]>
git.ipfire.org Git - ipfire-2.x.git/log
Michael Tremer [Wed, 9 Jan 2019 18:56:01 +0000 (19:56 +0100)]
ipsec: TTL only applies for GRE interfaces and not VTI
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 9 Jan 2019 18:52:46 +0000 (19:52 +0100)]
ipsec: Find correct RED IP address when using %defaultroute
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 9 Jan 2019 18:52:24 +0000 (19:52 +0100)]
ipsec: Log a message when an interface could not be created
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 10 Dec 2018 16:57:12 +0000 (16:57 +0000)]
ipsec-interfaces: Don't add any interfaces when IPsec is disabled
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 10 Dec 2018 16:55:53 +0000 (16:55 +0000)]
Revert "ipsec-interfaces: Run when IPsec is disabled"
This reverts commit
3c3a1cfdb9b473fae9b792e8c211c9940fafc658 .
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 10 Dec 2018 16:44:06 +0000 (16:44 +0000)]
vpnmain.cgi: Move advanced IPsec settings to connection page
This is required to make the initial setup easier for GRE/VTI connections
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 10 Dec 2018 16:08:58 +0000 (16:08 +0000)]
ipsec-interfaces: Run when IPsec is disabled
This needs to run even when IPsec is disable to remove
and interfaces
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 10 Dec 2018 16:01:00 +0000 (16:01 +0000)]
ipsec-interfaces: Use correct righthost variable
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 5 Dec 2018 17:10:16 +0000 (17:10 +0000)]
IPsec: Do not allow 0.0.0.0/0 as remote subnet
This renders the whole machine inaccessible
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 5 Dec 2018 16:24:52 +0000 (16:24 +0000)]
network: Create IPsec interfaces when network is brought up
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 5 Dec 2018 16:23:06 +0000 (16:23 +0000)]
ipsecctrl: Call ipsec-interfaces script when turning up/shutting down connections
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 5 Dec 2018 16:12:48 +0000 (16:12 +0000)]
IPsec: Add (experimental) script that creates GRE/VTI interfaces
Signed-off-by: root <root@interim-edge-a.ec2.internal>
Michael Tremer [Mon, 3 Dec 2018 11:21:29 +0000 (11:21 +0000)]
IPsec: Use left/rightprotoport in GRE mode
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 29 Nov 2018 16:12:45 +0000 (16:12 +0000)]
ipsecctrl: Don't wait when a connection is to be started
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 29 Nov 2018 16:00:52 +0000 (16:00 +0000)]
ipsec-policy: Don't install any block rules for connections with an interface
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 29 Nov 2018 15:58:55 +0000 (15:58 +0000)]
ipsec-policy: Permit GRE traffic for GRE connections
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 29 Nov 2018 15:58:39 +0000 (15:58 +0000)]
ipsec-policy: Variables don't match those from the CGI
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 29 Nov 2018 15:45:52 +0000 (15:45 +0000)]
ipsec-policy: Parse all configuration settings
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 29 Nov 2018 15:43:39 +0000 (15:43 +0000)]
IPsec: Move opening ports from ipsecctrl into ipsec-policy script
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 29 Nov 2018 15:04:28 +0000 (15:04 +0000)]
IPsec: Rename ipsec-block script to ipsec-policy
This is a more general name for a script that will be extended
soon to do more than just add blocking rules.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Nov 2018 20:37:32 +0000 (20:37 +0000)]
IPsec: Update ipsec.conf for GRE/VTI changes
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Nov 2018 14:46:15 +0000 (14:46 +0000)]
IPsec: Add UI for set interface MTU
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Nov 2018 14:38:11 +0000 (14:38 +0000)]
IPsec: Add option to configure IP address for tunnel interface
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Nov 2018 14:24:03 +0000 (14:24 +0000)]
IPsec: Set default inactivity timeout to half an hour
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Nov 2018 14:23:26 +0000 (14:23 +0000)]
IPsec: New connections should defatul to on-demand mode
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Nov 2018 14:21:33 +0000 (14:21 +0000)]
IPsec: Add dropdown to select tunnel interface mode
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 28 Nov 2018 14:07:30 +0000 (14:07 +0000)]
vpnmain.cgi: Correctly carry over INACTIVITY_TIMEOUT
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 27 Nov 2018 18:42:07 +0000 (18:42 +0000)]
IPsec: Write tunnel/transport mode to strongSwan configuration
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 27 Nov 2018 18:38:51 +0000 (18:38 +0000)]
IPsec: Add selection for transport/tunnel mode
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Tue, 5 Feb 2019 18:33:31 +0000 (18:33 +0000)]
python3-msgpack: Fix build on i586
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 4 Feb 2019 07:00:13 +0000 (07:00 +0000)]
