ipcop-devel Mailing List for IPCop Firewall

Feature Requests item #3590429, was opened at 2012-11-27 12:02
Message generated for change (Tracker Item Submitted) made by rgfpy
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=3590429&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: RobertG (rgfpy)
Assigned to: Nobody/Anonymous (nobody)
Summary: urlfilter

Initial Comment:
It would be great and excellent if the file can be included in a list urlfilter.cgi address or group of addresses so that one can choose anything over your list of addresses defined either block or allow the IP. the same would be good in the file proxy.cgi

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=3590429&group_id=40604

Feature Requests item #3588715, was opened at 2012-11-20 03:03
Message generated for change (Tracker Item Submitted) made by 
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=3588715&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: Next major version
Status: Open
Priority: 5
Private: No
Submitted By: https://www.google.com/accounts ()
Assigned to: Nobody/Anonymous (nobody)
Summary: make restore more foolproof

Initial Comment:
Backup and restore is very inflexible.  If users misunderstand or deviate even slightly from the instructions, they will be frustrated.  Some ways to "fix" this are

1.) I'd like to suggest that the encryption key be tar'd alongside the DAT and TIME file into a single backup file.  That wouldvprevent lots of user problems with forgetting to export the key file.  (For example: the ability to backup directly to a mounted USB KEY, but not being able to export the encryption key in the same way seems like a problem to me.  Instead, they need to use a different process [unmount, put USB in the web administrator's computer, and export key] to get a "complete" disaster recovery backup.)  This feature request opens up a bigger can of worms though, because now the encrypted key needs to be stored in /var/ipcop/backup, so it can simply be copied to the USB.  And the encrypted key needs to be updated during password changes, or if the backup.key is somehow changed.

2.)  If #1 is rejected, I'd liek to suggest using *.key for restores.  Many users want to rename the backup.xx.key file.  The backup prefix looks unnecessary, and when told that they must rename the DAT file, and that the KEY file must be the contain the exact same hostname/domainname, they tend to rename the KEY file as well. For that reason I'd also suggest that the exported KEY file be named hostname.domainname.backup.key (and then the files stay together in sorted-by-name lists as well).  If multiple KEY files exist, try them in preference order (hostname..., backup..., x.key) and check each time if the unencrypted DAT file is a valid tar.   The KEY ought to be used during USB-MOUNT restores also.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=3588715&group_id=40604

----- Mail original -----
> De: "Olaf Westrik" <wei...@ip...>
> À: "g esp" <g....@fr...>, "IPCop devel" <ipc...@li...>
> Cc: "Eric Oberlander" <eri...@gm...>
> Envoyé: Dimanche 18 Novembre 2012 11:22:38
> Objet: Re: [IPCop-devel] linux-headers upgrade to 3.0.39
> 
> On 2012-10-12 17:55, g....@fr... wrote:
> 
> > I make everyday some progress toward an upgrade to linux-3.4
> > kernel.
> > I am building with last 3.4.13 actually.
> 
> What is the current state for building with 3.4 kernel?
> 
I have commited everything else.
I build with 3.4.19

There is a few kernel option to be decided :
-  Support for large (2TB+) block devices and files CONFIG_LBDAF:
I would say maybe no, (ext3 size limit is 8 teraB)

- Tickless System (Dynamic Ticks) CONFIG_NO_HZ
Should we not test with that option? That should spare a bit of power.

- High Resolution Timer Support CONFIG_HIGH_RES_TIMERS
I think every distrib use that

- Maximum number of CPUs
Change from 4 to 8 cpu will cost in kernel size 4*8 kB, so probably yes

- Toshiba Laptop support and Dell laptop support
May enable some additional system management features (with additional code), should be limited to some models

- /dev/cpu/microcode - microcode support
Usually, a bios up to date could provide the microcode update, so this option should serve only when bios did not have the microcode update and a specific cpu need a microcode update.


- Transparent proxying support CONFIG_NETFILTER_TPROXY
?

There is many more other options to decide.

