]>
git.ipfire.org Git - people/mfischer/ipfire-2.x.git/log
Stefan Schantl [Tue, 29 Jan 2019 08:05:29 +0000 (09:05 +0100)]
convert-snort: Use set_ownership() from ids-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:01:20 +0000 (09:01 +0100)]
ruleset-sources: Add Emerging-Threads Pro ruleset
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:00:26 +0000 (09:00 +0100)]
logs.cgi/log.dat: Change search pattern from snort to suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:58:08 +0000 (08:58 +0100)]
ids-functions.pl: Set correct ownership for the stored error file.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:50:16 +0000 (08:50 +0100)]
ids-functions.pl: Add set_ownership() function.
This function is used to change the ownership of a given file
or directory to the user "nobody" and the group "nobody", which is
used by the WUI.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:40:34 +0000 (08:40 +0100)]
backup.pl: Run snort to suricata converter when a backup gets restored.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:26:15 +0000 (08:26 +0100)]
IDS: Install snort to suricata converter
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Mon, 28 Jan 2019 16:29:21 +0000 (17:29 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Matthias Fischer [Sun, 27 Jan 2019 17:38:04 +0000 (18:38 +0100)]
ghostscript: Update to 9.26
For details see:
https://www.ghostscript.com/doc/9.26/News.htm
This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")
Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-
4286563 .html
I saw this article and found it could be the time for an update...
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Sat, 26 Jan 2019 11:40:04 +0000 (12:40 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Michael Tremer [Thu, 24 Jan 2019 12:31:27 +0000 (12:31 +0000)]
Enable some performance tuning
These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.
Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.
On a slower system (apu1d) no performance improvement or loss
could have been measured.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 06:21:53 +0000 (06:21 +0000)]
proxy: Show error messages in English by default
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 20:34:13 +0000 (21:34 +0100)]
Postfix: update to 3.3.2
See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 05:40:41 +0000 (05:40 +0000)]
core128: Ship updated ca-certificates
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 19:59:41 +0000 (20:59 +0100)]
update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.
The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 05:40:04 +0000 (05:40 +0000)]
core128: Ship updated openssh
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 19:54:07 +0000 (20:54 +0100)]
OpenSSH: update to 7.9p1
Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Wed, 23 Jan 2019 20:19:01 +0000 (21:19 +0100)]
Merge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Wed, 23 Jan 2019 20:18:44 +0000 (21:18 +0100)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Wed, 23 Jan 2019 17:38:14 +0000 (18:38 +0100)]
kernel: update to 4.14.95
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)]
use HTTPS for downloading GeoIP database files
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 04:10:23 +0000 (04:10 +0000)]
xtables-addons: Fix generating GeoIP database
Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.
This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.
This patch changes this so that the last 12 bytes are just being dropped.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 03:06:07 +0000 (03:06 +0000)]
core128: Ship updated tzdata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 15:00:57 +0000 (16:00 +0100)]
tzdata: update to 2018i
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Tue, 22 Jan 2019 14:36:00 +0000 (15:36 +0100)]
convert-snort: Settings converter from snort to suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 22 Jan 2019 12:25:13 +0000 (13:25 +0100)]
ids.cgi: Move and rename GenerateIgnoreList() function to ids-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Michael Tremer [Tue, 22 Jan 2019 05:31:21 +0000 (05:31 +0000)]
strongswan: Update to 5.7.2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Tue, 22 Jan 2019 06:46:08 +0000 (07:46 +0100)]
kernel: x86_64 encrease NR_CPUS to 64
fixes #11963
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Tue, 22 Jan 2019 06:41:18 +0000 (07:41 +0100)]
kernel: update to 4.14.94
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Mon, 21 Jan 2019 21:04:10 +0000 (21:04 +0000)]
core128: Ship updated xt_geoip_update script
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)]
use HTTPS for downloading GeoIP database files
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Mon, 21 Jan 2019 12:04:13 +0000 (13:04 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Michael Tremer [Mon, 21 Jan 2019 10:20:29 +0000 (10:20 +0000)]
