]>
git.ipfire.org Git - people/pmueller/ipfire-2.x.git/log
Michael Tremer [Sat, 27 Apr 2019 02:58:44 +0000 (03:58 +0100)]
grub: Fix relocation type issue
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 27 Apr 2019 00:40:43 +0000 (01:40 +0100)]
ipfire-netboot: Fix compiling and linking with new GCC & binutils
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 26 Apr 2019 23:21:39 +0000 (00:21 +0100)]
sarg: Fix build with newer GCCs
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Fri, 26 Apr 2019 17:39:55 +0000 (19:39 +0200)]
Merge branch 'master' into next
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Fri, 26 Apr 2019 15:11:17 +0000 (16:11 +0100)]
grub: Fix build error with GCC 8
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 26 Apr 2019 15:10:25 +0000 (16:10 +0100)]
grub: Disable efiemu on PC builds
This won't compile with GCC 8 and we do not need it
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 26 Apr 2019 15:05:20 +0000 (16:05 +0100)]
nasm: Update to 2.14.02
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 26 Apr 2019 15:06:10 +0000 (16:06 +0100)]
ltrace: Bump package version
This package needs to be rebuilt because it uses elfutils
which has had an soname bump.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 26 Apr 2019 15:04:48 +0000 (16:04 +0100)]
elfutils: Update to 0.176
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Fri, 26 Apr 2019 15:08:35 +0000 (17:08 +0200)]
OpenVPN: Fixed certificate generation in French
Fixes #12060
Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 25 Apr 2019 17:31:48 +0000 (19:31 +0200)]
initscripts/suricata: Rework creation of firewall rules.
The script now will use the previously introduced seperate firewall chains called
IPS_INPUT, IPS_FORWARD and IPS_OUTPUT.
The commit also creates an AND connection between the choosen network zones in the UI and
the final firwall rules.
Fixes #12062.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Stefan Schantl [Thu, 25 Apr 2019 17:31:47 +0000 (19:31 +0200)]
initscripts/suricata: Move functions order and always use flush_fw_chain function
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Stefan Schantl [Thu, 25 Apr 2019 17:31:46 +0000 (19:31 +0200)]
firewall: Use seperate firewall chains for passing traffic to the IPS
Create and use seperate iptables chain called IPS_INPUT, IPS_FORWARD and IPS_OUTPUT
to be more flexible which kind of traffic should be passed to suricata.
Reference #12062
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Fri, 26 Apr 2019 05:43:21 +0000 (07:43 +0200)]
hostapd: bump package version
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Wed, 24 Apr 2019 10:24:33 +0000 (11:24 +0100)]
hostap: Fix wiring of checkboxes for client isolation
The checkboxes were swapped which lead to client isolation
being enabled when the UI said disabled and vice-versa.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 24 Apr 2019 10:31:28 +0000 (11:31 +0100)]
hostap: Translate configuration settings
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 24 Apr 2019 10:24:33 +0000 (11:24 +0100)]
hostap: Fix wiring of checkboxes for client isolation
The checkboxes were swapped which lead to client isolation
being enabled when the UI said disabled and vice-versa.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 24 Apr 2019 10:08:36 +0000 (11:08 +0100)]
hostap: Remove deprecated directive
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 24 Apr 2019 09:43:50 +0000 (10:43 +0100)]
hostap: Enable 80MHz bandwidth by default (when using ACS)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 24 Apr 2019 09:39:25 +0000 (10:39 +0100)]
hostap: Enable option to force clients to use 802.11w
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 24 Apr 2019 09:12:29 +0000 (10:12 +0100)]
hostap: Allow to use Automatic Channel Selection (ACS)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Tue, 23 Apr 2019 18:33:02 +0000 (20:33 +0200)]
convert-snort: Fix ownership of the generated homenet file.
Fixes #12059.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Tue, 23 Apr 2019 19:27:53 +0000 (21:27 +0200)]
suricata: Use device ppp0 if PPPoE dialin is used.
Fixes #12058.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 23 Apr 2019 19:45:42 +0000 (20:45 +0100)]
suricata: EXTERNAL_NET should equal any
This enables that we scan servers in ORANGE for clients in
GREEN which absolutely makes sense.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 21 Apr 2019 00:32:07 +0000 (01:32 +0100)]
suricata: Do not always convert rules to be bi-directional
This creates some overhead that we do not need and rules need to
be adjusted to match any direction they are supposed to match.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 23 Apr 2019 19:56:07 +0000 (20:56 +0100)]
core132: Ship updated suricata initscript
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 23 Apr 2019 19:55:22 +0000 (20:55 +0100)]
core132: Ship updated convert-snort script
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Tue, 23 Apr 2019 18:33:02 +0000 (20:33 +0200)]
convert-snort: Fix ownership of the generated homenet file.
