ipcop-devel Mailing List for IPCop Firewall

Eric Oberlander wrote:

> I've just installed the 1.9.8 iso for testing, and on a clean install
> I get a few error in the /var/log/httpd/error_log before I create
> root/host certificates, but I eventually hit this error when I try to
> add a host-net connection type.:
> 
> Can't call method "num" on an undefined value at
> /home/httpd/cgi-bin/openvpn.cgi line 290.
> 
> Do you have to do anything on the 'Global Settings' page, like 'save' first?

Yes, a save is required at the moment.
Several issues have popped up there :-( which I missed during my last 
tests, using restore and all interfaces configured.


Anyways things should work better with current SVN. If no other issues 
arise in the coming few days, I might try to use upgrade (that should 
prove fun :-)) and bump to 1.9.9


Olaf

Hi Olaf

I've just installed the 1.9.8 iso for testing, and on a clean install
I get a few error in the /var/log/httpd/error_log before I create
root/host certificates, but I eventually hit this error when I try to
add a host-net connection type.:

Can't call method "num" on an undefined value at
/home/httpd/cgi-bin/openvpn.cgi line 290.

Do you have to do anything on the 'Global Settings' page, like 'save' first?

Eric

Selon "na...@em..." <na...@em...>:

> Sirs,
> Does any body can add "pptp" connection for IPCop ...
> this is most popular protocol in Russia !!!!
>
> Thanks< LiOn
>
This is already supported with static ip or dhcp.
On 1.4, I think you need first on setup to set a nic on RED interface (so not
'red is modem') and select pptp.
Then the remaining of the configuration is on the web interface (on the dial-up
age).

Gilles

Darren Critchley wrote:
> Robert Kerr wrote:
>>> Use ip addr to get all addresses.
>> It may perhaps be worthwhile to modify ifconfig to emit a warning when
>> used explaining that iproute2 is the preferred tool and giving example
>> commands? I can look at this at some point if people things it's a good
>> idea.
>>
> My main concern was that it breaks ipconfig when an alias is added. 
> ifconfig stops halfway through the list and spews an error about not 
> being able to find the interface details for wan-1.alias. You never get 
> to see wlan-1 if you have BLUE enabled.
> 
> I guess that it will have to be made clear in the docs, that ip addr is 
> the correct tool to use going forward.

Ideally we would have a section in the administration manual where 
'console' operations are collected.
That would also include use of setup (or at least mention its existence) 
and describe some basics like ip addr.


> I post this here as I doubt I still have CVS access, and am not sure you 
> would want to make the change, but respectfully submit it for your review.

FWIW you have SVN (and CVS) access.

Some day we will completely remove ifconfig and friends (route, arp, 
etc.), so I do not think it is worth to worry about aliases not working 
with ifconfig.


Olaf

Sirs,
Does any body can add "pptp" connection for IPCop ...
this is most popular protocol in Russia !!!!

Thanks< LiOn

Robert Kerr wrote:
> On Fri, 2009-10-30 at 07:16 +0100, Olaf Westrik wrote:
>> Darren Critchley wrote:
> 
>>> While you can add them and they appear to be working, they do break the 
>>> ifconfig command. Are there any ill effects from that?
> 
>> All code has been changed to use ip (from IPRoute2) instead of ifconfig, 
>> route, arp, etc.
> 
> Just to explain the motivation of this - the linux (net-tools) version
> of ifconfig hasn't really been updated since 2001. Overall it seemed
> that iproute2 was really the sensible choice going forward - it has
> several IPv6 related features that ifconfig doesn't.
> 
> That said, there certainly is a learning curve associated with the
> switch. Particularly for people more used to *BSD where ifconfig is
> still maintained and iproute2 doesn't exist.
> 
>> Use ip addr to get all addresses.
> 
> It may perhaps be worthwhile to modify ifconfig to emit a warning when
> used explaining that iproute2 is the preferred tool and giving example
> commands? I can look at this at some point if people things it's a good
> idea.
> 
My main concern was that it breaks ipconfig when an alias is added. 
ifconfig stops halfway through the list and spews an error about not 
being able to find the interface details for wan-1.alias. You never get 
to see wlan-1 if you have BLUE enabled.

