ipcop-devel Mailing List for IPCop Firewall

On Friday 31 March 2006 05:12 pm, Eduardo Jorge (a.k.a eth0) wrote:
> Hi,
>
> I make a patch for insert pax[0] in IPCOP
>
> I insert this in lfs/linux


Eduardo,

pax has already been included in cvs.  I don't know if it's planned for 
inclusion in 1.4.

IvanK.

Hi,

I make a patch for insert pax[0] in IPCOP

I insert this in lfs/linux
 
-----Cut here-----

#App PaX in the kernel
cd $(DIR_APP) && patch -Np1 < 
$(DIR_SRC)/src/patches/pax-linux-2.4.31-200511122240.patch

---- Cut Here -----

Download pax here 
http://pax.grsecurity.net/pax-linux-2.4.31-200511122240.patch

Tks

[0]http://pax.grsecurity.net

On Wednesday 29 March 2006 01:57 pm, Gilles Espinasse wrote:
> ----- Original Message -----
> From: "Ivan Kabaivanov" <ch...@ya...>
> To: "ipcop-dev " <ipc...@li...>
> Sent: Wednesday, March 29, 2006 5:28 AM
> Subject: [IPCop-devel] ipcoprd.img?
>
> > I'm not sure who committed config/grub/grub.conf 1.8 but I didn't see
>
> anywhere
>
> > in lfs/* (I think the proper place is in initrd) where the ramdisk is
> > created.  Did I miss anything?  I can make a ramdisk, but if anyone has
>
> the
>
> > script ready, could you commit it/email it, please.  It'll save me some
>
> work.
>
> > Or I can just enable ide support back in the kernel just for now...
> >
> > IvanK.
>
> It should be a part of the new installer that Alan is writing.
>
> Gilles


Thanks, Gilles.  Then I'll just enable ide support temporarily so I don't have 
to load the modules manually.  While the manual loading works for the 
installer, the newly installed system cannot boot without ide support 
built-in.

IvanK.

----- Original Message ----- 
From: "Ivan Kabaivanov" <ch...@ya...>
To: "ipcop-dev " <ipc...@li...>
Sent: Wednesday, March 29, 2006 5:28 AM
Subject: [IPCop-devel] ipcoprd.img?


> I'm not sure who committed config/grub/grub.conf 1.8 but I didn't see
anywhere
> in lfs/* (I think the proper place is in initrd) where the ramdisk is
> created.  Did I miss anything?  I can make a ramdisk, but if anyone has
the
> script ready, could you commit it/email it, please.  It'll save me some
work.
> Or I can just enable ide support back in the kernel just for now...
>
> IvanK.
>
>
It should be a part of the new installer that Alan is writing.

Gilles

I'm not sure who committed config/grub/grub.conf 1.8 but I didn't see anywhere 
in lfs/* (I think the proper place is in initrd) where the ramdisk is 
created.  Did I miss anything?  I can make a ramdisk, but if anyone has the 
script ready, could you commit it/email it, please.  It'll save me some work.  
Or I can just enable ide support back in the kernel just for now...

IvanK.

Bugs item #1460292, was opened at 2006-03-28 17:10
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1460292&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: General
Group: 1.4.10
Status: Open
Resolution: None
Priority: 5
Submitted By: Bill Eccles (billeccles)
Assigned to: Nobody/Anonymous (nobody)
Summary: Web GUI not accessible through port 445

Initial Comment:
I know we hashed through this one a while back and the eventual 
resolution was to just use SSH and tunnel, but I just ran across an 
emergent situation where I was unable to SSH from where I was and 
HTTP was the only way out, so I was screwed, to put it mildly.

So, back to what is going on:

I have three IPcop boxen. One has 1.4.10, fresh install, fresh 
configuration. Two are 1.4.10, upgraded from functioning 1.4.9 
installations. Each box is tied to the other two by net/net VPNs and are 
at 192.168.1.1, ...2.1, and ...3.1. And all three behave differently.

LAN side:

1.1: I can access the 1.1 box via port 445 from inside the LAN. I cannot 
access it by port 8080 from inside the LAN. Port 81 redirects to HTTPS 
port 445 which connects. This box is one of the updated boxes.

