MantisBT - Issues

0004548: Please provide documentation in PDF

Thu, 23 May 2013 16:00:13 +0200

Online HTML does not print correctly -- exceeds margins.

Copy and paste into Word requires excessive time tryint to reformat.

Request a PDF of the documentation, please.

0004547: HTTP Proxy - (104) Connection reset by peer

Tue, 21 May 2013 17:33:09 +0200

Kernel version: 2.6.32.43-57.e48.i686.PAE

When HTTP Proxy filter is ON a web page can't be loaded at all (may be the issue will happened with others but I can't say at the moment). Instead, a web page from endian saying "(104) Connection reset by peer" appeares. When I turn the HTTP proxy off I can successfully load the web page in question. The problematic web page is - http://www.minfin.bg. [^]
The issue arisen regardless of the browser.

Thank you in advance.

0004374: Installation of Endian Firewall from USB flash drive fails

Fri, 17 May 2013 00:23:00 +0200

When trying to install EFW 2.5.1 from an USB flash drive, the installation fails before the first user input is required.
The system is booting the vmlinuz which is located on the USB drive. After that the /etc/inittab from instroot.gz is read and /bin/installer is executed. This installer file runs in an endless loop and the VGA display flashes blue/black.

Yes, I double-checked the MD5 checksums on the EFW installation ISO file.

0004472: SIP Proxy Endian 2.5.1

Wed, 08 May 2013 07:44:49 +0200

Endian 2.5.1 rewrites sip packets exiting tap1 with the IP to main interface. It also makes the changes inside the SIP packet which makes me believe there is some sort of SIP proxy action. The problem is I cannot find a sip proxy installed and this was a fresh install of Endian 2.5.1 not an upgrade. Is there some daemon running in the back that does these rewrites? Please see attached wire shark sniff. I have removed public IP information. Please note this capture was taken issuing the command: "tcpdump -s 0 -i tap1 -w tap1.pcap" The correct flow show have the internal IP of the phone as the source and not the external IP of the Endian uplink interface. I believe this started happening when I enabled the web proxy in transparent mode with dansguardian but cannot be sure. When the server replies, it replies to the endian public IP address over the public internet.

0004391: System not recognizing Intel nic based on 82574L

Wed, 08 May 2013 03:49:45 +0200

Possibly somehow related to issue 0003451

System has two onboard nics, one is Intel 82574L, the other 82579LM. One of those two nics is not seen by 2.5 in networconfiguration but works just without any problems in 2.4...I think both NICs use the e1000e driver.

I've seen a difference in loading network driver as it seems the 2.4 uses 1.2.20-NAPI while 2.5 is loading at the same point 1.0.2-k2.

Any idea?

0004545: error squid_ldap_group

Tue, 07 May 2013 15:21:43 +0200

Hello guys,

I started to test the Endian 2.5.1 and enjoyed. Currently I'm testing on a VM in Hyper-v. Well, already configured for integration with Active Directory and is listing the users and groups usually ok communication. I began to configure some access policies for a group of AD and early functioned properly, but after some time the policies do not work anymore and blocked everything, just out of nowhere. Since this policy is like first. When running a tail-f / var / log / squid / cache.log appear the following errors:

user filter '(&(objectClass=person)(sAMAccountName=squid))', searchbase 'dc=edusoft,dc=net'
attempting to authenticate user 'CN=squid,CN=Users,DC=edusoft,DC=net'
Connected OK
group filter '(&(objectClass=person)(sAMAccountName=squid)(memberOf=CN=Suporte,OU=Groups Edusoft,OU=Edusoft,DC=edusoft,DC=net))', searchbase 'dc=edusoft,dc=net'
squid_ldap_group WARNING, LDAP search error 'Operations error'
Connected OK
group filter '(&(objectClass=person)(sAMAccountName=squid)(memberOf=CN=Administrators,CN=Builtin,DC=edusoft,DC=net))', searchbase 'dc=edusoft,dc=net'

At another time also appeared the message:

Can't contact LDAP server

It seems that error is occurring in the validation of the AD group, but when I edit an access policy appears normally AD users and groups.

Any idea what it might be?

Rodrigo

0004544: Upgrading to 2.5.1 (Development) causes error code

Thu, 02 May 2013 09:59:04 +0200

Running efw-upgrade command result in following error message:

========================
Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm

Committing transaction...
Preparing... ######################################## [ 0%]
error: file /etc/init.d from install of chkconfig-1.3.11.2-1 conflicts with file from package initscripts-2.2.41-0.endian5
error: file /bin/login from install of util-linux-ng-2.13.1-6_WR.endian5 conflicts with file from package shadow-utils-4.0.3-56.endian1

ERROR: Error during upgrade of rpm
ERROR: Error during upgrade of rpm

0004543: green network fault in hyper-v 2012 legacy adapter

Thu, 02 May 2013 08:59:20 +0200

After few hours from reboot green don't respond. I've 2 uplink network in same hyper-v 2012 network Adapter configuration that work without problem.

