Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

config/firewall/firewall-lib.pl

@@ -391,8 +391,9 @@ sub get_address
 	# IPsec networks.
 	} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
 		my $network_address = &get_ipsec_net_ip($value, 11);
-		if ($network_address) {
-			push(@ret, [$network_address, ""]);
+		my @nets = split(/\|/, $network_address);
+		foreach my $net (@nets) {
+			push(@ret, [$net, ""]);
 		}
 
 	# The firewall's own IP addresses.

config/rootfiles/common/armv5tel/initscripts

@@ -62,7 +62,6 @@ etc/rc.d/init.d/mounttmpfs
 #etc/rc.d/init.d/netsnmpd
 etc/rc.d/init.d/network
 etc/rc.d/init.d/network-trigger
-etc/rc.d/init.d/network-vlans
 #etc/rc.d/init.d/networking
 etc/rc.d/init.d/networking/any
 etc/rc.d/init.d/networking/blue
@@ -232,7 +231,6 @@ etc/rc.d/rcsysinit.d/S75firstsetup
 etc/rc.d/rcsysinit.d/S80localnet
 etc/rc.d/rcsysinit.d/S85firewall
 etc/rc.d/rcsysinit.d/S90network-trigger
-etc/rc.d/rcsysinit.d/S91network-vlans
 etc/rc.d/rcsysinit.d/S92rngd
 etc/rc.d/rc3.d/S15fireinfo
 #etc/sysconfig

config/rootfiles/common/i586/initscripts

@@ -64,7 +64,6 @@ etc/rc.d/init.d/mounttmpfs
 #etc/rc.d/init.d/netsnmpd
 etc/rc.d/init.d/network
 etc/rc.d/init.d/network-trigger
-etc/rc.d/init.d/network-vlans
 #etc/rc.d/init.d/networking
 etc/rc.d/init.d/networking/any
 etc/rc.d/init.d/networking/blue
@@ -237,7 +236,6 @@ etc/rc.d/rcsysinit.d/S75firstsetup
 etc/rc.d/rcsysinit.d/S80localnet
 etc/rc.d/rcsysinit.d/S85firewall
 etc/rc.d/rcsysinit.d/S90network-trigger
-etc/rc.d/rcsysinit.d/S91network-vlans
 etc/rc.d/rcsysinit.d/S92rngd
 etc/rc.d/rc3.d/S15fireinfo
 #etc/sysconfig

config/rootfiles/common/udev

@@ -29,6 +29,7 @@ lib/udev
 #lib/udev/init-net-rules.sh
 #lib/udev/mtd_probe
 #lib/udev/network-hotplug-rename
+#lib/udev/network-hotplug-vlan
 #lib/udev/rule_generator.functions
 #lib/udev/rules.d
 #lib/udev/rules.d/25-alsa.rules

config/rootfiles/core/95/filelists/files

@@ -0,0 +1,8 @@
+etc/system-release
+etc/issue
+lib/udev/network-hotplug-vlan
+lib/udev/rules.d/60-net.rules
+srv/web/ipfire/cgi-bin/connections.cgi
+srv/web/ipfire/cgi-bin/vpnmain.cgi
+usr/lib/firewall/firewall-lib.pl
+var/ipfire/langs

config/rootfiles/core/95/update.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+############################################################################
+#                                                                          #
+# This file is part of the IPFire Firewall.                                #
+#                                                                          #
+# IPFire is free software; you can redistribute it and/or modify           #
+# it under the terms of the GNU General Public License as published by     #
+# the Free Software Foundation; either version 3 of the License, or        #
+# (at your option) any later version.                                      #
+#                                                                          #
+# IPFire is distributed in the hope that it will be useful,                #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of           #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the            #
+# GNU General Public License for more details.                             #
+#                                                                          #
+# You should have received a copy of the GNU General Public License        #
+# along with IPFire; if not, write to the Free Software                    #
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
+#                                                                          #
+# Copyright (C) 2015 IPFire-Team <info@ipfire.org>.                        #
+#                                                                          #
+############################################################################
+#
+. /opt/pakfire/lib/functions.sh
+/usr/local/bin/backupctrl exclude >/dev/null 2>&1
+
+# Remove old core updates from pakfire cache to save space...
+core=95
+for (( i=1; i<=$core; i++ ))
+do
+	rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire
+done
+
+# Remove files
+rm -f /etc/rc.d/init.d/network-vlans
+rm -f /etc/rc.d/rcsysinit.d/S91network-vlans
+
+# Stop services
+
+# Extract files
+extract_files
+
+# Update Language cache
+/usr/local/bin/update-lang-cache
+
+# Start services
+
+# This update need a reboot...
+#touch /var/run/need_reboot
+
+# Finish
+/etc/init.d/fireinfo start
+sendprofile
+# Update grub config to display new core version
+if [ -e /boot/grub/grub.cfg ]; then
+	grub-mkconfig -o /boot/grub/grub.cfg
+fi
+sync
+
+# Don't report the exitcode last command
+exit 0

