From: Arne Fitzenreiter Date: Thu, 14 Oct 2010 06:29:18 +0000 (+0200) Subject: Merge branch 'next' of ssh://arne_f@git.ipfire.org/pub/git/ipfire-2.x into next X-Git-Tag: v2.9-beta1~48^2~5^2~2^2~60 X-Git-Url: http://git.ipfire.org/?p=people%2Fpmueller%2Fipfire-2.x.git;a=commitdiff_plain;h=a4aae93d9616aff917de21317a917246f9417b07;hp=e21bd39e1271891eb3105e980c85bdd72306ccbd Merge branch 'next' of ssh://arne_f@git.ipfire.org/pub/git/ipfire-2.x into next Conflicts: doc/packages-list.txt --- diff --git a/config/guardian/guardian.pl b/config/guardian/guardian.pl index 0c37c34f4f..c7fd5f8656 100644 --- a/config/guardian/guardian.pl +++ b/config/guardian/guardian.pl @@ -50,6 +50,8 @@ print "My gatewayaddess is: $gatewayaddr\n"; # destination was found. "$hostipaddr" => 1); +&get_aliases; + %sshhash = (); if ( -e $targetfile ) { @@ -186,8 +188,8 @@ sub ipchain { my ($source, $dest, $type) = @_; &write_log ("$source\t$type\n"); if ($hash{$source} eq "") { - &write_log ("Running '$blockpath $source'\n"); - system ("$blockpath $source"); + &write_log ("Running '$blockpath $source $interface'\n"); + system ("$blockpath $source $interface"); $hash{$source} = time() + $TimeLimit; } else { # We have already blocked this one, but snort detected another attack. So @@ -244,6 +246,9 @@ sub load_conf { } if (/Interface\s+(.*)/) { $interface = $1; + if ( $interface eq "" ) { + $interface = `cat /var/ipfire/ethernet/settings | grep RED_DEV | cut -d"=" -f2`; + } } if (/AlertFile\s+(.*)/) { $alert_file = $1; @@ -265,16 +270,13 @@ sub load_conf { } } - if ($interface eq "") { - die "Fatal! Interface is undefined.. Please define it in $opt_o with keyword Interface\n"; - } if ($alert_file eq "") { print "Warning! AlertFile is undefined.. Assuming /var/log/snort.alert\n"; $alert_file="/var/log/snort.alert"; } if ($hostipaddr eq "") { print "Warning! HostIpAddr is undefined! Attempting to guess..\n"; - $hostipaddr = &get_ip($interface); + $hostipaddr = `cat /var/ipfire/red/local-ipaddress`; print "Got it.. your HostIpAddr is $hostipaddr\n"; } if ($ignorefile eq "") { @@ -345,30 +347,9 @@ sub daemonize { } } -sub get_ip { - my ($interface) = $_[0]; - my $ip; - open (IFCONFIG, "/bin/netstat -iee |grep $interface -A7 |"); - while () { - if ($OS eq "FreeBSD") { - if (/inet (\d+\.\d+\.\d+\.\d+)/) { - $ip = $1; - } - } - if ($OS eq "Linux") { - if (/inet addr:(\d+\.\d+\.\d+\.\d+)/) { - $ip = $1; - } - } - } - close (IFCONFIG); - - if ($ip eq "") { die "Couldn't figure out the ip address\n"; } - $ip; - } - sub sig_handler_setup { - $SIG{TERM} = \&clean_up_and_exit; # kill + $SIG{INT} = \&clean_up_and_exit; # kill -2 + $SIG{TERM} = \&clean_up_and_exit; # kill -9 $SIG{QUIT} = \&clean_up_and_exit; # kill -3 # $SIG{HUP} = \&flush_and_reload; # kill -1 } @@ -387,7 +368,7 @@ sub remove_blocks { sub call_unblock { my ($source, $message) = @_; &write_log ("$message"); - system ("$unblockpath $source"); + system ("$unblockpath $source $interface"); } sub clean_up_and_exit { @@ -412,3 +393,22 @@ sub load_targetfile { close (TARG); print "Loaded $count addresses from $targetfile\n"; } + +sub get_aliases { + my $ip; + print "Scanning for aliases on $interface and add them to the target hash..."; + + open (IFCONFIG, "/sbin/ip addr show $interface |"); + my @lines = ; + close(IFCONFIG); + + foreach $line (@lines) { + if ( $line =~ /inet (\d+\.