[git.ipfire.org] IPFire 2.x development tree branch, master, updated. b7c958992df0b2e9275c4df42133e2ebd50e1b8b - IPFire-SCM

9 Apr 2023

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
       via  b7c958992df0b2e9275c4df42133e2ebd50e1b8b (commit)
       via  ca06e817b84b8bb737b2811bdc5ad43d034e2c48 (commit)
       via  65df34a6f60714706cc48386c3ed60ee6e100cf3 (commit)
       via  a201764e756895ed5fc23028863ba3b0e8bb406d (commit)
       via  d3a520fa68d2d0198ddca827a96a4e2cbb595d8a (commit)
       via  7970d3937287171035336bd63ee28d0cd1c82d62 (commit)
       via  41d3d33dde1312d6e1556d3279d9c09d925b7452 (commit)
       via  a84b9ed2feb926681ad94273d8c2efc5d7b71b4f (commit)
      from  11f4726b0d72b6a4a0799bb4548e9ce93bf16911 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit b7c958992df0b2e9275c4df42133e2ebd50e1b8b
Author: Peter Müller peter.mueller@ipfire.org
Date:   Fri Apr 7 14:37:05 2023 +0000
Core Update 174: Ship parse-func.pl
Signed-off-by: Peter Müller peter.mueller@ipfire.org
commit ca06e817b84b8bb737b2811bdc5ad43d034e2c48
Author: Peter Müller peter.mueller@ipfire.org
Date:   Fri Apr 7 14:35:11 2023 +0000
parse-func.pl: Adjust regular expression to changed 'tc' output
It is not clear at all why they choose to change the tool's output this
    way in upstream commit 010a8388aea11e767ba3a2506728b9ad9760df0e, but
    we'll have to make do with this.
Fixes: #13075
    Signed-off-by: Peter Müller peter.mueller@ipfire.org
commit 65df34a6f60714706cc48386c3ed60ee6e100cf3
Author: Peter Müller peter.mueller@ipfire.org
Date:   Tue Apr 4 21:12:39 2023 +0000
Do not mark migrate.pl as executable in Git
Signed-off-by: Peter Müller peter.mueller@ipfire.org
commit a201764e756895ed5fc23028863ba3b0e8bb406d
Author: Peter Müller peter.mueller@ipfire.org
Date:   Tue Apr 4 20:25:55 2023 +0000
ovpnmain.cgi: Do not determine certificate expiry status for N2N connections
https://wiki.ipfire.org/devel/telco/2023-04-03
Fixes: #13066
    Signed-off-by: Peter Müller peter.mueller@ipfire.org
commit d3a520fa68d2d0198ddca827a96a4e2cbb595d8a
Author: Peter Müller peter.mueller@ipfire.org
Date:   Tue Apr 4 20:04:11 2023 +0000
Revert "e2fsprogs: Update to version 1.47.0"
This reverts commit 1f3f26702144ef600eb7937c4ab78e4833e6636f.
Symlink will remain in place to ensure the reverted version is always
    shipped to our users, including those that have installed Core Update
    174 (testing).
Fixes: #13073
    Reported-by: Arne Fitzenreiter arne.fitzenreiter@ipfire.org
    Signed-off-by: Peter Müller peter.mueller@ipfire.org
commit 7970d3937287171035336bd63ee28d0cd1c82d62
Author: Peter Müller peter.mueller@ipfire.org
Date:   Tue Apr 4 20:02:58 2023 +0000
Core Update 174: Ship ipblocklist-related changes
https://wiki.ipfire.org/devel/telco/2023-04-03
Cc: Stefan Schantl stefan.schantl@ipfire.org
    Signed-off-by: Peter Müller peter.mueller@ipfire.org
commit 41d3d33dde1312d6e1556d3279d9c09d925b7452
Author: Stefan Schantl stefan.schantl@ipfire.org
Date:   Tue Mar 28 18:05:42 2023 +0200
update-ipblocklists: Fix loading new blocklists after update
* The script needs to run with root permissions in order to
      do the ipset operations. So remove code to drop the permissions
      on startup.
* Adjust execute calls to use the proper functions from
      general functions.
* Add some code to set the correct ownership (nobody:nobody) for
      changed files during script runtime.
Fixes #13072.
Signed-off-by: Stefan Schantl stefan.schantl@ipfire.org
commit a84b9ed2feb926681ad94273d8c2efc5d7b71b4f
Author: Adolf Belka adolf.belka@ipfire.org
Date:   Thu Mar 16 11:34:03 2023 +0100
header.pl: Add reference to colors.txt into header.pl
- With change of common css entries into header.pl with commit
       https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=b52a84ddc77f9db7e4ad7b12...