I guess that it will have to be made clear in the docs, that ip addr is 
the correct tool to use going forward.

In the interest in not breaking ifconfig, in setaliases.c if you replace 
the period between the device(%s) and the alias label with a colon, it 
does not break ifconfig anymore.
Line 69
snprintf(command, STRING_SIZE - 1, "/sbin/ip addr flush label %s.alias",

Line 106
"/sbin/ip addr add %s/%s dev %s label %s.alias",

Line 110
"/sbin/ip addr add %s/%s dev %s label %s.alias",

In all three of those lines, if you change it to %s:alias, ifconfig 
won't break. It will only show the first alias, but at least it won't 
show an error.

I post this here as I doubt I still have CVS access, and am not sure you 
would want to make the change, but respectfully submit it for your review.

Regards,
Darren

On Fri, 2009-10-30 at 07:16 +0100, Olaf Westrik wrote:
> Darren Critchley wrote:

> > While you can add them and they appear to be working, they do break the 
> > ifconfig command. Are there any ill effects from that?

> All code has been changed to use ip (from IPRoute2) instead of ifconfig, 
> route, arp, etc.

Just to explain the motivation of this - the linux (net-tools) version
of ifconfig hasn't really been updated since 2001. Overall it seemed
that iproute2 was really the sensible choice going forward - it has
several IPv6 related features that ifconfig doesn't.

That said, there certainly is a learning curve associated with the
switch. Particularly for people more used to *BSD where ifconfig is
still maintained and iproute2 doesn't exist.

> Use ip addr to get all addresses.

It may perhaps be worthwhile to modify ifconfig to emit a warning when
used explaining that iproute2 is the preferred tool and giving example
commands? I can look at this at some point if people things it's a good
idea.

-- 
 Robert Kerr

Darren Critchley wrote:
> Just thought I would ask, are aliases actually working as expected in 
> the latest 1.9.x builds?

Yes (at least I hope so ;-)).


> While you can add them and they appear to be working, they do break the 
> ifconfig command. Are there any ill effects from that?

All code has been changed to use ip (from IPRoute2) instead of ifconfig, 
route, arp, etc.

Use ip addr to get all addresses.


Olaf

Bugs item #2889096, was opened at 2009-10-29 18:28
Message generated for change (Tracker Item Submitted) made by 
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=2889096&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: User Interface
Group: 1.4.21
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: https://www.google.com/accounts ()
Assigned to: Nobody/Anonymous (nobody)
Summary: Snort Helper program Error.

Initial Comment:

On the Intrusion Detection System: "Snort"

When I try to "Refresh update List" or "Download new ruleset" I recive this ERROR Message:

Helper program returned error code: HTTP::Response=HASH(0x82a3c94)->code

I am Running a P3-1ghz, 512meg ram and 4 x 3C905 TX Nics.

Is there any other info you need?



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=2889096&group_id=40604

IPCop 1.9.8 is released


v1.9.8 is a BETA version, *DO NOT* use in a productive environment.

Some things will work, for example cleaning your harddisk on installation.
Some things may work.
Some things will not work.

There may be updates to later versions, but it is very likely that a 
full installation is required to use newer versions.
There will be no support.


If you want to help, you can do so by testing and reporting any issues
you should find. Reports should go to the ipcop-devel mailing list.
Make sure that reports are verbose! also specify the exact version you
have been testing, either 1.9.8 or SVN version number if you are 
building IPCop by yourself.
A simple "xyz does not work" will get you nowhere! and is more than 
likely to be ignored.


For those familiar with earlier IPCop versions, IPCop v2 is different.

Noteworthy:
- the GUI uses 8443 instead of 445
- SSH uses 8022 instead of 222
- access to IPCop and to the internet from internal networks (aka
Green, Blue, Orange) is very much different. Spend some time with the
various options you will find under "Firewall Settings" and the online
admin manual.
- translations are incomplete
- (online) manual is still incomplete but large sections are available
and worth reading.


v1.9.8 is a BETA version, *DO NOT* use in a productive environment.



