From patchwork Fri Jun 18 17:24:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 4440 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4G65QB2bs9z3x6s for ; Fri, 18 Jun 2021 17:24:34 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4G65Q968cYz1CT; Fri, 18 Jun 2021 17:24:33 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4G65Q95drWz2ydk; Fri, 18 Jun 2021 17:24:33 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4G65Q80ypzz2xbB for ; Fri, 18 Jun 2021 17:24:32 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4G65Q70vTjz16S for ; Fri, 18 Jun 2021 17:24:30 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1624037071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TaaxbacuWYcoVdCwE/cvezPoTkv6nzYQ+rPWOoXD1KU=; b=FgkMq4pVf2ng/wMEjpxZ7UX24vVJxI1VLcQeWneK0c/Xi2mA2vee2EED772PfTX759yTN2 UcbYy/Gt+ngSn9Bg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1624037071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TaaxbacuWYcoVdCwE/cvezPoTkv6nzYQ+rPWOoXD1KU=; b=HEQAeNzVE92RJGb6shcbyFmI5eJ1XTSiXcwmqyEzTWrwd8/rTbFEpjhgH7hrWLYLOU/78q No9E/MldZq+C/VprBZtHlrjTqVYINaRqdnvbihAdIOJFdy9HphR824ddZc5MSmk70bGu9N 19DIRshM6bEIkiSvGdRm5Qtg8vh9rjZAjEo1bNec0wlZgvIvTrLMjnqmXbtmfkV5Ix6b8f 5TIHzFNImpVRIqt3QjRojLCoSetpo4K8tlt91o5l3L3i2WKCwGbUmacFyyBA2laCim+3v8 xpnvLG5F3PDnUzw6bt829/A0nfRH3+JjhSev7T55xYXTmiJPa2WScaPe57/RWA== Subject: [PATCH 1/3] squid-asnbl: New package To: development@lists.ipfire.org References: <243ade9e-d013-089b-7189-d4752689af72@ipfire.org> From: =?utf-8?q?Peter_M=C3=BCller?= Message-ID: <57f76aed-f963-e152-098a-3ca705cf3995@ipfire.org> Date: Fri, 18 Jun 2021 19:24:29 +0200 MIME-Version: 1.0 In-Reply-To: <243ade9e-d013-089b-7189-d4752689af72@ipfire.org> Content-Language: en-US X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This package adds an ASNBL helper for detecting Fast Flux setups and selectively announced networks (i. e. FQDNs resolving to IP addresses not being announced by an Autonomous System) to the distribution. Afterwards, the helper script is located at /usr/bin/asnbl-helper.py . Signed-off-by: Peter Müller --- config/rootfiles/common/squid-asnbl | 1 + lfs/squid-asnbl | 83 +++++++++++++++++++++++++++++ make.sh | 1 + 3 files changed, 85 insertions(+) create mode 100644 config/rootfiles/common/squid-asnbl create mode 100644 lfs/squid-asnbl diff --git a/config/rootfiles/common/squid-asnbl b/config/rootfiles/common/squid-asnbl new file mode 100644 index 000000000..f129f441e --- /dev/null +++ b/config/rootfiles/common/squid-asnbl @@ -0,0 +1 @@ +usr/bin/asnbl-helper.py diff --git a/lfs/squid-asnbl b/lfs/squid-asnbl new file mode 100644 index 000000000..f2396074d --- /dev/null +++ b/lfs/squid-asnbl @@ -0,0 +1,83 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2021 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 0.2.1 + +THISAPP = squid-asnbl-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) + +DIR_APP = $(DIR_SRC)/$(THISAPP) + +TARGET = $(DIR_INFO)/$(THISAPP) + +DEPS = libloc squid python3 + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 2225c88ba8e3ae25f5e5c8075f0e7ae8 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zvxf $(DIR_DL)/$(DL_FILE) + + # Install ASNBL helper script + cd $(DIR_APP) && install -o root -g root -m 0755 asnbl-helper.py /usr/bin/asnbl-helper.py + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index fc03ebcd5..19567769a 100755 --- a/make.sh +++ b/make.sh @@ -1623,6 +1623,7 @@ buildipfire() { lfsmake2 socat lfsmake2 libcdada lfsmake2 pmacct + lfsmake2 squid-asnbl } buildinstaller() { From patchwork Fri Jun 18 17:24:50 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 4441 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4G65QZ58ylz3x6s for ; Fri, 18 Jun 2021 17:24:54 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4G65QY73sXz1fH; Fri, 18 Jun 2021 17:24:53 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4G65QY6ZT5z2xcT; Fri, 18 Jun 2021 17:24:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4G65QX0qPVz2xbB for ; Fri, 18 Jun 2021 17:24:52 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4G65QW1ljnz13j for ; Fri, 18 Jun 2021 17:24:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1624037091; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Xv99GGn6VBM9V6A3dc2VxiO175hOdIP3g06va8k+svw=; b=atiNFCE4Pp+3ZU4yo8V+cd4g3uAkHNiuKUgD4G42Vpuw5UGG7Uq4Dej83WXI3Q6mDNo5+f Opvy3uHG6nWd7HCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1624037091; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Xv99GGn6VBM9V6A3dc2VxiO175hOdIP3g06va8k+svw=; b=GezhStc18AHqjxHVQ8TQ5EGjQlyCPfJYXHfvag6zL5nAo2JeWhIeJ6SV7c5S1JjyiZ30Cy qk2u7tU/53L6qsgnGlClT0IQgHYMi/2vsXUPJOq6iOrPM+MhKum7C++e+jSGCONNjnmCgi Xum/vJ2h6re14d1P1p5oMMswSvCT+WnaNZu4BAFNzHY14NjOlQuAJ2nsML4OPZiKrNQ4PS kfvz0ZftKSs1NzQCjBghe/mcOn+EI7LcefIfj5VAbsa2nwWjlrwKaeprd1uCBiZ6eorVdy 4rkbxufs/DQAHFt1lRRiymc38LNAP1Deqr4TlesjEsmdECdhSiTGvHL8TAr4vw== Subject: [PATCH 2/3] proxy.cgi: Implement proactive Fast Flux detection and detection for selectively announced destinations To: development@lists.ipfire.org References: <243ade9e-d013-089b-7189-d4752689af72@ipfire.org> <57f76aed-f963-e152-098a-3ca705cf3995@ipfire.org> From: =?utf-8?q?Peter_M=C3=BCller?= Message-ID: <461409ad-7b86-8744-b66d-1a36279dcc42@ipfire.org> Date: Fri, 18 Jun 2021 19:24:50 +0200 MIME-Version: 1.0 In-Reply-To: <57f76aed-f963-e152-098a-3ca705cf3995@ipfire.org> Content-Language: en-US X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This patch adds two new features to IPFire's web proxy: (a) Proactive Fast Flux detection FQDNs are resolved to their IP addresses, which are then resolved to corresponding Autonomous System Numbers using IPFire's location database. Most destinations will scatter across a very low number of ASNs (not to be confused with IP addresses!). FQDNs hosted on Fast Flux setups have a significantly higher ASN diversity (5 is usually a good threshold), so they can be proactively detected. (b) Detection for selectively announced destinations Especially in targeted operations, miscreants host FQDNs for exfiltrating data or malware distributions on ASNs not announced globally, but only to the intended victim or it's upstream ISPs. That way, security researchers located in other parts of the internet have no insights into these attacks, hence not being able to publish listings or send take down notices for the domains used. While RPKI made this attack harder, it can still