Placing the ipblocklist sources file as an own package, easily
allows to update this single file during a core update and to
keep the vendor details for the blocklists up-to-date.
Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
* Fixes that the same chain would be created each time a firewall
reload is performed.
* Also fixes multiple log and drop rules inside the the BLOCKLIST_DROP
chains after doing a firewall reload.
* Orphaned BLOCKLIST_DROP chains now will be flushed and removed in case
the blocklist gets disabled or the entire feature will be swithed off.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
The support for themes has been removed since ages, so we
do not need this anymore and may crash the page.
Signed-off-by: Rob Brewer <rob.brewer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
given list.
The function will return the rate in seconds based on the configured
rate value in the blocklist sources file and the given blocklist.
Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
not parse-able.
In case the downloaded list is empty or the parser is not able to parse
it properly, the download_and_create_blocklist() function now exits and
will return "empty_list" as new error code.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
This vendor has a different list format and therefore requires an
own parser.
Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
This function is responisible for downloading and converting the
blocklist into an ipset compatible format.
The only required argument is the blocklist (in upper letter format) which should be
performed. It automatically will setup an upstream proxy (if configured)
and grab the file specified in the blocklist vendor configuration hash.
There is a maximum amount of five attempts until the script gives up and
returns a "dl_error". In case the server responses with "Not Modified"
(Code 304) a "not_modified" will be returned.
If the blocklist successfully has been grabbed, the modification date
get stored for further purposes and the list content will be converted
and stored in an ipset compatible format.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Inspired-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
This library file will contain a collection of functions, which are
required to deal with the ipblocklist feature.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
- Update from version 4.91 to 4.95.0
- version 4.91 was the last version provided bia purdue.edu after which they stopped
maintaining it. It is now taken over ny the lsof-org team at Github.
https://github.com/lsof-org/lsof
- Update of rootfile not required - only one line in the rootfile
- Changelog
lsof-4.95.0-linux
[n+obsd] fix syntax error
Corrected end of comment.
This change closes#138.
@albert-github reported this issue in #138,
and provided the fix in #140
Don't ignore failures in test/Makefile
Tobias Geerinckx-Rice <me@tobias.gr> provides the fix.
Update perl scripts for the past few decades of progress
Generally, perl is available on base systems - people who are manually
installing perl into /usr/local/bin are the exception rather than the
rule. In addition, Perl 5 was release in 1994, so Perl 4 isn't relevant
any more. We've also standardized on the .pl extension, rather than
.perl5 or whatever.
Provided by @dilinger (Andres Salomon) in #149.
A commit in the pull request includes work of Nicholas Bamber.
Drop LSOF_CCDATE across all dialects to ensure reproducible builds
Simplify things for reproducible builds by just getting rid of
the embedded date/time string. With LSOF_CCDATE gone, keeping
SOURCE_DATE_EPOCH around doesn't make much sense, so drop that as
well. Folks doing reproducible builds should still override the
LSOF_HOST, LSOF_LOGNAME, LSOF_SYSINFO, and LSOF_USER variables (as
they were previously doing before SOURCE_DATE_EPOCH).
Provided by @dilinger (Andres Salomon) in #150.
[FreeBSD] get the ISO9660 filesystem working again
The ISO9660 filesystem broke starting with FreeBSD 7 due to the header
location changing. Fix the header search path to get it to be detected
again. Fix the header inclusion order. Also add the new way of finding
dev_t on more recent FreeBSD versions.
Provided by Damjan Jovanovic in #151.
[FreeBSD] add support for msdosfs on FreeBSD
Provided by Damjan Jovanovic in #151.
Fix FD field description.
In 811dc78 the output format was changed to not printf the `f`
field by default, however the field description in `lsof_fields.h`,
as seen in `-F?` output still included the `(always selected)` text.
Provided by @algorythmic (Grisha Levit) in #158.
Adjust alignment of buffer passed to stat().
The original code passes char[] buffer to stat(). This can be cause
a SIGBUS. #160 reported an actual crash on armv7a + glibc-2.33 platform.
See also https://sourceware.org/bugzilla/show_bug.cgi?id=27993.
Reported by @10ne1 in #160.
Clean up source code and documentats.
- remove trailing whitespace,
- fix some issues in scripts found through shellcheck, and
- fix spelling
Provided by @a1346054 in #163.
man page: fix hyphen issues
Properly use '-' and '\-' in the man page, ensuring that users
can cut & paste commandline options without issue. Original
patch from Raoul Gunnar Borenius <borenius@dfn.de>, and
submitted/expanded by @dilinger (Andres Salomon) in #168.
[FreeBSD] update for FreeBSD 13 & 14, and various internal changes
submitted by @DmitryAndric & @emaste.
[FreeBSD] remove various old FreeBSD versions from support
submitted by @emaste
[FreeBSD] configure: suggest variable to set if FreeBSD sys not
found
submitted by @emaste
Fix broken LSOF_CFLAGS_OVERRIDE.
