[git.ipfire.org] IPFire 2.x development tree branch, next, updated. dcc655efb8620b760d4b414203a54845ac9bbe34
by Arne Fitzenreiter 19 Jan '20
by Arne Fitzenreiter 19 Jan '20
19 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via dcc655efb8620b760d4b414203a54845ac9bbe34 (commit)
via dc08d74d955861ff39013e35e42d46e54602692f (commit)
from 97f4b51474551b9076af00bb9fc69acd0eba9bfc (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit dcc655efb8620b760d4b414203a54845ac9bbe34
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Sat Jan 18 10:03:06 2020 +0100
convert-dns-settings: Import all possible PPP dialin profiles.
* Avoid from adding the same imported DNS server multiple times.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit dc08d74d955861ff39013e35e42d46e54602692f
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Sun Jan 19 12:23:54 2020 +0000
core140: fix typo
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/core/140/filelists/files | 2 +-
src/scripts/convert-dns-settings | 44 ++++++++++++++++++++++++-------
2 files changed, 35 insertions(+), 11 deletions(-)
Difference in files:
diff --git a/config/rootfiles/core/140/filelists/files b/config/rootfiles/core/140/filelists/files
index 37ce80c6a..1bd2c314a 100644
--- a/config/rootfiles/core/140/filelists/files
+++ b/config/rootfiles/core/140/filelists/files
@@ -6,7 +6,7 @@ etc/rc.d/init.d/lvmetad
etc/rc.d/init.d/networking/dhcpcd.exe
etc/rc.d/init.d/networking/red
etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
-etc/rc.d/init.d/partresive
+etc/rc.d/init.d/partresize
etc/rc.d/init.d/suricata
etc/rc.d/init.d/unbound
etc/rc.d/rcsysinit.d/S09lvmetad
diff --git a/src/scripts/convert-dns-settings b/src/scripts/convert-dns-settings
index 04a5344f7..e9d4de86b 100755
--- a/src/scripts/convert-dns-settings
+++ b/src/scripts/convert-dns-settings
@@ -22,25 +22,49 @@
main() {
# Do not convert anything if we already have some servers set
if [ ! -s "/var/ipfire/dns/servers" ]; then
- local DNS0 DNS1 DNS2
+ # Array to store all found DNS servers.
+ SERVERS=()
+
+ # Try to get the DNS servers from ethernet settings file.
+ local DNS1 DNS2
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
+ # Add the grabbed DNS servers to the servers array.
+ SERVERS+=($DNS1 $DNS2)
+
+ # Check if the ppp settings file is not empty.
if [ -s "/var/ipfire/ppp/settings" ]; then
- eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
+ # Loop though all profile files.
+ for file in /var/ipfire/ppp/settings*; do
+ local DNS1 DNS2
+ eval $(/usr/local/bin/readhash $file)
+
+ # Add the DNS servers to the array of SERVERS.
+ for var in DNS1 DNS2; do
+ local server="${!var}"
+
+ # Check if the current server is allready part
+ # of the array.
+ for element in "${SERVERS[@]}"; do
+ [[ $element == $server ]] && continue
+ done
+
+ SERVERS+=($server)
+ done
+
+ # Remove DNS1 and DNS2 settings from profile file.
+ sed -i "/^DNS[12]?=/d" $file
+ done
- # Remove DNS, DNS1 and DNS2
- sed -i "/^DNS[12]?=/d" /var/ipfire/ppp/settings
elif [ -s "/var/ipfire/dns/settings" ]; then
eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
fi
- local var
+ local server
local i=3
- for var in DNS0 DNS1 DNS2; do
- if [ -n "${!var}" ]; then
- echo "${i},${!var},,enabled,"
- (( i++ ))
- fi
+ for server in "${SERVERS[@]}"; do
+ echo "${i},${server},,enabled,"
+ (( i++ ))
done > /var/ipfire/dns/servers
# Empty the old settings file
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 97f4b51474551b9076af00bb9fc69acd0eba9bfc
by Arne Fitzenreiter 17 Jan '20
by Arne Fitzenreiter 17 Jan '20
17 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 97f4b51474551b9076af00bb9fc69acd0eba9bfc (commit)
from 7fd560d81fb0041d292445fff194f40dd5dbbd23 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 97f4b51474551b9076af00bb9fc69acd0eba9bfc
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Fri Jan 17 11:21:43 2020 +0100
partresize: NanoPi R1: copy also a0 config of Ampac AP6212
there is a second hardware version of the AP6212 in some NanoPi R1
boards.
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/core/140/filelists/files | 3 ++-
src/initscripts/system/partresize | 2 ++
2 files changed, 4 insertions(+), 1 deletion(-)
Difference in files:
diff --git a/config/rootfiles/core/140/filelists/files b/config/rootfiles/core/140/filelists/files
index c4d07f279..37ce80c6a 100644
--- a/config/rootfiles/core/140/filelists/files
+++ b/config/rootfiles/core/140/filelists/files
@@ -6,8 +6,9 @@ etc/rc.d/init.d/lvmetad
etc/rc.d/init.d/networking/dhcpcd.exe
etc/rc.d/init.d/networking/red
etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
-etc/rc.d/init.d/unbound
+etc/rc.d/init.d/partresive
etc/rc.d/init.d/suricata
+etc/rc.d/init.d/unbound
etc/rc.d/rcsysinit.d/S09lvmetad
etc/ppp/ip-down
etc/ppp/ip-up
diff --git a/src/initscripts/system/partresize b/src/initscripts/system/partresize
index 040c6c369..e7e3bf40b 100644
--- a/src/initscripts/system/partresize
+++ b/src/initscripts/system/partresize
@@ -55,6 +55,8 @@ case "${1}" in
"FriendlyElec NanoPi-R1")
cp -f /lib/firmware/brcm/brcmfmac43430-sdio.AP6212.txt \
/lib/firmware/brcm/brcmfmac43430-sdio.txt
+ cp -f /lib/firmware/brcm/brcmfmac43430a0-sdio.ONDA-V80_PLUS.txt \
+ /lib/firmware/brcm/brcmfmac43430a0-sdio.txt
;;
esac 2>/dev/null
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 7fd560d81fb0041d292445fff194f40dd5dbbd23
by Arne Fitzenreiter 16 Jan '20
by Arne Fitzenreiter 16 Jan '20
16 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 7fd560d81fb0041d292445fff194f40dd5dbbd23 (commit)
via 889388116048b44a1e3a8b28e2933af9191d34d5 (commit)
via dd5e20120e1fdd49106b3c3847e01c5a3be4aac5 (commit)
via c835011d6ec0018892ed1ee69e8e32c7b2c4dc64 (commit)
via f9f79c662c5ba57d2b297be2069f84fb9bd75e12 (commit)
via 03d559964c6cee18533fbd6e414f9f70c13741e3 (commit)
via 87bee81c561562c61324769313414fcff5704176 (commit)
via bcf318fbd0cde846c053d9d0a9c36f8ceda28d40 (commit)
via c919b15c34e6fd25dadd4990bf86f8709a084c37 (commit)
via b48379d5ba9ea0cdffe6c0994d43f7213b5a830b (commit)
from e4c19cc91c23fb9f08b2b993133565670312a8e0 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 7fd560d81fb0041d292445fff194f40dd5dbbd23
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Thu Jan 16 18:28:26 2020 +0000
core140: add lvm2 to core updater
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit 889388116048b44a1e3a8b28e2933af9191d34d5
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Jan 15 15:20:12 2020 +0000
lvm2: Add initscript for lvmetad
This daemon needs to be launched in order to use LVM
devices in IPFire.
It will run on all installations after this patch has been
merged but only consumes very little memory.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit dd5e20120e1fdd49106b3c3847e01c5a3be4aac5
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Jan 15 15:20:11 2020 +0000
lvm2: Create lock files in /run/lvm
The default is /var/lock which is not mounted at the time
when udev is initialising the volumes. Therefore after a
reboot, LVM devices won't show up unless pvscan is executed
manually.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit c835011d6ec0018892ed1ee69e8e32c7b2c4dc64
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Jan 15 15:20:10 2020 +0000
lvm2: Enable lvmetad
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit f9f79c662c5ba57d2b297be2069f84fb9bd75e12
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Jan 15 15:20:09 2020 +0000
lvm2: Build with support for udev
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit 03d559964c6cee18533fbd6e414f9f70c13741e3
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Jan 15 15:20:08 2020 +0000
lvm2: Ship with core system
This was requested by some users to mount devices
with LVM.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit 87bee81c561562c61324769313414fcff5704176
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Jan 15 11:28:01 2020 +0000
Update list of contributors
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit bcf318fbd0cde846c053d9d0a9c36f8ceda28d40
Author: Stéphane Pautrel <stephane.pautrel(a)gmail.com>
Date: Wed Jan 15 11:26:47 2020 +0000
Many improvements for the French translation
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit c919b15c34e6fd25dadd4990bf86f8709a084c37
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Thu Jan 16 17:18:13 2020 +0100
DNS: Defaults to use the ISP nameservers.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit b48379d5ba9ea0cdffe6c0994d43f7213b5a830b
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Thu Jan 16 17:18:12 2020 +0100
configroot: Create /var/ipfire/dns/servers file
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/aarch64/initscripts | 2 +
config/rootfiles/common/armv5tel/initscripts | 2 +
config/rootfiles/common/configroot | 1 +
config/rootfiles/common/i586/initscripts | 2 +
config/rootfiles/common/lvm2 | 109 ++++++-------
config/rootfiles/common/x86_64/initscripts | 2 +
config/rootfiles/core/140/filelists/files | 2 +
.../{oldcore/125 => core/140}/filelists/lvm2 | 0
doc/language_issues.de | 6 +-
doc/language_issues.en | 11 +-
doc/language_issues.es | 7 +-
doc/language_issues.fr | 6 +-
doc/language_issues.it | 7 +-
doc/language_issues.nl | 7 +-
doc/language_issues.pl | 7 +-
doc/language_issues.ru | 7 +-
doc/language_issues.tr | 7 +-
doc/language_missings | 38 +++++
html/cgi-bin/credits.cgi | 4 +-
langs/en/cgi-bin/en.pl | 2 +-
langs/fr/cgi-bin/fr.pl | 169 +++++++++++----------
lfs/configroot | 3 +-
lfs/initscripts | 1 +
lfs/lvm2 | 7 +-
src/initscripts/{packages/monit => system/lvmetad} | 20 +--
25 files changed, 264 insertions(+), 165 deletions(-)
copy config/rootfiles/{oldcore/125 => core/140}/filelists/lvm2 (100%)
copy src/initscripts/{packages/monit => system/lvmetad} (52%)
mode change 100644 => 100755
Difference in files:
diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts
index 202da7372..ddf098ed4 100644
--- a/config/rootfiles/common/aarch64/initscripts
+++ b/config/rootfiles/common/aarch64/initscripts
@@ -26,6 +26,7 @@ etc/rc.d/init.d/functions
etc/rc.d/init.d/halt
etc/rc.d/init.d/ipsec
etc/rc.d/init.d/leds
+etc/rc.d/init.d/lvmetad
etc/rc.d/init.d/localnet
etc/rc.d/init.d/modules
etc/rc.d/init.d/mountfs
@@ -180,6 +181,7 @@ etc/rc.d/rc6.d/S99reboot
etc/rc.d/rcsysinit.d/S00mountkernfs
etc/rc.d/rcsysinit.d/S01sysctl
etc/rc.d/rcsysinit.d/S05modules
+etc/rc.d/rcsysinit.d/S09lvmetad
etc/rc.d/rcsysinit.d/S10udev
etc/rc.d/rcsysinit.d/S19waitdrives
etc/rc.d/rcsysinit.d/S20swap
diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts
index 202da7372..ddf098ed4 100644
--- a/config/rootfiles/common/armv5tel/initscripts
+++ b/config/rootfiles/common/armv5tel/initscripts
@@ -26,6 +26,7 @@ etc/rc.d/init.d/functions
etc/rc.d/init.d/halt
etc/rc.d/init.d/ipsec
etc/rc.d/init.d/leds
+etc/rc.d/init.d/lvmetad
etc/rc.d/init.d/localnet
etc/rc.d/init.d/modules
etc/rc.d/init.d/mountfs
@@ -180,6 +181,7 @@ etc/rc.d/rc6.d/S99reboot
etc/rc.d/rcsysinit.d/S00mountkernfs
etc/rc.d/rcsysinit.d/S01sysctl
etc/rc.d/rcsysinit.d/S05modules
+etc/rc.d/rcsysinit.d/S09lvmetad
etc/rc.d/rcsysinit.d/S10udev
etc/rc.d/rcsysinit.d/S19waitdrives
etc/rc.d/rcsysinit.d/S20swap
diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot
index 56b0257bc..67c4abc75 100644
--- a/config/rootfiles/common/configroot
+++ b/config/rootfiles/common/configroot
@@ -41,6 +41,7 @@ var/ipfire/dhcp
var/ipfire/dhcpc
var/ipfire/dns
#var/ipfire/dns/settings
+#var/ipfire/dns/servers
var/ipfire/dnsforward
#var/ipfire/dnsforward/config
var/ipfire/ethernet
diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts
index 9d4f7e5f3..e666ed84e 100644
--- a/config/rootfiles/common/i586/initscripts
+++ b/config/rootfiles/common/i586/initscripts
@@ -26,6 +26,7 @@ etc/rc.d/init.d/functions
etc/rc.d/init.d/halt
etc/rc.d/init.d/ipsec
etc/rc.d/init.d/leds
+etc/rc.d/init.d/lvmetad
etc/rc.d/init.d/localnet
etc/rc.d/init.d/modules
etc/rc.d/init.d/mountfs
@@ -179,6 +180,7 @@ etc/rc.d/rc6.d/S99reboot
etc/rc.d/rcsysinit.d/S00mountkernfs
etc/rc.d/rcsysinit.d/S01sysctl
etc/rc.d/rcsysinit.d/S05modules
+etc/rc.d/rcsysinit.d/S09lvmetad
etc/rc.d/rcsysinit.d/S10udev
etc/rc.d/rcsysinit.d/S19waitdrives
etc/rc.d/rcsysinit.d/S20swap
diff --git a/config/rootfiles/common/lvm2 b/config/rootfiles/common/lvm2
index db7f304e5..258f3201f 100644
--- a/config/rootfiles/common/lvm2
+++ b/config/rootfiles/common/lvm2
@@ -1,5 +1,5 @@
#etc/lvm
-#etc/lvm/lvm.conf
+etc/lvm/lvm.conf
#etc/lvm/lvmlocal.conf
#etc/lvm/profile
#etc/lvm/profile/cache-mq.profile
@@ -9,60 +9,66 @@
#etc/lvm/profile/metadata_profile_template.profile
#etc/lvm/profile/thin-generic.profile
#etc/lvm/profile/thin-performance.profile
+lib/udev/rules.d/10-dm.rules
+lib/udev/rules.d/11-dm-lvm.rules
+lib/udev/rules.d/13-dm-disk.rules
+lib/udev/rules.d/69-dm-lvm-metad.rules
+lib/udev/rules.d/95-dm-notify.rules
#usr/include/libdevmapper.h
#usr/lib/libdevmapper.so
usr/lib/libdevmapper.so.1.02
#usr/lib/pkgconfig/devmapper.pc
-#usr/sbin/blkdeactivate
-#usr/sbin/dmsetup
-#usr/sbin/dmstats
-#usr/sbin/fsadm
-#usr/sbin/lvchange
-#usr/sbin/lvconvert
-#usr/sbin/lvcreate
-#usr/sbin/lvdisplay
-#usr/sbin/lvextend
-#usr/sbin/lvm
-#usr/sbin/lvmconf
-#usr/sbin/lvmconfig
-#usr/sbin/lvmdiskscan
-#usr/sbin/lvmdump
-#usr/sbin/lvmsadc
-#usr/sbin/lvmsar
-#usr/sbin/lvreduce
-#usr/sbin/lvremove
-#usr/sbin/lvrename
-#usr/sbin/lvresize
-#usr/sbin/lvs
-#usr/sbin/lvscan
-#usr/sbin/pvchange
-#usr/sbin/pvck
-#usr/sbin/pvcreate
-#usr/sbin/pvdisplay
-#usr/sbin/pvmove
-#usr/sbin/pvremove
-#usr/sbin/pvresize
-#usr/sbin/pvs
-#usr/sbin/pvscan
-#usr/sbin/vgcfgbackup
-#usr/sbin/vgcfgrestore
-#usr/sbin/vgchange
-#usr/sbin/vgck
-#usr/sbin/vgconvert
-#usr/sbin/vgcreate
-#usr/sbin/vgdisplay
-#usr/sbin/vgexport
-#usr/sbin/vgextend
-#usr/sbin/vgimport
-#usr/sbin/vgimportclone
-#usr/sbin/vgmerge
-#usr/sbin/vgmknodes
-#usr/sbin/vgreduce
-#usr/sbin/vgremove
-#usr/sbin/vgrename
-#usr/sbin/vgs
-#usr/sbin/vgscan
-#usr/sbin/vgsplit
+usr/sbin/blkdeactivate
+usr/sbin/dmsetup
+usr/sbin/dmstats
+usr/sbin/fsadm
+usr/sbin/lvchange
+usr/sbin/lvconvert
+usr/sbin/lvcreate
+usr/sbin/lvdisplay
+usr/sbin/lvextend
+usr/sbin/lvm
+usr/sbin/lvmconf
+usr/sbin/lvmconfig
+usr/sbin/lvmdiskscan
+usr/sbin/lvmdump
+usr/sbin/lvmetad
+usr/sbin/lvmsadc
+usr/sbin/lvmsar
+usr/sbin/lvreduce
+usr/sbin/lvremove
+usr/sbin/lvrename
+usr/sbin/lvresize
+usr/sbin/lvs
+usr/sbin/lvscan
+usr/sbin/pvchange
+usr/sbin/pvck
+usr/sbin/pvcreate
+usr/sbin/pvdisplay
+usr/sbin/pvmove
+usr/sbin/pvremove
+usr/sbin/pvresize
+usr/sbin/pvs
+usr/sbin/pvscan
+usr/sbin/vgcfgbackup
+usr/sbin/vgcfgrestore
+usr/sbin/vgchange
+usr/sbin/vgck
+usr/sbin/vgconvert
+usr/sbin/vgcreate
+usr/sbin/vgdisplay
+usr/sbin/vgexport
+usr/sbin/vgextend
+usr/sbin/vgimport
+usr/sbin/vgimportclone
+usr/sbin/vgmerge
+usr/sbin/vgmknodes
+usr/sbin/vgreduce
+usr/sbin/vgremove
+usr/sbin/vgrename
+usr/sbin/vgs
+usr/sbin/vgscan
+usr/sbin/vgsplit
#usr/share/man/man5/lvm.conf.5
#usr/share/man/man7/lvmcache.7
#usr/share/man/man7/lvmraid.7
@@ -87,6 +93,7 @@ usr/lib/libdevmapper.so.1.02
#usr/share/man/man8/lvmconfig.8
#usr/share/man/man8/lvmdiskscan.8
#usr/share/man/man8/lvmdump.8
+#usr/share/man/man8/lvmetad.8
#usr/share/man/man8/lvmsadc.8
#usr/share/man/man8/lvmsar.8
#usr/share/man/man8/lvreduce.8
diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts
index 9d4f7e5f3..e666ed84e 100644
--- a/config/rootfiles/common/x86_64/initscripts
+++ b/config/rootfiles/common/x86_64/initscripts
@@ -26,6 +26,7 @@ etc/rc.d/init.d/functions
etc/rc.d/init.d/halt
etc/rc.d/init.d/ipsec
etc/rc.d/init.d/leds
+etc/rc.d/init.d/lvmetad
etc/rc.d/init.d/localnet
etc/rc.d/init.d/modules
etc/rc.d/init.d/mountfs
@@ -179,6 +180,7 @@ etc/rc.d/rc6.d/S99reboot
etc/rc.d/rcsysinit.d/S00mountkernfs
etc/rc.d/rcsysinit.d/S01sysctl
etc/rc.d/rcsysinit.d/S05modules
+etc/rc.d/rcsysinit.d/S09lvmetad
etc/rc.d/rcsysinit.d/S10udev
etc/rc.d/rcsysinit.d/S19waitdrives
etc/rc.d/rcsysinit.d/S20swap
diff --git a/config/rootfiles/core/140/filelists/files b/config/rootfiles/core/140/filelists/files
index 4cb92f0d3..c4d07f279 100644
--- a/config/rootfiles/core/140/filelists/files
+++ b/config/rootfiles/core/140/filelists/files
@@ -2,11 +2,13 @@ etc/system-release
etc/issue
srv/web/ipfire/cgi-bin/credits.cgi
var/ipfire/langs
+etc/rc.d/init.d/lvmetad
etc/rc.d/init.d/networking/dhcpcd.exe
etc/rc.d/init.d/networking/red
etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
etc/rc.d/init.d/unbound
etc/rc.d/init.d/suricata
+etc/rc.d/rcsysinit.d/S09lvmetad
etc/ppp/ip-down
etc/ppp/ip-up
etc/unbound/unbound.conf
diff --git a/config/rootfiles/core/140/filelists/lvm2 b/config/rootfiles/core/140/filelists/lvm2
new file mode 120000
index 000000000..d640870b7
--- /dev/null
+++ b/config/rootfiles/core/140/filelists/lvm2
@@ -0,0 +1 @@
+../../../common/lvm2
\ No newline at end of file
diff --git a/doc/language_issues.de b/doc/language_issues.de
index d3539dd98..89a703fcb 100644
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -219,6 +219,7 @@ WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
+WARNING: translation string unused: dns servers
WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
@@ -777,11 +778,13 @@ WARNING: untranslated string: dangerous = Dangerous
WARNING: untranslated string: dead peer detection = Dead Peer Detection
WARNING: untranslated string: default IP address = Default IP Address
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
@@ -835,3 +838,4 @@ WARNING: untranslated string: standard = Standard
WARNING: untranslated string: strict = Strict
WARNING: untranslated string: taa zombieload2 = TSX Async Abort / ZombieLoad v2
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: working = Working
diff --git a/doc/language_issues.en b/doc/language_issues.en
index eea6a9b7c..4986317f8 100644
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -610,16 +610,17 @@ WARNING: untranslated string: dmz = DMZ
WARNING: untranslated string: dnat address = Firewall Interface
WARNING: untranslated string: dns = unknown string
WARNING: untranslated string: dns check failed = DNS check failed
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns proxy server = DNS Proxy Server
-WARNING: untranslated string: dns servers = DNS Servers
WARNING: untranslated string: dns title = Domain Name System
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
@@ -1028,7 +1029,7 @@ WARNING: untranslated string: host deny = list with denied hosts
WARNING: untranslated string: host ip = Host IP address
WARNING: untranslated string: host to net vpn = Host-to-Net Virtual Private Network (RoadWarrior)
WARNING: untranslated string: hostname = Hostname
-WARNING: untranslated string: hostname cant be empty = Hostname can't be empty.
+WARNING: untranslated string: hostname cant be empty = Hostname cannot be empty.
WARNING: untranslated string: hostname not set = Hostname not set.
WARNING: untranslated string: hosts config added = Hosts config added
WARNING: untranslated string: hosts config changed = Hosts config changed
@@ -2104,7 +2105,8 @@ WARNING: untranslated string: vpn start action start = Always On
WARNING: untranslated string: vpn statistic n2n = VPN: Net-to-Net Statistics
WARNING: untranslated string: vpn statistic rw = VPN: Roadwarrior Statistics
WARNING: untranslated string: vpn statistics n2n = unknown string
-WARNING: untranslated string: vpn subjectaltname = Subject Alt Name
+WARNING: untranslated string: vpn subjectaltname = SubjectAlternativeName
+WARNING: untranslated string: vpn subjectaltname missing = SubjectAlternativeName cannot be emtpy.
WARNING: untranslated string: vpn wait = WAITING
WARNING: untranslated string: vpn weak = Weak
WARNING: untranslated string: vulnerability = Vulnerability
@@ -2202,6 +2204,7 @@ WARNING: untranslated string: wlanap wlan settings = WLan Settings
WARNING: untranslated string: wlanap wlan status = WLan Status
WARNING: untranslated string: wol wakeup = WakeUp
WARNING: untranslated string: workgroup = Workgroup
+WARNING: untranslated string: working = Working
WARNING: untranslated string: written bytes = Bytes Written
WARNING: untranslated string: year = Year
WARNING: untranslated string: yes = Yes
diff --git a/doc/language_issues.es b/doc/language_issues.es
index 0c9853d12..4ea707702 100644
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -822,15 +822,16 @@ WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dnat address = Firewall Interface
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
-WARNING: untranslated string: dns servers = DNS Servers
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
@@ -1362,6 +1363,7 @@ WARNING: untranslated string: vpn start action start = Always On
WARNING: untranslated string: vpn statistic n2n = VPN: Net-to-Net Statistics
WARNING: untranslated string: vpn statistic rw = VPN: Roadwarrior Statistics
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: vpn subjectaltname missing = SubjectAlternativeName cannot be emtpy.
WARNING: untranslated string: vpn wait = WAITING
WARNING: untranslated string: vpn weak = Weak
WARNING: untranslated string: vulnerability = Vulnerability
@@ -1422,5 +1424,6 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr
WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan
WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules!
WARNING: untranslated string: wlanap ssid = SSID
+WARNING: untranslated string: working = Working
WARNING: untranslated string: zoneconf notice reboot = Please reboot to apply your changes.
WARNING: untranslated string: zoneconf title = Zone Configuration
diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index c600be801..f5f67243a 100644
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -243,6 +243,7 @@ WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
+WARNING: translation string unused: dns servers
WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
@@ -812,11 +813,13 @@ WARNING: untranslated string: Scan for Songs = unknown string
WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
@@ -864,3 +867,4 @@ WARNING: untranslated string: routing table = unknown string
WARNING: untranslated string: standard = Standard
WARNING: untranslated string: strict = Strict
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: working = Working
diff --git a/doc/language_issues.it b/doc/language_issues.it
index 96feb3a3e..b83cdde9a 100644
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -220,6 +220,7 @@ WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
+WARNING: translation string unused: dns servers
WARNING: translation string unused: dnsforward forward_server
WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
@@ -844,13 +845,15 @@ WARNING: untranslated string: dhcp dns update algo = Algorithm
WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
@@ -1065,6 +1068,7 @@ WARNING: untranslated string: vpn start action start = Always On
WARNING: untranslated string: vpn statistic n2n = VPN: Net-to-Net Statistics
WARNING: untranslated string: vpn statistic rw = VPN: Roadwarrior Statistics
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: vpn subjectaltname missing = SubjectAlternativeName cannot be emtpy.
WARNING: untranslated string: vpn wait = WAITING
WARNING: untranslated string: vpn weak = Weak
WARNING: untranslated string: vulnerability = Vulnerability
@@ -1093,5 +1097,6 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr
WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan
WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules!
WARNING: untranslated string: wlanap ssid = SSID
+WARNING: untranslated string: working = Working
WARNING: untranslated string: zoneconf notice reboot = Please reboot to apply your changes.
WARNING: untranslated string: zoneconf title = Zone Configuration
diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index ab7c2e81e..003c9b6fe 100644
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -845,15 +845,16 @@ WARNING: untranslated string: dhcp dns update algo = Algorithm
WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
-WARNING: untranslated string: dns servers = DNS Servers
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
@@ -1107,6 +1108,7 @@ WARNING: untranslated string: vpn start action start = Always On
WARNING: untranslated string: vpn statistic n2n = VPN: Net-to-Net Statistics
WARNING: untranslated string: vpn statistic rw = VPN: Roadwarrior Statistics
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: vpn subjectaltname missing = SubjectAlternativeName cannot be emtpy.
WARNING: untranslated string: vpn wait = WAITING
WARNING: untranslated string: vpn weak = Weak
WARNING: untranslated string: vulnerability = Vulnerability
@@ -1135,5 +1137,6 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr
WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan
WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules!
WARNING: untranslated string: wlanap ssid = SSID
+WARNING: untranslated string: working = Working
WARNING: untranslated string: zoneconf notice reboot = Please reboot to apply your changes.
WARNING: untranslated string: zoneconf title = Zone Configuration
diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 0c9853d12..4ea707702 100644
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -822,15 +822,16 @@ WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dnat address = Firewall Interface
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
-WARNING: untranslated string: dns servers = DNS Servers
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
@@ -1362,6 +1363,7 @@ WARNING: untranslated string: vpn start action start = Always On
WARNING: untranslated string: vpn statistic n2n = VPN: Net-to-Net Statistics
WARNING: untranslated string: vpn statistic rw = VPN: Roadwarrior Statistics
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: vpn subjectaltname missing = SubjectAlternativeName cannot be emtpy.
WARNING: untranslated string: vpn wait = WAITING
WARNING: untranslated string: vpn weak = Weak
WARNING: untranslated string: vulnerability = Vulnerability
@@ -1422,5 +1424,6 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr
WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan
WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules!
WARNING: untranslated string: wlanap ssid = SSID
+WARNING: untranslated string: working = Working
WARNING: untranslated string: zoneconf notice reboot = Please reboot to apply your changes.
WARNING: untranslated string: zoneconf title = Zone Configuration
diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index dfea6d4cd..b783639a0 100644
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -826,15 +826,16 @@ WARNING: untranslated string: disk access per = Disk Access per
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dnat address = Firewall Interface
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
-WARNING: untranslated string: dns servers = DNS Servers
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
@@ -1357,6 +1358,7 @@ WARNING: untranslated string: vpn start action start = Always On
WARNING: untranslated string: vpn statistic n2n = VPN: Net-to-Net Statistics
WARNING: untranslated string: vpn statistic rw = VPN: Roadwarrior Statistics
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: vpn subjectaltname missing = SubjectAlternativeName cannot be emtpy.
WARNING: untranslated string: vpn wait = WAITING
WARNING: untranslated string: vpn weak = Weak
WARNING: untranslated string: vulnerability = Vulnerability
@@ -1417,5 +1419,6 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr
WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan
WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules!
WARNING: untranslated string: wlanap ssid = SSID
+WARNING: untranslated string: working = Working
WARNING: untranslated string: zoneconf notice reboot = Please reboot to apply your changes.
WARNING: untranslated string: zoneconf title = Zone Configuration
diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index a65712e9f..08702c67d 100644
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -242,6 +242,7 @@ WARNING: translation string unused: dns new 1
WARNING: translation string unused: dns saved
WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
+WARNING: translation string unused: dns servers
WARNING: translation string unused: dnsforward forward_server
WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
@@ -821,13 +822,15 @@ WARNING: untranslated string: crypto warning = Cryptographic warning
WARNING: untranslated string: dangerous = Dangerous
WARNING: untranslated string: default IP address = Default IP Address
WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns check servers = Check DNS Servers
WARNING: untranslated string: dns configuration = DNS Configuration
-WARNING: untranslated string: dns could not add server = Could not add server - Reason:
WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns isp nameservers and tls not allowed = ISP-assigned DNS servers and TLS cannot be used at the same time.
WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no address given = No IP Address given.
WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns tls hostname = TLS Hostname
WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
@@ -946,6 +949,7 @@ WARNING: untranslated string: transport mode does not support vti = VTI is not s
WARNING: untranslated string: update ruleset = Update ruleset
WARNING: untranslated string: vpn start action add = Wait for connection initiation
WARNING: untranslated string: vpn statistics n2n = unknown string
+WARNING: untranslated string: vpn subjectaltname missing = SubjectAlternativeName cannot be emtpy.
WARNING: untranslated string: vpn wait = WAITING
WARNING: untranslated string: vulnerability = Vulnerability
WARNING: untranslated string: vulnerable = Vulnerable
@@ -956,5 +960,6 @@ WARNING: untranslated string: wlanap management frame protection = Management Fr
WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan
WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules!
WARNING: untranslated string: wlanap ssid = SSID
+WARNING: untranslated string: working = Working
WARNING: untranslated string: zoneconf notice reboot = Please reboot to apply your changes.
