_tag"}) { + $VALIDATE_error = $Lang::tr{"zoneconf val vlan tag assignment error"}; + next; + } + + $VALIDATE_nic_check{"VLAN $mac $vlan_tag"} = 1; + + if (! looks_like_number($vlan_tag)) { + next; + } + if ($vlan_tag < 1 || $vlan_tag > 4095) { + next; + } + + my $rnd_mac = &Network::random_mac(); + + $vlansettings{"${uc}_PARENT_DEV"} = $mac; + $vlansettings{"${uc}_VLAN_ID"} = $vlan_tag; + $vlansettings{"${uc}_MAC_ADDRESS"} = $rnd_mac; + + if ($zone_mode eq "BRIDGE") { + $slave_string = "${slave_string}${rnd_mac} "; + } + + $VALIDATE_vlancount++; # We can't allow more than one VLAN per zone + } + } + + if ($VALIDATE_vlancount > 1) { + $VALIDATE_error = $Lang::tr{"zoneconf val vlan amount assignment error"}; + next; + } + + chop($slave_string); + + if ($zone_mode eq "BRIDGE") { + $ethsettings{"${uc}_MODE"} = "bridge"; + $ethsettings{"${uc}_SLAVES"} = $slave_string; + } elsif ($zone_mode eq "MACVTAP") { + $ethsettings{"${uc}_MODE"} = "macvtap"; + } + } + + if ($VALIDATE_error) { + &Header::openbox('100%', 'left', $Lang::tr{"error"}); + + print "$VALIDATE_error<br><a href='/cgi-bin/zoneconf.cgi'><button>$Lang::tr{'ok'}</button></a>"; + + &Header::closebox(); + &Header::closebigbox(); + &Header::closepage(); + + exit 0; + } + + &General::writehash("${General::swroot}/ethernet/settings",\%ethsettings); + &General::writehash("${General::swroot}/ethernet/vlans",\%vlansettings); +} + +&Header::openbox('100%', 'left', $Lang::tr{"zoneconf nic assignment"}); + +### START OF TABLE ### + +print <<END + <form method='post' enctype='multipart/form-data'> + <table> + <tr> + <td class="h topleft" /td> +END +; + +# Fill the table header with all physical NICs +foreach (@nics) { + my $mac = $_->[0]; + my $nic = $_->[1]; + + print "<td class='h textcenter'>$nic<br>$mac</td>"; +} + +print "</tr>"; + +foreach (@zones) { + print "<tr>"; + my $uc = uc $_; + + my $dev_name = $ethsettings{"${uc}_DEV"}; + + if ($dev_name eq "") { # If the zone is not activated, color it light grey + print "<td class='h disabled'>$uc</td>"; + + foreach (@nics) { + print "<td class='disabled'/>"; + } + + print "</tr>"; + next; + } + + if ($uc eq "RED") { + my $red_type = $ethsettings{"RED_TYPE"}; + my $red_restricted = ($uc eq "RED" && ! ($red_type eq "STATIC" || $red_type eq "DHCP")); + + # VLANs/Bridging is not possible if the RED interface is set to PPP, PPPoE, VDSL, ... + if ($red_restricted) { + print "<td class='h $_'>$uc<br>($red_type)</td>"; + + foreach (@nics) { + my $mac = $_->[0]; + my $checked = ""; + + if ($mac eq $ethsettings{"${uc}_MACADDR"}) { + $checked = "checked"; + } + + print "<td class='textcenter'><input type='radio' id='PPPACCESS $mac' name='PPPACCESS' value='$mac' $checked></td>"; + } + + print "</tr>"; + next; # We're done here + } + } + + my %mode_selected = (); + my $zone_mode = $ethsettings{"${uc}_MODE"}; + + if ($zone_mode eq "") { + $mode_selected{"DEFAULT"} = "selected"; + } elsif ($zone_mode eq "bridge") { + $mode_selected{"BRIDGE"} = "selected"; + } elsif ($zone_mode eq "macvtap") { + $mode_selected{"MACVTAP"} = "selected"; + } + + print <<END + <td class='h $_'>$uc<br> + <select name="MODE $uc"> + <option value="DEFAULT" $mode_selected{"DEFAULT"}>$Lang::tr{"zoneconf nicmode default"}</option> + <option value="BRIDGE" $mode_selected{"BRIDGE"}>$Lang::tr{"zoneconf nicmode bridge"}</option> + <option value="MACVTAP" $mode_selected{"MACVTAP"}>$Lang::tr{"zoneconf nicmode macvtap"}</option> + </select> + </td> +END +; + + # ZONE_PARENT_DEV is set if this zone accesses any interface via a VLAN + my $zone_parent_dev = $vlansettings{"${uc}_PARENT_DEV"}; + + # If ZONE_PARENT_DEV is set to a NICs name (e.g. green0 or eth0) instead of a MAC address, we have to find out this NICs MAC address + $zone_parent_dev = &Network::get_mac_by_name($zone_parent_dev); + + foreach (@nics) { # Check for all nics if they are assigned to the current zone + my %access_selected = (); + my $mac = $_->[0]; + my $wlan = $_->[2]; + my $field_disabled = "disabled"; # Only enable the VLAN ID input field if the current access mode is VLAN + my $zone_vlan_id = ""; + + # If the current NIC is accessed by the current zone via a VLAN, the ZONE_PARENT_DEV option corresponds to the current NIC + if ($mac eq $zone_parent_dev) { + $access_selected{"VLAN"} = "selected"; + $field_disabled = ""; + $zone_vlan_id = $vlansettings{"${uc}_VLAN_ID"}; + } + + # If the current zone is in bridge mode, all corresponding NICs (Native as well as VLAN) are set via the ZONE_SLAVES option + if ($zone_mode eq "bridge") { + my @slaves = split(/ /, $ethsettings{"${uc}_SLAVES"}); + + foreach (@slaves) { + # Slaves can be set to a NICs name so we have to find out its MAC address + $_ = &Network::get_mac_by_name($_); + + if ($_ eq $mac) { + $access_selected{"NATIVE"} = "selected"; + last; + } + } + } else { # Native access via ZONE_MACADDR is only set if the zone does not access a NIC via a VLAN and the zone is not in bridge mode + if ($mac eq $ethsettings{"${uc}_MACADDR"}) { + $access_selected{"NATIVE"} = "selected"; + } + } + + $access_selected{"NONE"} = ($access_selected{"NATIVE"} eq "") && ($access_selected{"VLAN"} eq "") ? "selected" : ""; + my $vlan_disabled = ($wlan) ? "disabled" : ""; + + print <<END + <td class="textcenter"> + <select name="ACCESS $uc $mac" onchange="document.getElementById('TAG $uc $mac').disabled = (this.value === 'VLAN' ? false : true)"> + <option value="NATIVE" $access_selected{"NATIVE"}>$Lang::tr{"zoneconf access native"}</option> + <option value="VLAN" $access_selected{"VLAN"} $vlan_disabled>$Lang::tr{"zoneconf access vlan"}</option> + <option value="NONE" $access_selected{"NONE"}>$Lang::tr{"zoneconf access none"}</option> + </select> + <input type="number" id="TAG $uc $mac" name="TAG $uc $mac" min="1" max="4095" value="$zone_vlan_id" $field_disabled> + </td> +END +; + + } + print "</tr>"; +} + +print <<END + </table> + <div id="submit-container"> + <font color="red">$Lang::tr{"zoneconf warning incorrect configuration"}</font> + <input type="submit" name="ACTION" value="$Lang::tr{"save"}"> + </div> + </form> +END +; + +### END OF TABLE ### + +&Header::closebox(); +&Header::closebigbox(); +&Header::closepage(); diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 0fc1ecf85..dec4a9f0f 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -961,6 +961,7 @@ 'err rs 6 decrypt' => 'Fehler beim Entschlüsseln des Archivs', 'err rs 7 untartst' => 'Ungültiges entschlüsseltes Archiv', 'err rs 8 untar' => 'Fehler beim un-tar-en des Archivs', +'error' => 'Fehler', 'error config' => 'Kann /var/ipfire/ovpn/config/ZERINA.ovpn nicht öffnen!', 'error external access' => 'Kann /var/ipfire/xtaccess/config nicht öffnen (external acccess could not be granted)!', 'error messages' => 'Fehlermeldungen', @@ -2879,6 +2880,19 @@ 'you can only define one roadwarrior connection when using pre-shared key authentication' => 'Sie können nur eine Roadwarrior-Verbindung definieren, wenn die Pre-shared-Schlüsselauthentifizierung verwendet wird.