]>
git.ipfire.org Git - people/pmueller/ipfire-2.x.git/log
Stefan Schantl [Thu, 7 Feb 2019 07:51:31 +0000 (08:51 +0100)]
ids.cgi: Improve showed messages while the IDS is working
Reference #11993
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 7 Feb 2019 07:28:29 +0000 (08:28 +0100)]
Add german translation for "system is offline"
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 7 Feb 2019 07:24:15 +0000 (08:24 +0100)]
ids.cgi: Lock page while autoupdate script is running
Fixes #11991
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 7 Feb 2019 07:06:49 +0000 (08:06 +0100)]
update-ids-ruleset: Lock and Unlock the IDS page during runtime
Reference #11991
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 7 Feb 2019 06:59:20 +0000 (07:59 +0100)]
ids-functions.pl: Add code to lock/unlock ids page while autoupdating the ruleset
Reference #11991
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 7 Feb 2019 06:44:11 +0000 (07:44 +0100)]
ids.cgi: Show "Update Ruleset"-Button only if automatic updates are disabled
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Feb 2019 14:59:02 +0000 (15:59 +0100)]
aliases.cgi: Handle suricata related actions when dealing with aliases
When working with aliases (adding/modifying/removing), the file which
contains the HOME_NET declarations needs to be re-generated and suricata
requires a restart afterwards.
Fixes #11990
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Feb 2019 14:23:46 +0000 (15:23 +0100)]
IDS: Call helper script when red interface gets up
The helper script will be automatically called when the red interface gets up
and will re-generate the HOME_NET file, to take care if the IP-address of this
interface has changed.
Fixes #11989
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Feb 2019 12:12:50 +0000 (13:12 +0100)]
IDS: Edit german translation for "ids oinkcode required".
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Feb 2019 11:49:01 +0000 (12:49 +0100)]
ids.cgi: Check if the selected ruleset requires an oinkcode
Fixes #11983
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Feb 2019 11:48:08 +0000 (12:48 +0100)]
ids.cgi: Only perform actions when saving ruleset settings, if there are no error messages
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Feb 2019 09:58:59 +0000 (10:58 +0100)]
ids-functions.pl: Do not send HEAD requests to sourcefire (snort.org) servers
Using this feature to fetch the size of the requested tarball is not allowed by these
servers, so skip this feature for their rulesets.
Fixes #11987
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Feb 2019 09:00:17 +0000 (10:00 +0100)]
Revert "ids-functions.pl: Use GET method to fetch Header data of a file"
Using the GET method will download the file twice and does not provide the
desired mechanism here.
This reverts commit
81592314ebe93ae942f28a1bc9037185f155ccda .
Stefan Schantl [Tue, 5 Feb 2019 13:34:44 +0000 (14:34 +0100)]
ids.cgi: Fix HTML formated spaces.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 13:14:11 +0000 (14:14 +0100)]
ids.cgi: Rework "Enable IPS" section
Just use one language string for a maximum of flexiblity for the
transloators.
Fixes #11986
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 12:57:40 +0000 (13:57 +0100)]
suricata: Do not display messages when starting up
Fixes #11979.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 12:51:08 +0000 (13:51 +0100)]
ids.cgi: Change lang string from "Activate IPS" to "Enable IPS"
Reference #11986
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 12:25:27 +0000 (13:25 +0100)]
IDS: Rename IDS strings to IPS
Reference: #11986
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 11:43:49 +0000 (12:43 +0100)]
ids.cgi: Stop suricata when the rulest source has been changed
If the ruleset source has been changed, it has to be configured again.
This happens because of different rule categories, filenames rule ID's etc.
In case suricata currently is running it has to be stopped and after the configuration
has been done by the user, it can be launched again.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 11:36:30 +0000 (12:36 +0100)]
ids.cgi: Fix downloading rules if source changed
Fix the if statement to detect wheater the ruleset has been
changed and automatically download the new one.
