* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. d71bcfce59ceac8c5cb9d96ef33de10742d161aa
@ 2014-09-26 11:14 git
0 siblings, 0 replies; only message in thread
From: git @ 2014-09-26 11:14 UTC (permalink / raw)
To: ipfire-scm
[-- Attachment #1: Type: text/plain, Size: 91202 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via d71bcfce59ceac8c5cb9d96ef33de10742d161aa (commit)
via 21df0788abbb174bb675c5ade256f86f6427d6a0 (commit)
via 7e09a94a8109be124f1e172999da06e478b15eed (commit)
via 60bce6ba6a70bf6b6683b8125aa86384c9ef5c4e (commit)
via 2acc3cd9e72789df0b05904559a73e98d9f840d2 (commit)
via b14e0f7d0eb0c833f2287e2a092b59667c878a91 (commit)
via 82f8d118b731a6bcd619c4a0e6bb55a27b47eb93 (commit)
via df6649b0feb13d5a08bdcff7bb1eb65b538b23ca (commit)
via b30890aa068415f5c47ee76d90b19753f0ee1da5 (commit)
via b7784e38bdca9a8377ffd3e7e990592510f13a35 (commit)
via 2a3506f3493a38609e787c9cf20718d233812584 (commit)
via d6796d144a772c40a4e6a82d6b9d1db8299fac6e (commit)
via 61466ab18dff0dc9809578f2e5d810a6a16d9aa4 (commit)
via cea3c8cf53ce5f23d737cfbd3c781c76edde3dd5 (commit)
via d8cc44393847801d8516ae026656ad29a4453437 (commit)
via ca4259a75817c7568f801c6c9535a2a2a60a8850 (commit)
via 5751876534a53176db3b537bca34bdfc096d948a (commit)
via d2793ea80576ac5200f62c911b9492a5c102a81b (commit)
via d8deec0b4fac7b97b7b6f3f944b7f874c997db2f (commit)
via 79ad6f7e539e82ba3dc51ca025ffcb7267f7c51f (commit)
via 3928f52b397bc5c2d8c10d401bbd1258fc826df3 (commit)
via 48f07c195761d0c7129b6beb314c339ba7164eaf (commit)
from 7a35d102cb321598a0bb9568dfc446a6362de7f8 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit d71bcfce59ceac8c5cb9d96ef33de10742d161aa
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Wed Sep 17 15:52:45 2014 +0200
squid-accounting: set right permissions of html directory for graphs and logo
commit 21df0788abbb174bb675c5ade256f86f6427d6a0
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 13:03:48 2014 +0200
core84: Add changed files from #10620
commit 7e09a94a8109be124f1e172999da06e478b15eed
Merge: 60bce6b ca4259a
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 13:03:22 2014 +0200
Merge remote-tracking branch 'amarx/BUG10620' into next
commit 60bce6ba6a70bf6b6683b8125aa86384c9ef5c4e
Merge: 2acc3cd 5751876
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 13:02:28 2014 +0200
Merge remote-tracking branch 'amarx/BUG10615' into next
commit 2acc3cd9e72789df0b05904559a73e98d9f840d2
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 13:00:38 2014 +0200
core84: Add changed files from fw-checksubnet branch
commit b14e0f7d0eb0c833f2287e2a092b59667c878a91
Merge: 82f8d11 d8cc443
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 12:59:26 2014 +0200
Merge remote-tracking branch 'amarx/fw-checksubnet' into next
commit 82f8d118b731a6bcd619c4a0e6bb55a27b47eb93
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 12:58:13 2014 +0200
core84: Add changed files from the firewall-dnat branch
commit df6649b0feb13d5a08bdcff7bb1eb65b538b23ca
Merge: b30890a 48f07c1
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 12:55:55 2014 +0200
Merge remote-tracking branch 'amarx/firewall-dnat' into next
Conflicts:
config/firewall/rules.pl
commit b30890aa068415f5c47ee76d90b19753f0ee1da5
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 12:42:27 2014 +0200
bash: Import upstream patches for CVE-2014-6271 and CVE-2014-7169
commit b7784e38bdca9a8377ffd3e7e990592510f13a35
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 12:25:48 2014 +0200
core84: Add dnsmasq update
commit 2a3506f3493a38609e787c9cf20718d233812584
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 12:24:16 2014 +0200
Create core update 84
commit d6796d144a772c40a4e6a82d6b9d1db8299fac6e
Merge: 7a35d10 61466ab
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Sep 26 12:21:18 2014 +0200
Merge branch 'master' into next
commit d8cc44393847801d8516ae026656ad29a4453437
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Fri Sep 5 08:12:44 2014 +0200
fw-groups: fix language strings
commit ca4259a75817c7568f801c6c9535a2a2a60a8850
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Thu Sep 11 17:13:07 2014 +0200
BUG10620: reload firewall.local in rules.pl, no longer in initscript
commit 5751876534a53176db3b537bca34bdfc096d948a
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Thu Sep 11 15:10:48 2014 +0200
BUG10615: fix wrong values in firewall.cgi
commit d2793ea80576ac5200f62c911b9492a5c102a81b
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Thu Sep 11 14:01:28 2014 +0200
BUG10615 part3: adapt rules.pl to use connectionlimit and ratelimit
commit d8deec0b4fac7b97b7b6f3f944b7f874c997db2f
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Thu Sep 11 13:59:54 2014 +0200
BUG10615 part2: Add ratelimit to firewallgui
commit 79ad6f7e539e82ba3dc51ca025ffcb7267f7c51f
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Thu Sep 11 10:59:25 2014 +0200
BUG10615 part1: Add connectionlimit to firewallgui
commit 3928f52b397bc5c2d8c10d401bbd1258fc826df3
Author: Alexander Marx <amarx(a)ipfire.org>
Date: Fri Sep 5 08:09:54 2014 +0200
fw-groups: cleanup checksubnets
Now the checksubnets function from general-functions.pl is used.
commit 48f07c195761d0c7129b6beb314c339ba7164eaf
Author: Alexander Marx <alexander.marx(a)ipfire.org>
Date: Fri Jul 18 08:44:45 2014 +0200
Firewall: make DNAT only accessible from selected source network
We added RED to the standard networks and now portforwardings are only
useable from the selected source. If selected "all" the portforwarding
can be used from any internal network. Else the access is only grnated
from the selected source network.
-----------------------------------------------------------------------
Summary of changes:
config/firewall/firewall-lib.pl | 53 ++++++---
config/firewall/rules.pl | 55 ++++++++-
config/rootfiles/core/{83 => 84}/exclude | 0
config/rootfiles/core/{83 => 84}/filelists/bash | 0
.../{oldcore/32 => core/84}/filelists/dnsmasq | 0
config/rootfiles/core/84/filelists/files | 8 ++
config/rootfiles/core/{83 => 84}/meta | 0
config/rootfiles/core/{83 => 84}/update.sh | 4 +-
.../{core => oldcore}/82/filelists/iputils | 0
.../{core => oldcore}/82/filelists/openssl-compat | 0
config/rootfiles/{core => oldcore}/83/exclude | 0
.../rootfiles/{core => oldcore}/83/filelists/bash | 0
.../rootfiles/{core => oldcore}/83/filelists/files | 0
.../{core => oldcore}/83/filelists/findutils | 0
.../rootfiles/{core => oldcore}/83/filelists/squid | 0
config/rootfiles/{core => oldcore}/83/meta | 0
config/rootfiles/{core => oldcore}/83/update.sh | 3 +
html/cgi-bin/firewall.cgi | 126 ++++++++++++++++++---
html/cgi-bin/fwhosts.cgi | 49 +++-----
langs/de/cgi-bin/de.pl | 8 +-
langs/en/cgi-bin/en.pl | 8 +-
lfs/bash | 4 +-
lfs/squid-accounting | 2 +-
make.sh | 4 +-
src/initscripts/init.d/firewall | 14 ---
src/paks/squid-accounting/install.sh | 3 +
src/patches/bash-3.2-CVE-2014-7169.patch | 11 --
.../bash32-052} | 32 ++++++
src/patches/bash/bash32-053 | 54 +++++++++
29 files changed, 332 insertions(+), 106 deletions(-)
copy config/rootfiles/core/{83 => 84}/exclude (100%)
copy config/rootfiles/core/{83 => 84}/filelists/bash (100%)
copy config/rootfiles/{oldcore/32 => core/84}/filelists/dnsmasq (100%)
create mode 100644 config/rootfiles/core/84/filelists/files
copy config/rootfiles/core/{83 => 84}/meta (100%)
copy config/rootfiles/core/{83 => 84}/update.sh (97%)
rename config/rootfiles/{core => oldcore}/82/filelists/iputils (100%)
rename config/rootfiles/{core => oldcore}/82/filelists/openssl-compat (100%)
rename config/rootfiles/{core => oldcore}/83/exclude (100%)
rename config/rootfiles/{core => oldcore}/83/filelists/bash (100%)
rename config/rootfiles/{core => oldcore}/83/filelists/files (100%)
rename config/rootfiles/{core => oldcore}/83/filelists/findutils (100%)
rename config/rootfiles/{core => oldcore}/83/filelists/squid (100%)
rename config/rootfiles/{core => oldcore}/83/meta (100%)
rename config/rootfiles/{core => oldcore}/83/update.sh (97%)
delete mode 100644 src/patches/bash-3.2-CVE-2014-7169.patch
rename src/patches/{bash-3.2-CVE-2014-6271.patch => bash/bash32-052} (75%)
create mode 100644 src/patches/bash/bash32-053
Difference in files:
diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl
index c4a19e5..9b3f2bf 100755
--- a/config/firewall/firewall-lib.pl
+++ b/config/firewall/firewall-lib.pl
@@ -217,7 +217,7 @@ sub get_std_net_ip
}elsif($val eq 'BLUE'){
return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
}elsif($val eq 'RED'){
- return "0.0.0.0/0 -o $con";
+ return "0.0.0.0/0";
}elsif($val =~ /OpenVPN/i){
return "$ovpnsettings{'DOVPN_SUBNET'}";
}elsif($val =~ /IPsec/i){
@@ -226,6 +226,23 @@ sub get_std_net_ip
return ;
}
}
+sub get_interface
+{
+ my $net=shift;
+ if($net eq "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}"){
+ return "$netsettings{'GREEN_DEV'}";
+ }
+ if($net eq "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}"){
+ return "$netsettings{'ORANGE_DEV'}";
+ }
+ if($net eq "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}"){
+ return "$netsettings{'BLUE_DEV'}";
+ }
+ if($net eq "0.0.0.0/0"){
+ return "$netsettings{'RED_DEV'}";
+ }
+ return "";
+}
sub get_net_ip
{
my $val=shift;
@@ -305,9 +322,9 @@ sub get_address
# address. Otherwise, we assume that it is an IP address.
if ($key ~~ ["src_addr", "tgt_addr"]) {
if (&General::validmac($value)) {
- push(@ret, "-m mac --mac-source $value");
+ push(@ret, ["-m mac --mac-source $value", ""]);
} else {
- push(@ret, $value);
+ push(@ret, [$value, ""]);
}
# If a default network interface (GREEN, BLUE, etc.) is selected, we
@@ -316,88 +333,90 @@ sub get_address
my $external_interface = &get_external_interface();
my $network_address = &get_std_net_ip($value, $external_interface);
+
if ($network_address) {
- push(@ret, $network_address);
+ my $interface = &get_interface($network_address);
+ push(@ret, [$network_address, $interface]);