core128: Ship updated logrotate
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Sun, 20 Jan 2019 17:07:47 +0000 (18:07 +0100)]
logrotate: Update to 3.15
For details see:
https://github.com/logrotate/logrotate/releases
- timer unit: change trigger fuzz from 12h to 1h (#230)
- service unit: only run if /var/log is mounted (#230)
- preserve fractional part of timestamps when compressing (#226)
- re-indent source code using spaces only (#188)
- minage: avoid rounding issue while comparing the amount of seconds (#36)
- never remove old log files if rotate -1 is specified (#202)
- return non-zero exit status if a config file contains an error (#199)
- make copytruncate work with rotate 0 (#191)
- warn user if both size and the time interval options are used (#192)
- pass rotated log file name as the 2nd argument of the postrotate script
when sharedscript is not enabled (#193)
- rename logrotate-default to logrotate.conf (#187)
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 18:58:48 +0000 (19:58 +0100)]
Merge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Sat, 19 Jan 2019 16:24:47 +0000 (17:24 +0100)]
core127: run xt_geoip_update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 16:20:51 +0000 (17:20 +0100)]
core127: ovpn ca index.txt is also missing on some installations
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 14:16:43 +0000 (15:16 +0100)]
xt_geoip_updte: fix download url
the maxmind server delivers an old version if there are
two slashes before the database filename.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 11:08:07 +0000 (12:08 +0100)]
core127: fix typo
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 09:02:17 +0000 (10:02 +0100)]
core127: add ovpn ca changes to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 09:01:40 +0000 (10:01 +0100)]
core127: add xt_geoip_update to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 09:00:54 +0000 (10:00 +0100)]
core127: add bind to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:39 +0000 (13:53 +0100)]
core127: set reboot needed flag
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:06 +0000 (13:53 +0100)]
core127: add general-functions.pl to updater
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Fri, 18 Jan 2019 06:52:17 +0000 (07:52 +0100)]
core127: fix updater for aarch64 and armv5tel
if a arch specific filelist has the same name as the common the common filelist was ignored
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 19:24:46 +0000 (19:24 +0000)]
Revert "Disable Path MTU discovery"
This reverts commit
1c0cfaa5949e4303e8e4e2f041af86a812f3fe6c .
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 5 Nov 2018 15:21:43 +0000 (16:21 +0100)]
drop orphaned OpenSSL patches
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 14:41:54 +0000 (14:41 +0000)]
core128: Remove openssl-compat package
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 5 Nov 2018 15:12:40 +0000 (16:12 +0100)]
drop openssl-compat package
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 14:39:14 +0000 (14:39 +0000)]
core128: Ship recently updated openssl and apache
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 14:38:01 +0000 (14:38 +0000)]
Start Core Update 128
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Tue, 15 Jan 2019 14:39:25 +0000 (15:39 +0100)]
httpd: include TLS 1.3 cipher suites
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Erik Kapfer <erik.kapfer@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Tue, 15 Jan 2019 14:43:01 +0000 (15:43 +0100)]
openssl: Update to version 1.1.1a
Disabled MD2 and Aria cipher.
TLSv1.3 is now available with:
TLS_CHACHA20_POLY1305_SHA256 TLSv1.3
TLS_AES_256_GCM_SHA384 TLSv1.3
TLS_AES_128_GCM_SHA256 TLSv1.3
Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Wed, 16 Jan 2019 21:31:43 +0000 (22:31 +0100)]
core127: set pakfire version to 127
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Sun, 13 Jan 2019 11:50:26 +0000 (12:50 +0100)]
keepalived: Move change of conntrack sysctl option into package
The setting cannot be set on the default system because the ip_vs
module is not loaded by default and there is no reason to load it
just because we would be able to set the setting.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 13 Jan 2019 11:28:10 +0000 (12:28 +0100)]
GeoIP: Add accidentially removed paths to database
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 13 Jan 2019 10:53:41 +0000 (11:53 +0100)]
firewall-lib.pl: Fix incorrect path to geoip-functions.pl
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Sat, 12 Jan 2019 19:01:00 +0000 (20:01 +0100)]
linux-initrd: fix build of uInit on aarch64
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 12 Jan 2019 08:04:23 +0000 (09:04 +0100)]
core127: fix xtables kmod rootfiles for arm32 builds
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Matthias Fischer [Fri, 11 Jan 2019 13:41:57 +0000 (14:41 +0100)]
xtables 3.2: Fix for rootfile
Found during the test builds...