<br/>Entweder haben Sie bereits eine Roadwarrior-Verbindung mit Pre-shared-Schlüsselauthentifizierung, oder Sie versuchen gerade, eine hinzuzufügen.', 'your department' => 'Ihre Abteilung', 'your e-mail' => 'Ihre E-Mail-Adresse', +'zoneconf access native' => 'Nativ', +'zoneconf access none' => 'Keine', +'zoneconf access vlan' => 'VLAN', +'zoneconf nic assignment' => 'Netzwerkkarten-Zuordnung', +'zoneconf nicmode bridge' => 'Brücke', +'zoneconf nicmode default' => 'Normal', +'zoneconf nicmode macvtap' => 'Macvtap', +'zoneconf title' => 'Zonen einrichten', +'zoneconf val native assignment error' => 'Eine Netzwerkkarte kann nicht von mehreren Zonen nativ verwendet werden.', +'zoneconf val ppp assignment error' => 'Die Netzwerkkarte, die von RED im PPP-Modus verwendet wird, kann keiner anderen Zone zugeordnet werden.', +'zoneconf val vlan amount assignment error' => 'Pro Zone kann nur ein VLAN verwendet werden.', +'zoneconf val vlan tag assignment error' => 'Pro Netzwerkkarte kann derselbe VLAN-Tag nur einmal verwendet werden.', +'zoneconf warning incorrect configuration' => 'Achtung: Fehlerhafte Einstellungen können dazu führen, dass diese Webseite nicht mehr erreichbar ist!', ); #EOF diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index d14a860f3..005a352f5 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -991,6 +991,7 @@ 'err rs 6 decrypt' => 'Error decrypting archive', 'err rs 7 untartst' => 'Invalid decrypted archive', 'err rs 8 untar' => 'Error untarring archive', +'error' => 'Error', 'error config' => 'Could not open /var/ipfire/ovpn/config/ZERINA.ovpn !', 'error external access' => 'Could not open /var/ipfire/xtaccess/config (external acccess could not be granted)!', 'error messages' => 'Error messages', @@ -2928,6 +2929,19 @@ 'you can only define one roadwarrior connection when using pre-shared key authentication' => 'You can only define one Roadwarrior connection when using pre-shared key authentication.<br />Either you already have a Roadwarrior connection with pre-shared key authentication, or you\'re trying to add one now.', 'your department' => 'Your department', 'your e-mail' => 'Your e-mail address', +'zoneconf access native' => 'Native', +'zoneconf access none' => 'None', +'zoneconf access vlan' => 'VLAN', +'zoneconf nic assignment' => 'NIC Assignment', +'zoneconf nicmode bridge' => 'Bridge', +'zoneconf nicmode default' => 'Default', +'zoneconf nicmode macvtap' => 'Macvtap', +'zoneconf title' => 'Zone Configuration', +'zoneconf val native assignment error' => 'A NIC can\'t be accessed natively by more than one zone.', +'zoneconf val ppp assignment error' => 'The NIC used for RED in PPP mode can\'t be accessed by any other zone.', +'zoneconf val vlan amount assignment error' => 'A zone can\'t have more than one VLAN assigned.', +'zoneconf val vlan tag assignment error' => 'You can\'t use the same VLAN tag more than once per NIC.', +'zoneconf warning incorrect configuration' => 'Warning: Incorrect configuration may render this web interface unreachable!', ); #EOF hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 6b19d192f93843df8e431d686d6830ebd1e93ccd
by Arne Fitzenreiter 08 May '19

08 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 6b19d192f93843df8e431d686d6830ebd1e93ccd (commit) from 34d72e754243fe86fb1772d39e1b45876b8c72f4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6b19d192f93843df8e431d686d6830ebd1e93ccd Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Tue May 7 19:17:16 2019 +0200 guardian: Remove snort related options. IPFire has moved to suricata as IDS/IPS system, therefore all snort related options has become obsolete. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/guardian/guardian.de.pl | 4 +--- config/guardian/guardian.en.pl | 4 +--- config/guardian/guardian.tr.pl | 4 +--- html/cgi-bin/guardian.cgi | 51 +++++------------------------------------- lfs/guardian | 2 +- 5 files changed, 10 insertions(+), 55 deletions(-) Difference in files: diff --git a/config/guardian/guardian.de.pl b/config/guardian/guardian.de.pl index 344d04543..c03c98525 100644 --- a/config/guardian/guardian.de.pl +++ b/config/guardian/guardian.de.pl @@ -6,7 +6,7 @@ 'guardian block httpd brute-force' => 'httpd-Brute-Force-Erkennung', 'guardian block owncloud brute-force' => 'Owncloud-Brute-Force-Erkennung', 'guardian block ssh brute-force' => 'SSH-Brute-Force-Erkennung', -'guardian blockcount' => 'Trefferschwelle (Snort)', +'guardian blockcount' => 'Trefferschwelle', 'guardian blocked hosts' => 'Aktuell geblockte Hosts', 'guardian blocking of this address is not allowed' => 'Diese Addresse darf nicht geblockt werden.', 'guardian blocktime' => 'Blockzeit (Sekunden)', @@ -36,9 +36,7 @@ 'guardian priolevel_medium' => '2 - Mittel', 'guardian priolevel_low' => '3 - Niedrig', 'guardian priolevel_very_low' => '4 - Sehr niedrig', -'guardian priority level' => 'Prioritätslevel (Snort)', 'guardian service' => 'Guardian-Dienst', -'guardian watch snort alertfile' => 'Snort-Alarme auswerten', ); diff --git a/config/guardian/guardian.en.pl b/config/guardian/guardian.en.pl index f6be8654d..c94484f7e 100644 --- a/config/guardian/guardian.en.pl +++ b/config/guardian/guardian.en.pl @@ -6,7 +6,7 @@ 'guardian block httpd brute-force' => 'httpd Brute Force Detection', 'guardian block owncloud brute-force' => 'Owncloud Brute Force detection', 'guardian block ssh brute-force' => 'SSH Brute Force Detection', -'guardian blockcount' => 'Strike Threshold (Snort)', +'guardian blockcount' => 'Strike Threshold', 'guardian blocked hosts' => 'Currently blocked hosts', 'guardian blocking of this address is not allowed' => 'Blocking of the given address is not allowed.', 'guardian blocktime' => 'Block Time (seconds)', @@ -36,9 +36,7 @@ 'guardian priolevel_medium' => '2 - Medium', 'guardian priolevel_low' => '3 - Low', 'guardian priolevel_very_low' => '4 - Very low', -'guardian priority level' => 'Priority Level (Snort)', 'guardian service' => 'Guardian Service', -'guardian watch snort alertfile' => 'Monitor Snort Alert File', ); diff --git a/config/guardian/guardian.tr.pl b/config/guardian/guardian.tr.pl index cb64a358d..c4d9c5aab 100644 --- a/config/guardian/guardian.tr.pl +++ b/config/guardian/guardian.tr.pl @@ -6,7 +6,7 @@ 'guardian block httpd brute-force' => 'httpd kaba kuvvet algılama', 'guardian block owncloud brute-force' => 'Owncloud kaba kuvvet algılama', 'guardian block ssh brute-force' => 'SSH kaba kuvvet algılama', -'guardian blockcount' => 'Vurgu eşiği (Snort)', +'guardian blockcount' => 'Vurgu eşiği', 'guardian blocked hosts' => 'Şu anda engellenen ana makineler', 'guardian blocking of this address is not allowed' => 'Verilen adresin engellenmesine izin verilmiyor.', 'guardian blocktime' => 'Engelleme zamanı (saniye)', @@ -36,9 +36,7 @@ 'guardian priolevel_medium' => '2 - Orta', 'guardian priolevel_low' => '3 - Düşük', 'guardian priolevel_very_low' => '4 - Çok düşük', -'guardian priority level' => 'Öncelik seviyesi (Snort)', 'guardian service' => 'Koruyucu servisi', -'guardian watch snort alertfile' => 'Snort uyarı dosyası', ); diff --git a/html/cgi-bin/guardian.cgi b/html/cgi-bin/guardian.cgi index 6144aca02..36d84bb5b 100644 --- a/html/cgi-bin/guardian.cgi +++ b/html/cgi-bin/guardian.cgi @@ -52,7 +52,6 @@ my $ignorefile ='/var/ipfire/guardian/guardian.ignore'; # file locations on IPFire systems. my %module_file_locations = ( "HTTPD" => "/var/log/httpd/error_log", - "SNORT" => "/var/log/snort/alert", "SSH" => "/var/log/messages", ); @@ -78,7 +77,6 @@ our %ignored = (); $settings{'ACTION'} = ''; $settings{'GUARDIAN_ENABLED'} = 'off'; -$settings{'GUARDIAN_MONITOR_SNORT'} = 'on'; $settings{'GUARDIAN_MONITOR_SSH'} = 'on'; $settings{'GUARDIAN_MONITOR_HTTPD'} = 'on'; $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = ''; @@ -88,7 +86,6 @@ $settings{'GUARDIAN_BLOCKCOUNT'} = '3'; $settings{'GUARDIAN_BLOCKTIME'} = '86400'; $settings{'GUARDIAN_FIREWALL_ACTION'} = 'DROP'; $settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log'; -$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'} = '3'; my $errormessage = ''; @@ -379,9 +376,6 @@ sub showMainBox() { $checked{'GUARDIAN_ENABLED'}{'on'} = ''; $checked{'GUARDIAN_ENABLED'}{'off'} = ''; $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked'; - $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} = ''; - $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} = ''; - $checked{'GUARDIAN_MONITOR_SNORT'}{$settings{'GUARDIAN_MONITOR_SNORT'}} = "checked='checked'"; $checked{'GUARDIAN_MONITOR_SSH'}{'off'} = ''; $checked{'GUARDIAN_MONITOR_SSH'}{'on'} = ''; $checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'"; @@ -394,7 +388,6 @@ sub showMainBox() { $selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected'; $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected'; - $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}} = 'selected'; $selected{'GUARDIAN_FIREWALL_ACTION'}{$settings{'GUARDIAN_FIREWALL_ACTION'}} = 'selected'; &Header::openpage($Lang::tr{'guardian configuration'}, 1, ''); @@ -447,19 +440,6 @@ sub showMainBox() { \$("#GUARDIAN_LOG_FACILITY").change(update_options); \$("#GUARDIAN_LOGLEVEL").change(update_options); update_options(); - - // Show / Hide snort priority level option, based if - // snort is enabled / disabled. - if (\$('input[name=GUARDIAN_MONITOR_SNORT]:checked').val() == 'on') { - \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').show(); - } else { - \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').hide(); - } - - // Show/Hide snort priority level when GUARDIAN_MONITOR_SNORT get changed. - \$('input[name=GUARDIAN_MONITOR_SNORT]').change(function() { - \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').toggle(); - }); }); </script> END @@ -533,12 +513,6 @@ END <td colspan='2'><br></td> </tr> - <tr> - <td width='25%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td> - <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='on' $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} /> / - <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='off' $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} /> off</td> - </tr> - <tr> <td width='25%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td> <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> / @@ -580,17 +554,15 @@ END <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td> </tr> - <tr class="GUARDIAN_SNORT_PRIORITY_LEVEL"> + <tr> <td colspan='2'><br></td> </tr> - <tr class="GUARDIAN_SNORT_PRIORITY_LEVEL"> - <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td> - <td><select name='GUARDIAN_SNORT_PRIORITY_LEVEL'> - <option value='1' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'1'}>$Lang::tr{'guardian priolevel_high'}</option> - <option value='2' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'2'}>$Lang::tr{'guardian priolevel_medium'}</option> - <option value='3' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'3'}>$Lang::tr{'guardian priolevel_low'}</option> - <option value='4' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'4'}>$Lang::tr{'guardian priolevel_very_low'}</option> + <tr> + <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td> + <td><select name='GUARDIAN_FIREWALL_ACTION'> + <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option> + <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option> </select></td> <td width='25%' class='base'>$Lang::tr{'guardian blockcount'}:</td> @@ -602,12 +574,6 @@ END </tr> <tr> - <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td> - <td><select name='GUARDIAN_FIREWALL_ACTION'> - <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option> - <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option> - </select></td> - <td width='25%' class='base'>$Lang::tr{'guardian blocktime'}:</td> <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td> </tr> @@ -977,11 +943,6 @@ sub BuildConfiguration() { # Module settings. print FILE "\n# Module settings.\n"; - # Check if SNORT is enabled and add snort priority. - if ($settings{'GUARDIAN_MONITOR_SNORT'} eq "on") { - print FILE "SnortPriorityLevel = $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}\n"; - } - close(FILE); # Generate ignore file. diff --git a/lfs/guardian b/lfs/guardian index 2eaf77212..d84ca64f3 100644 --- a/lfs/guardian +++ b/lfs/guardian @@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = guardian -PAK_VER = 15 +PAK_VER = 16 DEPS = "perl-inotify2 perl-Net-IP" hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. d2b54a312f520291539637ac891b874dd34ef436
by Arne Fitzenreiter 08 May '19

08 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via d2b54a312f520291539637ac891b874dd34ef436 (commit) from bf62652ecfbe1331f0eef5d198b8ac6db417a4d4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d2b54a312f520291539637ac891b874dd34ef436 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Tue May 7 19:17:16 2019 +0200 guardian: Remove snort related options. IPFire has moved to suricata as IDS/IPS system, therefore all snort related options has become obsolete. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/guardian/guardian.de.pl | 4 +--- config/guardian/guardian.en.pl | 4 +--- config/guardian/guardian.tr.pl | 4 +--- html/cgi-bin/guardian.cgi | 51 +++++------------------------------------- lfs/guardian | 2 +- 5 files changed, 10 insertions(+), 55 deletions(-) Difference in files: diff --git a/config/guardian/guardian.de.pl b/config/guardian/guardian.de.pl index 344d04543..c03c98525 100644 --- a/config/guardian/guardian.de.pl +++ b/config/guardian/guardian.de.pl @@ -6,7 +6,7 @@ 'guardian block httpd brute-force' => 'httpd-Brute-Force-Erkennung', 'guardian block owncloud brute-force' => 'Owncloud-Brute-Force-Erkennung', 'guardian block ssh brute-force' => 'SSH-Brute-Force-Erkennung', -'guardian blockcount' => 'Trefferschwelle (Snort)', +'guardian blockcount' => 'Trefferschwelle', 'guardian blocked hosts' => 'Aktuell geblockte Hosts', 'guardian blocking of this address is not allowed' => 'Diese Addresse darf nicht geblockt werden.', 'guardian blocktime' => 'Blockzeit (Sekunden)', @@ -36,9 +36,7 @@ 'guardian priolevel_medium' => '2 - Mittel', 'guardian priolevel_low' => '3 - Niedrig', 'guardian priolevel_very_low' => '4 - Sehr niedrig', -'guardian priority level' => 'Prioritätslevel (Snort)', 'guardian service' => 'Guardian-Dienst', -'guardian watch snort alertfile' => 