be observed every now and then. This feature also protects against accessing FQDNs resolving to IP addresses not being globally routeable, hence providing a trivial mitigation for so-called "rebound attacks" - which we cannot filter at DNS level currently. Signed-off-by: Peter Müller --- html/cgi-bin/proxy.cgi | 89 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index 78ad33ad2..b7227deaf 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -21,6 +21,7 @@ use strict; use Apache::Htpasswd; +use Scalar::Util qw(looks_like_number); # enable only the following on debugging purpose #use warnings; @@ -225,6 +226,9 @@ $proxysettings{'THROTTLING_GREEN_TOTAL'} = 'unlimited'; $proxysettings{'THROTTLING_GREEN_HOST'} = 'unlimited'; $proxysettings{'THROTTLING_BLUE_TOTAL'} = 'unlimited'; $proxysettings{'THROTTLING_BLUE_HOST'} = 'unlimited'; +$proxysettings{'ASNBL_FASTFLUX_DETECTION'} = 'off'; +$proxysettings{'ASNBL_FASTFLUX_THRESHOLD'} = '5'; +$proxysettings{'ASNBL_SELECANN_DETECTION'} = 'off'; $proxysettings{'ENABLE_MIME_FILTER'} = 'off'; $proxysettings{'AUTH_METHOD'} = 'none'; $proxysettings{'AUTH_REALM'} = ''; @@ -414,6 +418,21 @@ if (($proxysettings{'ACTION'} eq $Lang::tr{'save'}) || ($proxysettings{'ACTION'} $errormessage = $Lang::tr{'invalid maximum incoming size'}; goto ERROR; } + if (($proxysettings{'ASNBL_FASTFLUX_DETECTION'} eq 'on') || ($proxysettings{'ASNBL_SELECANN_DETECTION'} eq 'on')) + { + if (-z $proxysettings{'ASNBL_FASTFLUX_THRESHOLD'}) { + $errormessage = $Lang::tr{'advproxy fastflux no threshold given'}; + goto ERROR; + } + if (! looks_like_number($proxysettings{'ASNBL_FASTFLUX_THRESHOLD'})) { + $errormessage = $Lang::tr{'advproxy fastflux threshold invalid'}; + goto ERROR; + } + if (($proxysettings{'ASNBL_FASTFLUX_THRESHOLD'} < 2) || ($proxysettings{'ASNBL_FASTFLUX_THRESHOLD'} > 10)) { + $errormessage = $Lang::tr{'advproxy fastflux threshold out of bounds'}; + goto ERROR; + } + } if (!($proxysettings{'AUTH_METHOD'} eq 'none')) { unless (($proxysettings{'AUTH_METHOD'} eq 'ident') && @@ -797,6 +816,14 @@ $selected{'THROTTLING_GREEN_HOST'}{$proxysettings{'THROTTLING_GREEN_HOST'}} = "s $selected{'THROTTLING_BLUE_TOTAL'}{$proxysettings{'THROTTLING_BLUE_TOTAL'}} = "selected='selected'"; $selected{'THROTTLING_BLUE_HOST'}{$proxysettings{'THROTTLING_BLUE_HOST'}} = "selected='selected'"; +$checked{'ASNBL_FASTFLUX_DETECTION'}{'off'} = ''; +$checked{'ASNBL_FASTFLUX_DETECTION'}{'on'} = ''; +$checked{'ASNBL_FASTFLUX_DETECTION'}{$proxysettings{'ASNBL_FASTFLUX_DETECTION'}} = "checked='checked'"; + +$checked{'ASNBL_SELECANN_DETECTION'}{'off'} = ''; +$checked{'ASNBL_SELECANN_DETECTION'}{'on'} = ''; +$checked{'ASNBL_SELECANN_DETECTION'}{$proxysettings{'ASNBL_SELECANN_DETECTION'}} = "checked='checked'"; + $checked{'ENABLE_MIME_FILTER'}{'off'} = ''; $checked{'ENABLE_MIME_FILTER'}{'on'} = ''; $checked{'ENABLE_MIME_FILTER'}{$proxysettings{'ENABLE_MIME_FILTER'}} = "checked='checked'"; @@ -1627,6 +1654,24 @@ END print < +
+ + + + + + + + + + + + + + + +
$Lang::tr{'advproxy asbased anomaly detection'}
$Lang::tr{'advproxy fastflux detection'}:$Lang::tr{'advproxy fastflux detection threshold'}:
$Lang::tr{'advproxy selectively announcements detection'}:
+