Provided by Fabrice Fontaine in #172.
[linux] Remove sysvlegacy function.
Provided by Fabrice Fontaine in #195.
[linux] use close_range instead of calling close repeatedly
At the starting up, lsof closes its file descriptors greater
than 2 by calling close(2) repeatedly. As reported in #186,
it can take long time. Linux 5.9 introduced close_range(2).
The new system call can close multiple file descriptors faster.
@qianzhangyl reported the original issue (#186).
Add -Q option for adjusting exit status when failed to find a
search item (#129)
In the original code, lsof returned 1 when it failed to find a
search item. With the new option, lsof returns 0 in the case.
Document -Q option in manpage/00QUICKSTART, and adjust -h
output by @dilinger (Andres Salomon) in #129.
Improve readability of complex adverbial clause by adding a
comma.
Provided by Danny Fowler in #156.
lsof-4.94.0-linux
(All changes in this version are ported from
lsof-org/lsof-linux repository at GitHub).
Introduced a new test harness. The harness can run
test cases specific to a dialect. It is designed for
running test cases on CI environment like Travis-CI.
However, it is runnable locally with following command
line:
$ ./check.sh DIALECT
after making lsof executable.
[linux] Fixed a bug +|-E options output for pipe.
If two processes use the same fd number for a pipe
connecting them, the option didn't print the
information about it.
[linux] Fixed a bug +|-E options output for PTY.
If two processes use the same fd number for a PTY
connecting them, the option didn't print the
information about it.
[linux] Fixed a bug +|-E options output for PTY.
The code for detecting a slave device was incorrect.
[linux] Fixed a potential bug +|-E options output for
PTY. A structure field for the feature was not
initialized.
[linux] Added a code for decoding O_PATH flag in +fg
option.
[linux] Added a code for decoding O_CLOEXEC flag as CX
in +fg option.
[linux] Added a code for decoding O_TMPFILE flag as
TMPF in +fg option.
[linux] Added Linux display of INET socket endpoint
information with +|-E option. The option handles
INET sockets using IPC.
[linux] Added support for POSIX MQ of Linux
implementation. A POSIX message queue (MQ) is
represented in a fd on Linux. lsof reported it as a
regular file. lsof with this change reports it as a
file with PSXMQ type if mqueue file system is mounted.
[linux] Added Linux display of POSIX message queue
endpoint information with +|-E option. mqueue file system
must be mounted to display the information.
[linux] Added Linux display of INET6 socket endpoint
information with +|-E option. The option handles
INET6 sockets using IPC.
[FreeBSD] update to include <sys/_lock.h> on recent -CURRENT
since it is no longer implicitly included via header pollution.
[linux] Added Linux display of eventfd endpoint information
with +|-E option. The option handles eventfd using IPC.
[FreeBSD] include <stdbool.h> for recent change requiring
refcount(9).
Enhanced -r option. With `c<N>' specifier, lsof can stop itself
when the number of iterations reaches at <N>.
[linux] Fixed accessing an uninitialized local variable.
Detected by valgrind.
[linux] fix a crash when printing the endpoint for unaccepted
unix socket with +E option.
This closes the github issue #74 reported by @jolmg.
[linux] abort execution when failing in memory allocation for
socket private data.
[linux] decode the name of DCCP socket type.
[linux] decode more netlink protocol numbers (RDMA, CRYPTO, and
SMC).
[linux] print the connection state of unix domain socket
Lsof can print the state of TCP socket like:
nc 22247 yamato 3u IPv4 471409 0t0 TCP localhost:38802->localhost:9999 (ESTABLISHED)
This change exnteds this feature to support unix domain sockets.
LISTEN, UNCONNECTED, CONNECTING, CONNECTED, DISCONNECTING,
and UNKNOWN can be taken as a state.
An example of output:
evince 17333 yamato 1u unix 0x0000000054183795 0t0 89141 type=STREAM (CONNECTED)
This feature is enabled by default.
To turn off printing state information, use -T option.
Don't display command usage even when a file (or directory) listed
in command line doesn't exist.
This closes the github issue #90 reported by @rowlap.
[FreeBSD] merge all the FreeBSD specific fixes from the FreeBSD sysutils/lsof port
[linux] allow reproducible builds
In a reproducible build all varied information is removed. This
change does so, by checking if the standard SOURCE_DATE_EPOCH
variable is set. If it is, we are attempting a reproducible build
and will strip varying information.
About the standard, see https://reproducible-builds.org/specs/source-date-epoch/
Provided in github pull request #93 by @T4cC0re.
[freebsd] update for r363214
- no user visible changes
Added the way to include (or exclude) all numbered file descriptors
in -d option. "fd" is a pseudo file descriptor name for the purpose.
See the following output on Linux; lsof doesn't print cwd, rtd, txt,
and mem files.
