IPFire-SCM March 2020

ipfire-scm@lists.ipfire.org

1 participants
44 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 3c90dd92a5c23afe5216e91d57b19d1563adb2aa
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 3c90dd92a5c23afe5216e91d57b19d1563adb2aa (commit) from 0c466599d059d273a1d2d3d2255a421c1a09be34 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3c90dd92a5c23afe5216e91d57b19d1563adb2aa Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 19:13:08 2020 +0000 core143: add dma, mail.cgi and vpnmain.cgi Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/101 => core/143}/filelists/dma | 0 config/rootfiles/core/143/filelists/files | 2 ++ 2 files changed, 2 insertions(+) copy config/rootfiles/{oldcore/101 => core/143}/filelists/dma (100%) Difference in files: diff --git a/config/rootfiles/core/143/filelists/dma b/config/rootfiles/core/143/filelists/dma new file mode 120000 index 000000000..60f4682da --- /dev/null +++ b/config/rootfiles/core/143/filelists/dma @@ -0,0 +1 @@ +../../../common/dma \ No newline at end of file diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index 4f8f7cddf..216c98fa9 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -6,8 +6,10 @@ etc/rc.d/init.d/firewall etc/rc.d/init.d/localnet srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/fireinfo.cgi +srv/web/ipfire/cgi-bin/mail.cgi srv/web/ipfire/cgi-bin/netother.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi +srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/firewall/rules.pl var/ipfire/backup/bin/backup.pl var/ipfire/suricata/oinkmaster.conf hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0c466599d059d273a1d2d3d2255a421c1a09be34
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0c466599d059d273a1d2d3d2255a421c1a09be34 (commit) via 229a6dffd72cd526ccb13cbb1365c5c4adcb9f0c (commit) from 81ebfac70d723cfabe214a0791d1d028da61102a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0c466599d059d273a1d2d3d2255a421c1a09be34 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Mar 30 17:24:42 2020 +0000 amazon-ssm-agent: Allow to overcommit memory Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 229a6dffd72cd526ccb13cbb1365c5c4adcb9f0c Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Mar 30 17:24:41 2020 +0000 amazon-ssm-agent: Update to 2.3.930.0 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/amazon-ssm-agent | 10 +++++++--- src/initscripts/packages/amazon-ssm-agent | 6 ++++++ 2 files changed, 13 insertions(+), 3 deletions(-) Difference in files: diff --git a/lfs/amazon-ssm-agent b/lfs/amazon-ssm-agent index 44a91f4ac..4b08bd41d 100644 --- a/lfs/amazon-ssm-agent +++ b/lfs/amazon-ssm-agent @@ -24,7 +24,7 @@ include Config -VER = 2.3.786.0 +VER = 2.3.930.0 SUP_ARCH = x86_64 THISAPP = amazon-ssm-agent-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = amazon-ssm-agent -PAK_VER = 1 +PAK_VER = 3 DEPS = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = a2887445875d335b021c5044eab955dc +$(DL_FILE)_MD5 = cf7c50976e2853764d308581f94cbdd1 install : $(TARGET) @@ -88,6 +88,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Disable style check cd $(DIR_BUILD) && sed -e "/checkstyle.sh/d" -i makefile + # agent/plugins/inventory/gatherers/application/dataProvider.go:10:78: error: imported and not used: localpackages + cd $(DIR_BUILD) && sed -e "/localpackages/d" \ + -i agent/plugins/inventory/gatherers/application/dataProvider.go + # Build cd $(DIR_BUILD) && make build-linux diff --git a/src/initscripts/packages/amazon-ssm-agent b/src/initscripts/packages/amazon-ssm-agent index c385d890c..eeaa7b7e5 100644 --- a/src/initscripts/packages/amazon-ssm-agent +++ b/src/initscripts/packages/amazon-ssm-agent @@ -13,6 +13,12 @@ case "${1}" in exit 0 fi + # Allow the kernel to overcommit memory. + # The SSM agent fails to clone() itself when there is + # "not enough memory" available. This simply seems to + # fail no matter how much free memory is available. + echo 1 > /proc/sys/vm/overcommit_memory + boot_mesg "Starting Amazon SSM Agent..." /usr/bin/amazon-ssm-agent &>/dev/null & evaluate_retval hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 81ebfac70d723cfabe214a0791d1d028da61102a
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 81ebfac70d723cfabe214a0791d1d028da61102a (commit) from 610108ffbd0ac539b6c43f1deb8d41e4b2053bef (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 81ebfac70d723cfabe214a0791d1d028da61102a Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 17:25:08 2020 +0000 vpnmain.cgi: fix string Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/vpnmain.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index bfa60d27d..e0f2c7a5e 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -2385,7 +2385,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || goto ADVANCED_ERROR; } if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 24) { - $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'}; + $errormessage = $Lang::tr{'ike lifetime should be between 1 and 24 hours'}; goto ADVANCED_ERROR; } @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'}); hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 610108ffbd0ac539b6c43f1deb8d41e4b2053bef