WARNING: untranslated string: zoneconf title = Zone Configuration
diff --git a/doc/language_missings b/doc/language_missings
index 6283a5ed4..379eb9f61 100644
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -36,11 +36,14 @@
< dhcp server disabled on blue interface
< dhcp server enabled on blue interface
< dh name is invalid
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dns tls hostname
< dns use isp assigned nameservers
@@ -74,6 +77,7 @@
< updxlrtr used by
< upload fcdsl.o
< vpn configuration main
+< working
############################################################################
# Checking cgi-bin translations for language: es #
############################################################################
@@ -240,6 +244,7 @@
< Disabled
< dl client arch insecure
< dnat address
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
@@ -254,7 +259,9 @@
< dns forwarding dnssec disabled notice
< dnsforward zone
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
@@ -838,6 +845,7 @@
< vpn start action start
< vpn statistic n2n
< vpn statistic rw
+< vpn subjectaltname missing
< vpn wait
< vpn weak
< vulnerability
@@ -899,6 +907,7 @@
< wlan client wpa mode ccmp ccmp
< wlan client wpa mode ccmp tkip
< wlan client wpa mode tkip tkip
+< working
< zoneconf access native
< zoneconf access none
< zoneconf access vlan
@@ -917,11 +926,14 @@
# Checking cgi-bin translations for language: fr #
############################################################################
< broken
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dns tls hostname
< dns use isp assigned nameservers
@@ -930,6 +942,7 @@
< okay
< standard
< strict
+< working
############################################################################
# Checking cgi-bin translations for language: it #
############################################################################
@@ -1020,6 +1033,7 @@
< dhcp dns update secret
< Disabled
< dl client arch insecure
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
@@ -1028,7 +1042,9 @@
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dnssec disabled warning
< dns tls hostname
@@ -1215,6 +1231,7 @@
< vpn start action start
< vpn statistic n2n
< vpn statistic rw
+< vpn subjectaltname missing
< vpn wait
< vpn weak
< vulnerability
@@ -1244,6 +1261,7 @@
< wlan client password
< wlan client tls cipher
< wlan client tls version
+< working
< zoneconf access native
< zoneconf access none
< zoneconf access vlan
@@ -1358,6 +1376,7 @@
< dh parameter
< Disabled
< dl client arch insecure
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
@@ -1366,7 +1385,9 @@
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
@@ -1600,6 +1621,7 @@
< vpn start action start
< vpn statistic n2n
< vpn statistic rw
+< vpn subjectaltname missing
< vpn wait
< vpn weak
< vulnerability
@@ -1629,6 +1651,7 @@
< wlan client password
< wlan client tls cipher
< wlan client tls version
+< working
< zoneconf access native
< zoneconf access none
< zoneconf access vlan
@@ -1809,6 +1832,7 @@
< Disabled
< dl client arch insecure
< dnat address
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
@@ -1823,7 +1847,9 @@
< dns forwarding dnssec disabled notice
< dnsforward zone
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
@@ -2393,6 +2419,7 @@
< vpn start action start
< vpn statistic n2n
< vpn statistic rw
+< vpn subjectaltname missing
< vpn wait
< vpn weak
< vulnerability
@@ -2454,6 +2481,7 @@
< wlan client wpa mode ccmp ccmp
< wlan client wpa mode ccmp tkip
< wlan client wpa mode tkip tkip
+< working
< zoneconf access native
< zoneconf access none
< zoneconf access vlan
@@ -2637,6 +2665,7 @@
< disk access per
< dl client arch insecure
< dnat address
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
@@ -2651,7 +2680,9 @@
< dns forwarding dnssec disabled notice
< dnsforward zone
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
@@ -3223,6 +3254,7 @@
< vpn start action start
< vpn statistic n2n
< vpn statistic rw
+< vpn subjectaltname missing
< vpn wait
< vpn weak
< vulnerability
@@ -3285,6 +3317,7 @@
< wlan client wpa mode ccmp ccmp
< wlan client wpa mode ccmp tkip
< wlan client wpa mode tkip tkip
+< working
< year-graph
< zoneconf access native
< zoneconf access none
@@ -3320,6 +3353,7 @@
< dangerous
< default IP address
< Disabled
+< dns check servers
< dns configuration
< dns could not add server
< dns enable safe-search
@@ -3328,7 +3362,9 @@
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
< dns isp assigned nameserver
+< dns isp nameservers and tls not allowed
< dns mode for qname minimisation
+< dns no address given
< dns no tls hostname given
< dns tls hostname
< dns use isp assigned nameservers
@@ -3409,6 +3445,7 @@
< transport mode does not support vti
< update ruleset
< vpn start action add
+< vpn subjectaltname missing
< vpn wait
< vulnerability
< vulnerable
@@ -3420,6 +3457,7 @@
< wlanap neighbor scan
< wlanap neighbor scan warning
< wlanap ssid
+< working
< zoneconf access native
< zoneconf access none
< zoneconf access vlan
diff --git a/html/cgi-bin/credits.cgi b/html/cgi-bin/credits.cgi
index a132b0a4a..6eb7f1e49 100644
--- a/html/cgi-bin/credits.cgi
+++ b/html/cgi-bin/credits.cgi
@@ -66,8 +66,8 @@ Christian Schmidt,
Alexander Marx,
Stefan Schantl,
Matthias Fischer,
-Jan Paul Tücking,
Peter Müller,
+Jan Paul Tücking,
Jonatan Schlag,
Erik Kapfer,
Dirk Wagner,
@@ -86,11 +86,11 @@ Stephan Feddersen,
Joern-Ingo Weigert,
Alexander Koch,
Wolfgang Apolinarski,
+Stéphane Pautrel,
Alfred Haas,
Lars Schuhmacher,
Rene Zingel,
Sascha Kilian,
-Stéphane Pautrel,
Ronald Wiesinger,
Florian Bührle,
Bernhard Bitsch,
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index cec76c8db..c0a69cffe 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -852,8 +852,8 @@
'dns forward disable dnssec' => 'Disable DNSSEC (dangerous)',
'dns forwarding dnssec disabled notice' => '(DNSSEC disabled)',
'dns header' => 'Assign DNS server addresses only for DHCP on red0',
-'dns isp nameservers and tls not allowed' => 'ISP-assigned DNS servers and TLS cannot be used at the same time.',
'dns isp assigned nameserver' => 'ISP-assigned DNS server',
+'dns isp nameservers and tls not allowed' => 'ISP-assigned DNS servers and TLS cannot be used at the same time.',
'dns list' => 'List of free public DNS servers',
'dns menu' => 'Assign DNS Server',
'dns mode for qname minimisation' => 'QNAME Minimisation',
diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl
index 8c4e4d8a4..6729cd6c5 100644
--- a/langs/fr/cgi-bin/fr.pl
+++ b/langs/fr/cgi-bin/fr.pl
@@ -17,7 +17,7 @@
'Captive activate' => 'Activation',
'Captive activated' => 'Activé',
'Captive active on' => 'Activée sur',
-'Captive agree tac' => 'Je suis d\'accord avec les termes et conditions ci-dessous.',
+'Captive agree tac' => 'Je suis en accord avec les termes et conditions ci-dessous.',
'Captive auth_lic' => 'Licence',
'Captive auth_vou' => 'Reçu',
'Captive authentication' => 'Type d\'accès',
@@ -80,7 +80,7 @@
'ConnSched scheduler' => 'Planificateur',
'ConnSched select profile' => 'Sélectionner profil',
'ConnSched shutdown' => 'Extinction',
-'ConnSched time' => 'Temps :',
+'ConnSched time' => 'Heure :',
'ConnSched up' => 'Actif',
'ConnSched weekdays' => 'Jours de la semaine :',
'Daily' => 'Quotidienne',
@@ -177,13 +177,13 @@
'advproxy AUTH method radius' => 'RADIUS',
'advproxy AUTH no auth' => 'Domaines sans authentification (un par ligne)',
'advproxy AUTH number of auth processes' => 'Nombre de processus d\'authentification',
-'advproxy AUTH realm' => 'Authentification du royaume invité',
+'advproxy AUTH realm' => 'Invite du domaine d\'authentification',
'advproxy AUTH user IP cache TTL' => 'Cache utilisateur/IP TTL (en minutes)',
'advproxy IDENT authorized users' => 'Utilisateurs autorisés (un par ligne)',
'advproxy IDENT aware hosts' => 'Identification des hôtes courants (un par ligne)',
'advproxy IDENT identd settings' => 'Paramètres communs identd',
'advproxy IDENT required' => 'Exiger l\'authentification identd',
-'advproxy IDENT timeout' => 'Temps d\'identification limite (en secondes)',
+'advproxy IDENT timeout' => 'Limite de temps d\'identification (en secondes)',
'advproxy IDENT unauthorized users' => 'Utilisateurs non autorisés (un par ligne)',
'advproxy IDENT use negative access list' => 'Utilisation négative du contrôle d\'accès',
'advproxy IDENT use positive access list' => 'Utilisation positive du contrôle d\'accès',
@@ -215,7 +215,7 @@
'advproxy NCSA min password length' => 'Longueur minimale du mot de passe',
'advproxy NCSA no accounts' => 'Aucun compte utilisateur disponible',
'advproxy NCSA password' => 'Mot de passe',
-'advproxy NCSA password confirm' => 'Mot de passe (confirmez)',
+'advproxy NCSA password confirm' => 'Mot de passe (confirmation) ',
'advproxy NCSA redirector bypass' => 'Redirection par contournement pour les membres du groupe',
'advproxy NCSA update user' => 'Mise à jour utilisateur',
'advproxy NCSA user accounts' => 'Comptes utilisateurs',
@@ -251,7 +251,7 @@
'advproxy advanced web proxy configuration' => 'Configuration avancée du proxy web',
'advproxy allowed subnets' => 'Sous-réseaux autorisés (un par ligne) ',
'advproxy allowed web browsers' => 'Clients autorisés pour l\'accès web',
-'advproxy back to main page' => 'Retour à l\'accueil',
+'advproxy back to main page' => 'Retour à la page principale',
'advproxy banned ip clients' => 'Adresses IP interdites (une par ligne) ',
'advproxy banned mac clients' => 'Adresses MAC interdites (une par ligne) ',
'advproxy basic authentication' => 'Autoriser l\'authentification HTTP basique',
@@ -263,7 +263,7 @@
'advproxy chgwebpwd change password' => 'Modifier mot de passe',
'advproxy chgwebpwd change web password' => 'C h a n g e r l e m o t p a s s e w e b',
'advproxy chgwebpwd new password' => 'Nouveau mot de passe',
-'advproxy chgwebpwd new password confirm' => 'Nouveau mot de passe (confirmez)',
+'advproxy chgwebpwd new password confirm' => 'Nouveau mot de passe (confirmation)',
'advproxy chgwebpwd old password' => 'Mot de passe actuel',
'advproxy chgwebpwd username' => 'Nom utilisateur',
'advproxy classroom extensions' => 'Extensions des classes',
@@ -423,7 +423,7 @@
'all services' => 'Tous les services',
'all updates installed' => 'Toutes les mises à jour sont installées',
'allmsg' => 'tout montrer',
-'alt dialup' => 'Messages',
+'alt dialup' => 'Connexion',
'alt home' => 'Accueil',
'alt information' => 'Information',
'alt logs' => 'Journaux',
@@ -481,7 +481,7 @@
'backup sets' => 'Configuration des sauvegardes',
'backup to floppy' => 'Sauvegarder sur disquettes',
'backupaddon' => 'Sauvegarde additionnelle',
-'backupprofile' => 'Dans le cas ou la reconnexion échouerait, changez de profil',
+'backupprofile' => 'Dans le cas ou la reconnexion échouerait, changer de profil ',
'backups' => 'Sauvegardes',
'backupwarning' => 'Veuillez restaurer votre sauvegarde principale et ensuite vos sauvegardes additionnelles. Veuillez conserver le nom de fichier fourni lors du téléchargement.',
'bad characters in' => 'Mauvais caractères dans ',
@@ -508,7 +508,7 @@
'blue access use hint' => 'Vous devez saisir l\'adresse IP ou MAC de votre périphérique. Vous pouvez également saisir les deux',
'blue interface' => 'Interface BLEUE',
'broadcast' => 'Diffusion',
-'broken pipe' => 'Broken pipe',
+'broken pipe' => 'Lien rompu',
'buffered memory' => 'Mémoire tampon',
'buffers' => 'tampons',
'bytes per second' => 'Octets par seconde',
@@ -639,17 +639,17 @@
'community rules' => 'Règles communautaires GPL de Snort',
'comp-lzo' => 'Compression-LZO :',
'compression' => 'Compression :',
-'computer to modem rate' => 'Taux de l\'ordinateur au modem :',
+'computer to modem rate' => 'Vitesse entre l\'ordinateur et le modem :',
'concentrator name' => 'Nom de concentrateur :',
'confirmation' => 'confirmation',
'connect' => 'Démarrage / Connexion OVPN',
'connect the modem' => 'Connexion au modem',
-'connect timeout' => 'Temps de connexion dépassé :',
+'connect timeout' => 'Délai de connexion dépassé :',
'connected' => 'Connecté',
'connecting' => 'Connexion en cours...',
'connection' => 'Connexion',
'connection closed' => 'Non connecté...',
-'connection debugging' => 'Déboggage de la connexion',
+'connection debugging' => 'Déboggage de la connexion ',
'connection status and controlc' => 'Etat et contrôle de connexion :',
'connection tracking' => 'Surveillance des connexions tables IP',
'connection type' => 'Type de connexion',
@@ -812,8 +812,8 @@
'dial profile' => 'Contact avec le profil',
'dial user password' => 'Mot de passe de l\'utilisateur connecté :',
'dial user password has been changed' => 'Le mot de passe de l\'utilisateur connecté a été changé.',
-'dialing mode' => 'Mode connecté :',
-'dialup red not ppp' => 'Les profils de connexion peuvent seulement être utilisés si <b>ROUGE</b> est positionné sur <b>Connexion PPP</b><BR>Vérifiez les réglages du réseau.',
+'dialing mode' => 'Mode de numérotation :',
+'dialup red not ppp' => 'Les profils de connexion peuvent seulement être utilisés si <b>ROUGE</b> est positionné sur <b>Connexion PPP</b><BR>Veuillez vérifier les réglages du réseau.',
'dialup settings' => 'Réglage de connexion',
'directory mask' => 'Droits des répertoires UNIX',
'directory writeable' => 'Ecriture possible dans ce répertoire',
@@ -823,7 +823,7 @@
'disk access per' => 'Accès disque par',
'disk usage' => 'Utilisation disque',
'display' => 'Réglages',
-'display charset' => 'Afficher Charset',
+'display charset' => 'Afficher jeu de car.',
'display hostname in window title' => 'Afficher le nom d\'hôte dans le titre de la fenêtre',
'display traffic at home' => 'Afficher les statistiques du trafic en page de démarrage',
'display webinterface effects' => 'Activer les effets',
@@ -883,10 +883,10 @@
'donation' => 'Faire un don',
'donation-link' => 'https://www.paypal.com/fr_fr/fr/i/btn/btn_donateCC_LG.gif',
'donation-text' => '<strong>IPFire</strong> est développé et maintenu par des volontaires durant leur temps libre.<br>Afin d\'assurer les coûts du projet et nous encourager, vous pouvez effectuer un don.',
-'done' => 'Faites le',
-'dos charset' => 'DOS Charset',
+'done' => 'Fait',
+'dos charset' => 'Jeu de car. DOS',
'down and up speed' => 'Entrez votre débit descendant et montant <br /> et cliquez sur <i>Sauvegarder</i>.',
-'downlink' => 'Downlink',
+'downlink' => 'Liaison descendante',
'downlink speed' => 'Débit descendant - download (kbit/sec) ',
'downlink std class' => 'Classe standard de téléchargement ',
'download' => 'Téléchargement ',
@@ -898,7 +898,7 @@
'download pkcs12 file' => 'Télécharger le fichier PKCS12',
'download root certificate' => 'Télécharger le certificat Root',
'download tls-auth key' => 'Télécharger la clé tls-auth',
-'dpd action' => 'Détection du peer mort',
+'dpd action' => 'Détection du pair mort',
'dpd delay' => 'Retard',
'dpd timeout' => 'Délai dépassé',
'driver' => 'Pilote',
@@ -927,8 +927,8 @@
'e-mail address too long' => 'L\'adresse email est trop longue ; Elle ne doit pas dépasser 40 caractères.',
'eciadsl help' => 'Pour utiliser le modem ECI ADSL, vous devez charger un fichier synch.bin sur votre machine IPFire. Veuillez télécharger le fichier depuis le site web d\'ECIADSL et chargez le fichier <b>synch.bin</b> en utilisant le formulaire ci-dessous.',
'eciadsl upload' => 'Charger le fichier ECI ADSL synch.bin',
-'edit' => 'Editer',
-'edit a rule' => 'Editer une règle existante :',
+'edit' => 'Modifier',
+'edit a rule' => 'Modifier une règle existante :',
'edit advanced settings when done' => 'Modifier les paramètres avancés lorsque vous avez terminé.',
'edit an existing alias' => 'Modifier un alias existant',
'edit an existing host' => 'Modifer un hôte existant',
@@ -970,14 +970,14 @@
'empty profile' => 'vide',
'enable ignore filter' => 'Activer le filtre d\'exclusion ',
'enable javascript' => 'Activer Javascript',
-'enable smt' => 'Activer multithreading simultané (SMT)',
+'enable smt' => 'Activer le partage d\'un cœur de processeur (SMT)',
'enable wildcards' => 'Activer les cartes d\'invitations :',
'enabled' => 'Activé :',
'enabled on' => 'Activé sur',
'enabledtitle' => 'Activé',
'encapsulation' => 'Encapsulation',
'encrypted' => 'Chiffré',
-'encryption' => 'Encryption :',
+'encryption' => 'Chiffrement :',
'end address' => 'Adresse de fin :',
'enter ack class' => 'Entrez la classe ACK <br /> et cliquez sur <i>Sauvegarder</i>.',
'enter data' => 'Entrez vos réglages <br /> et cliquez sur <i>Sauvegarder</i>.',
@@ -996,7 +996,7 @@
'error' => 'Erreur',
'error config' => 'Impossible d\'ouvrir /var/ipcop/ovpn/config/ZERINA.ovpn !',
'error external access' => 'Impossible d\'ouvrir /var/ipcop/xtaccess/config (l\'accès externe ne peut pas être garanti) !',
-'error messages' => 'Messages d\'erreurs :',
+'error messages' => 'Remarque :',
'esp encryption' => 'Chiffrement ESP :',
'esp grouptype' => 'Type de groupe ESP :',
'esp integrity' => 'Intégrité ESP :',
@@ -1163,7 +1163,7 @@
'fwdfw menu' => 'Pare-feu',
'fwdfw movedown' => 'Descendre',
'fwdfw moveup' => 'Monter',
-'fwdfw natport used' => 'Le port donné pour NAPT est déjà utilisé par une autre règle DNAT.',
+'fwdfw natport used' => 'Le port proposé pour NAPT est déjà utilisé par une autre règle DNAT.',
'fwdfw newrule' => 'Nouvelle règle',
'fwdfw numcon' => 'Nombre de connexions ',
'fwdfw p2p txt' => 'Accorder / refuser l\'accès aux réseaux P2P.',
@@ -1353,7 +1353,7 @@
'high' => 'Haut',
'high memory usage' => 'Utilisation mémoire importante',
'hint' => 'Remarque :',
-'holdoff' => 'Temps d\'inactivité (en secondes)',
+'holdoff' => 'Temps d\'inactivité (en secondes) ',
'host' => 'Hôte',
'host allow' => 'Liste des hôtes autorisés',
'host certificate' => 'Certificat hôte',
@@ -1376,7 +1376,7 @@
'icmp type' => 'Type ICMP',
'id' => 'ID',
'idle' => 'Inactif',
-'idle timeout' => 'Délai d\'inactivité (minutes ; 0 pour désactiver) :',
+'idle timeout' => 'Délai d\'inactivité (en minutes ; 0 pour désactiver) :',
'idle timeout not set' => 'Délai d\'inactivité non défini.',
'ids apply' => 'Appliquer',
'ids apply ruleset changes' => 'Les modifications du jeu de règles sont appliquées. Veuillez patienter jusqu\'à ce que toutes les opérations soient terminées avec succès...',
@@ -1404,7 +1404,7 @@
'ike grouptype' => 'Type de groupe IKE :',
'ike integrity' => 'Intégrité IKE :',
'ike lifetime' => 'Durée de vie IKE :',
-'ike lifetime should be between 1 and 24 hours' => 'La durée de vie IKE devrait être comprise entre 1 et 24 heures.',
+'ike lifetime should be between 1 and 24 hours' => 'La durée de vie IKE doit être comprise entre 1 et 24 heures.',
'imei' => 'IMEI',
'import' => 'Importer',
'importkey' => 'Importer PSK',
@@ -1562,7 +1562,7 @@
'lateprompting' => 'Dernière action',
'lease expires' => 'Bail expiré',
'least preferred' => 'le moins apprécié',
-'legend' => 'Légende',
+'legend' => 'Légende ',
'length' => 'Longueur',
'lifetime' => 'Durée de vie :',
'line' => 'Ligne',
@@ -1691,7 +1691,7 @@
'misc-options' => 'Options supplémentaires',
'missing dat' => 'Archive chiffrée introuvable',
'missing gz' => 'Archive déchiffrée introuvable',
-'mitigated' => 'Mitigé',
+'mitigated' => 'Modéré',
'mode' => 'Mode',
'model' => 'Modèle',
'modem' => 'Modem',
@@ -1718,7 +1718,7 @@
'modify' => 'Modifier',
'modulation' => 'Modulation',
'monday' => 'Lundi',
-'monitor interface' => 'Monitor Interface',
+'monitor interface' => 'Interface de gestion ',
'month' => 'Mois ',
'month-graph' => 'Mois',
'monthly firewallhits' => 'Contacts mensuels avec le pare-feu',
@@ -1816,7 +1816,7 @@
'ntp syncro disabled' => 'Synchronisation NTP désactivee',
'ntp syncro enabled' => 'Synchronisation NTP activee',
'ntpd restarted' => 'ntpd redemarre',
-'number' => 'Nombre :',
+'number' => 'Numéro de téléphone :',
'o-no' => 'Inactif',
'o-yes' => 'Actif',
'october' => 'Octobre',
@@ -1897,16 +1897,16 @@
'outgoing traffic in bytes per second' => 'Trafic sortant',
'override mtu' => 'Outrepasser le MTU par défaut',
'ovpn' => 'OpenVPN',
-'ovpn add conf' => 'Configuration addtionnelle',
+'ovpn add conf' => 'Configuration additionnelle',
'ovpn con stat' => 'Statistiques de connexions OpenVPN',
-'ovpn config' => 'OVPN-Config',
+'ovpn config' => 'Config OVPN',
'ovpn crypt options' => 'Options cryptographiques',
'ovpn device' => 'Périphérique OpenVPN :',
'ovpn dh' => 'Longueur de paramètres Diffie-Hellman ',
'ovpn dh new key' => 'Générer de nouveaux paramètres Diffie-Hellman ',
'ovpn dh parameters' => 'Options de paramètres Diffie-Hellman',
'ovpn dh upload' => 'Mettre à jour de nouveaux paramètres Diffie-Hellman ',
-'ovpn dl' => 'Télécharger OVPN-Config',
+'ovpn dl' => 'Télécharger Config OVPN',
'ovpn engines' => 'Moteur Crypto',
'ovpn errmsg green already pushed' => 'La route pour le réseau VERT est toujours activée',
'ovpn errmsg invalid ip or mask' => 'Adresse ou masque de sous-r?seau invalide',
@@ -1914,7 +1914,7 @@
'ovpn error md5' => 'Votre certificat hôte utilise MD5 pour la signature qui n\'est plus acceptée. <br>Veuillez mettre à jour la dernière version d\'IPFire et générez un nouveau certificat racine et hôte..</br><br>Tous les clients OpenVPN doivent ensuite être renouvelés!</br>',
'ovpn generating the root and host certificates' => 'La génération du certificat racine et hôte peut prendre du temps.',
'ovpn ha' => 'Algorithme de hashage',
-'ovpn log' => 'OVPN-Log',
+'ovpn log' => 'Log OVPN',
'ovpn mgmt in root range' => 'Un numéro de port de 1024 ou plus est requis.',
'ovpn mtu-disc' => 'Découverte du chemin MTU',
'ovpn mtu-disc and mtu not 1500' => 'Path MTU Discovery nécessite un MTU de 1500.',
@@ -1941,19 +1941,19 @@
'ovpn_mssfix' => 'Taille MSSFIX',
'ovpn_mtudisc' => 'Découverte MTU',
'ovpn_processprio' => 'Priorité du processus',
-'ovpn_processprioD' => 'Profond',
-'ovpn_processprioED' => 'Extrêmement profondément',
+'ovpn_processprioD' => 'Profonde',
+'ovpn_processprioED' => 'Extrêmement profonde',
'ovpn_processprioEH' => 'Extrêmement haute',
'ovpn_processprioEN' => 'Plus haute que la normale',
'ovpn_processprioH' => 'Elevé',
-'ovpn_processprioLN' => 'Plus profondément que la normale',
+'ovpn_processprioLN' => 'Plus profonde que la normale',
'ovpn_processprioN' => 'Normal',
-'ovpn_processprioVD' => 'Très profondément',
+'ovpn_processprioVD' => 'Très profonde',
'ovpn_processprioVH' => 'Très haute',
'ovpnstatus log' => 'Journal statut OVPN',
'ovpnsys log' => 'Journal système OVPN',
'p2p block' => 'Réseaux P2P',
-'p2p block save notice' => 'Veuillez recharger le jeu de règles de pare-feu afin d\'appliquer vos modifications.',
+'p2p block save notice' => 'Veuillez recharger le jeu de règles du pare-feu afin d\'appliquer vos modifications.',
'package failed to install' => 'L\'installation du paquet a échoué.',
'pagerefresh' => 'La page est en cours de rafraichissement, veuillez patienter.',
'pakfire accept all' => 'Voulez-vous installer tous les paquets ?',
@@ -1961,7 +1961,7 @@
'pakfire available addons' => 'Modules disponibles :',
'pakfire configuration' => 'Configuration Pakfire',
'pakfire core update auto' => 'Installer automatiquement les mises à jour du noyau et des modules :',
-'pakfire core update level' => 'Niveau de mise à jour du noyau ',
+'pakfire core update level' => 'Version de mise à jour du noyau ',
'pakfire health check' => 'Vérifier si le miroir est accessible (ping) :',
'pakfire install description' => 'Veuillez choisir un ou plusieurs modules dans la liste ci-dessous<br>et cliquer sur le signe PLUS pour le(s) installer.',
'pakfire install package' => 'Vous souhaitez installer les paquets suivants : ',
@@ -1993,8 +1993,8 @@
'pc add' => 'ajouter PC',
'pdc options' => 'Options PDC',
'percentage' => 'Pourcentage',
-'persistent' => 'Persistant',
-'pfs yes no' => 'Perfect Forward Secrecy (PFS)',
+'persistent' => 'Persistante',
+'pfs yes no' => 'Confidentialité persistante parfaite (PFS)',
'phase1 group' => 'Groupe phase 1',
'phonebook entry' => 'Entrée du répertoire :',
'ping disabled' => 'Désactiver la réponse au ping',
@@ -2008,11 +2008,11 @@
'ports' => 'Ports',
'portscans' => 'Scans de ports',
'pots' => 'Entrée ligne analogique classique',
-'ppp setup' => 'Installation PPP',
+'ppp setup' => 'Paramètres point à point (PPP)',
'pppoe' => 'PPPoE',
'pppoe settings' => 'Paramètres supplémentaires PPPoE :',
'pptp netconfig' => 'Ma config réseau',
-'pptp peer' => 'Peer',
+'pptp peer' => 'Pair',
'pptp route' => 'Route PPTP',
'pptp settings' => 'Paramètres supplémentaires PPTP :',
'pre-shared key is too short' => 'La clef partagée préliminaire est trop courte.',
@@ -2029,10 +2029,10 @@
'printing options' => 'Options d\'impression',
'priority' => 'Priorité',
'processes' => 'Processus',
-'processor vulnerability mitigations' => 'Atténuations de la vulnérabilité du processeur',
+'processor vulnerability mitigations' => 'Atténuation de la vulnérabilité du processeur',
'profile' => 'Profil',
'profile deleted' => 'Profil supprimé : ',
-'profile has errors' => 'Le profil contient des erreurs',
+'profile has errors' => 'Le profil de connexion contient des erreurs',
'profile made current' => 'Profil en cours : ',
'profile name' => 'Nom du profil :',
'profile name not given' => 'Le profil n\'a pas de nom.',
@@ -2081,7 +2081,7 @@
'rebooting' => 'Redémarrage en cours...',
'rebooting ipfire' => 'Redemarrage d\'IPFire',
'reconnect' => 'Reconnecter',
-'reconnection' => 'Reconnexion',
+'reconnection' => 'Reconnexion ',
'red' => 'Internet',
'red1' => 'ROUGE',
'references' => 'Références',
@@ -2155,7 +2155,7 @@
'secondary wins server address' => 'Serveur WINS secondaire ',
'seconds' => 'Secondes',
'section' => 'Section ',
-'secure shell server' => 'Secure shell server',
+'secure shell server' => 'Serveur Shell Sécurisé',
'security' => 'Sécurité',
'security options' => 'Options de sécurité',
'select' => 'Sélectionner',
@@ -2203,7 +2203,7 @@
'shuffle' => 'Mélanger',
'shutdown' => 'Arrêter',
'shutdown ask' => 'Arrêter ?',
-'shutdown control' => 'Contrôle de l\'arrêt d\'IPFire',
+'shutdown control' => 'Contrôle l\'arrêt d\'IPFire',
'shutdown sure' => 'Etes-vous sûr de vouloir arrêter ?',
'shutdown2' => 'Arrêt :',
'shutting down' => 'Arrêter',
@@ -2219,9 +2219,9 @@
'smbrestart' => 'Redémarrer Samba',
'smbstart' => 'Démarrer Samba',
'smbstop' => 'Arrêter Samba',
-'smt disabled' => 'Le MultiThreading Simultané (SMT) est désactivé',
-'smt enabled' => 'Le MultiThreading Simultané(SMT) est activé',
-'smt not supported' => 'Le MultiThreading Simultané (SMT) n\'est pas supporté',
+'smt disabled' => 'Le partage d\'un cœur de processeur (SMT) est désactivé',
+'smt enabled' => 'Le partage d\'un cœur de processeur (SMT) est activé',
+'smt not supported' => 'Le partage d\'un cœur de processeur (SMT) n\'est pas supporté',
'smtphost' => 'Hôte SMTP',
'smtpport' => 'Port SMTP',
'snat new source ip address' => 'Nouvelle adresse IP source',
@@ -2260,7 +2260,7 @@
'ssh access tip' => 'IPFire n\'utilise pas le port par défaut 22 pour le SSH !',
'ssh active sessions' => 'Connexions actives',
'ssh agent forwarding' => 'Autoriser le transfert d\'agent SSH',
-'ssh fingerprint' => 'Empreinte digitale',
+'ssh fingerprint' => 'Empreinte numérique',
'ssh host keys' => 'Clef SSH de l\'hôte',
'ssh is disabled' => 'SSH est desactive. Arret.',
'ssh is enabled' => 'SSH est active. Redemarrage.',
@@ -2325,7 +2325,7 @@
'ta key' => 'Clé d\'authentification TLS',
'taa zombieload2' => 'TSX Async Abort / ZombieLoad v2',
'tcp more reliable' => 'TCP (plus fiable)',
-'telephone not set' => 'Téléphone non défini.',
+'telephone not set' => 'Numéro de téléphone non défini.',
'template' => 'Préétabli',
'template warning' => 'Vous avez deux options pour établir la Qos : La première, vous cliquez sur le bouton de sauvegarde et générez les classes et règles qui vous conviennent.<br>La seconde, vous cliquez sur le bouton préétabli et les classes et règles seront mises en place par un modèle.',
'ten minutes' => '10 minutes',
@@ -2363,19 +2363,19 @@
'too long 80 char max' => ' est trop long, le maximum autorisé est de 80 caractères',
'tor' => 'Tor',
'tor 0 = disabled' => '0 = désactivé',
-'tor accounting' => 'Accounting',
+'tor accounting' => 'Comptage',
'tor accounting bytes' => 'Trafic (lu / écrit)',
'tor accounting bytes left' => 'restant',
'tor accounting interval' => 'Interval (UTC)',
-'tor accounting limit' => 'Accounting limit (Mo)',
-'tor accounting period' => 'Accounting period',
+'tor accounting limit' => 'Limite de comptage (Mo)',
+'tor accounting period' => 'Période de comptage',
'tor accounting period daily' => 'Quotidienne',
'tor accounting period monthly' => 'Mensuelle',
'tor accounting period weekly' => 'Hebdomadaire',
'tor acls' => 'Contrôle d\'accès',
'tor allowed subnets' => 'Sous-réseaux alloués (un par ligne)',
-'tor bandwidth burst' => 'Max. burst',
-'tor bandwidth rate' => 'Max. rate',
+'tor bandwidth burst' => 'Eclatement max.',
+'tor bandwidth rate' => 'Taux max.',
'tor bandwidth settings' => 'Paramètres de bande passante',
'tor bandwidth unlimited' => 'illimité',
'tor bridge enabled' => 'Activer le pont Tor',
@@ -2383,28 +2383,28 @@
'tor configuration' => 'Configuration Tor',
'tor connected relays' => 'Relais connectés',
'tor contact info' => 'Info contact',
-'tor daemon' => 'Service',
+'tor daemon' => 'Statut du service',
'tor directory port' => 'Port répertoire',
'tor enabled' => 'Activer Tor',
-'tor errmsg invalid accounting limit' => 'Invalid accounting limit',
-'tor errmsg invalid directory port' => 'Invalid directory port',
-'tor errmsg invalid ip or mask' => 'Sous-réseau ou IP non valide',
+'tor errmsg invalid accounting limit' => 'Limite de comptage invalide',
+'tor errmsg invalid directory port' => 'Port répertoire invalide',
+'tor errmsg invalid ip or mask' => 'Sous-réseau ou IP invalide',
'tor errmsg invalid node id' => 'ID noeud invalide',
'tor errmsg invalid relay address' => 'Adresse relais invalide',
'tor errmsg invalid relay name' => 'Surnom relais invalide',
'tor errmsg invalid relay port' => 'Port relais invalide',
'tor errmsg invalid socks port' => 'Port SOCKS invalide',
-'tor exit country' => 'Exit country',
-'tor exit country any' => 'Any country',
-'tor exit nodes' => 'Exit Nodes',
+'tor exit country' => 'Pays de sortie',
+'tor exit country any' => 'N\'importe quel pays',
+'tor exit nodes' => 'Noeuds de sortie',
'tor relay address' => 'Adresse relais',
'tor relay configuration' => 'Configuration relais Tor',
'tor relay enabled' => 'Activer relais Tor',
'tor relay external address' => 'Adresse externe relais',
-'tor relay fingerprint' => 'Relay fingerprint',
+'tor relay fingerprint' => 'Empreinte numérique relais',
'tor relay mode' => 'Mode relais',
'tor relay mode bridge' => 'Pont',
-'tor relay mode exit' => 'Exit-Node',
+'tor relay mode exit' => 'Noeud de sortie',
'tor relay mode private bridge' => 'Pont privé',
'tor relay mode relay' => 'Relais seul',
'tor relay nickname' => 'Surnom relais',
@@ -2596,7 +2596,7 @@
'urlfilter background text' => 'Afin d\'avoir une image de fond personnalisée pour les pages bloquées, envoyez le fichier .jpg',
'urlfilter backup' => 'Créer un fichier de sauvegarde',
'urlfilter backup error' => 'Impossible de créer un fichier de sauvegarde',
-'urlfilter backup settings' => 'Sauvegarder les réglages du filtre d\'URL',
+'urlfilter backup settings' => 'Sauvegarder les paramètres du filtre URL',
'urlfilter banned clients' => 'Adresses IP bannies',
'urlfilter blacklist age 1' => 'La dernière mise à jour de la liste noire a eu lieu il y a',
'urlfilter blacklist age 2' => 'jours',
@@ -2628,7 +2628,7 @@
'urlfilter constraint outside' => 'Hors',
'urlfilter constraint within' => 'Avec',
'urlfilter copy rule' => 'Copie',
-'urlfilter current files' => 'Fichiers courant du dépôt local ',
+'urlfilter current files' => 'Fichier(s) actuel(s) du dépôt local ',
'urlfilter custom blacklist' => 'Liste noire perso',
'urlfilter custom expression list' => 'Liste de mots clés perso',
'urlfilter custom url' => 'Source URL perso ',
@@ -2644,7 +2644,7 @@
'urlfilter edit time constraint rule' => 'Modifier une règle existante de contrainte de temps',
'urlfilter edit user quota rule' => 'Modifier une règle de quota utilisateur',
'urlfilter empty ads' => 'Bloquer "pubs" avec fenêtre vide ',
-'urlfilter empty repository' => 'Fichier du dépot local est vide',
+'urlfilter empty repository' => 'Le dossier du dépot local est vide',
'urlfilter enable automatic blacklist update' => 'Activer la mise à jour automatique ',
'urlfilter enable custom blacklist' => 'Activer liste noire perso ',
'urlfilter enable custom expression list' => 'Activer la liste d\'expressions personnalisées ',
@@ -2697,11 +2697,11 @@
'urlfilter msg text 3' => 'Message ligne 3 ',
'urlfilter network access control' => 'Contrôle d\'accès réseau en fonction',
'urlfilter no categories' => 'Aucune catégorie disponible',
-'urlfilter not enabled' => 'Filtre URL n\'est pas activé sur le proxy page web',
+'urlfilter not enabled' => 'Le filtre URL n\'est pas activé sur la page du proxy web',
'urlfilter quota restart message' => 'Note : Les compteurs seront remis à zéro pour tous les utilisateurs au redémarrage du filtre URL',
-'urlfilter quota time error' => 'Valeur non valide pour quota de temps',
+'urlfilter quota time error' => 'Valeur invalide pour le quota de temps',
'urlfilter quota user error' => 'Au moins un nom d\'utilisateur est requis',
-'urlfilter redirect template' => 'Redirection modèle de page',
+'urlfilter redirect template' => 'Modèle de page de redirection',
'urlfilter redirectpage' => 'Redirige vers cette URL ',
'urlfilter remove file' => 'Supprime le fichier du dépôt',
'urlfilter renewal' => 'Renouvellement',
@@ -2713,7 +2713,7 @@
'urlfilter restart notification' => 'Activer règles modifiées',
'urlfilter restore' => 'Importer fichier de sauvegarde',
'urlfilter restore results' => 'Restaurer résultats',
-'urlfilter restore settings' => 'Restaurer paramètres filtre URL',
+'urlfilter restore settings' => 'Restaurer les paramètres du filtre URL',
'urlfilter restore success' => 'Configuration filtre URL restaurée. Filtre URL doit être redémarré pour activer les nouveaux paramètres.',
'urlfilter restore text' => 'Pour restaurer une configuration précédemment sauvée, charger le fichier de sauvegarde .tar.gz suivant ',
'urlfilter safesearch' => 'Activer SafeSearch ',
@@ -2727,7 +2727,7 @@
'urlfilter set time constraints' => 'Fixer les contraintes horaires',
'urlfilter set user quota' => 'Fixer les quotas utilisateur',
'urlfilter show category' => 'Montrer la catégorie de page bloquée ',
-'urlfilter show dnserror' => 'Utiliser "Erreur DNS" pour les url bloquées ',
+'urlfilter show dnserror' => 'Utiliser "Erreur DNS" pour url bloquées ',
'urlfilter show ip' => 'Montrer adresse IP page bloquée ',
'urlfilter show url' => 'Montrer adresse url page bloquée ',
'urlfilter source' => 'Hôte(s) ou réseau(x) source(s)',
@@ -2762,7 +2762,7 @@
'urlfilter upload success' => 'Chargement liste noire complété avec succès.',
'urlfilter upload text' => 'Pour installer une mise à jour, uploader le fichier .tar.gz suivant ',
'urlfilter url filter' => 'Filtre d\'URL',
-'urlfilter urlfilter blacklist editor' => 'Editeur de la liste noire du filtre d\'URL ',
+'urlfilter urlfilter blacklist editor' => 'Editeur de la liste noire du filtre URL ',
'urlfilter urls' => 'URLs (une par ligne)',
'urlfilter user time quota' => 'Quota de temps (en minutes) ',
'urlfilter username' => 'Nom d\'utilisateur',
@@ -2835,7 +2835,8 @@
'vpn start action start' => 'Toujours démarré',
'vpn statistic n2n' => 'Stats OpenVPN (site-à-site)',
'vpn statistic rw' => 'Stats OpenVPN (client nomade)',
-'vpn subjectaltname' => 'Subject Alt Name',
+'vpn subjectaltname' => 'Nom de l\'objet',
+'vpn subjectaltname missing' => 'Le nom de l\'objet ne peut être vide.',
'vpn wait' => 'ATTENTE',
'vpn watch' => 'Redémarrer le VPN site-à-site si l\'IP hôte distant change (dyndns).',
'vpn weak' => 'Faible',
@@ -2881,7 +2882,7 @@
'wlan client eap phase2 method' => 'Méthode phase 2 EAP',
'wlan client eap state' => 'Statut EAP',
'wlan client edit entry' => 'Modifier la configuration du client sans fil',
-'wlan client encryption' => 'Encryption',
+'wlan client encryption' => 'Chiffrement',
'wlan client encryption eap' => 'EAP',
'wlan client encryption none' => 'Aucun',
'wlan client encryption wep' => 'WEP',
@@ -2911,14 +2912,14 @@
'wlan clients' => 'Clients sans fil',
'wlanap' => 'Point d\'accès',
'wlanap auto' => 'Sélection automatique du canal',
-'wlanap broadcast ssid' => 'Broadcast SSID',
+'wlanap broadcast ssid' => 'Diffusion du SSID',
'wlanap channel' => 'Canal',
'wlanap client isolation' => 'Isolation du client',
'wlanap configuration' => 'Configuration du point d\'accès',
'wlanap country' => 'Code pays',
'wlanap debugging' => 'Débogage',
'wlanap del interface' => 'Supprimer l\'interface sélectionnée ?',
-'wlanap encryption' => 'Encryption',
+'wlanap encryption' => 'Chiffrement',
'wlanap informations' => 'Informations',
'wlanap interface' => 'Choisir interface',
'wlanap invalid wpa' => 'Longueur non valide dans la Passphrase WPA. Doit comporter entre 8 et 63 caractères.',
diff --git a/lfs/configroot b/lfs/configroot
index 227d09239..6092f889b 100644
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -63,7 +63,7 @@ $(TARGET) :
# Touch empty files
for i in auth/users backup/include.user backup/exclude.user \
captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \
- dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
+ dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dns/servers dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \
fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \
isdn/settings mac/settings main/hosts main/routing main/security main/settings optionsfw/settings \
@@ -132,6 +132,7 @@ $(TARGET) :
echo "DROPWIRELESSFORWARD=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "POLICY=MODE2" >> $(CONFIG_ROOT)/firewall/settings