0004542: WCCP in Proxy

Wed, 01 May 2013 04:37:33 +0200

Hi,

It is possible to setup the wccp in proxy? I can see that in version 2.5.1 community, wccp2 is already compiled. I have added the wccp2_* setup in squid template and created a GRE tunnel manually using ip tunnel and ifconfig to up the GRE interface.

the problem is, i don't see any tcpdump in the GRE tunnel that I created. It seems the wccp request is not getting to the wccp router.

Please help.

Thank you.

Regards,

Albert

0004162: clamd crash, tcp socket should be monitored

Tue, 23 Apr 2013 16:17:02 +0200

Hi Guys,

this happens randomly:

Sep 2 09:19:46 xxx havp[3818]: Scanner errors: Clamd: Could not connect to scanner socket (lasturl: http://www.google.it/ [^])
Sep 2 09:19:47 xxx havp[3824]: Clamd: Could not connect to scanner! Scanner down?
Sep 2 09:20:45 xxx havp[3813]: Clamd: Could not connect to scanner! Scanner down?
Sep 2 09:20:45 xxx havp[3811]: Scanner errors: Clamd: Could not connect to scanner socket (lasturl: http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl [^])
Sep 2 09:21:06 xxx havp[4051]: Clamd: Could not connect to scanner! Scanner down?
Sep 2 09:21:06 xxx havp[4034]: Scanner errors: Clamd: Could not connect to scanner socket (lasturl: http://check.sanasecurity.com/ [^])
Sep 2 09:21:06 xxx havp[4034]: 127.0.0.1 POST 200 http://check.sanasecurity.com/ [^] 264+495 SCANERROR Clamd: Could not connect to scanner socket

**POSSIBLE SOLUTION**

We should check the clamd socket with monit, which is pretty easy since monit support the CLAMAV protocol!

root@xxx:/etc/monit.d # cat clamd.conf
check process clamd with pidfile /var/run/clamav/clamd.pid
group virus
start program = "/etc/init.d/clamd start"
stop program = "/etc/init.d/clamd stop"
if failed host 127.0.0.1 port 3310 protocol CLAMAV for 5 cycle then restart
if 5 restarts within 5 cycles then timeout
depends on clamavd_bin
mode manual

check file clamavd_bin with path /usr/sbin/clamd
group virus
if failed checksum then unmonitor
if failed permission 755 then unmonitor
if failed uid root then unmonitor
if failed gid root then unmonitor
mode manual

This would increase reliability for http proxy and smtp proxy as well!
What you think?

0003221: http proxy don't returns anything after some time. If flush cache of Squid, the firewall works again correctly

Tue, 16 Apr 2013 21:29:36 +0200

After some utilisation the firewall don't returns pages. Ping is working, dns also.
If I flush the cache of squid, proxy is again OK.

0004540: DUAL LINK WAN

Tue, 16 Apr 2013 19:25:09 +0200

Hello

I have the following scenario for Internet access:

WAN0 - eth1: RED
WAN1 - eth4: RED

If I set any of the links as the second link shows MAIN FAILURE with the following log.

/var/log/messages
Apr 16 13:11:52 LOFW001GFT sudo: nobody : TTY=unknown ; PWD=/home/httpd/cgi-bin ; USER=root ; COMMAND=/etc/rc.d/uplinks start uplink1 --with-hooks
Apr 16 13:11:52 LOFW001GFT uplink[uplink1]: Starting Uplink 'uplink1'
Apr 16 13:11:53 LOFW001GFT kernel: [ 261.936098] e1000e 0000:01:00.1: irq 30 for MSI/MSI-X
Apr 16 13:11:53 LOFW001GFT kernel: [ 261.986175] e1000e 0000:01:00.1: irq 30 for MSI/MSI-X
Apr 16 13:11:53 LOFW001GFT kernel: [ 261.986492] ADDRCONF(NETDEV_UP): eth4: link is not ready
Apr 16 13:11:53 LOFW001GFT kernel: [ 262.606054] e1000e 0000:01:00.1: irq 30 for MSI/MSI-X
Apr 16 13:11:53 LOFW001GFT kernel: [ 262.656051] e1000e 0000:01:00.1: irq 30 for MSI/MSI-X
Apr 16 13:11:53 LOFW001GFT kernel: [ 262.656379] ADDRCONF(NETDEV_UP): eth4: link is not ready
Apr 16 13:11:53 LOFW001GFT uplink[uplink1]: Notify uplinks daemon about status change of uplink 'uplink1'. Status id FAILED
Apr 16 13:11:53 LOFW001GFT uplink[uplink1]: Uplink 'uplink1' status: 'OFFLINE'
Apr 16 13:11:53 LOFW001GFT uplink[uplink1]: Could not set up routing

As a way to circumvent the problem perform the following activities.

1) Link setup MAIN
2) mv /var/efw/uplinks/uplink1/failure /var/efw/uplinks/uplink1/active
3) ifconfig eth4 200.146.46.254 netmask 255.255.255.248

This way I can climb the two links but it is not the most pleasant thing to do.

Would like to help me solve this problem?

I await a return.

Sincerely.

Fernando Guse

0004295: NTOP Segmentation Fault

Fri, 12 Apr 2013 18:54:44 +0200

Hello everyone,

I have noticed an issue with the 2.5.1 EFW Ntop that I wanted to report. After an out-of-the box installation, I tried to activate the NTOP monitoring system. It would run for a while (3-7 minutes) and then stop.

/etc/init.d/ntop status would return that ntop is dead, but a PID still exists.

I couldn't find any useful logs for ntop outside of monit.log, but it only ever contained information about the system starting and stopping. As such, I launched ntop using the configurations in /etc/ntop/ntop.conf (But I specified to use http 3001 not https 3001).

It seemed to work fine for a while, which blew my mind, but eventually it stopped with the following output:

Thu Mar 8 10:33:02 2012 THREADMGMT[t2967894960]: SIH: Idle host scan thread running [p9813]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2976283568]: SFP: Fingerprint scan thread running [p9813]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2917264304]: NPS(WAN): pcapDispatch thread starting [p9813]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2917264304]: NPS(WAN): pcapDispatch thread running [p9813]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2908875696]: NPS(2): Started thread for network packet sniffing [br0]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2900487088]: NPS(3): Started thread for network packet sniffing [eth0]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2908875696]: NPS(br0): pcapDispatch thread starting [p9813]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2908875696]: NPS(br0): pcapDispatch thread running [p9813]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2900487088]: NPS(eth0): pcapDispatch thread starting [p9813]
Thu Mar 8 10:33:02 2012 THREADMGMT[t2900487088]: NPS(eth0): pcapDispatch thread running [p9813]
./start_ntop.sh: line 2: 9813 Segmentation fault ntop --user ntop --db-file-path /var/ntop --interface eth1,br0,eth0 --trace-level 3 --https-server 0 --http-server 3001 --disable-schedyield --no-fc

It will start every time, but eventually fails with the segmentation fault

0004539: Sarg generates no access denied

Thu, 11 Apr 2013 12:34:03 +0200

By enabling authenticated proxy the SARG can not generate the access denied page.

0004532: 2.5.1 DNS issue openvpn

Sun, 07 Apr 2013 18:40:41 +0200

I have installed 2.5.1 several times now on different hardware and version 2.5.1 will not push DNS serves to clients. Clients can ping and get to servers by IP but not FQDN. If I install 2.5.0 it pushes the DNS servers every time. It looks to us that the OpenVPN version is the same in both versions so why does one version push DNS and the other does not?

Any suggestions before I rebuild to 2.5.0?

0004231: "Your Harddisk is to small" error message during install of 2.5 version

Sun, 07 Apr 2013 06:08:42 +0200

When installing 2.5 on VMware with a disk 15GB or less the installation fails with an error message "Your harddisk is to small" sh: -c line 0: unexpected EOF while looking for matching '"

0002464: Snort blocks smb and netbios over VPN despite FW rule

Wed, 03 Apr 2013 12:09:21 +0200

Ive got EFW 2.3 with openvpn and client is a roadwarrior. VPN works fine ie. I can ping and SSH to machines on the GREEN zone to/from the openvpn client.

PING OK : VPN client <----> GREEN zone
SSH OK : VPN client <----> GREEN zone
smb/netbios BLOCKED : VPN client <----> GREEN zone

After almost a week I figured out that snort(IPS) will block smb and netbios over the VPN despite the VPN firewall rule to allow all access, also same result if VPN firewall is disabled.

If I switch off IPS then file and print sharing WORKS. There is nothing in the logs about these packets being blocked otherwise I would have found out much earlier.

Please advise a fix to this.