END ; @@ -3507,6 +3552,50 @@ if (@ssl_ports) { print FILE "http_access deny CONNECT !SSL_ports\n"; } + if ((($proxysettings{'ASNBL_FASTFLUX_DETECTION'} eq 'on') && (!-z $proxysettings{'ASNBL_FASTFLUX_THRESHOLD'})) || ($proxysettings{'ASNBL_SELECANN_DETECTION'} eq 'on')) { + print FILE "external_acl_type asnblhelper children-max=10 children-startup=2 ttl=86400 %DST /usr/bin/asnbl-helper.py /var/ipfire/proxy/asnbl-helper.conf\n"; + print FILE "acl asnbl external asnblhelper\n"; + print FILE "http_access deny asnbl\n\n"; + + # Write ASNBL helper configuration file... + open(ASNBLFILE, ">${General::swroot}/proxy/asnbl-helper.conf"); + flock(ASNBLFILE, 2); + + print ASNBLFILE< X-Patchwork-Id: 4442 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4G65Qx3FJvz3x7Q for ; Fri, 18 Jun 2021 17:25:13 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4G65Qx0jjTz1fq; Fri, 18 Jun 2021 17:25:13 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4G65Qx0Dclz2xd1; Fri, 18 Jun 2021 17:25:13 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4G65Qv55MTz2xbB for ; Fri, 18 Jun 2021 17:25:11 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4G65Qt5rcJz92 for ; Fri, 18 Jun 2021 17:25:10 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1624037111; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=05A3EAesvmDdz/6txCH7DJagnK4UX8CDjqjtKuAZ5Pc=; b=DogbvZ2k4nV/8gCk/i6JfLlO652ETNJxZHvhWpmP6Bk7TW8Jnmx8EH13VUW9LemyiO4a0u oBLTxnRVIErYF0Cw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1624037111; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=05A3EAesvmDdz/6txCH7DJagnK4UX8CDjqjtKuAZ5Pc=; b=g5OyzNMKmTWJktFVh6lhbNMsBC5TEmjnjN7JNJa1y3DnSt5VmiBxNrtiLC8zdgygqZ3WG4 t/2Tt9WEV+yUhOFq9kSpF0npIUwQVQakBwDBZVL5vcNl+o6kpFzkg6bMK+/EnzSiI9N75H Le5ystE80I5r38S81gCLOVifyzxICVKlnoMFaY8VXMQMnINZ5czx2wX/607LqIOn11QBTI GzGPK70nz4tboSb6LU77Krf2ulVe0CU/goL3xvq06UyBwgBv+oSilawwSRjj5QgHTyygLC 6wc83lNZm/luw+TbIXVkmSqoCMCwViNTB04jGPj2Of33JpP7lx801vYTh6WNSQ== Subject: [PATCH 3/3] langs: Add English and German translations for newly added web proxy features To: development@lists.ipfire.org References: <243ade9e-d013-089b-7189-d4752689af72@ipfire.org> <57f76aed-f963-e152-098a-3ca705cf3995@ipfire.org> <461409ad-7b86-8744-b66d-1a36279dcc42@ipfire.org> From: =?utf-8?q?Peter_M=C3=BCller?= Message-ID: <8f645836-9b33-1540-33d1-a59426b42c0b@ipfire.org> Date: Fri, 18 Jun 2021 19:25:09 +0200 MIME-Version: 1.0 In-Reply-To: <461409ad-7b86-8744-b66d-1a36279dcc42@ipfire.org> Content-Language: en-US X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" Signed-off-by: Peter Müller --- langs/de/cgi-bin/de.pl | 7 +++++++ langs/en/cgi-bin/en.pl | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 0d2228ede..642ff53de 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -255,6 +255,7 @@ 'advproxy advanced web proxy configuration' => 'Proxy-Konfiguration', 'advproxy allowed subnets' => 'Erlaubte Subnetze (eins pro Zeile)', 'advproxy allowed web browsers' => 'Zulässige Clients für Web-Zugriffe', +'advproxy asbased anomaly detection' => 'Anomalieerkennungen auf Basis Autonomer Systeme', 'advproxy back to main page' => 'Zurück zur Hauptseite', 'advproxy banned ip clients' => 'Gesperrte IP-Adressen (eine pro Zeile)', 