echo "POLICY1=MODE2" >> $(CONFIG_ROOT)/firewall/settings
+ echo "USE_ISP_NAMESERVERS=on" >> $(CONFIG_ROOT)/dns/settings
# Install snort to suricata converter.
cp $(DIR_SRC)/config/suricata/convert-snort /usr/sbin/convert-snort
diff --git a/lfs/initscripts b/lfs/initscripts
index d74e0c650..3a769bd99 100644
--- a/lfs/initscripts
+++ b/lfs/initscripts
@@ -161,6 +161,7 @@ $(TARGET) :
ln -sf ../init.d/mountkernfs /etc/rc.d/rcsysinit.d/S00mountkernfs
ln -sf ../init.d/sysctl /etc/rc.d/rcsysinit.d/S01sysctl
ln -sf ../init.d/modules /etc/rc.d/rcsysinit.d/S05modules
+ ln -sf ../init.d/lvmetad /etc/rc.d/rcsysinit.d/S09lvmetad
ln -sf ../init.d/udev /etc/rc.d/rcsysinit.d/S10udev
ln -sf ../init.d/waitdrives /etc/rc.d/rcsysinit.d/S19waitdrives
ln -sf ../init.d/swap /etc/rc.d/rcsysinit.d/S20swap
diff --git a/lfs/lvm2 b/lfs/lvm2
index fe6974279..a9e02b692 100644
--- a/lfs/lvm2
+++ b/lfs/lvm2
@@ -78,7 +78,12 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
./configure \
--prefix=/usr \
--with-usrlibdir=/usr/lib \
- --enable-pkgconfig
+ --enable-pkgconfig \
+ --with-udevdir=/lib/udev/rules.d \
+ --with-default-locking-dir=/run/lvm \
+ --enable-lvmetad \
+ --enable-udev_rules \
+ --enable-udev_sync
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
@rm -rf $(DIR_APP)
diff --git a/src/initscripts/system/lvmetad b/src/initscripts/system/lvmetad
new file mode 100755
index 000000000..fdae39fd9
--- /dev/null
+++ b/src/initscripts/system/lvmetad
@@ -0,0 +1,41 @@
+#!/bin/sh
+########################################################################
+# Begin $rc_base/init.d/lvmeta2
+#
+# Description : LVM2 Metadata Daemon
+########################################################################
+
+. /etc/sysconfig/rc
+. ${rc_functions}
+
+case "${1}" in
+ start)
+ # Create diretory for control socket
+ mkdir -p /run/lvm
+
+ boot_mesg "Starting LVM2 Metadata Daemon..."
+ loadproc /usr/sbin/lvmetad
+ ;;
+
+ stop)
+ boot_mesg "Stopping LVM2 Metadata Daemon..."
+ killproc /usr/sbin/lvmetad
+ ;;
+
+ restart)
+ ${0} stop
+ sleep 1
+ ${0} start
+ ;;
+
+ status)
+ statusproc /usr/sbin/lvmetad
+ ;;
+
+ *)
+ echo "Usage: ${0} {start|stop|restart|status}"
+ exit 1
+ ;;
+esac
+
+# End $rc_base/init.d/lvmetad
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. e4c19cc91c23fb9f08b2b993133565670312a8e0
by Arne Fitzenreiter 16 Jan '20
by Arne Fitzenreiter 16 Jan '20
16 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via e4c19cc91c23fb9f08b2b993133565670312a8e0 (commit)
from 9662858bd8ad02dbd11369436797420a6a1f25b7 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit e4c19cc91c23fb9f08b2b993133565670312a8e0
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Thu Jan 16 15:01:13 2020 +0100
core140: add dns changes to updater.
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/core/140/filelists/files | 19 +++++++++++++++++++
config/rootfiles/core/140/update.sh | 1 +
2 files changed, 20 insertions(+)
Difference in files:
diff --git a/config/rootfiles/core/140/filelists/files b/config/rootfiles/core/140/filelists/files
index 2285170ff..4cb92f0d3 100644
--- a/config/rootfiles/core/140/filelists/files
+++ b/config/rootfiles/core/140/filelists/files
@@ -2,12 +2,31 @@ etc/system-release
etc/issue
srv/web/ipfire/cgi-bin/credits.cgi
var/ipfire/langs
+etc/rc.d/init.d/networking/dhcpcd.exe
+etc/rc.d/init.d/networking/red
+etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
etc/rc.d/init.d/unbound
etc/rc.d/init.d/suricata
+etc/ppp/ip-down
+etc/ppp/ip-up
+etc/unbound/unbound.conf
opt/pakfire/etc/pakfire.conf
opt/pakfire/lib/functions.pl
+srv/web/ipfire/cgi-bin/dns.cgi
+srv/web/ipfire/cgi-bin/dnsforward.cgi
+srv/web/ipfire/cgi-bin/hosts.cgi
srv/web/ipfire/cgi-bin/ids.cgi
+srv/web/ipfire/cgi-bin/index.cgi
+srv/web/ipfire/cgi-bin/netexternal.cgi
+srv/web/ipfire/cgi-bin/pppsetup.cgi
srv/web/ipfire/cgi-bin/vpnmain.cgi
usr/local/bin/backupiso
+usr/local/bin/convert-dns-settings
+usr/local/bin/unboundctrl
usr/sbin/convert-snort
usr/sbin/setup
+usr/sbin/unbound-dhcp-leases-bridge
+var/ipfire/backup/bin/backup.pl
+var/ipfire/ids-functions.pl
+var/ipfire/menu.d/30-network.menu
+var/ipfire/general-functions.pl
diff --git a/config/rootfiles/core/140/update.sh b/config/rootfiles/core/140/update.sh
index 27b032966..0b43a388d 100644
--- a/config/rootfiles/core/140/update.sh
+++ b/config/rootfiles/core/140/update.sh
@@ -43,6 +43,7 @@ done
# Remove files
+rm -f /etc/rc.d/init.d/networking/red.up/06-safe-search
# Stop services
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9662858bd8ad02dbd11369436797420a6a1f25b7
by Arne Fitzenreiter 16 Jan '20
by Arne Fitzenreiter 16 Jan '20
16 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 9662858bd8ad02dbd11369436797420a6a1f25b7 (commit)
via 3a380f87c7b914edc41cfd01b8106254f85e27e7 (commit)
via 834b933ca5f9e3c969f7891cb0588b752cbe24e5 (commit)
from cb1c8f108f7efb8fbe9aa8036e0d4e0d8c54aa59 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 9662858bd8ad02dbd11369436797420a6a1f25b7
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Wed Jan 15 17:15:48 2020 +0000
Revert "stage2: update rootfile"
This reverts commit a877032915898b07dcacd165c0f89e427bc672a4.
commit 3a380f87c7b914edc41cfd01b8106254f85e27e7
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Wed Jan 15 17:15:25 2020 +0000
Revert "Introduce update-location-database script."
This reverts commit 93a985cc05e6b564ac1e3fc59fd37e94c77000ca.
commit 834b933ca5f9e3c969f7891cb0588b752cbe24e5
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Wed Jan 15 17:14:57 2020 +0000
Revert "crontab: Adjust crontab to hourly launch the update-location-database"
This reverts commit f8e7c1c9d07d348e8c3235c83fd889068269c823.
-----------------------------------------------------------------------
Summary of changes:
config/cron/crontab | 2 +-
config/rootfiles/common/aarch64/stage2 | 1 +
config/rootfiles/common/stage2 | 1 +
config/rootfiles/common/x86_64/stage2 | 1 +
src/scripts/update-location-database | 45 -----------
src/scripts/xt_geoip_update | 138 +++++++++++++++++++++++++++++++++
6 files changed, 142 insertions(+), 46 deletions(-)
delete mode 100644 src/scripts/update-location-database
create mode 100644 src/scripts/xt_geoip_update
Difference in files:
diff --git a/config/cron/crontab b/config/cron/crontab
index 519554195..56801394e 100644
--- a/config/cron/crontab
+++ b/config/cron/crontab
@@ -60,7 +60,7 @@ HOME=/
00 2 * 10-11 0 /usr/local/bin/timezone-transition /usr/local/bin/firewallctrl
# Update GeoIP database once a month.
-%hourly,random * * * [ -f "/var/ipfire/red/active" ] && /usr/local/bin/update-location-database >/dev/null 2>&1
+%monthly,random * * * [ -f "/var/ipfire/red/active" ] && /usr/local/bin/xt_geoip_update >/dev/null 2>&1
# Retry sending spooled mails regularly
%hourly * /usr/sbin/dma -q
diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2
index 14544ddcc..f4169a44e 100644
--- a/config/rootfiles/common/aarch64/stage2
+++ b/config/rootfiles/common/aarch64/stage2
@@ -107,6 +107,7 @@ usr/local/bin/timecheck
usr/local/bin/timezone-transition
usr/local/bin/update-ids-ruleset
usr/local/bin/update-lang-cache
+usr/local/bin/xt_geoip_update
#usr/local/include
#usr/local/lib
#usr/local/lib/sse2
diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2
index c57d252f3..fca540431 100644
--- a/config/rootfiles/common/stage2
+++ b/config/rootfiles/common/stage2
@@ -107,6 +107,7 @@ usr/local/bin/timezone-transition
usr/local/bin/update-lang-cache
usr/local/bin/update-ids-ruleset
usr/local/bin/xt_geoip_build
+usr/local/bin/xt_geoip_update
#usr/local/include
#usr/local/lib
#usr/local/lib/sse2
diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2
index e3832f3ad..cc67837e5 100644
--- a/config/rootfiles/common/x86_64/stage2
+++ b/config/rootfiles/common/x86_64/stage2
@@ -109,6 +109,7 @@ usr/local/bin/timezone-transition
usr/local/bin/update-ids-ruleset
usr/local/bin/update-lang-cache
usr/local/bin/xt_geoip_build
+usr/local/bin/xt_geoip_update
#usr/local/include
#usr/local/lib
#usr/local/lib/sse2
diff --git a/src/scripts/update-location-database b/src/scripts/update-location-database
deleted file mode 100644
index ebed5a095..000000000
--- a/src/scripts/update-location-database
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/bash
-###############################################################################
-# #
-# IPFire.org - A linux based firewall #
-# Copyright (C) 2019 IPFire Development Team <info(a)ipfire.org> #
-# #
-# This program is free software: you can redistribute it and/or modify #
-# it under the terms of the GNU General Public License as published by #
-# the Free Software Foundation, either version 3 of the License, or #
-# (at your option) any later version. #
-# #
-# This program is distributed in the hope that it will be useful, #
-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
-# GNU General Public License for more details. #
-# #
-# You should have received a copy of the GNU General Public License #
-# along with this program. If not, see <http://www.gnu.org/licenses/>. #
-# #
-###############################################################################
-
-eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings)
-
-# Proxy settings.
-# Check if a proxy should be used.
-if [[ $UPSTREAM_PROXY ]]; then
- PROXYSETTINGS="https_proxy=http://"
-
- # Check if authentication against the proxy is configured.
- if [[ $UPSTREAM_USER && $UPSTREAM_PASSWORD ]]; then
- PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_USER:$UPSTREAM_PASSWORD@"
- fi
-
- # Add proxy server.
- PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_PROXY"
-
- # Export proxy settings.
- export HTTPS_PROXY="$PROXYSETTINGS"
-fi
-
-# Get the latest location database from server.
-/usr/bin/location-downloader update
-
-# Call initscript to reload the firewall.
-/etc/init.d/firewall reload
diff --git a/src/scripts/xt_geoip_update b/src/scripts/xt_geoip_update
new file mode 100644
index 000000000..ebd266533
--- /dev/null
+++ b/src/scripts/xt_geoip_update
@@ -0,0 +1,138 @@
+#!/bin/bash
+###############################################################################
+# #
+# IPFire.org - A linux based firewall #
+# Copyright (C) 2019 IPFire Development Team <info(a)ipfire.org> #
+# #
+# This program is free software: you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation, either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# This program is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+# #
+###############################################################################
+
+TMP_PATH=$(mktemp -dp /var/tmp)
+TMP_FILE=$(mktemp -p $TMP_PATH)
+
+SCRIPT_PATH=/usr/local/bin
+DEST_PATH=/usr/share/xt_geoip
+DB_PATH=/var/lib/GeoIP
+DB1_PATH=/usr/share/GeoIP
+
+DL_URL=https://geolite.maxmind.com/download/geoip/database
+DL_FILE=GeoLite2-Country-CSV.zip
+
+eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings)
+
+function download() {
+ echo "Downloading latest GeoIP ruleset..."
+
+ # Proxy settings.
+ # Check if a proxy should be used.
+ if [[ $UPSTREAM_PROXY ]]; then
+ PROXYSETTINGS="-e https_proxy=http://"
+
+ # Check if authentication against the proxy is configured.
+ if [[ $UPSTREAM_USER && $UPSTREAM_PASSWORD ]]; then
+ PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_USER:$UPSTREAM_PASSWORD@"
+ fi
+
+ # Add proxy server.
+ PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_PROXY"
+ fi
+
+ # Get the latest GeoIP database from server.
+ wget $DL_URL/$DL_FILE $PROXYSETTINGS -O $TMP_FILE
+
+ # Extract files to database path.
+ unzip $TMP_FILE -d $TMP_PATH
+
+ return 0
+}
+
+function install() {
+ echo "Install CSV database..."
+
+ # Check if the database dir exists.
+ if [ ! -e "$DB_PATH" ]; then
+ mkdir -p $DB_PATH &>/dev/null
+ fi
+
+ # Check if the directory for binary databases exists.
+ if [ ! -e "$DEST_PATH" ]; then
+ mkdir -p $DEST_PATH &>/dev/null
+ fi
+
+ # Install CSV databases.
+ if ! cp -af $TMP_PATH/*/* $DB_PATH &>/dev/null; then
+ echo "Could not copy files. Aborting." >&2
+ return 1
+ fi
+
+ return 0
+}
+
+function build_legacy() {
+ echo "Convert database to legacy GeoIP.dat ..."
+ cat $DB_PATH/GeoLite2-Country-Blocks-IPv4.csv | \
+ $DB1_PATH/bin/geolite2-to-legacy-csv.sh $DB1_PATH/bin/countryInfo.txt > \
+ $TMP_FILE
+ $DB1_PATH/bin/geoip-generator -v -4 --info="$(date -u +'GEO-106FREE %Y%m%d Build -IPFire-' \
+ -r $DB_PATH/GeoLite2-Country-Blocks-IPv4.csv) $(<$DB_PATH/COPYRIGHT.txt)" -o \
+ $DB1_PATH/GeoIP.dat $TMP_FILE
+
+ return 0
+}
+
+
+function build() {
+ echo "Convert database..."
+
+ # Run script to convert the CSV file into several xtables
+ # compatible binary files.
+ if ! $SCRIPT_PATH/xt_geoip_build -S $DB_PATH -D $DEST_PATH; then
+ echo "Could not convert ruleset. Aborting." >&2
+ return 1
+ fi
+
+ return 0
+}
+
+function cleanup() {
+ echo "Cleaning up temporary files..."
+ if ! rm -rf $TMP_PATH &>/dev/null; then
+ echo "Could not remove files. Aborting." >&2
+ return 1
+ fi
+
+ return 0
+}
+
+function main() {
+ local func
+ for func in download install build build_legacy; do
+ if ! ${func}; then
+ # Cleanup any temporary data
+ cleanup
+
+ return 1
+ fi
+ done
+
+ # Cleanup
+ cleanup || return $?
+
+ # All done
+ return 0
+}
+
+# Run the main function.
+main || exit $?
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. cb1c8f108f7efb8fbe9aa8036e0d4e0d8c54aa59
by Arne Fitzenreiter 14 Jan '20
by Arne Fitzenreiter 14 Jan '20
14 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via cb1c8f108f7efb8fbe9aa8036e0d4e0d8c54aa59 (commit)
from 19602b681f9b5d88578162319366e7efde768352 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit cb1c8f108f7efb8fbe9aa8036e0d4e0d8c54aa59
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Tue Jan 14 21:10:15 2020 +0000
set version in backupiso and also pakfire core to 140
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/core/140/filelists/files | 2 +-
make.sh | 2 +-
src/scripts/backupiso | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
Difference in files:
diff --git a/config/rootfiles/core/140/filelists/files b/config/rootfiles/core/140/filelists/files
index 82c6e5ec0..2285170ff 100644
--- a/config/rootfiles/core/140/filelists/files
+++ b/config/rootfiles/core/140/filelists/files
@@ -2,12 +2,12 @@ etc/system-release
etc/issue
srv/web/ipfire/cgi-bin/credits.cgi
var/ipfire/langs
-etc/rc.d/init.d/networking/red.up/06-safe-search
etc/rc.d/init.d/unbound
etc/rc.d/init.d/suricata
opt/pakfire/etc/pakfire.conf
opt/pakfire/lib/functions.pl
srv/web/ipfire/cgi-bin/ids.cgi
srv/web/ipfire/cgi-bin/vpnmain.cgi
+usr/local/bin/backupiso
usr/sbin/convert-snort
usr/sbin/setup
diff --git a/make.sh b/make.sh
index f60277301..0d32f812b 100755
--- a/make.sh
+++ b/make.sh
@@ -27,7 +27,7 @@ SNAME="ipfire" # Short name
# If you update the version don't forget to update backupiso and add it to core update
VERSION="2.25" # Version number
CORE="140" # Core Level (Filename)
-PAKFIRE_CORE="139" # Core Level (PAKFIRE)
+PAKFIRE_CORE="140" # Core Level (PAKFIRE)
GIT_BRANCH=`git rev-parse --abbrev-ref HEAD` # Git Branch
SLOGAN="www.ipfire.org" # Software slogan
CONFIG_ROOT=/var/ipfire # Configuration rootdir
diff --git a/src/scripts/backupiso b/src/scripts/backupiso
index 7e8599f00..220e619d4 100644
--- a/src/scripts/backupiso
+++ b/src/scripts/backupiso
@@ -1,7 +1,7 @@
#!/bin/sh
# FIXME: edit this lines before release
-IPFVER=2.23
+IPFVER=2.25
COREVER=$(cat /opt/pakfire/db/core/mine)
arch=$(uname -m)
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 19602b681f9b5d88578162319366e7efde768352
by Arne Fitzenreiter 14 Jan '20
by Arne Fitzenreiter 14 Jan '20
14 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 19602b681f9b5d88578162319366e7efde768352 (commit)
via 3a5866ac2bc26ddbc5c51192dbc4f653b879036a (commit)
from a877032915898b07dcacd165c0f89e427bc672a4 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 19602b681f9b5d88578162319366e7efde768352
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Tue Jan 14 13:53:59 2020 +0100
dns.cgi: Fix ID and greater than checks.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit 3a5866ac2bc26ddbc5c51192dbc4f653b879036a
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Tue Jan 14 12:14:02 2020 +0100
dns.cgi: Set kdig params for timeout and retry back to default.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Acked-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
html/cgi-bin/dns.cgi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
Difference in files:
diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi
index ff228422b..11415cdf8 100755
--- a/html/cgi-bin/dns.cgi
+++ b/html/cgi-bin/dns.cgi
@@ -634,7 +634,7 @@ END
# Nameservers with an ID's of one or two are ISP assigned,
# and we cannot perform any actions on them, so hide the tools for
# them.
- if ($id gt "2") {
+ if ($id > 2) {
print <<END;
<td align='center' width='5%' $col>
@@ -677,7 +677,7 @@ END
print"<table width='100%'>\n";
# Check if the usage of the ISP nameservers is enabled and there are more than 2 servers.
- if (($settings{'USE_ISP_NAMESERVERS'} eq "on") && ($server_amount gt "2")) {
+ if (($settings{'USE_ISP_NAMESERVERS'} eq "on") && ($server_amount > 2)) {
print <<END;
<tr>
<td class='boldbase'> <b>$Lang::tr{'legend'}:</b></td>
@@ -847,7 +847,7 @@ sub check_nameserver($$$$) {
}
# Default values.
- my @command = ("kdig", "+timeout=2", "+retry=0", "+dnssec",
+ my @command = ("kdig", "+dnssec",
"+bufsize=1232");