0004538: calaendar problem, duplice day

Wed, 03 Apr 2013 09:28:30 +0200

in month 3 day 16 duplicate at year 2013 and in year 2012 day 17 duplicate
place after remove this bug send for me.
mgr9500@yahoo.com

0004497: Openvpn GUI settings not saved to settings file - settings file resets when saving via GUI

Fri, 22 Mar 2013 17:26:03 +0100

Hello,

I upgraded our firewall from 2.4.1 to 2.5. I restored a backup to do this, mainly because we have around 150 openvpn users I didn't want to recreate.

When I try to save global options in the GUI, nothing is saved to the /etc/openvpn.conf file. When I edit the conf file and restart the Openvpn service through SSH, everything is OK and the options are pushed correctly. The options aren't displayed in the GUI though.

When I then try to change a global option in the GUI, or even just click the save & restart button in the GUI, the openvpn.conf file gets reset to default, and my clients receive the DNS servers below instead of their correct ones (at that moment no DNS servers are defined in the conf file because of the reset)

DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1

Thanks!

0003432: HAVP => no youtube videos from iphone & ipad

Mon, 11 Mar 2013 09:41:10 +0100

When HAVP is enabled we are unable to see youtube videos with iphone or ipad.
when is disabled the problem disappears.

The issue is reproducible and the zone is indifferent (green/orange or blue).

I noticed testing this that the cause is havp but no error message in the log.

System tested was full up-to-date.

0004415: NTOP / Traffic Monitoring Is Not Working

Mon, 11 Mar 2013 05:21:02 +0100

On Endian Firewall 2.5.1.

The NTOP doesn't work even Intrusion is turned off (some reported this issue may due to Intrusion turned on).

0004535: Endian 2.5 Community does not accept special characters in the PSK

Fri, 01 Mar 2013 03:15:50 +0100

I'm trying to use a PSK for the establishment of an IPsec tunnel. This PSK contains some special characters, such as * and &.

When I try to set this PSK up at an Endian 2.5 Community firewall, it complains about these characters with an error message like this:

"Invalid characters found in the pre-shared key."

I've searched the issues database and found the issue 0000613 where the situation is the same. The responsible for the ticket says it's solved but I'm facing the same issue on version 2.5.

Please help me out.

0001151: portforwarding: unable to access GREEN from GREEN via RED portforward rule

Fri, 22 Feb 2013 14:58:25 +0100

as per summary, a device on the GREEN network is unable to access another device on the GREEN network, by using the RED interface and portforwarding.

we configure mobile devices to access resources on the GREEN network, by using the RED device and port forwarding. they can operate onsite and offsite (without vpn) this way.

0004221: kernel : xt_TCPMSS: bad length (1024 bytes) + PATCH

Thu, 21 Feb 2013 05:52:24 +0100

Hi,

a customer with 500+ concurrent voip connection (a 16 cores workstation) saying that the firewall "crashed" due to heavy voip traffic.

When logged in this is what I recall interesting:
http://pastie.org/2991370 [^]

Leaving the other problems (already know what and why) and focusing to the kernel message I found that is related with netfilter, an the matching rule (MSS) is located in mangle, chain:

Chain FORWARD (policy ACCEPT 231M packets, 33G bytes)
pkts bytes target prot opt in out source destination
1217K 66M TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU

http://rhkernel.org/#RHEL6+2.6.32-71.18.2.el6/net/netfilter/xt_TCPMSS.c [^]
63 /* Since it passed flags test in tcp match, we know it is is
64 not a fragment, and has data >= tcp header length. SYN
65 packets should not contain data: if they did, then we risk
66 running over MTU, sending Frag Needed and breaking things
67 badly. --RR */
68 if (tcplen != tcph->doff*4) {
69 if (net_ratelimit())
70 printk(KERN_ERR "xt_TCPMSS: bad length (%u bytes)\n",
71 skb->len);
72 return -1;
73 }

So the error is caused for 2 reasons:

1) Syn packets which contains data (normally not allowed)
2) TCP header larger than the packet itself

It's rare to reproduce because on rare occasions is produced this kind of traffic, however there is already a patch on this problem (I belive it's included in the vanilla).

PATCH:

http://www.gossamer-threads.com/lists/linux/kernel/1180390?do=post_view_threaded [^]

0004394: Support for Intel 82580 based network cards (Ethernet-Server-Adapter I340-T4)

Tue, 19 Feb 2013 06:23:36 +0100

The Intel Ethernet-Server-Adapter I340-T4 and other Intel 82580 based network cards don't work on Endian 2.5.1.
There is a Linux driver on the Intel website:
http://downloadcenter.intel.com/detail_desc.aspx?agr=Y&DwnldID=13663 [^]

Please add this driver to EFW Community Edition or provide a Kernel source package so that users can compile the driver itself.

Thank you very much!