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Fri, 11 Jan 2019 09:05:24 +0000 (10:05 +0100)]
Revert "geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address."
Enhanching the code to fix the lookup will rapidely slow down the lookup speed. Because using
the GeoIP2 module is no option ( the reasons have been described in the commit message which will
now reverted), we have decided to temporary switch back to the old module until a nice solution has
been found.
This reverts commit
ff21ff90d24de0f648d24bb906c45738b81ce67a .
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Fri, 11 Jan 2019 09:05:23 +0000 (10:05 +0100)]
Revert "GeoIP: Drop legacy GeoIP perl module."
This reverts commit
9d1708e081d7e7ba490db3620509dcce29cb0ae8 .
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Fri, 11 Jan 2019 00:32:37 +0000 (01:32 +0100)]
xtables-addons: Fix typo in lfs
Just some typos...
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 10 Jan 2019 22:48:25 +0000 (22:48 +0000)]
Bump kernel version to ship a new PAE kernel
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 10 Jan 2019 22:46:31 +0000 (22:46 +0000)]
core127: Ship updated kernel modules for xtables
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 10 Jan 2019 22:43:45 +0000 (22:43 +0000)]
core127: Ship updated firewall functions library
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 19:40:04 +0000 (20:40 +0100)]
firewall-lib.pl: Use get_geoip_locations from geoip-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 19:40:03 +0000 (20:40 +0100)]
geoip-locations.pl: Add get_geoip_locations().
This function is used to get all available GeoIP locations.
The functions returns them as array, sorted in alphabetical order.
Reference #11959
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Thu, 10 Jan 2019 14:30:49 +0000 (15:30 +0100)]
clamav: Update to 0.101.1
For details see:
https://blog.clamav.net/2019/01/clamav-01011-patch-has-been-released.html
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 7 Jan 2019 01:32:46 +0000 (01:32 +0000)]
core127: Ship updated tar
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Thu, 10 Jan 2019 13:29:22 +0000 (14:29 +0100)]
tar: Update to 1.31, including fix for bug #11958
For details see:
http://savannah.gnu.org/forum/forum.php?forum_id=9344
"- Fix heap-buffer-overrun with --one-top-level.
- Support for zstd compression.
- The -K option interacts properly with member names given in the command line.
- Fix CVE-2018-20482"
This patch was reverted because 'tar 1.31' crashed when installing PakFire packages
with the option '--no-overwrite-dir'.
See: https://bugzilla.ipfire.org/show_bug.cgi?id=11958
Included is now a patch from https://savannah.gnu.org/bugs/?55413, which seems to fix this issue.
The test cases given in https://savannah.gnu.org/bugs/?55413#comment1 ran without problems.
As always, please check and confirm.
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 7 Jan 2019 01:28:38 +0000 (01:28 +0000)]
core127: Ship updated GeoIP functions
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 12:00:17 +0000 (13:00 +0100)]
geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address.
Drop the usage of the old legacy GeoIP perl module which was not able to handle the
new GeoLite2 databases.
Write some code to directly access the databases and extract the required data.
Usage of the GeoIP2 perl module would provide a lot of more functionality which is not
used/needed. Unfortunately ir requires at lot of additional perl modules which are
not available on IPFire and would only be build and shipped for this module. Buildig all
of them will slow down the entire build process, mess up the system and requires a lot
more space on disk.
Fixes #11962.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 12:00:16 +0000 (13:00 +0100)]
GeoIP: Drop legacy GeoIP perl module.
The legacy GeoIP perl module cannot handle the new GeoLite2 databases
provided from maxmind and therefore needs to be dropped.
Reference #11960
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 12:00:15 +0000 (13:00 +0100)]
xt_geoip_update: Adjust script to download and use the GeoLite2 database
Fixes #11961.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 12:00:14 +0000 (13:00 +0100)]
xtables-addons: Use shipped xt_geoip_build
Use the shipped xt_geoip_build directly instead of holding a copy in our GIT.