2.1: I can access the 2.1 box via port 8080 from inside the LAN. I 
cannot access it by port 445 from inside the LAN. Port 81 redirects to 
HTTPS port 445 which fails to connect. This box is a fresh 1.4.10 
install with fresh configuration information.

3.1: I can access the 3.1 box via port 8080 from inside the LAN. I 
cannot access it by port 445 from inside the LAN. Port 81 redirects to 
HTTPS port 8080 which connects. This box is one of the updated 
boxes.

WAN side:

The 1.1 box can be accessed from the WAN on port 81 which redirects 
to port 445, which is successful. It cannot be accessed by port 8080 
from the WAN side, though this may or may not be blocked by my ISP.

The 2.1 box can be accessed from the WAN on port 81 which redirects 
to port 445, which fails as above. It can, however, be accessed from 
the WAN on port 8080.

The 3.1 box can be accessed from the WAN on port 81 which redirects 
to port 8080, which succeeds as above. It cannot be accessed by port 
445, though this may or may not be blocked by my ISP.

What I have discovered is that, while I can successfully get Apache to 
listen on the right ports on the green interface by editing the relevant 
lines in /etc/httpd/conf/httpd.conf, I cannot seem to get the box to 
listen to the right ports on the red interface. I would have thought this 
was related to, say, iptables so I used setxtaccess 445 and that didn't 
get the box to pass packets to Apache.

Two bugs, supposedly, then:

One: Redirection doesn't seem to occur consistently to port 445 (and I 
don't know how that's controlled, or I'd look for a clue).

Two: Even if Apache is listening on the right port (445), something 
blocks access to 445 from the red interface (and I don't know how 
that's controlled, or I'd look for a clue).

Thanks!
Bill

Configuration information:

1.1: /var/ipcop/xtaccess
config.new is empty
config is:
tcp,0.0.0.0/0,113,on,0.0.0.0
tcp,0.0.0.0/0,8080,on,0.0.0.0,External web access
tcp,0.0.0.0/0,81,on,0.0.0.0,External web access
tcp,0.0.0.0/0,222,on,0.0.0.0,External SSH access
tcp,0.0.0.0/0,445,on,0.0.0.0,External web access

There are no portfw's that line up with these ports on this box.

Relevant lines in /etc/httpd/conf/httpd.conf:
Listen 445
<VirtualHost _default_:445>

2.1:  /var/ipcop/xtaccess
config.new is empty
config is:
tcp,0.0.0.0/0,113,on,0.0.0.0
tcp,0.0.0.0/0,8080,on,0.0.0.0,External Web Access
tcp,0.0.0.0/0,222,on,0.0.0.0,External SSH Access
tcp,0.0.0.0/0,81,on,0.0.0.0,External Web Access
tcp,0.0.0.0/0,445,on,0.0.0.0,External Web Access

There are no portfw's that line up with these ports on this box.

Relevant lines in /etc/httpd/conf/httpd.conf:
Listen 8080
<VirtualHost _default_:8080>

3.1:  /var/ipcop/xtaccess
config.new does not exist
config is:
tcp,0.0.0.0/0,113,on,0.0.0.0
tcp,0.0.0.0/0,445,on,0.0.0.0,
tcp,0.0.0.0/0,222,on,0.0.0.0,
tcp,0.0.0.0/0,81,on,0.0.0.0,
tcp,0.0.0.0/0,8080,on,0.0.0.0,

portfw/config is empty

Relevant lines in /etc/httpd/conf/httpd.conf:
Listen 8080
<VirtualHost _default_:8080>



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1460292&group_id=40604

On Tuesday 28 March 2006 08:51, Eric Oberlander wrote:
> On 28 Mar 2006, at 11:07, Franck Bourdonnec wrote:
> >> by the way, did anybody figure out how to build ipcop on ubuntu?
> >>
> >> ---eric
> >
> > It buils perfectly. No problem. Just install gcc4 and some
> > other tools (you will see in error message fot
> > what it missing in log).
> >
> > Franck
>
> Or, you can download the precompiled toolchain, engineered by Gilles
> Espinasse, which is what I did.
>
> You run the make command "./make.sh gettoolchain" to download it,
> before you do a build. If make finds the toolchain.tgz file in /
> cache, it uses it.
>
> Sorted.
>
> Eric
>

Guess I should have read this before I commented to Franck's post, your way is 
easier to get the files into the cache. Oh well.