Happy testing :-)
Olaf

Resume?
What recommendations?

----- Original Message ----- 
Sent: Monday, October 26, 2009 11:59 PM


>> Could you test on console 5 with hdparm /dev/hda to see what is reported.
hdparm: not found

>> You could too test with dd if=/dev/zero of=/dev/hda bs=1M count=5
5+0 ...... in
5+0 ...... out
(I am at home. I don't remember exactly what was written)

On console 1:
tar error
<OK>

On console 2:
[...]
....tar ..... /harddisk .........

On console 3:
[...]
tar: read short

I entered on console 5 the last command TAR [...]. At the end of the output
string "tar: read short"

On 10/27/2009 5:57 PM, Gilles Espinasse wrote:
>
> ----- Original Message -----
> From: "Eric S. Johansson"<es...@ha...>
> To: "IPCOP devel"<ipc...@li...>
> Sent: Tuesday, October 27, 2009 10:38 PM
> Subject: [IPCop-devel] more 1.4.2X build problems.
>
>
>> got yet another customer generated feature fix to integrate.  grabbed the
> latest
>> cvs of 1.4 and found it can't handle compressed kernel modules.  any idea
> why?
>> It's been a while since I've mucked with 2.4
>>
> Didn't you use cvs main branch with 2.6 kernel?
>
> IPCOP_V_1_4 branch has modules compressed with gzip like v1.9.x
>

ugh.  I updated from my last dip into 1.4 (a few months ago) instead of starting 
fresh.  maybe I should mv and start anew.

----- Original Message ----- 
From: "Eric S. Johansson" <es...@ha...>
To: "IPCOP devel" <ipc...@li...>
Sent: Tuesday, October 27, 2009 10:38 PM
Subject: [IPCop-devel] more 1.4.2X build problems.


> got yet another customer generated feature fix to integrate.  grabbed the
latest
> cvs of 1.4 and found it can't handle compressed kernel modules.  any idea
why?
> It's been a while since I've mucked with 2.4
>
Didn't you use cvs main branch with 2.6 kernel?

IPCOP_V_1_4 branch has modules compressed with gzip like v1.9.x

Gilles

got yet another customer generated feature fix to integrate.  grabbed the latest 
cvs of 1.4 and found it can't handle compressed kernel modules.  any idea why? 
It's been a while since I've mucked with 2.4

David W Studeman wrote:

>> Enable "Connection debugging" and watch for log messages in RED section.
>>
> 
> I always have it checked. The logs show nothing more than the lcp being 
> terminated by the peer up to exit and nothing more until I click connect 
> on the main page.

Odd. ip-down should start rc.connectioncheck for retrying.
I have added/rearranged logging to help track this.


Olaf

>> Could you test on console 5 with hdparm /dev/hda to see what is reported.
hdparm: not found

>> You could too test with dd if=/dev/zero of=/dev/hda bs=1M count=5
5+0 ...... in
5+0 ...... out
(I am at home. I don't remember exactly what was written)

On console 1:
tar error
<OK>

On console 2:
[...]
....tar ..... /harddisk .........

On console 3:
[...]
tar: read short

I entered on console 5 the last command TAR [...]. At the end of the output 
string "tar: read short"

Olaf Westrik wrote:
> David W Studeman wrote:
>> Olaf Westrik wrote:
>>> David W Studeman wrote:
>>>> The ppp portion of the SVN tree has certainly come a long way in the 
>>>> last few weeks thanks to your efforts. The only real issue I notice is 
>>>> that when red goes down, even though persistent is checked, it makes no 
>>>> attempt to redial. It's the only thing I can see right now that doesn't 
>>>> work as far as dialing and redialing goes.
>>> That is using a 3G modem as RED, correct?
>>>
>>>
>>> Olaf
>>>
>> Correct.
>>
>>
> 
> Enable "Connection debugging" and watch for log messages in RED section.
> 
> 
> Olaf

I always have it checked. The logs show nothing more than the lcp being 
terminated by the peer up to exit and nothing more until I click connect 
on the main page.