# Handle different protols.
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a877032915898b07dcacd165c0f89e427bc672a4
by Arne Fitzenreiter 14 Jan '20
by Arne Fitzenreiter 14 Jan '20
14 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via a877032915898b07dcacd165c0f89e427bc672a4 (commit)
from 61cc563558f0bd2fed68a60e83f68d595855e7d7 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit a877032915898b07dcacd165c0f89e427bc672a4
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Tue Jan 14 06:54:45 2020 +0000
stage2: update rootfile
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/aarch64/stage2 | 1 -
config/rootfiles/common/stage2 | 1 -
config/rootfiles/common/x86_64/stage2 | 1 -
3 files changed, 3 deletions(-)
Difference in files:
diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2
index f4169a44e..14544ddcc 100644
--- a/config/rootfiles/common/aarch64/stage2
+++ b/config/rootfiles/common/aarch64/stage2
@@ -107,7 +107,6 @@ usr/local/bin/timecheck
usr/local/bin/timezone-transition
usr/local/bin/update-ids-ruleset
usr/local/bin/update-lang-cache
-usr/local/bin/xt_geoip_update
#usr/local/include
#usr/local/lib
#usr/local/lib/sse2
diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2
index fca540431..c57d252f3 100644
--- a/config/rootfiles/common/stage2
+++ b/config/rootfiles/common/stage2
@@ -107,7 +107,6 @@ usr/local/bin/timezone-transition
usr/local/bin/update-lang-cache
usr/local/bin/update-ids-ruleset
usr/local/bin/xt_geoip_build
-usr/local/bin/xt_geoip_update
#usr/local/include
#usr/local/lib
#usr/local/lib/sse2
diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2
index cc67837e5..e3832f3ad 100644
--- a/config/rootfiles/common/x86_64/stage2
+++ b/config/rootfiles/common/x86_64/stage2
@@ -109,7 +109,6 @@ usr/local/bin/timezone-transition
usr/local/bin/update-ids-ruleset
usr/local/bin/update-lang-cache
usr/local/bin/xt_geoip_build
-usr/local/bin/xt_geoip_update
#usr/local/include
#usr/local/lib
#usr/local/lib/sse2
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 61cc563558f0bd2fed68a60e83f68d595855e7d7
by Arne Fitzenreiter 13 Jan '20
by Arne Fitzenreiter 13 Jan '20
13 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 61cc563558f0bd2fed68a60e83f68d595855e7d7 (commit)
via 7be4822f3d60eee6be75cb622b153ae2487bcdce (commit)
via 04b7a78140356b6c3288364cb1451f012e842fe4 (commit)
via ebc14e8db2c43274770153b7561d8be0ac2f7139 (commit)
via 24a694d425b3036a3334ded8a39b74833c7ab05d (commit)
via 77c454b267f4a99809226b4a5f0d2c7ca31265b4 (commit)
via d37cdb1bf80a97ea55c18d566fb3154b75d228a0 (commit)
via 6137797cb39b32e49d97eee572478a92099ded23 (commit)
via 903247fef8bb482d81aeef98a88b8acf1a024482 (commit)
via f59bc0c55d807ca37ef39654cdfb60d53bdfa65e (commit)
via a25dcda295b45ca6e5789c01c7b78f639d188bb3 (commit)
via 39a6219fff28fa4af0754683148f1fb781cef818 (commit)
via 6e61f357fbba0bee4c01a66637e6fd44cdf85905 (commit)
via 611587cf29033a8cdcd86b02a5ec40bd8a9b2a08 (commit)
via 4caa0efc595594d167d24085f7a181a4baa7bdc0 (commit)
via 0c1094770a727b2c269c5c7c88eabd4ee9d01dcd (commit)
via bdb1f38a07370c006f06ad31582abe8e0ff8c4a7 (commit)
via f03f34298bbd749211d7ee8c6c4252bb9cc1bda8 (commit)
via c73baee1f05ed75e66e5f2b894241cc38acb1072 (commit)
via 8fbb12f168f770835cd3637996ca6fac974f1c0e (commit)
via dc7466ce9a007b1fe5554d6c873d40c724ccd1a5 (commit)
via 12c49915d8ab35f3f7ae9ee404311efb6284c840 (commit)
via c8dcd46537bebe4f59cd7c22d09c45e98bfecb1f (commit)
via 9f9b2b8ebc2751064503fed22602f7608d8c316e (commit)
via 9702252470263975e972e9ea9be9a87bc5541de1 (commit)
via 8f4bde6574d83ac197b071caaf4dd857b791ce64 (commit)
via 46cc88ed22d2e4af848c5ada6319c9e2c9e790c7 (commit)
via 719db1cdb80ce4a11f932c4bc0c92196f423e902 (commit)
via 770ea81ee514c92038f1c28546d99e7872aae1ad (commit)
via 43140993025fd6fb0b4da264fe478762c63f0bf8 (commit)
via a969acc7d76d91963cab41facc611a3f78c8af70 (commit)
via 03e466de35d450853b5f7f8b82b24b64dd9f20fd (commit)
via 038f962ea0555c132287db4c20f83800becf846f (commit)
via 70187da6a665120f1af623899a10b0b1eff670e3 (commit)
via f36855fe73010235ffbcf409219cbb2dadded8a2 (commit)
via f10fb4bf4366f515f0ff523e5ae0469f55edcb70 (commit)
via 25dda4a082b6b2927cbe16039bf1ef96b955a1ff (commit)
via beebf925c38004d0703f8777a16f32adb9e1d8fa (commit)
via a33489a7aa6cd8f42c48f23b193e75fa8156b71f (commit)
via a32fd634ceb2e2227fb5e4104b5c9f1cfa5263d0 (commit)
via 4b26aac62535a79dff2882356a32a1594270f3b8 (commit)
via 2654c6694571baf4efafee6deb0b0b4dd1f85b39 (commit)
via 54898bc6c1951ec42f2cdced18235a31fcc7840e (commit)
via 77c7a94cdd6d0cf6fa1a48cd1248205dea1d6069 (commit)
via 984f14bdc4e1663200d286f98935158884366fa4 (commit)
via 71471d9bded39dc2186a96b0eb7d5f18c103636f (commit)
via dab1258a789ab3c09b6766e603bbdbab57010909 (commit)
via 1434fa0df5ab01c2e3a430f05db159a3a82bc3ba (commit)
via 4e2d3325afaf413e707e5d4db7172c7f379b59ce (commit)
via ffc46751f29af7759e051cbb0114b79b4fba4433 (commit)
via ee90aa9858451db1e93e463db4b90332bbad7320 (commit)
via 50005ad1d4da8a95dac1518d40e02344de58944f (commit)
via 94a51c64bb7aead36ea0e6d40de06a8cc195cd5d (commit)
via 15cf79e3b864bef46d32b08e3b381a654e00950e (commit)
via dea5f34914819b5f6c0801ff12eafa521c79188b (commit)
via 372576e0ab699a188e9248d73afcc00a5a635d2b (commit)
via 3bf804e83400c87398950526170b3d77bf38b8a6 (commit)
via 0fa6bde78ab9d25a078cad1b233e67c14bfe1cc9 (commit)
via cdfc93cb7abd412987bbf098117fa86cb475de72 (commit)
via e8981e3c8faafbf042e29d3896b6c81b77e5fe2c (commit)
via ecbf66761f922f821940ec063d271acae89c78cb (commit)
via 2946d562f1fa06840e576184d58a1e90a03934e7 (commit)
via 24d7c5ef6bea7b6521d309757d2fa0461935f89d (commit)
via 456f0b06f4691cd7e07b9e5ec5bb86d0117c3456 (commit)
via 0bb159bbfc6dd48bf2b6aa4b4d7e1d87f61e1655 (commit)
via c5d20f9665a659ddd5fc46fa8cba1c3133a91180 (commit)
via 1cb8ffe84d5d3ea1699fa566ce8fa03f50638f4a (commit)
via f8e7c1c9d07d348e8c3235c83fd889068269c823 (commit)
via 93a985cc05e6b564ac1e3fc59fd37e94c77000ca (commit)
from 23dc6e0b23dc519b41a26ff25ecf0e221863128f (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 61cc563558f0bd2fed68a60e83f68d595855e7d7
Merge: 23dc6e0b2 7be4822f3
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Mon Jan 13 21:42:49 2020 +0000
Merge remote-tracking branch 'ms/next-dns-ng' into next
commit 7be4822f3d60eee6be75cb622b153ae2487bcdce
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:43:27 2020 +0100
unbound: Make dhcp-leases.conf readable for everyone
unbound runs as nobody and cannot reload its configuration
when this file is only readable for root.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 04b7a78140356b6c3288364cb1451f012e842fe4
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:25:10 2020 +0100
unbound: Do not reset safe search again
This is now done in the reload stage and we do not need to
take care about it again.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit ebc14e8db2c43274770153b7561d8be0ac2f7139
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:20:32 2020 +0100
unbound: Drop some unused variables
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 24a694d425b3036a3334ded8a39b74833c7ab05d
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:19:22 2020 +0100
unbound: Drop function to reload forwarders on the fly
This is now being done by updating and re-reading forward.conf.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 77c454b267f4a99809226b4a5f0d2c7ca31265b4
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:13:03 2020 +0100
dnsforward.cgi: Reloading unbound is enough to apply changes
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit d37cdb1bf80a97ea55c18d566fb3154b75d228a0
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:12:02 2020 +0100
hosts.cgi: Hosts can now be imported when reloading unbound
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 6137797cb39b32e49d97eee572478a92099ded23
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:10:18 2020 +0100
unbound: Write hosts to unbound configuration file
This will allow us to read more hosts in a shorter time.
Fixes: #11743
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 903247fef8bb482d81aeef98a88b8acf1a024482
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 20:55:59 2020 +0100
unbound: There is no need to rewrite tuning.conf
The number of CPU cores and memory normally does not change
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit f59bc0c55d807ca37ef39654cdfb60d53bdfa65e
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 20:55:32 2020 +0100
unbound: Reload own hostname, too
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit a25dcda295b45ca6e5789c01c7b78f639d188bb3
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 20:44:55 2020 +0100
dns.cgi: Fix check for undefined variable
This was positive when zero was returned.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 39a6219fff28fa4af0754683148f1fb781cef818
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Mon Jan 13 17:40:29 2020 +0100
dns.cgi: Show error when trying to use ISP nameservers and TLS at the same time.
Because the ISP-assigned nameservers do not have any TLS-hostname
information they cannot be used, when TLS is activated.
They only can be used if they will be added as "regular" DNS servers
with a TLS-hostname.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 6e61f357fbba0bee4c01a66637e6fd44cdf85905
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 16:05:27 2020 +0000
setup: Remove DNS settings
This is no longer required since we have a new CGI script
that takes care of all DNS settings and stores things in
another format.
Fixes: #12235
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 611587cf29033a8cdcd86b02a5ec40bd8a9b2a08
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Mon Jan 13 10:42:56 2020 +0100
dns.cgi: Fix id compare when adding a new nameserver.
I do not know why perl when using "le" which means "less-or-equal"
defines a "10" as "1".
This commit fixes the issue that it was not possible to add more than 8
nameservers.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 4caa0efc595594d167d24085f7a181a4baa7bdc0
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Sat Jan 11 19:37:50 2020 +0100
ids.cgi: Do reload instead of restarting unbound
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 0c1094770a727b2c269c5c7c88eabd4ee9d01dcd
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Sat Jan 11 19:36:29 2020 +0100
initscripts/unbound: Add support for reload the service
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit bdb1f38a07370c006f06ad31582abe8e0ff8c4a7
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Sat Jan 11 19:35:24 2020 +0100
unboundctrl: Add support for calling reload.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit f03f34298bbd749211d7ee8c6c4252bb9cc1bda8
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Sat Jan 11 19:34:12 2020 +0100
dns.cgi: Only perform reverse lookup if DNS is working.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit c73baee1f05ed75e66e5f2b894241cc38acb1072
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Fri Jan 10 09:29:47 2020 +0100
convert-dns-settings: Set correct ownership after convert is done.
Otherwise it may happen, that the created config files have wrong
permissions and the WUI will break.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 8fbb12f168f770835cd3637996ca6fac974f1c0e
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Thu Jan 9 16:36:39 2020 +0100
dns.cgi: Restart suricata if neccessary.
When the DNS configuration of the system is changed,
we need to re-generate the file which contains the DNS Server
details for suricata and to restart the service.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit dc7466ce9a007b1fe5554d6c873d40c724ccd1a5
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Thu Jan 9 16:30:10 2020 +0100
index.cgi: Do not longer display the DNS servers.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 12c49915d8ab35f3f7ae9ee404311efb6284c840
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Thu Jan 9 16:25:01 2020 +0100
ids-functions.pl: Update generate_dns_servers_file() function.
The function now uses the newly introduced get_nameservers() function
while generating the DNS servers file.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit c8dcd46537bebe4f59cd7c22d09c45e98bfecb1f
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Thu Jan 9 16:08:13 2020 +0100
general-functions.pl: Add get_nameservers().
This function simply return an array of all used nameservers.
It also takes care if the usage of ISP assigned nameservers
is enabled or not and if user-added nameservers are enabled or not.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 9f9b2b8ebc2751064503fed22602f7608d8c316e
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Thu Jan 9 09:15:05 2020 +0100
guardian: Remove code for DNS servers.
In the past this code was used to add the DNS servers
to the ignore list and prevent them from being blocked by
guardian.
Because of the switch to suricata as IPS, guardian now prevents
from password brute-forcing on SSH and/or the webserver, so this
code is not longer needed and safly can be removed.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 9702252470263975e972e9ea9be9a87bc5541de1
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 18:44:41 2020 +0100
dns.cgi: Move grab_address_from_file function to general-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 8f4bde6574d83ac197b071caaf4dd857b791ce64
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 18:19:58 2020 +0100
dns.cgi: Also restart unbound if a server got enabled/disabled
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 46cc88ed22d2e4af848c5ada6319c9e2c9e790c7
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 18:15:33 2020 +0100
dns.cgi: Remove accidently commited debug code
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 719db1cdb80ce4a11f932c4bc0c92196f423e902
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 18:10:23 2020 +0100
dns.cgi: Restart unbound
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 770ea81ee514c92038f1c28546d99e7872aae1ad
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 18:00:15 2020 +0100
dns.cgi: Display DNS system status.
For this, a test query to the local unbound instance will be
sent and if the DNS system work properly can be answerd.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 43140993025fd6fb0b4da264fe478762c63f0bf8
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 15:24:59 2020 +0100
dns.cgi: Perform server checks on user request
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit a969acc7d76d91963cab41facc611a3f78c8af70
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 15:22:56 2020 +0100
dns.cgi: Remove hard-coded box title.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 03e466de35d450853b5f7f8b82b24b64dd9f20fd
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 12:58:50 2020 +0100
dns.cgi: Do not perform kdig tests when adding a server
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 038f962ea0555c132287db4c20f83800becf846f
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 12:12:29 2020 +0100
dns.cgi: Check for empty server address.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 70187da6a665120f1af623899a10b0b1eff670e3
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 11:13:05 2020 +0100
dns.cgi: Perform kdig tests only if the system is online.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit f36855fe73010235ffbcf409219cbb2dadded8a2
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 11:12:42 2020 +0100
dns.cgi: Introduce red_is_active()
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit f10fb4bf4366f515f0ff523e5ae0469f55edcb70
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 10:35:52 2020 +0100
dns.cgi: Always display the input field for TLS_HOSTNAME
* Mark it as required if the protocol is set to TLS.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 25dda4a082b6b2927cbe16039bf1ef96b955a1ff
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Wed Jan 8 10:35:24 2020 +0100
dns.cgi: Only perform reverse lookups if the system is online
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit beebf925c38004d0703f8777a16f32adb9e1d8fa
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 16:32:35 2020 +0000
unbound: Implement setting qname minimisation into strict mode
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit a33489a7aa6cd8f42c48f23b193e75fa8156b71f
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 16:24:35 2020 +0000
unbound: Try to set time when DNS is not working
Since DNSSEC relies on time to validate its signatures,
a common problem is that some systems (usually those without
a working RTC) are not being able to reach their time server.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit a32fd634ceb2e2227fb5e4104b5c9f1cfa5263d0
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 16:02:14 2020 +0000
unbound: Do not update the forwarders when we are running in TLS mode
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 4b26aac62535a79dff2882356a32a1594270f3b8
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 15:28:21 2020 +0000
unbound: Read configuration globally
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 2654c6694571baf4efafee6deb0b0b4dd1f85b39
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 15:21:59 2020 +0000
unbound: Update forwarders when system connects/disconnects
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 54898bc6c1951ec42f2cdced18235a31fcc7840e
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 14:57:12 2020 +0000
unbound: Update setting Safe Search redirects
When the system comes online, we must update entries
in the unbound cache to point to the "safe" IP addresses.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 77c7a94cdd6d0cf6fa1a48cd1248205dea1d6069
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 14:49:54 2020 +0000
dns.cgi: Show ISP name servers as disabled
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 984f14bdc4e1663200d286f98935158884366fa4
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 14:41:13 2020 +0000
dns.cgi: Fix handling of WARNINGs from kdig
There might be multiple warnings which must all be shown
to the user.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 71471d9bded39dc2186a96b0eb7d5f18c103636f
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 13:46:11 2020 +0000
dns.cgi: Remove smartmatch operator
Perl likes to make things difficult
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit dab1258a789ab3c09b6766e603bbdbab57010909
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 13:45:21 2020 +0000
dns.cgi: Timeout after 2 seconds for DNS server checks
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 1434fa0df5ab01c2e3a430f05db159a3a82bc3ba
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 13:35:45 2020 +0000
DNS: Write name servers received from ISP to /var/run/dns{1,2}
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 4e2d3325afaf413e707e5d4db7172c7f379b59ce
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 13:06:09 2020 +0000
unbound: Drop live checks
Those checks have caused us a lot of trouble and are now being dropped.
Users must make sure to choose servers that support DNSSEC or enable
any of the tunneling mechanisms to be able to reach them.
Fixes: #12239
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit ffc46751f29af7759e051cbb0114b79b4fba4433
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 12:59:24 2020 +0000
unbound: Add path to TLS CA bundle
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit ee90aa9858451db1e93e463db4b90332bbad7320
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 12:58:28 2020 +0000
unbound: No longer read old configuration file
The old configuration file in /etc/sysconfig/unbound is no
longer being used and all settings should be in
/var/ipfire/dns/settings.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 50005ad1d4da8a95dac1518d40e02344de58944f
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 12:55:35 2020 +0000
unbound: Write upstream name servers to forward.conf
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 94a51c64bb7aead36ea0e6d40de06a8cc195cd5d
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 11:18:41 2020 +0000
unbound: Remove test-name-server command
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 15cf79e3b864bef46d32b08e3b381a654e00950e
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Nov 12 12:43:28 2019 +0000
unbound: Convert forward zones to stub zones
It was incorrect to use forward zones here, because that
assumes that unbound is talking a recursive resolver here.
The feature is however designed to be talking to an authoritative
server.
Fixes: #12230
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit dea5f34914819b5f6c0801ff12eafa521c79188b
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Nov 4 12:04:48 2019 +0000
unbound: Allow forcing to speak TLS to upstream servers only
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 372576e0ab699a188e9248d73afcc00a5a635d2b
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 11:12:33 2020 +0000
unbound: Set EDNS buffer size to 1232 bytes
Fixes: #12240
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 3bf804e83400c87398950526170b3d77bf38b8a6
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 11:06:10 2020 +0000
dns.cgi: Set EDNS buffer size to 1232
References: #12240
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 0fa6bde78ab9d25a078cad1b233e67c14bfe1cc9
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 10:53:34 2020 +0000
Update English translation
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit cdfc93cb7abd412987bbf098117fa86cb475de72
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 10:48:01 2020 +0000
webif: Show menu entry for DNS all the time
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit e8981e3c8faafbf042e29d3896b6c81b77e5fe2c
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 10:45:08 2020 +0000
netexternal.cgi: Drop DNSSEC status
This has now been moved to the new dns.cgi.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit ecbf66761f922f821940ec063d271acae89c78cb
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Tue Jan 7 10:43:19 2020 +0000
DNS: Add converter to migrate settings
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 2946d562f1fa06840e576184d58a1e90a03934e7
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Tue Jan 7 10:32:43 2020 +0100
langs/en.pl: Add new strings for modified dns.cgi.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 24d7c5ef6bea7b6521d309757d2fa0461935f89d
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Tue Jan 7 10:30:37 2020 +0100
dns.cgi: Rework to allow central DNS configuration.
Fixes #12237.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 456f0b06f4691cd7e07b9e5ec5bb86d0117c3456
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Sun Jan 5 12:37:57 2020 +0100
pppsetup.cgi: Remove support for configure DNS settings.
Fixes #12234.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 0bb159bbfc6dd48bf2b6aa4b4d7e1d87f61e1655
Merge: c5d20f966 916859f5f
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Sun Jan 5 12:15:00 2020 +0100
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
commit c5d20f9665a659ddd5fc46fa8cba1c3133a91180
Merge: 1cb8ffe84 c846ed161
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Fri Jan 3 11:06:47 2020 +0100
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
commit 1cb8ffe84d5d3ea1699fa566ce8fa03f50638f4a
Merge: f8e7c1c9d 6a3acff93
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Mon Dec 16 09:04:29 2019 +0100
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
commit f8e7c1c9d07d348e8c3235c83fd889068269c823
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Mon Dec 9 14:19:53 2019 +0100
crontab: Adjust crontab to hourly launch the update-location-database
script.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
commit 93a985cc05e6b564ac1e3fc59fd37e94c77000ca
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date: Mon Dec 9 14:14:34 2019 +0100
Introduce update-location-database script.
This script obsoletes the old xt_geoip_update script.
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/backup/backup.pl | 3 +
config/cfgroot/general-functions.pl | 81 ++
config/cfgroot/ids-functions.pl | 35 +-
config/cron/crontab | 2 +-
config/menu/30-network.menu | 12 +-
config/rootfiles/common/aarch64/initscripts | 1 -
config/rootfiles/common/aarch64/stage2 | 1 +
config/rootfiles/common/armv5tel/initscripts | 1 -
config/rootfiles/common/i586/initscripts | 1 -
config/rootfiles/common/stage2 | 1 +
config/rootfiles/common/x86_64/initscripts | 1 -
config/rootfiles/common/x86_64/stage2 | 1 +
config/unbound/unbound-dhcp-leases-bridge | 4 +
config/unbound/unbound.conf | 10 +
doc/language_issues.de | 32 +-
doc/language_issues.en | 34 +-
doc/language_issues.es | 32 +-
doc/language_issues.fr | 32 +-
doc/language_issues.it | 32 +
doc/language_issues.nl | 32 +-
doc/language_issues.pl | 32 +-
doc/language_issues.ru | 32 +-
doc/language_issues.tr | 32 +
doc/language_missings | 112 +++
html/cgi-bin/dns.cgi | 950 ++++++++++++++++++---
html/cgi-bin/dnsforward.cgi | 6 +-
html/cgi-bin/guardian.cgi | 44 +-
html/cgi-bin/hosts.cgi | 2 +-
html/cgi-bin/index.cgi | 19 -
html/cgi-bin/netexternal.cgi | 131 ---
html/cgi-bin/pppsetup.cgi | 29 -
langs/en/cgi-bin/en.pl | 26 +-
lfs/guardian | 2 +-
src/initscripts/networking/dhcpcd.exe | 20 +-
src/initscripts/networking/red | 2 -
.../networking/red.up/05-update-dns-forwarders | 13 +-
src/initscripts/networking/red.up/06-safe-search | 3 -
src/initscripts/system/unbound | 553 +++---------
src/misc-progs/unboundctrl.c | 6 +-
src/ppp/ip-down | 5 +-
src/ppp/ip-up | 29 +-
src/scripts/convert-dns-settings | 95 +++
.../scripts/update-location-database | 41 +-
src/scripts/xt_geoip_update | 138 ---
src/setup/networking.c | 93 +-
45 files changed, 1643 insertions(+), 1120 deletions(-)
mode change 100644 => 100755 html/cgi-bin/dns.cgi
delete mode 100644 src/initscripts/networking/red.up/06-safe-search
create mode 100755 src/scripts/convert-dns-settings
copy config/dma/dma-cleanup-spool => src/scripts/update-location-database (67%)
delete mode 100644 src/scripts/xt_geoip_update
Difference in files:
diff --git a/config/backup/backup.pl b/config/backup/backup.pl
index b1dd1d297..aae31098a 100644
--- a/config/backup/backup.pl
+++ b/config/backup/backup.pl
@@ -143,6 +143,9 @@ restore_backup() {
rm -rf "/var/ipfire/snort"
fi
+ # Convert DNS settings
+ convert-dns-settings
+
return 0
}
diff --git a/config/cfgroot/general-functions.pl b/config/cfgroot/general-functions.pl
index aefcfb687..448f4c635 100644
--- a/config/cfgroot/general-functions.pl
+++ b/config/cfgroot/general-functions.pl
@@ -1177,4 +1177,85 @@ sub number_cpu_cores() {
return $cores;
}
+# Tiny function to grab a single IP-address from a given file.
+sub grab_address_from_file($) {
+ my ($file) = @_;
+
+ my $address;
+
+ # Check if the given file exists.
+ if(-f $file) {
+ # Open the file for reading.
+ open(FILE, $file) or die "Could not read from $file. $!\n";
+
+ # Read the address from the file.
+ $address = <FILE>;
+
+ # Close filehandle.
+ close(FILE);
+
+ # Remove newlines.
+ chomp($address);
+
+ # Check if the obtained address is valid.
+ if (&validip($address)) {
+ # Return the address.
+ return $address;
+ }
+ }
+
+ # Return nothing.
+ return;
+}
+
+# Function to get all configured and enabled nameservers.
+sub get_nameservers () {
+ my %settings;
+ my %servers;
+
+ my @nameservers;
+
+ # Read DNS configuration.
+ &readhash("$General::swroot/dns/settings", \%settings);
+
+ # Read configured DNS servers.
+ &readhasharray("$General::swroot/dns/servers", \%servers);
+
+ # Check if the ISP assigned server should be used.
+ if ($settings{'USE_ISP_NAMESERVERS'} eq "on") {
+ # Assign ISP nameserver files.
+ my @ISP_nameserver_files = ( "/var/run/dns1", "/var/run/dns2" );
+
+ # Loop through the array of ISP assigned DNS servers.
+ foreach my $file (@ISP_nameserver_files) {
+ # Grab the IP address.
+ my $address = &grab_address_from_file($file);
+
+ # Check if an address has been grabbed.
+ if ($address) {
+ # Add the address to the array of nameservers.
+ push(@nameservers, $address);
+ }
+ }
+ }
+
+ # Check if DNS servers are configured.
+ if (%servers) {
+ # Loop through the hash of configured DNS servers.
+ foreach my $id (keys %servers) {
+ my $address = $servers{$id}[0];
+ my $status = $servers{$id}[2];
+
+ # Check if the current processed server is enabled.
+ if ($status eq "enabled") {
+ # Add the address to the array of nameservers.
+ push(@nameservers, $address);
+ }
+ }
+ }
+
+ # Return the array.
+ return @nameservers;
+}
+
1;
diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl
index 89ad90c2e..3fa19fab7 100644
--- a/config/cfgroot/ids-functions.pl
+++ b/config/cfgroot/ids-functions.pl
@@ -702,40 +702,31 @@ sub generate_home_net_file() {
# Function to generate and write the file which contains the configured and used DNS servers.
#
sub generate_dns_servers_file() {
- # Open file which contains the current used DNS configuration.
- open (FILE, "${General::swroot}/red/dns") or die "Could not read DNS configuration from ${General::swroot}/red/dns. $!\n";
-
- # Read-in whole file content and store it in a temporary array.
- my @file_content = split(' ', <FILE>);
-
- # Close file handle.
- close(FILE);
+ # Get the used DNS servers.
+ my @nameservers = &General::get_nameservers();
# Format dns servers declaration.
my $line = "\"\[";
- # Check if the current DNS configuration is using the local recursor mode.
- if ($file_content[0] eq "local" && $file_content[1] eq "recursor") {
- # The responsible DNS servers on red are directly used, and because we are not able
- # to specify each single DNS server address here, we currently have to thread each
- # address which is not part of the HOME_NET as possible DNS server.
- $line = "$line" . "!\$HOME_NET";
-
- } else {
- # Loop through the array which contains the file content.
- foreach my $server (@file_content) {
- # Remove newlines.
- chomp($server);
-
+ # Check if the system has configured nameservers.
+ if (@nameservers) {
+ # Loop through the array of nameservers.
+ foreach my $server (@nameservers) {
# Add the DNS server to the line.
$line = "$line" . "$server";
# Check if the current DNS server was the last in the array.
- if ($server ne $file_content[-1]) {
+ if ($server ne $nameservers[-1]) {
# Add "," for the next DNS server.
$line = "$line" . "\,";
}
}
+ } else {
+ # The responsible DNS servers on red are directly used, and because we are not able
+ # to specify each single DNS server address here, we currently have to thread each
+ # address which is not part of the HOME_NET as possible DNS server.
+ $line = "$line" . "!\$HOME_NET";
+
}
# Close the line...
diff --git a/config/cron/crontab b/config/cron/crontab
index 56801394e..519554195 100644
--- a/config/cron/crontab
+++ b/config/cron/crontab
@@ -60,7 +60,7 @@ HOME=/
00 2 * 10-11 0 /usr/local/bin/timezone-transition /usr/local/bin/firewallctrl
# Update GeoIP database once a month.
-%monthly,random * * * [ -f "/var/ipfire/red/active" ] && /usr/local/bin/xt_geoip_update >/dev/null 2>&1
+%hourly,random * * * [ -f "/var/ipfire/red/active" ] && /usr/local/bin/update-location-database >/dev/null 2>&1
# Retry sending spooled mails regularly
%hourly * /usr/sbin/dma -q
diff --git a/config/menu/30-network.menu b/config/menu/30-network.menu
index 629411786..19571a870 100644
--- a/config/menu/30-network.menu
+++ b/config/menu/30-network.menu
@@ -8,6 +8,12 @@
'title' => "$Lang::tr{'zoneconf title'}",
'enabled' => 1,
};
+ $subnetwork->{'12.dns'} = {
+ 'caption' => $Lang::tr{'dns title'},
+ 'uri' => '/cgi-bin/dns.cgi',
+ 'title' => "$Lang::tr{'dns title'}",
+ 'enabled' => 1,
+ };
$subnetwork->{'20.proxy'} = {'caption' => "$Lang::tr{'web proxy'}",
'uri' => '/cgi-bin/proxy.cgi',
'title' => "$Lang::tr{'web proxy'}",
@@ -45,12 +51,6 @@
'title' => "$Lang::tr{'edit hosts'}",
'enabled' => 1,
};
- $subnetwork->{'51.dnsmenu'} = {
- 'caption' => $Lang::tr{'dns menu'},
- 'uri' => '/cgi-bin/dns.cgi',
- 'title' => "$Lang::tr{'dns menu'}",
- 'enabled' => `grep "RED_TYPE=DHCP" /var/ipfire/ethernet/settings`,
- };
$subnetwork->{'52.dnsforward'} = {
'caption' => $Lang::tr{'dnsforward'},
'uri' => '/cgi-bin/dnsforward.cgi',
diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts
index 6b08fcac6..202da7372 100644
--- a/config/rootfiles/common/aarch64/initscripts
+++ b/config/rootfiles/common/aarch64/initscripts
@@ -51,7 +51,6 @@ etc/rc.d/init.d/networking/red.down/99-beep
#etc/rc.d/init.d/networking/red.up
etc/rc.d/init.d/networking/red.up/01-conntrack-cleanup
etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
-etc/rc.d/init.d/networking/red.up/06-safe-search
etc/rc.d/init.d/networking/red.up/10-miniupnpd
etc/rc.d/init.d/networking/red.up/10-multicast
etc/rc.d/init.d/networking/red.up/10-static-routes
diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2
index 2d9a70f81..f4169a44e 100644
--- a/config/rootfiles/common/aarch64/stage2
+++ b/config/rootfiles/common/aarch64/stage2
@@ -91,6 +91,7 @@ usr/lib64
usr/local/bin/backupiso
usr/local/bin/connscheduler
usr/local/bin/consort.sh
+usr/local/bin/convert-dns-settings
usr/local/bin/convert-ovpn
usr/local/bin/filesystem-cleanup
usr/local/bin/hddshutdown
diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts
index 6b08fcac6..202da7372 100644
--- a/config/rootfiles/common/armv5tel/initscripts
+++ b/config/rootfiles/common/armv5tel/initscripts
@@ -51,7 +51,6 @@ etc/rc.d/init.d/networking/red.down/99-beep
#etc/rc.d/init.d/networking/red.up
etc/rc.d/init.d/networking/red.up/01-conntrack-cleanup
etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
-etc/rc.d/init.d/networking/red.up/06-safe-search
etc/rc.d/init.d/networking/red.up/10-miniupnpd
etc/rc.d/init.d/networking/red.up/10-multicast
etc/rc.d/init.d/networking/red.up/10-static-routes
diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts
index 23b1938f4..9d4f7e5f3 100644
--- a/config/rootfiles/common/i586/initscripts
+++ b/config/rootfiles/common/i586/initscripts
@@ -51,7 +51,6 @@ etc/rc.d/init.d/networking/red.down/99-beep
#etc/rc.d/init.d/networking/red.up
etc/rc.d/init.d/networking/red.up/01-conntrack-cleanup
etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
-etc/rc.d/init.d/networking/red.up/06-safe-search
etc/rc.d/init.d/networking/red.up/10-miniupnpd
etc/rc.d/init.d/networking/red.up/10-multicast
etc/rc.d/init.d/networking/red.up/10-static-routes
diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2
index b0680914e..fca540431 100644
--- a/config/rootfiles/common/stage2
+++ b/config/rootfiles/common/stage2
@@ -90,6 +90,7 @@ usr/lib/libstdc++.so.6
usr/local/bin/backupiso
usr/local/bin/connscheduler
usr/local/bin/consort.sh
+usr/local/bin/convert-dns-settings
usr/local/bin/convert-ovpn
usr/local/bin/filesystem-cleanup
usr/local/bin/hddshutdown
diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts
index 23b1938f4..9d4f7e5f3 100644
--- a/config/rootfiles/common/x86_64/initscripts
+++ b/config/rootfiles/common/x86_64/initscripts
@@ -51,7 +51,6 @@ etc/rc.d/init.d/networking/red.down/99-beep
#etc/rc.d/init.d/networking/red.up
etc/rc.d/init.d/networking/red.up/01-conntrack-cleanup
etc/rc.d/init.d/networking/red.up/05-update-dns-forwarders
-etc/rc.d/init.d/networking/red.up/06-safe-search
etc/rc.d/init.d/networking/red.up/10-miniupnpd
etc/rc.d/init.d/networking/red.up/10-multicast
etc/rc.d/init.d/networking/red.up/10-static-routes
diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2
index 9d3334e69..cc67837e5 100644
--- a/config/rootfiles/common/x86_64/stage2
+++ b/config/rootfiles/common/x86_64/stage2
@@ -92,6 +92,7 @@ usr/lib64
usr/local/bin/backupiso
usr/local/bin/connscheduler
usr/local/bin/consort.sh
+usr/local/bin/convert-dns-settings
usr/local/bin/convert-ovpn
usr/local/bin/filesystem-cleanup
usr/local/bin/hddshutdown
diff --git a/config/unbound/unbound-dhcp-leases-bridge b/config/unbound/unbound-dhcp-leases-bridge
index 64306bc9b..e3da4860b 100644
--- a/config/unbound/unbound-dhcp-leases-bridge
+++ b/config/unbound/unbound-dhcp-leases-bridge
@@ -28,6 +28,7 @@ import logging.handlers
import os
import re
import signal
+import stat
import subprocess
import tempfile
@@ -528,6 +529,9 @@ class UnboundConfigWriter(object):
for rr in l.rrset:
f.write("local-data: \"%s\"\n" % " ".join(rr))
+ # Make file readable for everyone
+ os.fchmod(f.fileno(), stat.S_IRUSR|stat.S_IWUSR|stat.S_IRGRP|stat.S_IROTH)
+
os.rename(filename, self.path)
def _control(self, *args):
diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index e20c3330d..24822ee67 100644
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -61,6 +61,13 @@ server:
harden-algo-downgrade: no
use-caps-for-id: yes
aggressive-nsec: yes
+ qname-minimisation: yes
+
+ # TLS
+ tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt
+
+ # EDNS Buffer Size (#12240)
+ edns-buffer-size: 1232
# Harden against DNS cache poisoning
unwanted-reply-threshold: 1000000
@@ -78,6 +85,9 @@ server:
# Include DHCP leases
include: "/etc/unbound/dhcp-leases.conf"
+ # Include hosts
+ include: "/etc/unbound/hosts.conf"
+
# Include any forward zones
include: "/etc/unbound/forward.conf"
diff --git a/doc/language_issues.de b/doc/language_issues.de
index 42d9c60b5..d3539dd98 100644
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -203,7 +203,23 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
+WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
WARNING: translation string unused: donation-link
@@ -240,7 +256,6 @@ WARNING: translation string unused: err rs 1
WARNING: translation string unused: err rs 6 decrypt
WARNING: translation string unused: err rs 7 untartst
WARNING: translation string unused: err rs 8 untar
-WARNING: translation string unused: error
WARNING: translation string unused: error config
WARNING: translation string unused: error external access
WARNING: translation string unused: esp encryption
@@ -408,6 +423,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -754,11 +770,22 @@ WARNING: translation string unused: zoneconf val vlan tag assignment error
WARNING: translation string unused: zoneconf val zoneslave amount error
WARNING: untranslated string: Scan for Songs = unknown string
WARNING: untranslated string: addons = Addons
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: community rules = Snort/VRT GPLv2 Community Rules
WARNING: untranslated string: dangerous = Dangerous
WARNING: untranslated string: dead peer detection = Dead Peer Detection
WARNING: untranslated string: default IP address = Default IP Address
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: emerging pro rules = Emergingthreats.net Pro Rules
WARNING: untranslated string: emerging rules = Emergingthreats.net Community Rules
WARNING: untranslated string: enable smt = Enable Simultaneous Multi-Threading (SMT)
@@ -798,10 +825,13 @@ WARNING: untranslated string: guardian logtarget_syslog = unknown string
WARNING: untranslated string: guardian no entries = unknown string
WARNING: untranslated string: guardian service = unknown string
WARNING: untranslated string: itlb multihit = iTLB MultiHit
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: route config changed = unknown string
WARNING: untranslated string: routing config added = unknown string
WARNING: untranslated string: routing config changed = unknown string
WARNING: untranslated string: routing table = unknown string
WARNING: untranslated string: show tls-auth key = Show tls-auth key
+WARNING: untranslated string: standard = Standard
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: taa zombieload2 = TSX Async Abort / ZombieLoad v2
WARNING: untranslated string: vpn statistics n2n = unknown string
diff --git a/doc/language_issues.en b/doc/language_issues.en
index 885e85d75..eea6a9b7c 100644
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -335,7 +335,7 @@ WARNING: untranslated string: august = August
WARNING: untranslated string: authentication = Authentication:
WARNING: untranslated string: automatic = Automatic
WARNING: untranslated string: average = Average
-WARNING: untranslated string: back = BACK
+WARNING: untranslated string: back = Back
WARNING: untranslated string: backup = Backup
WARNING: untranslated string: backup from = Backup from
WARNING: untranslated string: backupaddon = Addon Backup
@@ -358,6 +358,7 @@ WARNING: untranslated string: block = Block
WARNING: untranslated string: blue = BLUE
WARNING: untranslated string: blue access = Blue Access
WARNING: untranslated string: broadcast = Broadcast
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: broken pipe = Broken pipe
WARNING: untranslated string: buffered memory = Buffered Memory
WARNING: untranslated string: buffers = buffers
@@ -607,27 +608,22 @@ WARNING: untranslated string: dl client arch = Download Client Package (zip)
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dmz = DMZ
WARNING: untranslated string: dnat address = Firewall Interface
-WARNING: untranslated string: dns address deleted = Successfully deleted!