}
# Custom networks.
} elsif ($key ~~ ["cust_net_src", "cust_net_tgt", "Custom Network"]) {
my $network_address = &get_net_ip($value);
if ($network_address) {
- push(@ret, $network_address);
+ push(@ret, [$network_address, ""]);
}
# Custom hosts.
} elsif ($key ~~ ["cust_host_src", "cust_host_tgt", "Custom Host"]) {
my $host_address = &get_host_ip($value, $type);
if ($host_address) {
- push(@ret, $host_address);
+ push(@ret, [$host_address, ""]);
}
# OpenVPN networks.
} elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
my $network_address = &get_ovpn_net_ip($value, 1);
if ($network_address) {
- push(@ret, $network_address);
+ push(@ret, [$network_address, ""]);
}
# OpenVPN hosts.
} elsif ($key ~~ ["ovpn_host_src", "ovpn_host_tgt", "OpenVPN static host"]) {
my $host_address = &get_ovpn_host_ip($value, 33);
if ($host_address) {
- push(@ret, $host_address);
+ push(@ret, [$host_address, ""]);
}
# OpenVPN N2N.
} elsif ($key ~~ ["ovpn_n2n_src", "ovpn_n2n_tgt", "OpenVPN N-2-N"]) {
my $network_address = &get_ovpn_n2n_ip($value, 11);
if ($network_address) {
- push(@ret, $network_address);
+ push(@ret, [$network_address, ""]);
}
# IPsec networks.
} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
my $network_address = &get_ipsec_net_ip($value, 11);
if ($network_address) {
- push(@ret, $network_address);
+ push(@ret, [$network_address, ""]);
}
# The firewall's own IP addresses.
} elsif ($key ~~ ["ipfire", "ipfire_src"]) {
# ALL
if ($value eq "ALL") {
- push(@ret, "0/0");
+ push(@ret, ["0/0", ""]);
# GREEN
} elsif ($value eq "GREEN") {
- push(@ret, $netsettings{"GREEN_ADDRESS"});
+ push(@ret, [$netsettings{"GREEN_ADDRESS"}, ""]);
# BLUE
} elsif ($value eq "BLUE") {
- push(@ret, $netsettings{"BLUE_ADDRESS"});
+ push(@ret, [$netsettings{"BLUE_ADDRESS"}, ""]);
# ORANGE
} elsif ($value eq "ORANGE") {
- push(@ret, $netsettings{"ORANGE_ADDRESS"});
+ push(@ret, [$netsettings{"ORANGE_ADDRESS"}, ""]);
# RED
} elsif ($value ~~ ["RED", "RED1"]) {
my $address = &get_external_address();
if ($address) {
- push(@ret, $address);
+ push(@ret, [$address, ""]);
}
# Aliases
} else {
my $alias = &get_alias($value);
if ($alias) {
- push(@ret, $alias);
+ push(@ret, [$alias, ""]);
}
}
# If nothing was selected, we assume "any".
} else {
- push(@ret, "0/0");
+ push(@ret, ["0/0", ""]);
}
return @ret;
diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index aa8870c..40fb8dd 100755
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -268,6 +268,33 @@ sub buildrules {
}
}
+ # Concurrent connection limit
+ my @ratelimit_options = ();
+ if ($$hash{$key}[32] eq 'ON') {
+ my $conn_limit = $$hash{$key}[33];
+
+ if ($conn_limit ge 1) {
+ push(@ratelimit_options, ("-m", "connlimit"));
+
+ # Use the the entire source IP address
+ push(@ratelimit_options, "--connlimit-saddr");
+ push(@ratelimit_options, ("--connlimit-mask", "32"));
+
+ # Apply the limit
+ push(@ratelimit_options, ("--connlimit-upto", $conn_limit));
+ }
+ }
+
+ # Ratelimit
+ if ($$hash{$key}[34] eq 'ON') {
+ my $rate_limit = "$$hash{$key}[35]/$$hash{$key}[36]";
+
+ if ($rate_limit) {
+ push(@ratelimit_options, ("-m", "limit"));
+ push(@ratelimit_options, ("--limit", $rate_limit));
+ }
+ }
+
# Check which protocols are used in this rule and so that we can
# later group rules by protocols.
my @protocols = &get_protocols($hash, $key);
@@ -295,22 +322,26 @@ sub buildrules {
next unless ($src);
# Sanitize source.
- my $source = $src;
+ my $source = @$src[0];
if ($source ~~ @ANY_ADDRESSES) {
$source = "";
}
+ my $source_intf = @$src[1];
+
foreach my $dst (@destinations) {
# Skip invalid rules.
next unless (defined $dst);
next if (!$dst || ($dst eq "none"));
# Sanitize destination.
- my $destination = $dst;
+ my $destination = @$dst[0];
if ($destination ~~ @ANY_ADDRESSES) {
$destination = "";
}
+ my $destination_intf = @$dst[1];
+
# Array with iptables arguments.
my @options = ();
@@ -327,15 +358,26 @@ sub buildrules {
push(@source_options, ("-s", $source));
}
+ if ($source_intf) {
+ push(@source_options, ("-i", $source_intf));
+ }
+
# Prepare destination options.
my @destination_options = ();
if ($destination) {
push(@destination_options, ("-d", $destination));
}
+ if ($destination_intf) {
+ push(@destination_options, ("-o", $destination_intf));
+ }
+
# Add time constraint options.
push(@options, @time_options);
+ # Add ratelimiting option
+ push(@options, @ratelimit_options);
+
my $firewall_is_in_source_subnet = 1;
if ($source) {
$firewall_is_in_source_subnet = &firewall_is_in_subnet($source);
@@ -366,7 +408,7 @@ sub buildrules {
# Make port-forwardings useable from the internal networks.
my @internal_addresses = &fwlib::get_internal_firewall_ip_addresses(1);
unless ($nat_address ~~ @internal_addresses) {
- &add_dnat_mangle_rules($nat_address, @nat_options);
+ &add_dnat_mangle_rules($nat_address, $source_intf, @nat_options);
}
push(@nat_options, @source_options);
@@ -457,6 +499,10 @@ sub buildrules {
}
}
}
+ #Reload firewall.local if present
+ if ( -f '/etc/sysconfig/firewall.local'){
+ run("/etc/sysconfig/firewall.local reload");