> I would like to start working towards first release candidate. I am
> aware that there will not be many that will test rc-versions, but we
> must offer the option due to the large number of modifications
> between 2.0 and 2.1.
> 
> 
> > - the /run change (not yet fully ready actually)
> 
> Can't we leave that as is for now?
> 
That was my conclusion too.
I fixed mdadm to use /var/run and configured util-linux-2.22.

Gilles

I'm actually currently working on integrating WLANAP addon into IPCop,
although at the moment I'm working on the back-end (crda, hostapd,
wpa_supplicant, etc) I'll shortly be working on the front-end (WebGUI) as
soon as I obtain a wlan card. I hope to contribute my work to the actual
project very soon :)

On Sun, Nov 18, 2012 at 7:30 PM, David W Studeman <da...@da...>wrote:

> Olaf Westrik wrote:
>
> > On 2012-11-15 05:24, David W Studeman wrote:
> >
> >> Beside the typical end user using rc.event.local to start it, what would
> >> be the logical place to start this script? It IS a service that can be
> >> started and stopped as most services can be. The other question is, does
> >> having this operating gain anything?
> >
> > To gain or not to gain...
> > That would require some crypto performance measurements. Something like
> > iperf/jperf are doing for network transfer.
> >
> >
> > Olaf
>
> I'll have to test it. It's there, I might as well use it. There are a quite
> a few people using PFSense on these (Symantec 5420 and variations thereof).
> I also think that one of their drivers handles it out of the box.
>
> What am I going to do with all those ethernet ports? There are six. Red
> will
> be handled by the Solos-pci, Blue by a usb2 wifi dongle. That leaves Green
> and Orange. If only I could afford a Mansion and full time staff so I can
> make a bunch of subnets for them to use in their Quarters.
>
> As a side note: I was able to get a USB2 Ubiquiti SR71 WLAN working with
> your WlanAP addon including Draft N I think. It has two antenna ports and I
> think there are none built in. It required a chunk of firmware to work.
> It's
> rather powerful. It shows as Draft N  using my laptop and wifi data
> sniffing
> programs hut also shows 54mbs as the max. I wish I had gone with Ubiquiti
> stuff a lot sooner.
> --
> Dave Studeman
> http://www.raqcop.com
>
>
>
>
> ------------------------------------------------------------------------------
> Monitor your physical, virtual and cloud infrastructure from a single
> web console. Get in-depth insight into apps, servers, databases, vmware,
> SAP, cloud infrastructure, etc. Download 30-day Free Trial.
> Pricing starts from $795 for 25 servers or applications!
> http://p.sf.net/sfu/zoho_dev2dev_nov
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>

Hi all,
I observed the issue that IPCop is unable to install on storage devices 
which hold non-IPCop partition data already during my intensive testing 
with the 1.9.x line, but it seems that this issue is still with actual 
release. I got this issue also reported from some friends who use IPCop; 
actually a friend repoteded it to me who wanted to use a HD which was 
formerly partitioned by M0n0wall.
In all cases it helped to wipe the partion data with something like:
dd if=/dev/zero of=/dev/[h|s]da bs=1k count=1000
but I wonder why the IPCop installer cant correctly partion itself or 
wipe the storage device 1st - although it claims to do so with its 
warning .... :-P
its always troublesomely to 1st do the wiping with a LiveCD - specially 
when the firewall hardware is an embedded system with a flash where you 
need to disassemble the whole hardware in order to pull the CF ...

Gün.

Olaf Westrik wrote:

> On 2012-11-15 05:24, David W Studeman wrote:
> 
>> Beside the typical end user using rc.event.local to start it, what would
>> be the logical place to start this script? It IS a service that can be
>> started and stopped as most services can be. The other question is, does
>> having this operating gain anything?
> 
> To gain or not to gain...
> That would require some crypto performance measurements. Something like
> iperf/jperf are doing for network transfer.
> 
> 
> Olaf

I'll have to test it. It's there, I might as well use it. There are a quite 
a few people using PFSense on these (Symantec 5420 and variations thereof). 
I also think that one of their drivers handles it out of the box. 

What am I going to do with all those ethernet ports? There are six. Red will 
be handled by the Solos-pci, Blue by a usb2 wifi dongle. That leaves Green 
and Orange. If only I could afford a Mansion and full time staff so I can 
make a bunch of subnets for them to use in their Quarters.  