python3-dateutil: Update rootfiles
Changed because of new python3-setuptools
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 4 Feb 2019 00:40:02 +0000 (00:40 +0000)]
core128: Ship updated dhcpcd
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Mon, 4 Feb 2019 17:38:44 +0000 (18:38 +0100)]
dhcpcd: Update to 7.1.0
For some informations about this update see:
https://roy.marples.name/blog/dhcpcd-7-1-0-released
"dhcpcd-7.1.0 has been released with the following changes:
- OpenBSD: works alongside slaacd(8)
- NetBSD: sets SO_RERROR on to detect receive socket overflow
- BSD: route improvements to avoid listening for own changes
- Linux: use NETLINK_BROADCAST_ERROR
- BSD: avoid late address deletion messages by testing address existance
- IP6: implement IP6 address sharing
- BSD: catch UP/DOWN events when interfaces does support media changes
- IPv4LL: remember old address when carrier is lost
Many other minor fixes and documenation updates have been submitted by various
community members for this release..."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 4 Feb 2019 00:15:24 +0000 (00:15 +0000)]
core128: Ship updated curl
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Mon, 4 Feb 2019 17:30:54 +0000 (18:30 +0100)]
curl: Update to 7.63.0
For details see:
https://curl.haxx.se/changes.html
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Sat, 2 Feb 2019 07:46:12 +0000 (08:46 +0100)]
update.sh: Delete .rnd files
Since RANDFILE has been disabled in OpenSSL configurations, .rnd files are not needed anymore.
Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 3 Feb 2019 21:42:43 +0000 (21:42 +0000)]
core128: Ship updated apr
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Wolfgang Apolinarski [Sun, 3 Feb 2019 14:11:58 +0000 (15:11 +0100)]
Updated apr, stabilized apache build
- Updated apr to 1.6.5
- Stabilized apache build (rebuild)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Sun, 3 Feb 2019 14:28:52 +0000 (15:28 +0100)]
python3-llfuse: fix rootfile for non x86_64 builds
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Sun, 3 Feb 2019 11:45:52 +0000 (12:45 +0100)]
kernel: update to 4.14.97
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Fri, 1 Feb 2019 17:34:02 +0000 (17:34 +0000)]
haproxy: Bump version to support TLSv1.3 (and PCRE JIT)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 1 Feb 2019 17:12:23 +0000 (17:12 +0000)]
core128: Restart updated apache
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Fri, 1 Feb 2019 17:06:38 +0000 (18:06 +0100)]
apache: Update to 2.4.38
For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.38
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 1 Feb 2019 17:08:44 +0000 (17:08 +0000)]
core128: Ship AWS scripts again
It seems that this was missing in Core Update 125/126 so not all
bug fixes made it into the release.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Fri, 1 Feb 2019 11:52:45 +0000 (11:52 +0000)]
Add new package borgbackup
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Fri, 1 Feb 2019 11:52:44 +0000 (11:52 +0000)]
Add new package python3-msgpack
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Fri, 1 Feb 2019 11:52:43 +0000 (11:52 +0000)]
Add new package python3-llfuse
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Fri, 1 Feb 2019 11:52:42 +0000 (11:52 +0000)]
Add new package python3-setuptools-scm
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Jonatan Schlag [Fri, 1 Feb 2019 11:52:41 +0000 (11:52 +0000)]
Add new package python3-settuptools
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Fri, 1 Feb 2019 13:34:25 +0000 (14:34 +0100)]
suricata.yaml: Add port 222 to list of SSH Ports
The SSH-server listened on port "222" as default on IPFire in the past.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 31 Jan 2019 08:50:47 +0000 (09:50 +0100)]
ids-functions.pl: Grab address for RED by using get_red_address() function.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 31 Jan 2019 08:41:35 +0000 (09:41 +0100)]
ids-functions.pl: Add function to the the current assigned IP-address of RED.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Thu, 31 Jan 2019 07:55:05 +0000 (08:55 +0100)]
ids.cgi: Automatically download ruleset if the ruleset source has been changed.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Michael Tremer [Wed, 30 Jan 2019 18:37:26 +0000 (18:37 +0000)]
core128: Delete SSE2-optimised legacy OpenSSL libraries, too
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 12:43:38 +0000 (13:43 +0100)]
initscripts/suricata: Generate firewall rules on start and reload
Fixes #11978
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 11:04:54 +0000 (12:04 +0100)]
ids-functions.pl: Add RED address and aliases to the HOME_NET
Reference: #11981
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 10:57:49 +0000 (11:57 +0100)]
ids-functions.pl: Add get_aliases()
This subfunction is used to get all configured and enabled aliases