Dave

On Tuesday 28 March 2006 02:07, Franck Bourdonnec wrote:
> > by the way, did anybody figure out how to build ipcop on ubuntu?
> >
> > ---eric
>
> It buils perfectly. No problem. Just install gcc4 and some
> other tools (you will see in error message fot
> what it missing in log).
>
>
>
> Franck

I would think that having the toolchain and md5sum file in the cache would 
make that a moot point. I don't think enough people know about the toolchain 
prebuild that is available. I'm actually able to build on the 64 bit version 
of SuSE 10 using a 32 bit konsole session. The real obstacle here would be 
the fact that it's a gcc4 system were it not for the prebuild toolchain. Look 
on this page http://sourceforge.net/project/showfiles.php?group_id=40604

Dave

----- Original Message ----- 
From: "Franck Bourdonnec" <fbo...@ch...>
To: <ipc...@li...>
Sent: Tuesday, March 28, 2006 12:07 PM
Subject: Re: [IPCop-devel] Plans for 1.4.11 releasedate?


> >
> > by the way, did anybody figure out how to build ipcop on ubuntu?
> >
> > ---eric
> >
> It buils perfectly. No problem. Just install gcc4 and some
> other tools (you will see in error message fot
> what it missing in log).
>
>
>
> Franck
>
Did you use the prebuild toolchain or the full build?
We should not need the macro gcc fix if only prebuild toolchain is usable on
last ubuntu.

I have tested once building on i586 using gentoo-2005.1.
During toolchain build on i586, it actually hang forever during gcc build
when the macro fix for gcc-4 is applied and when the macro fix is commented
out, it does normally build.


Gilles

On 28 Mar 2006, at 11:07, Franck Bourdonnec wrote:

>>
>> by the way, did anybody figure out how to build ipcop on ubuntu?
>>
>> ---eric
>>
> It buils perfectly. No problem. Just install gcc4 and some
> other tools (you will see in error message fot
> what it missing in log).
>
> Franck

Or, you can download the precompiled toolchain, engineered by Gilles  
Espinasse, which is what I did.

You run the make command "./make.sh gettoolchain" to download it,  
before you do a build. If make finds the toolchain.tgz file in / 
cache, it uses it.

Sorted.

Eric

Bugs item #1459920, was opened at 2006-03-28 10:56
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1459920&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: General
Group: 1.4.10
Status: Open
Resolution: None
Priority: 5
Submitted By: Jeremy Tucker (regs4ships-net)
Assigned to: Nobody/Anonymous (nobody)
Summary: Port forwards are not accessible

Initial Comment:
Hi IPCop guys,

Here's a brainteaser for you.

I'm a very satisfied user of IPCop, however recently 
I've discovered a bug I hope you guys can fix.

Here's my network setup:

     RED
      |
      |
      | Red
      | 10.10.10.10
      |
   IPCOP router
      |
      | Green
      | 10.0.0.1
     /
    +  10.0.0.10 web server
    |
    +  10.0.0.20 client

IPCop is set up with 1 port forward:

Forward port 80 from the default red IP to port 80 on 
10.0.0.10

What works:

When accessing 10.10.10.10:80, all is well and I 
receive web pages from the web server 10.0.0.10

What doesn't work:

When 10.0.0.20 tries to access 10.10.10.10:80, nothing 
happens, eventually the browser times out.

My theory:

I think that IPCop receives the client's TCP 
connection, changes the destination IP as per the 
forwarding rule, but leaves the source IP as 10.0.0.20.

So the web server, instead of replying to 10.10.10.10, 
tries to reply to 10.0.0.20 directly. The client isn't 
expecting this reply, so discards it, and hence the web 
server can't be contacted in this way.

