ruleset-sources: Update sourcefire rulesets to latest snapshot version

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Suricata: detect DNS events on port 853, too

As DNS over TLS popularity is increasing, port 853 becomes
more interesting for an attacker as a bypass method. Enabling
this port for DNS monitoring makes sense in order to avoid
unusual activity (non-DNS traffic) as well as "normal" DNS
attacks.

Partially fixes #11808

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Suricata: enable full detection for missing protocols

These are IMAP and MSN, which can be safely enabled.

Partially fixes #11808

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Suricata: detect TLS traffic on IMAPS/POP3S/SSMTP ports as, well

Partially fixes #11808

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Format and show date of the current ruleset again

Fixes #11992

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Change name of the button to apply the ruleset changes

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

langs: Remove snort related and unused strings

Fixes #11993.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

logs.cgi/ids.dat: Do not call the IDS snort again

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Improve showed messages while the IDS is working

Reference #11993

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Add german translation for "system is offline"

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Lock page while autoupdate script is running

Fixes #11991

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

update-ids-ruleset: Lock and Unlock the IDS page during runtime

Reference #11991

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add code to lock/unlock ids page while autoupdating the ruleset

Reference #11991

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Show "Update Ruleset"-Button only if automatic updates are disabled

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

aliases.cgi: Handle suricata related actions when dealing with aliases

When working with aliases (adding/modifying/removing), the file which
contains the HOME_NET declarations needs to be re-generated and suricata
requires a restart afterwards.

Fixes #11990

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Call helper script when red interface gets up

The helper script will be automatically called when the red interface gets up
and will re-generate the HOME_NET file, to take care if the IP-address of this
interface has changed.

Fixes #11989

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Edit german translation for "ids oinkcode required".

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Check if the selected ruleset requires an oinkcode

Fixes #11983

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Only perform actions when saving ruleset settings, if there are no error messages

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Do not send HEAD requests to sourcefire (snort.org) servers

Using this feature to fetch the size of the requested tarball is not allowed by these
servers, so skip this feature for their rulesets.

Fixes #11987

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "ids-functions.pl: Use GET method to fetch Header data of a file"

Using the GET method will download the file twice and does not provide the
desired mechanism here.

This reverts commit 81592314ebe93ae942f28a1bc9037185f155ccda.

ids.cgi: Fix HTML formated spaces.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework "Enable IPS" section

Just use one language string for a maximum of flexiblity for the
transloators.

Fixes #11986

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Do not display messages when starting up

Fixes #11979.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Change lang string from "Activate IPS" to "Enable IPS"

Reference #11986

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Rename IDS strings to IPS

Reference: #11986

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Stop suricata when the rulest source has been changed

If the ruleset source has been changed, it has to be configured again.
This happens because of different rule categories, filenames rule ID's etc.

In case suricata currently is running it has to be stopped and after the configuration
has been done by the user, it can be launched again.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Fix downloading rules if source changed

Fix the if statement to detect wheater the ruleset has been
changed and automatically download the new one.

Fixes #11984.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Update automatic download texts

Update the showed texts in the dropdown box as mentioned in the
bug report.

Fixes #11985

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Use GET method to fetch Header data of a file

The sourcfire web servers does not support the HEAD request so we have to do
this with a GET here.

Fixes #11987

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Fix show HTTP error code and message

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata.yaml: Add port 222 to list of SSH Ports

The SSH-server listened on port "222" as default on IPFire in the past.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Grab address for RED by using get_red_address() function.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add function to the the current assigned IP-address of RED.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Automatically download ruleset if the ruleset source has been changed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

initscripts/suricata: Generate firewall rules on start and reload

Fixes #11978

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add RED address and aliases to the HOME_NET

Reference: #11981

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add get_aliases()

This subfunction is used to get all configured and enabled aliases
for the RED network zone. They will be returned as an array.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

update-ids-ruleset: Improve error reporting if the system is offline

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Dynamically generate SHOW/HIDE for expanding or collapsing a ruleset category

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Show IDS setting area only if a ruleset is present.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Diplay reason, why a ruleset could not be downloaded, if the system is offline.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Also download the ruleset when saving the ruleset settings

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Add dropdown option for Emergingthreats.net Pro rules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Only show "update ruleset" button if a ruleset is present

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Draw daemon status and setting in the same box.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Show/Hide subscription code area dynamically.