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 610108ffbd0ac539b6c43f1deb8d41e4b2053bef (commit) from 37533b0deabab9f1e44ac8d710c9cd6f1e4570f7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 610108ffbd0ac539b6c43f1deb8d41e4b2053bef Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Mar 10 13:37:18 2020 +0000 Fix accidentially reverted IKE lifetime limit to 24 hours Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/vpnmain.cgi | 2 +- langs/de/cgi-bin/de.pl | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) Difference in files: diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 43cdc5aa0..bfa60d27d 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -2384,7 +2384,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || $errormessage = $Lang::tr{'invalid input for ike lifetime'}; goto ADVANCED_ERROR; } - if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) { + if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 24) { $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'}; goto ADVANCED_ERROR; } diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index fb676b868..c3702cc09 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1398,7 +1398,6 @@ 'ike integrity' => 'IKE-Integrität:', 'ike lifetime' => 'IKE-Lebensdauer:', 'ike lifetime should be between 1 and 24 hours' => 'IKE Lebensdauer sollte zwischen 1 und 24 Stunden betragen.', -'ike lifetime should be between 1 and 8 hours' => 'Die IKE-Laufzeit sollte zwischen einer und acht Stunden betragen', 'imei' => 'IMEI', 'import' => 'Import', 'importkey' => 'PSK importieren', hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 37533b0deabab9f1e44ac8d710c9cd6f1e4570f7
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 37533b0deabab9f1e44ac8d710c9cd6f1e4570f7 (commit) via 29a8992b7228771fb2cfc68679596598fb01105a (commit) from 6075720c481ee58367d06088c18739e26b768201 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 37533b0deabab9f1e44ac8d710c9cd6f1e4570f7 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 17:09:34 2020 +0000 core143: apply changed sysctl settings Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 29a8992b7228771fb2cfc68679596598fb01105a Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Thu Jan 23 21:28:00 2020 +0000 sysctl.conf: Turn on hard- and symlink protection Cc: Michael Tremer <michael.tremer(a)ipfire.org> Cc: Arne Fitzenreiter <arne_f(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Acked-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/etc/sysctl.conf | 4 ++++ config/rootfiles/core/143/update.sh | 3 +++ 2 files changed, 7 insertions(+) Difference in files: diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index d11e53c88..7e7ebee44 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -45,6 +45,10 @@ kernel.kptr_restrict = 2 # Avoid kernel memory address exposures via dmesg. kernel.dmesg_restrict = 1 +# Turn on hard- and symlink protection +fs.protected_symlinks = 1 +fs.protected_hardlinks = 1 + # Minimal preemption granularity for CPU-bound tasks: # (default: 1 msec# (1 + ilog(ncpus)), units: nanoseconds) kernel.sched_min_granularity_ns = 10000000 diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index bc28f7de7..51c4557bd 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -68,6 +68,9 @@ chown cron:cron /var/spool/cron # restart init after glibc replace telinit u +# Apply changed sysctl settings +/etc/init.d/sysctl start + # Apply local configuration to sshd_config /usr/local/bin/sshctrl hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6075720c481ee58367d06088c18739e26b768201
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 6075720c481ee58367d06088c18739e26b768201 (commit) via d07286de4633212dea8cf21253314d007ac36825 (commit) via 59b2a70f7a483b4b63ff7d33fba42bb6eb35eda6 (commit) via 2d599cca34e8228b1cfa639ea9ddbabf51498361 (commit) via 1d84b352dfc6275dfefb8645b54ed2f0fa350524 (commit) via 2480c416d61a21320e7728786310028cee75c3b0 (commit) via e4a0b558815c07f934c135374cd077c2c0fabf0a (commit) via 8f4ed62fa87ef4d1125cc2326a6461c8b0ba018f (commit) via fa4dbe2745d2f7b025c524003adeb9be6f039c78 (commit) from 5192ceae53acc7549e78942254d48fcb5b464270 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6075720c481ee58367d06088c18739e26b768201 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Feb 3 18:35:00 2020 +0000 update language files for mail.cgi changes Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit d07286de4633212dea8cf21253314d007ac36825 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Feb 3 18:35:00 2020 +0000 mail.cgi: add support for implicit TLS usage The second version of this patchset fixes reading empty configuration files and superseds the first version (duh!). Fixes #12161 Reported-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Tested-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 