       I had missed that color20 and color22 etc, that come from colors.txt, are not known in
       header.pl so that the alternate colours in tables were missing. Even though I tested the
       previous commit I obviously did not look well enough because I missed that the tables
       had no alternate colours. I just found it now when looking at Core Update 174 Testing.
    - Confirmed by copying this version of header.pl into my CU174 Testing system and the
       alternate colour rows came back again as they should be. I am sure now that they are
       correct.
Tested-by: Adolf Belka adolf.belka@ipfire.org
    Signed-off-by: Adolf Belka adolf.belka@ipfire.org
    Reviewed-by: Bernhard Bitsch bbitsch@ipfire.org
    Tested-by: Bernhard Bitsch bbitsch@ipfire.org
-----------------------------------------------------------------------
Summary of changes:
 config/cfgroot/header.pl                  |  3 +++
 config/cfgroot/ipblocklist-functions.pl   | 27 +++++++++++++++++++
 config/qos/migrate.pl                     |  0
 config/qos/parse-func.pl                  | 10 +++----
 config/rootfiles/core/174/filelists/files |  3 +++
 config/rootfiles/core/174/update.sh       |  3 +++
 html/cgi-bin/ovpnmain.cgi                 | 43 +++++++++++++++++++------------
 lfs/e2fsprogs                             |  4 +--
 src/scripts/update-ipblocklists           | 28 +++++++++-----------
 9 files changed, 82 insertions(+), 39 deletions(-)
 mode change 100755 => 100644 config/qos/migrate.pl
Difference in files:

diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl
index 955ed2646..3f80ce9b4 100644
--- a/config/cfgroot/header.pl
+++ b/config/cfgroot/header.pl
@@ -17,6 +17,9 @@ use HTML::Entities();
 use Socket;
 use Time::Local;
+our %color = ();
+&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", %color);
+
 $|=1; # line buffering
$Header::revision = 'final';
diff --git a/config/cfgroot/ipblocklist-functions.pl b/config/cfgroot/ipblocklist-functions.pl
index ecabf42e8..bd026a01d 100644
--- a/config/cfgroot/ipblocklist-functions.pl
+++ b/config/cfgroot/ipblocklist-functions.pl
@@ -383,4 +383,31 @@ sub get_holdoff_rate($) {
    return $value;
 }
+#
+## sub set_ownership(file)
+##
+## Function to set the correct ownership (nobody:nobody) to a given file.
+##
+#
+sub set_ownership($) {
+	my ($file) = @_;
+
+	# User and group of the WUI.
+	my $uname = "nobody";
+	my $grname = "nobody";
+
+	# The chown function implemented in perl requies the user and group as nummeric id's.
+	my $uid = getpwnam($uname);
+	my $gid = getgrnam($grname);
+
+	# Check if the given file exists.
+	unless ($file) {
+		# Stop the script and print error message.
+		die "The given $file does not exist. Cannot change the ownership!\n";
+	}
+
+	# Change ownership of the file.
+	chown($uid, $gid, "$file");
+}
+
 1;
diff --git a/config/qos/migrate.pl b/config/qos/migrate.pl
old mode 100755
new mode 100644
diff --git a/config/qos/parse-func.pl b/config/qos/parse-func.pl
index 991757f92..04ca85b7f 100644