'advproxy banned mac clients' => 'Gesperrte MAC-Adressen (eine pro Zeile)', @@ -326,6 +327,11 @@ 'advproxy errmsg wpad invalid ip or mask' => 'WPAD: Ungültige IP oder Subnetz für ausgenommenes IP-Subnetz', 'advproxy error design' => 'Design der Fehlermeldungen', 'advproxy error language' => 'Sprache der Fehlermeldungen', +'advproxy fastflux detection' => 'Verbindungen zu auf Fast Flux-Setups gehosteten Zielen verweigern', +'advproxy fastflux no threshold given' => 'Kein Schwellwert für Fast Flux-Erkennung angegeben', +'advproxy fastflux detection threshold' => 'Schwellwert', +'advproxy fastflux threshold invalid' => 'Eingegebener Schwellwert für Fast Flux-Erkennung ist ungültig', +'advproxy fastflux threshold out of bounds' => 'Eingegebener Schwellwert für Fast Flux-Erkennung befindet sich außerhalb zulässiger Grenzwerte', 'advproxy friday' => 'Fr', 'advproxy from' => 'Von', 'advproxy group access control' => 'Gruppenbasierte Zugriffskontrolle', @@ -362,6 +368,7 @@ 'advproxy reset' => 'Zurücksetzen', 'advproxy saturday' => 'Sa', 'advproxy save and restart' => 'Speichern und Neustart', +'advproxy selectively announcements detection' => 'Verbindungen zu Zielen in selektiv propagierten Netzen verweigern', 'advproxy squid version' => 'Squid Versionsnummer', 'advproxy squidclamav' => 'SquidClamav', 'advproxy ssadvanced proxy' => 'advanced proxy', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 2ba6961f3..1f82c47ca 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -252,6 +252,7 @@ 'advproxy advanced web proxy configuration' => 'Advanced web proxy configuration', 'advproxy allowed subnets' => 'Allowed subnets (one per line)', 'advproxy allowed web browsers' => 'Allowed clients for web access', +'advproxy asbased anomaly detection' => 'Anomaly detections based on Autonomous Systems information', 'advproxy back to main page' => 'Back to main page', 'advproxy banned ip clients' => 'Banned IP addresses (one per line)', 'advproxy banned mac clients' => 'Banned MAC addresses (one per line)', @@ -323,6 +324,11 @@ 'advproxy errmsg wpad invalid ip or mask' => 'WPAD: Invalid IP or subnet for excluded IP subnet', 'advproxy error design' => 'Error messages design', 'advproxy error language' => 'Error messages language', +'advproxy fastflux detection' => 'Deny access to destinations hosted on fast flux setups', +'advproxy fastflux no threshold given' => 'No threshold was given for fast flux detection', +'advproxy fastflux detection threshold' => 'Threshold', +'advproxy fastflux threshold invalid' => 'Supplied fast flux detection threshold is invalid', +'advproxy fastflux threshold out of bounds' => 'Supplied fast flux detection threshold is out of bounds', 'advproxy friday' => 'Fri', 'advproxy from' => 'From', 'advproxy group access control' => 'Group based access control', @@ -359,6 +365,7 @@ 'advproxy reset' => 'Reset', 'advproxy saturday' => 'Sat', 'advproxy save and restart' => 'Save and Restart', +'advproxy selectively announcements detection' => 'Deny access to destinations hosted on selectively announced networks', 'advproxy squid version' => 'Squid cache version', 'advproxy squidclamav' => 'SquidClamav', 'advproxy ssadvanced proxy' => 'advanced proxy',