'Snort-Alarme auswerten', ); diff --git a/config/guardian/guardian.en.pl b/config/guardian/guardian.en.pl index f6be8654d..c94484f7e 100644 --- a/config/guardian/guardian.en.pl +++ b/config/guardian/guardian.en.pl @@ -6,7 +6,7 @@ 'guardian block httpd brute-force' => 'httpd Brute Force Detection', 'guardian block owncloud brute-force' => 'Owncloud Brute Force detection', 'guardian block ssh brute-force' => 'SSH Brute Force Detection', -'guardian blockcount' => 'Strike Threshold (Snort)', +'guardian blockcount' => 'Strike Threshold', 'guardian blocked hosts' => 'Currently blocked hosts', 'guardian blocking of this address is not allowed' => 'Blocking of the given address is not allowed.', 'guardian blocktime' => 'Block Time (seconds)', @@ -36,9 +36,7 @@ 'guardian priolevel_medium' => '2 - Medium', 'guardian priolevel_low' => '3 - Low', 'guardian priolevel_very_low' => '4 - Very low', -'guardian priority level' => 'Priority Level (Snort)', 'guardian service' => 'Guardian Service', -'guardian watch snort alertfile' => 'Monitor Snort Alert File', ); diff --git a/config/guardian/guardian.tr.pl b/config/guardian/guardian.tr.pl index cb64a358d..c4d9c5aab 100644 --- a/config/guardian/guardian.tr.pl +++ b/config/guardian/guardian.tr.pl @@ -6,7 +6,7 @@ 'guardian block httpd brute-force' => 'httpd kaba kuvvet algılama', 'guardian block owncloud brute-force' => 'Owncloud kaba kuvvet algılama', 'guardian block ssh brute-force' => 'SSH kaba kuvvet algılama', -'guardian blockcount' => 'Vurgu eşiği (Snort)', +'guardian blockcount' => 'Vurgu eşiği', 'guardian blocked hosts' => 'Şu anda engellenen ana makineler', 'guardian blocking of this address is not allowed' => 'Verilen adresin engellenmesine izin verilmiyor.', 'guardian blocktime' => 'Engelleme zamanı (saniye)', @@ -36,9 +36,7 @@ 'guardian priolevel_medium' => '2 - Orta', 'guardian priolevel_low' => '3 - Düşük', 'guardian priolevel_very_low' => '4 - Çok düşük', -'guardian priority level' => 'Öncelik seviyesi (Snort)', 'guardian service' => 'Koruyucu servisi', -'guardian watch snort alertfile' => 'Snort uyarı dosyası', ); diff --git a/html/cgi-bin/guardian.cgi b/html/cgi-bin/guardian.cgi index 6144aca02..36d84bb5b 100644 --- a/html/cgi-bin/guardian.cgi +++ b/html/cgi-bin/guardian.cgi @@ -52,7 +52,6 @@ my $ignorefile ='/var/ipfire/guardian/guardian.ignore'; # file locations on IPFire systems. my %module_file_locations = ( "HTTPD" => "/var/log/httpd/error_log", - "SNORT" => "/var/log/snort/alert", "SSH" => "/var/log/messages", ); @@ -78,7 +77,6 @@ our %ignored = (); $settings{'ACTION'} = ''; $settings{'GUARDIAN_ENABLED'} = 'off'; -$settings{'GUARDIAN_MONITOR_SNORT'} = 'on'; $settings{'GUARDIAN_MONITOR_SSH'} = 'on'; $settings{'GUARDIAN_MONITOR_HTTPD'} = 'on'; $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = ''; @@ -88,7 +86,6 @@ $settings{'GUARDIAN_BLOCKCOUNT'} = '3'; $settings{'GUARDIAN_BLOCKTIME'} = '86400'; $settings{'GUARDIAN_FIREWALL_ACTION'} = 'DROP'; $settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log'; -$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'} = '3'; my $errormessage = ''; @@ -379,9 +376,6 @@ sub showMainBox() { $checked{'GUARDIAN_ENABLED'}{'on'} = ''; $checked{'GUARDIAN_ENABLED'}{'off'} = ''; $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked'; - $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} = ''; - $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} = ''; - $checked{'GUARDIAN_MONITOR_SNORT'}{$settings{'GUARDIAN_MONITOR_SNORT'}} = "checked='checked'"; $checked{'GUARDIAN_MONITOR_SSH'}{'off'} = ''; $checked{'GUARDIAN_MONITOR_SSH'}{'on'} = ''; $checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'"; @@ -394,7 +388,6 @@ sub showMainBox() { $selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected'; $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected'; - $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}} = 'selected'; $selected{'GUARDIAN_FIREWALL_ACTION'}{$settings{'GUARDIAN_FIREWALL_ACTION'}} = 'selected'; &Header::openpage($Lang::tr{'guardian configuration'}, 1, ''); @@ -447,19 +440,6 @@ sub showMainBox() { \$("#GUARDIAN_LOG_FACILITY").change(update_options); \$("#GUARDIAN_LOGLEVEL").change(update_options); update_options(); - - // Show / Hide snort priority level option, based if - // snort is enabled / disabled. - if (\$('input[name=GUARDIAN_MONITOR_SNORT]:checked').val() == 'on') { - \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').show(); - } else { - \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').hide(); - } - - // Show/Hide snort priority level when GUARDIAN_MONITOR_SNORT get changed. - \$('input[name=GUARDIAN_MONITOR_SNORT]').change(function() { - \$('.GUARDIAN_SNORT_PRIORITY_LEVEL').toggle(); - }); }); </script> END @@ -533,12 +513,6 @@ END <td colspan='2'><br></td> </tr> - <tr> - <td width='25%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td> - <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='on' $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} /> / - <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='off' $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} /> off</td> - </tr> - <tr> <td width='25%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td> <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> / @@ -580,17 +554,15 @@ END <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td> </tr> - <tr class="GUARDIAN_SNORT_PRIORITY_LEVEL"> + <tr> <td colspan='2'><br></td> </tr> - <tr class="GUARDIAN_SNORT_PRIORITY_LEVEL"> - <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td> - <td><select name='GUARDIAN_SNORT_PRIORITY_LEVEL'> - <option value='1' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'1'}>$Lang::tr{'guardian priolevel_high'}</option> - <option value='2' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'2'}>$Lang::tr{'guardian priolevel_medium'}</option> - <option value='3' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'3'}>$Lang::tr{'guardian priolevel_low'}</option> - <option value='4' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'4'}>$Lang::tr{'guardian priolevel_very_low'}</option> + <tr> + <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td> + <td><select name='GUARDIAN_FIREWALL_ACTION'> + <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option> + <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option> </select></td> <td width='25%' class='base'>$Lang::tr{'guardian blockcount'}:</td> @@ -602,12 +574,6 @@ END </tr> <tr> - <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td> - <td><select name='GUARDIAN_FIREWALL_ACTION'> - <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option> - <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option> - </select></td> - <td width='25%' class='base'>$Lang::tr{'guardian blocktime'}:</td> <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td> </tr> @@ -977,11 +943,6 @@ sub BuildConfiguration() { # Module settings. print FILE "\n# Module settings.\n"; - # Check if SNORT is enabled and add snort priority. - if ($settings{'GUARDIAN_MONITOR_SNORT'} eq "on") { - print FILE "SnortPriorityLevel = $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}\n"; - } - close(FILE); # Generate ignore file. diff --git a/lfs/guardian b/lfs/guardian index 2eaf77212..d84ca64f3 100644 --- a/lfs/guardian +++ b/lfs/guardian @@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = guardian -PAK_VER = 15 +PAK_VER = 16 DEPS = "perl-inotify2 perl-Net-IP" hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. bf62652ecfbe1331f0eef5d198b8ac6db417a4d4
