ids-functions.pl: Rename ruleset-sources.list to ruleset-sources

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-ruleset-sources: New package

Move the file which contains the download URL's for the IDS rulesets
into an own common package. This will allow us in future to easily ship
a changed file with a core update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

configroot: Move from snort to suricata

Create /var/ipfire/suricata and /var/ipfire/suricata/settings instead of
/var/ipfire/snort and /var/ipfire/snort/settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Install very basic config file

This config file is mostly based on the example configuration shipped
by the suricata project and needs to be enhanched.

See #11808.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Generate suricata compatiple used-rulefiles file

 * Rename filename to suricata-used-rulefiles.yaml
 * Adjust file generation as a yaml file to be compatible with suricata
 * Adjust code to correctly read-in and parse the changed file

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

backup: Make backup ISO bootable on EFI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids-functions.pl: Move path details from snort to suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'next-new-ids.cgi' into next-suricata-and-cgi

suricata: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

aws: Disable SSH password authentication by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libhtp: New package

This is build and runtime dependency for suricata.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

yaml: New package

This is a build and runtime dependency for suricata.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Rework error and log handling in ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Introduce settingsdir variable

The $settingsdir variable is declared in the ids-functions.pl and used to to
store the path where the various files which contains the settings for the IDS and
oinkmaster is located.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Move rulepath declaration to ids-functions.pl

This will help if the path ever changed. Also remove hard coded rulepath
from oinkmaster call.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rename snortrules hash to idsrules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core123: Ship and restart squid and apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 3.5.28

For details see:
http://www.squid-cache.org/Versions/v3/3.5/changesets/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Apache: Update to 2.4.34

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Drop code which is detecting if oinkmaster is running

This code is not longer required and therefore can be dropped.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Reimplement function to lock page and show working notice

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Also log errors to syslog

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Use pure perl to log oinkmaster result to syslog

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Make variables globally accessible

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework CGI logic to download a new ruleset

* Drop function to show a notice about snort is working.
* Introduce the log_error function which is responsible for log any
  error messages. Currently it writes it to a tempory file, which will
  be read by the WUI, the message will be displayed and the temporary file
  will be released again.
* Introduce a tiny function to easily perform a reload of the generated
  webpage.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Use tarball information from ids-functions.pl

Directly use the value from the ids-functions.pl for the
location and filename of the tarball which includes the snort ruleset.

This will save to declare this information twice and prevents from any
failures if the location of filname every changes.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop dirty hook for updating the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move function to call oinkmaster to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move downloader code to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Use ids-functions.pl for checking available discspace

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Introduce ids-functions.pl.

This library will contain a set of functions used by the IDS CGI script
and the planned update script for auto-updating the snort ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop loading of File::Copy module.

This is not required, at any time by the script.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

logs.cgi/log.dat: Add support for oinkmaster

This will allow to display the logged output of oinkmaster
via the webinterface.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework snort configuration area

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Pipe the oinkmaster output to the logger binary

This will allow anybody, to access the log of oinkmaster and
get detailed information about any changes which have been done
on the ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework downloader for rulesets

Doing the rules download in pure perl instead of using
the external wget.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop old control code

The control file are not longer required, because the
initscript uses the settings file to determine if snort
should be started and binded to which interfaches.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

snort: Introduce ruleset-sources.list

This file contains the ruleset vendors and download urls and
will be used by the ids.cgi.

If an url or filename changes, we easily can adjust this file. In most
cases this will be needed when performing a snort update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

general-functions.pl: readhash() Add code to handle optional comments in files

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Call oinkmaster without a log target

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Introduce ruleset-source.list

This new file will contain the vendor information and url
for downloading their ruleset. In future if the download location
or filename changes, we only need to adjust this one file and ship
it via a core update.

Also extend the downloadrulesfile to be able to directly call the
subfunction.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Adjust code for saving snort settings

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Remove logfile after wget has successfully downloaded the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework code which shows if oinkmaster is working

Move the code for displaying a notice that snort currently is working
into an own subfunction which will be called if oinkmaster currently
is started.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop old code for debuging purposes

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Add check when altering the ruleset

Add a check if the currently processing sid is nummeric, otherwise skip it.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework code for downloading/updating the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move call of oinkmaster to an own subfunction

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Always write config files for enabled/disabled rule files

If a single sid has been activated and then disabled without doing
any other ruleset modifications only one of the oinkmaster files
for enabled / disabled rules has been modified.