-WARNING: untranslated string: dns address deleted txt = The DNS-Server addresses have been successfully deleted.<br />You have to reboot or reconnect that the changes have effect!
-WARNING: untranslated string: dns address done = The DNS-Server address settings are going to be saved.
-WARNING: untranslated string: dns address recon = Trying to reconnect!
+WARNING: untranslated string: dns = unknown string
WARNING: untranslated string: dns check failed = DNS check failed
-WARNING: untranslated string: dns desc = If the red0 interface gets the IP address information via DHCP from the provider, the DNS server addresses will be set automatically. Now here you are able to change these DNS server IP addresses with your own ones.
-WARNING: untranslated string: dns error 0 = The IP address of the <strong>primary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>secondary</strong> DNS server address is valid.
-WARNING: untranslated string: dns error 01 = The entered IP address of the <strong>primary</strong> and <strong>secondary</strong> DNS server are not valid, please check your entries!
-WARNING: untranslated string: dns error 1 = The IP address of the <strong>secondary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>primary</strong> DNS server address is valid.
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
-WARNING: untranslated string: dns header = Assign DNS server addresses only for DHCP on red0
-WARNING: untranslated string: dns list = List of free public DNS servers
-WARNING: untranslated string: dns menu = Assign DNS-Server
-WARNING: untranslated string: dns new 0 = New <strong>primary</strong> DNS server IP:
-WARNING: untranslated string: dns new 1 = New <strong>secondary</strong> DNS server IP:
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns proxy server = DNS Proxy Server
-WARNING: untranslated string: dns saved = Successfully saved!
-WARNING: untranslated string: dns saved txt = The two entered DNS server addresses have been saved successfully.<br />You have to reboot or reconnect that the changes have effect!
WARNING: untranslated string: dns servers = DNS Servers
WARNING: untranslated string: dns title = Domain Name System
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: dnsforward = DNS Forwarding
WARNING: untranslated string: dnsforward add a new entry = Add a new entry
WARNING: untranslated string: dnsforward configuration = DNS forward configuration
@@ -638,7 +634,6 @@ WARNING: untranslated string: dnsforward forward_servers = Nameservers
WARNING: untranslated string: dnsforward zone = Zone
WARNING: untranslated string: dnssec aware = DNSSEC Aware
WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled
-WARNING: untranslated string: dnssec information = DNSSEC Information
WARNING: untranslated string: dnssec not supported = DNSSEC Not supported
WARNING: untranslated string: dnssec validating = DNSSEC Validating
WARNING: untranslated string: dod = Dial on Demand
@@ -727,6 +722,7 @@ WARNING: untranslated string: enter ack class = Enter the ACK- Class <br /> and
WARNING: untranslated string: enter data = Enter your settings <br /> and then press <i>Save</i>.
WARNING: untranslated string: entropy = Entropy
WARNING: untranslated string: entropy graphs = Entropy Graphs
+WARNING: untranslated string: error = Error
WARNING: untranslated string: error messages = Error messages
WARNING: untranslated string: esp keylife should be between 1 and 24 hours = ESP keylife should be between 1 and 24 hours.
WARNING: untranslated string: every = Every
@@ -1231,7 +1227,6 @@ WARNING: untranslated string: magic packet send to: = Magic packet send to:
WARNING: untranslated string: main page = Main page
WARNING: untranslated string: manage printers = manage printers
WARNING: untranslated string: manage shares = Manage Shares
-WARNING: untranslated string: manual = Manual
WARNING: untranslated string: manually = Manually
WARNING: untranslated string: map to guest = Map to Guest
WARNING: untranslated string: march = March
@@ -1347,6 +1342,7 @@ WARNING: untranslated string: not enough disk space = Not enough disk space
WARNING: untranslated string: not present = <b>Not</b> present
WARNING: untranslated string: not running = not running
WARNING: untranslated string: not set = not set
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: notice = Notice
WARNING: untranslated string: november = November
WARNING: untranslated string: ntp common settings = Common settings
@@ -1670,6 +1666,7 @@ WARNING: untranslated string: ssh tempstart15 = Stop SSH demon in 15 minutes
WARNING: untranslated string: ssh tempstart30 = Stop SSH demon in 30 minutes
WARNING: untranslated string: ssh username = Username
WARNING: untranslated string: sstraffic = Net-Traffic
+WARNING: untranslated string: standard = Standard
WARNING: untranslated string: standard login script = Standard login script
WARNING: untranslated string: start = Start
WARNING: untranslated string: start address = Start address:
@@ -1684,6 +1681,7 @@ WARNING: untranslated string: std classes = Standardclasses
WARNING: untranslated string: stop = Stop
WARNING: untranslated string: stop ovpn server = Stop OpenVPN Server
WARNING: untranslated string: stopped = STOPPED
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: subject = Subject
WARNING: untranslated string: subnet mask = Subnet Mask
WARNING: untranslated string: subscripted user rules = Talos VRT rules with subscription
diff --git a/doc/language_issues.es b/doc/language_issues.es
index 7ce921f91..0c9853d12 100644
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -194,6 +194,21 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
@@ -359,6 +374,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -740,6 +756,7 @@ WARNING: untranslated string: atm device = Device:
WARNING: untranslated string: attention = ATTENTION
WARNING: untranslated string: bit = bit
WARNING: untranslated string: block = Block
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: capabilities = Capabilities
WARNING: untranslated string: ccd add = Add network
@@ -804,9 +821,19 @@ WARNING: untranslated string: dhcp dns update algo = Algorithm
WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dnat address = Firewall Interface
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns servers = DNS Servers
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: dnsforward = DNS Forwarding
WARNING: untranslated string: dnsforward add a new entry = Add a new entry
WARNING: untranslated string: dnsforward configuration = DNS forward configuration
@@ -817,7 +844,6 @@ WARNING: untranslated string: dnsforward forward_servers = Nameservers
WARNING: untranslated string: dnsforward zone = Zone
WARNING: untranslated string: dnssec aware = DNSSEC Aware
WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled
-WARNING: untranslated string: dnssec information = DNSSEC Information
WARNING: untranslated string: dnssec not supported = DNSSEC Not supported
WARNING: untranslated string: dnssec validating = DNSSEC Validating
WARNING: untranslated string: downlink = Downlink
@@ -852,6 +878,7 @@ WARNING: untranslated string: enable smt = Enable Simultaneous Multi-Threading (
WARNING: untranslated string: encryption = Encryption:
WARNING: untranslated string: entropy = Entropy
WARNING: untranslated string: entropy graphs = Entropy Graphs
+WARNING: untranslated string: error = Error
WARNING: untranslated string: fallout zombieload ridl = Fallout/ZombieLoad/RIDL
WARNING: untranslated string: fifteen minutes = 15 Minutes
WARNING: untranslated string: fireinfo ipfire version = IPFire version
@@ -1161,6 +1188,7 @@ WARNING: untranslated string: no data = unknown string
WARNING: untranslated string: none = none
WARNING: untranslated string: not a valid dh key = Not a valid Diffie-Hellman parameters file. Please use a length of 2048, 3072 or 4096 bits and the PKCS#3 format.
WARNING: untranslated string: not affected = Not Affected
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: notice = Notice
WARNING: untranslated string: one hour = One Hour
WARNING: untranslated string: one month = One Month
@@ -1244,7 +1272,9 @@ WARNING: untranslated string: ssh agent forwarding = Allow SSH Agent Forwarding
WARNING: untranslated string: ssh login time = Logged in since
WARNING: untranslated string: ssh no active logins = No active logins
WARNING: untranslated string: ssh username = Username
+WARNING: untranslated string: standard = Standard
WARNING: untranslated string: static routes = Static Routes
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: subnet mask = Subnet Mask
WARNING: untranslated string: support donation = Support the IPFire project with your donation
WARNING: untranslated string: system has rdrand = This system has support for Intel(R) RDRAND.
diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index fdab9b4e1..c600be801 100644
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -227,7 +227,23 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
+WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
WARNING: translation string unused: donation-link
@@ -265,7 +281,6 @@ WARNING: translation string unused: err rs 1
WARNING: translation string unused: err rs 6 decrypt
WARNING: translation string unused: err rs 7 untartst
WARNING: translation string unused: err rs 8 untar
-WARNING: translation string unused: error
WARNING: translation string unused: error config
WARNING: translation string unused: error external access
WARNING: translation string unused: esp encryption
@@ -436,6 +451,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -793,7 +809,18 @@ WARNING: translation string unused: zoneconf val zoneslave amount error
WARNING: untranslated string: Captive ACTIVATE = unknown string
WARNING: untranslated string: Captive clients = unknown string
WARNING: untranslated string: Scan for Songs = unknown string
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: fwhost cust geoipgrp = unknown string
WARNING: untranslated string: fwhost err hostip = unknown string
WARNING: untranslated string: guardian block a host = unknown string
@@ -828,9 +855,12 @@ WARNING: untranslated string: guardian service = unknown string
WARNING: untranslated string: ike lifetime should be between 1 and 8 hours = unknown string
WARNING: untranslated string: info messages = unknown string
WARNING: untranslated string: no data = unknown string
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: pakfire ago = ago.
WARNING: untranslated string: route config changed = unknown string
WARNING: untranslated string: routing config added = unknown string
WARNING: untranslated string: routing config changed = unknown string
WARNING: untranslated string: routing table = unknown string
+WARNING: untranslated string: standard = Standard
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: vpn statistics n2n = unknown string
diff --git a/doc/language_issues.it b/doc/language_issues.it
index b9089abfd..96feb3a3e 100644
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -204,8 +204,24 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
WARNING: translation string unused: dnsforward forward_server
+WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
WARNING: translation string unused: donation-link
@@ -411,6 +427,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -813,6 +830,7 @@ WARNING: untranslated string: advproxy wpad title = Web Proxy Auto-Discovery Pro
WARNING: untranslated string: advproxy wpad view pac = Open PAC File
WARNING: untranslated string: application layer gateways = Application Layer Gateways
WARNING: untranslated string: block = Block
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: check all = Check all
WARNING: untranslated string: crypto error = Cryptographic error
@@ -825,8 +843,18 @@ WARNING: untranslated string: dhcp dns update = DNS Update
WARNING: untranslated string: dhcp dns update algo = Algorithm
WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled
WARNING: untranslated string: dnsforward forward_servers = Nameservers
WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled
@@ -849,6 +877,7 @@ WARNING: untranslated string: email tls = Use TLS
WARNING: untranslated string: email usemail = Activate Mail Service
WARNING: untranslated string: emerging pro rules = Emergingthreats.net Pro Rules
WARNING: untranslated string: enable smt = Enable Simultaneous Multi-Threading (SMT)
+WARNING: untranslated string: error = Error
WARNING: untranslated string: fallout zombieload ridl = Fallout/ZombieLoad/RIDL
WARNING: untranslated string: fifteen minutes = 15 Minutes
WARNING: untranslated string: firewall graph country = Firewall-Diagram (Country)
@@ -968,6 +997,7 @@ WARNING: untranslated string: mtu = MTU
WARNING: untranslated string: no data = unknown string
WARNING: untranslated string: none = none
WARNING: untranslated string: not affected = Not Affected
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: one hour = One Hour
WARNING: untranslated string: one month = One Month
WARNING: untranslated string: one week = One Week
@@ -1005,6 +1035,8 @@ WARNING: untranslated string: ssh agent forwarding = Allow SSH Agent Forwarding
WARNING: untranslated string: ssh login time = Logged in since
WARNING: untranslated string: ssh no active logins = No active logins
WARNING: untranslated string: ssh username = Username
+WARNING: untranslated string: standard = Standard
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: subnet mask = Subnet Mask
WARNING: untranslated string: system is offline = The system is offline.
WARNING: untranslated string: taa zombieload2 = TSX Async Abort / ZombieLoad v2
diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index f8c84b2da..ab7c2e81e 100644
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -202,6 +202,21 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
WARNING: translation string unused: dnsforward forward_server
WARNING: translation string unused: do not log this port list
@@ -409,6 +424,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -808,6 +824,7 @@ WARNING: untranslated string: advproxy wpad view pac = Open PAC File
WARNING: untranslated string: application layer gateways = Application Layer Gateways
WARNING: untranslated string: atm device = Device:
WARNING: untranslated string: block = Block
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: capabilities = Capabilities
WARNING: untranslated string: check all = Check all
@@ -827,14 +844,23 @@ WARNING: untranslated string: dhcp dns update = DNS Update
WARNING: untranslated string: dhcp dns update algo = Algorithm
WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns servers = DNS Servers
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled
WARNING: untranslated string: dnsforward forward_servers = Nameservers
WARNING: untranslated string: dnssec aware = DNSSEC Aware
WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled
-WARNING: untranslated string: dnssec information = DNSSEC Information
WARNING: untranslated string: dnssec not supported = DNSSEC Not supported
WARNING: untranslated string: dnssec validating = DNSSEC Validating
WARNING: untranslated string: download tls-auth key = Download tls-auth key
@@ -858,6 +884,7 @@ WARNING: untranslated string: email tls = Use TLS
WARNING: untranslated string: email usemail = Activate Mail Service
WARNING: untranslated string: emerging pro rules = Emergingthreats.net Pro Rules
WARNING: untranslated string: enable smt = Enable Simultaneous Multi-Threading (SMT)
+WARNING: untranslated string: error = Error
WARNING: untranslated string: fallout zombieload ridl = Fallout/ZombieLoad/RIDL
WARNING: untranslated string: fifteen minutes = 15 Minutes
WARNING: untranslated string: firewall graph country = Firewall-Diagram (Country)
@@ -997,6 +1024,7 @@ WARNING: untranslated string: no data = unknown string
WARNING: untranslated string: none = none
WARNING: untranslated string: not a valid dh key = Not a valid Diffie-Hellman parameters file. Please use a length of 2048, 3072 or 4096 bits and the PKCS#3 format.
WARNING: untranslated string: not affected = Not Affected
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: one hour = One Hour
WARNING: untranslated string: one month = One Month
WARNING: untranslated string: one week = One Week
@@ -1046,6 +1074,8 @@ WARNING: untranslated string: ssh agent forwarding = Allow SSH Agent Forwarding
WARNING: untranslated string: ssh login time = Logged in since
WARNING: untranslated string: ssh no active logins = No active logins
WARNING: untranslated string: ssh username = Username
+WARNING: untranslated string: standard = Standard
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: subnet mask = Subnet Mask
WARNING: untranslated string: system is offline = The system is offline.
WARNING: untranslated string: ta key = TLS-Authentification-Key
diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 7ce921f91..0c9853d12 100644
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -194,6 +194,21 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
@@ -359,6 +374,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -740,6 +756,7 @@ WARNING: untranslated string: atm device = Device:
WARNING: untranslated string: attention = ATTENTION
WARNING: untranslated string: bit = bit
WARNING: untranslated string: block = Block
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: capabilities = Capabilities
WARNING: untranslated string: ccd add = Add network
@@ -804,9 +821,19 @@ WARNING: untranslated string: dhcp dns update algo = Algorithm
WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dnat address = Firewall Interface
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns servers = DNS Servers
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: dnsforward = DNS Forwarding
WARNING: untranslated string: dnsforward add a new entry = Add a new entry
WARNING: untranslated string: dnsforward configuration = DNS forward configuration
@@ -817,7 +844,6 @@ WARNING: untranslated string: dnsforward forward_servers = Nameservers
WARNING: untranslated string: dnsforward zone = Zone
WARNING: untranslated string: dnssec aware = DNSSEC Aware
WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled
-WARNING: untranslated string: dnssec information = DNSSEC Information
WARNING: untranslated string: dnssec not supported = DNSSEC Not supported
WARNING: untranslated string: dnssec validating = DNSSEC Validating
WARNING: untranslated string: downlink = Downlink
@@ -852,6 +878,7 @@ WARNING: untranslated string: enable smt = Enable Simultaneous Multi-Threading (
WARNING: untranslated string: encryption = Encryption:
WARNING: untranslated string: entropy = Entropy
WARNING: untranslated string: entropy graphs = Entropy Graphs
+WARNING: untranslated string: error = Error
WARNING: untranslated string: fallout zombieload ridl = Fallout/ZombieLoad/RIDL
WARNING: untranslated string: fifteen minutes = 15 Minutes
WARNING: untranslated string: fireinfo ipfire version = IPFire version
@@ -1161,6 +1188,7 @@ WARNING: untranslated string: no data = unknown string
WARNING: untranslated string: none = none
WARNING: untranslated string: not a valid dh key = Not a valid Diffie-Hellman parameters file. Please use a length of 2048, 3072 or 4096 bits and the PKCS#3 format.
WARNING: untranslated string: not affected = Not Affected
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: notice = Notice
WARNING: untranslated string: one hour = One Hour
WARNING: untranslated string: one month = One Month
@@ -1244,7 +1272,9 @@ WARNING: untranslated string: ssh agent forwarding = Allow SSH Agent Forwarding
WARNING: untranslated string: ssh login time = Logged in since
WARNING: untranslated string: ssh no active logins = No active logins
WARNING: untranslated string: ssh username = Username
+WARNING: untranslated string: standard = Standard
WARNING: untranslated string: static routes = Static Routes
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: subnet mask = Subnet Mask
WARNING: untranslated string: support donation = Support the IPFire project with your donation
WARNING: untranslated string: system has rdrand = This system has support for Intel(R) RDRAND.
diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 0cd31c5b4..dfea6d4cd 100644
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -194,6 +194,21 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
@@ -352,6 +367,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -742,6 +758,7 @@ WARNING: untranslated string: atm device = Device:
WARNING: untranslated string: attention = ATTENTION
WARNING: untranslated string: bit = bit
WARNING: untranslated string: block = Block
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: capabilities = Capabilities
WARNING: untranslated string: ccd add = Add network
@@ -808,9 +825,19 @@ WARNING: untranslated string: dhcp dns update secret = Secret
WARNING: untranslated string: disk access per = Disk Access per
WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
WARNING: untranslated string: dnat address = Firewall Interface
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
WARNING: untranslated string: dns servers = DNS Servers
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: dnsforward = DNS Forwarding
WARNING: untranslated string: dnsforward add a new entry = Add a new entry
WARNING: untranslated string: dnsforward configuration = DNS forward configuration
@@ -821,7 +848,6 @@ WARNING: untranslated string: dnsforward forward_servers = Nameservers
WARNING: untranslated string: dnsforward zone = Zone
WARNING: untranslated string: dnssec aware = DNSSEC Aware
WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled
-WARNING: untranslated string: dnssec information = DNSSEC Information
WARNING: untranslated string: dnssec not supported = DNSSEC Not supported
WARNING: untranslated string: dnssec validating = DNSSEC Validating
WARNING: untranslated string: downlink = Downlink
@@ -856,6 +882,7 @@ WARNING: untranslated string: enable smt = Enable Simultaneous Multi-Threading (
WARNING: untranslated string: encryption = Encryption:
WARNING: untranslated string: entropy = Entropy
WARNING: untranslated string: entropy graphs = Entropy Graphs
+WARNING: untranslated string: error = Error
WARNING: untranslated string: extrahd because there is already a device mounted = , because there is already a device mounted
WARNING: untranslated string: extrahd cant umount = Can't umount
WARNING: untranslated string: extrahd install or load driver = If your device isn't listed here, you need to install or load the driver.<br />If you can see your device but no partitions you have to create them first.
@@ -1163,6 +1190,7 @@ WARNING: untranslated string: no data = unknown string
WARNING: untranslated string: none = none
WARNING: untranslated string: not a valid dh key = Not a valid Diffie-Hellman parameters file. Please use a length of 2048, 3072 or 4096 bits and the PKCS#3 format.
WARNING: untranslated string: not affected = Not Affected
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: notice = Notice
WARNING: untranslated string: one hour = One Hour
WARNING: untranslated string: one month = One Month
@@ -1240,7 +1268,9 @@ WARNING: untranslated string: ssh agent forwarding = Allow SSH Agent Forwarding
WARNING: untranslated string: ssh login time = Logged in since
WARNING: untranslated string: ssh no active logins = No active logins
WARNING: untranslated string: ssh username = Username
+WARNING: untranslated string: standard = Standard
WARNING: untranslated string: static routes = Static Routes
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: subnet mask = Subnet Mask
WARNING: untranslated string: support donation = Support the IPFire project with your donation
WARNING: untranslated string: system has rdrand = This system has support for Intel(R) RDRAND.
diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index ff2550b8d..a65712e9f 100644
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -226,8 +226,24 @@ WARNING: translation string unused: dmz pinhole configuration
WARNING: translation string unused: dmz pinhole rule added
WARNING: translation string unused: dmz pinhole rule removed
WARNING: translation string unused: dmzpinholes for same net not necessary
+WARNING: translation string unused: dns address deleted
+WARNING: translation string unused: dns address deleted txt
+WARNING: translation string unused: dns address done
+WARNING: translation string unused: dns address recon
+WARNING: translation string unused: dns desc
+WARNING: translation string unused: dns error 0
+WARNING: translation string unused: dns error 01
+WARNING: translation string unused: dns error 1
+WARNING: translation string unused: dns header
+WARNING: translation string unused: dns list
+WARNING: translation string unused: dns menu
+WARNING: translation string unused: dns new 0
+WARNING: translation string unused: dns new 1
+WARNING: translation string unused: dns saved
+WARNING: translation string unused: dns saved txt
WARNING: translation string unused: dns server
WARNING: translation string unused: dnsforward forward_server
+WARNING: translation string unused: dnssec information
WARNING: translation string unused: do not log this port list
WARNING: translation string unused: domain not set
WARNING: translation string unused: donation-link
@@ -439,6 +455,7 @@ WARNING: translation string unused: mac address error not 00
WARNING: translation string unused: mailmethod
WARNING: translation string unused: mailprogramm
WARNING: translation string unused: manage ovpn
+WARNING: translation string unused: manual
WARNING: translation string unused: manual control and status
WARNING: translation string unused: marked
WARNING: translation string unused: max incoming size
@@ -797,17 +814,29 @@ WARNING: untranslated string: advproxy wpad label dst_noproxy_url = Excluded URL
WARNING: untranslated string: advproxy wpad notice = Notice: For WPAD/PAC to work properly, furtcher changes need to be made. Please see the <a href="https://wiki.ipfire.org/configuration/network/proxy/extend/wpad" target="_blank">Wiki</a>.
WARNING: untranslated string: advproxy wpad title = Web Proxy Auto-Discovery Protocol (WPAD) / Proxy Auto-Config (PAC)
WARNING: untranslated string: advproxy wpad view pac = Open PAC File
+WARNING: untranslated string: broken = Broken
WARNING: untranslated string: bytes = unknown string
WARNING: untranslated string: crypto error = Cryptographic error
WARNING: untranslated string: crypto warning = Cryptographic warning
WARNING: untranslated string: dangerous = Dangerous
WARNING: untranslated string: default IP address = Default IP Address
+WARNING: untranslated string: dns = unknown string
+WARNING: untranslated string: dns configuration = DNS Configuration
+WARNING: untranslated string: dns could not add server = Could not add server - Reason:
+WARNING: untranslated string: dns enable safe-search = Enable Safe Search
WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
+WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server
+WARNING: untranslated string: dns mode for qname minimisation = QNAME Minimisation
+WARNING: untranslated string: dns no tls hostname given = No TLS hostname given.
+WARNING: untranslated string: dns tls hostname = TLS Hostname
+WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers
+WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries
WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled
WARNING: untranslated string: dnsforward forward_servers = Nameservers
WARNING: untranslated string: emerging pro rules = Emergingthreats.net Pro Rules
WARNING: untranslated string: enable smt = Enable Simultaneous Multi-Threading (SMT)
+WARNING: untranslated string: error = Error
WARNING: untranslated string: fallout zombieload ridl = Fallout/ZombieLoad/RIDL
WARNING: untranslated string: force enable = Forced
WARNING: untranslated string: foreshadow = Foreshadow
@@ -885,6 +914,7 @@ WARNING: untranslated string: mitigated = Mitigated
WARNING: untranslated string: mtu = MTU
WARNING: untranslated string: no data = unknown string
WARNING: untranslated string: not affected = Not Affected
+WARNING: untranslated string: not validating = Not validating
WARNING: untranslated string: ovpn error dh = The Diffie-Hellman parameter needs to be in minimum 2048 bit! <br>Please generate or upload a new Diffie-Hellman parameter, this can be made below in the section "Diffie-Hellman parameters options".</br>
WARNING: untranslated string: ovpn error md5 = You host certificate uses MD5 for the signature which is not accepted anymore. <br>Please update to the latest IPFire version and generate a new root and host certificate.</br><br>All OpenVPN clients needs then to be renewed!</br>
WARNING: untranslated string: ovpn tls auth = TLS Channel Protection:
@@ -907,6 +937,8 @@ WARNING: untranslated string: ssh agent forwarding = Allow SSH Agent Forwarding
WARNING: untranslated string: ssh login time = Logged in since
WARNING: untranslated string: ssh no active logins = No active logins
WARNING: untranslated string: ssh username = Username
+WARNING: untranslated string: standard = Standard
+WARNING: untranslated string: strict = Strict
WARNING: untranslated string: subnet mask = Subnet Mask
WARNING: untranslated string: system is offline = The system is offline.
WARNING: untranslated string: taa zombieload2 = TSX Async Abort / ZombieLoad v2
diff --git a/doc/language_missings b/doc/language_missings
index 5c333f866..6283a5ed4 100644
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -21,6 +21,7 @@
< backup protect key password
< bewan adsl pci st
< bewan adsl usb
+< broken
< Captive heading terms
< Captive heading voucher
< Captive invalid coupon
@@ -35,6 +36,15 @@
< dhcp server disabled on blue interface
< dhcp server enabled on blue interface
< dh name is invalid
+< dns configuration
+< dns could not add server
+< dns enable safe-search
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
< done
< emerging pro rules
< emerging rules
@@ -48,11 +58,15 @@
< insert removable device
< itlb multihit
< notes
+< not validating
+< okay
< quick control
< shaping add options
< show areas
< show lines
< show tls-auth key
+< standard
+< strict
< taa zombieload2
< teovpn_fragment
< tor bridge enabled
@@ -97,6 +111,7 @@
< attention
< bit
< block
+< broken
< capabilities
< Captive
< Captive 1day
@@ -225,6 +240,9 @@
< Disabled
< dl client arch insecure
< dnat address
+< dns configuration
+< dns could not add server
+< dns enable safe-search
< dnsforward
< dnsforward add a new entry
< dnsforward configuration
@@ -235,12 +253,18 @@
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
< dnsforward zone
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
< dnssec information
< dnssec not supported
< dnssec validating
< dns servers
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
< downlink
< download dh parameter
< download tls-auth key
@@ -606,7 +630,9 @@
< not affected
< not a valid dh key
< notice
+< not validating
< Number of Countries for the pie chart
+< okay
< one hour
< one month
< one week
@@ -710,7 +736,9 @@
< ssh login time
< ssh no active logins
< ssh username
+< standard
< static routes
+< strict
< subnet mask
< support donation
< system has hwrng
@@ -888,6 +916,20 @@
############################################################################
# Checking cgi-bin translations for language: fr #
############################################################################
+< broken
+< dns configuration
+< dns could not add server
+< dns enable safe-search
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
+< not validating
+< okay
+< standard
+< strict
############################################################################
# Checking cgi-bin translations for language: it #
############################################################################
@@ -909,6 +951,7 @@
< advproxy wpad view pac
< application layer gateways
< block
+< broken
< Captive
< Captive 1day
< Captive 1month
@@ -977,11 +1020,20 @@
< dhcp dns update secret
< Disabled
< dl client arch insecure
+< dns configuration
+< dns could not add server
+< dns enable safe-search
< dns forward disable dnssec
< dnsforward dnssec disabled
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
< dnssec disabled warning
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
< eight hours
< email config
< email empty field
@@ -1097,7 +1149,9 @@
< MTU settings
< none
< not affected
+< not validating
< Number of Countries for the pie chart
+< okay
< one hour
< one month
< one week
@@ -1132,6 +1186,8 @@
< ssh login time
< ssh no active logins
< ssh username
+< standard
+< strict
< subnet mask
< system is offline
< taa zombieload2
@@ -1225,6 +1281,7 @@
< application layer gateways
< atm device
< block
+< broken
< capabilities
< Captive
< Captive 1day
@@ -1301,16 +1358,25 @@
< dh parameter
< Disabled
< dl client arch insecure
+< dns configuration
+< dns could not add server
+< dns enable safe-search
< dns forward disable dnssec
< dnsforward dnssec disabled
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
< dnssec information
< dnssec not supported
< dnssec validating
< dns servers
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
< download dh parameter
< download tls-auth key
< drop outgoing
@@ -1450,7 +1516,9 @@
< none
< not affected
< not a valid dh key
+< not validating
< Number of Countries for the pie chart
+< okay
< one hour
< one month
< one week
@@ -1499,6 +1567,8 @@
< ssh login time
< ssh no active logins
< ssh username
+< standard
+< strict
< subnet mask
< system is offline
< taa zombieload2
@@ -1609,6 +1679,7 @@
< attention
< bit
< block
+< broken
< capabilities
< Captive
< Captive 1day
@@ -1738,6 +1809,9 @@
< Disabled
< dl client arch insecure
< dnat address
+< dns configuration
+< dns could not add server
+< dns enable safe-search
< dnsforward
< dnsforward add a new entry
< dnsforward configuration
@@ -1748,12 +1822,18 @@
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
< dnsforward zone
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
< dnssec information
< dnssec not supported
< dnssec validating
< dns servers
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
< downlink
< download dh parameter
< download tls-auth key
@@ -2121,7 +2201,9 @@
< not affected
< not a valid dh key
< notice
+< not validating
< Number of Countries for the pie chart
+< okay
< one hour
< one month
< one week
@@ -2210,7 +2292,9 @@
< ssh login time
< ssh no active logins
< ssh username
+< standard
< static routes
+< strict
< subnet mask
< support donation
< system has hwrng
@@ -2421,6 +2505,7 @@
< attention
< bit
< block
+< broken
< capabilities
< Captive
< Captive 1day
@@ -2552,6 +2637,9 @@
< disk access per
< dl client arch insecure
< dnat address
+< dns configuration
+< dns could not add server
+< dns enable safe-search
< dnsforward
< dnsforward add a new entry
< dnsforward configuration
@@ -2562,12 +2650,18 @@
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
< dnsforward zone
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
< dnssec aware
< dnssec disabled warning
< dnssec information
< dnssec not supported
< dnssec validating
< dns servers
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
< downlink
< download dh parameter
< download tls-auth key
@@ -2940,7 +3034,9 @@
< not affected
< not a valid dh key
< notice
+< not validating
< Number of Countries for the pie chart
+< okay
< one hour
< one month
< one week
@@ -3026,7 +3122,9 @@
< ssh login time
< ssh no active logins
< ssh username
+< standard
< static routes
+< strict
< subnet mask
< support donation
< system has hwrng
@@ -3213,6 +3311,7 @@
< advproxy wpad notice
< advproxy wpad title
< advproxy wpad view pac
+< broken
< Captive delete logo
< crypto error
< cryptographic settings
@@ -3221,10 +3320,19 @@
< dangerous
< default IP address
< Disabled
+< dns configuration
+< dns could not add server
+< dns enable safe-search
< dns forward disable dnssec
< dnsforward dnssec disabled
< dnsforward forward_servers
< dns forwarding dnssec disabled notice
+< dns isp assigned nameserver
+< dns mode for qname minimisation
+< dns no tls hostname given
+< dns tls hostname
+< dns use isp assigned nameservers
+< dns use protocol for dns queries
< emerging pro rules
< enable smt
< error
@@ -3272,6 +3380,8 @@
< mitigated
< mtu
< not affected
+< not validating
+< okay
< ovpn error dh
< ovpn error md5
< ovpn tls auth
@@ -3291,6 +3401,8 @@
< ssh login time
< ssh no active logins
< ssh username
+< standard
+< strict
< subnet mask
< system is offline
< taa zombieload2
diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi
old mode 100644
new mode 100755
index eee7a90b4..ff228422b
--- a/html/cgi-bin/dns.cgi
+++ b/html/cgi-bin/dns.cgi
@@ -2,7 +2,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> #
+# Copyright (C) 2020 IPFire Development Team #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -20,166 +20,896 @@
###############################################################################
use strict;
+use IO::Socket;
# enable only the following on debugging purpose
#use warnings;
#use CGI::Carp 'fatalsToBrowser';
require '/var/ipfire/general-functions.pl';
+require "${General::swroot}/geoip-functions.pl";
+require "${General::swroot}/ids-functions.pl";
require "${General::swroot}/lang.pl";
require "${General::swroot}/header.pl";
-my %dnssettings=();
+#workaround to suppress a warning when a variable is used only once
+my @dummy = ( ${Header::colouryellow} );
+undef (@dummy);
+
+my %cgiparams=();
+my %checked=();
+my %selected=();
my $errormessage = '';
+# Config file which stores the DNS settings.