+ }
}
# Formats the given timestamp into the iptables format which is "hh:mm" UTC.
@@ -683,6 +729,7 @@ sub get_dnat_target_port {
sub add_dnat_mangle_rules {
my $nat_address = shift;
+ my $interface = shift;
my @options = @_;
my $mark = 0;
@@ -693,6 +740,8 @@ sub add_dnat_mangle_rules {
next unless (exists $defaultNetworks{$zone . "_NETADDRESS"});
next unless (exists $defaultNetworks{$zone . "_NETMASK"});
+ next if ($interface && $interface ne $defaultNetworks{$zone . "_DEV"});
+
my @mangle_options = @options;
my $netaddress = $defaultNetworks{$zone . "_NETADDRESS"};
diff --git a/config/rootfiles/core/82/filelists/iputils b/config/rootfiles/core/82/filelists/iputils
deleted file mode 120000
index 361c28f..0000000
--- a/config/rootfiles/core/82/filelists/iputils
+++ /dev/null
@@ -1 +0,0 @@
-../../../common/iputils
\ No newline at end of file
diff --git a/config/rootfiles/core/82/filelists/openssl-compat b/config/rootfiles/core/82/filelists/openssl-compat
deleted file mode 120000
index c9fa421..0000000
--- a/config/rootfiles/core/82/filelists/openssl-compat
+++ /dev/null
@@ -1 +0,0 @@
-../../../common/openssl-compat
\ No newline at end of file
diff --git a/config/rootfiles/core/83/exclude b/config/rootfiles/core/83/exclude
deleted file mode 100644
index 18e9b4d..0000000
--- a/config/rootfiles/core/83/exclude
+++ /dev/null
@@ -1,20 +0,0 @@
-boot/config.txt
-etc/collectd.custom
-etc/ipsec.conf
-etc/ipsec.secrets
-etc/ipsec.user.conf
-etc/ipsec.user.secrets
-etc/localtime
-etc/shadow
-etc/ssh/ssh_config
-etc/ssh/sshd_config
-etc/ssl/openssl.cnf
-etc/sudoers
-etc/sysconfig/firewall.local
-etc/sysconfig/rc.local
-etc/udev/rules.d/30-persistent-network.rules
-srv/web/ipfire/html/proxy.pac
-var/ipfire/ovpn
-var/log/cache
-var/state/dhcp/dhcpd.leases
-var/updatecache
diff --git a/config/rootfiles/core/83/filelists/bash b/config/rootfiles/core/83/filelists/bash
deleted file mode 120000
index de970cb..0000000
--- a/config/rootfiles/core/83/filelists/bash
+++ /dev/null
@@ -1 +0,0 @@
-../../../common/bash
\ No newline at end of file
diff --git a/config/rootfiles/core/83/filelists/files b/config/rootfiles/core/83/filelists/files
deleted file mode 100644
index 5c0b6fe..0000000
--- a/config/rootfiles/core/83/filelists/files
+++ /dev/null
@@ -1,6 +0,0 @@
-etc/system-release
-etc/issue
-srv/web/ipfire/cgi-bin/logs.cgi/ids.dat
-srv/web/ipfire/cgi-bin/proxy.cgi
-srv/web/ipfire/cgi-bin/urlfilter.cgi
-var/ipfire/general-functions.pl
diff --git a/config/rootfiles/core/83/filelists/findutils b/config/rootfiles/core/83/filelists/findutils
deleted file mode 120000
index 545280a..0000000
--- a/config/rootfiles/core/83/filelists/findutils
+++ /dev/null
@@ -1 +0,0 @@
-../../../common/findutils
\ No newline at end of file
diff --git a/config/rootfiles/core/83/filelists/squid b/config/rootfiles/core/83/filelists/squid
deleted file mode 120000
index 2dc8372..0000000
--- a/config/rootfiles/core/83/filelists/squid
+++ /dev/null
@@ -1 +0,0 @@
-../../../common/squid
\ No newline at end of file
diff --git a/config/rootfiles/core/83/meta b/config/rootfiles/core/83/meta
deleted file mode 100644
index d547fa8..0000000
--- a/config/rootfiles/core/83/meta
+++ /dev/null
@@ -1 +0,0 @@
-DEPS=""
diff --git a/config/rootfiles/core/83/update.sh b/config/rootfiles/core/83/update.sh
deleted file mode 100644
index 195ba23..0000000
--- a/config/rootfiles/core/83/update.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/bin/bash
-############################################################################
-# #
-# This file is part of the IPFire Firewall. #
-# #
-# IPFire is free software; you can redistribute it and/or modify #
-# it under the terms of the GNU General Public License as published by #
-# the Free Software Foundation; either version 3 of the License, or #
-# (at your option) any later version. #
-# #
-# IPFire is distributed in the hope that it will be useful, #
-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
-# GNU General Public License for more details. #
-# #
-# You should have received a copy of the GNU General Public License #
-# along with IPFire; if not, write to the Free Software #
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
-# #
-# Copyright (C) 2014 IPFire-Team <info(a)ipfire.org>. #
-# #
-############################################################################
-#
-. /opt/pakfire/lib/functions.sh
-/usr/local/bin/backupctrl exclude >/dev/null 2>&1
-
-# Remove old core updates from pakfire cache to save space...
-core=83
-for (( i=1; i<=$core; i++ ))
-do
- rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
-done
-
-# Stop services
-
-# Remove old files
-
-# Extract files
-extract_files
-
-# Start services
-
-# Update Language cache
-perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang"
-
-sync
-
-# This update need a reboot...
-touch /var/run/need_reboot
-
-# Finish
-/etc/init.d/fireinfo start
-sendprofile
-
-# Don't report the exitcode last command
-exit 0
diff --git a/config/rootfiles/core/84/exclude b/config/rootfiles/core/84/exclude
new file mode 100644
index 0000000..18e9b4d
--- /dev/null
+++ b/config/rootfiles/core/84/exclude
@@ -0,0 +1,20 @@
+boot/config.txt
+etc/collectd.custom
+etc/ipsec.conf
+etc/ipsec.secrets
+etc/ipsec.user.conf
+etc/ipsec.user.secrets
+etc/localtime
+etc/shadow
+etc/ssh/ssh_config
+etc/ssh/sshd_config
+etc/ssl/openssl.cnf
+etc/sudoers
+etc/sysconfig/firewall.local
+etc/sysconfig/rc.local
+etc/udev/rules.d/30-persistent-network.rules
+srv/web/ipfire/html/proxy.pac
+var/ipfire/ovpn
+var/log/cache
+var/state/dhcp/dhcpd.leases
+var/updatecache
diff --git a/config/rootfiles/core/84/filelists/bash b/config/rootfiles/core/84/filelists/bash
new file mode 120000
index 0000000..de970cb
--- /dev/null
+++ b/config/rootfiles/core/84/filelists/bash
@@ -0,0 +1 @@
+../../../common/bash
\ No newline at end of file
diff --git a/config/rootfiles/core/84/filelists/dnsmasq b/config/rootfiles/core/84/filelists/dnsmasq
new file mode 120000
index 0000000..d469c74
--- /dev/null
+++ b/config/rootfiles/core/84/filelists/dnsmasq
@@ -0,0 +1 @@
+../../../common/dnsmasq
\ No newline at end of file
diff --git a/config/rootfiles/core/84/filelists/files b/config/rootfiles/core/84/filelists/files
new file mode 100644
index 0000000..85bca99
--- /dev/null
+++ b/config/rootfiles/core/84/filelists/files
@@ -0,0 +1,8 @@
+etc/system-release
+etc/issue
+etc/rc.d/init.d/firewall
+srv/web/ipfire/cgi-bin/firewall.cgi
+srv/web/ipfire/cgi-bin/fwhosts.cgi
+usr/lib/firewall/firewall-lib.pl
+usr/lib/firewall/rules.pl
+var/ipfire/langs
diff --git a/config/rootfiles/core/84/meta b/config/rootfiles/core/84/meta
new file mode 100644
index 0000000..d547fa8
--- /dev/null
+++ b/config/rootfiles/core/84/meta
@@ -0,0 +1 @@
+DEPS=""
diff --git a/config/rootfiles/core/84/update.sh b/config/rootfiles/core/84/update.sh
new file mode 100644
index 0000000..1b83326
--- /dev/null
+++ b/config/rootfiles/core/84/update.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+############################################################################
+# #
+# This file is part of the IPFire Firewall. #
+# #
+# IPFire is free software; you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation; either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# IPFire is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with IPFire; if not, write to the Free Software #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
+# #
+# Copyright (C) 2014 IPFire-Team <info(a)ipfire.org>. #
+# #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+/usr/local/bin/backupctrl exclude >/dev/null 2>&1
+
+# Remove old core updates from pakfire cache to save space...
+core=84
+for (( i=1; i<=$core; i++ ))
+do
+ rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
+done
+
+# Stop services
+/etc/init.d/dnsmasq stop
+
+# Remove old files
+
+# Extract files
+extract_files
+
+# Start services
+/etc/init.d/dnsmasq start
+
+# Update Language cache
+perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang"
+
+sync
+
+# This update need a reboot...
+touch /var/run/need_reboot
+
+# Finish
+/etc/init.d/fireinfo start
+sendprofile
+
+# Don't report the exitcode last command
+exit 0
diff --git a/config/rootfiles/oldcore/82/filelists/iputils b/config/rootfiles/oldcore/82/filelists/iputils
new file mode 120000
index 0000000..361c28f
--- /dev/null
+++ b/config/rootfiles/oldcore/82/filelists/iputils
@@ -0,0 +1 @@
+../../../common/iputils
\ No newline at end of file
diff --git a/config/rootfiles/oldcore/82/filelists/openssl-compat b/config/rootfiles/oldcore/82/filelists/openssl-compat
new file mode 120000
index 0000000..c9fa421
--- /dev/null
+++ b/config/rootfiles/oldcore/82/filelists/openssl-compat
@@ -0,0 +1 @@
+../../../common/openssl-compat
\ No newline at end of file
diff --git a/config/rootfiles/oldcore/83/exclude b/config/rootfiles/oldcore/83/exclude
new file mode 100644
index 0000000..18e9b4d
--- /dev/null
+++ b/config/rootfiles/oldcore/83/exclude
@@ -0,0 +1,20 @@
+boot/config.txt
+etc/collectd.custom
+etc/ipsec.conf
+etc/ipsec.secrets
+etc/ipsec.user.conf
+etc/ipsec.user.secrets
+etc/localtime
+etc/shadow
+etc/ssh/ssh_config
+etc/ssh/sshd_config
+etc/ssl/openssl.cnf
+etc/sudoers
+etc/sysconfig/firewall.local
+etc/sysconfig/rc.local
+etc/udev/rules.d/30-persistent-network.rules
+srv/web/ipfire/html/proxy.pac
+var/ipfire/ovpn
+var/log/cache
+var/state/dhcp/dhcpd.leases
+var/updatecache
diff --git a/config/rootfiles/oldcore/83/filelists/bash b/config/rootfiles/oldcore/83/filelists/bash
new file mode 120000
index 0000000..de970cb
--- /dev/null
+++ b/config/rootfiles/oldcore/83/filelists/bash
@@ -0,0 +1 @@
+../../../common/bash
\ No newline at end of file
diff --git a/config/rootfiles/oldcore/83/filelists/files b/config/rootfiles/oldcore/83/filelists/files
new file mode 100644
index 0000000..5c0b6fe
--- /dev/null
+++ b/config/rootfiles/oldcore/83/filelists/files
@@ -0,0 +1,6 @@
+etc/system-release
+etc/issue
+srv/web/ipfire/cgi-bin/logs.cgi/ids.dat
+srv/web/ipfire/cgi-bin/proxy.cgi
+srv/web/ipfire/cgi-bin/urlfilter.cgi
+var/ipfire/general-functions.pl
diff --git a/config/rootfiles/oldcore/83/filelists/findutils b/config/rootfiles/oldcore/83/filelists/findutils
new file mode 120000
index 0000000..545280a
--- /dev/null
+++ b/config/rootfiles/oldcore/83/filelists/findutils
@@ -0,0 +1 @@
+../../../common/findutils
\ No newline at end of file
diff --git a/config/rootfiles/oldcore/83/filelists/squid b/config/rootfiles/oldcore/83/filelists/squid
new file mode 120000
index 0000000..2dc8372
--- /dev/null
+++ b/config/rootfiles/oldcore/83/filelists/squid
@@ -0,0 +1 @@
+../../../common/squid
\ No newline at end of file
diff --git a/config/rootfiles/oldcore/83/meta b/config/rootfiles/oldcore/83/meta
new file mode 100644
index 0000000..d547fa8
--- /dev/null
+++ b/config/rootfiles/oldcore/83/meta
@@ -0,0 +1 @@
+DEPS=""
diff --git a/config/rootfiles/oldcore/83/update.sh b/config/rootfiles/oldcore/83/update.sh
new file mode 100644
index 0000000..c766b42
--- /dev/null
+++ b/config/rootfiles/oldcore/83/update.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+############################################################################
+# #
+# This file is part of the IPFire Firewall. #
+# #
+# IPFire is free software; you can redistribute it and/or modify #
+# it under the terms of the GNU General Public License as published by #
+# the Free Software Foundation; either version 3 of the License, or #
+# (at your option) any later version. #
+# #
+# IPFire is distributed in the hope that it will be useful, #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
+# GNU General Public License for more details. #
+# #
+# You should have received a copy of the GNU General Public License #
+# along with IPFire; if not, write to the Free Software #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA #
+# #
+# Copyright (C) 2014 IPFire-Team <info(a)ipfire.org>. #
+# #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+/usr/local/bin/backupctrl exclude >/dev/null 2>&1
+
+# Remove old core updates from pakfire cache to save space...
