From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fzhSq34v7z2yrL for ; Mon, 20 Apr 2026 10:25:15 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fzhSq2hPKz2xSM for ; Mon, 20 Apr 2026 10:25:15 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4fzhSp2hbFzPf for ; Mon, 20 Apr 2026 10:25:14 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1776680714; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=AMRuf7TO4sqFeVK2kOAsca7TVQfuZrNTtr2BBEjB0hY=; b=/krDrxaJqbL8j6R9UrLd6/w+C9J7hUBL0iIi/U7ZpNSrrMrtW/UhMOua8kol+lypw6Yf/w VKiwMVkMLqbKJ2Dg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1776680714; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=AMRuf7TO4sqFeVK2kOAsca7TVQfuZrNTtr2BBEjB0hY=; b=a+gIwhvYr2Fwmxwa10OQVY90n2hQkt4MUVEXJHBDXaARM5Exr/Hyi7ocefZfy/kXqjJjL3 2LZn08j9TiFqwJMxgHt9jSJnpFmjtMrbp/8Zv+8/BinuPfL2DljOy/GEMl6kvhwBiXguwP 59sK6FogI5L5yOszQTxpAAUEU+xVvYX7qftmiLYTVm6srxJBwHiyKfVBiFSXJxNjRyb3NR UWXKXNA0MONxvmpgR9z1BEvQVKw6InrgtqwKZARZBdCOJX1PvqPYb6NWPuRt7gOEt6HY4r gnDpiGI0/kQsBbVlfjFpZjB+uz8nSSTTkYyzUZ33aj/tNS9qXpxNLWwvmESODQ== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4fzhSp0h0kz2xZ2; Mon, 20 Apr 2026 10:25:14 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, master, updated. a7f578e949a385e79f1b39f5ac19d7fea32f4bed X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Oldrev: d3b06186321fb4a1315bb0fa39645f12b97dfe43 X-Git-Newrev: a7f578e949a385e79f1b39f5ac19d7fea32f4bed Message-Id: <4fzhSp0h0kz2xZ2@people01.haj.ipfire.org> Date: Mon, 20 Apr 2026 10:25:13 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via a7f578e949a385e79f1b39f5ac19d7fea32f4bed (commit) via fb248260597a1734a2c32137615a1e74fe536c05 (commit) via 171f4e965cc2419a584a0b7abfdc0b8a4087462c (commit) via 4d482385bcb91537003c54c081afc3ed1ad75f4f (commit) from d3b06186321fb4a1315bb0fa39645f12b97dfe43 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a7f578e949a385e79f1b39f5ac19d7fea32f4bed Author: Michael Tremer Date: Mon Apr 20 11:19:54 2026 +0100 dnsbl.cgi: Check if domain names are valid Signed-off-by: Michael Tremer commit fb248260597a1734a2c32137615a1e74fe536c05 Author: Michael Tremer Date: Mon Apr 20 11:10:48 2026 +0100 network-functions.pl: Convert IP addresses into networks on normalize Signed-off-by: Michael Tremer commit 171f4e965cc2419a584a0b7abfdc0b8a4087462c Author: Michael Tremer Date: Mon Apr 20 10:59:49 2026 +0100 dnsbl.cgi: Normalize all custom networks on the ACL Signed-off-by: Michael Tremer commit 4d482385bcb91537003c54c081afc3ed1ad75f4f Author: Michael Tremer Date: Mon Apr 20 10:59:24 2026 +0100 unbound: Fix typo in variable name This resulted in the ACLs not being properly split. Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/cfgroot/network-functions.pl | 17 +++++++++++++++++ html/cgi-bin/dnsbl.cgi | 17 +++++++++++++++++ src/initscripts/system/unbound | 2 +- 3 files changed, 35 insertions(+), 1 deletion(-) Difference in files: diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index ad89fc777..6716cfe4b 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -344,6 +344,23 @@ sub normalize_network($) { return "${address}/${prefix}"; } +sub normalize_networks($) { + my @networks = (); + + foreach my $network (@_) { + # Convert any IP addresses to networks + if (&check_ip_address($network)) { + push(@networks, "${network}/32"); + next; + } + + $network = &normalize_network($network); + push(@networks, $network); + } + + return @networks; +} + # Returns True if $address is in $network. sub ip_address_in_network($$) { my $address = shift; diff --git a/html/cgi-bin/dnsbl.cgi b/html/cgi-bin/dnsbl.cgi index 9b4e8dcab..c2f48381e 100644 --- a/html/cgi-bin/dnsbl.cgi +++ b/html/cgi-bin/dnsbl.cgi @@ -139,6 +139,9 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}") { } } + # Normalize all networks + @custom_acl = &Network::normalize_networks(@custom_acl); + # Only go further, if there was no error message. unless (scalar @errormessages) { # Read-in settings file. @@ -203,6 +206,20 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}") { push(@errormessages, "$dup - $Lang::tr{'dnsbl error domain specified twice'}"); } + # Check allowed domains + foreach my $domain (@ascii_allowed_domains) { + unless (&General::validfqdn($domain)) { + push(@errormessages, "$Lang::tr{'invalid domain name'}: ${domain}"); + } + } + + # Check blocked domains + foreach my $domain (@ascii_blocked_domains) { + unless (&General::validfqdn($domain)) { + push(@errormessages, "$Lang::tr{'invalid domain name'}: ${domain}"); + } + } + # Check if a domain from the posted blocked domains array is allready part of # the saved allowed domains array $dup = &compare_arrays(\@custom_allowed_domains, \@ascii_blocked_domains); diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index cc658432a..2be3b81f1 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -265,7 +265,7 @@ write_dnsbl_zones() { # Add any custom ACL if [ -n "${custom_acls}" ]; then - IFS='|' read -r -a custom_acl <<< "${custom_acls}" + IFS='|' read -r -a custom_acls <<< "${custom_acls}" local custom_acl for custom_acl in ${custom_acls[@]}; do hooks/post-receive -- IPFire 2.x development tree