Dynamically (Java Script) show/hide the area for entering the
subscription code / oinkcode based on the choosen ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Remove help text for obtaining an oinkcode

This information is only valid for sourcefire (snort) rulesets, may
confuse users and therefore should be handled in the wiki.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Scan outgoing traffic, too

Connections from the firewall and through the proxy must be filtered, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Suricata: drop unused cuda HW acceleration

As stated in https://bugzilla.ipfire.org/show_bug.cgi?id=11808#c5 ,
Cuda hardware acceleration is unused and so the configuration file
section can be removed.

This partially addresses #11808.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "Add DDNS to core 107."

This reverts commit 197033fab234d4698b097fdb1b653b8ae39b1aae.

update-ids-ruleset: Set correct ownership for rulesdir and files

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

convert-snort: Use set_ownership() from ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ruleset-sources: Add Emerging-Threads Pro ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

logs.cgi/log.dat: Change search pattern from snort to suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Set correct ownership for the stored error file.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add set_ownership() function.

This function is used to change the ownership of a given file
or directory to the user "nobody" and the group "nobody", which is
used by the WUI.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

backup.pl: Run snort to suricata converter when a backup gets restored.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Install snort to suricata converter

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

ghostscript: Update to 9.26

For details see:
https://www.ghostscript.com/doc/9.26/News.htm

This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")

Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-4286563.html

I saw this article and found it could be the time for an update...

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

Enable some performance tuning

These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.

Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.

On a slower system (apu1d) no performance improvement or loss
could have been measured.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy: Show error messages in English by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.3.2

See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated ca-certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated openssh

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenSSH: update to 7.9p1

Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

kernel: update to 4.14.95

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xtables-addons: Fix generating GeoIP database

Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.

This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.

This patch changes this so that the last 12 bytes are just being dropped.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated tzdata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: update to 2018i

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

convert-snort: Settings converter from snort to suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move and rename GenerateIgnoreList() function to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

strongswan: Update to 5.7.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: x86_64 encrease NR_CPUS to 64

fixes #11963

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.94

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: Ship updated xt_geoip_update script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

core128: Ship updated logrotate

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.15

For details see:
https://github.com/logrotate/logrotate/releases

- timer unit: change trigger fuzz from 12h to 1h (#230)
- service unit: only run if /var/log is mounted (#230)
- preserve fractional part of timestamps when compressing (#226)
- re-indent source code using spaces only (#188)
- minage: avoid rounding issue while comparing the amount of seconds (#36)
- never remove old log files if rotate -1 is specified (#202)
- return non-zero exit status if a config file contains an error (#199)
- make copytruncate work with rotate 0 (#191)
- warn user if both size and the time interval options are used (#192)
- pass rotated log file name as the 2nd argument of the postrotate script
  when sharedscript is not enabled (#193)
- rename logrotate-default to logrotate.conf (#187)

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

core127: run xt_geoip_update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: ovpn ca index.txt is also missing on some installations

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

xt_geoip_updte: fix download url

the maxmind server delivers an old version if there are
two slashes before the database filename.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: fix typo

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add ovpn ca changes to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add xt_geoip_update to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add bind to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: set reboot needed flag

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add general-functions.pl to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: fix updater for aarch64 and armv5tel

if a arch specific filelist has the same name as the common the common filelist was ignored

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Revert "Disable Path MTU discovery"

This reverts commit 1c0cfaa5949e4303e8e4e2f041af86a812f3fe6c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

drop orphaned OpenSSL patches

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Remove openssl-compat package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>