59b2a70f7a483b4b63ff7d33fba42bb6eb35eda6 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 1 20:26:00 2020 +0000 dma: update to 0.12 All of the dma patches in src/patches/ were merged into its upstream repository by now, thus becoming obsolete and deleted by this patch. Cc: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 2d599cca34e8228b1cfa639ea9ddbabf51498361 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 16:43:50 2020 +0000 core143: add oinkmaster.conf Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 1d84b352dfc6275dfefb8645b54ed2f0fa350524 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 30 13:58:16 2020 +0100 oinkmaster: Do not skip threshold.conf Fixes #12096. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 2480c416d61a21320e7728786310028cee75c3b0 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 16:39:06 2020 +0000 core143: set user of /var/spool/cron to cron Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit e4a0b558815c07f934c135374cd077c2c0fabf0a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 5 11:23:34 2020 +0000 fcron: Fix reloading crontab fcrontab -z fails on a freshly installed system since /var/spool/cron is now owned by cron:cron and a temporary file cannot be created. This will have to be manually changed in the updater by calling: chown cron:cron /var/spool/cron Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 8f4ed62fa87ef4d1125cc2326a6461c8b0ba018f Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Mar 21 19:40:00 2020 +0000 spectre-meltdown-checker: update to 0.43 Please refer to https://github.com/speed47/spectre-meltdown-checker/releases/tag/v0.43 for release notes. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit fa4dbe2745d2f7b025c524003adeb9be6f039c78 Author: Erik Kapfer <ummeegge(a)ipfire.org> Date: Sat Mar 28 09:32:24 2020 +0100 OpenVPN: Delete RRD dir if connection is deleted Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> Reviewed-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/oinkmaster/oinkmaster.conf | 2 +- config/rootfiles/common/fcron | 2 +- config/rootfiles/core/143/filelists/files | 1 + config/rootfiles/core/143/update.sh | 3 + html/cgi-bin/mail.cgi | 20 +- html/cgi-bin/ovpnmain.cgi | 2 +- langs/de/cgi-bin/de.pl | 6 +- langs/en/cgi-bin/en.pl | 4 +- lfs/dma | 9 +- lfs/spectre-meltdown-checker | 8 +- src/patches/dma-0.10-better-authentication.patch | 373 ----------------------- src/patches/dma-0.10-better-tls.patch | 26 -- src/patches/dma-0.11-compile-fixes.patch | 29 -- 13 files changed, 34 insertions(+), 451 deletions(-) delete mode 100644 src/patches/dma-0.10-better-authentication.patch delete mode 100644 src/patches/dma-0.10-better-tls.patch delete mode 100644 src/patches/dma-0.11-compile-fixes.patch Difference in files: diff --git a/config/oinkmaster/oinkmaster.conf b/config/oinkmaster/oinkmaster.conf index a04e32987..57c328139 100644 --- a/config/oinkmaster/oinkmaster.conf +++ b/config/oinkmaster/oinkmaster.conf @@ -222,7 +222,7 @@ skipfile deleted.rules # local thresholding/suppressing in some local file and still update # and use the official one though, in case important stuff is added to # it some day. We do update it by default, but it's your call. -# skipfile threshold.conf +skipfile threshold.conf # If you update from multiple URLs at the same time you may need to # ignore the sid-msg.map (and generate it yourself if you need one) as diff --git a/config/rootfiles/common/fcron b/config/rootfiles/common/fcron index d37541b95..fb4410f4d 100644 --- a/config/rootfiles/common/fcron +++ b/config/rootfiles/common/fcron @@ -93,6 +93,6 @@ usr/sbin/fcron #usr/share/man/man5/fcron.conf.5 #usr/share/man/man5/fcrontab.5 #usr/share/man/man8/fcron.8 -#var/spool/cron +var/spool/cron var/spool/cron/new.root var/spool/cron/root.orig diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index c82f67734..4f8f7cddf 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -10,3 +10,4 @@ srv/web/ipfire/cgi-bin/netother.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi usr/lib/firewall/rules.pl var/ipfire/backup/bin/backup.pl +var/ipfire/suricata/oinkmaster.conf diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index cb7f57914..bc28f7de7 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -62,6 +62,9 @@ ldconfig # remove wrong vnstat tag file rm -f /var/log/vnstat/tag +# set /var/spool/cron to cron user +chown cron:cron /var/spool/cron + # restart init after glibc replace telinit u diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi index 25589046e..7865a1da6 100755 --- a/html/cgi-bin/mail.cgi +++ b/html/cgi-bin/mail.