by Michael Tremer 08 May '19

08 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via bf62652ecfbe1331f0eef5d198b8ac6db417a4d4 (commit) via e9dd6da5527766be474dfc057677acab7f756ed4 (commit) via 68f2b71778eebea13d17fd51172407c8030d7797 (commit) via 5737a22cf2feee68f4865683dff192e8c897e24f (commit) via 090af02e07889d6d62b346a3330f563ec6181ec4 (commit) via c818134f44ca937b288671e541a95d1bd662066d (commit) via 673db997cc5a359b59a223811c94a83df6eca9d2 (commit) via f302e31ae2dd296422a8685294e2aa1c18d0fb20 (commit) via 7f07bdb43f731d45ba4ff208c997e09f55adddd8 (commit) via 45e4d6af99d28d6453a9a29ab2fe7414aad016cb (commit) via 92f4652226e14ccbd7cf067928964d9b7d5c52e3 (commit) via 9177b69830974333ef0197ba4c94aa6c21366741 (commit) via bc78976cc6586c5f8e7c59ab3cb844fa56249c91 (commit) via 60bc3a4b7a60587d590517a167b80d624f0c86cb (commit) via b38710a1cd942f231ea16eafe62369e742b56d55 (commit) from a59052cec61a78357033f9a97d09f4f47625a2d2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit bf62652ecfbe1331f0eef5d198b8ac6db417a4d4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 22:54:11 2019 +0100 squid: Link against libatomic on ARM This package failed to build on ARM because atomic functions are being emulated on ARM32 and the required library was not linked. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e9dd6da5527766be474dfc057677acab7f756ed4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 21:19:53 2019 +0100 xfsprogs: Disable LTO on armv5tel LTO fails on ARM, but since we do not require it, we can disable it here. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 68f2b71778eebea13d17fd51172407c8030d7797 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 23:53:43 2019 +0100 core132: Ship updated pakfire files Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 5737a22cf2feee68f4865683dff192e8c897e24f Author: Alexander Koch <ipfire(a)starkstromkonsument.de> Date: Sat Apr 27 21:26:46 2019 +0200 zabbix_agentd: Add UserParameter for Pakfire Status Ship the UserParameter for monitoring the status of pakfire for keeping track of available updates etc. Signed-off-by: Alexander Koch <ipfire(a)starkstromkonsument.de> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 090af02e07889d6d62b346a3330f563ec6181ec4 Author: Alexander Koch <ipfire(a)starkstromkonsument.de> Date: Sat Apr 27 21:26:45 2019 +0200 Pakfire: Add new command line argument "status" This enables Pakfire to return a Status-Summary for the Current Core-Update-Level, time since last updates, the availability of a core-/packet-update and if a reboot is required to complete an update. This can be used by monitoring agents (e.g. zabbix_agentd) to monitor the update status of the IPFire device. Signed-off-by: Alexander Koch <ipfire(a)starkstromkonsument.de> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit c818134f44ca937b288671e541a95d1bd662066d Author: Alexander Koch <ipfire(a)starkstromkonsument.de> Date: Sat Apr 27 21:26:44 2019 +0200 zabbix_agentd: update to 4.2.1 Release notes: https://www.zabbix.com/rn/rn4.2.1 Signed-off-by: Alexander Koch <ipfire(a)starkstromkonsument.de> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 673db997cc5a359b59a223811c94a83df6eca9d2 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 23:50:26 2019 +0100 core132: Ship updated libedit Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f302e31ae2dd296422a8685294e2aa1c18d0fb20 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed May 1 19:32:15 2019 +0200 libedit: Update to 20190324-3.1 For details see: https://thrysoee.dk/editline/ Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 7f07bdb43f731d45ba4ff208c997e09f55adddd8 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 23:49:47 2019 +0100 core132: Ship updated knot Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 45e4d6af99d28d6453a9a29ab2fe7414aad016cb Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed May 1 19:28:16 2019 +0200 knot: Update to 2.8.1 For details see: https://www.knot-dns.cz/2019-04-09-version-281.html Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 92f4652226e14ccbd7cf067928964d9b7d5c52e3 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 23:48:41 2019 +0100 core132: Ship updated bind Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 9177b69830974333ef0197ba4c94aa6c21366741 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Apr 27 02:19:34 2019 +0200 bind: Update to 9.11.6-P1 For details see: http://ftp.isc.org/isc/bind9/9.11.6-P1/RELEASE-NOTES-bind-9.11.6-P1.html "Security Fixes The TCP client quota set using the tcp-clients option could be exceeded in some cases. This could lead to exhaustion of file descriptors. This flaw is disclosed in CVE-2018-5743. [GL #615]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit bc78976cc6586c5f8e7c59ab3cb844fa56249c91 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 23:46:36 2019 +0100 core132: Ship updated dhcpcd Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 60bc3a4b7a60587d590517a167b80d624f0c86cb Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat May 4 21:59:15 2019 +0200 dhcpcd: Update to 7.2.2 For details see: https://roy.marples.name/ Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b38710a1cd942f231ea16eafe62369e742b56d55 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue May 7 23:44:44 2019 +0100 firewall: Allow SNAT rules with RED interface Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/bind | 2 +- config/rootfiles/common/libedit | 2 +- .../{oldcore/100 => core/132}/filelists/bind | 0 .../{oldcore/125 => core/132}/filelists/dhcpcd | 0 config/rootfiles/core/132/filelists/files | 3 ++ .../{oldcore/128 => core/132}/filelists/knot | 0 .../{oldcore/128 => core/132}/filelists/libedit | 0 config/rootfiles/packages/zabbix_agentd | 1 + config/zabbix_agentd/sudoers | 8 ++-- config/zabbix_agentd/userparameter_pakfire.conf | 2 + html/cgi-bin/firewall.cgi | 1 + lfs/bind | 4 +- lfs/dhcpcd | 6 +-- lfs/knot | 4 +- lfs/libedit | 4 +- lfs/squid | 7 ++- lfs/xfsprogs | 10 ++++- lfs/zabbix_agentd | 8 ++-- src/pakfire/lib/functions.pl | 52 ++++++++++++++++++++++ src/pakfire/pakfire | 2 + 20 files changed, 96 insertions(+), 20 deletions(-) copy config/rootfiles/{oldcore/100 => core/132}/filelists/bind (100%) copy config/rootfiles/{oldcore/125 => core/132}/filelists/dhcpcd (100%) copy config/rootfiles/{oldcore/128 => core/132}/filelists/knot (100%) copy config/rootfiles/{oldcore/128 => core/132}/filelists/libedit (100%) create mode 100644 config/zabbix_agentd/userparameter_pakfire.conf Difference in files: diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 8c8a55d19..9164ff740 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -274,7 +274,7 @@ usr/lib/libdns.so.1105.0.0 #usr/lib/libisc.la #usr/lib/libisc.so usr/lib/libisc.so.1100 -usr/lib/libisc.so.1100.0.1 +usr/lib/libisc.so.1100.1.0 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 diff --git a/config/rootfiles/common/libedit b/config/rootfiles/common/libedit index 65b3b86a9..c9a20fc01 100644 --- a/config/rootfiles/common/libedit +++ b/config/rootfiles/common/libedit @@ -4,7 +4,7 @@ #usr/lib/libedit.la #usr/lib/libedit.so usr/lib/libedit.so.0 -usr/lib/libedit.so.0.0.59 +usr/lib/libedit.so.0.0.60 #usr/lib/pkgconfig/libedit.pc #usr/share/man/man3/editline.3 #usr/share/man/man3/el_deletestr.3 diff --git a/config/rootfiles/core/132/filelists/bind b/config/rootfiles/core/132/filelists/bind new file mode 120000 index 000000000..48a0ebaef --- /dev/null +++ b/config/rootfiles/core/132/filelists/bind @@ -0,0 +1 @@ +../../../common/bind \ No newline at end of file diff --git a/config/rootfiles/core/132/filelists/dhcpcd b/config/rootfiles/core/132/filelists/dhcpcd new file mode 120000 index 000000000..1e799dabb --- /dev/null +++ b/config/rootfiles/core/132/filelists/dhcpcd @@ -0,0 +1 @@ +../../../common/dhcpcd \ No newline at end of file diff --git a/config/rootfiles/core/132/filelists/files b/config/rootfiles/core/132/filelists/files index 875dd3048..1411d6c90 100644 --- a/config/rootfiles/core/132/filelists/files +++ b/config/rootfiles/core/132/filelists/files @@ -3,7 +3,10 @@ etc/issue etc/mime.types etc/rc.d/init.d/suricata etc/suricata/suricata.yaml +opt/pakfire/lib/functions.pl +opt/pakfire/pakfire srv/web/ipfire/cgi-bin/credits.cgi +srv/web/ipfire/cgi-bin/firewall.cgi srv/web/ipfire/cgi-bin/proxy.cgi usr/lib/firewall/rules.pl usr/sbin/convert-snort diff --git a/config/rootfiles/core/132/filelists/knot b/config/rootfiles/core/132/filelists/knot new file mode 120000 index 000000000..28e96f878 --- /dev/null +++ b/config/rootfiles/core/132/filelists/knot @@ -0,0 +1 @@ +../../../common/knot \ No newline at end of file diff --git a/config/rootfiles/core/132/filelists/libedit b/config/rootfiles/core/132/filelists/libedit new file mode 120000 index 000000000..03fc483da --- /dev/null +++ b/config/rootfiles/core/132/filelists/libedit @@ -0,0 +1 @@ +../../../common/libedit \ No newline at end of file diff --git a/config/rootfiles/packages/zabbix_agentd b/config/rootfiles/packages/zabbix_agentd index eaecf2644..4420bda05 100644 --- a/config/rootfiles/packages/zabbix_agentd +++ b/config/rootfiles/packages/zabbix_agentd @@ -5,6 +5,7 @@ etc/zabbix_agentd etc/zabbix_agentd/scripts etc/zabbix_agentd/zabbix_agentd.conf etc/zabbix_agentd/zabbix_agentd.d +etc/zabbix_agentd/zabbix_agentd.d/userparameter_pakfire.conf usr/bin/zabbix_get usr/bin/zabbix_sender usr/lib/modules diff --git a/config/zabbix_agentd/sudoers b/config/zabbix_agentd/sudoers index f4e4321cc..1b362a4fd 100644 --- a/config/zabbix_agentd/sudoers +++ b/config/zabbix_agentd/sudoers @@ -8,10 +8,10 @@ # Some hints: # - It is strongly recommended to edit this file only using the visudo -f <filename> command. If you mess up this file, # you might end up locking yourself out of your system! -# - Append the full path to each command, using "," as separator. +# - Append the full path incl. parameters to each command, using "," as separator. # - Only add commands you really need. Zabbix should not have more rights than it has to. # -# Uncomment the following two lines and edit the example of commands to fit your needs: +# Append / edit the following list of commands to fit your needs: # -#Defaults:zabbix !requiretty -#zabbix ALL=(ALL) NOPASSWD: <path to command1>, <path to command2> +Defaults:zabbix !requiretty +zabbix ALL=(ALL) NOPASSWD: /opt/pakfire/pakfire status diff --git a/config/zabbix_agentd/userparameter_pakfire.conf b/config/zabbix_agentd/userparameter_pakfire.conf new file mode 100644 index 000000000..aa2e80f5c --- /dev/null +++ b/config/zabbix_agentd/userparameter_pakfire.conf @@ -0,0 +1,2 @@ +### Parameter for monitoring pakfire status +UserParameter=pakfire.status,sudo /opt/pakfire/pakfire status diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index fb1c25dfd..45f740322 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -1718,6 +1718,7 @@ END <td width='25%' align='right'><span class='snat'>$Lang::tr{'snat new source ip address'}:</span></td> <td width='30%'> <select name='snat' class='snat' style='width: 100%;'> + <option value='RED' $selected{'snat'}{'RED'}>$Lang::tr{'red1'} ($redip)</option> END foreach my $alias (sort keys %aliases) { diff --git a/lfs/bind b/lfs/bind index f2286fe1f..b0a513c5f 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.6 +VER = 9.11.6-P1 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4882bd3eeef779e05b515b32354cc081 +$(DL_FILE)_MD5 = 8294f1a86f57a331379717d714e840e3 install : $(TARGET) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index d7372ea82..08d763f37 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 7.1.1 +VER = 7.2.2 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = adc0a949cb718b455d81deea9ba2875f +$(DL_FILE)_MD5 = 2f17034432ea10415ee84a97ef131128 install : $(TARGET) diff --git a/lfs/knot b/lfs/knot index 1a7fec0cb..804d3bcc2 100644 --- a/lfs/knot +++ b/lfs/knot @@ -24,7 +24,7 @@ include Config -VER = 2.8.0 +VER = 2.8.1 THISAPP = knot-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5b0d73e143b4c5a72faf4f1f1337ca08 +$(DL_FILE)_MD5 = 14e67b33ed409f92259dbdbaf0e5ade7 install : $(TARGET) diff --git a/lfs/libedit b/lfs/libedit index f3a831b14..33bfee183 100644 --- a/lfs/libedit +++ b/lfs/libedit @@ -24,7 +24,7 @@ include Config -VER = 20181209-3.1 +VER = 20190324-3.1 THISAPP = libedit-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 22e945a0476e388e6f78bfc8d6e1192c +$(DL_FILE)_MD5 = bec755c8044ad84b752dfe49a0b371d8 install : $(TARGET) diff --git a/lfs/squid b/lfs/squid index 0115cad82..780f16548 100644 --- a/lfs/squid +++ b/lfs/squid @@ -34,6 +34,10 @@ TARGET = $(DIR_INFO)/$(THISAPP) CXXFLAGS+= -Wno-error=format-truncation +ifeq "$(BUILD_ARCH)" "armv5tel" + LDFLAGS += -latomic +endif + ############################################################################### # Top-level Rules ############################################################################### @@ -77,7 +81,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && autoreconf -vfi cd $(DIR_APP)/libltdl && autoreconf -vfi - cd $(DIR_APP) && CXXFLAGS="$(CXXFLAGS)" ./configure \ + cd $(DIR_APP) && CFLAGS="$(CFLAGS)" CXXFLAGS="$(CXXFLAGS)" \ + LDFLAGS="$(LDFLAGS)" ./configure \ --prefix=/usr \ --sysconfdir=/etc/squid \ --datadir=/usr/lib/squid \ diff --git a/lfs/xfsprogs b/lfs/xfsprogs index af6ccce37..07410f720 100644 --- a/lfs/xfsprogs +++ b/lfs/xfsprogs @@ -32,6 +32,14 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) +CONFIGURE_OPTIONS = \ + --enable-readline=yes + +ifeq "$(BUILD_ARCH)" "armv5tel" + CONFIGURE_OPTIONS += \ + --enable-lto=no +endif + ############################################################################### # Top-level Rules ############################################################################### @@ -74,7 +82,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && make $(MAKETUNING) DEBUG=-DNDEBUG INSTALL_USER=root INSTALL_GROUP=root \ - LOCAL_CONFIGURE_OPTIONS="--enable-readline=yes" + LOCAL_CONFIGURE_OPTIONS="$(CONFIGURE_OPTIONS)" cd $(DIR_APP) && make install install-dev cd $(DIR_APP) && install -v -m755 -D libhandle/libhandle.la /usr/lib/libhandle.la chmod -v 755 /lib/libhandle.so* diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd index 23b77b930..d4d5a22fb 100644 --- a/lfs/zabbix_agentd +++ b/lfs/zabbix_agentd @@ -24,7 +24,7 @@ include Config -VER = 4.2.0 +VER = 4.2.1 THISAPP = zabbix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = zabbix_agentd -PAK_VER = 2 +PAK_VER = 3 DEPS = "" ############################################################################### @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 20f261708f95787f3dbea3eab89f804d +$(DL_FILE)_MD5 = e55ba94060ba2548ae8a1c29fd7cb7dd install : $(TARGET) @@ -91,6 +91,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -mkdir -pv /etc/zabbix_agentd/scripts install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/zabbix_agentd.conf \ /etc/zabbix_agentd/zabbix_agentd.conf + install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/userparameter_pakfire.conf \ + /etc/zabbix_agentd/zabbix_agentd.d/userparameter_pakfire.conf # Create directory for additional agent modules -mkdir -pv /usr/lib/zabbix diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index 12a405bd7..9ed911d0c 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -108,6 +108,7 @@ sub usage { &Pakfire::message(" <update> - Contacts the servers for new lists of paks."); &Pakfire::message(" <upgrade> - Installs the latest version of all paks."); &Pakfire::message(" <list> - Outputs a short list with all available paks."); + &Pakfire::message(" <status> - Outputs a summary about available core upgrades, updates and a required reboot"); &Pakfire::message(""); &Pakfire::message(" Global options:"); &Pakfire::message(" --non-interactive --> Enables the non-interactive mode."); @@ -893,4 +894,55 @@ sub progress_bar { sprintf "$color{'lightgreen'}%-20s %7s |%-${width}s| %10s$color{'normal'}\r",$show_bfile, $progress, $char x (($width-1)*$got/$total). '>', beautifysize($got); } +sub updates_available { + # Get packets with updates available + my @upgradepaks = &Pakfire::dblist("upgrade", "noweb"); + + # Get the length of the returned array + my $updatecount = scalar @upgradepaks; + + return "$updatecount"; +} + +sub coreupdate_available { + eval(`grep "core_" $Conf::dbdir/lists/core-list.db`); + if ("$core_release" > "$Conf::core_mine") { + return "yes ($core_release)"; + } + else { + return "no"; + } +} + +sub reboot_required { + if ( -e "/var/run/need_reboot" ) { + return "yes"; + } + else { + return "no"; + } +} + +sub status { + # General info + my $return = "Core-Update-Level: $Conf::core_mine\n"; + $return .= "Last update: " . &General::age("/opt/pakfire/db/core/mine") . " ago\n"; + $return .= "Last core-list update: " . &General::age("/opt/pakfire/db/lists/core-list.db") . " ago\n"; + $return .= "Last server-list update: " . &General::age("/opt/pakfire/db/lists/server-list.db") . " ago\n"; + $return .= "Last packages-list update: " . &General::age("/opt/pakfire/db/lists/packages_list.db") . " ago\n"; + + # Get availability of core updates + $return .= "Core-Update available: " . &Pakfire::coreupdate_available() . "\n"; + + # Get availability of package updates + $return .= "Package-Updates available: " . &Pakfire::updates_available() . "\n"; + + # Test if reboot is required + $return .= "Reboot required: " . &Pakfire::reboot_required() . "\n"; + + # Return status text + print "$return"; + exit 1; +} + 1; diff --git a/src/pakfire/pakfire b/src/pakfire/pakfire index 041ba669a..c69a8d3ad 100644 --- a/src/pakfire/pakfire +++ b/src/pakfire/pakfire @@ -322,6 +322,8 @@ } elsif ("$ARGV[1]" eq "upgrades") { system("rm -f /etc/fcron.daily/pakfire-upgrade"); } + } elsif ("$ARGV[0]" eq "status") { + &Pakfire::status; } else { &Pakfire::usage; } hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core131, updated. 34d72e754243fe86fb1772d39e1b45876b8c72f4
by Arne Fitzenreiter 02 May '19

02 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core131 has been updated via 34d72e754243fe86fb1772d39e1b45876b8c72f4 (commit) from 0c52297641c96927eba3476851957ef0fe321ec8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 34d72e754243fe86fb1772d39e1b45876b8c72f4 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 20:19:01 2019 +0200 suricata: Update to 4.1.4 This is a minor update to the latest available version from the suricata 4.1 series. Fixes #12068. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/lfs/suricata b/lfs/suricata index d7b5b71d6..310920606 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 4.1.3 +VER = 4.1.4 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 35c4a8e6be3910831649a073950195df +$(DL_FILE)_MD5 = cb8bf6b8330c44ae78dfb5b083a6fe82 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 34d72e754243fe86fb1772d39e1b45876b8c72f4
by Arne Fitzenreiter 02 May '19

02 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 34d72e754243fe86fb1772d39e1b45876b8c72f4 (commit) from 0c52297641c96927eba3476851957ef0fe321ec8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 34d72e754243fe86fb1772d39e1b45876b8c72f4 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 20:19:01 2019 +0200 suricata: Update to 4.1.4 This is a minor update to the latest available version from the suricata 4.1 series. Fixes #12068. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/lfs/suricata b/lfs/suricata index d7b5b71d6..310920606 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 4.1.3 +VER = 4.1.4 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 35c4a8e6be3910831649a073950195df +$(DL_FILE)_MD5 = cb8bf6b8330c44ae78dfb5b083a6fe82 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a59052cec61a78357033f9a97d09f4f47625a2d2
by Arne Fitzenreiter 02 May '19

02 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a59052cec61a78357033f9a97d09f4f47625a2d2 (commit) from 1f367e0aab3ffb1bc8d5528dc1a383142ab3d92b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a59052cec61a78357033f9a97d09f4f47625a2d2 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 20:19:01 2019 +0200 suricata: Update to 4.1.4 This is a minor update to the latest available version from the suricata 4.1 series. Fixes #12068. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/suricata | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/lfs/suricata b/lfs/suricata index d7b5b71d6..310920606 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 4.1.3 +VER = 4.1.4 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 35c4a8e6be3910831649a073950195df +$(DL_FILE)_MD5 = cb8bf6b8330c44ae78dfb5b083a6fe82 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core131, updated. 0c52297641c96927eba3476851957ef0fe321ec8
by Arne Fitzenreiter 01 May '19