Fixes #11984.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 11:13:28 +0000 (12:13 +0100)]
ids.cgi: Update automatic download texts
Update the showed texts in the dropdown box as mentioned in the
bug report.
Fixes #11985
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 11:01:43 +0000 (12:01 +0100)]
ids-functions.pl: Use GET method to fetch Header data of a file
The sourcfire web servers does not support the HEAD request so we have to do
this with a GET here.
Fixes #11987
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 5 Feb 2019 10:55:37 +0000 (11:55 +0100)]
ids-functions.pl: Fix show HTTP error code and message
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Fri, 1 Feb 2019 13:34:25 +0000 (14:34 +0100)]
suricata.yaml: Add port 222 to list of SSH Ports
The SSH-server listened on port "222" as default on IPFire in the past.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 31 Jan 2019 08:50:47 +0000 (09:50 +0100)]
ids-functions.pl: Grab address for RED by using get_red_address() function.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 31 Jan 2019 08:41:35 +0000 (09:41 +0100)]
ids-functions.pl: Add function to the the current assigned IP-address of RED.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 31 Jan 2019 07:55:05 +0000 (08:55 +0100)]
ids.cgi: Automatically download ruleset if the ruleset source has been changed.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 12:43:38 +0000 (13:43 +0100)]
initscripts/suricata: Generate firewall rules on start and reload
Fixes #11978
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 11:04:54 +0000 (12:04 +0100)]
ids-functions.pl: Add RED address and aliases to the HOME_NET
Reference: #11981
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 10:57:49 +0000 (11:57 +0100)]
ids-functions.pl: Add get_aliases()
This subfunction is used to get all configured and enabled aliases
for the RED network zone. They will be returned as an array.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:57:31 +0000 (10:57 +0100)]
update-ids-ruleset: Improve error reporting if the system is offline
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:53:17 +0000 (10:53 +0100)]
ids.cgi: Dynamically generate SHOW/HIDE for expanding or collapsing a ruleset category
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:12:11 +0000 (10:12 +0100)]
ids.cgi: Show IDS setting area only if a ruleset is present.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:05:14 +0000 (10:05 +0100)]
ids.cgi: Diplay reason, why a ruleset could not be downloaded, if the system is offline.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:57:49 +0000 (09:57 +0100)]
ids.cgi: Also download the ruleset when saving the ruleset settings
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:42:28 +0000 (09:42 +0100)]
ids.cgi: Add dropdown option for Emergingthreats.net Pro rules.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:39:17 +0000 (09:39 +0100)]
ids.cgi: Only show "update ruleset" button if a ruleset is present
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:33:47 +0000 (09:33 +0100)]
ids.cgi: Draw daemon status and setting in the same box.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:27:37 +0000 (09:27 +0100)]
ids.cgi: Show/Hide subscription code area dynamically.
Dynamically (Java Script) show/hide the area for entering the
subscription code / oinkcode based on the choosen ruleset.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:25:34 +0000 (09:25 +0100)]
ids.cgi: Remove help text for obtaining an oinkcode
This information is only valid for sourcefire (snort) rulesets, may
confuse users and therefore should be handled in the wiki.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Michael Tremer [Tue, 29 Jan 2019 12:03:37 +0000 (12:03 +0000)]
suricata: Scan outgoing traffic, too
Connections from the firewall and through the proxy must be filtered, too
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 20:22:41 +0000 (21:22 +0100)]
Suricata: drop unused cuda HW acceleration
As stated in https://bugzilla.ipfire.org/show_bug.cgi?id=11808#c5 ,
Cuda hardware acceleration is unused and so the configuration file
section can be removed.
This partially addresses #11808.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 10:23:54 +0000 (11:23 +0100)]
Revert "Add DDNS to core 107."
This reverts commit
197033fab234d4698b097fdb1b653b8ae39b1aae .