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2015 IPFire Team <alexander.marx(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -110,8 +110,8 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite $dma{'SMARTHOST'} = $cgiparams{'txt_mailserver'}; $dma{'PORT'} = $cgiparams{'txt_mailport'}; - $dma{'STARTTLS'} = '' if ($cgiparams{'mail_tls'}); - $dma{'SECURETRANSFER'} = '' if exists $dma{'STARTTLS'}; + $dma{'STARTTLS'} = '' if ($cgiparams{'mail_tls'} eq 'explicit'); + $dma{'SECURETRANSFER'} = '' if ($cgiparams{'mail_tls'} eq 'explicit' || $cgiparams{'mail_tls'} eq 'implicit'); $dma{'SPOOLDIR'} = "/var/spool/dma"; $dma{'FULLBOUNCE'} = ''; $dma{'MAILNAME'} = "$mainsettings{'HOSTNAME'}.$mainsettings{DOMAINNAME}"; @@ -140,8 +140,6 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'email testmail'}"){ #Testmail button on #FUNCTIONS sub configsite{ - - #If update set fieldvalues new if($cgiparams{'update'} eq 'on'){ $mail{'USEMAIL'} = 'on'; @@ -156,7 +154,9 @@ sub configsite{ } #find preselections $checked{'usemail'}{$mail{'USEMAIL'}} = 'CHECKED'; - $checked{'mail_tls'}{'on'} = 'CHECKED' if exists $dma{'STARTTLS'}; + $selected{'mail_tls'}{'explicit'} = 'selected' if exists $dma{'STARTTLS'}; + $selected{'mail_tls'}{'implicit'} = 'selected' if (exists $dma{'SECURETRANSFER'}) and (not exists $dma{'STARTTLS'}); + $selected{'mail_tls'}{'disabled'} = 'selected' if (not exists $dma{'SECURETRANSFER'}) and (not exists $dma{'STARTTLS'}); #Open site &Header::openpage($Lang::tr{'email settings'}, 1, ''); @@ -226,7 +226,13 @@ END </tr> <tr> <td>$Lang::tr{'email tls'}</td> - <td><input type='checkbox' name='mail_tls' $checked{'mail_tls'}{'on'}></td> + <td> + <select name='mail_tls'> + <option value='implicit' $selected{'mail_tls'}{'implicit'}>$Lang::tr{'email tls implicit'}</option> + <option value='explicit' $selected{'mail_tls'}{'explicit'}>$Lang::tr{'email tls explicit'}</option> + <option value='disabled' $selected{'mail_tls'}{'disabled'}>$Lang::tr{'disabled'}</option> + </select> + </td> </tr> END if (! -z $dmafile && $mail{'USEMAIL'} eq 'on' && !$errormessage){ diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index ce9524df7..00ecd77a0 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2513,7 +2513,7 @@ else # CCD end # Update collectd configuration and delete all RRD files of the removed connection &writecollectdconf(); - system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]"); + system ('/usr/local/bin/openvpnctrl', '-drrd', $confighash{$cgiparams{'KEY'}}[1]); delete $confighash{$cgiparams{'KEY'}}; my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index be6daa3ea..fb676b868 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -953,8 +953,10 @@ 'email subject' => 'IPFire Test-E-Mail', 'email success' => 'Test-E-Mail erfolgreich versendet', 'email testmail' => 'Testnachricht senden', -'email text' => 'Testnachricht vom IPFire Mailversand.', -'email tls' => 'TLS aktivieren', +'email text' => 'Testnachricht vom IPFire-Mailversandsystem.', +'email tls' => 'Transportverschlüsselungsmodus', +'email tls explicit' => 'explizit (STARTTLS)', +'email tls implicit' => 'implizit (TLS)', 'email usemail' => 'Mailversand aktivieren', 'emailreportlevel' => 'E-Mail-Reportlevel', 'emerging pro rules' => 'Emergingthreats.net Pro-Regelsatz', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 1e1aed53c..3f3e46641 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -975,7 +975,9 @@ 'email success' => 'Test message successfully sent', 'email testmail' => 'Send test mail', 'email text' => 'Test mail from IPFire Mail Service', -'email tls' => 'Use TLS', +'email tls' => 'TLS mode', +'email tls explicit' => 'explicit (STARTTLS)', +'email tls implicit' => 'implicit (TLS)', 'email usemail' => 'Activate Mail Service', 'emailreportlevel' => 'E-mailreportlevel', 'emerging pro rules' => 'Emergingthreats.net Pro Rules', diff --git a/lfs/dma b/lfs/dma index 2b89bcc6e..aceb2704e 100644 --- a/lfs/dma +++ b/lfs/dma @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.11 +VER = 0.12 THISAPP = dma-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4090572921fc33be0977f4010881b501 +$(DL_FILE)_MD5 = 58cb2a286995381c92dc557e639622d6 install : $(TARGET) @@ -73,9 +73,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) mkdir -pv /var/ipfire/dma touch /var/ipfire/dma/mail.conf - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.10-better-authentication.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.10-better-tls.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.11-compile-fixes.patch cd $(DIR_APP) && sed -i '/PREFIX/s/usr\/local/usr/g' Makefile cd $(DIR_APP) && sed -i '/CONFDIR/s/etc\/dma/var\/ipfire\/dma/g' Makefile cd $(DIR_APP) && make diff --git a/lfs/spectre-meltdown-checker b/lfs/spectre-meltdown-checker index c05c5fead..2bf34f590 100644 --- a/lfs/spectre-meltdown-checker +++ b/lfs/spectre-meltdown-checker @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.42 +VER = 0.43 THISAPP = spectre-meltdown-checker-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = spectre-meltdown-checker -PAK_VER = 3 +PAK_VER = 4 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c8aca684284d604adb67cb6d9d07ce70 +$(DL_FILE)_MD5 = 05cd2e53edbdcccfc072a66fafa4ea38 install : $(TARGET) diff --git a/src/patches/dma-0.10-better-authentication.patch