01 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core131 has been updated via 0c52297641c96927eba3476851957ef0fe321ec8 (commit) via 0034a92ad79d6c9853216602960c8ebe22d13b21 (commit) from 9cf253e150078852877f5ee530aeb3408fa4216b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0c52297641c96927eba3476851957ef0fe321ec8 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 17:03:06 2019 +0200 suricata: Remove PID file on stop Force the initscript to remove the PID file when calling "stop" section. If suricata crashes during startup, the PID file still remains and the service cannot be started anymore until the file has been deleted. Now when calling "stop" or "restart" the PID file will be deleted and the service can be used again. Fixes #12067. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 0034a92ad79d6c9853216602960c8ebe22d13b21 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 16:49:25 2019 +0200 update-ids-ruleset: Set correct ownership for the rulestarball. The script usualy will be executed by cron which will start it with root permissions, so the downloaded tarball is owned by this user. This has to be changed to the user which runs the WUI (nobody:nobody) to allow, changing the ruleset to an other one and to display the ruleset area. Fixes #12066 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: src/initscripts/system/suricata | 3 +++ src/scripts/update-ids-ruleset | 3 +++ 2 files changed, 6 insertions(+) Difference in files: diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index c9f131fca..38b6a40d8 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -171,6 +171,9 @@ case "$1" in # Remove suricata control socket. rm /var/run/suricata/* >/dev/null 2>/dev/null + # Trash remain pid file if still exists. + rm -f $PID_FILE >/dev/null 2>/dev/null + # Don't report returncode of rm if suricata was not started exit 0 ;; diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset index 14ea25ec6..f28a8c156 100644 --- a/src/scripts/update-ids-ruleset +++ b/src/scripts/update-ids-ruleset @@ -58,6 +58,9 @@ if(&IDS::downloadruleset()) { exit 0; } +# Set correct ownership for the downloaded tarball. +&IDS::set_ownership("$IDS::rulestarball"); + # Call oinkmaster to alter the ruleset. &IDS::oinkmaster(); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 0c52297641c96927eba3476851957ef0fe321ec8
by Arne Fitzenreiter 01 May '19

01 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 0c52297641c96927eba3476851957ef0fe321ec8 (commit) via 0034a92ad79d6c9853216602960c8ebe22d13b21 (commit) from 9cf253e150078852877f5ee530aeb3408fa4216b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0c52297641c96927eba3476851957ef0fe321ec8 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 17:03:06 2019 +0200 suricata: Remove PID file on stop Force the initscript to remove the PID file when calling "stop" section. If suricata crashes during startup, the PID file still remains and the service cannot be started anymore until the file has been deleted. Now when calling "stop" or "restart" the PID file will be deleted and the service can be used again. Fixes #12067. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 0034a92ad79d6c9853216602960c8ebe22d13b21 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 16:49:25 2019 +0200 update-ids-ruleset: Set correct ownership for the rulestarball. The script usualy will be executed by cron which will start it with root permissions, so the downloaded tarball is owned by this user. This has to be changed to the user which runs the WUI (nobody:nobody) to allow, changing the ruleset to an other one and to display the ruleset area. Fixes #12066 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: src/initscripts/system/suricata | 3 +++ src/scripts/update-ids-ruleset | 3 +++ 2 files changed, 6 insertions(+) Difference in files: diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index c9f131fca..38b6a40d8 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -171,6 +171,9 @@ case "$1" in # Remove suricata control socket. rm /var/run/suricata/* >/dev/null 2>/dev/null + # Trash remain pid file if still exists. + rm -f $PID_FILE >/dev/null 2>/dev/null + # Don't report returncode of rm if suricata was not started exit 0 ;; diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset index 14ea25ec6..f28a8c156 100644 --- a/src/scripts/update-ids-ruleset +++ b/src/scripts/update-ids-ruleset @@ -58,6 +58,9 @@ if(&IDS::downloadruleset()) { exit 0; } +# Set correct ownership for the downloaded tarball. +&IDS::set_ownership("$IDS::rulestarball"); + # Call oinkmaster to alter the ruleset. &IDS::oinkmaster(); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1f367e0aab3ffb1bc8d5528dc1a383142ab3d92b
by Arne Fitzenreiter 01 May '19

01 May '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 1f367e0aab3ffb1bc8d5528dc1a383142ab3d92b (commit) via 62910a28a690338799ba53a423e9541c537fb3b0 (commit) via 50b35e0f8f19d14182fa485430fc26c9c2738350 (commit) from 5a4617a8711d69ba6ce19ca05a4fd21033dc72d1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1f367e0aab3ffb1bc8d5528dc1a383142ab3d92b Merge: 62910a28a 5a4617a87 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Wed May 1 18:04:36 2019 +0200 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next commit 62910a28a690338799ba53a423e9541c537fb3b0 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 17:03:06 2019 +0200 suricata: Remove PID file on stop Force the initscript to remove the PID file when calling "stop" section. If suricata crashes during startup, the PID file still remains and the service cannot be started anymore until the file has been deleted. Now when calling "stop" or "restart" the PID file will be deleted and the service can be used again. Fixes #12067. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 50b35e0f8f19d14182fa485430fc26c9c2738350 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Wed May 1 16:49:25 2019 +0200 update-ids-ruleset: Set correct ownership for the rulestarball. The script usualy will be executed by cron which will start it with root permissions, so the downloaded tarball is owned by this user. This has to be changed to the user which runs the WUI (nobody:nobody) to allow, changing the ruleset to an other one and to display the ruleset area. Fixes #12066 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: src/initscripts/system/suricata | 3 +++ src/scripts/update-ids-ruleset | 3 +++ 2 files changed, 6 insertions(+) Difference in files: diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index c9f131fca..38b6a40d8 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -171,6 +171,9 @@ case "$1" in # Remove suricata control socket. rm /var/run/suricata/* >/dev/null 2>/dev/null + # Trash remain pid file if still exists. + rm -f $PID_FILE >/dev/null 2>/dev/null + # Don't report returncode of rm if suricata was not started exit 0 ;; diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset index 14ea25ec6..f28a8c156 100644 --- a/src/scripts/update-ids-ruleset +++ b/src/scripts/update-ids-ruleset @@ -58,6 +58,9 @@ if(&IDS::downloadruleset()) { exit 0; } +# Set correct ownership for the downloaded tarball. +&IDS::set_ownership("$IDS::rulestarball"); + # Call oinkmaster to alter the ruleset. &IDS::oinkmaster(); hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM May 2019