+my $settings_file = "${General::swroot}/dns/settings";
+
+# File which stores the configured DNS-Servers.
+my $servers_file = "${General::swroot}/dns/servers";
+
+# Create files if the does not exist.
+unless (-f $settings_file) { system("touch $settings_file") };
+unless (-f $servers_file) { system("touch $servers_file") };
+
+# File which stores the ISP assigned DNS servers.
+my @ISP_nameserver_files = ( "/var/run/dns1", "/var/run/dns2" );
+
+# File which contains the ca-certificates.
+my $ca_certs_file = "/etc/ssl/certs/ca-bundle.crt";
+
+# Server which is used, to determine if the whole DNS system works properly.
+my $dns_test_server = "ping.ipfire.org";
+
+my $check_servers;
+
+my %color = ();
+my %mainsettings = ();
+&General::readhash("${General::swroot}/main/settings", \%mainsettings);
+&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
+
&Header::showhttpheaders();
+&Header::getcgihash(\%cgiparams);
-&General::readhash("${General::swroot}/dns/settings", \%dnssettings);
+##
+# Save general settings.
+#
+if ($cgiparams{'GENERAL'} eq $Lang::tr{'save'}) {
+ # Prevent form name from been stored in conf file.
+ delete $cgiparams{'GENERAL'};
-&Header::getcgihash(\%dnssettings);
+ # Add value for non-checked checkbox.
+ if ($cgiparams{'USE_ISP_NAMESERVERS'} ne "on") {
+ $cgiparams{'USE_ISP_NAMESERVERS'} = "off";
+ }
-&Header::openpage($Lang::tr{'dns title'}, 1, );
+ # Add value for non-checked checkbox.
+ if ($cgiparams{'ENABLE_SAFE_SEARCH'} ne "on") {
+ $cgiparams{'ENABLE_SAFE_SEARCH'} = "off";
+ }
-&Header::openbigbox('100%', 'left', '', $errormessage);
+ # Check if using ISP nameservers and TLS is enabled at the same time.
+ if (($cgiparams{'USE_ISP_NAMESERVERS'} eq "on") && ($cgiparams{'PROTO'} eq "TLS")) {
+ $errormessage = $Lang::tr{'dns isp nameservers and tls not allowed'}
+ }
+
+ # Check if there was an error.
+ if ( ! $errormessage) {
-if ($dnssettings{'ACTION'} eq $Lang::tr{'save'}) {
- if ((&General::validip($dnssettings{"DNS0"}) == 1)&&(&General::validip($dnssettings{"DNS1"}) == 1)) {
- if ($errormessage eq "") {
- &General::writehash("${General::swroot}/dns/settings", \%dnssettings);
- &Header::openbox('100%', 'left', $Lang::tr{'dns saved'});
- print "<font class='base'>$Lang::tr{'dns saved txt'}</font>\n";
- &Header::closebox();
+ # Store settings into settings file.
+ &General::writehash("$settings_file", \%cgiparams);
+
+ # Call function to handle unbound restart, etc.
+ &_handle_unbound_and_more()
+ }
+}
+
+###
+# Add / Edit entries.
+#
+if (($cgiparams{'SERVERS'} eq $Lang::tr{'save'}) || ($cgiparams{'SERVERS'} eq $Lang::tr{'update'})) {
+ # Hash to store the generic DNS settings.
+ my %settings = ();
+
+ # Read-in generic settings.
+ &General::readhash("$settings_file", \%settings);
+
+ # Check if an IP-address has been given.
+ if ($cgiparams{"NAMESERVER"} eq "") {
+ $errormessage = "$Lang::tr{'dns no address given'}";
+ }
+
+ # Check if the given DNS server is valid.
+ elsif(!&General::validip($cgiparams{"NAMESERVER"})) {
+ $errormessage = "$Lang::tr{'invalid ip'}: $cgiparams{'NAMESERVER'}";
+ }
+
+ # Check if a TLS is enabled and no TLS_HOSTNAME has benn specified.
+ elsif($settings{'PROTO'} eq "TLS") {
+ unless($cgiparams{"TLS_HOSTNAME"}) {
+ $errormessage = "$Lang::tr{'dns no tls hostname given'}";
+ } else {
+ # Check if the provided domain is valid.
+ unless(&General::validfqdn($cgiparams{"TLS_HOSTNAME"})) {
+ $errormessage = "$Lang::tr{'invalid ip or hostname'}: $cgiparams{'TLS_HOSTNAME'}";
+ }
}
- } else {
- if ((&General::validip($dnssettings{"DNS0"}) == 0)&&(&General::validip($dnssettings{"DNS1"}) == 1)){
- $errormessage = $Lang::tr{'dns error 0'};
- }
- if ((&General::validip($dnssettings{"DNS1"}) == 0)&&(&General::validip($dnssettings{"DNS0"}) == 1)){
- $errormessage = $Lang::tr{'dns error 1'};
+ }
+
+ # Go further if there was no error.
+ if ( ! $errormessage) {
+ # Check if a remark has been entered.
+ $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
+
+ my %dns_servers = ();
+ my $id;
+ my $status;
+
+ # Read-in configfile.
+ &General::readhasharray($servers_file, \%dns_servers);
+
+ # Check if we should edit an existing entry and got an ID.
+ if (($cgiparams{'SERVERS'} eq $Lang::tr{'update'}) && ($cgiparams{'ID'})) {
+ # Assin the provided id.
+ $id = $cgiparams{'ID'};
+
+ # Undef the given ID.
+ undef($cgiparams{'ID'});
+
+ # Grab the configured status of the corresponding entry.
+ $status = $dns_servers{$id}[2];
+ } else {
+ # Each newly added entry automatically should be enabled.
+ $status = "enabled";
+
+ # Generate the ID for the new entry.
+ #
+ # Sort the keys by their ID and store them in an array.
+ my @keys = sort { $a <=> $b } keys %dns_servers;
+
+ # Reverse the key array.
+ my @reversed = reverse(@keys);
+
+ # Obtain the last used id.
+ my $last_id = @reversed[0];
+
+ # Increase the last id by one and use it as id for the new entry.
+ $id = ++$last_id;
+
+ # The first allowed id is 3 to keep space for
+ # possible ISP assigned DNS servers.
+ if ($id <= "2") {
+ $id = "3";
+ }
}
- if ((&General::validip($dnssettings{"DNS1"}) == 0)&&(&General::validip($dnssettings{"DNS0"}) == 0)){
- $errormessage = $Lang::tr{'dns error 01'};
+
+ # Add/Modify the entry to/in the dns_servers hash.
+ $dns_servers{$id} = ["$cgiparams{'NAMESERVER'}", "$cgiparams{'TLS_HOSTNAME'}", "$status", "$cgiparams{'REMARK'}"];
+
+ # Write the changed hash to the config file.
+ &General::writehasharray($servers_file, \%dns_servers);
+
+ # Call function to handle unbound restart, etc.
+ &_handle_unbound_and_more();
+ } else {
+ # Switch back to previous mode.
+ $cgiparams{'SERVERS'} = $cgiparams{'MODE'};
+ }
+###
+# Toggle enable / disable.
+#
+} elsif ($cgiparams{'SERVERS'} eq $Lang::tr{'toggle enable disable'}) {
+ my %dns_servers = ();
+
+ # Only go further, if an ID has been passed.
+ if ($cgiparams{'ID'}) {
+ # Assign the given ID.
+ my $id = $cgiparams{'ID'};
+
+ # Undef the given ID.
+ undef($cgiparams{'ID'});
+
+ # Read-in configfile.
+ &General::readhasharray($servers_file, \%dns_servers);
+
+ # Grab the configured status of the corresponding entry.
+ my $status = $dns_servers{$id}[2];
+
+ # Switch the status.
+ if ($status eq "disabled") {
+ $status = "enabled";
+ } else {
+ $status = "disabled";
}
+
+ # Modify the status of the existing entry.
+ $dns_servers{$id} = ["$dns_servers{$id}[0]", "$dns_servers{$id}[1]", "$status", "$dns_servers{$id}[3]"];
+
+ # Write the changed hash back to the config file.
+ &General::writehasharray($servers_file, \%dns_servers);
+
+ # Call function to handle unbound restart, etc.
+ &_handle_unbound_and_more();
}
+
+## Remove entry from DNS servers list.
+#
+} elsif ($cgiparams{'SERVERS'} eq $Lang::tr{'remove'}) {
+ my %dns_servers = ();
+
+ # Read-in configfile.
+ &General::readhasharray($servers_file, \%dns_servers);
+
+ # Drop entry from the hash.
+ delete($dns_servers{$cgiparams{'ID'}});
+
+ # Undef the given ID.
+ undef($cgiparams{'ID'});
+
+ # Write the changed hash to the config file.
+ &General::writehasharray($servers_file, \%dns_servers);
+
+ # Call function to handle unbound restart, etc.
+ &_handle_unbound_and_more();
+
+## Handle request to check the servers.
+#
+} elsif ($cgiparams{'SERVERS'} eq $Lang::tr{'dns check servers'}) {
+ $check_servers = 1;
}
-if ($dnssettings{'ACTION'} eq $Lang::tr{'reconnect'}) {
- system("/usr/local/bin/redctrl restart >/dev/null 2>&1 &");
- &Header::openbox('100%', 'left', $Lang::tr{'dns address recon'} );
- print "<font class='base'>$Lang::tr{'dns address done'}</font>\n";
- &Header::closebox();
+# Hash to store the generic DNS settings.
+my %settings = ();
+
+# Read-in general DNS settings.
+&General::readhash("$settings_file", \%settings);
+
+# Hash which contains the configured DNS servers.
+my %dns_servers = ();
+
+# Read-in config file.
+&General::readhasharray("$servers_file", \%dns_servers);
+
+&Header::openpage($Lang::tr{'dns'}, 1, '');
+
+&Header::openbigbox('100%', 'left', '', $errormessage);
+
+###
+# Error messages layout.
+#
+if ($errormessage) {
+ &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
+ print "<class name='base'>$errormessage\n";
+ print " </class>\n";
+ &Header::closebox();
}
-if ($dnssettings{'ACTION'} eq $Lang::tr{'delete'}) {
- system("cat /dev/null > ${General::swroot}/dns/settings &");
- &Header::openbox('100%', 'left', $Lang::tr{'dns address deleted'} );
- print "<font class='base'>$Lang::tr{'dns address deleted txt'}</font>\n";
- &Header::closebox();
+# Handle if a nameserver should be added or edited.
+if (($cgiparams{'SERVERS'} eq "$Lang::tr{'add'}") || ($cgiparams{'SERVERS'} eq "$Lang::tr{'edit'}")) {
+ # Display the sub page.
+ &show_add_edit_nameserver();
+
+ # Close webpage.
+ &Header::closebigbox();
+ &Header::closepage();
+
+ # Finished here for the moment.
+ exit(0);
}
-# DPC move error message to top so it is seen!
-if ($errormessage) {
- &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
- print "<font class='base'>$errormessage </font>\n";
+$cgiparams{'GENERAL'} = '';
+$cgiparams{'SERVERS'} = '';
+$cgiparams{'NAMESERVER'} = '';
+$cgiparams{'TLS_HOSTNAME'} = '';
+$cgiparams{'REMARK'} ='';
+
+$checked{'USE_ISP_NAMESERVERS'}{'off'} = '';
+$checked{'USE_ISP_NAMESERVERS'}{'on'} = '';
+$checked{'USE_ISP_NAMESERVERS'}{$settings{'USE_ISP_NAMESERVERS'}} = "checked='checked'";
+
+$checked{'ENABLE_SAFE_SEARCH'}{'off'} = '';
+$checked{'ENABLE_SAFE_SEARCH'}{'on'} = '';
+$checked{'ENABLE_SAFE_SEARCH'}{$settings{'ENABLE_SAFE_SEARCH'}} = "checked='checked'";
+
+$selected{'PROTO'}{'UDP'} = '';
+$selected{'PROTO'}{'TLS'} = '';
+$selected{'PROTO'}{'TCP'} = '';
+$selected{'PROTO'}{$settings{'PROTO'}} = "selected='selected'";
+
+$selected{'QNAME_MIN'}{'standard'} = '';
+$selected{'QNAME_MIN'}{'strict'} = '';
+$selected{'QNAME_MIN'}{$settings{'QNAME_MIN'}} = "selected='selected'";
+
+# Display nameserver and configuration sections.
+&show_nameservers();
+&show_general_dns_configuration();
+
+&Header::closebigbox();
+&Header::closepage();
+
+###
+# General DNS-Servers sektion.
+#
+sub show_general_dns_configuration () {
+ &Header::openbox('100%', 'center', "$Lang::tr{'dns configuration'}");
+
+ print <<END;
+ <form method='post' action='$ENV{'SCRIPT_NAME'}'>
+ <table width="100%">
+ <tr>
+ <td width="33%">
+ $Lang::tr{'dns use isp assigned nameservers'}
+ </td>
+
+ <td>
+ <input type="checkbox" name="USE_ISP_NAMESERVERS" $checked{'USE_ISP_NAMESERVERS'}{'on'}>
+ </td>
+ </tr>
+
+ <tr>
+ <td colspan="2">
+ <br>
+ </td>
+ </tr>
+
+ <tr>
+ <td width="33%">
+ $Lang::tr{'dns use protocol for dns queries'}
+ </td>
+
+ <td>
+ <select name="PROTO">
+ <option value="UDP" $selected{'PROTO'}{'UDP'}>UDP</option>
+ <option value="TLS" $selected{'PROTO'}{'TLS'}>TLS</option>
+ <option value="TCP" $selected{'PROTO'}{'TCP'}>TCP</option>
+ </select>
+ </td>
+ </tr>
+
+ <tr>
+ <td colspan="2">
+ <br>
+ </td>
+ </tr>
+
+ <tr>
+ <td width="33%">
+ $Lang::tr{'dns enable safe-search'}
+ </td>
+
+ <td>
+ <input type="checkbox" name="ENABLE_SAFE_SEARCH" $checked{'ENABLE_SAFE_SEARCH'}{'on'}>
+ </td>
+ </tr>
+
+ <tr>
+ <td colspan="2">
+ <br>
+ </td>
+ </tr>
+
+ <tr>
+ <td width="33%">
+ $Lang::tr{'dns mode for qname minimisation'}
+ </td>
+
+ <td>
+ <select name="QNAME_MIN">
+ <option value="standard" $selected{'QNAME_MIN'}{'standard'}>$Lang::tr{'standard'}</option>
+ <option value="strict" $selected{'QNAME_MIN'}{'strict'}>$Lang::tr{'strict'}</option>
+ </select>
+ </td>
+ </tr>
+
+ <tr>
+ <td colspan="2" align="right">
+ <input type="submit" name="GENERAL" value="$Lang::tr{'save'}">
+ </td>
+ </tr>
+ </table>
+ </form>
+END
+
&Header::closebox();
}
-print "<form method='post' action='$ENV{'SCRIPT_NAME'}'>\n";
+###
+# Section to display the configured and used DNS servers.
+#
+sub show_nameservers () {
+ &Header::openbox('100%', 'center', "$Lang::tr{'dns title'}");
-&Header::openbox('100%', 'left', $Lang::tr{'dns header'});
-print <<END
+ my $dns_status_string;
+ my $dns_status_col;
+ my $dns_working;
-<table border="0" width='100%'>
- <tr>
- <td colspan="2"><font class='base'>$Lang::tr{'dns desc'}<br /><img src="/images/dns_link.png" border="0" align="absmiddle"/><a href="https://wiki.ipfire.org/dns/public-servers" target="_blank">$Lang::tr{'dns list'}</a></font></td>
- </tr>
- <tr>
- <td colspan="2"> </td>
- </tr>
- <tr>
- <td width="25%"><font class='base'>$Lang::tr{'dns new 0'}</font></td>
-END
-;
-if ($dnssettings{'ACTION'} eq $Lang::tr{'delete'}) {
-print <<END
- <td width="75%"><input type="text" name="DNS0" maxlength="15" value=""/></td>
+ # Test if the DNS system is working.
+ #
+ # Simple send a request to unbound and check if it can resolve the
+ # DNS test server.
+ my $dns_status_ret = &check_nameserver("127.0.0.1", "$dns_test_server", "UDP");
+
+ if ($dns_status_ret eq "2") {
+ $dns_status_string = "$Lang::tr{'working'}";
+ $dns_status_col = "${Header::colourgreen}";
+ $dns_working = 1;
+ } else {
+ $dns_status_string = "$Lang::tr{'broken'}";
+ $dns_status_col = "${Header::colourred}";
+ }
+
+print <<END;
+ <table width='100%'>
+ <tr>
+ <td>
+ <strong>$Lang::tr{'status'}: </strong>
+ <strong><font color='$dns_status_col'>$dns_status_string</font></strong>
+ </td>
+ </tr>
+ </table>
+
+ <br>
+
+ <table class="tbl" width='100%'>
+ <tr>
+ <td align="center">
+ <strong>$Lang::tr{'nameserver'}</strong>
+ </td>
+
+ <td align="center">
+ <strong>$Lang::tr{'country'}</strong>
+ </td>
+
+ <td align="center">
+ <strong>$Lang::tr{'rdns'}</strong>
+ </td>
+
+ <td align="center">
+ <strong>$Lang::tr{'remark'}</strong>
+ </td>
END
-;
-} else {
+ # Check if the status should be displayed.
+ if ($check_servers) {
print <<END
- <td width="75%"><input type="text" name="DNS0" maxlength="15" value="$dnssettings{"DNS0"}"/></td>
+ <td align="center">
+ <strong>$Lang::tr{'status'}</strong>
+ </td>
END
-;
-}
+;
+ }
+
print <<END
- </tr>
- <tr>
- <td><font class='base'>$Lang::tr{'dns new 1'}</font></td>
+
+ <td align="center" colspan="3">
+ <strong>$Lang::tr{'action'}</strong>
+ </td>
+ </tr>
END
-;
-if ($dnssettings{'ACTION'} eq $Lang::tr{'delete'}) {
-print <<END
- <td><input type="text" name="DNS1" maxlength="15" value=""/></td>
+;
+
+ # Check the usage of ISP assigned nameservers is enabled.
+ my $id = 1;
+
+ # Loop through the array which stores the files.
+ foreach my $file (@ISP_nameserver_files) {
+ # Grab the address of the nameserver.
+ my $address = &General::grab_address_from_file($file);
+
+ # Check if we got an address.
+ if ($address) {
+ # Add the address to the hash of nameservers.
+ $dns_servers{$id} = [ "$address", "none",
+ ($settings{'USE_ISP_NAMESERVERS'} eq "on") ? "enabled" : "disabled",
+ "$Lang::tr{'dns isp assigned nameserver'}" ];
+
+ # Increase id by one.
+ $id++;
+ }
+ }
+
+ # Check some DNS servers have been configured. In this case
+ # the hash contains at least one key.
+ my $server_amount;
+ if (keys %dns_servers) {
+ # Sort the keys by their ID and store them in an array.
+ my @keys = sort { $a <=> $b } keys %dns_servers;
+
+ # Loop through all entries of the array/hash.
+ foreach my $id (@keys) {
+ # Inrease server_amount.
+ $server_amount++;
+
+ # Assign data array positions to some nice variable names.
+ my $nameserver = $dns_servers{$id}[0];
+ my $tls_hostname = $dns_servers{$id}[1];
+ my $enabled = $dns_servers{$id}[2];
+ my $remark = $dns_servers{$id}[3];
+
+ my $col = '';
+ my $toggle = '';
+ my $gif = '';
+ my $gdesc = '';
+ my $notice = "";
+
+ # Colorize columns.
+ if ($server_amount % 2) {
+ $col="bgcolor='$color{'color22'}'"; }
+ else {
+ $col="bgcolor='$color{'color20'}'";
+ }
+
+ if ($enabled eq 'enabled') {
+ $gif='on.gif'; $toggle='off'; $gdesc=$Lang::tr{'click to disable'};
+ } else {
+ $gif='off.gif'; $toggle='on'; $gdesc=$Lang::tr{'click to enable'};
+ }
+
+ my $status;
+ my $status_short;
+ my $status_message;
+ my $status_colour;
+
+ # Only grab the status if the nameserver is enabled.
+ if (($check_servers) && ($enabled eq "enabled")) {
+ $status = &check_nameserver("$nameserver", "ping.ipfire.org", "$settings{'PROTO'}", "$tls_hostname");
+ }
+
+ if (!defined $status) {
+ $status_short = "$Lang::tr{'disabled'}";
+
+ # DNSSEC Not supported
+ } elsif ($status eq 0) {
+ $status_short = "$Lang::tr{'broken'}";
+ $status_message = $Lang::tr{'dnssec not supported'};
+ $status_colour = ${Header::colourred};
+
+ # DNSSEC Aware
+ } elsif ($status eq 1) {
+ $status_short = "$Lang::tr{'not validating'}";
+ $status_message = $Lang::tr{'dnssec aware'};
+ $status_colour = ${Header::colourblack};
+
+ # DNSSEC Validating
+ } elsif ($status eq 2) {
+ $status_short = "$Lang::tr{'ok'}";
+ $status_message = $Lang::tr{'dnssec validating'};
+ $status_colour = ${Header::colourgreen};
+
+ # Error
+ } else {
+ $status_short = "$Lang::tr{'error'}";
+ $status_message = $status;
+ $status_colour = ${Header::colourred};
+ }
+
+ # collect more information about name server (rDNS, GeoIP country code)
+ my $ccode = &GeoIP::lookup($nameserver);
+ my $flag_icon = &GeoIP::get_flag_icon($ccode);
+
+ my $rdns;
+
+ # Only do the reverse lookup if the system is online.
+ if ($dns_working) {
+ my $iaddr = inet_aton($nameserver);
+ $rdns = gethostbyaddr($iaddr, AF_INET);
+ }
+
+ if (!$rdns) { $rdns = $Lang::tr{'lookup failed'}; }
+
+ # Mark ISP name servers as disabled
+ if ($id <= 2 && $enabled eq "disabled") {
+ $nameserver = "<del>$nameserver</del>";
+ }
+
+print <<END;
+ <tr>
+ <td align="center" $col>
+ $nameserver
+ </td>
+
+ <td align="center" $col>
+ <a href='country.cgi#$ccode'><img src="$flag_icon" border="0" alt="$ccode" title="$ccode" /></a>
+ </td>
+
+ <td align="center" $col>
+ $rdns
+ </td>
+
+ <td align="center" $col>
+ $remark
+ </td>
END
-;
-} else {
+;
+ # Display server status if requested.
+ if ($check_servers) {
print <<END
- <td><input type="text" name="DNS1" maxlength="15" value="$dnssettings{"DNS1"}"/></td>
+ <td align="center" $col>
+ <strong><font color="$status_colour"><abbr title="$status_message">$status_short</abbr></font></strong>
+ </td>
END
-;
-}
-print <<END
- </tr>
- <tr>
- <td colspan="2"><hr /></td>
- </tr>
- <tr>
- <td colspan="2"><div align="center">
+;
+ }
+
+ # Check if the id is greater than "2".
+ #
+ # Nameservers with an ID's of one or two are ISP assigned,
+ # and we cannot perform any actions on them, so hide the tools for
+ # them.
+ if ($id gt "2") {
+
+print <<END;
+ <td align='center' width='5%' $col>
+ <form method='post' name='frma$id' action='$ENV{'SCRIPT_NAME'}'>
+ <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' title='$gdesc' alt='$gdesc' />
+ <input type='hidden' name='ID' value='$id' />
+ <input type='hidden' name='ENABLE' value='$toggle' />
+ <input type='hidden' name='SERVERS' value='$Lang::tr{'toggle enable disable'}' />
+ </form>
+ </td>
+
+ <td align='center' width='5%' $col>
+ <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
+ <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' title='$Lang::tr{'edit'}' alt='$Lang::tr{'edit'}' />
+ <input type='hidden' name='ID' value='$id' />
+ <input type='hidden' name='SERVERS' value='$Lang::tr{'edit'}' />
+ </form>
+ </td>
+
+ <td align='center' width='5%' $col>
+ <form method='post' name='frmc$id' action='$ENV{'SCRIPT_NAME'}'>
+ <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}' />
+ <input type='hidden' name='ID' value='$id' />
+ <input type='hidden' name='SERVERS' value='$Lang::tr{'remove'}' />
+ </form>
+ </td>
END
-;
-if ($dnssettings{'ACTION'} eq $Lang::tr{'save'} && $errormessage eq "") {
-print <<END
- <input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
-
- <input type='submit' name='ACTION' value='$Lang::tr{'delete'}' />
-
- <input type='submit' name='ACTION' value='$Lang::tr{'reconnect'}' />
+;
+ } else {
+ print "<td colspan='3' $col> </td>\n";
+ }
+
+
+ print"</tr>\n";
+
+ }
+
+ print"</table>\n";
+
+ print"<table width='100%'>\n";
+
+ # Check if the usage of the ISP nameservers is enabled and there are more than 2 servers.
+ if (($settings{'USE_ISP_NAMESERVERS'} eq "on") && ($server_amount gt "2")) {
+print <<END;
+ <tr>
+ <td class='boldbase'> <b>$Lang::tr{'legend'}:</b></td>
+ <td> <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
+ <td class='base'>$Lang::tr{'click to disable'}</td>
+ <td> <img src='/images/off.gif' alt='$Lang::tr{'click to enable'}' /></td>
+ <td class='base'>$Lang::tr{'click to enable'}</td>
+ <td> <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
+ <td class='base'>$Lang::tr{'edit'}</td>
+ <td> <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
+ <td class='base'>$Lang::tr{'remove'}</td>
+ </tr>
END
-;
-} elsif ($dnssettings{'ACTION'} eq $Lang::tr{'delete'}) {
-print <<END
- <input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
-
- <input type='submit' name='ACTION' value='$Lang::tr{'reconnect'}' />
+;
+ }
+print <<END;
+ <tr>
+ <form method="post" action="$ENV{'SCRIPT_NAME'}">
+ <td colspan="9" align="right">
+ <input type="submit" name="SERVERS" value="$Lang::tr{'add'}">
+ <input type="submit" name="SERVERS" value="$Lang::tr{'dns check servers'}">
+ </td>
+ </form>
+ </tr>
+ </table>
END
;
-} elsif ($dnssettings{'ACTION'} eq $Lang::tr{'save'}) {
-print <<END
- <input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
+
+ } else {
+print <<END;
+ <table width="100%">
+ <tr>
+ <td colspan="6" align="center">
+ <br>$Lang::tr{'guardian no entries'}<br>
+ </td>
+ </tr>
+
+ <tr>
+ <form method="post" action="$ENV{'SCRIPT_NAME'}">
+ <td colspan="6" align="right"><input type="submit" name="SERVERS" value="$Lang::tr{'add'}"></td>
+ </form>
+ </tr>
+ </table>
+
END
-;
-} else {
+;
+ }
+
+ &Header::closebox();
+}
+
+###
+# Section to display the add or edit subpage.
+#
+sub show_add_edit_nameserver() {
+ print "<form method='post' action='$ENV{'SCRIPT_NAME'}'>\n";
+
+ my $buttontext = $Lang::tr{'save'};
+ my $dnssec_checked;
+ my $dot_checked;
+ if ($cgiparams{'SERVERS'} eq $Lang::tr{'edit'}) {
+ &Header::openbox('100%', 'left', $Lang::tr{'dnsforward edit an entry'});
+
+ # Update button text for upate the existing entry.
+ $buttontext = $Lang::tr{'update'};
+
+ # Add hidden input for sending ID.
+ print"<input type='hidden' name='ID' value='$cgiparams{'ID'}'>\n";
+
+ # Check if an ID has been given.
+ if ($cgiparams{'ID'}) {
+ # Assign cgiparams values.
+ $cgiparams{'NAMESERVER'} = $dns_servers{$cgiparams{'ID'}}[0];
+ $cgiparams{'TLS_HOSTNAME'} = $dns_servers{$cgiparams{'ID'}}[1];
+ $cgiparams{'REMARK'} = $dns_servers{$cgiparams{'ID'}}[3];
+ }
+ } else {
+ &Header::openbox('100%', 'left', $Lang::tr{'dnsforward add a new entry'});
+ }
+
+ my $tls_required_image;
+
+ # If the protocol is TLS, dispaly the required image.
+ if ($settings{'PROTO'} eq "TLS") {
+ $tls_required_image = "<img src='/blob.gif' alt='*'>";
+ }
+
+ # Add hidden input to store the mode.
+ print "<input type='hidden' name='MODE' value='$cgiparams{'SERVERS'}'>\n";
+
print <<END
- <input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
-
- <input type='submit' name='ACTION' value='$Lang::tr{'delete'}' />
-END
-;
-}
-print <<END
- </div>
- </td>
- </tr>
-</table>
+ <table width='100%'>
+ <tr>
+ <td width='20%' class='base'>$Lang::tr{'ip address'}: <img src='/blob.gif' alt='*' /></td>
+ <td><input type='text' name='NAMESERVER' value='$cgiparams{"NAMESERVER"}' size='24' /></td>
+ </tr>
+
+
+ <tr>
+ <td width='20%' class='base'>$Lang::tr{'dns tls hostname'}: $tls_required_image</td>
+ <td><input type='text' name='TLS_HOSTNAME' value='$cgiparams{'TLS_HOSTNAME'}' size='24'></td>
+ </tr>
+
+
+ <tr>
+ <td width ='20%' class='base'>$Lang::tr{'remark'}:</td>
+ <td><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='40' maxlength='50' /></td>
+ </tr>
+ </table>
+ <br>
+ <hr>
+
+ <table width='100%'>
+ <tr>
+ <td class='base' width='55%'><img src='/blob.gif' alt ='*' align='top' /> $Lang::tr{'required field'}</td>
+ <td width='40%' align='right'>
+ <input type="submit" name="SERVERS" value="$buttontext">
+ <input type="submit" name="SERVERS" value="$Lang::tr{'back'}">
+ </td>
+ </tr>
+ </table>
END
;
-&Header::closebox();
+ &Header::closebox();
+ print "</form>\n";
-print "</form>\n";
+ &Header::closebox();
+}
-&Header::closebigbox();
+# Private function to handle the restart of unbound and more.
+sub _handle_unbound_and_more () {
+ # Restart unbound
+ system('/usr/local/bin/unboundctrl reload >/dev/null');
-&Header::closepage();
+ # Check if the IDS is running.
