From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4frwmP2Sgmz2yDM for ; Thu, 09 Apr 2026 10:15:17 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4frwmP2FyJz2xQW for ; Thu, 09 Apr 2026 10:15:17 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4frwmN6h68z2pp for ; Thu, 09 Apr 2026 10:15:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1775729716; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=j8pev4XJ20ul+aCTvJhXEs8kxYAzJFr4Y/7bI9a0MPM=; b=ZuhbjHrblAJPhWSmA8+cccEyiN02fdF0/+6KxekYWl6741+eivVqAg8MclClbOzl9TYYDc AUYCu+5SsjRPq8Cw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1775729716; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=j8pev4XJ20ul+aCTvJhXEs8kxYAzJFr4Y/7bI9a0MPM=; b=Djcp7GXBny0yLBVOwM+ur1nCEGmllLtvfL5I78XF9fh42Tim83TQRlU/W/Z2AcQBjNr9UY uotVyjQn7CY1wCqt76grIuZknymgCtiCydYrwoCedYWaJRp9qi9S8GJUSOKrfnRgbWAIMn FRAG1TEl3YgJ0MZGcMrEEvW+n8YzLcrvm2muvP6O2zXnTv5tugBrwRoKK97u7CVavQJEfc E3Dcyt0hH7IbObzFpawgqoUJCn0bDyRWe3IYv++I87JfrI7SYcjZMfNNnomdep7FaPw1MV ZtjDGuFu816WMtKA+1FJNJ5Cs8q+EsE4u0Cb+w8zHX7j+rgVe4U1sWcmlTHeoA== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4frwmN69vxz2xcL; Thu, 09 Apr 2026 10:15:16 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 71dd91ede170246c041d3b034234e1f3deabf79b X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: 01fad903a5a10884112042a3c311e73a4c78a71c X-Git-Newrev: 71dd91ede170246c041d3b034234e1f3deabf79b Message-Id: <4frwmN69vxz2xcL@people01.haj.ipfire.org> Date: Thu, 09 Apr 2026 10:15:16 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 71dd91ede170246c041d3b034234e1f3deabf79b (commit) via bcddbbb1c204821ae15ccf5425f83c0b5fb24188 (commit) via d3b06186321fb4a1315bb0fa39645f12b97dfe43 (commit) via 4b6370ca43c3df9303ae067bad26a1ee56046004 (commit) via e3c11ae3436b578432df0058eee229f262791254 (commit) from 01fad903a5a10884112042a3c311e73a4c78a71c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 71dd91ede170246c041d3b034234e1f3deabf79b Author: Michael Tremer Date: Thu Apr 9 10:14:47 2026 +0000 core202: Ship DNSBL changes Signed-off-by: Michael Tremer commit bcddbbb1c204821ae15ccf5425f83c0b5fb24188 Merge: 01fad903a d3b061863 Author: Michael Tremer Date: Thu Apr 9 10:14:15 2026 +0000 Merge branch 'master' into next ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/202/filelists/files | 2 + doc/language_issues.en | 1 + doc/language_issues.es | 1 + doc/language_issues.fr | 1 + doc/language_issues.it | 1 + doc/language_issues.nl | 1 + doc/language_issues.pl | 1 + doc/language_issues.ru | 1 + doc/language_issues.tr | 1 + doc/language_issues.tw | 1 + doc/language_issues.zh | 1 + doc/language_missings | 9 ++++ html/cgi-bin/dnsbl.cgi | 8 +++ langs/de/cgi-bin/de.pl | 3 +- langs/en/cgi-bin/en.pl | 1 + src/initscripts/system/unbound | 83 ++++++++++++++++--------------- 16 files changed, 75 insertions(+), 41 deletions(-) Difference in files: diff --git a/config/rootfiles/core/202/filelists/files b/config/rootfiles/core/202/filelists/files index ee0138114..6866afb14 100644 --- a/config/rootfiles/core/202/filelists/files +++ b/config/rootfiles/core/202/filelists/files @@ -1,5 +1,7 @@ etc/rc.d/init.d/firewall etc/rc.d/init.d/sysklogd +etc/rc.d/init.d/unbound +srv/web/ipfire/cgi-bin/dnsbl.cgi srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/services.cgi diff --git a/doc/language_issues.en b/doc/language_issues.en index 70377df36..109dc0f39 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -622,6 +622,7 @@ WARNING: untranslated string: dns title = Domain Name System WARNING: untranslated string: dns tls hostname = TLS Hostname WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: dnsforward = DNS Forwarding diff --git a/doc/language_issues.es b/doc/language_issues.es index d44baf3a0..0038f162f 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -1022,6 +1022,7 @@ WARNING: untranslated string: Captive ACTIVATE = unknown string WARNING: untranslated string: Captive clients = unknown string WARNING: untranslated string: ca name must only contain characters and spaces = unknown string WARNING: untranslated string: dns servers = DNS Servers +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: download report = Download Report diff --git a/doc/language_issues.fr b/doc/language_issues.fr index 142caa588..a00b1c646 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -1003,6 +1003,7 @@ WARNING: untranslated string: ca name must only contain characters and spaces = WARNING: untranslated string: configuration file = Configuration File WARNING: untranslated string: core notice 3 = available. WARNING: untranslated string: data transfer = Data Transfer +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: done = Done diff --git a/doc/language_issues.it b/doc/language_issues.it index ed649b021..fd5542e1f 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -1047,6 +1047,7 @@ WARNING: untranslated string: dns recursor mode = Recursor Mode WARNING: untranslated string: dns tls hostname = TLS Hostname WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 03f163ee7..94750b660 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -1046,6 +1046,7 @@ WARNING: untranslated string: dns recursor mode = Recursor Mode WARNING: untranslated string: dns tls hostname = TLS Hostname WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 6fbda032d..a0556cf95 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -1002,6 +1002,7 @@ WARNING: untranslated string: dns recursor mode = Recursor Mode WARNING: untranslated string: dns tls hostname = TLS Hostname WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: dnsforward = DNS Forwarding diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 261b917d9..6d233a776 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -1000,6 +1000,7 @@ WARNING: untranslated string: dns recursor mode = Recursor Mode WARNING: untranslated string: dns tls hostname = TLS Hostname WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: dnsforward = DNS Forwarding diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 856be4dde..622d52bb5 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -1028,6 +1028,7 @@ WARNING: untranslated string: dns recursor mode = Recursor Mode WARNING: untranslated string: dns tls hostname = TLS Hostname WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigned DNS servers WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled diff --git a/doc/language_issues.tw b/doc/language_issues.tw index c6299c27e..cf7d0163e 100644 --- a/doc/language_issues.tw +++ b/doc/language_issues.tw @@ -1030,6 +1030,7 @@ WARNING: untranslated string: Captive wrong type = Uploaded file has wrong filet WARNING: untranslated string: aliases default interface = - Default Interface - WARNING: untranslated string: ca name must only contain characters and spaces = unknown string WARNING: untranslated string: dns servers = DNS Servers +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: download report = Download Report diff --git a/doc/language_issues.zh b/doc/language_issues.zh index c6299c27e..cf7d0163e 100644 --- a/doc/language_issues.zh +++ b/doc/language_issues.zh @@ -1030,6 +1030,7 @@ WARNING: untranslated string: Captive wrong type = Uploaded file has wrong filet WARNING: untranslated string: aliases default interface = - Default Interface - WARNING: untranslated string: ca name must only contain characters and spaces = unknown string WARNING: untranslated string: dns servers = DNS Servers +WARNING: untranslated string: dnsbl acl explanation = By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied. WARNING: untranslated string: dnsbl dns firewall = DNS Firewall WARNING: untranslated string: dnsbl error domain specified twice = The domain cannot be allowed and blocked at the same time. WARNING: untranslated string: download report = Download Report diff --git a/doc/language_missings b/doc/language_missings index 9fafee2d2..a505fdd5d 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -161,6 +161,7 @@ < AES-256-GCM < CHACHA20-POLY1305 < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -267,6 +268,7 @@ < configuration file < data transfer < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -586,6 +588,7 @@ < Disabled < disconnected < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -1286,6 +1289,7 @@ < Disabled < disconnected < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -2051,6 +2055,7 @@ < disconnected < dnat address < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -3224,6 +3229,7 @@ < disk access < dnat address < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -4261,6 +4267,7 @@ < Disabled < disconnected < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -4708,6 +4715,7 @@ < Captive wrong type < CHACHA20-POLY1305 < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall @@ -4822,6 +4830,7 @@ < Captive wrong type < CHACHA20-POLY1305 < dnsbl acl +< dnsbl acl explanation < dnsbl custom block and allow list < dnsbl custom source < dnsbl dns firewall diff --git a/html/cgi-bin/dnsbl.cgi b/html/cgi-bin/dnsbl.cgi index 16e6dded2..9b4e8dcab 100644 --- a/html/cgi-bin/dnsbl.cgi +++ b/html/cgi-bin/dnsbl.cgi @@ -400,6 +400,14 @@ print < + + +

+ $Lang::tr{'dnsbl acl explanation'} +

