diff --git a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood index 33596f5a8..4dd01d6f9 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-kirkwood +++ b/config/kernel/kernel.config.armv5tel-ipfire-kirkwood @@ -299,7 +299,7 @@ CONFIG_ARCH_KIRKWOOD=y # CONFIG_ARCH_DAVINCI is not set # CONFIG_ARCH_OMAP1 is not set # CONFIG_GPIO_PCA953X is not set -CONFIG_KEYBOARD_GPIO_POLLED=m +CONFIG_KEYBOARD_GPIO_POLLED=y # # Marvell Kirkwood Implementations @@ -2221,7 +2221,7 @@ CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_QT1070 is not set # CONFIG_KEYBOARD_QT2160 is not set # CONFIG_KEYBOARD_LKKBD is not set -CONFIG_KEYBOARD_GPIO=m +CONFIG_KEYBOARD_GPIO=y # CONFIG_KEYBOARD_TCA6416 is not set # CONFIG_KEYBOARD_TCA8418 is not set # CONFIG_KEYBOARD_MATRIX is not set @@ -2258,8 +2258,8 @@ CONFIG_MOUSE_SYNAPTICS_USB=m # CONFIG_INPUT_TABLET is not set # CONFIG_INPUT_TOUCHSCREEN is not set CONFIG_INPUT_MISC=y -CONFIG_INPUT_88PM860X_ONKEY=m -CONFIG_INPUT_88PM80X_ONKEY=m +# CONFIG_INPUT_88PM860X_ONKEY is not set +# CONFIG_INPUT_88PM80X_ONKEY is not set # CONFIG_INPUT_AD714X is not set # CONFIG_INPUT_BMA150 is not set # CONFIG_INPUT_MMA8450 is not set diff --git a/config/kernel/kernel.config.armv5tel-ipfire-rpi b/config/kernel/kernel.config.armv5tel-ipfire-rpi index e0d2b318f..9ad830154 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-rpi +++ b/config/kernel/kernel.config.armv5tel-ipfire-rpi @@ -1746,7 +1746,7 @@ CONFIG_INPUT_MOUSEDEV=y CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 # CONFIG_INPUT_JOYDEV is not set -# CONFIG_INPUT_EVDEV is not set +CONFIG_INPUT_EVDEV=y # CONFIG_INPUT_EVBUG is not set # diff --git a/config/rootfiles/core/fifteen/filelists/files b/config/rootfiles/core/fifteen/filelists/files index 2d4ff42bf..b97812d1d 100644 --- a/config/rootfiles/core/fifteen/filelists/files +++ b/config/rootfiles/core/fifteen/filelists/files @@ -2,8 +2,11 @@ etc/system-release etc/issue etc/rc.d/init.d/network srv/web/ipfire/cgi-bin/index.cgi +srv/web/ipfire/cgi-bin/netinternal.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi +srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/upnp.cgi +srv/web/ipfire/cgi-bin/speed.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi var/ipfire/backup/bin/backup.pl var/ipfire/backup/exclude diff --git a/html/cgi-bin/netinternal.cgi b/html/cgi-bin/netinternal.cgi index 60560f3d4..3f2fb56cc 100644 --- a/html/cgi-bin/netinternal.cgi +++ b/html/cgi-bin/netinternal.cgi @@ -61,8 +61,8 @@ if ( $querry[0] =~ /wireless/ ){ &Header::openbigbox('100%', 'left'); push (@graphs, ($netsettings{'GREEN_DEV'})); - if ($netsettings{'BLUE_DEV'}) {push (@graphs, ($netsettings{'BLUE_DEV'})); } - if ($netsettings{'ORANGE_DEV'}) {push (@graphs, ($netsettings{'ORANGE_DEV'})); } + if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {push (@graphs, ($netsettings{'BLUE_DEV'})); } + if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {push (@graphs, ($netsettings{'ORANGE_DEV'})); } my @wirelessgraphs = `ls -dA /var/log/rrd/collectd/localhost/wireless* 2>/dev/null`; foreach (@wirelessgraphs){ diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index bcdc2024f..97e752e28 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -180,8 +180,8 @@ close(FILE); &General::readhash("${General::swroot}/main/settings", \%mainsettings); my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}"); -my $blue_cidr = "# Blue not defined"; -if ($netsettings{'BLUE_DEV'}) { +my $blue_cidr = ""; +if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) { $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}"); } diff --git a/html/cgi-bin/speed.cgi b/html/cgi-bin/speed.cgi index b714d679c..4468abd90 100644 --- a/html/cgi-bin/speed.cgi +++ b/html/cgi-bin/speed.cgi @@ -36,9 +36,8 @@ foreach $field (@fields) { } } - -my $interface = `cat /var/ipfire/red/iface`; -my @data_now = `ip -s link show $interface`; +my $interface = `cat /var/ipfire/red/iface 2>/dev/null`; +my @data_now = `ip -s link show $interface 2>/dev/null`; my $lastline; my $rxb_now = 0; diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 2fbe48035..2d9058d05 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -61,11 +61,11 @@ my %mainsettings = (); my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}"); my $blue_cidr = "# Blue not defined"; -if ($netsettings{'BLUE_DEV'}) { +if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) { $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}"); } my $orange_cidr = "# Orange not defined"; -if ($netsettings{'ORANGE_DEV'}) { +if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) { $orange_cidr = &General::ipcidr("$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}"); } diff --git a/lfs/configroot b/lfs/configroot index d91dbeb8b..ba6770b33 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -122,8 +122,8 @@ $(TARGET) : echo "FWPOLICY2=DROP" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPPORTSCAN=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPOUTGOING=on" >> $(CONFIG_ROOT)/optionsfw/settings - echo "DROPSAMBA=on" >> $(CONFIG_ROOT)/optionsfw/settings - echo "DROPPROXY=on" >> $(CONFIG_ROOT)/optionsfw/settings + echo "DROPSAMBA=off" >> $(CONFIG_ROOT)/optionsfw/settings + echo "DROPPROXY=off" >> $(CONFIG_ROOT)/optionsfw/settings echo "SHOWREMARK=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "SHOWCOLORS=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "SHOWTABLES=off" >> $(CONFIG_ROOT)/optionsfw/settings diff --git a/src/misc-progs/wirelessctrl.c b/src/misc-progs/wirelessctrl.c index 450aa368f..101661386 100644 --- a/src/misc-progs/wirelessctrl.c +++ b/src/misc-progs/wirelessctrl.c @@ -5,8 +5,6 @@ * * (c) Alan Hourihane, 2003 * - * $Id: wirelessctrl.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $ - * */ #include "libsmooth.h" @@ -25,167 +23,150 @@ FILE *fd = NULL; char blue_dev[STRING_SIZE] = ""; char command[STRING_SIZE]; -void exithandler(void) -{ - /* added comment mark to the drop rules to be able to collect the bytes by the collectd */ - if(strlen(blue_dev)) - { - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev); - safe_system(command); - } +void exithandler(void) { + /* added comment mark to the drop rules to be able to collect the bytes by the collectd */ + if (strlen(blue_dev) > 0) { + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev); + safe_system(command); + } - if (fd) - fclose(fd); + if (fd) + fclose(fd); } -int main(void) -{ - char green_dev[STRING_SIZE] = ""; - char buffer[STRING_SIZE]; - char *index, *ipaddress, *macaddress, *enabled; - struct keyvalue *kv = NULL; +int main(void) { + char green_dev[STRING_SIZE] = ""; + char buffer[STRING_SIZE]; + char *index, *ipaddress, *macaddress, *enabled; + struct keyvalue *kv = NULL; - if (!(initsetuid())) - exit(1); + if (!(initsetuid())) + exit(1); - /* flush wireless iptables */ - safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null"); - safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null"); + /* flush wireless iptables */ + safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null"); + safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null"); - memset(buffer, 0, STRING_SIZE); + memset(buffer, 0, STRING_SIZE); - /* Init the keyvalue structure */ - kv=initkeyvalues(); + /* Init the keyvalue structure */ + kv=initkeyvalues(); - /* Read in the current values */ - if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) - { - fprintf(stderr, "Cannot read ethernet settings\n"); - exit(1); + /* Read in the current values */ + if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) { + fprintf(stderr, "Cannot read ethernet settings\n"); + exit(1); + } + + /* Read in the firewall values */ + if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings")) { + fprintf(stderr, "Cannot read optionsfw settings\n"); + exit(1); + } + + /* Get the GREEN interface details */ + if (findkey(kv, "GREEN_DEV", green_dev) > 0) { + if (!VALID_DEVICE(green_dev)) { + fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev); + exit(1); + } + } + + /* Get the BLUE interface details */ + if (findkey(kv, "BLUE_DEV", blue_dev) > 0) { + if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) { + fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev); + exit(1); + } + } + + if (strlen(blue_dev) == 0) { + exit(0); + } + + if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r"))) + return 0; + + /* register exit handler to ensure the block rule is always present */ + atexit(exithandler); + + if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) { + exit(0); + } + + /* restrict blue access tp the proxy port */ + if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer,"off") == 0) { + /* Read the proxy values */ + if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) { + fprintf(stderr, "Cannot read proxy settings\n"); + exit(1); + } + + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer); + safe_system(command); + } + + /* not allow blue to acces a samba server running on local fire*/ + if(findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer,"off")){ + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev); + safe_system(command); + } + + while (fgets(buffer, STRING_SIZE, fd)) { + buffer[strlen(buffer) - 1] = 0; + + index = strtok(buffer, ","); + ipaddress = strtok(NULL, ","); + macaddress = strtok(NULL, ","); + enabled = strtok(NULL, ","); + + if (strncmp(enabled, "on", 2) != 0) { + /* both specified, added security */ + if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) { + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev); + safe_system(command); + } else { + /* correctly formed mac address is 17 chars */ + if (strlen(macaddress) == 17) { + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev); + safe_system(command); } - /* Read in the firewall values */ - if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings")) - { - fprintf(stderr, "Cannot read optionsfw settings\n"); - exit(1); + if (VALID_IP_AND_MASK(ipaddress)) { + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev); + safe_system(command); + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev); + safe_system(command); } + } + } + } - /* Get the GREEN interface details */ - if(!findkey(kv, "GREEN_DEV", green_dev)) - { - fprintf(stderr, "Cannot read GREEN_DEV\n"); - exit(1); - } - if (!VALID_DEVICE(green_dev)) - { - fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev); - exit(1); - } - /* Get the BLUE interface details */ - if(!findkey(kv, "BLUE_DEV", blue_dev)) - { - fprintf(stderr, "Cannot read BLUE_DEV\n"); - exit(1); - } - if (strlen(blue_dev) && !VALID_DEVICE(blue_dev)) - { - fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev); - exit(1); - } - if(! strlen(blue_dev) > 0) - { - fprintf(stderr, "No BLUE interface\n"); - exit(0); - } + /* with this rule you can disable the logging of the dropped wireless input packets*/ + if (!findkey(kv, "DROPWIRELESSINPUT", buffer) || strcmp(buffer,"off") == 0) { + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev); + safe_system(command); + } - if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r"))) - return 0; + /* with this rule you can disable the logging of the dropped wireless forward packets*/ + if (!findkey(kv, "DROPWIRELESSFORWARD", buffer) || strcmp(buffer,"off") == 0) { + snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev); + safe_system(command); + } - /* register exit handler to ensure the block rule is always present */ - atexit(exithandler); - - if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) - { - exit(0); - } - - /* restrict blue access tp the proxy port */ - if(findkey(kv, "DROPPROXY", buffer) && strcmp(buffer,"off")){ - /* Read the proxy values */ - if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) - { - fprintf(stderr, "Cannot read proxy settings\n"); - exit(1); - } - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer); - safe_system(command); - } - - /* not allow blue to acces a samba server running on local fire*/ - if(findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer,"off")){ - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev); - safe_system(command); - } - - while (fgets(buffer, STRING_SIZE, fd)) - { - buffer[strlen(buffer) - 1] = 0; - - index = strtok(buffer, ","); - ipaddress = strtok(NULL, ","); - macaddress = strtok(NULL, ","); - enabled = strtok(NULL, ","); - - if (!strncmp(enabled, "on", 2)) { - - /* both specified, added security */ - if ((strlen(macaddress) == 17) && - (VALID_IP_AND_MASK(ipaddress))) { - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev); - safe_system(command); - } else { - - /* correctly formed mac address is 17 chars */ - if (strlen(macaddress) == 17) { - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev); - safe_system(command); - } - - if (VALID_IP_AND_MASK(ipaddress)) { - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev); - safe_system(command); - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev); - safe_system(command); - } - } - } - } - - /* with this rule you can disable the logging of the dropped wireless input packets*/ - if(!findkey(kv, "DROPWIRELESSINPUT", buffer) || strcmp(buffer,"off")){ - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev); - safe_system(command); - } - /* with this rule you can disable the logging of the dropped wireless forward packets*/ - if(!findkey(kv, "DROPWIRELESSFORWARD", buffer) || strcmp(buffer,"off")){ - snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev); - safe_system(command); - } - - return 0; + return 0; }