+core=83
+for (( i=1; i<=$core; i++ ))
+do
+ rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
+done
+
+# Stop services
+
+# Remove old files
+
+# Extract files
+extract_files
+
+# reload init because glibc/linker changed
+telinit -u
+
+# Start services
+
+# Update Language cache
+perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang"
+
+sync
+
+# This update need a reboot...
+touch /var/run/need_reboot
+
+# Finish
+/etc/init.d/fireinfo start
+sendprofile
+
+# Don't report the exitcode last command
+exit 0
diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi
index e6ae527..badee6b 100644
--- a/html/cgi-bin/firewall.cgi
+++ b/html/cgi-bin/firewall.cgi
@@ -161,6 +161,22 @@ print<<END;
\$("#TIME_CONSTRAINTS").toggle();
});
+ // Limit concurrent connections per ip
+ if(!\$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").attr("checked")) {
+ \$("#LIMIT_CON").hide();
+ }
+ \$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").change(function() {
+ \$("#LIMIT_CON").toggle();
+ });
+
+ // Rate-limit new connections
+ if(!\$("#USE_RATELIMIT").attr("checked")) {
+ \$("#RATELIMIT").hide();
+ }
+ \$("#USE_RATELIMIT").change(function() {
+ \$("#RATELIMIT").toggle();
+ });
+
// Automatically select radio buttons when corresponding
// dropdown menu changes.
\$("select").change(function() {
@@ -222,8 +238,8 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
#check if we have an identical rule already
if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
foreach my $key (sort keys %configinputfw){
- if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}"
- eq "$configinputfw{$key}[0],$configinputfw{$key}[2],$configinputfw{$key}[3],$configinputfw{$key}[4],$configinputfw{$key}[5],$configinputfw{$key}[6],$configinputfw{$key}[7],$configinputfw{$key}[8],$configinputfw{$key}[9],$configinputfw{$key}[10],$configinputfw{$key}[11],$configinputfw{$key}[12],$configinputfw{$key}[13],$configinputfw{$key}[14],$configinputfw{$key}[15],$configinputfw{$key}[17],$configinputfw{$key}[18],$configinputfw{$key}[19],$configinputfw{$key}[20],$configinputfw{$key}[21],$configinputfw{$key}[22],$configinputfw{$key}[23],$configinputfw{$key}[24],$configinputfw{$key}[25],$configinputfw{$key}[26],$configinputfw{$key}[27],$configinputfw{$key}[28],$configinputfw{$key}[29],$configinputfw{$key}[30],$configinputfw{$key}[31]"){
+ if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
+ eq "$configinputfw{$key}[0],$configinputfw{$key}[2],$configinputfw{$key}[3],$configinputfw{$key}[4],$configinputfw{$key}[5],$configinputfw{$key}[6],$configinputfw{$key}[7],$configinputfw{$key}[8],$configinputfw{$key}[9],$configinputfw{$key}[10],$configinputfw{$key}[11],$configinputfw{$key}[12],$configinputfw{$key}[13],$configinputfw{$key}[14],$configinputfw{$key}[15],$configinputfw{$key}[17],$configinputfw{$key}[18],$configinputfw{$key}[19],$configinputfw{$key}[20],$configinputfw{$key}[21],$configinputfw{$key}[22],$configinputfw{$key}[23],$configinputfw{$key}[24],$configinputfw{$key}[25],$configinputfw{$key}[26],$configinputfw{$key}[27],$configinputfw{$key}[28],$configinputfw{$key}[29],$configinputfw{$key}[30],$configinputfw{$key}[31],$configinputfw{$key}[32],$configinputfw{$key}[33],$configinputfw{$key}[34],$configinputfw{$key}[35],$configinputfw{$key}[36]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
$errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
@@ -241,14 +257,14 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
$fwdfwsettings{'oldrulenumber'}=$maxkey;
foreach my $key (sort keys %configinputfw){
- if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}"
- eq "$configinputfw{$key}[0],$configinputfw{$key}[2],$configinputfw{$key}[3],$configinputfw{$key}[4],$configinputfw{$key}[5],$configinputfw{$key}[6],$configinputfw{$key}[7],$configinputfw{$key}[8],$configinputfw{$key}[9],$configinputfw{$key}[10],$configinputfw{$key}[11],$configinputfw{$key}[12],$configinputfw{$key}[13],$configinputfw{$key}[14],$configinputfw{$key}[15],$configinputfw{$key}[17],$configinputfw{$key}[18],$configinputfw{$key}[19],$configinputfw{$key}[20],$configinputfw{$key}[21],$configinputfw{$key}[22],$configinputfw{$key}[23],$configinputfw{$key}[24],$configinputfw{$key}[25],$configinputfw{$key}[26],$configinputfw{$key}[27],$configinputfw{$key}[28],$configinputfw{$key}[29],$configinputfw{$key}[30],$configinputfw{$key}[31]"){
+ if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
+ eq "$configinputfw{$key}[0],$configinputfw{$key}[2],$configinputfw{$key}[3],$configinputfw{$key}[4],$configinputfw{$key}[5],$configinputfw{$key}[6],$configinputfw{$key}[7],$configinputfw{$key}[8],$configinputfw{$key}[9],$configinputfw{$key}[10],$configinputfw{$key}[11],$configinputfw{$key}[12],$configinputfw{$key}[13],$configinputfw{$key}[14],$configinputfw{$key}[15],$configinputfw{$key}[17],$configinputfw{$key}[18],$configinputfw{$key}[19],$configinputfw{$key}[20],$configinputfw{$key}[21],$configinputfw{$key}[22],$configinputfw{$key}[23],$configinputfw{$key}[24],$configinputfw{$key}[25],$configinputfw{$key}[26],$configinputfw{$key}[27],$configinputfw{$key}[28],$configinputfw{$key}[29],$configinputfw{$key}[30],$configinputfw{$key}[31],$configinputfw{$key}[32],$configinputfw{$key}[33],$configinputfw{$key}[34],$configinputfw{$key}[35],$configinputfw{$key}[36]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
}
}
}
#check if we just close a rule
- if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}) {
+ if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'} ) {
if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
$errormessage='';
$fwdfwsettings{'nosave2'} = 'on';
@@ -266,8 +282,8 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
my $maxkey=&General::findhasharraykey(\%configoutgoingfw);
if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
foreach my $key (sort keys %configoutgoingfw){
- if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}"
- eq "$configoutgoingfw{$key}[0],$configoutgoingfw{$key}[2],$configoutgoingfw{$key}[3],$configoutgoingfw{$key}[4],$configoutgoingfw{$key}[5],$configoutgoingfw{$key}[6],$configoutgoingfw{$key}[7],$configoutgoingfw{$key}[8],$configoutgoingfw{$key}[9],$configoutgoingfw{$key}[10],$configoutgoingfw{$key}[11],$configoutgoingfw{$key}[12],$configoutgoingfw{$key}[13],$configoutgoingfw{$key}[14],$configoutgoingfw{$key}[15],$configoutgoingfw{$key}[17],$configoutgoingfw{$key}[18],$configoutgoingfw{$key}[19],$configoutgoingfw{$key}[20],$configoutgoingfw{$key}[21],$configoutgoingfw{$key}[22],$configoutgoingfw{$key}[23],$configoutgoingfw{$key}[24],$configoutgoingfw{$key}[25],$configoutgoingfw{$key}[26],$configoutgoingfw{$key}[27],$configoutgoingfw{$key}[28],$configoutgoingfw{$key}[29],$configoutgoingfw{$key}[30],$configoutgoingfw{$key}[31]"){
+ if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
+ eq "$configoutgoingfw{$key}[0],$configoutgoingfw{$key}[2],$configoutgoingfw{$key}[3],$configoutgoingfw{$key}[4],$configoutgoingfw{$key}[5],$configoutgoingfw{$key}[6],$configoutgoingfw{$key}[7],$configoutgoingfw{$key}[8],$configoutgoingfw{$key}[9],$configoutgoingfw{$key}[10],$configoutgoingfw{$key}[11],$configoutgoingfw{$key}[12],$configoutgoingfw{$key}[13],$configoutgoingfw{$key}[14],$configoutgoingfw{$key}[15],$configoutgoingfw{$key}[17],$configoutgoingfw{$key}[18],$configoutgoingfw{$key}[19],$configoutgoingfw{$key}[20],$configoutgoingfw{$key}[21],$configoutgoingfw{$key}[22],$configoutgoingfw{$key}[23],$configoutgoingfw{$key}[24],$configoutgoingfw{$key}[25],$configoutgoingfw{$key}[26],$configoutgoingfw{$key}[27],$configoutgoingfw{$key}[28],$configoutgoingfw{$key}[29],$configoutgoingfw{$key}[30],$configoutgoingfw{$key}[31],$configoutgoingfw{$key}[32],$configoutgoingfw{$key}[33],$configoutgoingfw{$key}[34],$configoutgoingfw{$key}[35],$configoutgoingfw{$key}[36]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
$errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
@@ -285,14 +301,14 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
$fwdfwsettings{'oldrulenumber'}=$maxkey;
foreach my $key (sort keys %configoutgoingfw){
- if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}"
- eq "$configoutgoingfw{$key}[0],$configoutgoingfw{$key}[2],$configoutgoingfw{$key}[3],$configoutgoingfw{$key}[4],$configoutgoingfw{$key}[5],$configoutgoingfw{$key}[6],$configoutgoingfw{$key}[7],$configoutgoingfw{$key}[8],$configoutgoingfw{$key}[9],$configoutgoingfw{$key}[10],$configoutgoingfw{$key}[11],$configoutgoingfw{$key}[12],$configoutgoingfw{$key}[13],$configoutgoingfw{$key}[14],$configoutgoingfw{$key}[15],$configoutgoingfw{$key}[17],$configoutgoingfw{$key}[18],$configoutgoingfw{$key}[19],$configoutgoingfw{$key}[20],$configoutgoingfw{$key}[21],$configoutgoingfw{$key}[22],$configoutgoingfw{$key}[23],$configoutgoingfw{$key}[24],$configoutgoingfw{$key}[25],$configoutgoingfw{$key}[26],$configoutgoingfw{$key}[27],$configoutgoingfw{$key}[28],$configoutgoingfw{$key}[29],$configoutgoingfw{$key}[30],$configoutgoingfw{$key}[31]"){