b/src/patches/dma-0.10-better-authentication.patch deleted file mode 100644 index 596168d2a..000000000 --- a/src/patches/dma-0.10-better-authentication.patch +++ /dev/null @@ -1,373 +0,0 @@ -From 1fa7a882dd22d5f619b3645c6597a419034e9b4e Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Mon, 9 Nov 2015 21:52:08 +0000 -Subject: [PATCH] Implement better authentication - -DMA tries to authenticate by simply trying various authentication -mechanisms. This is obviously not conforming to RFC and some mail -providers detect this is spam and reject all emails. - -This patch parses the EHLO response and reads various keywords -from it that can then later in the program be used to jump into -certain code paths. - -Currently this is used to only authenticate with CRAM-MD5 and/or -LOGIN if the server supports one or both of these. The -implementation can be easily be extended though. - -Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ---- - crypto.c | 6 +- - dma.h | 13 +++- - net.c | 219 +++++++++++++++++++++++++++++++++++++++++++++++---------------- - 3 files changed, 181 insertions(+), 57 deletions(-) - -diff --git a/crypto.c b/crypto.c -index 897b55b..8048f20 100644 ---- a/crypto.c -+++ b/crypto.c -@@ -77,7 +77,7 @@ init_cert_file(SSL_CTX *ctx, const char *path) - } - - int --smtp_init_crypto(int fd, int feature) -+smtp_init_crypto(int fd, int feature, struct smtp_features* features) - { - SSL_CTX *ctx = NULL; - #if (OPENSSL_VERSION_NUMBER >= 0x00909000L) -@@ -118,8 +118,7 @@ smtp_init_crypto(int fd, int feature) - /* TLS init phase, disable SSL_write */ - config.features |= NOSSL; - -- send_remote_command(fd, "EHLO %s", hostname()); -- if (read_remote(fd, 0, NULL) == 2) { -+ if (perform_server_greeting(fd, features) == 0) { - send_remote_command(fd, "STARTTLS"); - if (read_remote(fd, 0, NULL) != 2) { - if ((feature & TLS_OPP) == 0) { -@@ -131,6 +130,7 @@ smtp_init_crypto(int fd, int feature) - } - } - } -+ - /* End of TLS init phase, enable SSL_write/read */ - config.features &= ~NOSSL; - } -diff --git a/dma.h b/dma.h -index acf5e44..ee749d8 100644 ---- a/dma.h -+++ b/dma.h -@@ -51,6 +51,7 @@ - #define BUF_SIZE 2048 - #define ERRMSG_SIZE 200 - #define USERNAME_SIZE 50 -+#define EHLO_RESPONSE_SIZE BUF_SIZE - #define MIN_RETRY 300 /* 5 minutes */ - #define MAX_RETRY (3*60*60) /* retry at least every 3 hours */ - #define MAX_TIMEOUT (5*24*60*60) /* give up after 5 days */ -@@ -160,6 +161,15 @@ struct mx_hostentry { - struct sockaddr_storage sa; - }; - -+struct smtp_auth_mechanisms { -+ int cram_md5; -+ int login; -+}; -+ -+struct smtp_features { -+ struct smtp_auth_mechanisms auth; -+ int starttls; -+}; - - /* global variables */ - extern struct aliases aliases; -@@ -187,7 +197,7 @@ void parse_authfile(const char *); - /* crypto.c */ - void hmac_md5(unsigned char *, int, unsigned char *, int, unsigned char *); - int smtp_auth_md5(int, char *, char *); --int smtp_init_crypto(int, int); -+int smtp_init_crypto(int, int, struct smtp_features*); - - /* dns.c */ - int dns_get_mx_list(const char *, int, struct mx_hostentry **, int); -@@ -196,6 +206,7 @@ int dns_get_mx_list(const char *, int, struct mx_hostentry **, int); - char *ssl_errstr(void); - int read_remote(int, int, char *); - ssize_t send_remote_command(int, const char*, ...) __attribute__((__nonnull__(2), __format__ (__printf__, 2, 3))); -+int perform_server_greeting(int, struct smtp_features*); - int deliver_remote(struct qitem *); - - /* base64.c */ -diff --git a/net.c b/net.c -index 26935a8..33ff8f5 100644 ---- a/net.c -+++ b/net.c -@@ -247,64 +247,70 @@ read_remote(int fd, int extbufsize, char *extbuf) - * Handle SMTP authentication - */ - static int --smtp_login(int fd, char *login, char* password) -+smtp_login(int fd, char *login, char* password, const struct smtp_features* features) - { - char *temp; - int len, res = 0; - -- res = smtp_auth_md5(fd, login, password); -- if (res == 0) { -- return (0); -- } else if (res == -2) { -- /* -- * If the return code is -2, then then the login attempt failed, -- * do not try other login mechanisms -- */ -- return (1); -- } -- -- if ((config.features & INSECURE) != 0 || -- (config.features & SECURETRANS) != 0) { -- /* Send AUTH command according to RFC 2554 */ -- send_remote_command(fd, "AUTH LOGIN"); -- if (read_remote(fd, 0, NULL) != 3) { -- syslog(LOG_NOTICE, "remote delivery deferred:" -- " AUTH login not available: %s", -- neterr); -+ // CRAM-MD5 -+ if (features->auth.cram_md5) { -+ res = smtp_auth_md5(fd, login, password); -+ if (res == 0) { -+ return (0); -+ } else if (res == -2) { -+ /* -+ * If the return code is -2, then then the login attempt failed, -+ * do not try other login mechanisms -+ */ - return (1); - } -+ } - -- len = base64_encode(login, strlen(login), &temp); -- if (len < 0) { -+ // LOGIN -+ if (features->auth.login) { -+ if ((config.features & INSECURE) != 0 || -+ (config.features & SECURETRANS) != 0) { -+ /* Send AUTH command according to RFC 2554 */ -+ send_remote_command(fd, "AUTH