\d+\.\d+\.\d+)/) { + $ip = $1; + print " got $ip on $interface ... "; + $targethash{'$ip'} = "1"; + } + } + + print "done \n"; +} \ No newline at end of file diff --git a/config/guardian/guardian_block.sh b/config/guardian/guardian_block.sh index 0a44325f18..a8331faaa1 100644 --- a/config/guardian/guardian_block.sh +++ b/config/guardian/guardian_block.sh @@ -2,10 +2,11 @@ # this is a sample block script for guardian. This should work with ipchains. # This command gets called by guardian as such: -# guardian_block.sh +# guardian_block.sh # and the script will issue a command to block all traffic from that source ip # address. The logic of weither or not it is safe to block that address is # done inside guardian itself. source=$1 +interface=$2 -/sbin/iptables -I GUARDIANINPUT -s $source -j DROP +/sbin/iptables -I GUARDIAN -s $source -i $interface -j DROP diff --git a/config/guardian/guardian_unblock.sh b/config/guardian/guardian_unblock.sh index e0d3b5d481..315d771951 100644 --- a/config/guardian/guardian_unblock.sh +++ b/config/guardian/guardian_unblock.sh @@ -2,8 +2,9 @@ # this is a sample unblock script for guardian. This should work with ipchains. # This command gets called by guardian as such: -# unblock.sh +# unblock.sh # and the script will issue a command to remove the block that was created with # block.sh address. source=$1 +interface=$2 -/sbin/iptables -D GUARDIANINPUT -s $source -j DROP +/sbin/iptables -D GUARDIAN -s $source -i $interface -j DROP diff --git a/doc/packages-list.txt b/doc/packages-list.txt index dac3ba473d..4d9d11e9b6 100644 --- a/doc/packages-list.txt +++ b/doc/packages-list.txt @@ -160,6 +160,7 @@ * igb-2.3.4-kmod-2.6.32.24-ipfire-xen * igmpproxy-0.1 * imspector-0.9 +* imspector-20101008 * inetutils-1.4.2 * ipaddr-1.2 * iperf-2.0.4 @@ -316,6 +317,7 @@ * rsync-3.0.7 * rtorrent-0.8.6 * samba-3.5.5 +* samba-3.5.6 * sane-1.0.19 * screen-4.0.3 * sdparm-1.01 @@ -330,7 +332,7 @@ * spandsp-0.0.6pre12 * splix-2.0.0-rc2 * sqlite-3.6.10 -* squid-2.7.STABLE9 +* squid-3.1.8 * squidGuard-1.4.1 * squidclamav-5.4 * sshfs-fuse-2.2 @@ -373,6 +375,7 @@ * vnstat-1.6 * vnstati-beta3 * vsftpd-2.1.2 +* vsftpd-2.2.2 * w_scan-20080105 * watchdog-5.9 * wget-1.10.2 diff --git a/html/cgi-bin/outgoinggrp.cgi b/html/cgi-bin/outgoinggrp.cgi index f99468e4fc..a00db2a741 100644 --- a/html/cgi-bin/outgoinggrp.cgi +++ b/html/cgi-bin/outgoinggrp.cgi @@ -137,7 +137,7 @@ $ipgroupcontent =~ s/\n/
/g; &Header::openbox('100%', 'center', $Lang::tr{'outgoing firewall ip groups'}); print < +
@@ -214,7 +214,7 @@ $macgroupcontent =~ s/\n/
/g; &Header::openbox('100%', 'center', $Lang::tr{'outgoing firewall mac groups'}); print < +
diff --git a/html/cgi-bin/urlfilter.cgi b/html/cgi-bin/urlfilter.cgi index eea32bff22..1bfc0392cd 100644 --- a/html/cgi-bin/urlfilter.cgi +++ b/html/cgi-bin/urlfilter.cgi @@ -1213,6 +1213,10 @@ print <$Lang::tr{'urlfilter blocked domains'} * + + + +
$Lang::tr{'urlfilter blocked urls'} *
$Lang::tr{'urlfilter example'}$Lang::tr{'urlfilter example ads'}