Stefan Schantl [Tue, 29 Jan 2019 08:09:11 +0000 (09:09 +0100)]
update-ids-ruleset: Set correct ownership for rulesdir and files
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:05:29 +0000 (09:05 +0100)]
convert-snort: Use set_ownership() from ids-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:01:20 +0000 (09:01 +0100)]
ruleset-sources: Add Emerging-Threads Pro ruleset
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:00:26 +0000 (09:00 +0100)]
logs.cgi/log.dat: Change search pattern from snort to suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:58:08 +0000 (08:58 +0100)]
ids-functions.pl: Set correct ownership for the stored error file.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:50:16 +0000 (08:50 +0100)]
ids-functions.pl: Add set_ownership() function.
This function is used to change the ownership of a given file
or directory to the user "nobody" and the group "nobody", which is
used by the WUI.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:40:34 +0000 (08:40 +0100)]
backup.pl: Run snort to suricata converter when a backup gets restored.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:26:15 +0000 (08:26 +0100)]
IDS: Install snort to suricata converter
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Mon, 28 Jan 2019 16:29:21 +0000 (17:29 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Matthias Fischer [Sun, 27 Jan 2019 17:38:04 +0000 (18:38 +0100)]
ghostscript: Update to 9.26
For details see:
https://www.ghostscript.com/doc/9.26/News.htm
This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")
Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-
4286563 .html
I saw this article and found it could be the time for an update...
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Sat, 26 Jan 2019 11:40:04 +0000 (12:40 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Michael Tremer [Thu, 24 Jan 2019 12:31:27 +0000 (12:31 +0000)]
Enable some performance tuning
These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.
Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.
On a slower system (apu1d) no performance improvement or loss
could have been measured.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 06:21:53 +0000 (06:21 +0000)]
proxy: Show error messages in English by default
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 20:34:13 +0000 (21:34 +0100)]
Postfix: update to 3.3.2
See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 05:40:41 +0000 (05:40 +0000)]
core128: Ship updated ca-certificates
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 19:59:41 +0000 (20:59 +0100)]
update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.
The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 05:40:04 +0000 (05:40 +0000)]
core128: Ship updated openssh
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 19:54:07 +0000 (20:54 +0100)]
OpenSSH: update to 7.9p1
Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Wed, 23 Jan 2019 20:19:01 +0000 (21:19 +0100)]
Merge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Wed, 23 Jan 2019 20:18:44 +0000 (21:18 +0100)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Wed, 23 Jan 2019 17:38:14 +0000 (18:38 +0100)]
kernel: update to 4.14.95
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)]
use HTTPS for downloading GeoIP database files
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 04:10:23 +0000 (04:10 +0000)]
xtables-addons: Fix generating GeoIP database
Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.
This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.
This patch changes this so that the last 12 bytes are just being dropped.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 03:06:07 +0000 (03:06 +0000)]
core128: Ship updated tzdata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 15:00:57 +0000 (16:00 +0100)]
tzdata: update to 2018i
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Tue, 22 Jan 2019 14:36:00 +0000 (15:36 +0100)]
convert-snort: Settings converter from snort to suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 22 Jan 2019 12:25:13 +0000 (13:25 +0100)]
ids.cgi: Move and rename GenerateIgnoreList() function to ids-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Michael Tremer [Tue, 22 Jan 2019 05:31:21 +0000 (05:31 +0000)]
strongswan: Update to 5.7.2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Tue, 22 Jan 2019 06:46:08 +0000 (07:46 +0100)]
kernel: x86_64 encrease NR_CPUS to 64
fixes #11963
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Tue, 22 Jan 2019 06:41:18 +0000 (07:41 +0100)]
kernel: update to 4.14.94
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Mon, 21 Jan 2019 21:04:10 +0000 (21:04 +0000)]
core128: Ship updated xt_geoip_update script