+ if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
+ eq "$configoutgoingfw{$key}[0],$configoutgoingfw{$key}[2],$configoutgoingfw{$key}[3],$configoutgoingfw{$key}[4],$configoutgoingfw{$key}[5],$configoutgoingfw{$key}[6],$configoutgoingfw{$key}[7],$configoutgoingfw{$key}[8],$configoutgoingfw{$key}[9],$configoutgoingfw{$key}[10],$configoutgoingfw{$key}[11],$configoutgoingfw{$key}[12],$configoutgoingfw{$key}[13],$configoutgoingfw{$key}[14],$configoutgoingfw{$key}[15],$configoutgoingfw{$key}[17],$configoutgoingfw{$key}[18],$configoutgoingfw{$key}[19],$configoutgoingfw{$key}[20],$configoutgoingfw{$key}[21],$configoutgoingfw{$key}[22],$configoutgoingfw{$key}[23],$configoutgoingfw{$key}[24],$configoutgoingfw{$key}[25],$configoutgoingfw{$key}[26],$configoutgoingfw{$key}[27],$configoutgoingfw{$key}[28],$configoutgoingfw{$key}[29],$configoutgoingfw{$key}[30],$configoutgoingfw{$key}[31],$configoutgoingfw{$key}[32],$configoutgoingfw{$key}[33],$configoutgoingfw{$key}[34],$configoutgoingfw{$key}[35],$configoutgoingfw{$key}[36]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
}
}
}
#check if we just close a rule
- if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}) {
+ if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'} ) {
if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
$fwdfwsettings{'nosave2'} = 'on';
$errormessage='';
@@ -312,8 +328,8 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
#check if we have an identical rule already
foreach my $key (sort keys %configfwdfw){
- if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}"
- eq "$configfwdfw{$key}[0],$configfwdfw{$key}[2],$configfwdfw{$key}[3],$configfwdfw{$key}[4],$configfwdfw{$key}[5],$configfwdfw{$key}[6],$configfwdfw{$key}[7],$configfwdfw{$key}[8],$configfwdfw{$key}[9],$configfwdfw{$key}[10],$configfwdfw{$key}[11],$configfwdfw{$key}[12],$configfwdfw{$key}[13],$configfwdfw{$key}[14],$configfwdfw{$key}[15],$configfwdfw{$key}[18],$configfwdfw{$key}[19],$configfwdfw{$key}[20],$configfwdfw{$key}[21],$configfwdfw{$key}[22],$configfwdfw{$key}[23],$configfwdfw{$key}[24],$configfwdfw{$key}[25],$configfwdfw{$key}[26],$configfwdfw{$key}[27],$configfwdfw{$key}[28],$configfwdfw{$key}[29],$configfwdfw{$key}[30],$configfwdfw{$key}[31]"){
+ if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
+ eq "$configfwdfw{$key}[0],$configfwdfw{$key}[2],$configfwdfw{$key}[3],$configfwdfw{$key}[4],$configfwdfw{$key}[5],$configfwdfw{$key}[6],$configfwdfw{$key}[7],$configfwdfw{$key}[8],$configfwdfw{$key}[9],$configfwdfw{$key}[10],$configfwdfw{$key}[11],$configfwdfw{$key}[12],$configfwdfw{$key}[13],$configfwdfw{$key}[14],$configfwdfw{$key}[15],$configfwdfw{$key}[18],$configfwdfw{$key}[19],$configfwdfw{$key}[20],$configfwdfw{$key}[21],$configfwdfw{$key}[22],$configfwdfw{$key}[23],$configfwdfw{$key}[24],$configfwdfw{$key}[25],$configfwdfw{$key}[26],$configfwdfw{$key}[27],$configfwdfw{$key}[28],$configfwdfw{$key}[29],$configfwdfw{$key}[30],$configfwdfw{$key}[31],$configfwdfw{$key}[32],$configfwdfw{$key}[33],$configfwdfw{$key}[34],$configfwdfw{$key}[35],$configfwdfw{$key}[36]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
$errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
@@ -331,19 +347,35 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
$fwdfwsettings{'oldrulenumber'}=$maxkey;
foreach my $key (sort keys %configfwdfw){
- if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}"
- eq "$configfwdfw{$key}[0],$configfwdfw{$key}[2],$configfwdfw{$key}[3],$configfwdfw{$key}[4],$configfwdfw{$key}[5],$configfwdfw{$key}[6],$configfwdfw{$key}[7],$configfwdfw{$key}[8],$configfwdfw{$key}[9],$configfwdfw{$key}[10],$configfwdfw{$key}[11],$configfwdfw{$key}[12],$configfwdfw{$key}[13],$configfwdfw{$key}[14],$configfwdfw{$key}[15],$configfwdfw{$key}[18],$configfwdfw{$key}[19],$configfwdfw{$key}[20],$configfwdfw{$key}[21],$configfwdfw{$key}[22],$configfwdfw{$key}[23],$configfwdfw{$key}[24],$configfwdfw{$key}[25],$configfwdfw{$key}[26],$configfwdfw{$key}[27],$configfwdfw{$key}[28],$configfwdfw{$key}[29],$configfwdfw{$key}[30],$configfwdfw{$key}[31]"){
+ if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
+ eq "$configfwdfw{$key}[0],$configfwdfw{$key}[2],$configfwdfw{$key}[3],$configfwdfw{$key}[4],$configfwdfw{$key}[5],$configfwdfw{$key}[6],$configfwdfw{$key}[7],$configfwdfw{$key}[8],$configfwdfw{$key}[9],$configfwdfw{$key}[10],$configfwdfw{$key}[11],$configfwdfw{$key}[12],$configfwdfw{$key}[13],$configfwdfw{$key}[14],$configfwdfw{$key}[15],$configfwdfw{$key}[18],$configfwdfw{$key}[19],$configfwdfw{$key}[20],$configfwdfw{$key}[21],$configfwdfw{$key}[22],$configfwdfw{$key}[23],$configfwdfw{$key}[24],$configfwdfw{$key}[25],$configfwdfw{$key}[26],$configfwdfw{$key}[27],$configfwdfw{$key}[28],$configfwdfw{$key}[29],$configfwdfw{$key}[30],$configfwdfw{$key}[31],$configfwdfw{$key}[32],$configfwdfw{$key}[33],$configfwdfw{$key}[34],$configfwdfw{$key}[35],$configfwdfw{$key}[36]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
}
}
}
#check if we just close a rule
- if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}) {
+ if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}){
if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
$fwdfwsettings{'nosave2'} = 'on';
$errormessage='';
}
}
+ #check max concurrent connections per ip address
+ if ($fwdfwsettings{'LIMIT_CON_CON'} eq 'ON'){
+ if (!($fwdfwsettings{'concon'} =~ /^(\d+)$/)) {
+ $errormessage.=$Lang::tr{'fwdfw err concon'};
+ }
+ }else{
+ $fwdfwsettings{'concon'}='';
+ }
+ #check ratelimit value
+ if ($fwdfwsettings{'RATE_LIMIT'} eq 'ON'){
+ if (!($fwdfwsettings{'ratecon'} =~ /^(\d+)$/)) {
+ $errormessage.=$Lang::tr{'fwdfw err ratecon'};
+ }
+ }else{
+ $fwdfwsettings{'ratecon'}='';
+ }
#increase counters
if (!$errormessage){
if ($fwdfwsettings{'nosave2'} ne 'on'){
@@ -1064,7 +1096,6 @@ print<<END;
END
foreach my $network (sort keys %defaultNetworks)
{
- next if($defaultNetworks{$network}{'NAME'} eq "RED" && $srctgt eq 'src');
next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
print "<option value='$defaultNetworks{$network}{'NAME'}'";
print " selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $defaultNetworks{$network}{'NAME'});
@@ -1517,6 +1548,11 @@ sub newrule
$fwdfwsettings{'nat'} = $hash{$key}[31]; #changed order
$fwdfwsettings{$fwdfwsettings{'nat'}} = $hash{$key}[29];
$fwdfwsettings{'dnatport'} = $hash{$key}[30];
+ $fwdfwsettings{'LIMIT_CON_CON'} = $hash{$key}[32];
+ $fwdfwsettings{'concon'} = $hash{$key}[33];
+ $fwdfwsettings{'RATE_LIMIT'} = $hash{$key}[34];
+ $fwdfwsettings{'ratecon'} = $hash{$key}[35];
+ $fwdfwsettings{'RATETIME'} = $hash{$key}[36];
$checked{'grp1'}{$fwdfwsettings{'grp1'}} = 'CHECKED';
$checked{'grp2'}{$fwdfwsettings{'grp2'}} = 'CHECKED';
$checked{'grp3'}{$fwdfwsettings{'grp3'}} = 'CHECKED';
@@ -1534,12 +1570,15 @@ sub newrule
$checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}} = 'CHECKED';
$checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}} = 'CHECKED';
$checked{'nat'}{$fwdfwsettings{'nat'}} = 'CHECKED';
+ $checked{'LIMIT_CON_CON'}{$fwdfwsettings{'LIMIT_CON_CON'}} = 'CHECKED';
+ $checked{'RATE_LIMIT'}{$fwdfwsettings{'RATE_LIMIT'}} = 'CHECKED';
$selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}} = 'selected';
$selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}} = 'selected';
$selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
$selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
$selected{'dnat'}{$fwdfwsettings{'dnat'}} ='selected';
$selected{'snat'}{$fwdfwsettings{'snat'}} ='selected';
+ $selected{'RATETIME'}{$fwdfwsettings{'RATETIME'}} ='selected';
}
}
$fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
@@ -1552,6 +1591,11 @@ sub newrule
$fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
$fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
$fwdfwsettings{'oldruletype'}=$fwdfwsettings{'chain'};
+ $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
+ $fwdfwsettings{'olduseratelimit'}=$fwdfwsettings{'RATE_LIMIT'};
+ $fwdfwsettings{'olduseratelimitamount'}=$fwdfwsettings{'ratecon'};
+ $fwdfwsettings{'oldratelimittime'}=$fwdfwsettings{'RATETIME'};
+
#check if manual ip (source) is orange network
if ($fwdfwsettings{'grp1'} eq 'src_addr'){
my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
@@ -1573,6 +1617,7 @@ sub newrule
$fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
$fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
$fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
+ $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
#check if manual ip (source) is orange network
if ($fwdfwsettings{'grp1'} eq 'src_addr'){