As a side note: I was able to get a USB2 Ubiquiti SR71 WLAN working with 
your WlanAP addon including Draft N I think. It has two antenna ports and I 
think there are none built in. It required a chunk of firmware to work. It's 
rather powerful. It shows as Draft N  using my laptop and wifi data sniffing 
programs hut also shows 54mbs as the max. I wish I had gone with Ubiquiti 
stuff a lot sooner.
-- 
Dave Studeman
http://www.raqcop.com 

----- Mail original -----
> De: "Olaf Westrik" <wei...@ip...>
> À: "Gilles Espinasse" <g....@fr...>, "IPCop devel" <ipc...@li...>
> Envoyé: Dimanche 18 Novembre 2012 20:36:29
> Objet: Re: [Ipcop-svn] SF.net SVN: ipcop:[6853] ipcop/trunk
> 
> On 2012-11-18 15:03, ges...@us... wrote:
> 
> > +	# This issue disappear on 2.22
> >   	# CCACHE_CPP2=1 replace the CFLAGS -fPIE hack and workaround a
> >   	not well identified gcc-4.4 issue that trigger
> >   	# lscpu.c: In function 'read_hypervisor':
> >   	# lscpu.c:446: error can't find a register in class 'BREG' while
> >   	reloading 'asm'
> >   	# lscpu.c:446: error 'asm' operand has impossible constraints
> > -	# Testing is prone to error, CCACHE_RECACHE= is required to avoid
> > ancient cache hit
> > -	cd $(DIR_APP)&&  make -j $(PARALLELISM) V=1 CCACHE_CPP2=1
> > +	# Testing compilation with ccache is prone to error,
> > CCACHE_RECACHE= is required to avoid ancient cache hit
> > +	cd $(DIR_APP)&&  make -j $(PARALLELISM) V=1
> 
> I've tried several variants to clean ccache, but I still seem to need
> CCACHE_CPP2=1 to be able to build util-linux
> 
> 
> Olaf
> 
I restored CCACHE_CPP2=1.
I don't know what happen.
That's by mistake once compiling manually to run the test suite that I find compilation working without CCACHE_CPP2=1.
Since that worked until I do
export CCACHE_RECACHE=
make

Gilles

On 2012-11-18 15:03, ges...@us... wrote:

> +	# This issue disappear on 2.22
>   	# CCACHE_CPP2=1 replace the CFLAGS -fPIE hack and workaround a not well identified gcc-4.4 issue that trigger
>   	# lscpu.c: In function 'read_hypervisor':
>   	# lscpu.c:446: error can't find a register in class 'BREG' while reloading 'asm'
>   	# lscpu.c:446: error 'asm' operand has impossible constraints
> -	# Testing is prone to error, CCACHE_RECACHE= is required to avoid ancient cache hit
> -	cd $(DIR_APP)&&  make -j $(PARALLELISM) V=1 CCACHE_CPP2=1
> +	# Testing compilation with ccache is prone to error, CCACHE_RECACHE= is required to avoid ancient cache hit
> +	cd $(DIR_APP)&&  make -j $(PARALLELISM) V=1

I've tried several variants to clean ccache, but I still seem to need 
CCACHE_CPP2=1 to be able to build util-linux


Olaf

On 2012-11-15 05:24, David W Studeman wrote:

> Beside the typical end user using rc.event.local to start it, what would be
> the logical place to start this script? It IS a service that can be started
> and stopped as most services can be. The other question is, does having this
> operating gain anything?

To gain or not to gain...
That would require some crypto performance measurements. Something like 
iperf/jperf are doing for network transfer.


Olaf

On 2012-10-12 17:55, g....@fr... wrote:

> I make everyday some progress toward an upgrade to linux-3.4 kernel.
> I am building with last 3.4.13 actually.

What is the current state for building with 3.4 kernel?

I would like to start working towards first release candidate. I am 
aware that there will not be many that will test rc-versions, but we 
must offer the option due to the large number of modifications between 
2.0 and 2.1.


> - the /run change (not yet fully ready actually)

Can't we leave that as is for now?