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)]
use HTTPS for downloading GeoIP database files
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Mon, 21 Jan 2019 12:04:13 +0000 (13:04 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Michael Tremer [Mon, 21 Jan 2019 10:20:29 +0000 (10:20 +0000)]
core128: Ship updated logrotate
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Sun, 20 Jan 2019 17:07:47 +0000 (18:07 +0100)]
logrotate: Update to 3.15
For details see:
https://github.com/logrotate/logrotate/releases
- timer unit: change trigger fuzz from 12h to 1h (#230)
- service unit: only run if /var/log is mounted (#230)
- preserve fractional part of timestamps when compressing (#226)
- re-indent source code using spaces only (#188)
- minage: avoid rounding issue while comparing the amount of seconds (#36)
- never remove old log files if rotate -1 is specified (#202)
- return non-zero exit status if a config file contains an error (#199)
- make copytruncate work with rotate 0 (#191)
- warn user if both size and the time interval options are used (#192)
- pass rotated log file name as the 2nd argument of the postrotate script
when sharedscript is not enabled (#193)
- rename logrotate-default to logrotate.conf (#187)
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 18:58:48 +0000 (19:58 +0100)]
Merge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Sat, 19 Jan 2019 16:24:47 +0000 (17:24 +0100)]
core127: run xt_geoip_update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 16:20:51 +0000 (17:20 +0100)]
core127: ovpn ca index.txt is also missing on some installations
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 14:16:43 +0000 (15:16 +0100)]
xt_geoip_updte: fix download url
the maxmind server delivers an old version if there are
two slashes before the database filename.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 11:08:07 +0000 (12:08 +0100)]
core127: fix typo
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 09:02:17 +0000 (10:02 +0100)]
core127: add ovpn ca changes to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 09:01:40 +0000 (10:01 +0100)]
core127: add xt_geoip_update to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sat, 19 Jan 2019 09:00:54 +0000 (10:00 +0100)]
core127: add bind to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:39 +0000 (13:53 +0100)]
core127: set reboot needed flag
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:06 +0000 (13:53 +0100)]
core127: add general-functions.pl to updater
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Fri, 18 Jan 2019 06:52:17 +0000 (07:52 +0100)]
core127: fix updater for aarch64 and armv5tel
if a arch specific filelist has the same name as the common the common filelist was ignored
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 19:24:46 +0000 (19:24 +0000)]
Revert "Disable Path MTU discovery"
This reverts commit
1c0cfaa5949e4303e8e4e2f041af86a812f3fe6c .
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 5 Nov 2018 15:21:43 +0000 (16:21 +0100)]
drop orphaned OpenSSL patches
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 14:41:54 +0000 (14:41 +0000)]
core128: Remove openssl-compat package
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 5 Nov 2018 15:12:40 +0000 (16:12 +0100)]
drop openssl-compat package
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 14:39:14 +0000 (14:39 +0000)]
core128: Ship recently updated openssl and apache
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 17 Jan 2019 14:38:01 +0000 (14:38 +0000)]
Start Core Update 128
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Tue, 15 Jan 2019 14:39:25 +0000 (15:39 +0100)]
httpd: include TLS 1.3 cipher suites
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Erik Kapfer <erik.kapfer@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Tue, 15 Jan 2019 14:43:01 +0000 (15:43 +0100)]
openssl: Update to version 1.1.1a
Disabled MD2 and Aria cipher.
TLSv1.3 is now available with:
TLS_CHACHA20_POLY1305_SHA256 TLSv1.3
TLS_AES_256_GCM_SHA384 TLSv1.3
TLS_AES_128_GCM_SHA256 TLSv1.3
Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Wed, 16 Jan 2019 21:31:43 +0000 (22:31 +0100)]
core127: set pakfire version to 127
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Sun, 13 Jan 2019 11:50:26 +0000 (12:50 +0100)]
keepalived: Move change of conntrack sysctl option into package
The setting cannot be set on the default system because the ip_vs
module is not loaded by default and there is no reason to load it
just because we would be able to set the setting.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 13 Jan 2019 11:28:10 +0000 (12:28 +0100)]
GeoIP: Add accidentially removed paths to database
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>