my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
@@ -2012,6 +2057,44 @@ END
</table>
</td>
</tr>
+ <tr>
+ <td width='1%'>
+ <input type='checkbox' name='LIMIT_CON_CON' id="USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP" value='ON' $checked{'LIMIT_CON_CON'}{'ON'}>
+ </td>
+ <td>$Lang::tr{'fwdfw limitconcon'}</td>
+ </tr>
+ <tr id="LIMIT_CON">
+ <td colspan='2'>
+ <table width='66%' border='0'>
+ <tr>
+ <td width="20em"> </td>
+ <td>$Lang::tr{'fwdfw maxconcon'}: <input type='text' name='concon' size='2' value="$fwdfwsettings{'concon'}"></td>
+ </tr>
+ </table>
+ </td>
+ </tr>
+ <tr>
+ <td width='1%'>
+ <input type='checkbox' name='RATE_LIMIT' id="USE_RATELIMIT" value='ON' $checked{'RATE_LIMIT'}{'ON'}>
+ </td>
+ <td>$Lang::tr{'fwdfw ratelimit'}</td>
+ </tr>
+ <tr id="RATELIMIT">
+ <td colspan='2'>
+ <table width='66%' border='0'>
+ <tr>
+ <td width="20em"> </td>
+ <td>$Lang::tr{'fwdfw numcon'}: <input type='text' name='ratecon' size='2' value="$fwdfwsettings{'ratecon'}"> /
+ <select name='RATETIME' style='width:100px;'>
+ <option value='second' $selected{'RATETIME'}{'second'}>$Lang::tr{'age second'}</option>
+ <option value='minute' $selected{'RATETIME'}{'minute'}>$Lang::tr{'minute'}</option>
+ <option value='hour' $selected{'RATETIME'}{'hour'}>$Lang::tr{'hour'}</option>
+ </select>
+ </td>
+ </tr>
+ </table>
+ </td>
+ </tr>
</table>
<br>
END
@@ -2044,6 +2127,7 @@ END
<input type='hidden' name='oldorange' value='$fwdfwsettings{'oldorange'}' />
<input type='hidden' name='oldnat' value='$fwdfwsettings{'oldnat'}' />
<input type='hidden' name='oldruletype' value='$fwdfwsettings{'oldruletype'}' />
+ <input type='hidden' name='oldconcon' value='$fwdfwsettings{'oldconcon'}' />
<input type='hidden' name='ACTION' value='saverule' ></form><form method='post' style='display:inline'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value'reset'></td></td>
</table></form>
END
@@ -2180,6 +2264,11 @@ sub saverule
$$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
$$hash{$key}[30] = $fwdfwsettings{'dnatport'};
$$hash{$key}[31] = $fwdfwsettings{'nat'};
+ $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
+ $$hash{$key}[33] = $fwdfwsettings{'concon'};
+ $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
+ $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
+ $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
&General::writehasharray("$config", $hash);
}else{
foreach my $key (sort {$a <=> $b} keys %$hash){
@@ -2216,6 +2305,11 @@ sub saverule
$$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
$$hash{$key}[30] = $fwdfwsettings{'dnatport'};
$$hash{$key}[31] = $fwdfwsettings{'nat'};
+ $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
+ $$hash{$key}[33] = $fwdfwsettings{'concon'};
+ $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
+ $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
+ $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
last;
}
}
diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi
index 1f96336..c3642f0 100644
--- a/html/cgi-bin/fwhosts.cgi
+++ b/html/cgi-bin/fwhosts.cgi
@@ -291,42 +291,13 @@ if ($fwhostsettings{'ACTION'} eq 'savenet' )
$errormessage=$errormessage.$Lang::tr{'fwhost err sub32'};
}
if($fwhostsettings{'error'} ne 'on'){
- #check if we use one of ipfire's networks (green,orange,blue)
- if (($ownnet{'GREEN_NETADDRESS'} ne '' && $ownnet{'GREEN_NETADDRESS'} ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'GREEN_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'GREEN_NETMASK'}))
- {
- $errormessage=$errormessage.$Lang::tr{'ccd err green'}."<br>";
- $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
- if ($fwhostsettings{'update'} eq 'on'){$fwhostsettings{'ACTION'}='editnet';}
- }
- if (($ownnet{'ORANGE_NETADDRESS'} ne '' && $ownnet{'ORANGE_NETADDRESS'} ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'ORANGE_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'ORANGE_NETMASK'}))
- {
- $errormessage=$errormessage.$Lang::tr{'ccd err orange'}."<br>";
- $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
- if ($fwhostsettings{'update'} eq 'on'){$fwhostsettings{'ACTION'}='editnet';}
- }
- if (($ownnet{'BLUE_NETADDRESS'} ne '' && $ownnet{'BLUE_NETADDRESS'} ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'BLUE_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'BLUE_NETMASK'}))
- {
- $errormessage=$errormessage.$Lang::tr{'ccd err blue'}."<br>";
- $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
- if ($fwhostsettings{'update'} eq 'on'){$fwhostsettings{'ACTION'}='editnet';}
- }
- if (($ownnet{'RED_NETADDRESS'} ne '' && $ownnet{'RED_NETADDRESS'} ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'RED_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'RED_NETMASK'}))
- {
- $errormessage=$errormessage.$Lang::tr{'ccd err red'}."<br>";
- $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
- if ($fwhostsettings{'update'} eq 'on'){$fwhostsettings{'ACTION'}='editnet';}
- }
+ my $fullip="$fwhostsettings{'IP'}/".&General::iporsubtocidr($fwhostsettings{'SUBNET'});
+ $errormessage=$errormessage.&General::checksubnets($fwhostsettings{'HOSTNAME'},$fullip,"");
}
#only check plausi when no error till now
if (!$errormessage){
&plausicheck("editnet");
}
- #check if network ip is part of an already used one
- if(&checksubnet(\%customnetwork))
- {
- $errormessage=$errormessage.$Lang::tr{'fwhost err partofnet'};
- $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
- }
if($fwhostsettings{'actualize'} eq 'on' && $fwhostsettings{'newnet'} ne 'on' && $errormessage)
{
$fwhostsettings{'actualize'} = '';
@@ -338,9 +309,8 @@ if ($fwhostsettings{'ACTION'} eq 'savenet' )
$customnetwork{$key}[3] = $fwhostsettings{'orgnetremark'};
&General::writehasharray("$confignet", \%customnetwork);
undef %customnetwork;
- }
+ }
if (!$errormessage){
-
&General::readhasharray("$confignet", \%customnetwork);
if ($fwhostsettings{'ACTION'} eq 'updatenet'){
if ($fwhostsettings{'update'} == '0'){
@@ -392,7 +362,7 @@ if ($fwhostsettings{'ACTION'} eq 'savenet' )
&General::writehasharray("$fwconfiginp", \%fwinp);
}
}
- }
+ }
my $key = &General::findhasharraykey (\%customnetwork);
foreach my $i (0 .. 3) { $customnetwork{$key}[$i] = "";}
$fwhostsettings{'SUBNET'} = &General::iporsubtocidr($fwhostsettings{'SUBNET'});
@@ -416,7 +386,8 @@ if ($fwhostsettings{'ACTION'} eq 'savenet' )
}
&addnet;
&viewtablenet;
- }else {
+ }else{
+ $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
&addnet;
&viewtablenet;
}
@@ -1644,7 +1615,10 @@ sub getcolor
$tdcolor="<font style='color: $Header::colourblue;'>$c</font>";
return $tdcolor;
}
-
+ if ("$sip/$scidr" eq "0.0.0.0/0"){
+ $tdcolor="<font style='color: $Header::colourred;'>$c</font>";
+ return $tdcolor;
+ }
#Check if IP is part of OpenVPN N2N subnet
foreach my $key (sort keys %ccdhost){
if ($ccdhost{$key}[3] eq 'net'){
@@ -2501,6 +2475,9 @@ sub getipforgroup
&General::readhash("${General::swroot}/vpn/settings",\%hash);
return $hash{'RW_NET'};
}
+ if ($name eq 'RED'){
+ return "0.0.0.0/0";
+ }
}
}
sub decrease
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index 6c46f70..b7692ee 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -982,12 +982,14 @@
'fwdfw dnat porterr' => 'Für NAT-Regeln muss ein einzelner Port oder Portbereich angegeben werden.',
'fwdfw dnat porterr2' => 'Externer Port (NAT) darf nur angegeben werden, wenn ein Ziel-Port definiert ist.',
'fwdfw edit' => 'Bearbeiten',
+'fwdfw err concon' => 'Ungültige Zahl für gleichzeitige Verbindungen',
'fwdfw err nosrc' => 'Keine Quelle ausgewählt',
'fwdfw err nosrcip' => 'Bitte Quell-IP-Adresse angeben',
'fwdfw err notgt' => 'Kein Ziel ausgewählt',
'fwdfw err notgtip' => 'Bitte Ziel-IP-Adresse angeben',
'fwdfw err prot_port' => 'Bei dem gewählten Protokoll sind Quell- und Zielport nicht erlaubt',
'fwdfw err prot_port1' => 'Bei Nutzung von Quell- oder Zielport muss als Protokoll TCP oder UDP gewählt werden.',
+'fwdfw err ratecon' => 'Ungültiger Wert bei Anzahl der Verbindungen für Ratenlimitierung',
'fwdfw err remark' => 'Die Bemerkung enthält ungültige Zeichen',
'fwdfw err ruleexists' => 'Eine identische Regel existiert bereits',
'fwdfw err same' => 'Quelle und Ziel sind identisch',
@@ -1006,15 +1008,18 @@
'fwdfw hint mac' => 'Sie nutzen MAC-Adressen in der Zielgruppe. Diese werden bei der Regelerstellung übersprungen.',
'fwdfw iface' => 'Interface',
'fwdfw ipsec network' => 'IPsec-Netzwerke:',
+'fwdfw limitconcon' => 'Beschränke gleichzeitige Verbindungen je IP-Adresse',
'fwdfw log' => 'Log',
'fwdfw log rule' => 'Logging aktivieren',
'fwdfw man port' => 'Port(s):',
'fwdfw many' => 'Diverse',
+'fwdfw maxconcon' => 'Max. gleichzeitige Verbindungen',
'fwdfw menu' => 'Firewall',
'fwdfw movedown' => 'Herunter',
'fwdfw moveup' => 'Herauf',
'fwdfw natport used' => 'Der eingegebene Port wird bereits von einer anderen DNAT-Regel benutzt.',