config/rootfiles/oldcore/94/exclude

@@ -0,0 +1,22 @@
+boot/config.txt
+etc/alternatives
+etc/collectd.custom
+etc/ipsec.conf
+etc/ipsec.secrets
+etc/ipsec.user.conf
+etc/ipsec.user.secrets
+etc/localtime
+etc/shadow
+etc/ssh/ssh_config
+etc/ssh/sshd_config
+etc/ssl/openssl.cnf
+etc/sudoers
+etc/sysconfig/firewall.local
+etc/sysconfig/rc.local
+etc/udev/rules.d/30-persistent-network.rules
+srv/web/ipfire/html/proxy.pac
+var/ipfire/ovpn
+var/lib/alternatives
+var/log/cache
+var/state/dhcp/dhcpd.leases
+var/updatecache

config/rootfiles/oldcore/94/meta

@@ -0,0 +1 @@
+DEPS=""

config/udev/60-net.rules

@@ -1,3 +1,7 @@
 # Call a script that checks for the right name of the new device.
 # If it matches the configuration it will be renamed accordingly.
 ACTION=="add", SUBSYSTEM=="net", PROGRAM="/lib/udev/network-hotplug-rename", RESULT=="?*", NAME="$result"
+
+# Call a script that will create all virtual devices for a parent device
+# that has just come up.
+ACTION=="add", SUBSYSTEM=="net", PROGRAM="/lib/udev/network-hotplug-vlan"

config/udev/network-hotplug-vlan

@@ -17,10 +17,12 @@
 # along with IPFire; if not, write to the Free Software                    #
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA #
 #                                                                          #
-# Copyright (C) 2012 IPFire Team <info@ipfire.org>                         #
+# Copyright (C) 2015 IPFire Team <info@ipfire.org>                         #
 #                                                                          #
 ############################################################################
 
+[ -n "${INTERFACE}" ] || exit 2
+
 CONFIG_FILE="/var/ipfire/ethernet/vlans"
 
 # Skip immediately if no configuration file has been found.
@@ -28,9 +30,6 @@ CONFIG_FILE="/var/ipfire/ethernet/vlans"
 
 eval $(/usr/local/bin/readhash ${CONFIG_FILE})
 
-# This is start or stop.
-action=${1}
-
 for interface in green0 red0 blue0 orange0; do
 	case "${interface}" in
 		green*)
@@ -55,59 +54,34 @@ for interface in green0 red0 blue0 orange0; do
 			;;
 	esac
 
-	case "${action}" in
-		start)
-			# If no parent device has been configured, we assume
-			# that this interface is not set up for VLANs and
-			# silently go on.
-			[ -z "${PARENT_DEV}" ] && continue
+	# If the parent device does not match the interface that
+	# has just come up, we will go on for the next one.
+	[ "${PARENT_DEV}" = "${INTERFACE}" ] || continue
 
-			# Check if the interface does already exists.
-			# If so, we skip creating it.
-			if [ -d "/sys/class/net/${interface}" ]; then
-				echo "Interface ${interface} already exists." >&2
-				continue
-			fi
+	# Check if the interface does already exists.
+	# If so, we skip creating it.
+	if [ -d "/sys/class/net/${interface}" ]; then
+		echo "Interface ${interface} already exists." >&2
+		continue
+	fi
 
-			# Check if the parent interface exists.
-			if [ ! -d "/sys/class/net/${PARENT_DEV}" ]; then
-				echo "${interface}: Parent device is not set or does not exist: ${PARENT_DEV}" >&2
-				continue
-			fi
+	if [ -z "${VLAN_ID}" ]; then
+		echo "${interface}: You did not set the VLAN ID." >&2
+		continue
+	fi
 
-			if [ -z "${VLAN_ID}" ]; then
-				echo "${interface}: You did not set the VLAN ID." >&2
-				continue
-			fi
+	# Build command line.
+	command="ip link add link ${PARENT_DEV} name ${interface}"
+	if [ -n "${MAC_ADDRESS}" ]; then
+		command="${command} address ${MAC_ADDRESS}"
+	fi
+	command="${command} type vlan id ${VLAN_ID}"
 