-- 
Dave Studeman
http://www.raqcop.com

David W Studeman wrote:
> Olaf Westrik wrote:
>> David W Studeman wrote:
>>> The ppp portion of the SVN tree has certainly come a long way in the 
>>> last few weeks thanks to your efforts. The only real issue I notice is 
>>> that when red goes down, even though persistent is checked, it makes no 
>>> attempt to redial. It's the only thing I can see right now that doesn't 
>>> work as far as dialing and redialing goes.
>>
>> That is using a 3G modem as RED, correct?
>>
>>
>> Olaf
>>
> Correct.
> 
> 

Enable "Connection debugging" and watch for log messages in RED section.


Olaf

Olaf Westrik wrote:
> David W Studeman wrote:
>> The ppp portion of the SVN tree has certainly come a long way in the 
>> last few weeks thanks to your efforts. The only real issue I notice is 
>> that when red goes down, even though persistent is checked, it makes no 
>> attempt to redial. It's the only thing I can see right now that doesn't 
>> work as far as dialing and redialing goes.
> 
> 
> That is using a 3G modem as RED, correct?
> 
> 
> Olaf
> 
Correct.


-- 
Dave Studeman
http://www.raqcop.com

David W Studeman wrote:
> The ppp portion of the SVN tree has certainly come a long way in the 
> last few weeks thanks to your efforts. The only real issue I notice is 
> that when red goes down, even though persistent is checked, it makes no 
> attempt to redial. It's the only thing I can see right now that doesn't 
> work as far as dialing and redialing goes.


That is using a 3G modem as RED, correct?


Olaf

ges...@us... wrote:
> Revision: 3742
>           http://ipcop.svn.sourceforge.net/ipcop/?rev=3742&view=rev
> Author:   gespinasse
> Date:     2009-10-25 22:34:25 +0000 (Sun, 25 Oct 2009)
>
> Log Message:
> -----------
> Due to the upgrade to coreutils-0.7.6, hostname no more accept -f option
> Fix that. Without option, we already have the FQDN
>
>   

We 'normally' use hostname from net-tools, which has the -f option.
Not installing hostname from coreutils breaks some testcases later.

I did a quick grep and could only find rc.sysinit and httpscert as users 
of hostname. So changing should not be a big problem (perhaps I missed 
something though ?).

We will need to stop net-tools from installing hostname though, to not 
overwrite hostname on a full build.


Olaf

The ppp portion of the SVN tree has certainly come a long way in the 
last few weeks thanks to your efforts. The only real issue I notice is 
that when red goes down, even though persistent is checked, it makes no 
attempt to redial. It's the only thing I can see right now that doesn't 
work as far as dialing and redialing goes.
-- 
Dave Studeman
http://www.raqcop.com

----- Original Message ----- 
From: "Igoriy" <me...@co...>
To: <ipc...@li...>
Sent: Sunday, October 25, 2009 10:13 PM
Subject: Re: [IPCop-devel] ipCOP 1.9.x and Compact Flash


> Selected 'nodma' at the boot menu. I chose to install at FLASH.
> After create the partitions on CF, immediately at the beginning of OS 
> installation i'm see error "tar error".

Could you test on console 5 with hdparm /dev/hda to see what is reported.

You could too test with dd if=/dev/zero of=/dev/hda bs=1M count=5
That will write 5 MB of zero to the flash disk.

Gilles

Selected 'nodma' at the boot menu. I chose to install at FLASH.
After create the partitions on CF, immediately at the beginning of OS 
installation i'm see error "tar error".
________________________________________________________

----- Original Message ----- 
From: Игорь Ю. Картавцев
To: ipc...@li...
Sent: Sunday, October 25, 2009 6:43 PM
Subject: [IPCop-devel] ipCOP 1.9.x and Compact Flash


> Version 1.9. x, I can't put on Compact Flash installation writes "tar
error" and everything ...  :(
> Version 1.4.21 has properly.
> CF size 4Gb
>
How did you proceed?
1.9.x has direct support on install.
You just need to select the proper button during install.

If you CF adaptator does not support DMA, you may disable dma using
hdparm -d0 /dev/hda (if your disk is hda) on a separate console
or selecting nodma at the boot menu.

Gilles