In this case it was possible, that the same sid, was part of the
file for enabled rules and part of the file for disabled rules at the
same time.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Process enabled rulefiles in an own loop

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop enabled/disabled rules from cgiparams hash

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop enabled rulefile from cgiparams hash after processing

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Re-add code for enable/disable rulefiles

The enabled rulefiles (rule categories) now will be added
to an own file, which will be included by the snort main config
file.

This will allow us to update snort and push the new main config file
without loosing the activated rulesets anymore.

* Introducing snort-used-rulefiles.conf

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Code cleanup

* Drop a lot of unused variables and code.
* Re-ordering some code parts.
* Add a lot of comments.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Re-add code to save the ruleset.

The manually enabled or disabled rules by the user now will be written
to own config files, which will be used by oinkmaster to keep these rules
in the same state after a rules update has been performed.

In short words, if you adjust your ruleset, the changes will not be lost
again if you perform an update of your ruleset.

* Grabbing and storing the cgi values now in an own hash (%cgiparams)
* Introducing oinkmaster config files for enabled and disabled rules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop unused css code

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework code for displaying the single rules

The complete ruleset will be grouped as categories by it's
corresponding rulefile and printed in hidden tables.

They easiely can be displayed by klicking on the show link and
vice-versa.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Always display ruleset

Display the rule categories any time and do not hide them
if no instance of snort is runing.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Remove comment lines for snort rules control

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Refactor reading-in rule files.

Move the code for reading and parsing the snort rule files
into an own subfunction.

* Drop code for reading in and modifying the snort main config file.
* Rework code for parsing and adding the snort rules to the snortrules hash.
* Drop code for gathering a description for the rule files, which does not
  because of a file layout change and sadly there is not suitable description
  shipped anymore by the snort team.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move function to end of file

Move the function for doing the page refresh stuff to the end of the file and
do some layout changes for better reading the code.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Use pure perl for directory listing

Use pure perl for getting the filelist of available
rule files instead of using a sub-shell and unix commands.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop old code for uploading a ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

cdrom: Move list of EFI modules to lfs/cdrom

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cdrom: Re-order arguments again

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cdrom: The order of arguments for mkisofs seems to be relevant

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: apply vga fallback disable patch again

on some systems (e.g. J1900 based) grub detects a too low resolution
and use it. This is no problem in grub itself but the kernel not render
the consoles in this mode.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

syslinux: update i586 rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: fix partition layout on i586

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

aws: Add support for a script that can be executed at first boot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Always exit the init script cleanly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

asterisk: Don't optimise for builder

Asterisk enables -march=native which renders the code
incompatible to most systems.

Fixes: #11793
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' into efi

fireinfo: Import latest patches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Run install-bootloader script instead of own code

This allows us to keep the GRUB installation routine in one
place only.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

partresize: Remove debugging line

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

partresize: Only regenerate configuration instead of re-installing GRUB

This should not be necessary

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Move update-bootloader script into installer

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update-bootloader: Allow passing device to install GRUB on

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update-bootloader: Extend script to support EFI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flash-image: use FAT for /boot partition on aarch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' into efi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Conflicts:
config/kernel/kernel.config.aarch64-ipfire

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

kernel: aarch64: enable virtio drivers

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: boot aarch64 kernel without -multi extension

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: apply multi arch patchset for aarch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

cdrom: mkisofs seems to not like the order of the arguments

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

We don't have EFI on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Give setup user permissions to read its own SSH keys

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Unlock setup account

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Install SSH keys only for setup user

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: setup user should not be a system user

Login is not permitted for system users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable EFI on aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flash-images: Only install grub for EFI on aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cdrom: Run isohybrid only when we have syslinux

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cdrom: Fix building GRUB image for aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cdrom: Install ISOLINUX only on some architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cdrom: Install iPXE only on x86

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cdrom: Install memtest only on x86

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>