My solution:

I think IPCop should masquerade the connection from the 
client (i.e. set the tcp source address to itself). It 
should then re-address the returning packets from the 
web server and send them to the client.

Justification:

I use many 'black box' firewalls from companies like 
Netgear and Linksys, and they all have this 
functionality to masquerade green->port forward 
connections.

Thank you for looking into this, and for a very 
comprehensive open-source firewall in IPCop.

Best regards,

Jeremy Tucker
Network Manager
Regs4ships Limited
Southampton
UK

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1459920&group_id=40604

>
> by the way, did anybody figure out how to build ipcop on ubuntu?
>
> ---eric
>
It buils perfectly. No problem. Just install gcc4 and some
other tools (you will see in error message fot
what it missing in log).



Franck

I have only three (well technically speaking four) patches left:

make.sh
lfs/linux
config/kernel/kernel.config.i486{,.smp}

I made way too many changes to make.sh so I want to break them into separate 
patches and apply them according to function, one at a time.  Then I want to 
try a few more things before I commit lfs/linux and the configs -- like I 
said there's a conflict between grsecurity and one/some of the other patches.

IvanK.

On Monday 27 March 2006 23:58, Eric S. Johansson wrote:
> Eric Oberlander wrote:
>
> by the way, did anybody figure out how to build ipcop on ubuntu?

what's the problem with ubuntu?  Compiler? I only run LFS on my machines...

IvanK.

Eric Oberlander wrote:

> Testing the new backup options was one of the few things to do. We  
> then have to add about 25 new phrases to the Language Database when  
> the code is frozen. But, I think Gilles wants to do a separate kernel  
> upgrade shortly after v1.4.11, so we can pick up any available  
> translated Language strings in v1.4.12.

I think you should institute the same policy I had on 1.2 release.  Any 
time anyone asks when it's going to be released, they automatically owe 
you very high-quality chocolate.  I got a very nice slicing bar from New 
Zealand.  The chocolate ginger was especially good and remembered quite 
favorably to this day.

by the way, did anybody figure out how to build ipcop on ubuntu?

---eric

I'll commit lfs/* and make.sh later today.

IvanK.

Le Lundi 27 Mars 2006 12:30, Ivan Kabaivanov a =C3=A9crit=C2=A0:
> After a very long break, last sunday I resumed my hlfs work on cvs and on
> friday I could finally finish the entire build without any errors.=20
> However, the grsecurity patch conflicts with these:
> openswan natt patch
> openswan klips patch
>
> With these two and grsecurity applied, the installer kernel oopses very
> early on.  With just the grsecurity patch applied, it loads fine.  With
> these applied and grsecurity applied but disabled, the resulting kernel
> still oopses in the same manner.
>
> The question is: Do you want me to commit my changes now, or after I try =
to
> isolate the problem?  If I commit now, more people will be able to give it
> a try and have a better chance of finding the offender quicker.  If I hold
> off committing, it might take me awhile because I can't be burning and
> testing cds at work, so I'll be limitted to only a couple hours a day,
> after work, and of course weekends.
>
> What's the consensus?
>
> IvanK.
>

Commit with explaining somewhere easily found/read=20
where howto disable offending modules.

=46ranck

After a very long break, last sunday I resumed my hlfs work on cvs and on 
friday I could finally finish the entire build without any errors.  However, 
the grsecurity patch conflicts with these:
openswan natt patch
openswan klips patch

With these two and grsecurity applied, the installer kernel oopses very early 
on.  With just the grsecurity patch applied, it loads fine.  With these 
applied and grsecurity applied but disabled, the resulting kernel still 
oopses in the same manner.

The question is: Do you want me to commit my changes now, or after I try to 
isolate the problem?  If I commit now, more people will be able to give it a 
try and have a better chance of finding the offender quicker.  If I hold off 
committing, it might take me awhile because I can't be burning and testing 
cds at work, so I'll be limitted to only a couple hours a day, after work, 
and of course weekends.

What's the consensus?

IvanK.

----- Original Message ----- 
From: "olaf" <co...@ba...>
To: "Gilles Espinasse" <g....@fr...>
Cc: "Achim Weber" <dot...@gm...>; "IPCOP devel"
<ipc...@li...>
Sent: Saturday, March 25, 2006 2:28 PM
Subject: Re: [IPCop-devel] Plans for 1.4.11 releasedate?