Reference #11959
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 12:00:13 +0000 (13:00 +0100)]
xtables-addons: Update to 3.2
Reference #11959
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 7 Jan 2019 00:34:30 +0000 (00:34 +0000)]
perl-Net-CIDR-Lite: Make rootfile work on other arches
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 7 Jan 2019 00:31:46 +0000 (00:31 +0000)]
perl-Net-CIDR-Lite: Fix whitespace
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 10 Jan 2019 12:00:12 +0000 (13:00 +0100)]
perl-Net-CIDR-Lite: New package.
This is a runtime dependency of the xt_geoip_build perl script
shipped by xtables-addons in version 3.2.
Reference #11960.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 6 Jan 2019 21:33:43 +0000 (21:33 +0000)]
IPVS: Enable connection tracking by default
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Sun, 6 Jan 2019 13:11:30 +0000 (14:11 +0100)]
ids-functions.pl: Downloader should reads settings from correct file
In commit
ea5c8eeb83a65791960d6cb5de6c7dc78db02fda the taken settings
for the ruleset have been stored into an own file.
The Downloader now uses this file to read-in which ruleset should be used
and downloaded.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Michael Tremer [Sun, 6 Jan 2019 09:00:47 +0000 (09:00 +0000)]
Backup conntrackd's configuration file
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 6 Jan 2019 08:59:25 +0000 (08:59 +0000)]
Add initscript for conntrackd
The daemon will be started by default when a configuration
file exists.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 6 Jan 2019 07:03:08 +0000 (07:03 +0000)]
Update translations
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Tue, 8 Jan 2019 13:14:41 +0000 (14:14 +0100)]
Fix typo in 'html/cgi-bin/logs.cgi/log.dat'
Translation string uses capital letter: 'Captive' => 'Captive Portal',
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 15:14:01 +0000 (16:14 +0100)]
core127: Ship updated proxy.cgi and regenerate configuration
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 15:09:46 +0000 (16:09 +0100)]
proxy: Allow selecting throttled bandwidth in MBit/s
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 15:02:05 +0000 (16:02 +0100)]
proxy: Suggest modern defaults for cache memory and disk
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 15:00:05 +0000 (16:00 +0100)]
proxy: Drop support for throttling only certain mime types
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 14:54:56 +0000 (15:54 +0100)]
proxy: Drop web browser check
This is neither reliable nor up to date and is therefore removed
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 14:49:18 +0000 (15:49 +0100)]
proxy: Set authentication TTL for NTLM authentication also
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 14:48:32 +0000 (15:48 +0100)]
proxy: Use correct authentication cache TTL for AD
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 14:46:20 +0000 (15:46 +0100)]
proxy: Use entered setting for auth children for AD
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 14:44:19 +0000 (15:44 +0100)]
proxy: Use correct realm for AD authentication
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 14:37:00 +0000 (15:37 +0100)]
proxy: Remove AUTH_IPCACHE_TTL
This is potentially dangerous to set larger than zero.
Authentication is perfomed on basis of IP addresses which is
not a good idea at all.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 14:27:54 +0000 (15:27 +0100)]
proxy: Drop NTLM authentication
This is the authentication againt NT 4.0 style domain controllers.
squid has dropped support for this in the 4.5 release and nobody
should be using these old domain controllers any more.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 8 Jan 2019 02:33:37 +0000 (03:33 +0100)]
squid: Run as many redirectors as we have CPU cores
This makes sure that we use the optimal ratio of memory and
CPU usage.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Tested-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Tested-by: Matthias Fischer <matthias.fischer@ipfire.org>
Daniel Weismüller [Tue, 30 Oct 2018 11:06:59 +0000 (12:06 +0100)]
BUG 11786 - squid: Remove setting for filter processes the number of Squid processes
I added a function to determine the number of cores.
Now the number of squid processes will be equal to the number of logical cores.
Further I removed the possibility of changing the number
of squid processes in the proxy.cgi
Signed-off-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: root <root@ipfire.test>
Michael Tremer [Sat, 5 Jan 2019 21:12:24 +0000 (21:12 +0000)]
Revert "core127: Ship updated tar"
This reverts commit
9ab1c9302c01f11010d0cb87a66366361465461e .
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>