+ if(&IDS::ids_is_running()) {
+ # Re-generate the file which contains the DNS Server
+ # details.
+ &IDS::generate_dns_servers_file();
+
+ # Call suricatactrl to perform a reload.
+ &IDS::call_suricatactrl("restart");
+ }
+}
+
+# Check if the system is online (RED is connected).
+sub red_is_active () {
+ # Check if the "active" file is present.
+ if ( -f "${General::swroot}/red/active") {
+ # Return "1" - True.
+ return 1;
+ } else {
+ # Return nothing - False.
+ return;
+ }
+}
+# Function to check a given nameserver against propper work.
+sub check_nameserver($$$$) {
+ my ($nameserver, $record, $proto, $tls_hostname) = @_;
+
+ # Check if the system is online.
+ unless (&red_is_active()) {
+ return "$Lang::tr{'system is offline'}";
+ }
+
+ # Default values.
+ my @command = ("kdig", "+timeout=2", "+retry=0", "+dnssec",
+ "+bufsize=1232");
+
+ # Handle different protols.
+ if ($proto eq "TCP") {
+ # Add TCP switch to the command.
+ push(@command, "+tcp");
+
+ } elsif($proto eq "TLS") {
+ # Add TLS switch to the command and provide the
+ # path to our file which contains the ca certs.
+ push(@command, "+tls-ca=$ca_certs_file");
+
+ # Check if a TLS hostname has been provided.
+ if ($tls_hostname) {
+ # Add TLS hostname to the command.
+ push(@command, "+tls-hostname=$tls_hostname");
+ } else {
+ return "$Lang::tr{'dns no tls hostname given'}";
+ }
+ }
+
+ # Add record to the command array.
+ push(@command, "$record");
+
+ # Add nameserver to the command array.
+ push(@command, "\@$nameserver");
+
+ # Connect to STDOUT and STDERR.
+ push(@command, "2>&1");
+
+ my @output = qx(@command);
+ my $output = join("", @output);
+
+ my $status = 0;
+
+ if ($output =~ m/status: (\w+)/) {
+ $status = ($1 eq "NOERROR");
+
+ if (!$status) {
+ return -1;
+ }
+ } else {
+ my $warning;
+
+ while ($output =~ m/WARNING: (.*)/g) {
+ # Add the current grabbed warning to the warning string.
+ $warning .= "$1\; ";
+ }
+
+ # Return the warning string, if we grabbed at least one.
+ if ($warning) {
+ return $warning;
+ }
+ }
+
+ my @flags = ();
+ if ($output =~ m/Flags: (.*);/) {
+ @flags = split(/ /, $1);
+ }
+
+ my $aware = ($output =~ m/RRSIG/);
+ my $validating = (grep(/ad;/, @flags));
+
+ return $aware + $validating;
+}
diff --git a/html/cgi-bin/dnsforward.cgi b/html/cgi-bin/dnsforward.cgi
index 626b664fd..ed373c09a 100644
--- a/html/cgi-bin/dnsforward.cgi
+++ b/html/cgi-bin/dnsforward.cgi
@@ -124,7 +124,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'add'})
}
}
# Restart unbound
- system('/usr/local/bin/unboundctrl restart >/dev/null');
+ system('/usr/local/bin/unboundctrl reload >/dev/null');
}
###
@@ -142,7 +142,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'remove'})
}
close(FILE);
# Restart unbound.
- system('/usr/local/bin/unboundctrl restart >/dev/null');
+ system('/usr/local/bin/unboundctrl reload >/dev/null');
}
###
@@ -169,7 +169,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'})
}
close(FILE);
# Restart unbound.
- system('/usr/local/bin/unboundctrl restart >/dev/null');
+ system('/usr/local/bin/unboundctrl reload >/dev/null');
}
###
diff --git a/html/cgi-bin/guardian.cgi b/html/cgi-bin/guardian.cgi
index 36d84bb5b..71316523f 100644
--- a/html/cgi-bin/guardian.cgi
+++ b/html/cgi-bin/guardian.cgi
@@ -280,15 +280,9 @@ if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
# File declarations.
my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
- my $dns1file = "${General::swroot}/red/dns1";
- my $dns2file = "${General::swroot}/red/dns2";
# Get gateway address.
- my $gateway = &_get_address_from_file($gatewayfile);
-
- # Get addresses from the used dns servers.
- my $dns1 = &_get_address_from_file($dns1file);
- my $dns2 = &_get_address_from_file($dns2file);
+ my $gateway = &General::grab_address_from_file($gatewayfile);
# Check if any input has been performed.
if ($input eq '') {
@@ -306,7 +300,7 @@ if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
}
# Check if the given input is one of the interface addresses or our gateway.
- elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway" || $input eq "$dns1" || $input eq "$dns2") {
+ elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
$errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
}
@@ -989,8 +983,6 @@ sub GenerateIgnoreFile() {
# File declarations.
my $public_address_file = "${General::swroot}/red/local-ipaddress";
my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
- my $dns1file = "${General::swroot}/red/dns1";
- my $dns2file = "${General::swroot}/red/dns2";
# Write the obtained addresses to the ignore file.
print FILE "# IPFire local interfaces.\n";
@@ -1012,8 +1004,6 @@ sub GenerateIgnoreFile() {
print FILE "# Include the corresponding files to obtain the addresses.\n";
print FILE "Include_File = $public_address_file\n";
print FILE "Include_File = $gatewayfile\n";
- print FILE "Include_File = $dns1file\n";
- print FILE "Include_File = $dns2file\n";
# Add all user defined hosts and networks to the ignore file.
#
@@ -1045,33 +1035,3 @@ sub GenerateIgnoreFile() {
close(FILE);
}
-
-# Private subfunction to obtain IP-addresses from given file names.
-#
-sub _get_address_from_file ($) {
- my $file = shift;
-
- # Check if the file exists.
- if (-e $file) {
- # Open the given file.
- open(FILE, "$file") or die "Could not open $file.";
-
- # Obtain the address from the first line of the file.
- my $address = <FILE>;
-
- # Close filehandle
- close(FILE);
-
- # Remove newlines.
- chomp $address;
-
- # Check if the grabbed address is valid.
- if (&General::validip($address)) {
- # Return the address.
- return $address;
- }
- }
-
- # Return nothing.
- return;
-}
diff --git a/html/cgi-bin/hosts.cgi b/html/cgi-bin/hosts.cgi
index 973c480b3..1c9df5a62 100644
--- a/html/cgi-bin/hosts.cgi
+++ b/html/cgi-bin/hosts.cgi
@@ -488,5 +488,5 @@ sub SortDataFile
#
sub BuildConfiguration {
system '/usr/local/bin/rebuildhosts';
- system '/usr/local/bin/unboundctrl restart &>/dev/null';
+ system '/usr/local/bin/unboundctrl reload &>/dev/null';
}
diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi
index c7bf9f323..bd6a02ef5 100644
--- a/html/cgi-bin/index.cgi
+++ b/html/cgi-bin/index.cgi
@@ -200,25 +200,6 @@ END
END
}
- my $dns_servers;
- if ( -e "${General::swroot}/red/dns" ) {
- open (TMP, "<${General::swroot}/red/dns");
- $dns_servers = <TMP>;
- chomp($dns_servers);
- close TMP;
- }
- print <<END;
- <tr>
- <td>
- <b><a href="netexternal.cgi">$Lang::tr{'dns servers'}</a>:</b>
- </td>
- <td style='text-align:center;'>
- $dns_servers
- </td>
- <td></td>
- </tr>
-END
-
if (&General::RedIsWireless()) {
my $iface = $netsettings{"RED_DEV"} || "red0";
diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi
index 8f29eb8a2..98ac4fe12 100644
--- a/html/cgi-bin/netexternal.cgi
+++ b/html/cgi-bin/netexternal.cgi
@@ -80,108 +80,6 @@ if ( $querry[0] ne~ ""){
&Header::closebox();
}
- ## DNSSEC
- my @nameservers = ();
- foreach my $f ("${General::swroot}/red/dns1", "${General::swroot}/red/dns2") {
- open(DNS, "<$f");
- my $nameserver = <DNS>;
- close(DNS);
-
- chomp($nameserver);
- if ($nameserver) {
- push(@nameservers, $nameserver);
- }
- }
-
- &Header::openbox('100%', 'center', $Lang::tr{'dnssec information'});
-
- print <<END;
- <table class="tbl" width='66%'>
- <thead>
- <tr>
- <th align="center">
- <strong>$Lang::tr{'nameserver'}</strong>
- </th>
- <th align="center">
- <strong>$Lang::tr{'country'}</strong>
- </th>
- <th align="center">
- <strong>$Lang::tr{'rdns'}</strong>
- </th>
- <th align="center">
- <strong>$Lang::tr{'status'}</strong>
- </th>
- </tr>
- </thead>
- <tbody>
-END
-
- my $id = 0;
- for my $nameserver (@nameservers) {
- my $status = &check_dnssec($nameserver, "ping.ipfire.org");
-
- my $colour = "";
- my $bgcolour = "";
- my $message = "";
-
- # DNSSEC Not supported
- if ($status == 0) {
- $message = $Lang::tr{'dnssec not supported'};
- $colour = "white";
- $bgcolour = ${Header::colourred};
-
- # DNSSEC Aware
- } elsif ($status == 1) {
- $message = $Lang::tr{'dnssec aware'};
- $colour = "black";
- $bgcolour = ${Header::colouryellow};
-
- # DNSSEC Validating
- } elsif ($status == 2) {
- $message = $Lang::tr{'dnssec validating'};
- $colour = "white";
- $bgcolour = ${Header::colourgreen};
-
- # Error
- } else {
- $colour = ${Header::colourred};
- }
-
- my $table_colour = ($id++ % 2) ? $color{'color22'} : $color{'color20'};
-
- # collect more information about name server (rDNS, GeoIP country code)
- my $ccode = &GeoIP::lookup($nameserver);
- my $flag_icon = &GeoIP::get_flag_icon($ccode);
-
- my $iaddr = inet_aton($nameserver);
- my $rdns = gethostbyaddr($iaddr, AF_INET);
- if (!$rdns) { $rdns = $Lang::tr{'lookup failed'}; }
-
- print <<END;
- <tr bgcolor="$table_colour">
- <td>
- $nameserver
- </td>
- <td align="center">
- <a href='country.cgi#$ccode'><img src="$flag_icon" border="0" alt="$ccode" title="$ccode" /></a>
- </td>
- <td align="center">
- $rdns
- </td>
- <td bgcolor="$bgcolour" align="center">
- <font color="$colour"><strong>$message</strong></font>
- </td>
- </tr>
-END
- }
-
- print <<END;
- </tbody>
- </table>
-END
-
- &Header::closebox();
-
if ( $netsettings{'CONFIG_TYPE'} =~ /^(1|2|3|4)$/ && $netsettings{'RED_TYPE'} eq "DHCP"){
&Header::openbox('100%', 'left', "RED $Lang::tr{'dhcp configuration'}");
@@ -268,32 +166,3 @@ END
&Header::closebigbox();
&Header::closepage();
}
-
-sub check_dnssec($$) {
- my $nameserver = shift;
- my $record = shift;
-
- my @command = ("dig", "+dnssec", $record, "\@$nameserver");
-
- my @output = qx(@command);
- my $output = join("", @output);
-
- my $status = 0;
- if ($output =~ m/status: (\w+)/) {
- $status = ($1 eq "NOERROR");
-
- if (!$status) {
- return -1;
- }
- }
-
- my @flags = ();
- if ($output =~ m/flags: (.*);/) {
- @flags = split(/ /, $1);
- }
-
- my $aware = ($output =~ m/RRSIG/);
- my $validating = ("ad" ~~ @flags);
-
- return $aware + $validating;
-}
diff --git a/html/cgi-bin/pppsetup.cgi b/html/cgi-bin/pppsetup.cgi
index 4b45ee50c..bdcd41e24 100644
--- a/html/cgi-bin/pppsetup.cgi
+++ b/html/cgi-bin/pppsetup.cgi
@@ -116,19 +116,6 @@ elsif ($pppsettings{'ACTION'} eq $Lang::tr{'save'})
$errormessage = $Lang::tr{'bad characters in script field'};
goto ERROR; }
- if ($pppsettings{'DNS1'})
- {
- if (!(&General::validip($pppsettings{'DNS1'}))) {
- $errormessage = $Lang::tr{'invalid primary dns'};
- goto ERROR; }
- }
- if ($pppsettings{'DNS2'})
- {
- if (!(&General::validip($pppsettings{'DNS2'}))) {
- $errormessage = $Lang::tr{'invalid secondary dns'};
- goto ERROR; }
- }
-
if ($pppsettings{'MAXRETRIES'} eq '') {
$errormessage = $Lang::tr{'max retries not set'};
goto ERROR; }
@@ -948,22 +935,6 @@ print <<END
<td width='25%'>$Lang::tr{'script name'}</td>
<td width='25%'><input type='text' name='LOGINSCRIPT' value='$pppsettings{'LOGINSCRIPT'}' /></td>
</tr>
-<tr><td colspan='4' width='100%'><br></br></td></tr>
-<tr>
- <td bgcolor='$color{'color20'}' colspan='4' width='100%'><b>DNS:</b></td>
-</tr>
-<tr>
- <td colspan='4' width='100%'><input type='radio' name='DNS' value='Automatic' $checked{'DNS'}{'Automatic'} />$Lang::tr{'automatic'}</td>
-</tr>
-<tr>
- <td colspan='4' width='100%'><input type='radio' name='DNS' value='Manual' $checked{'DNS'}{'Manual'} />$Lang::tr{'manual'}</td>
-</tr>
-<tr>
- <td width='25%'>$Lang::tr{'primary dns'}</td>
- <td width='25%'><input type='text' name='DNS1' value='$pppsettings{'DNS1'}'></td>
- <td width='25%'>$Lang::tr{'secondary dns'}</td>
- <td width='25%'><input type='text' name='DNS2' value='$pppsettings{'DNS2'}'></td>
-</tr>
<tr><td colspan='4' width='100%'><br></br><hr></hr><br></br></td></tr>
<tr>
<td width='25%'>$Lang::tr{'profile name'} <img src='/blob.gif' alt='*' /></td>
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 2dc325a3a..cec76c8db 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -452,7 +452,7 @@
'available updates' => 'Available updates:',
'average' => 'Average',
'avoid dod' => 'Do not use this option with Dial on Demand! Mainly used if your IPFire is behind a router. Your RED IP must be inside one of the three reserved network numbers e.g. 10/8, 172.16/12, 192.168/16',
-'back' => 'BACK',
+'back' => 'Back',
'backup' => 'Backup',
'backup archive' => 'Backup File (.dat)',
'backup clear archive' => 'Clear Backup File (.gz)',
@@ -508,6 +508,7 @@
'blue access use hint' => 'You have to enter the MAC or the IP Address for a device. To enter both is also possible',
'blue interface' => 'Blue Interface',
'broadcast' => 'Broadcast',
+'broken' => 'Broken',
'broken pipe' => 'Broken pipe',
'buffered memory' => 'Buffered Memory',
'buffers' => 'buffers',
@@ -836,27 +837,39 @@
'dmzpinholes for same net not necessary' => 'DMZ Pinholes are not necessary for same net. Select different source or destination net.',
'dnat address' => 'Firewall Interface',
'dns address deleted' => 'Successfully deleted!',
-'dns address deleted txt' => 'The DNS-Server addresses have been successfully deleted.<br />You have to reboot or reconnect that the changes have effect!',
-'dns address done' => 'The DNS-Server address settings are going to be saved.',
+'dns address deleted txt' => 'The DNS server addresses have been successfully deleted.<br />You have to reboot or reconnect that the changes have effect!',
+'dns address done' => 'The DNS server address settings are going to be saved.',
'dns address recon' => 'Trying to reconnect!',
'dns check failed' => 'DNS check failed',
+'dns check servers' => 'Check DNS Servers',
+'dns configuration' => 'DNS Configuration',
+'dns could not add server' => 'Could not add server - Reason:',
'dns desc' => 'If the red0 interface gets the IP address information via DHCP from the provider, the DNS server addresses will be set automatically. Now here you are able to change these DNS server IP addresses with your own ones.',
+'dns enable safe-search' => 'Enable Safe Search',
'dns error 0' => 'The IP address of the <strong>primary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>secondary</strong> DNS server address is valid.',
'dns error 01' => 'The entered IP address of the <strong>primary</strong> and <strong>secondary</strong> DNS server are not valid, please check your entries!',
'dns error 1' => 'The IP address of the <strong>secondary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>primary</strong> DNS server address is valid.',
'dns forward disable dnssec' => 'Disable DNSSEC (dangerous)',
'dns forwarding dnssec disabled notice' => '(DNSSEC disabled)',
'dns header' => 'Assign DNS server addresses only for DHCP on red0',
+'dns isp nameservers and tls not allowed' => 'ISP-assigned DNS servers and TLS cannot be used at the same time.',
+'dns isp assigned nameserver' => 'ISP-assigned DNS server',
'dns list' => 'List of free public DNS servers',
-'dns menu' => 'Assign DNS-Server',
+'dns menu' => 'Assign DNS Server',
+'dns mode for qname minimisation' => 'QNAME Minimisation',
'dns new 0' => 'New <strong>primary</strong> DNS server IP:',
'dns new 1' => 'New <strong>secondary</strong> DNS server IP:',
+'dns no address given' => 'No IP Address given.',
+'dns no tls hostname given' => 'No TLS hostname given.',
'dns proxy server' => 'DNS Proxy Server',
'dns saved' => 'Successfully saved!',
'dns saved txt' => 'The two entered DNS server addresses have been saved successfully.<br />You have to reboot or reconnect that the changes have effect!',
'dns server' => 'DNS Server',
'dns servers' => 'DNS Servers',
'dns title' => 'Domain Name System',
+'dns tls hostname' => 'TLS Hostname',
+'dns use isp assigned nameservers' => 'Use ISP-assigned DNS servers',
+'dns use protocol for dns queries' => 'Protocol for DNS queries',
'dnsforward' => 'DNS Forwarding',
'dnsforward add a new entry' => 'Add a new entry',
'dnsforward configuration' => 'DNS forward configuration',
@@ -1805,6 +1818,7 @@
'not present' => '<b>Not</b> present',
'not running' => 'not running',
'not set' => 'not set',
+'not validating' => 'Not validating',
'notes' => 'Notes',
'notice' => 'Notice',
'november' => 'November',
@@ -1822,6 +1836,7 @@
'october' => 'October',
'off' => 'off',
'ok' => 'OK',
+'okay' => 'Okay',
'older' => 'Older',
'on' => 'on',
'one hour' => 'One Hour',
@@ -2286,6 +2301,7 @@
'sssystem status' => 'System Status',
'sstraffic' => 'Net-Traffic',
'sstraffic graphs' => 'Traffic Graphs',
+'standard' => 'Standard',
'standard login script' => 'Standard login script',
'start' => 'Start',
'start address' => 'Start address:',
@@ -2300,6 +2316,7 @@
'stop' => 'Stop',
'stop ovpn server' => 'Stop OpenVPN Server',
'stopped' => 'STOPPED',
+'strict' => 'Strict',
'subject' => 'Subject',
'subject test' => 'Teste-mail',
'subject warn' => 'Warning - warnlevel reached',
@@ -2941,6 +2958,7 @@
'wlanap wlan status' => 'WLan Status',
'wol wakeup' => 'WakeUp',
'workgroup' => 'Workgroup',
+'working' => 'Working',
'written bytes' => 'Bytes Written',
'xtaccess all error' => 'You cannot set an external access to ALL, that is done in the port forwarding record.',
'xtaccess bad transfert' => 'If you specify a port destination range, the source range must be identical !',
diff --git a/lfs/guardian b/lfs/guardian
index 31d1dcb43..a40480c0c 100644
--- a/lfs/guardian
+++ b/lfs/guardian
@@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = guardian
-PAK_VER = 17
+PAK_VER = 18
DEPS = "perl-inotify2 perl-Net-IP"
diff --git a/src/initscripts/networking/dhcpcd.exe b/src/initscripts/networking/dhcpcd.exe
index 28d62a14e..7a9889b5b 100644
--- a/src/initscripts/networking/dhcpcd.exe
+++ b/src/initscripts/networking/dhcpcd.exe
@@ -14,9 +14,7 @@
. /etc/sysconfig/rc
. $rc_functions
-
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
-eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
dhcpcd_up()
{
@@ -30,8 +28,7 @@ dhcpcd_up()
# Only if RED_TYPE=DHCP update /var/ipfire/red
if [ "$RED_TYPE" == "DHCP" ]; then
-
- #Check if we have to restart the services at update
+ # Check if we have to restart the services at update
[ ! -e "/var/ipfire/red/active" ] && update=1;
if [ "$old_domain_name_service" != "$new_domain_name_service" ]; then
update=1;
@@ -43,15 +40,9 @@ dhcpcd_up()
update=1;
fi
- #Get DNS from dhcp
- if [ -n "$DNS0" ] && [ -n "$DNS1" ]; then
- logger -p local0.info -t dhcpcd.exe[$$] "Overwritting DNS-Server addresses with ${DNS0},${DNS1}"
- echo -n ${DNS0} > /var/ipfire/red/dns1
- echo -n ${DNS1} > /var/ipfire/red/dns2
- else
- echo -n `/etc/rc.d/helper/getdnsfromdhcpc.pl 1` > /var/ipfire/red/dns1
- echo -n `/etc/rc.d/helper/getdnsfromdhcpc.pl 2` > /var/ipfire/red/dns2
- fi
+ # Get DNS from dhcp
+ /etc/rc.d/helper/getdnsfromdhcpc.pl 1 > /var/run/dns1
+ /etc/rc.d/helper/getdnsfromdhcpc.pl 2 > /var/run/dns2
#Get IP Address
echo -n "$new_ip_address" > /var/ipfire/red/local-ipaddress
@@ -76,6 +67,9 @@ dhcpcd_down()
set | grep "^new_" | sed "s|^new_||g" | \
sort > /var/ipfire/dhcpc/dhcpcd-$interface.info
+ # Remove DNS servers
+ rm -f /var/run/dns1 /var/run/dns2
+
# Only if RED_TYPE=DHCP update /var/ipfire/red
if [ "$RED_TYPE" == "DHCP" ]; then
rm -f /var/ipfire/red/active
diff --git a/src/initscripts/networking/red b/src/initscripts/networking/red
index b8d463241..7ce0a6f47 100644
--- a/src/initscripts/networking/red
+++ b/src/initscripts/networking/red
@@ -120,8 +120,6 @@ case "${1}" in
grep -v -E "\<gateway\>" /etc/hosts > /tmp/hosts
echo "$GATEWAY gateway" >> /tmp/hosts
mv /tmp/hosts /etc/hosts
- echo -n "${DNS1}" > /var/ipfire/red/dns1
- echo -n "${DNS2}" > /var/ipfire/red/dns2
touch /var/ipfire/red/active
# Create route to default gateway
diff --git a/src/initscripts/networking/red.up/05-update-dns-forwarders b/src/initscripts/networking/red.up/05-update-dns-forwarders
index 4ff2e58ef..cdae7781f 100644
--- a/src/initscripts/networking/red.up/05-update-dns-forwarders
+++ b/src/initscripts/networking/red.up/05-update-dns-forwarders
@@ -1,13 +1,4 @@
#!/bin/bash
-# If network has not fully been brought up here, we start unbound
-# so that all following scripts can rely on DNS resolution
-
-pidof unbound > /dev/null
-if [ "${?}" = "0" ]; then
- # unbound is run so update the forwarders
- /etc/init.d/unbound update-forwarders
-else
- # Start unbound if it is not running, yet
- /etc/init.d/unbound start
-fi
+# Update DNS forwarders
+exec /etc/init.d/unbound update-forwarders
diff --git a/src/initscripts/networking/red.up/06-safe-search b/src/initscripts/networking/red.up/06-safe-search
deleted file mode 100644
index 14ff93b45..000000000
--- a/src/initscripts/networking/red.up/06-safe-search
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-
-exec /etc/init.d/unbound update-safe-search
diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound
index 61d62beb1..7df50e9d4 100644
--- a/src/initscripts/system/unbound
+++ b/src/initscripts/system/unbound
@@ -7,30 +7,12 @@
. /etc/sysconfig/rc
. ${rc_functions}
-TEST_DOMAIN="ipfire.org"
-
-# This domain will never validate
-TEST_DOMAIN_FAIL="dnssec-failed.org"
-
-INSECURE_ZONES=
-USE_FORWARDERS=1
-ENABLE_SAFE_SEARCH=off
-FORCE_TCP=off
-
# Cache any local zones for 60 seconds
LOCAL_TTL=60
-# EDNS buffer size
-EDNS_DEFAULT_BUFFER_SIZE=4096
-
-# Load optional configuration
-[ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
-
-DIG_ARGS=()
-
-if [ "${FORCE_TCP}" = "on" ]; then
- DIG_ARGS+=( "+tcp" )
-fi
+# Load configuration
+eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
+eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
ip_address_revptr() {
local addr=${1}
@@ -42,26 +24,27 @@ ip_address_revptr() {
}
read_name_servers() {
- local i
- for i in 1 2; do
- echo "$(</var/ipfire/red/dns${i})"
- done 2>/dev/null | xargs echo
-}
-
-check_red_has_carrier_and_ip() {
- # Interface configured ?
- [ ! -e "/var/ipfire/red/iface" ] && return 0;
-
- # Interface present ?
- [ ! -e "/sys/class/net/$(</var/ipfire/red/iface)" ] && return 0;
-
- # has carrier ?
- [ ! "$(</sys/class/net/$(</var/ipfire/red/iface)/carrier)" = "1" ] && return 0;
+ # Read name servers from ISP
+ if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
+ local i
+ for i in 1 2; do
+ echo "$(</var/run/dns${i})"
+ done 2>/dev/null
+ fi
- # has ip ?
- [ "$(ip address show dev $(</var/ipfire/red/iface) | grep "inet")" = "" ] && return 0;
+ # Read configured name servers
+ local id address tls_hostname enabled remark
+ while IFS="," read -r id address tls_hostname enabled remark; do
+ [ "${enabled}" != "enabled" ] && continue
- return 1;
+ if [ "${PROTO}" = "TLS" ]; then
+ if [ -n "${tls_hostname}" ]; then
+ echo "${address}@853#${tls_hostname}"
+ fi
+ else
+ echo "${address}"
+ fi
+ done < /var/ipfire/dns/servers
}
config_header() {
@@ -70,151 +53,67 @@ config_header() {
echo
}
-update_forwarders() {
- check_red_has_carrier_and_ip
- if [ "${USE_FORWARDERS}" = "1" -a "${?}" = "1" ]; then
- local forwarders
- local broken_forwarders
-
- local ns
- for ns in $(read_name_servers); do
- test_name_server ${ns} &>/dev/null
- case "$?" in
- # Only use DNSSEC-validating or DNSSEC-aware name servers
- 0|2)
- forwarders="${forwarders} ${ns}"
- ;;
- *)
- broken_forwarders="${broken_forwarders} ${ns}"
- ;;
- esac
- done
-
- # Determine EDNS buffer size
- local new_edns_buffer_size=${EDNS_DEFAULT_BUFFER_SIZE}
-
- for ns in ${forwarders}; do
- local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
- if [ -n "${edns_buffer_size}" ]; then
- if [ ${edns_buffer_size} -lt ${new_edns_buffer_size} ]; then
- new_edns_buffer_size=${edns_buffer_size}
- fi
- fi
- done
-
- if [ ${new_edns_buffer_size} -lt ${EDNS_DEFAULT_BUFFER_SIZE} ]; then
- boot_mesg "EDNS buffer size reduced to ${new_edns_buffer_size}" ${WARNING}
- echo_warning
-
- unbound-control -q set_option edns-buffer-size: ${new_edns_buffer_size}
- fi
-
- # Show warning for any broken upstream name servers
- if [ -n "${broken_forwarders}" ]; then
- boot_mesg "Ignoring broken upstream name server(s): ${broken_forwarders:1}" ${WARNING}
- echo_warning
- fi
-
- if [ -n "${forwarders}" ]; then
- boot_mesg "Configuring upstream name server(s): ${forwarders:1}" ${INFO}
- echo_ok
-
- # Make sure DNSSEC is activated
- enable_dnssec
-
- echo "${forwarders}" > /var/ipfire/red/dns
- unbound-control -q forward ${forwarders}
- return 0
-
- # In case we have found no working forwarders
- else
- # Test if the recursor mode is available
- if can_resolve_root +bufsize=${new_edns_buffer_size}; then
- # Make sure DNSSEC is activated
- enable_dnssec
-
- boot_mesg "Falling back to recursor mode" ${WARNING}
- echo_warning
-
- # If not, we set DNSSEC in permissive mode and allow using all recursors
- elif [ -n "${broken_forwarders}" ]; then
- disable_dnssec
-
- boot_mesg "DNSSEC has been set to permissive mode" ${FAILURE}
- echo_failure
+write_hosts_conf() {
+ (
+ config_header
- echo "${broken_forwarders}" > /var/ipfire/red/dns
- unbound-control -q forward ${broken_forwarders}
- return 0
- fi
+ # Make own hostname resolveable
+ # 1.1.1.1 is reserved for unused green, skip this
+ if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
+ echo "local-data: \"${HOSTNAME} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}\""
fi
- fi
- # If forwarders cannot be used we run in recursor mode
- echo "local recursor" > /var/ipfire/red/dns
- unbound-control -q forward off
-}
+ local address
+ for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
+ [ -n "${address}" ] || continue
+ [ "${address}" = "1.1.1.1" ] && continue
-remove_forwarders() {
- enable_dnssec
- echo "local recursor" > /var/ipfire/red/dns
- unbound-control -q forward off
-
-}
-
-own_hostname() {
- local hostname=$(hostname -f)
- # 1.1.1.1 is reserved for unused green, skip this
- if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
- unbound-control -q local_data "${hostname} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}"
- fi
-
- local address
- for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
- [ -n "${address}" ] || continue
- [ "${address}" = "1.1.1.1" ] && continue
-
- address=$(ip_address_revptr ${address})
- unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${hostname}"
- done
-}
-
-update_hosts() {
- local enabled address hostname domainname generateptr
-
- while IFS="," read -r enabled address hostname domainname generateptr; do
- [ "${enabled}" = "on" ] || continue
+ address=$(ip_address_revptr ${address})
+ echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${HOSTNAME}\""
+ done
- # Build FQDN
- local fqdn="${hostname}.${domainname}"
+ # Add all hosts
+ local enabled address hostname domainname generateptr
+ while IFS="," read -r enabled address hostname domainname generateptr; do
+ [ "${enabled}" = "on" ] || continue
- unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"
+ # Build FQDN
+ local fqdn="${hostname}.${domainname}"
+ echo "local-data: \"${fqdn} ${LOCAL_TTL} IN A ${address}\""
- # Skip reverse resolution if the address equals the GREEN address
- [ "${address}" = "${GREEN_ADDRESS}" ] && continue
+ # Skip reverse resolution if the address equals the GREEN address
+ [ "${address}" = "${GREEN_ADDRESS}" ] && continue
- # Skip reverse resolution if user requested not to do so
- [ "${generateptr}" = "off" ] && continue
+ # Skip reverse resolution if user requested not to do so
+ [ "${generateptr}" = "off" ] && continue
- # Add RDNS
- address=$(ip_address_revptr ${address})
- unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}"
- done < /var/ipfire/main/hosts
+ # Add RDNS
+ address=$(ip_address_revptr ${address})
+ echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${fqdn}\""
+ done < /var/ipfire/main/hosts
+ ) > /etc/unbound/hosts.conf
}
write_forward_conf() {
(
config_header
+ # Enable strict QNAME minimisation
+ if [ "${QNAME_MIN}" = "strict" ]; then
+ echo "server:"
+ echo " qname-minimisation-strict: yes"
+ echo
+ fi
+
# Force using TCP for upstream servers only
- if [ "${FORCE_TCP}" = "on" ]; then
+ if [ "${PROTO}" = "TCP" ]; then
echo "# Force using TCP for upstream servers only"
echo "server:"
echo " tcp-upstream: yes"
echo
fi
- local insecure_zones="${INSECURE_ZONES}"
+ local insecure_zones=""
local enabled zone server servers remark disable_dnssec rest
while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
@@ -234,35 +133,24 @@ write_forward_conf() {
;;
esac
- # Reverse-lookup zones must be stubs
+ echo "stub-zone:"
+ echo " name: ${zone}"
+ for server in ${servers//|/ }; do
+ if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+ echo " stub-addr: ${server}"
+ else
+ echo " stub-host: ${server}"
+ fi
+ done
+ echo
+
+ # Make all reverse lookup zones transparent
case "${zone}" in
*.in-addr.arpa)
- echo "stub-zone:"
- echo " name: ${zone}"
- for server in ${servers//|/ }; do
- if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
- echo " stub-addr: ${server}"
- else
- echo " stub-host: ${server}"
- fi
- done
- echo
echo "server:"
echo " local-zone: \"${zone}\" transparent"
echo
;;
- *)
- echo "forward-zone:"
- echo " name: ${zone}"
- for server in ${servers//|/ }; do
- if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
- echo " forward-addr: ${server}"
- else
- echo " forward-host: ${server}"
- fi
- done
- echo
- ;;
esac
done < /var/ipfire/dnsforward/config
@@ -273,6 +161,20 @@ write_forward_conf() {
echo " domain-insecure: ${zone}"
done
fi
+
+ echo "forward-zone:"
+ echo " name: \".\""
+
+ # Force using TLS only
+ if [ "${PROTO}" = "TLS" ]; then
+ echo " forward-tls-upstream: yes"
+ fi
+
+ # Add upstream name servers
+ local ns
+ for ns in $(read_name_servers); do
+ echo " forward-addr: ${ns}"
+ done
) > /etc/unbound/forward.conf
}
@@ -361,190 +263,26 @@ get_memory_amount() {
done < /proc/meminfo
}
-test_name_server() {
- local ns=${1}
- local args
-
- # Return codes:
- # 0 DNSSEC validating
- # 1 Error: unreachable, etc.