-			# Build command line.
-			command="ip link add link ${PARENT_DEV} name ${interface}"
-			if [ -n "${MAC_ADDRESS}" ]; then
-				command="${command} address ${MAC_ADDRESS}"
-			fi
-			command="${command} type vlan id ${VLAN_ID}"
+	echo "Creating VLAN interface ${interface}..."
+	${command}
 
-			echo "Creating VLAN interface ${interface}..."
-			${command}
-
-			# Bring up the parent device.
-			ip link set ${PARENT_DEV} up
-			;;
-
-		stop)
-			if [ ! -e "/proc/net/vlan/${interface}" ]; then
-				echo "${interface} is not a VLAN interface. Skipping."
-				continue
-			fi
-
-			echo "Removing VLAN interface ${interface}..."
-			ip link set ${interface} down
-			ip link delete ${interface}
-			;;
-		
-		*)
-			echo "Invalid action: ${action}"
-			exit 1
-			;;
-	esac
+	# Bring up the parent device.
+	ip link set ${PARENT_DEV} up
 done
+
+exit 0

html/cgi-bin/connections.cgi

@@ -261,15 +261,19 @@ close(IPSEC);
 
 foreach my $line (@ipsec) {
 	my @vpn = split(',', $line);
-	my ($network, $mask) = split("/", $vpn[12]);
 
-	if (!&General::validip($mask)) {
-		$mask = ipv4_cidr2msk($mask);
+	my @subnets = split('|', $vpn[12]);
+	for my $subnet (@subnets) {
+		my ($network, $mask) = split("/", $subnet);
+
+		if (!&General::validip($mask)) {
+			$mask = ipv4_cidr2msk($mask);
+		}
+
+		push(@network, $network);
+		push(@masklen, $mask);
+		push(@colour, ${Header::colourvpn});
 	}
-
-	push(@network, $network);
-	push(@masklen, $mask);
-	push(@colour, ${Header::colourvpn});
 }
 
 if (-e "${General::swroot}/ovpn/n2nconf") {

langs/de/cgi-bin/de.pl

@@ -2620,7 +2620,6 @@
 'vpn statistic n2n' => 'OpenVPN-Netz-zu-Netz-Statistik',
 'vpn statistic rw' => 'OpenVPN-Roadwarrior-Statistik',
 'vpn subjectaltname' => 'Subjekt Alternativer Name',
-'vpn vhost' => 'Roadwarrior virtuelle IP (manchmal auch Inner-IP genannt)',
 'vpn watch' => 'Netz-zu-Netz VPN neu starten, wenn sich Remote-IP ändert (DynDNS).',
 'waiting to synchronize clock' => 'Bitte warten, die Uhr wird synchronisiert',
 'warn when traffic reaches' => 'Warnen wenn Traffic x % erreicht',

langs/en/cgi-bin/en.pl

@@ -2664,7 +2664,6 @@
 'vpn statistic n2n' => 'OpenVPN Net-to-Net Statistics',
 'vpn statistic rw' => 'OpenVPN Roadwarrior Statistics',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Restart net-to-net vpn when remote peer IP changes (dyndns).',
 'waiting to synchronize clock' => 'Waiting to synchronize clock',
 'warn when traffic reaches' => 'Warn when traffic reaches x %',

langs/es/cgi-bin/es.pl

@@ -2107,7 +2107,6 @@
 'vpn red name' => 'Dirección IP pública o FQDN para la interfaz RED o<%defaultroute>',
 'vpn remote id' => 'ID Remoto',
 'vpn subjectaltname' => 'Nombre alternativo en Asunto',
-'vpn vhost' => 'IP virtual Roadwarris (también referida como ip-interior)',
 'vpn watch' => 'Reinciar vpn net-to-net cuando la ip remota cambie (dyndns)',
 'waiting to synchronize clock' => 'Esperando sincronización con el reloj',
 'warn when traffic reaches' => 'Advertir cuando el tráfico alcance x %',

langs/fr/cgi-bin/fr.pl

@@ -2111,7 +2111,6 @@
 'vpn red name' => 'IP publique ou nom de domaine complet pour l\'interface ROUGE ou <%defaultroute>',
 'vpn remote id' => 'ID Distant',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'IP Virtuelle Roadwarrior (parfois appelée Inner-IP)',
 'vpn watch' => 'Redémarrer net-to-net VPN si IP hôte distant change (dyndns).',
 'waiting to synchronize clock' => 'Attendre la synchronisation de l\'horloge',
 'warn when traffic reaches' => 'Avertir lorsque le trafic atteint x %',

langs/it/cgi-bin/it.pl

@@ -2586,7 +2586,6 @@
 'vpn red name' => 'IP pubblico o il nome di dominio completo per l\'interfaccia RED o <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Restart net-to-net vpn when remote peer IP changes (dyndns).',
 'waiting to synchronize clock' => 'Waiting to synchronize clock',
 'warn when traffic reaches' => 'Warn when traffic reaches x %',