LOGIN"); -+ if (read_remote(fd, 0, NULL) != 3) { -+ syslog(LOG_NOTICE, "remote delivery deferred:" -+ " AUTH login not available: %s", -+ neterr); -+ return (1); -+ } -+ -+ len = base64_encode(login, strlen(login), &temp); -+ if (len < 0) { - encerr: -- syslog(LOG_ERR, "can not encode auth reply: %m"); -- return (1); -- } -+ syslog(LOG_ERR, "can not encode auth reply: %m"); -+ return (1); -+ } - -- send_remote_command(fd, "%s", temp); -- free(temp); -- res = read_remote(fd, 0, NULL); -- if (res != 3) { -- syslog(LOG_NOTICE, "remote delivery %s: AUTH login failed: %s", -- res == 5 ? "failed" : "deferred", neterr); -- return (res == 5 ? -1 : 1); -- } -+ send_remote_command(fd, "%s", temp); -+ free(temp); -+ res = read_remote(fd, 0, NULL); -+ if (res != 3) { -+ syslog(LOG_NOTICE, "remote delivery %s: AUTH login failed: %s", -+ res == 5 ? "failed" : "deferred", neterr); -+ return (res == 5 ? -1 : 1); -+ } - -- len = base64_encode(password, strlen(password), &temp); -- if (len < 0) -- goto encerr; -- -- send_remote_command(fd, "%s", temp); -- free(temp); -- res = read_remote(fd, 0, NULL); -- if (res != 2) { -- syslog(LOG_NOTICE, "remote delivery %s: Authentication failed: %s", -- res == 5 ? "failed" : "deferred", neterr); -- return (res == 5 ? -1 : 1); -+ len = base64_encode(password, strlen(password), &temp); -+ if (len < 0) -+ goto encerr; -+ -+ send_remote_command(fd, "%s", temp); -+ free(temp); -+ res = read_remote(fd, 0, NULL); -+ if (res != 2) { -+ syslog(LOG_NOTICE, "remote delivery %s: Authentication failed: %s", -+ res == 5 ? "failed" : "deferred", neterr); -+ return (res == 5 ? -1 : 1); -+ } -+ } else { -+ syslog(LOG_WARNING, "non-encrypted SMTP login is disabled in config, so skipping it. "); -+ return (1); - } -- } else { -- syslog(LOG_WARNING, "non-encrypted SMTP login is disabled in config, so skipping it. "); -- return (1); - } - - return (0); -@@ -348,10 +354,115 @@ close_connection(int fd) - close(fd); - } - -+static void parse_auth_line(char* line, struct smtp_auth_mechanisms* auth) { -+ // Skip the auth prefix -+ line += strlen("AUTH "); -+ -+ char* method = strtok(line, " "); -+ while (method) { -+ if (strcmp(method, "CRAM-MD5") == 0) -+ auth->cram_md5 = 1; -+ -+ else if (strcmp(method, "LOGIN") == 0) -+ auth->login = 1; -+ -+ method = strtok(NULL, " "); -+ } -+} -+ -+int perform_server_greeting(int fd, struct smtp_features* features) { -+ /* -+ Send EHLO -+ XXX allow HELO fallback -+ */ -+ send_remote_command(fd, "EHLO %s", hostname()); -+ -+ char buffer[EHLO_RESPONSE_SIZE]; -+ memset(buffer, 0, sizeof(buffer)); -+ -+ int res = read_remote(fd, sizeof(buffer) - 1, buffer); -+ -+ // Got an unexpected response -+ if (res != 2) -+ return -1; -+ -+ // Reset all features -+ memset(features, 0, sizeof(*features)); -+ -+ // Run through the buffer line by line -+ char linebuffer[EHLO_RESPONSE_SIZE]; -+ char* p = buffer; -+ -+ while (*p) { -+ char* line = linebuffer; -+ while (*p && *p != '\n') { -+ *line++ = *p++; -+ } -+ -+ // p should never point to NULL after the loop -+ // above unless we reached the end of the buffer. -+ // In that case we will raise an error. -+ if (!*p) { -+ return -1; -+ } -+ -+ // Otherwise p points to the newline character which -+ // we will skip. -+ p++; -+ -+ // Terminte the string (and remove the carriage-return character) -+ *--line = '\0'; -+ line = linebuffer; -+ -+ // End main loop for empty lines -+ if (*line == '\0') -+ break; -+ -+ // Process the line -+ // - Must start with 250, followed by dash or space -+ // - We won't check for the correct usage of space and dash because -+ // that is already done in read_remote(). -+ if ((strncmp(line, "250-", 4) != 0) && (strncmp(line, "250 ", 4) != 0)) { -+ syslog(LOG_ERR, "Invalid line: %s\n", line); -+ return -1; -+ } -+ -+ // Skip the prefix -+ line += 4; -+ -+ // Check for STARTTLS -+ if (strcmp(line, "STARTTLS") == 0) -+ features->starttls = 1; -+ -+ // Parse authentication mechanisms -+ else if (strncmp(line, "AUTH ", 5) == 0) -+ parse_auth_line(line, &features->auth); -+ } -+ -+ syslog(LOG_DEBUG, "Server greeting successfully completed"); -+ -+ // STARTTLS -+ if (features->starttls) -+ syslog(LOG_DEBUG, " Server supports STARTTLS"); -+ else -+ syslog(LOG_DEBUG, " Server does not support STARTTLS"); -+ -+ // Authentication -+ if (features->auth.cram_md5) { -+ syslog(LOG_DEBUG, " Server supports CRAM-MD5 authentication"); -+ } -+ if (features->auth.login) { -+ syslog(LOG_DEBUG, " Server supports LOGIN authentication"); -+ } -+ -+ return 0; -+} -+ - static int - deliver_to_host(struct qitem *it, struct mx_hostentry *host) - { - struct authuser *a; -+ struct smtp_features features; - char line[1000]; - size_t linelen; - int fd, error = 0, do_auth = 0, res = 0; -@@ -389,7 +500,7 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - } - - if ((config.features & SECURETRANS) != 0) { -- error = smtp_init_crypto(fd, config.features); -+ error = smtp_init_crypto(fd, config.features, &features); - if (error == 