+ + + $Lang::tr{"network zone"} diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 623ec4ef6..d7f8148f3 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -457,7 +457,7 @@ 'available' => 'verfügbar', 'average' => 'Durchschnitt', 'avoid dod' => 'Benutzen Sie diese Option nicht mit Dial on Demand! Wird hauptsächlich verwendet, wenn Ihr IPFire sich hinter einem Router befindet. Ihre ROTE IP muss sich innerhalb eines der drei reservierten Netzwerkbereiche befinden z.B. 10/8, 172.16/12, 192.168/16.', -'back' => 'ZURÜCK', +'back' => 'Zurück', 'backup' => 'Datensicherung', 'backup config floppy' => 'Backup-Konfiguration - Diskette', 'backup configuration' => 'Backup-Konfiguration:', @@ -859,6 +859,7 @@ 'dns use isp assigned nameservers' => 'Vom ISP zugewiesene DNS-Server verwenden', 'dns use protocol for dns queries' => 'Für DNS-Anfragen zu verwendendes Protokoll', 'dnsbl acl' => 'Zugriffskontrolle', +'dnsbl acl explanation' => 'Standardmäßig wird die Blockierung auf das gesamte Netzwerk angewendet. Sie können optional nur bestimmte Netzwerkzonen, Hosts oder Subnetze konfigurieren, für die diese Kategorie gelten soll.', 'dnsbl custom block and allow list' => 'Individuelle Block- und Freigabeliste', 'dnsbl custom source' => 'Benutzerdefinierte Quelle', 'dnsbl dns firewall' => 'DNS-Firewall', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 2c49106d1..1685a7032 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -908,6 +908,7 @@ 'dns use isp assigned nameservers' => 'Use ISP-assigned DNS servers', 'dns use protocol for dns queries' => 'Protocol for DNS queries', 'dnsbl acl' => 'Access Control', +'dnsbl acl explanation' => 'By default, the blocking will apply to the entire network. You may configure only a few network zones, hosts or subnets where this category will be applied.', 'dnsbl custom block and allow list' => 'Custom Block And Allow List', 'dnsbl custom source' => 'Custom source', 'dnsbl dns firewall' => 'DNS Firewall', diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index 7020cd7b6..cc658432a 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -233,8 +233,11 @@ write_dnsbl_zones() { return 0 fi + # Collect all networks + local -A networks=() + while IFS=$'\t' read -r name zone primary; do - while IFS=$',' read -r _zone enabled comment enabled_zones custom_acl rest; do + while IFS=$',' read -r _zone enabled comment enabled_zones custom_acls rest; do # Skip if we are looking at the wrong list [ "${zone}" = "${_zone}" ] || continue @@ -246,25 +249,45 @@ write_dnsbl_zones() { return 1 fi + # Nothing more to do if there are no ACLs set + if [ -z "${enabled_zones}" -a -z "${custom_acls}" ]; then + continue + fi + # Limit to specific zones if [ -n "${enabled_zones}" ]; then IFS='|' read -r -a enabled_zones <<< "${enabled_zones}" - if ! write_dnsbl_acl "${zone}" "${enabled_zones[@]}"; then + if ! add_dnsbl_acl "${zone}" "${enabled_zones[@]}"; then return 1 fi fi # Add any custom ACL - if [ -n "${custom_acl}" ]; then - IFS='|' read -r -a custom_acl <<< "${custom_acl}" + if [ -n "${custom_acls}" ]; then + IFS='|' read -r -a custom_acl <<< "${custom_acls}" - if ! write_dnsbl_custom_acl "${zone}" "${custom_acl[@]}"; then - return 1 - fi + local custom_acl + for custom_acl in ${custom_acls[@]}; do + networks["${custom_acl}"]+=" ${zone}" + done fi done < /var/ipfire/dns/dnsbl done <<< "$(jq -r '.[] | [.name, .zone, .primary] | @tsv' /var/ipfire/dns/dnsbl.json)" + + # Emit all ACLs + if [ -n "${networks[*]}" ]; then + local network + + echo "# Write the ACL" + echo "server:" + + for network in "${!networks[@]}"; do + echo " access-control-tag: ${network} \"${networks[${network}]:1}\"" + done + fi + + return 0 } write_custom_zone() { @@ -325,18 +348,22 @@ rpz: rpz-log: yes rpz-log-name: ${zone} - # Tags - tags: "${zone}" - EOF + + # If any ACLs are defined, add the tag + if [ -n "${enabled_zones}" -o -n "${custom_acls}" ]; then + echo " # Tags" + echo " tags: ${zone}" + echo + fi + + return 0 } -write_dnsbl_acl() { +add_dnsbl_acl() { local tag="${1}" shift - echo "server:" - local zone for zone in $@; do case "${zone}" in @@ -380,34 +407,9 @@ write_dnsbl_acl() { ;; esac - # Add the ACL tag - if [ -n "${network}" ]; then - echo " access-control-tag: ${network} \"${tag}\"" - fi - done - - echo # empty line -} - -write_dnsbl_custom_acl() { - local tag="${1}" - shift - - # Do nothing if there are no hosts listed - if [ $# -eq 0 ]; then - return 0 - fi - - local acl - - echo "server:" - - # List all ACLs - for acl in $@; do - echo " access-control-tag: ${acl} \"${tag}\"" + # Append to the network slot + networks["${network}"]+=" ${tag}" done - - echo # empty line } write_dnsbl_conf() { @@ -429,6 +431,7 @@ rpz: # Log all matches rpz-log: yes rpz-log-name: custom + EOF fi hooks/post-receive -- IPFire 2.x development tree