langs/nl/cgi-bin/nl.pl

@@ -2529,7 +2529,6 @@
 'vpn red name' => 'Publiek IP of FQDN voor RODE interface of <%defaultroute>',
 'vpn remote id' => 'Remote ID',
 'vpn subjectaltname' => 'Onderwerp Alt Naam',
-'vpn vhost' => 'Roadwarrior virtual IP (Ook wel Inner-IP genoemd)',
 'vpn watch' => 'Herstart net-to-net vpn wanneer remote peer IP verandert (dyndns).',
 'waiting to synchronize clock' => 'Wachten op synchronisatie van klok',
 'warn when traffic reaches' => 'Waarschuw wanneer verkeer x % bereikt',

langs/pl/cgi-bin/pl.pl

@@ -2120,7 +2120,6 @@
 'vpn red name' => 'Publiczne IP lub FQDN interfejsu RED lub <%defaultroute>',
 'vpn remote id' => 'Zdalne ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Uruchom ponownie vpn net-to-net kiedy zmieni się IP zdalnej końcówki (dyndns).',
 'waiting to synchronize clock' => 'Oczekiwanie na synchronizację zegara',
 'warn when traffic reaches' => 'Ostrzegaj kiedy ruch osiągnie x %',

langs/ru/cgi-bin/ru.pl

@@ -2115,7 +2115,6 @@
 'vpn red name' => 'Внешний IP или FQDN для RED интерфейса или <%defaultroute>',
 'vpn remote id' => 'Удалённый ID',
 'vpn subjectaltname' => 'Subject Alt Name',
-'vpn vhost' => 'Roadwarrior virtual IP (sometimes called Inner-IP)',
 'vpn watch' => 'Перезапускать net-to-net vpn когда удалённый IP меняется (dyndns).',
 'waiting to synchronize clock' => 'Ожидается синхронизация',
 'warn when traffic reaches' => 'Предупреждать когда трафик возрастает до x %',

langs/tr/cgi-bin/tr.pl

@@ -2609,7 +2609,6 @@
 'vpn red name' => 'KIRMIZI arabirim veya <%defaultroute> için gerçek IP veya FQDN',
 'vpn remote id' => 'Uzak kimlik (ID)',
 'vpn subjectaltname' => 'Alternatif konu adı',
-'vpn vhost' => 'Roadwarrior sanal IP (bazen iç IP olarakta adlandırılır)',
 'vpn watch' => 'Karşı eş IP değiştirdiğinde (dyndns) ağdan-ağa VPN bağlantısını yeniden başlat. Bu DPD ye yardımcı olur.',
 'waiting to synchronize clock' => 'Saat eşleştirmesi bekleniyor',
 'warn when traffic reaches' => 'Trafik x % değere ulaştığında uyar',

lfs/initscripts

@@ -177,7 +177,6 @@ $(TARGET) :
 	ln -sf ../init.d/localnet    /etc/rc.d/rcsysinit.d/S80localnet
 	ln -sf ../init.d/firewall    /etc/rc.d/rcsysinit.d/S85firewall
 	ln -sf ../init.d/network-trigger /etc/rc.d/rcsysinit.d/S90network-trigger
-	ln -sf ../init.d/network-vlans /etc/rc.d/rcsysinit.d/S91network-vlans
 	ln -sf ../init.d/rngd        /etc/rc.d/rcsysinit.d/S92rngd
 	ln -sf ../init.d/wlanclient  /etc/rc.d/rc0.d/K82wlanclient
 	ln -sf ../init.d/wlanclient  /etc/rc.d/rc3.d/S19wlanclient

lfs/udev

@@ -107,6 +107,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	# Install network rules.
 	install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-rename \
 		/lib/udev/network-hotplug-rename
+	install -v -m 755 $(DIR_SRC)/config/udev/network-hotplug-vlan \
+		/lib/udev/network-hotplug-vlan
 	install -v -m 644 $(DIR_SRC)/config/udev/60-net.rules \
 		/lib/udev/rules.d
 

make.sh

@@ -25,7 +25,7 @@
 NAME="IPFire"							# Software name
 SNAME="ipfire"							# Short name
 VERSION="2.17"							# Version number
-CORE="94"							# Core Level (Filename)
+CORE="95"							# Core Level (Filename)
 PAKFIRE_CORE="94"						# Core Level (PAKFIRE)
 GIT_BRANCH=`git rev-parse --abbrev-ref HEAD`			# Git Branch
 SLOGAN="www.ipfire.org"						# Software slogan