# ./lsof -p $$ -a -d fd
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 866421 root 0u CHR 136,1 0t0 4 /dev/pts/1
bash 866421 root 1u CHR 136,1 0t0 4 /dev/pts/1
bash 866421 root 2u CHR 136,1 0t0 4 /dev/pts/1
bash 866421 root 255u CHR 136,1 0t0 4 /dev/pts/1
docs: fixed minor grammatical error in instructions in Customize file
The change is provided by @hardikpnsp.
man page: improve phrasing and add examples
The change is provided by Martin D Kealey.
man page: improve explanation of -t implying -w
The change is provided by Martin D Kealey.
test cases, [linux]: fix tests for large inode-numbers (i >= 2^32)
The change is provided by Henry Peteet.
[linux] handle ffff:ffff in ipv6 addr correctly
The listen address and port of an AF_INET6 socket were not display if
the socket listened at an ipv6 address including ffff:ffff.
Here is a command session demonstrating the bug:
# ip -6 addr add abcd:ef10:ffff:ffff:ffff:ffff:ffff:ff62 dev lo
# nc -6 -l abcd:ef10:ffff:ffff:ffff:ffff:ffff:ff62 8888 &
[1] 6762
# ./lsof -p 6762 -a -d fd -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nc 6762 yamato 0u CHR 136,6 0t0 9 /dev/pts/6
nc 6762 yamato 1u CHR 136,6 0t0 9 /dev/pts/6
nc 6762 yamato 2u CHR 136,6 0t0 9 /dev/pts/6
nc 6762 yamato 3u sock 0,9 0t0 5833594 protocol: TCPv6
The last line should be:
nc 6762 yamato 3u IPv6 5833594 0t0 TCP [abcd:ef10:ffff:ffff:ffff:ffff:ffff:ff62]:8888 (LISTEN)
The original code decoding an ipv6 address uses UINT32_MAX constant
incorrect way.
@zhrf2020 reported this bug in #102.
@zhrf2020 provided the initial version of fix, #109.
man page,[linux]: enumerate abbreviated flags printed with '+f g' option
Make -Fo option work
-Fo option is for printing file offset. For regular files,
the option didn't work.
Here is a command session demonstrating the fix:
# ./lsof -Fo -o0| grep ^o | sort | uniq -c
90586 o0t0
87 o0t101
84 o0t103
...
@JustAnotherArchivist reported this bug in #118.
man page: fix definition of the `o` field on programmatic output
The change is provided by @JustAnotherArchivist who reported
the original issue in #118.
[linux]: show the pid monitored by a pidfd
With this change, lsof prints pidfd in the following form:
[pidfd:%d]
where %d represents the pid monitored by the pidfd.
Example output:
# ./lsof -p 12573 -p 12710 | grep pidfd
dbus-brok 12573 jet 11u a_inode 0,13 0 13312 [pidfd:12575]
dbus-brok 12710 jet 10u a_inode 0,13 0 13312 [pidfd:12711]
fd 11 of pid 12573 monitors pid 12575.
fd 10 of pid 12710 monitors pid 12711.
This change closed#116.
Don't select the file descriptor field by default.
The version 4.88 introduced the change for selecting the file
descriptor field by default. However, the change is not
suitable for users who wants to print only PID field.
@po5857 suggests the use case and the way to improve the man page.
[linux]: enumerate fds monitored by an eventpoll fd
With this change, lsof prints an eventpoll fd in the following form:
[eventpoll:<fd0>,<fd1>,...,<fdn>...]
Here fdX is a file descriptor monitored by the eventpoll fd.
If an eventpoll fd monitors too many file descriptors, lsof
truncates the list of fds. "..." at the end of list implies
the truncation.
Example output:
# sudo ./lsof -p 1 -a -d 10,11,12
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root 10u a_inode 0,13 0 11624 [eventpoll:11,12]
systemd 1 root 11r REG 0,4 0 17680 /proc/1/mountinfo
systemd 1 root 12r a_inode 0,13 0 11624 inotify
systemd monitors fd 11 and fd 12 via eventpoll fd 10.
[linux]: implement "make check"
The target runs check.bash.
4.93.2 May 8, 2019
Update the version number embedded in lsof executable.
lsof-4.93.1
4.93.0 May 7, 2019
[freebsd] Made FreeBSD 13 adjustment.
[darwin] Fix a typo causing a build error.
Fix a potential memory leak.
[linux] use tirpc for rpc if libc doesn't provide rpc.h.
Fix a typo in man page.
[linux] fix memory leaks detected by valgrind about unix
endpoint information.
Update the description about -fg and -fG options on linux.
4.93.1 May 7, 2019
Fix a broken symbolic link.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
I am not sure what the rationale is here, but we should probably not do
this. Other hosts on the network will be able to update their ARP caches
properly.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
This is a little patch which will extend the aliases page to offer an
interface selection if there are more than one RED interfaces.
This is a little hack to make configuration easier for users who have
manually set up more than one RED interface (e.g. for load balancing or
fail-over) and want to use the UI to configure firewall rules.
As a little benefit on the side, I had to rewrite setaliases.c to use
ip(8) instead of ifconfig(8).
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