--- a/config/qos/parse-func.pl
+++ b/config/qos/parse-func.pl
@@ -46,24 +46,24 @@ class htb 1:10 parent 1:1 prio 0 rate 80Kbit ceil 320Kbit burst 1701b cburst 200
  lended: 230876 borrowed: 17112 giants: 0
  tokens: 127200 ctokens: 37940
-class htb 1:20 parent 1:1 leaf 4220: prio 1 rate 100Kbit ceil 200Kbit burst 1727b cburst 1855b 
+class htb 1:20 parent 1:1 leaf 4220prio 1 rate 100Kbit ceil 200Kbit burst 1727b cburst 1855b 
  Sent 2495181573 bytes 44034303 pkts (dropped 5837, overlimits 0) 
  lended: 43825585 borrowed: 208718 giants: 0
  tokens: 103424 ctokens: 55808
-class htb 1:30 parent 1:1 leaf 4230: prio 3 rate 80Kbit ceil 400Kbit burst 1701b cburst 2111b 
+class htb 1:30 parent 1:1 leaf 4230prio 3 rate 80Kbit ceil 400Kbit burst 1701b cburst 2111b 
  Sent 2060213567 bytes 5465574 pkts (dropped 121, overlimits 0) 
  rate 16851bps 35pps 
  lended: 4556992 borrowed: 908582 giants: 0
  tokens: -25364 ctokens: 32897
-class htb 1:50 parent 1:1 leaf 4250: prio 5 rate 40Kbit ceil 120Kbit burst 1650b cburst 1752b 
+class htb 1:50 parent 1:1 leaf 4250prio 5 rate 40Kbit ceil 120Kbit burst 1650b cburst 1752b 
  Sent 6071486687 bytes 24448436 pkts (dropped 8086739, overlimits 0) 
  rate 15801bps 85pps backlog 126p 
  lended: 8324530 borrowed: 16123780 giants: 0
  tokens: -202717 ctokens: -172499
-class htb 1:666 parent 1:1 leaf 666: prio 7 rate 4Kbit ceil 40Kbit burst 1604b cburst 1650b 
+class htb 1:666 parent 1:1 leaf 666prio 7 rate 4Kbit ceil 40Kbit burst 1604b cburst 1650b 
  Sent 2148626078 bytes 6771069 pkts (dropped 2078536, overlimits 0) 
  rate 5221bps 17pps backlog 125p 
  lended: 675330 borrowed: 6095613 giants: 0
@@ -94,7 +94,7 @@ sub parse_class($) {
    my $line=$tc_output[$i];
    # Parsing HTB:
    # ------------
-	if ( $line =~ m/class htb (\d+):(\d+)( root| parent )?(\d+:\d+)?( leaf )?(\d+)?:?( prio )?(\d+)? rate (.*) ceil (.*) burst (.*) cburst (.*)/ ) {
+	if ( $line =~ m/class htb (\d+):(\d+)( root| parent )?(\d+:\d+)?( leaf )?(\d+)?(prio )?(\d+)? rate (.*) ceil (.*) burst (.*) cburst (.*)/ ) {
        my $type  = "htb";
        my $major = $1;
        my $minor = $2;
diff --git a/config/rootfiles/core/174/filelists/files b/config/rootfiles/core/174/filelists/files
index 8b7058f81..53b01dca6 100644
--- a/config/rootfiles/core/174/filelists/files
+++ b/config/rootfiles/core/174/filelists/files
@@ -92,7 +92,10 @@ srv/web/ipfire/cgi-bin/proxy.cgi
 srv/web/ipfire/cgi-bin/traffic.cgi
 srv/web/ipfire/cgi-bin/updatexlrator.cgi
 usr/lib/firewall/rules.pl
+usr/local/bin/update-ipblocklists
 var/ipfire/graphs.pl
 var/ipfire/header.pl
 var/ipfire/ids-functions.pl
+var/ipfire/ipblocklist-functions.pl
 var/ipfire/network-functions.pl
+var/ipfire/qos/bin/parse-func.pl
diff --git a/config/rootfiles/core/174/update.sh b/config/rootfiles/core/174/update.sh
index 7acaad64e..25474a7b2 100644
--- a/config/rootfiles/core/174/update.sh
+++ b/config/rootfiles/core/174/update.sh
@@ -184,6 +184,9 @@ if [ -e "/opt/pakfire/db/installed/meta-perl-TimeDate" ] && [ -e "/opt/pakfire/d