0) - syslog(LOG_DEBUG, "SSL initialization successful"); - else -@@ -399,10 +510,12 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - READ_REMOTE_CHECK("connect", 2); - } - -- /* XXX allow HELO fallback */ -- /* XXX record ESMTP keywords */ -- send_remote_command(fd, "EHLO %s", hostname()); -- READ_REMOTE_CHECK("EHLO", 2); -+ // Say EHLO -+ if (perform_server_greeting(fd, &features) != 0) { -+ syslog(LOG_ERR, "Could not perform server greeting at %s [%s]: %s", -+ host->host, host->addr, neterr); -+ return -1; -+ } - - /* - * Use SMTP authentication if the user defined an entry for the remote -@@ -421,7 +534,7 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - * encryption. - */ - syslog(LOG_INFO, "using SMTP authentication for user %s", a->login); -- error = smtp_login(fd, a->login, a->password); -+ error = smtp_login(fd, a->login, a->password, &features); - if (error < 0) { - syslog(LOG_ERR, "remote delivery failed:" - " SMTP login failed: %m"); diff --git a/src/patches/dma-0.10-better-tls.patch b/src/patches/dma-0.10-better-tls.patch deleted file mode 100644 index 8f60fdd04..000000000 --- a/src/patches/dma-0.10-better-tls.patch +++ /dev/null @@ -1,26 +0,0 @@ -commit e94f50bbbe7318eec5b6b165ff73d94bbc9d20b0 -Author: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sun Feb 11 11:05:43 2018 +0000 - - crypto: Don't limit to TLSv1 only - - Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> - -diff --git a/crypto.c b/crypto.c -index 897b55bfdcfc..440c882880b5 100644 ---- a/crypto.c -+++ b/crypto.c -@@ -93,7 +93,12 @@ smtp_init_crypto(int fd, int feature) - SSL_library_init(); - SSL_load_error_strings(); - -- meth = TLSv1_client_method(); -+ // Allow any possible version -+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) -+ meth = TLS_client_method(); -+#else -+ meth = SSLv23_client_method(); -+#endif - - ctx = SSL_CTX_new(meth); - if (ctx == NULL) { diff --git a/src/patches/dma-0.11-compile-fixes.patch b/src/patches/dma-0.11-compile-fixes.patch deleted file mode 100644 index a6e5165c9..000000000 --- a/src/patches/dma-0.11-compile-fixes.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 60cf6f03a4b13ec0e491a282ab5233a1619a7a66 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Tue, 24 Apr 2018 12:30:13 +0100 -Subject: [PATCH] net.c: Include string.h - -Various functions that have been used come from string.h. GCC compiled -dma without this header, but unfortunately the binary segfaulted at random -times. - -Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ---- - net.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net.c b/net.c -index a1cc3e3bfd79..221dda131a23 100644 ---- a/net.c -+++ b/net.c -@@ -53,6 +53,7 @@ - #include <netdb.h> - #include <setjmp.h> - #include <signal.h> -+#include <string.h> - #include <syslog.h> - #include <unistd.h> - --- -2.14.3 - hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5192ceae53acc7549e78942254d48fcb5b464270
by Arne Fitzenreiter 29 Mar '20

29 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 5192ceae53acc7549e78942254d48fcb5b464270 (commit) via 54e6ded41782f444b501161b404cb41acc5c2e00 (commit) via 454c77d4c48192184c52dca34e4b4e58c3449741 (commit) from 41ac6f547e06ded7339c1530d02c0893e94feb8a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5192ceae53acc7549e78942254d48fcb5b464270 Merge: 54e6ded41 41ac6f547 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 29 06:35:21 2020 +0000 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next commit 54e6ded41782f444b501161b404cb41acc5c2e00 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 29 06:34:18 2020 +0000 smartmontools: update rootfile Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 454c77d4c48192184c52dca34e4b4e58c3449741 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Mar 25 12:33:49 2020 +0100 bind: Update to 9.11.17 For details see: https://downloads.isc.org/isc/bind9/9.11.17/RELEASE-NOTES-bind-9.11.17.html "Notes for BIND 9.11.17 Feature Changes The configure option --with-libxml2 now uses pkg-config to detect libxml2 library availability. You will either have to install pkg-config or specify the exact path where libxml2 has been installed on your system. [GL #1635] Bug Fixes Fixed re-signing issues with inline zones which resulted in records being re-signed late or not at all." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/bind | 11 ++++++----- config/rootfiles/common/smartmontools | 6 +----- lfs/bind | 6 +++--- 3 files changed, 10 insertions(+), 13 deletions(-) Difference in files: diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index df6bbf4b6..3a306bf9e 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -198,6 +198,7 @@ usr/bin/nsupdate #usr/include/isc/socket.h #usr/include/isc/stat.h #usr/include/isc/stats.h +#usr/include/isc/stdatomic.h #usr/include/isc/stdio.h #usr/include/isc/stdlib.h #usr/include/isc/stdtime.h @@ -271,12 +272,12 @@ usr/lib/libbind9.so.161 usr/lib/libbind9.so.161.0.4 #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libdns.so.1107 -usr/lib/libdns.so.1107.1.0 +usr/lib/libdns.so.1110 +usr/lib/libdns.so.1110.0.0 #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisc.so.1104 -usr/lib/libisc.so.1104.0.0 +usr/lib/libisc.so.1105 +usr/lib/libisc.so.1105.0.1 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 @@ -284,7 +285,7 @@ usr/lib/libisccc.so.161.0.1 #usr/lib/libisccfg.la #usr/lib/libisccfg.so usr/lib/libisccfg.so.163 -usr/lib/libisccfg.so.163.0.4 +usr/lib/libisccfg.so.163.0.6 #usr/lib/liblwres.la #usr/lib/liblwres.so usr/lib/liblwres.so.161 diff --git a/config/rootfiles/common/smartmontools b/config/rootfiles/common/smartmontools index 9f03226be..6b3f923b1 100644 --- a/config/rootfiles/common/smartmontools +++ b/config/rootfiles/common/smartmontools @@ -1,7 +1,3 @@ -#usr/etc -#usr/etc/rc.d -#usr/etc/rc.d/init.d -#usr/etc/rc.d/init.d/smartd #usr/etc/smartd.conf #usr/etc/smartd_warning.d #usr/etc/smartd_warning.sh @@ -12,7 +8,7 @@ usr/sbin/update-smart-drivedb #usr/share/doc/smartmontools/AUTHORS #usr/share/doc/smartmontools/COPYING #usr/share/doc/smartmontools/ChangeLog -#usr/share/doc/smartmontools/ChangeLog-5.0-6.0 +#usr/share/doc/smartmontools/ChangeLog-6.0-7.0 #usr/share/doc/smartmontools/INSTALL #usr/share/doc/smartmontools/NEWS #usr/share/doc/smartmontools/README diff --git a/lfs/bind b/lfs/bind index 6bb23a143..80207f4dc 100644 --- a/lfs/bind +++ b/lfs/bind @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 9.11.13 +VER = 9.11.17 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 17de0d024ab1eac377f1c2854dc25057 +$(DL_FILE)_MD5 = ceab137e8e7ce3b356be95f505abf737 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 41ac6f547e06ded7339c1530d02c0893e94feb8a
by Arne Fitzenreiter 28 Mar '20

28 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 41ac6f547e06ded7339c1530d02c0893e94feb8a (commit) via 1b8a5da550a8918832064067ef157b4cd8b20ddc (commit) from 0b1f09d581cb93f316e00f5983c27275ab681ff1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 41ac6f547e06ded7339c1530d02c0893e94feb8a Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 28 09:42:20 2020 +0100 Revert "core143: add dhcp" This reverts commit 804deb1b23f24daa35d0cf052d8d0eac82c3319f. commit 1b8a5da550a8918832064067ef157b4cd8b20ddc Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 28 09:40:21 2020 +0100 Revert "dhcp: Update to 4.4.2" dhcp 4.4.2 internally includes bind 9.11.14 this version not work on arm 32bit. This reverts commit 417fd66045433d8101c11bea669e14a39af4db13. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/143/filelists/dhcp | 1 - lfs/dhcp | 6 +++--- 2 files changed, 3 insertions(+), 4 deletions(-) delete mode 120000 config/rootfiles/core/143/filelists/dhcp Difference in files: diff --git a/config/rootfiles/core/143/filelists/dhcp b/config/rootfiles/core/143/filelists/dhcp deleted file mode 120000 index 32d8da443..000000000 --- a/config/rootfiles/core/143/filelists/dhcp +++ /dev/null @@ -1 +0,0 @@ -../../../common/dhcp \ No newline at end of file diff --git a/lfs/dhcp b/lfs/dhcp index 8c64ae899..4c01428f5 100644 --- a/lfs/dhcp +++ b/lfs/dhcp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.4.2 +VER = 4.4.1 THISAPP = dhcp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2afdaf8498dc1edaf3012efdd589b3e1 +$(DL_FILE)_MD5 = 18c7f4dcbb0a63df25098216d47b1ede install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0b1f09d581cb93f316e00f5983c27275ab681ff1
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0b1f09d581cb93f316e00f5983c27275ab681ff1 (commit) from 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0b1f09d581cb93f316e00f5983c27275ab681ff1 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 18:26:07 2020 +0000 core143: update local openssh config Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/143/update.sh | 3 +++ 1 file changed, 3 insertions(+) Difference in files: diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index 90d3f72fc..cb7f57914 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -65,6 +65,9 @@ rm -f /var/log/vnstat/tag # restart init after glibc replace telinit u +# Apply local configuration to sshd_config +/usr/local/bin/sshctrl + # remove dropped packages for package in bluetooth; do if [ -e /opt/pakfire/db/installed/meta-$package ]; then hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6 (commit) from 5562f26f6979c2d60202eafe32469989c0878f20 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 18:03:19 2020 +0000 core143: add backup.pl Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/143/filelists/files | 1 + 1 file changed, 1 insertion(+) Difference in files: diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index b571b41bd..c82f67734 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -9,3 +9,4 @@ srv/web/ipfire/cgi-bin/fireinfo.cgi srv/web/ipfire/cgi-bin/netother.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi usr/lib/firewall/rules.pl +var/ipfire/backup/bin/backup.pl hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM March 2020