'fwdfw newrule' => 'Neue Regel erstellen',
+'fwdfw numcon' => 'Anzahl der Verbindungen',
'fwdfw p2p txt' => 'P2P-Netzwerke erlauben/verbieten.',
'fwdfw pol allow' => 'Zugelassen',
'fwdfw pol block' => 'Blockiert',
@@ -1023,6 +1028,7 @@
'fwdfw pol title' => 'Standardverhalten der Firewall',
'fwdfw prot41' => 'IPv6 Encapsulation (Protokoll 41)',
'fwdfw prot41 short' => 'IPv6 Encap',
+'fwdfw ratelimit' => 'Ratenlimitierung für neue Verbindungen',
'fwdfw red' => 'ROT',
'fwdfw reread' => 'Änderungen übernehmen',
'fwdfw rule action' => 'Regelaktion:',
@@ -1111,7 +1117,7 @@
'fwhost err remark' => 'Ungültige Bemerkung. Erlaubte Zeichen: Klein- und Großbuchstaben, Bindestrich, Unterstrich, Runde Klammern, Semikolon, Punkt.',
'fwhost err srv exists' => 'Ein Service mit diesem Namen existiert bereits',
'fwhost err srvexist' => 'Dieser Dienst ist bereits in der Gruppe',
-'fwhost err sub32' => 'Bitte einen einzelnen Host hinzufügen, keine Netzwerke',
+'fwhost err sub32' => 'Bitte Netzwerke hinzufügen, keinen einzelnen Host',
'fwhost green' => 'Grün',
'fwhost hint' => 'Hinweis',
'fwhost hosts' => 'Firewall-Hosts',
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index b537868..a15090a 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -1009,12 +1009,14 @@
'fwdfw dnat porterr' => 'You have to select a single port or portrange (tcp/udp) for NAT',
'fwdfw dnat porterr2' => 'Cannot use external port (NAT) when no destination port is defined.',
'fwdfw edit' => 'Edit',
+'fwdfw err concon' => 'Invalid number for concurrent connections',
'fwdfw err nosrc' => 'No source selected.',
'fwdfw err nosrcip' => 'Please provide a source IP address.',
'fwdfw err notgt' => 'No destination selected.',
'fwdfw err notgtip' => 'Please provide a destination IP address.',
'fwdfw err prot_port' => 'Source- or targetport are not allowed with selected protocol',
'fwdfw err prot_port1' => 'When using Source- or targetport you have to select TCP or UDP for protocol',
+'fwdfw err ratecon' => 'Invalid value for connections in Rate-limit',
'fwdfw err remark' => 'Invalid characters in remark.',
'fwdfw err ruleexists' => 'This rule already exists.',
'fwdfw err same' => 'Source and destination are identical.',
@@ -1033,15 +1035,18 @@
'fwdfw hint mac' => 'The destination group contains MAC addresses, which will be skipped during rule creation.',
'fwdfw iface' => 'Interface',
'fwdfw ipsec network' => 'IPsec networks:',
+'fwdfw limitconcon' => 'Limit concurrent connections per IP address',
'fwdfw log' => 'Log',
'fwdfw log rule' => 'Log rule',
'fwdfw man port' => 'Port(s):',
'fwdfw many' => 'Many',
+'fwdfw maxconcon' => 'Max. concurrent connections',
'fwdfw menu' => 'Firewall',
'fwdfw movedown' => 'Move down',
'fwdfw moveup' => 'Move up',
'fwdfw natport used' => 'The given port for NAPT is already in use by an other DNAT rule.',
'fwdfw newrule' => 'New rule',
+'fwdfw numcon' => 'Number of connections',
'fwdfw p2p txt' => 'Grant/deny access to P2P networks.',
'fwdfw pol allow' => 'Allowed',
'fwdfw pol block' => 'Blocked',
@@ -1050,6 +1055,7 @@
'fwdfw pol title' => 'Default firewall behaviour',
'fwdfw prot41' => 'IPv6 Encapsulation (Protocol 41)',
'fwdfw prot41 short' => 'IPv6 Encap',
+'fwdfw ratelimit' => 'Rate-limit new connections',
'fwdfw red' => 'RED',
'fwdfw reread' => 'Apply changes',
'fwdfw rule action' => 'Rule action:',
@@ -1138,7 +1144,7 @@
'fwhost err remark' => 'Invalid remark. Allowed characters: Upper- and lowercase letters, digits, space, dash, braces, semicolon, pipe and dot.',
'fwhost err srv exists' => 'A service with the same name already exists',
'fwhost err srvexist' => 'This service already exists in the group',
-'fwhost err sub32' => 'Please add a single host, not a network.',
+'fwhost err sub32' => 'Please add a network, not a single host',
'fwhost green' => 'Green',
'fwhost hint' => 'Note',
'fwhost hosts' => 'Firewall Hosts',
diff --git a/lfs/bash b/lfs/bash
index 58556fa..55afd24 100644
--- a/lfs/bash
+++ b/lfs/bash
@@ -89,15 +89,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
- for i in $$(seq 1 51); do \
+ for i in $$(seq 1 53); do \
cd $(DIR_APP) && patch -Np0 < $(DIR_SRC)/src/patches/bash/bash32-$$(printf "%03d" "$${i}") || exit 1; \
done
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/bash-4.0-paths-1.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/bash-4.0-profile-1.patch
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/bash-3.2-ssh_source_bash.patch
- cd $(DIR_APP) && patch -Np0 < $(DIR_SRC)/src/patches/bash-3.2-CVE-2014-6271.patch
- cd $(DIR_APP) && patch -Np0 < $(DIR_SRC)/src/patches/bash-3.2-CVE-2014-7169.patch
cd $(DIR_APP) && ./configure $(EXTRA_CONFIG)
cd $(DIR_APP) && make $(EXTRA_MAKE)
diff --git a/lfs/squid-accounting b/lfs/squid-accounting
index 6f0fdc3..0dca63f 100644
--- a/lfs/squid-accounting
+++ b/lfs/squid-accounting
@@ -15,7 +15,7 @@ THISAPP = squid-accounting-$(VER)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = squid-accounting
-PAK_VER = 2
+PAK_VER = 3
DEPS = "perl-DBI perl-DBD-SQLite perl-File-ReadBackwards perl-PDF-API2 sendEmail"
diff --git a/make.sh b/make.sh
index 2b8f769..23ef2b6 100755
--- a/make.sh
+++ b/make.sh
@@ -25,8 +25,8 @@
NAME="IPFire" # Software name
SNAME="ipfire" # Short name
VERSION="2.15" # Version number
-CORE="83" # Core Level (Filename)
-PAKFIRE_CORE="82" # Core Level (PAKFIRE)
+CORE="84" # Core Level (Filename)
+PAKFIRE_CORE="83" # Core Level (PAKFIRE)
GIT_BRANCH=`git rev-parse --abbrev-ref HEAD` # Git Branch
SLOGAN="www.ipfire.org" # Software slogan
CONFIG_ROOT=/var/ipfire # Configuration rootdir
diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index c7f8b67..66ca432 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -402,21 +402,11 @@ case "$1" in
boot_mesg "Setting up firewall"
iptables_init
evaluate_retval
-
- # run local firewall configuration, if present
- if [ -x /etc/sysconfig/firewall.local ]; then
- /etc/sysconfig/firewall.local start
- fi
;;
reload|up)
boot_mesg "Reloading firewall"
iptables_red_up
evaluate_retval
-
- # run local firewall configuration, if present
- if [ -x /etc/sysconfig/firewall.local ]; then
- /etc/sysconfig/firewall.local reload
- fi
;;
down)
boot_mesg "Disabling firewall access to RED"
@@ -424,10 +414,6 @@ case "$1" in
evaluate_retval
;;
restart)
- # run local firewall configuration, if present
- if [ -x /etc/sysconfig/firewall.local ]; then
- /etc/sysconfig/firewall.local stop
- fi
$0 start
;;
*)
diff --git a/src/paks/squid-accounting/install.sh b/src/paks/squid-accounting/install.sh
index f20b85f..835055a 100644
--- a/src/paks/squid-accounting/install.sh
+++ b/src/paks/squid-accounting/install.sh
@@ -31,5 +31,8 @@ if [ ! -f /var/ipfire/accounting/acct.db ]; then
chmod 644 /var/ipfire/accounting/acct.db
chown nobody.nobody /var/ipfire/accounting/acct.db
fi
+#Set right permissions of directory /srv/web/ipfire/html/accounting
+chown -R nobody.nobody /srv/web/ipfire/html/accounting
+chmod 755 -R /srv/web/ipfire/html/accounting
rm -f /var/ipfire/accounting/dbinstall.pl
/usr/local/bin/update-lang-cache
diff --git a/src/patches/bash-3.2-CVE-2014-6271.patch b/src/patches/bash-3.2-CVE-2014-6271.patch
deleted file mode 100644
index 3964916..0000000
--- a/src/patches/bash-3.2-CVE-2014-6271.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-*** ../bash-3.2.51/builtins/common.h 2006-03-06 09:38:44.000000000 -0500
---- builtins/common.h 2014-09-16 19:08:02.000000000 -0400
-***************
-*** 34,37 ****
---- 34,39 ----
-
- /* Flags for describe_command, shared between type.def and command.def */
-+ #define SEVAL_FUNCDEF 0x080 /* only allow function definitions */
-+ #define SEVAL_ONECMD 0x100 /* only allow a single command */
- #define CDESC_ALL 0x001 /* type -a */
- #define CDESC_SHORTDESC 0x002 /* command -V */
-*** ../bash-3.2.51/builtins/evalstring.c 2008-11-15 17:47:04.000000000 -0500
---- builtins/evalstring.c 2014-09-16 19:08:02.000000000 -0400
-***************
-*** 235,238 ****
---- 235,246 ----
- struct fd_bitmap *bitmap;
-
-+ if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
-+ {
-+ internal_warning ("%s: ignoring function definition attempt", from_file);
-+ should_jump_to_top_level = 0;
-+ last_result = last_command_exit_value = EX_BADUSAGE;
-+ break;
-+ }
-+
- bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
- begin_unwind_frame ("pe_dispose");
-***************
-*** 292,295 ****
---- 300,306 ----
- dispose_fd_bitmap (bitmap);
- discard_unwind_frame ("pe_dispose");
-+
-+ if (flags & SEVAL_ONECMD)
-+ break;
- }
- }
-*** ../bash-3.2.51/variables.c 2008-11-15 17:15:06.000000000 -0500
---- variables.c 2014-09-16 19:10:39.000000000 -0400
-***************
-*** 319,328 ****
- strcpy (temp_string + char_index + 1, string);
-
-! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
-!