Fixes #12059.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Koch [Tue, 23 Apr 2019 18:46:11 +0000 (20:46 +0200)]
core132: Bugfix for typo in filelist
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Tue, 23 Apr 2019 19:27:53 +0000 (21:27 +0200)]
suricata: Use device ppp0 if PPPoE dialin is used.
Fixes #12058.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 23 Apr 2019 19:45:42 +0000 (20:45 +0100)]
suricata: EXTERNAL_NET should equal any
This enables that we scan servers in ORANGE for clients in
GREEN which absolutely makes sense.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 23 Apr 2019 19:20:14 +0000 (20:20 +0100)]
core132: Ship updated list of mime types
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Koch [Wed, 17 Apr 2019 23:54:18 +0000 (01:54 +0200)]
apache / WPAD: Add correct MIME type for wpad.dat and proxy.pac
Some clients require the correct MIME type to be set for accepting/handling the Proxy-Settings properly.
See: http://findproxyforurl.com/deploying-wpad/
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 21 Apr 2019 00:32:07 +0000 (01:32 +0100)]
suricata: Do not always convert rules to be bi-directional
This creates some overhead that we do not need and rules need to
be adjusted to match any direction they are supposed to match.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Tue, 23 Apr 2019 17:21:30 +0000 (19:21 +0200)]
core131: add services.cgi to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 20 Apr 2019 16:12:21 +0000 (18:12 +0200)]
finish core131
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 20 Apr 2019 15:35:54 +0000 (17:35 +0200)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Sat, 20 Apr 2019 15:21:03 +0000 (17:21 +0200)]
kernel: update 4.14.113
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Sat, 20 Apr 2019 13:21:46 +0000 (14:21 +0100)]
Update contributors
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 20 Apr 2019 13:20:06 +0000 (14:20 +0100)]
core132: Ship WPAD/proxy changes
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 20 Apr 2019 13:18:17 +0000 (14:18 +0100)]
Update translation
Fix some apostrophe and spelling errors
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Koch [Sun, 21 Apr 2019 21:56:59 +0000 (23:56 +0200)]
squid / WPAD: Add Wiki-Link for required further adjustments to GUI
This patch adds a notice with a link to the Wiki-page https://wiki.ipfire.org/configuration/network/proxy/extend/wpad to the new WebGUI-Setion to make the user aware of the fact, that WPAD will only work correctly if he makes further adjustments:
- Add DHCP-Options for WPAD via DHCP
- Add HOST-Entries to DNS and Apache-vhost or haproxy-frontend/backend or firewall-redirect for WPAD via DNS
These additional options depend on the users environment and can not be shipped by default as they might break the users setups.
Note: The translations are only done for "en" and "de" yet!
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Koch [Sun, 21 Apr 2019 21:56:58 +0000 (23:56 +0200)]
squid / WPAD: Add GUI for exception-files for generation of proxy.pac
This patch adds the missing Web-GUI for the WPAD-Exceptions to proxy.cgi
Note: The translations are only done for "en" and "de" yet!
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Koch [Sun, 14 Apr 2019 10:08:43 +0000 (12:08 +0200)]
squid / WPAD: Add exception-files for generation of proxy.pac
This patch extends the script /srv/web/ipfire/cgi-bin/proxy.cgi by additional code for reading exceptions for URL's and IP's/Subnets from two new files:
- /var/ipfire/proxy/advanced/acls/dst_noproxy_url.acl
- /var/ipfire/proxy/advanced/acls/dst_noproxy_ip.acl
as described in: https://wiki.ipfire.org/configuration/network/proxy/extend/add_distri
These can be used to define additional URL's, IP's and Subnets that should be retrieved "DIRECT" and not via the proxy. The files have to be created by the user, as the WPAD-Feature is not enabled by default anyway. If the files are not present or their size is 0, nothing is done. I'll revise the wiki-page, after the patch is merged and the core update is released.
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Sat, 13 Apr 2019 14:55:16 +0000 (15:55 +0100)]
Enable seccomp support for qemu
Fixes: #11941
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Sat, 13 Apr 2019 14:55:15 +0000 (15:55 +0100)]
Add new package libseccomp
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 20 Apr 2019 13:10:12 +0000 (14:10 +0100)]
core132: Ship changed suricata configuration
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Sun, 21 Apr 2019 07:26:45 +0000 (09:26 +0200)]
suricata: Disable stats.log
This log is mainly needed for debugging the IPS. It writes some stats
every couple of seconds and will create some load on SD cards and other
cheap storage that we do not need.