    	/opt/pakfire/db/rootfiles/perl-TimeDate
 fi
+# Update IP blocklists to resolve fallout of #13072 as quickly as possible
+/usr/local/bin/update-location-database
+
 # This update needs a reboot...
 touch /var/run/need_reboot
diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 87bda4f1e..51d6e8431 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2022  IPFire Team  info@ipfire.org                     #
+# Copyright (C) 2007-2023  IPFire Team  info@ipfire.org                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -5354,26 +5354,37 @@ END
    	}
    if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
-	# Fetch information about the certificate
-	my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text",
-		"-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
+	# Create some simple booleans to check the status
+	my $hasExpired;
+	my $expiresSoon;
-	my $expiryDate = 0;
+	# Fetch information about the certificate for non-N2N connections only
+	if ($confighash{$key}[3] ne 'net') {
+		my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text",
+			"-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
-	# Parse the certificate information
-	foreach my $line (@cavalid) {
-		if ($line =~ /Not After : (.*)[\n]/) {
-			$expiryDate = &Date::Parse::str2time($1);
-			last;
+		my $expiryDate = 0;
+
+		# Parse the certificate information
+		foreach my $line (@cavalid) {
+			if ($line =~ /Not After : (.*)[\n]/) {
+				$expiryDate = &Date::Parse::str2time($1);
+				last;
+			}
    	}
-	}
-	# Calculate the remaining time
-	my $remainingTime = $expiryDate - time();
+		# Calculate the remaining time
+		my $remainingTime = $expiryDate - time();
-	# Create some simple booleans to check the status
-	my $hasExpired = ($remainingTime <= 0);
-	my $expiresSoon = ($remainingTime <= 30 * 24 * 3600);
+		# Determine whether the certificate has already expired, or will so soon
+		$hasExpired = ($remainingTime <= 0);
+		$expiresSoon = ($remainingTime <= 30 * 24 * 3600);
+
+	} else {
+		# Populate booleans with dummy values for N2N connections (#13066)
+		$hasExpired = 0;
+		$expiresSoon = 0;
+	}
print "<tr>";
diff --git a/lfs/e2fsprogs b/lfs/e2fsprogs
index 8db1c215c..4758b5401 100644
--- a/lfs/e2fsprogs
+++ b/lfs/e2fsprogs
@@ -24,7 +24,7 @@
include Config
-VER      = 1.47.0
+VER      = 1.46.5
THISAPP    = e2fsprogs-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 84f58b05a9f0e14e1a66c6e5171ff23b022f51c4e9a02d4d6d1d26c91909f3c7ec9c9f0462663a4457b4479043774502b8891f691e58a61f4ef6bf9ba33f33aa
+$(DL_FILE)_BLAKE2 = 8d8c02e891c464782a7cff518c41d793fc73366b57e17d80ffc5afd96e6144e354290e667e9710509a9dde4e5dab7e7185c5bf084c5bfd26219f05e5e92e0830
install : $(TARGET)
diff --git a/src/scripts/update-ipblocklists b/src/scripts/update-ipblocklists
index 9918cac41..a17b47999 100644
--- a/src/scripts/update-ipblocklists
+++ b/src/scripts/update-ipblocklists
@@ -32,19 +32,6 @@ require "${General::swroot}/lang.pl";
 # Hash to store the settings.
 my %settings = ();
-# The user and group name as which this script should be run.
-my $run_as = 'nobody';
-
-# Get user and group id of the user.
-my ( $uid, $gid ) = ( getpwnam $run_as )[ 2, 3 ];
-
-# Check if the script currently runs as root.
-if ( $> == 0 ) {
-	# Drop privileges and switch to the specified user and group.
-	POSIX::setgid( $gid );
-	POSIX::setuid( $uid );
-}
-
 # Establish the connection to the syslog service.
 openlog('ipblocklist', 'cons', 'user');
@@ -122,6 +109,12 @@ foreach my $blocklist (@blocklists) {
    		&_log_to_syslog("<ERROR> Could not update $blocklist blocklist - Unexpected error!");
    	}
    } else {
+		# Get the filename of the blocklist.
+		my $ipset_db_file = &IPblocklist::get_ipset_db_file($blocklist);
+
+		# Set the correct ownership.
+		&IPblocklist::set_ownership($ipset_db_file);
+
    	# Log successfull update.
    	&_log_to_syslog("<INFO> Successfully updated $blocklist blocklist.");
@@ -132,22 +125,25 @@ foreach my $blocklist (@blocklists) {
# Check if a blocklist has been updated and therefore needs to be reloaded.
 if (@updated_blocklists) {
+	# Set correct ownership to the modified file.
+	&IPblocklist::set_ownership($IPblocklist::modified_file);
+
    # Loop through the array.
    foreach my $updated_blocklist (@updated_blocklists) {
    	# Get the blocklist file.
    	my $ipset_db_file = &IPblocklist::get_ipset_db_file($updated_blocklist);
# Call safe system function to reload/update the blocklist.
-		&General::system("ipset", "restore", "-f", "$ipset_db_file");
+		&General::safe_system("ipset", "restore", "-f", "$ipset_db_file");
# The set name contains a "v4" as suffix.
    	my $set_name = "$updated_blocklist" . "v4";
# Swap the sets to use the new one.
-		&General::system("ipset", "swap", "$set_name", "$updated_blocklist");
+		&General::safe_system("ipset", "swap", "$set_name", "$updated_blocklist");
# Destroy the old blocklist.
-		&General::system("ipset", "destroy", "$set_name");
+		&General::safe_system("ipset", "destroy", "$set_name");
    }
 }
hooks/post-receive
--
IPFire 2.x development tree

    