Olaf

I am in possession of two Symantec 5420 Firewall appliances that contain an 
Iwill G478 motherboard and in Symantec's case, one of the optional Crypto 
Accelerators, a Broadcom BCM5823 is standard. Iwill themselves made a 
barebones appliance from this board only the Crypto Accelerator was an 
option and you had more choices than just the BCM5823. I believe HiFn was an 
option as well as one other. 

I started a special build tree for this appliance aside from the Cobalt 
stuff and managed to make an LFS that downloads the bcm58xx driver from 
Sourceforge and builds it. It builds two utilities that can read 
/dev/cryptonet, a separate libubsec.so that resides in /usr/lib NOT 
/usr/lib/engines. The driver package comes with a start script that loads 
the driver and makes the device node /dev/cryptonet. This script is copied 
to /etc/rc.d/bcm58xx. I had to do a minor patch to the driver source to make 
it look for the correct kernel otherwise it looks for the build host 
version. 

Beside the typical end user using rc.event.local to start it, what would be 
the logical place to start this script? It IS a service that can be started 
and stopped as most services can be. The other question is, does having this 
operating gain anything?  

Now that I have it building, loading and working, will the system use it? 
SHOULD the system use it if it even can? I thought since it is there I might 
as well build and load something to the bcm5823. It is an out of kernel 
driver as you might have concluded. Nobody pushed very hard for inclusion 
into the newer kernels as it needed updating to cover more than just the 
5820 which was slower. This driver started as an outgrowth of the 2.4 
kernel's bcm5820 driver to not only work with 2.6 and up but to cover newer 
faster chips. 

Here is the output of the two utilities which will only work if the driver 
is loaded and /dev/cryptonet is created as well as it's own 
/usr/lib/libubsec existing. It does not care about the same named library in 
the engines directory. Here we go, sorry about the email truncation:

root@5420:~ # b58stats
bcm58xx stats - (Public Key Ops):
Dv|       IKE|   IKEfail|     DHP|     DHS|    RPub|    RPrv|      DS|      
DV
 1|         1|         0|       1|       0|       0|       0|       0|       
0
  |      0.00|      0.00|    0.00|    0.00|    0.00|    0.00|    0.00|    
0.00
root@5420:~ # b58diag
Card number 0 requested.
1 cards present in the system.
Device type BCM5823 Revision 1. Driver version 2.10
succeeded.

Side Facts: This appliance is a socket 478 and comes with a 2ghz Celeron and 
uses PC2100 ram, has six 82551 Intel Nics built in, has two usb ports which 
support USB2 and one com port. Com2 is used for the 16x2 lcd. It does have 
headers for VGA (standard adapter needs rewiring to work) Parallel and a 
header for led signals for all six nics, only eth0 is wired on this. A PCI 
slot exists on all of them but some appliances would need a slot cut into 
the back to use it. I have one with the cutout and mount already there as a 
facory option. 

I set my build to use the serial port at 115200 out of the box via extlinux 
and inittab. It can easily be installed via Virtual and a slaved USB drive 
and then set up via serial at first. It's a 1U appliance. I would never have 
a monitor attached unless there was something I could do in the bios which 
is doubtful. ACPI works perfectly on this. My motivation is that I need 
something that can use my Solos PCI Quad. The Cobalts work with the Pulsar 
but not with the Solos. There is reportedly an endian swap on the Cobalt PCI 
bus that causes some hardware not to work, eg PCI Wireless nics and the 
Solos. This swap was carried to the 5000 series before Sun Killed Cobalt.    

-- 
Dave Studeman
http://www.raqcop.com 

Feature Requests item #3582802, was opened at 2012-11-03 01:55
Message generated for change (Tracker Item Submitted) made by greg33300
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=3582802&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Greg (greg33300)
Assigned to: Nobody/Anonymous (nobody)
Summary: (re-)Add rtsp module

Initial Comment:
Hi i'm old user of ipcop (since beginning) , and i were watch TV (french) with my adsl box : rtsp module power :-D

But since version 2.0 : no rtsp module available

For Waiting i'm using port forwarding, but if i want back using more than one IP to see TV it's become complicating

Please add RTSP module ASAP, thanks a lot, and good continuation 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=3582802&group_id=40604