Fixes #12056.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 20 Apr 2019 13:07:43 +0000 (14:07 +0100)]
Start Core Update 132
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Wed, 17 Apr 2019 20:30:19 +0000 (22:30 +0200)]
kernel: update to 4.14.112
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Wed, 17 Apr 2019 20:24:25 +0000 (21:24 +0100)]
suricata: Do not let oinkmaster be too verbose
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 17 Apr 2019 19:59:55 +0000 (20:59 +0100)]
suricata: Redirect oinkmaster output to perl function
The output was written to stderr before and landed in apache's
error log where we do not want it.
Fixes: #12004
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 17 Apr 2019 18:15:44 +0000 (19:15 +0100)]
Revert "hostapd: Always enable 80 MHz channel width for 802.11ac"
This reverts commit
c31c8078cffcf3f933f567cb02a366ceedd6d5da .
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 17 Apr 2019 06:38:27 +0000 (07:38 +0100)]
unbound: Drop unused function
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 17 Apr 2019 04:16:05 +0000 (05:16 +0100)]
suricata: Change runmode to workers
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Tue, 16 Apr 2019 16:05:18 +0000 (18:05 +0200)]
wireless-regdb: update to 2019.03.01
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Tue, 16 Apr 2019 12:23:17 +0000 (13:23 +0100)]
haproxy: Backup certificates, too
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 16 Apr 2019 12:22:10 +0000 (13:22 +0100)]
backup: Allow passing name of tarball for creation/restore
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 22:32:57 +0000 (23:32 +0100)]
Move IPS to a higher position in the Firewall menu
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 22:24:28 +0000 (23:24 +0100)]
remote.cgi: Move SSH Agent Forwarding to the top
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 22:22:14 +0000 (23:22 +0100)]
sshctrl: Fix syntax of generated sed command
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 22:02:57 +0000 (23:02 +0100)]
core131: Ship PTR changes in hosts.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 22:00:25 +0000 (23:00 +0100)]
Update list of contributors
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 8 Apr 2019 18:04:00 +0000 (18:04 +0000)]
Unbound: do not generate PTR if the user requested not to, do so
Partially fixes #12030
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 21:58:35 +0000 (22:58 +0100)]
Update translations
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 8 Apr 2019 18:04:00 +0000 (18:04 +0000)]
add option for selective PTR generation on hosts.cgi
In some cases, it might be useful to create an additional
host (i.e. for round robin loadbalancing) without assigning
another PTR to the IP address specified.
This patch introduces the ability to check or uncheck
PTR generation for each host individually.
Partially fixes #12030
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 20:59:41 +0000 (21:59 +0100)]
udev: Rename interfaces when MACs are uppercase
The script relied on the configuration being in lowercase.
If people manually editied their configuration file they might
not have paid attention to this and therefore this script now
also accepts uppercase MAC addresses.
Fixes: #12047
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 12 Apr 2019 16:59:21 +0000 (17:59 +0100)]
suricata: Take as much off of the CPU as possible
https://suricata.readthedocs.io/en/suricata-4.1.3/performance/high-performance-config.html
This will compile the ruleset as efficient as possible and
allows the IPS to run faster on smaller systems.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 09:29:56 +0000 (10:29 +0100)]
core131: Ship updated setup
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Fri, 12 Apr 2019 16:21:01 +0000 (18:21 +0200)]
ids.cgi: Display oinkcode section after page load when neccessary.
Fixes #12048.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 12 Apr 2019 16:36:54 +0000 (17:36 +0100)]
IPS logging: Fix date comparison for last entry
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 12 Apr 2019 16:33:39 +0000 (17:33 +0100)]
IPS logging: There is no distinguation between suricata & snort required
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 12 Apr 2019 16:32:02 +0000 (17:32 +0100)]
IPS logging: Fix reading date
The CGI script only compares mm/dd and does not care about the year.
Suricata, however, logs the year as well which has to be ignored here.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 11 Apr 2019 06:55:36 +0000 (07:55 +0100)]
zabbix_agentd: Bump package version
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Koch [Wed, 10 Apr 2019 18:33:31 +0000 (20:33 +0200)]
zabbix_agentd: Bugfix for /etc/sudoers.d/zabbix.user
Files containing an '~' or '.' are ignored by sudo when placed in the includedir /etc/sudoers.d This makes the file useless. The file is renamed to "zabbix" instead of "zabbix.user" to fix this.