- # 2 DNSSEC aware
- # 3 NOT DNSSEC-aware
-
- # Exit when the server is not reachable
- ns_is_online ${ns} || return 1
-
- # Determine the maximum edns buffer size that works
- local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
- if [ -n "${edns_buffer_size}" ]; then
- args="${args} +bufsize=${edns_buffer_size}"
- fi
-
- local errors
- for rr in DNSKEY DS RRSIG; do
- if ! ns_forwards_${rr} ${ns} ${args}; then
- errors="${errors} ${rr}"
- fi
- done
-
- if [ -n "${errors}" ]; then
- echo >&2 "Unable to retrieve the following resource records from ${ns}: ${errors:1}"
- return 3
- fi
-
- if ns_is_validating ${ns} ${args}; then
- # Return 0 if validating
+fix_time_if_dns_fails() {
+ # If DNS is working, everything is fine
+ if resolve "ping.ipfire.org" &>/dev/null; then
return 0
- else
- # Is DNSSEC-aware
- return 2
fi
-}
-# Sends an A query to the nameserver w/o DNSSEC
-ns_is_online() {
- local ns=${1}
- shift
-
- dig "${DIG_ARGS[@]}" @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null
-}
-
-# Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating
-ns_is_validating() {
- local ns=${1}
- shift
-
- if ! dig "${DIG_ARGS[@]}" @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then
- return 1
- else
- # Determine if NS replies with "ad" data flag if DNSSEC enabled
- dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }'
- fi
-}
-
-# Checks if we can retrieve the DNSKEY for this domain.
-# dig will print the SOA if nothing was found
-ns_forwards_DNSKEY() {
- local ns=${1}
- shift
-
- dig "${DIG_ARGS[@]}" @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA
-}
-
-ns_forwards_DS() {
- local ns=${1}
- shift
-
- dig "${DIG_ARGS[@]}" @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA
-}
-
-ns_forwards_RRSIG() {
- local ns=${1}
- shift
-
- dig "${DIG_ARGS[@]}" @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG
-}
-
-ns_supports_tcp() {
- local ns=${1}
- shift
-
- # If TCP is forced we know by now if the server responds to it
- if [ "${FORCE_TCP}" = "on" ]; then
- return 0
- fi
-
- dig "${DIG_ARGS[@]}" @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1
-}
-
-ns_determine_edns_buffer_size() {
- local ns=${1}
- shift
-
- local b
- for b in 4096 2048 1500 1480 1464 1400 1280 512; do
- if dig "${DIG_ARGS[@]}" @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then
- echo "${b}"
- return 0
- fi
- done
-
- return 1
-}
-
-get_root_nameservers() {
- while read -r hostname ttl record address; do
- # Searching for A records
- [ "${record}" = "A" ] || continue
-
- echo "${address}"
- done < /etc/unbound/root.hints
-}
-
-can_resolve_root() {
- local ns
- for ns in $(get_root_nameservers); do
- if dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA . $@ >/dev/null; then
- return 0
- fi
- done
-
- # none of the servers was reachable
- return 1
-}
-
-enable_dnssec() {
- local status=$(unbound-control get_option val-permissive-mode)
-
- # Log DNSSEC status
- echo "on" > /var/ipfire/red/dnssec-status
-
- # Don't do anything if DNSSEC is already activated
- [ "${status}" = "no" ] && return 0
-
- # Activate DNSSEC and flush cache with any stale and unvalidated data
- unbound-control -q set_option val-permissive-mode: no
- unbound-control -q flush_zone .
-}
-
-disable_dnssec() {
- # Log DNSSEC status
- echo "off" > /var/ipfire/red/dnssec-status
-
- unbound-control -q set_option val-permissive-mode: yes
-}
-
-fix_time_if_dns_fail() {
- # If DNS still not work try to init ntp with
- # hardcoded ntp.ipfire.org (81.3.27.46)
- check_red_has_carrier_and_ip
- if [ -e "/var/ipfire/red/iface" -a "${?}" = "1" ]; then
- host 0.ipfire.pool.ntp.org > /dev/null 2>&1
- if [ "${?}" != "0" ]; then
- boot_mesg "DNS still not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
- loadproc /usr/local/bin/settime 81.3.27.46
- fi
- fi
+ # Try to sync time with a known time server
+ boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
+ loadproc /usr/local/bin/settime 81.3.27.46
}
resolve() {
local hostname="${1}"
- local found=0
- local ns
- for ns in $(read_name_servers); do
- local answer
- for answer in $(dig "${DIG_ARGS[@]}" +short "@${ns}" A "${hostname}"); do
- found=1
-
- # Filter out non-IP addresses
- if [[ ! "${answer}" =~ \.$ ]]; then
- echo "${answer}"
- fi
- done
-
- # End loop when we have got something
- [ ${found} -eq 1 ] && break
+ local answer
+ for answer in $(dig +short A "${hostname}"); do
+ # Filter out non-IP addresses
+ if [[ ! "${answer}" =~ \.$ ]]; then
+ echo "${answer}"
+ fi
done
}
@@ -809,30 +547,18 @@ case "$1" in
exit 0
fi
- eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
-
# Update configuration files
write_tuning_conf
+ write_hosts_conf
write_forward_conf
boot_mesg "Starting Unbound DNS Proxy..."
loadproc /usr/sbin/unbound || exit $?
- # Make own hostname resolveable
- own_hostname
-
- # Update any known forwarding name servers
- update_forwarders
-
# Install Safe Search rules when the system is already online
if [ -e "/var/ipfire/red/active" ]; then
update_safe_search
fi
-
- # Update hosts
- update_hosts
-
- fix_time_if_dns_fail
;;
stop)
@@ -845,84 +571,37 @@ case "$1" in
sleep 1
$0 start
;;
+ reload|remove-forwarders)
+ # Update configuration files
+ write_forward_conf
+ write_hosts_conf
- status)
- statusproc /usr/sbin/unbound
- ;;
-
- update-forwarders)
- # Do not try updating forwarders when unbound is not running
- if ! pgrep unbound &>/dev/null; then
- exit 0
+ # Update Safe Search rules if the system is online.
+ if [ -e "/var/ipfire/red/active" ]; then
+ update_safe_search
fi
- update_forwarders
-
- unbound-control flush_negative > /dev/null
- unbound-control flush_bogus > /dev/null
-
- fix_time_if_dns_fail
+ # Call unbound-control and perform the reload
+ /usr/sbin/unbound-control -q reload
;;
- remove-forwarders)
- # Do not try updating forwarders when unbound is not running
- if ! pgrep unbound &>/dev/null; then
- exit 0
- fi
-
- remove_forwarders
-
- unbound-control flush_negative > /dev/null
- unbound-control flush_bogus > /dev/null
+ status)
+ statusproc /usr/sbin/unbound
;;
+ update-forwarders)
+ $0 reload
- test-name-server)
- ns=${2}
-
- test_name_server ${ns}
- ret=${?}
-
- case "${ret}" in
- 0)
- echo "${ns} is validating"
- ;;
- 2)
- echo "${ns} is DNSSEC-aware"
- ;;
- 3)
- echo "${ns} is NOT DNSSEC-aware"
- ;;
- *)
- echo "Test failed for an unknown reason"
- exit ${ret}
- ;;
- esac
-
- if ns_supports_tcp ${ns}; then
- echo "${ns} supports TCP fallback"
- else
- echo "${ns} does not support TCP fallback"
- fi
-
- edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
- if [ -n "${edns_buffer_size}" ]; then
- echo "EDNS buffer size for ${ns}: ${edns_buffer_size}"
- fi
-
- exit ${ret}
+ # Make sure DNS works at this point
+ fix_time_if_dns_fails
;;
resolve)
resolve "${2}"
;;
- update-safe-search)
- update_safe_search
- ;;
-
*)
- echo "Usage: $0 {start|stop|restart|status|update-forwarders|remove-forwarders|test-name-server|resolve|update-safe-search}"
+ echo "Usage: $0 {start|stop|restart|reload|status|resolve|update-forwarders|remove-forwarders}"
exit 1
;;
esac
diff --git a/src/misc-progs/unboundctrl.c b/src/misc-progs/unboundctrl.c
index fea81c671..86c6ac42b 100644
--- a/src/misc-progs/unboundctrl.c
+++ b/src/misc-progs/unboundctrl.c
@@ -19,14 +19,16 @@ int main(int argc, char *argv[]) {
exit(1);
if (argc < 2) {
- fprintf(stderr, "\nNo argument given.\n\nunboundctrl (restart)\n\n");
+ fprintf(stderr, "\nNo argument given.\n\nunboundctrl restart|reload\n\n");
exit(1);
}
if (strcmp(argv[1], "restart") == 0) {
safe_system("/etc/rc.d/init.d/unbound restart");
+ } else if (strcmp(argv[1], "reload") == 0) {
+ safe_system("/etc/rc.d/init.d/unbound reload");
} else {
- fprintf(stderr, "\nBad argument given.\n\nunboundctrl (restart)\n\n");
+ fprintf(stderr, "\nBad argument given.\n\nunboundctrl restart|reload\n\n");
exit(1);
}
diff --git a/src/ppp/ip-down b/src/ppp/ip-down
index ea0dcbf94..f67a91ea2 100644
--- a/src/ppp/ip-down
+++ b/src/ppp/ip-down
@@ -22,9 +22,8 @@
. /etc/sysconfig/rc
. $rc_functions
-eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
-
-rm -f /var/ipfire/red/active
+rm -f /var/ipfire/red/active \
+ /var/run/dns1 /var/run/dns2
run_subdir ${rc_base}/init.d/networking/red.down/
diff --git a/src/ppp/ip-up b/src/ppp/ip-up
index c7357708a..ee1683fdd 100644
--- a/src/ppp/ip-up
+++ b/src/ppp/ip-up
@@ -22,32 +22,17 @@
. /etc/sysconfig/rc
. $rc_functions
-PRIMARY_DNS=$DNS1
-SECONDARY_DNS=$DNS2
-
eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
-if [ "$DNS" == "Automatic" ]; then
- if [ "$TYPE" == "isdn" ]; then
- echo -n "$MS_DNS1" > /var/ipfire/red/dns1
- echo -n "$MS_DNS2" > /var/ipfire/red/dns2
- else
- if [ "$PRIMARY_DNS" == "10.11.12.13" ]; then
- echo -n "$DNS1" > /var/ipfire/red/dns1
- else
- echo -n "$PRIMARY_DNS" > /var/ipfire/red/dns1
- fi
- if [ "$SECONDARY_DNS" == "10.11.12.14" ]; then
- echo -n "$DNS2" > /var/ipfire/red/dns2
- else
- echo -n "$SECONDARY_DNS" > /var/ipfire/red/dns2
- fi
- fi
-else
- echo -n "$DNS1" > /var/ipfire/red/dns1
- echo -n "$DNS2" > /var/ipfire/red/dns2
+if [ "$TYPE" = "isdn" ]; then
+ DNS1="${MS_DNS1}"
+ DNS2="${MS_DNS2}"
fi
+# Write DNS servers to configuration
+echo "${DNS1}" > /var/run/dns1
+echo "${DNS2}" > /var/run/dns2
+
echo -n "$1" > /var/ipfire/red/iface
echo -n "$4" > /var/ipfire/red/local-ipaddress
echo -n "$5" > /var/ipfire/red/remote-ipaddress
diff --git a/src/scripts/convert-dns-settings b/src/scripts/convert-dns-settings
new file mode 100755
index 000000000..04a5344f7
--- /dev/null
+++ b/src/scripts/convert-dns-settings
@@ -0,0 +1,95 @@
+#!/bin/bash
+###############################################################################
+# #
+# IPFire.org - A Linux-based firewall #
+# Copyright (C) 2020 IPFire Team <info(a)ipfire.org> #
+# #
+# This program is free software: you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation, either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# This program is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+# #
+###############################################################################
+
+main() {
+ # Do not convert anything if we already have some servers set
+ if [ ! -s "/var/ipfire/dns/servers" ]; then
+ local DNS0 DNS1 DNS2
+ eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
+
+ if [ -s "/var/ipfire/ppp/settings" ]; then
+ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
+
+ # Remove DNS, DNS1 and DNS2
+ sed -i "/^DNS[12]?=/d" /var/ipfire/ppp/settings
+ elif [ -s "/var/ipfire/dns/settings" ]; then
+ eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
+ fi
+
+ local var
+ local i=3
+ for var in DNS0 DNS1 DNS2; do
+ if [ -n "${!var}" ]; then
+ echo "${i},${!var},,enabled,"
+ (( i++ ))
+ fi
+ done > /var/ipfire/dns/servers
+
+ # Empty the old settings file
+ : > /var/ipfire/dns/settings
+
+ # Disable using ISP name servers when we already have some configured
+ if [ ${i} -gt 3 ]; then
+ echo "USE_ISP_NAMESERVERS=off" \
+ >> /var/ipfire/dns/settings
+ fi
+ fi
+
+ # Set correct ownership.
+ chown nobody:nobody /var/ipfire/dns/settings
+
+ # Convert old unbound settings file
+ if [ -e "/etc/sysconfig/unbound" ]; then
+ local USE_FORWARDERS
+ local ENABLE_SAFE_SEARCH
+ local FORCE_TCP
+
+ # Read settings
+ eval $(/usr/local/bin/readhash /etc/sysconfig/unbound)
+
+ # Safe Search
+ if [ "${ENABLE_SAFE_SEARCH}" = "on" ]; then
+ echo "ENABLE_SAFE_SEARCH=${ENABLE_SAFE_SEARCH}" \
+ >> /var/ipfire/dns/settings
+ fi
+
+ # Force TCP
+ if [ "${FORCE_TCP}" = "on" ]; then
+ echo "PROTO=TCP" >> /var/ipfire/dns/settings
+ fi
+
+ # Run in recursor mode
+ if [ "${USE_FORWARDERS}" = "0" ]; then
+ # Remove all servers
+ : > /var/ipfire/dns/servers
+ fi
+
+ rm -f "/etc/sysconfig/unbound"
+ fi
+
+ # Set correct ownership.
+ chown nobody:nobody /var/ipfire/dns/servers
+
+ # Make DHCP leases readable for nobody
+ chown 644 /etc/unbound/dhcp-leases.conf
+}
+
+main "$@" || exit $?
diff --git a/src/scripts/update-location-database b/src/scripts/update-location-database
new file mode 100644
index 000000000..ebed5a095
--- /dev/null
+++ b/src/scripts/update-location-database
@@ -0,0 +1,45 @@
+#!/bin/bash
+###############################################################################
+# #
+# IPFire.org - A linux based firewall #
+# Copyright (C) 2019 IPFire Development Team <info(a)ipfire.org> #
+# #
+# This program is free software: you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation, either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# This program is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with this program. If not, see <http://www.gnu.org/licenses/>. #
+# #
+###############################################################################
+
+eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings)
+
+# Proxy settings.
+# Check if a proxy should be used.
+if [[ $UPSTREAM_PROXY ]]; then
+ PROXYSETTINGS="https_proxy=http://"
+
+ # Check if authentication against the proxy is configured.
+ if [[ $UPSTREAM_USER && $UPSTREAM_PASSWORD ]]; then
+ PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_USER:$UPSTREAM_PASSWORD@"
+ fi
+
+ # Add proxy server.
+ PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_PROXY"
+
+ # Export proxy settings.
+ export HTTPS_PROXY="$PROXYSETTINGS"
+fi
+
+# Get the latest location database from server.
+/usr/bin/location-downloader update
+
+# Call initscript to reload the firewall.
+/etc/init.d/firewall reload
diff --git a/src/scripts/xt_geoip_update b/src/scripts/xt_geoip_update
deleted file mode 100644
index ebd266533..000000000
--- a/src/scripts/xt_geoip_update
+++ /dev/null
@@ -1,138 +0,0 @@
-#!/bin/bash
-###############################################################################
-# #
-# IPFire.org - A linux based firewall #
-# Copyright (C) 2019 IPFire Development Team <info(a)ipfire.org> #
-# #
-# This program is free software: you can redistribute it and/or modify #
-# it under the terms of the GNU General Public License as published by #
-# the Free Software Foundation, either version 3 of the License, or #
-# (at your option) any later version. #
-# #
-# This program is distributed in the hope that it will be useful, #
-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
-# GNU General Public License for more details. #
-# #
-# You should have received a copy of the GNU General Public License #
-# along with this program. If not, see <http://www.gnu.org/licenses/>. #
-# #
-###############################################################################
-
-TMP_PATH=$(mktemp -dp /var/tmp)
-TMP_FILE=$(mktemp -p $TMP_PATH)
-
-SCRIPT_PATH=/usr/local/bin
-DEST_PATH=/usr/share/xt_geoip
-DB_PATH=/var/lib/GeoIP
-DB1_PATH=/usr/share/GeoIP
-
-DL_URL=https://geolite.maxmind.com/download/geoip/database
-DL_FILE=GeoLite2-Country-CSV.zip
-
-eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings)
-
-function download() {
- echo "Downloading latest GeoIP ruleset..."
-
- # Proxy settings.
- # Check if a proxy should be used.
- if [[ $UPSTREAM_PROXY ]]; then
- PROXYSETTINGS="-e https_proxy=http://"
-
- # Check if authentication against the proxy is configured.
- if [[ $UPSTREAM_USER && $UPSTREAM_PASSWORD ]]; then
- PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_USER:$UPSTREAM_PASSWORD@"
- fi
-
- # Add proxy server.
- PROXYSETTINGS="$PROXYSETTINGS$UPSTREAM_PROXY"
- fi
-
- # Get the latest GeoIP database from server.
- wget $DL_URL/$DL_FILE $PROXYSETTINGS -O $TMP_FILE
-
- # Extract files to database path.
- unzip $TMP_FILE -d $TMP_PATH
-
- return 0
-}
-
-function install() {
- echo "Install CSV database..."
-
- # Check if the database dir exists.
- if [ ! -e "$DB_PATH" ]; then
- mkdir -p $DB_PATH &>/dev/null
- fi
-
- # Check if the directory for binary databases exists.
- if [ ! -e "$DEST_PATH" ]; then
- mkdir -p $DEST_PATH &>/dev/null
- fi
-
- # Install CSV databases.
- if ! cp -af $TMP_PATH/*/* $DB_PATH &>/dev/null; then
- echo "Could not copy files. Aborting." >&2
- return 1
- fi
-
- return 0
-}
-
-function build_legacy() {
- echo "Convert database to legacy GeoIP.dat ..."
- cat $DB_PATH/GeoLite2-Country-Blocks-IPv4.csv | \
- $DB1_PATH/bin/geolite2-to-legacy-csv.sh $DB1_PATH/bin/countryInfo.txt > \
- $TMP_FILE
- $DB1_PATH/bin/geoip-generator -v -4 --info="$(date -u +'GEO-106FREE %Y%m%d Build -IPFire-' \
- -r $DB_PATH/GeoLite2-Country-Blocks-IPv4.csv) $(<$DB_PATH/COPYRIGHT.txt)" -o \
- $DB1_PATH/GeoIP.dat $TMP_FILE
-
- return 0
-}
-
-
-function build() {
- echo "Convert database..."
-
- # Run script to convert the CSV file into several xtables
- # compatible binary files.
- if ! $SCRIPT_PATH/xt_geoip_build -S $DB_PATH -D $DEST_PATH; then
- echo "Could not convert ruleset. Aborting." >&2
- return 1
- fi
-
- return 0
-}
-
-function cleanup() {
- echo "Cleaning up temporary files..."
- if ! rm -rf $TMP_PATH &>/dev/null; then
- echo "Could not remove files. Aborting." >&2
- return 1
- fi
-
- return 0
-}
-
-function main() {
- local func
- for func in download install build build_legacy; do
- if ! ${func}; then
- # Cleanup any temporary data
- cleanup
-
- return 1
- fi
- done
-
- # Cleanup
- cleanup || return $?
-
- # All done
- return 0
-}
-
-# Run the main function.
-main || exit $?
diff --git a/src/setup/networking.c b/src/setup/networking.c
index d6cd30cff..51dc7acb0 100644
--- a/src/setup/networking.c
+++ b/src/setup/networking.c
@@ -14,11 +14,6 @@
#include "setup.h"
-#define DNS1 0
-#define DNS2 1
-#define DEFAULT_GATEWAY 2
-#define DNSGATEWAY_TOTAL 3
-
extern FILE *flog;
extern char *mylog;
@@ -56,7 +51,7 @@ int drivermenu(void);
int changedrivers(void);
int greenaddressmenu(void);
int addressesmenu(void);
-int dnsgatewaymenu(void);
+int gatewaymenu(void);
int handlenetworking(void)
{
@@ -89,7 +84,7 @@ int handlenetworking(void)
break;
case 4:
- dnsgatewaymenu();
+ gatewaymenu();
break;
case 0:
@@ -250,7 +245,7 @@ int firstmenu(void)
_("Network configuration type"),
_("Drivers and card assignments"),
_("Address settings"),
- _("DNS and Gateway settings"),
+ _("Gateway settings"),
NULL
};
int rc;
@@ -708,14 +703,14 @@ int addressesmenu(void)
return 0;
}
-/* DNS and default gateway.... */
-int dnsgatewaymenu(void)
+/* default gateway.... */
+int gatewaymenu(void)
{
struct keyvalue *kv = initkeyvalues();
char message[1000];
char temp[STRING_SIZE] = "0";
- struct newtWinEntry entries[DNSGATEWAY_TOTAL+1];
- char *values[DNSGATEWAY_TOTAL]; /* pointers for the values. */
+ struct newtWinEntry entries[2];
+ char* values[1]; /* pointers for the values. */
int error;
int configtype;
int rc;
@@ -727,92 +722,50 @@ int dnsgatewaymenu(void)
return 0;
}
- entries[DNS1].text = _("Primary DNS:");
- strcpy(temp, ""); findkey(kv, "DNS1", temp);
- values[DNS1] = strdup(temp);
- entries[DNS1].value = &values[DNS1];
- entries[DNS1].flags = 0;
-
- entries[DNS2].text = _("Secondary DNS:");
- strcpy(temp, ""); findkey(kv, "DNS2", temp);
- values[DNS2] = strdup(temp);
- entries[DNS2].value = &values[DNS2];
- entries[DNS2].flags = 0;
-
- entries[DEFAULT_GATEWAY].text = _("Default gateway:");
+ entries[0].text = _("Default gateway:");
strcpy(temp, ""); findkey(kv, "DEFAULT_GATEWAY", temp);
- values[DEFAULT_GATEWAY] = strdup(temp);
- entries[DEFAULT_GATEWAY].value = &values[DEFAULT_GATEWAY];
- entries[DEFAULT_GATEWAY].flags = 0;
+ values[0] = strdup(temp);
+ entries[0].value = &values[0];
+ entries[0].flags = 0;
- entries[DNSGATEWAY_TOTAL].text = NULL;
- entries[DNSGATEWAY_TOTAL].value = NULL;
- entries[DNSGATEWAY_TOTAL].flags = 0;
+ entries[1].text = NULL;
+ entries[1].value = NULL;
+ entries[1].flags = 0;
do
{
error = 0;
- rc = newtWinEntries(_("DNS and Gateway settings"),
- _("Enter the DNS and gateway information. "
- "These settings are used only with Static IP (and DHCP if DNS set) on the RED interface."),
+ rc = newtWinEntries(_("Gateway settings"),
+ _("Enter the gateway information. "
+ "These settings are used only with Static IP on the RED interface."),
50, 5, 5, 18, entries, _("OK"), _("Cancel"), NULL);
if (rc == 0 || rc == 1)
{
- strcpy(message, _("The following fields are invalid:"));
- strcpy(message, "\n\n");
- if (strlen(values[DNS1]))
+ if (strlen(values[0]))
{
- if (inet_addr(values[DNS1]) == INADDR_NONE)
- {
- strcat(message, _("Primary DNS"));
- strcat(message, "\n");
- error = 1;
- }
- }
- if (strlen(values[DNS2]))
- {
- if (inet_addr(values[DNS2]) == INADDR_NONE)
- {
- strcat(message, _("Secondary DNS"));
- strcat(message, "\n");
- error = 1;
- }
- }
- if (strlen(values[DEFAULT_GATEWAY]))
- {
- if (inet_addr(values[DEFAULT_GATEWAY]) == INADDR_NONE)
+ if (inet_addr(values[0]) == INADDR_NONE)
{
strcat(message, _("Default gateway"));
strcat(message, "\n");
error = 1;
}
}
- if (!strlen(values[DNS1]) && strlen(values[DNS2]))
- {
- strcpy(message, _("Secondary DNS specified without a Primary DNS"));
- strcat(message, "\n");
- error = 1;
- }
if (error)
errorbox(message);
else
{
- replacekeyvalue(kv, "DNS1", values[DNS1]);
- replacekeyvalue(kv, "DNS2", values[DNS2]);
- replacekeyvalue(kv, "DEFAULT_GATEWAY", values[DEFAULT_GATEWAY]);
+ replacekeyvalue(kv, "DEFAULT_GATEWAY", values[0]);
netaddresschange = 1;
- free(values[DNS1]);
- free(values[DNS2]);
- free(values[DEFAULT_GATEWAY]);
+ free(values[0]);
writekeyvalues(kv, CONFIG_ROOT "/ethernet/settings");
}
}
}
while (error);
-
+
freekeyvalues(kv);
-
+
return 1;
}
hooks/post-receive
--
IPFire 2.x development tree
1
0
[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 23dc6e0b23dc519b41a26ff25ecf0e221863128f
by Arne Fitzenreiter 13 Jan '20
by Arne Fitzenreiter 13 Jan '20
13 Jan '20
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 23dc6e0b23dc519b41a26ff25ecf0e221863128f (commit)
via 1475bc53a4757af1fca78dcf521dfd5f11d1a819 (commit)
via 97756e21241b2eb6823368b4d3ab2856e18856ca (commit)
via aab6ec606a068f153e1a8cd5920d5c411e018639 (commit)
from eba8e481e1cc0a5bbd61d95f2022735d4e9efab0 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 23dc6e0b23dc519b41a26ff25ecf0e221863128f
Merge: 1475bc53a eba8e481e
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date: Mon Jan 13 21:38:16 2020 +0000
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
commit 1475bc53a4757af1fca78dcf521dfd5f11d1a819
Author: Daniel Weismüller <whytea(a)ipfire.org>
Date: Fri Jan 10 16:06:00 2020 +0100
filesystem-cleanup: Add parameter to show changes
Use --dry-run to only show files that would be deleted, but do
not actually delete them.
Signed-off-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit 97756e21241b2eb6823368b4d3ab2856e18856ca
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Jan 10 11:12:36 2020 +0000
filesystem-cleanup: Automatically remove old libraries
This script runs through /usr/lib and /lib and tries to find
all libraries which are no longer being used and more and
deletes them.
This will help us to free space on root partitions that
are limited to 2GB.
However, the script does not cover 100% of the cases, so that
some files still need to be deleted manually (e.g. boost with
their weird versioning schema).
This script should be executed after a Core Update has been
installed.
Fixes: #12270
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Reviewed-by: Peter Müller <peter.mueller(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
commit aab6ec606a068f153e1a8cd5920d5c411e018639
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Jan 13 21:06:38 2020 +0000
amazon-ssm-agent: Move source to GOPATH
Go won't build when this is only symlinked any more.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/aarch64/stage2 | 1 +
config/rootfiles/common/stage2 | 1 +
config/rootfiles/common/x86_64/stage2 | 1 +
lfs/amazon-ssm-agent | 2 +-
.../enable_codel => src/scripts/filesystem-cleanup | 104 ++++++++++++++-------
5 files changed, 76 insertions(+), 33 deletions(-)
copy config/udev/enable_codel => src/scripts/filesystem-cleanup (52%)
Difference in files:
diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2
index 366ab2bb0..2d9a70f81 100644
--- a/config/rootfiles/common/aarch64/stage2
+++ b/config/rootfiles/common/aarch64/stage2
@@ -92,6 +92,7 @@ usr/local/bin/backupiso
usr/local/bin/connscheduler
usr/local/bin/consort.sh
usr/local/bin/convert-ovpn
+usr/local/bin/filesystem-cleanup
usr/local/bin/hddshutdown
usr/local/bin/ipsec-interfaces
usr/local/bin/makegraphs
diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2
index d9068415b..b0680914e 100644
--- a/config/rootfiles/common/stage2
+++ b/config/rootfiles/common/stage2
@@ -91,6 +91,7 @@ usr/local/bin/backupiso
usr/local/bin/connscheduler
usr/local/bin/consort.sh
usr/local/bin/convert-ovpn
+usr/local/bin/filesystem-cleanup
usr/local/bin/hddshutdown
usr/local/bin/ipsec-interfaces
usr/local/bin/makegraphs
diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2
index d90e3d70a..9d3334e69 100644
--- a/config/rootfiles/common/x86_64/stage2
+++ b/config/rootfiles/common/x86_64/stage2
@@ -93,6 +93,7 @@ usr/local/bin/backupiso
usr/local/bin/connscheduler
usr/local/bin/consort.sh
usr/local/bin/convert-ovpn
+usr/local/bin/filesystem-cleanup
usr/local/bin/hddshutdown
usr/local/bin/ipsec-interfaces
usr/local/bin/makegraphs
diff --git a/lfs/amazon-ssm-agent b/lfs/amazon-ssm-agent
index b477690a4..a41dc08bb 100644
--- a/lfs/amazon-ssm-agent
+++ b/lfs/amazon-ssm-agent
@@ -83,7 +83,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
# The build system is searching for code in a certain path
mkdir -pv $$(dirname $(DIR_BUILD))
- ln -svf --relative $(DIR_APP) $(DIR_BUILD)
+ mv -v $(DIR_APP) $(DIR_BUILD)
# Disable style check
cd $(DIR_BUILD) && sed -e "/checkstyle.sh/d" -i makefile
diff --git a/src/scripts/filesystem-cleanup b/src/scripts/filesystem-cleanup
new file mode 100644
index 000000000..7e7accc7a
--- /dev/null
+++ b/src/scripts/filesystem-cleanup
@@ -0,0 +1,97 @@
+#!/bin/bash
+############################################################################
+# #
+# This file is part of the IPFire Firewall. #
+# #
+# IPFire is free software; you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation; either version 2 of the License, or #
+# (at your option) any later version. #
+# #
+# IPFire is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with IPFire; if not, write to the Free Software #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
+# #
+# Copyright (C) 2020 IPFire Team <info(a)ipfire.org>. #
+# #
+############################################################################
+
+PATHS=(
+ /usr/lib
+ /lib
+)
+
+main() {
+ local dry_run="false"
+
+ while [ $# -gt 0 ]; do
+ case "${1}" in
+ --dry-run)
+ dry_run="true"
+ ;;
+
+ *)
+ echo "${0}: Invalid argument: ${1}" >&2
+ return 2
+ ;;
+ esac
+ shift
+ done
+
+ # Update the runtime linker cache (this may fix any broken symlinks)
+ ldconfig
+
+ local path
+ for path in ${PATHS[@]}; do
+ echo "Searching in ${path}..."
+
+ # Find all files called libsomething.so.N
+ local lib
+ for lib in $(find "${path}" -maxdepth 1 -type l -name "lib*.so.*" | sort); do
+ # Read the name of the linked library
+ local link="$(readlink -m "${lib}")"
+
+ # We have two versioning schemas that we need to distinguish...
+ local files=()
+ case "${link}" in
+ # Libraries called libsomething-N.so
+ */lib*-*.so)
+ files+=( ${link%-*}-* )
+ ;;
+
+ # Libraries called libsomething.so.N.*
+ *)
+ files+=( ${lib}* )
+ ;;
+ esac
+
+ # Remove all files that have the same base name than
+ # the library we are looking at, apart from the symlink
+ # and the linked file itself.
+ local file
+ for file in ${files[@]}; do
+ case "${file}" in
+ # Ignore these files
+ ${lib}|${link})
+ ;;
+
+ *)
+ echo "Removing ${file}..."
+
+ # Actually remove the file (maybe)
+ if [ "${dry_run}" = "false" ]; then
+ unlink "${file}"
+ fi
+ ;;
+ esac
+ done
+ done
+ done
+}
+
+main "$@" || exit $?
hooks/post-receive
--
IPFire 2.x development tree
1
0