-! /* Ancient backwards compatibility. Old versions of bash exported
-! functions like name()=() {...} */
-! if (name[char_index - 1] == ')' && name[char_index - 2] == '(')
-! name[char_index - 2] = '\0';
-
- if (temp_var = find_function (name))
---- 319,326 ----
- strcpy (temp_string + char_index + 1, string);
-
-! /* Don't import function names that are invalid identifiers from the
-! environment. */
-! if (legal_identifier (name))
-! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
-
- if (temp_var = find_function (name))
-***************
-*** 333,340 ****
- else
- report_error (_("error importing function definition for `%s'"), name);
--
-- /* ( */
-- if (name[char_index - 1] == ')' && name[char_index - 2] == '\0')
-- name[char_index - 2] = '('; /* ) */
- }
- #if defined (ARRAY_VARS)
---- 331,334 ----
diff --git a/src/patches/bash-3.2-CVE-2014-7169.patch b/src/patches/bash-3.2-CVE-2014-7169.patch
deleted file mode 100644
index 964b91f..0000000
--- a/src/patches/bash-3.2-CVE-2014-7169.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-*** ../bash-20140912/parse.y 2014-08-26 15:09:42.000000000 -0400
---- parse.y 2014-09-24 22:47:28.000000000 -0400
-***************
-*** 2959,2962 ****
---- 2959,2964 ----
- word_desc_to_read = (WORD_DESC *)NULL;
-
-+ eol_ungetc_lookahead = 0;
-+
- current_token = '\n'; /* XXX */
- last_read_token = '\n';
diff --git a/src/patches/bash/bash32-052 b/src/patches/bash/bash32-052
new file mode 100644
index 0000000..78e7d92
--- /dev/null
+++ b/src/patches/bash/bash32-052
@@ -0,0 +1,104 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.2
+Patch-ID: bash32-052
+
+Bug-Reported-by: Stephane Chazelas <stephane.chazelas(a)gmail.com>
+Bug-Reference-ID:
+Bug-Reference-URL:
+
+Bug-Description:
+
+Under certain circumstances, bash will execute user code while processing the
+environment for exported function definitions.
+
+Patch (apply with `patch -p0'):
+
+*** ../bash-3.2.51/builtins/common.h 2006-03-06 09:38:44.000000000 -0500
+--- builtins/common.h 2014-09-16 19:08:02.000000000 -0400
+***************
+*** 34,37 ****
+--- 34,39 ----
+
+ /* Flags for describe_command, shared between type.def and command.def */
++ #define SEVAL_FUNCDEF 0x080 /* only allow function definitions */
++ #define SEVAL_ONECMD 0x100 /* only allow a single command */
+ #define CDESC_ALL 0x001 /* type -a */
+ #define CDESC_SHORTDESC 0x002 /* command -V */
+*** ../bash-3.2.51/builtins/evalstring.c 2008-11-15 17:47:04.000000000 -0500
+--- builtins/evalstring.c 2014-09-16 19:08:02.000000000 -0400
+***************
+*** 235,238 ****
+--- 235,246 ----
+ struct fd_bitmap *bitmap;
+
++ if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
++ {
++ internal_warning ("%s: ignoring function definition attempt", from_file);
++ should_jump_to_top_level = 0;
++ last_result = last_command_exit_value = EX_BADUSAGE;
++ break;
++ }
++
+ bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
+ begin_unwind_frame ("pe_dispose");
+***************
+*** 292,295 ****
+--- 300,306 ----
+ dispose_fd_bitmap (bitmap);
+ discard_unwind_frame ("pe_dispose");
++
++ if (flags & SEVAL_ONECMD)
++ break;
+ }
+ }
+*** ../bash-3.2.51/variables.c 2008-11-15 17:15:06.000000000 -0500
+--- variables.c 2014-09-16 19:10:39.000000000 -0400
+***************
+*** 319,328 ****
+ strcpy (temp_string + char_index + 1, string);
+
+! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
+!
+! /* Ancient backwards compatibility. Old versions of bash exported
+! functions like name()=() {...} */
+! if (name[char_index - 1] == ')' && name[char_index - 2] == '(')
+! name[char_index - 2] = '\0';
+
+ if (temp_var = find_function (name))
+--- 319,326 ----
+ strcpy (temp_string + char_index + 1, string);
+
+! /* Don't import function names that are invalid identifiers from the
+! environment. */
+! if (legal_identifier (name))
+! parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
+
+ if (temp_var = find_function (name))
+***************
+*** 333,340 ****
+ else
+ report_error (_("error importing function definition for `%s'"), name);
+-
+- /* ( */
+- if (name[char_index - 1] == ')' && name[char_index - 2] == '\0')
+- name[char_index - 2] = '('; /* ) */
+ }
+ #if defined (ARRAY_VARS)
+--- 331,334 ----
+*** ../bash-3.2/patchlevel.h Thu Apr 13 08:31:04 2006
+--- patchlevel.h Mon Oct 16 14:22:54 2006
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 51
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 52
+
+ #endif /* _PATCHLEVEL_H_ */
diff --git a/src/patches/bash/bash32-053 b/src/patches/bash/bash32-053
new file mode 100644
index 0000000..e7efce7
--- /dev/null
+++ b/src/patches/bash/bash32-053
@@ -0,0 +1,54 @@
+ BASH PATCH REPORT
+ =================
+
+Bash-Release: 3.2
+Patch-ID: bash32-053
+
+Bug-Reported-by: Tavis Ormandy <taviso () cmpxchg8b com>
+Bug-Reference-ID:
+Bug-Reference-URL: http://twitter.com/taviso/statuses/514887394294652929
+
+Bug-Description:
+
+Under certain circumstances, bash can incorrectly save a lookahead character and
+return it on a subsequent call, even when reading a new line.
+
+Patch:
+
+*** ../bash-3.2.52/parse.y 2008-04-29 21:24:55.000000000 -0400
+--- parse.y 2014-09-25 16:18:41.000000000 -0400
+***************
+*** 2504,2507 ****
+--- 2504,2509 ----
+ word_desc_to_read = (WORD_DESC *)NULL;
+
++ eol_ungetc_lookahead = 0;
++
+ last_read_token = '\n';
+ token_to_read = '\n';
+*** ../bash-3.2.52/y.tab.c 2006-09-25 08:15:16.000000000 -0400
+--- y.tab.c 2014-09-25 20:28:17.000000000 -0400
+***************
+*** 3833,3836 ****
+--- 3833,3838 ----
+ word_desc_to_read = (WORD_DESC *)NULL;
+
++ eol_ungetc_lookahead = 0;
++
+ last_read_token = '\n';
+ token_to_read = '\n';
+*** ../bash-3.2/patchlevel.h Thu Apr 13 08:31:04 2006
+--- patchlevel.h Mon Oct 16 14:22:54 2006
+***************
+*** 26,30 ****
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 52
+
+ #endif /* _PATCHLEVEL_H_ */
+--- 26,30 ----
+ looks for to find the patch level (for the sccs version string). */
+
+! #define PATCHLEVEL 53
+
+ #endif /* _PATCHLEVEL_H_ */
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-09-26 11:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-09-26 11:14 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. d71bcfce59ceac8c5cb9d96ef33de10742d161aa git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox