Merge remote-tracking branch 'ms/strongswan-next' into strongswan-next

diff --git a/config/backup/include b/config/backup/include
index 8463a89493c5d98776037a06adc000b84bda8c10..c863a0e560ed525c74653fe612be75249a75a64f 100644 (file)
--- a/config/backup/include
+++ b/config/backup/include
@@ -14,6 +14,7 @@
 /etc/ssh/ssh_host*
 /var/ipfire/auth/users
 /var/ipfire/dhcp/*
+/var/ipfire/dnsforward/*
 /var/ipfire/main/*
 /var/ipfire/outgoing/groups
 /var/ipfire/outgoing/macgroups

diff --git a/config/backup/includes/vdr b/config/backup/includes/vdr
index 38bd82a4426c722b9f2aae3019cf2a3f01e70de1..a2b5d83f06f3a9cd89f4209b491dfcb06381a766 100644 (file)
--- a/config/backup/includes/vdr
+++ b/config/backup/includes/vdr
@@ -1 +1,2 @@
 /etc/vdr
+/etc/sysconfig/vdr

diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot
index 3910b36a73258926faa8a11f0ee99aa26217c70c..cd33ec496ce72a93eaf29979373d8bbf0225a187 100644 (file)
--- a/config/rootfiles/common/configroot
+++ b/config/rootfiles/common/configroot
@@ -30,6 +30,8 @@ var/ipfire/dmzholes
 #var/ipfire/dmzholes/config
 var/ipfire/dns
 #var/ipfire/dns/settings
+var/ipfire/dnsforward
+#var/ipfire/dnsforward/config
 var/ipfire/ethernet
 #var/ipfire/ethernet/aliases
 #var/ipfire/ethernet/known_nics

diff --git a/config/rootfiles/core/71/filelists/files b/config/rootfiles/core/71/filelists/files
index 9dd0e30eda637a2f04bbf8568162396029720d86..c7df219c63cc9d39057445fde1f32479d66d2584 100644 (file)
--- a/config/rootfiles/core/71/filelists/files
+++ b/config/rootfiles/core/71/filelists/files
@@ -19,6 +19,7 @@ srv/web/ipfire/cgi-bin/ids.cgi
 srv/web/ipfire/cgi-bin/proxy.cgi
 srv/web/ipfire/cgi-bin/pppsetup.cgi
 srv/web/ipfire/cgi-bin/wirelessclient.cgi
+var/ipfire/dnsforward/config
 var/ipfire/general-functions.pl
 var/ipfire/langs
 var/ipfire/backup/include

diff --git a/config/rootfiles/core/72/exclude b/config/rootfiles/core/72/exclude
new file mode 100644 (file)
index 0000000..321a931
--- /dev/null
+++ b/config/rootfiles/core/72/exclude
@@ -0,0 +1,17 @@
+srv/web/ipfire/html/proxy.pac
+boot/config.txt
+etc/udev/rules.d/30-persistent-network.rules
+etc/collectd.custom
+etc/shadow
+etc/ipsec.conf
+etc/ipsec.secrets
+etc/ipsec.user.conf
+etc/ipsec.user.secrets
+var/log/cache
+var/updatecache
+etc/localtime
+var/ipfire/ovpn
+etc/ssh/ssh_config
+etc/ssh/sshd_config
+etc/ssl/openssl.cnf
+var/state/dhcp/dhcpd.leases

diff --git a/config/rootfiles/core/72/filelists/files b/config/rootfiles/core/72/filelists/files
new file mode 100644 (file)
index 0000000..efa4759
--- /dev/null
+++ b/config/rootfiles/core/72/filelists/files
@@ -0,0 +1,3 @@
+etc/system-release
+etc/issue
+usr/local/bin/openvpnctrl

diff --git a/config/rootfiles/core/72/meta b/config/rootfiles/core/72/meta
new file mode 100644 (file)
index 0000000..d547fa8
--- /dev/null
+++ b/config/rootfiles/core/72/meta
@@ -0,0 +1 @@
+DEPS=""

diff --git a/config/rootfiles/core/72/update.sh b/config/rootfiles/core/72/update.sh
new file mode 100644 (file)
index 0000000..f365abb
--- /dev/null
+++ b/config/rootfiles/core/72/update.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+############################################################################
+#                                                                          #
+# This file is part of the IPFire Firewall.                                #
+#                                                                          #
+# IPFire is free software; you can redistribute it and/or modify           #
+# it under the terms of the GNU General Public License as published by     #
+# the Free Software Foundation; either version 3 of the License, or        #
+# (at your option) any later version.                                      #
+#                                                                          #
+# IPFire is distributed in the hope that it will be useful,                #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of           #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
+# GNU General Public License for more details.                             #
+#                                                                          #
+# You should have received a copy of the GNU General Public License        #
+# along with IPFire; if not, write to the Free Software                    #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
+#                                                                          #
+# Copyright (C) 2013 IPFire-Team <info@ipfire.org>.                        #
+#                                                                          #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+/usr/local/bin/backupctrl exclude >/dev/null 2>&1
+
+#
+# Remove old core updates from pakfire cache to save space...
+core=72
+for (( i=1; i<=$core; i++ ))
+do
+       rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
+done
+
+#
+#Stop services
+
+
+#
+#Extract files
+extract_files
+
+
+#
+#Start services
+
+#
+#Update Language cache
+#perl -e "require '/var/ipfire/lang.pl'; &Lang::BuildCacheLang"
+
+sync
+
+# This update need a reboot...
+#touch /var/run/need_reboot
+
+#
+#Finish
+/etc/init.d/fireinfo start
+sendprofile
+#Don't report the exitcode last command
+exit 0
+

diff --git a/config/vdr/vdr.sysconfig b/config/vdr/vdr.sysconfig
index a1cebf10f808a58dac1da6e54a32dacbd822e509..9c7906912c9c1ca6a1a8573e5ebec099d6a975b8 100644 (file)
--- a/config/vdr/vdr.sysconfig
+++ b/config/vdr/vdr.sysconfig
@@ -3,7 +3,7 @@
 # The "master" options.  Some examples of options you may want to set
 # here are -r, -t, and --rcu.  See the vdr(1) man page for more info.
 #
-VDR_OPTIONS=(--vfat)
+VDR_OPTIONS=(--vfat --log=1)
 
 # VDR_PLUGIN_ORDER is a space separated list of plugins that should be
 # loaded in a specific order.  This affects eg. the order the plugins'

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index a4953ffe496185991e6ecd70996160604d391258..5e18d3cb53bf1a01e15565d7a78d50845185f2b0 100644 (file)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -127,21 +127,6 @@ sub sizeformat{
     return("$newsize $units[$i]");
 }
 
-sub valid_dns_host {
-       my $hostname = $_[0];
-       unless ($hostname) { return "No hostname"};
-       my $res = new Net::DNS::Resolver;
-       my $query = $res->search("$hostname");
-       if ($query) {
-               foreach my $rr ($query->answer) {
-                       ## Potential bug - we are only looking at A records:
-                       return 0 if $rr->type eq "A";
-               }
-       } else {
-               return $res->errorstring;
-       }
-}
-
 sub cleanssldatabase
 {
     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
@@ -982,7 +967,11 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
   print SERVERCONF "persist-key\n";
   print SERVERCONF "script-security 2\n";
   print SERVERCONF "# IP/DNS for remote Server Gateway\n"; 
+
+  if ($cgiparams{'REMOTE'} ne '') {
   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
+  }
+
   print SERVERCONF "float\n";
   print SERVERCONF "# IP adresses of the VPN Subnet\n"; 
   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n"; 
@@ -2339,6 +2328,9 @@ ADV_ERROR:
     if ($cgiparams{'LOG_VERB'} eq '') {
        $cgiparams{'LOG_VERB'} =  '3';
     }
+    if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
+       $cgiparams{'PMTU_DISCOVERY'} = 'off';
+    }
     $checked{'CLIENT2CLIENT'}{'off'} = '';
     $checked{'CLIENT2CLIENT'}{'on'} = '';
     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
@@ -3520,6 +3512,14 @@ if ($cgiparams{'TYPE'} eq 'net') {
       goto VPNCONF_ERROR;                      
                }
 
+    # Check if the input for the transfer net is valid.
+    if (!&General::validipandmask($cgiparams{'OVPN_SUBNET'})){
+                       $errormessage = $Lang::tr{'ccd err invalidnet'};
+                       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+           rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+                       goto VPNCONF_ERROR;
+               }
+
     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
                        $errormessage = $Lang::tr{'openvpn subnet is used'};
                        unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
@@ -3603,34 +3603,38 @@ if ($cgiparams{'TYPE'} eq 'net') {
            }
        }
 
-       if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
+       # Check if a remote host/IP has been set for the client.
+       if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'SIDE'} ne 'server') {
            $errormessage = $Lang::tr{'invalid input for remote host/ip'};
+
+           # Check if this is a N2N connection and drop temporary config.
            if ($cgiparams{'TYPE'} eq 'net') {
-      unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-           rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-      }
+               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+           }
            goto VPNCONF_ERROR;
        }
 
-       if ($cgiparams{'REMOTE'}) {
+       # Check if a remote host/IP has been configured - the field can be empty on the server side.
+       if ($cgiparams{'REMOTE'} ne '') {
+
+           # Check if the given IP is valid - otherwise check if it is a valid domain.
            if (! &General::validip($cgiparams{'REMOTE'})) {
+
+               # Check for a valid domain.
                if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
                    $errormessage = $Lang::tr{'invalid input for remote host/ip'};
+
+                   # Check if this is a N2N connection and drop temporary config.
                    if ($cgiparams{'TYPE'} eq 'net') {
-        unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-        }
+                       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+                   }
                    goto VPNCONF_ERROR;
-               } else {
-                   if (&valid_dns_host($cgiparams{'REMOTE'})) {
-                       $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
-                       if ($cgiparams{'TYPE'} eq 'net') {
-
-      }
-                   }
                }
            }
        }
+
        if ($cgiparams{'TYPE'} ne 'host') {
             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
                    $errormessage = $Lang::tr{'local subnet is invalid'}; 
@@ -4147,6 +4151,9 @@ if ($cgiparams{'TYPE'} eq 'net') {
     $checked{'MSSFIX'}{'on'} = '';
     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
 
+    if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
+       $cgiparams{'PMTU_DISCOVERY'} = 'off';
+    }
     $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
 
 

diff --git a/lfs/configroot b/lfs/configroot
index 1f84a1691bbea53fa1164512ff751f0c4e4f77fd..1185236851fa6f695658bcc5db720f121d31a661 100644 (file)
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -50,7 +50,7 @@ $(TARGET) :
        @$(PREBUILD)
 
        # Create all directories
-       for i in addon-lang auth backup ca certs connscheduler crls ddns dhcp dhcpc dmzholes dns \
+       for i in addon-lang auth backup ca certs connscheduler crls ddns dhcp dhcpc dmzholes dns dnsforward \
                        ethernet extrahd/bin fwlogs isdn key langs logging mac main  menu.d modem net-traffic \
                        net-traffic/templates nfs optionsfw outgoing/bin outgoing/groups outgoing/groups/ipgroups \
                        outgoing/groups/macgroups ovpn patches pakfire portfw ppp private proxy/advanced/cre \
@@ -63,7 +63,7 @@ $(TARGET) :
        # Touch empty files
        for i in auth/users backup/include.user backup/exclude.user \
            certs/index.txt ddns/config ddns/noipsettings ddns/settings ddns/ipcache dhcp/settings \
-           dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dmzholes/config dns/settings ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
+           dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dmzholes/config dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
            ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings fwlogs/ipsettings fwlogs/portsettings \
            isdn/settings mac/settings main/disable_nf_sip main/hosts main/routing main/settings net-traffic/settings optionsfw/settings outgoing/settings outgoing/rules \
            ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \

diff --git a/lfs/transmission b/lfs/transmission
index b20ae8852d788550957473fcd90e3bd35789bff0..9d5dfa578813bd2736447ca5ac2d912260a526a0 100644 (file)
--- a/lfs/transmission
+++ b/lfs/transmission
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.80
+VER        = 2.81
 
 THISAPP    = transmission-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -32,7 +32,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = transmission
-PAK_VER    = 7
+PAK_VER    = 8
 
 DEPS       = "libevent2"
 
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 2bde600d4b0a75d0bd3784550d59a8af
+$(DL_FILE)_MD5 = db1ad10ecff07150486dab2365ccb3a8
 
 install : $(TARGET)
 

diff --git a/lfs/vdr b/lfs/vdr
index 0dd2c0f4628ab3960e895a583e00d7213fbbf570..b1feb0152c3352cc0457124ac242071ebf5d547d 100644 (file)
--- a/lfs/vdr
+++ b/lfs/vdr
@@ -33,7 +33,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = vdr
-PAK_VER    = 6
+PAK_VER    = 7
 
 DEPS       = "vdr_streamdev"
 

diff --git a/make.sh b/make.sh
index 35912b71c89f9f29b41d06f37b85992ead691516..786d91778544dd509b7aa1dc1c0d37f8e7866b36 100755 (executable)
--- a/make.sh
+++ b/make.sh
@@ -25,7 +25,7 @@
 NAME="IPFire"                                                  # Software name
 SNAME="ipfire"                                                 # Short name
 VERSION="2.13"                                                 # Version number
-CORE="71"                                                      # Core Level (Filename)
+CORE="72"                                                      # Core Level (Filename)
 PAKFIRE_CORE="71"                                              # Core Level (PAKFIRE)
 GIT_BRANCH=`git status | head -n1 | cut -d" " -f4`             # Git Branch
 SLOGAN="www.ipfire.org"                                                # Software slogan

diff --git a/src/misc-progs/openvpnctrl.c b/src/misc-progs/openvpnctrl.c
index e366294b572ab796e54fc6deb196e920af27365d..76916f147cb009a587fdee449a2f37303468e70a 100644 (file)
--- a/src/misc-progs/openvpnctrl.c
+++ b/src/misc-progs/openvpnctrl.c
@@ -362,6 +362,10 @@ char* calcTransferNetAddress(const connection* conn) {
        char *subnetmask = strdup(conn->transfer_subnet);
        char *address = strsep(&subnetmask, "/");
 
+       if ((address == NULL) || (subnetmask == NULL)) {
+               goto ERROR;
+       }
+
        in_addr_t _address    = inet_addr(address);
        in_addr_t _subnetmask = inet_addr(subnetmask);
        _address &= _subnetmask;
@@ -496,12 +500,11 @@ void setFirewallRules(void) {
                        local_subnet_address = getLocalSubnetAddress(conn);
                        transfer_subnet_address = calcTransferNetAddress(conn);
 
-                       if ((!local_subnet_address) || (!transfer_subnet_address))
-                               continue;
-
-                       snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
-                               OVPNNAT, transfer_subnet_address, local_subnet_address);
-                       executeCommand(command);
+                       if ((local_subnet_address) && (transfer_subnet_address)) {
+                               snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
+                                       OVPNNAT, transfer_subnet_address, local_subnet_address);
+                               executeCommand(command);
+                       }
                }
 
                conn = conn->next;