See: https://www.sudo.ws/man/1.8.13/sudoers.man.html#Including_other_files_from_within_sudoers
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Koch [Wed, 10 Apr 2019 18:33:30 +0000 (20:33 +0200)]
zabbix_agentd: update to 4.2.0
Relase Notes: https://www.zabbix.com/rn/rn4.2.0
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stéphane Pautrel [Thu, 11 Apr 2019 02:47:44 +0000 (03:47 +0100)]
installer+setup: Update French translation
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Thu, 11 Apr 2019 05:34:14 +0000 (07:34 +0200)]
make.sh: fix syntax error
i have merged master>next and not deleted this line.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Thu, 11 Apr 2019 05:31:11 +0000 (07:31 +0200)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Thu, 11 Apr 2019 05:30:26 +0000 (07:30 +0200)]
Merge remote-tracking branch 'origin/master' into next
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Matthias Fischer [Fri, 5 Apr 2019 19:55:12 +0000 (21:55 +0200)]
wget: Update to 1.20.3
For details see:
https://fossies.org/linux/wget/ChangeLog
Excerpt from "NEWS":
"2019-04-05 Tim Ruehsen <tim.ruehsen@gmx.de>
Fix a buffer overflow vulnerability
* src/iri.c(do_conversion): Reallocate the output buffer to a larger
size if it is already full"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 4 Apr 2019 01:04:28 +0000 (02:04 +0100)]
core130: Ship updated apache
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Matthias Fischer [Thu, 4 Apr 2019 07:15:00 +0000 (09:15 +0200)]
apache: Update to 2.4.39
For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Tue, 9 Apr 2019 05:31:23 +0000 (07:31 +0200)]
core130: insert a core update for urgent fixes.
the bigger changes for suricata and kernel need longer time for test
so we insert a core with smaller but important fixes.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Tue, 9 Apr 2019 05:30:26 +0000 (07:30 +0200)]
core130: ship strongswan
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Mon, 8 Apr 2019 10:56:58 +0000 (11:56 +0100)]
core130: Ship perl-Net-SSLeay
This was still using the old version of OpenSSL.
Instead of linking the module (which we should have found earlier)
the module uses dlopen :(
Fixes: #12044
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 8 Apr 2019 15:41:24 +0000 (16:41 +0100)]
strongswan: Manually install all routes for non-routed VPNs
This is a regression from disabling charon.install_routes.
VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.
Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 4 Apr 2019 01:07:16 +0000 (02:07 +0100)]
core130: Ship updated wget
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Thu, 4 Apr 2019 07:43:50 +0000 (09:43 +0200)]
wget: Update to 1.20.2
For details see:
https://fossies.org/linux/wget/ChangeLog
Excerpt from "NEWS":
* Changes in Wget 1.20.2
** NTLM authentication will retry under certain cases
** Fixed a buffer overflow vulnerability"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Wed, 27 Mar 2019 19:54:10 +0000 (20:54 +0100)]
clamav: Update to 0.101.2
For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html
"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 18 Mar 2019 15:24:56 +0000 (15:24 +0000)]
ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Stefan Schantl [Mon, 8 Apr 2019 18:20:18 +0000 (20:20 +0200)]
convert-snort: Re-order steps at end of script
This will ensure that the whole IDS is configured property, if
no or an empty snort config file is present.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Mon, 8 Apr 2019 18:02:53 +0000 (20:02 +0200)]
convert-snort: Fix logic for detecting enough free disk space.
The subfunction only will return something if the check fails - so the logic
of the if statement was wrong set and the downloader only was called if
this check failed and to less diskspace would be available.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 8 Apr 2019 19:53:47 +0000 (20:53 +0100)]
core130: Ship SSH Agent Forwarding changes
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 8 Apr 2019 16:35:00 +0000 (16:35 +0000)]
change AllowAgentForwarding in SSHD configuration if, necessary
Fixes #11931
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 8 Apr 2019 16:35:00 +0000 (16:35 +0000)]
allow SSH agent forwarding to be configured via WebUI
Fixes #11931
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 8 Apr 2019 16:34:00 +0000 (16:34 +0000)]
add language strings for SSH agent forwarding settings
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Mon, 8 Apr 2019 19:49:20 +0000 (21:49 +0200)]
rename core130 -> core131
we need to insert a core update to fix urgent bugs
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Mon, 8 Apr 2019 19:47:23 +0000 (21:47 +0200)]
kernel: update to 4.14.111
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Mon, 8 Apr 2019 19:47:12 +0000 (21:47 +0200)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>