> Dear Gilles,
>
> Gilles Espinasse wrote:
>
> >> are there any plans for the releasedate of 1.4.11?
> >>
> >> I ask because 1.4.10 is 4 month old now and the rootfiles for 1.4.11
update are quite long:
>  >
> > I hope on the following days or it will be on the beginning of the next
week
>
> Just out of curiosity, what kind of things are still open for 1.4.11 ?
> As Achim said, the list of changes is already quite long.
>
>
> Cheers Olaf
>
New backup work but related changes still need review.
V1.4.11 will be released just after.

Gilles

Thanks are due to Raina Otoni, who has recently completed the  
Japanese translation of IPCop's web interface. It's been added to CVS  
and will be in v1.4.11, when it's released.

Eric

On 25 Mar 2006, at 12:28, olaf wrote:

> Dear Gilles,
>
> Gilles Espinasse wrote:
>
>>> are there any plans for the releasedate of 1.4.11?
>>>
>>> I ask because 1.4.10 is 4 month old now and the rootfiles for  
>>> 1.4.11 update are quite long:
> >
>> I hope on the following days or it will be on the beginning of the  
>> next week
>
> Just out of curiosity, what kind of things are still open for 1.4.11 ?
> As Achim said, the list of changes is already quite long.
>
> Cheers Olaf

Testing the new backup options was one of the few things to do. We  
then have to add about 25 new phrases to the Language Database when  
the code is frozen. But, I think Gilles wants to do a separate kernel  
upgrade shortly after v1.4.11, so we can pick up any available  
translated Language strings in v1.4.12.

Eric

On Thursday 23 March 2006 23:39, Ivan Kabaivanov wrote:
> cvs down again?
>
> IvanK.
>
>

I didn't try it when you posted this but anonymous access is working for me 
today.

Dave

Dear Gilles,

Gilles Espinasse wrote:

>> are there any plans for the releasedate of 1.4.11?
>>
>> I ask because 1.4.10 is 4 month old now and the rootfiles for 1.4.11 update are quite long:
 >
> I hope on the following days or it will be on the beginning of the next week

Just out of curiosity, what kind of things are still open for 1.4.11 ?
As Achim said, the list of changes is already quite long.


Cheers Olaf

-- 

A weizen a day helps keep the doctor away.

At 8:36 PM +0000 3/23/06, Eric Oberlander wrote:
>On 23 Mar 2006, at 19:01, Achim Weber wrote:
>
>>Hi Community,
>>
>>some committed users of IPCop-Forum.de have translated the installation
>>and the administration manual into german. The manuals are available
>>as PDF, CHM, packaged HTML and online HTML. You find the manuals under
>>the following link:
>>     http://www.ipcop-forum.de/links.php
>>     (Section "Deutsche =DCbersetzung der original Dokumentation")
>>
>>We want to thank all translaters and co-helpers.
>>
>>
>>Hallo Community,
>>
>>einige engagierte Mitglieder von IPCop-Forum.de haben das
>>Installations- und das Administrationshandbuch ins Deutsche =FCbersetzt.
>>Die Handb=FCcher sind als PDF, CHM, HTML-Paket und als Online-Version
>>verf=FCgbar. Die Handb=FCcher sind unter nachfolgendem Link zu finden:
>>     http://www.ipcop-forum.de/links.php
>>     (Abschnitt "Deutsche =DCbersetzung der original Dokumentation")
>>
>>Wir m=F6chten uns an dieser Stelle noch einmal bei allen =DCbersetzern und
>>Helfern bedanken.
>>
>>
>>Best regards
>>Achim (aka dotzball), Frank (aka Darkmann), Tom (aka wintermute)
>>& IPCop-Forum.de-Community
>
>Great work. Thanks to you and the Team for all your efforts.
>
>Best wishes
>
>Eric

Thank you all for your great work.  It's folks=20
like you that make IPCop and open source software=20
work.

Harry

cvs down again?

IvanK.