for the RED network zone. They will be returned as an array.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:57:31 +0000 (10:57 +0100)]
update-ids-ruleset: Improve error reporting if the system is offline
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:53:17 +0000 (10:53 +0100)]
ids.cgi: Dynamically generate SHOW/HIDE for expanding or collapsing a ruleset category
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:12:11 +0000 (10:12 +0100)]
ids.cgi: Show IDS setting area only if a ruleset is present.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 09:05:14 +0000 (10:05 +0100)]
ids.cgi: Diplay reason, why a ruleset could not be downloaded, if the system is offline.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:57:49 +0000 (09:57 +0100)]
ids.cgi: Also download the ruleset when saving the ruleset settings
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:42:28 +0000 (09:42 +0100)]
ids.cgi: Add dropdown option for Emergingthreats.net Pro rules.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:39:17 +0000 (09:39 +0100)]
ids.cgi: Only show "update ruleset" button if a ruleset is present
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:33:47 +0000 (09:33 +0100)]
ids.cgi: Draw daemon status and setting in the same box.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:27:37 +0000 (09:27 +0100)]
ids.cgi: Show/Hide subscription code area dynamically.
Dynamically (Java Script) show/hide the area for entering the
subscription code / oinkcode based on the choosen ruleset.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 30 Jan 2019 08:25:34 +0000 (09:25 +0100)]
ids.cgi: Remove help text for obtaining an oinkcode
This information is only valid for sourcefire (snort) rulesets, may
confuse users and therefore should be handled in the wiki.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Michael Tremer [Tue, 29 Jan 2019 13:51:37 +0000 (13:51 +0000)]
core128: Ship updated OpenSSL configuration files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Tue, 8 Jan 2019 19:33:32 +0000 (20:33 +0100)]
del_rand: Deletion of RAND file in openssl config
Fixes #11943
Since the kernel RNG should do this, there is no need for this anymore.
Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 29 Jan 2019 12:03:37 +0000 (12:03 +0000)]
suricata: Scan outgoing traffic, too
Connections from the firewall and through the proxy must be filtered, too
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 20:22:41 +0000 (21:22 +0100)]
Suricata: drop unused cuda HW acceleration
As stated in https://bugzilla.ipfire.org/show_bug.cgi?id=11808#c5 ,
Cuda hardware acceleration is unused and so the configuration file
section can be removed.
This partially addresses #11808.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 10:23:54 +0000 (11:23 +0100)]
Revert "Add DDNS to core 107."
This reverts commit
197033fab234d4698b097fdb1b653b8ae39b1aae .
Stefan Schantl [Tue, 29 Jan 2019 08:09:11 +0000 (09:09 +0100)]
update-ids-ruleset: Set correct ownership for rulesdir and files
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:05:29 +0000 (09:05 +0100)]
convert-snort: Use set_ownership() from ids-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:01:20 +0000 (09:01 +0100)]
ruleset-sources: Add Emerging-Threads Pro ruleset
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 08:00:26 +0000 (09:00 +0100)]
logs.cgi/log.dat: Change search pattern from snort to suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:58:08 +0000 (08:58 +0100)]
ids-functions.pl: Set correct ownership for the stored error file.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:50:16 +0000 (08:50 +0100)]
ids-functions.pl: Add set_ownership() function.
This function is used to change the ownership of a given file
or directory to the user "nobody" and the group "nobody", which is
used by the WUI.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:40:34 +0000 (08:40 +0100)]
backup.pl: Run snort to suricata converter when a backup gets restored.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 29 Jan 2019 07:26:15 +0000 (08:26 +0100)]
IDS: Install snort to suricata converter
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Mon, 28 Jan 2019 16:29:21 +0000 (17:29 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Matthias Fischer [Sun, 27 Jan 2019 17:38:04 +0000 (18:38 +0100)]
ghostscript: Update to 9.26
For details see:
https://www.ghostscript.com/doc/9.26/News.htm
This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")
Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-
4286563 .html
I saw this article and found it could be the time for an update...
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Sat, 26 Jan 2019 11:40:04 +0000 (12:40 +0100)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Michael Tremer [Thu, 24 Jan 2019 12:31:27 +0000 (12:31 +0000)]
Enable some performance tuning
These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.
Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.
On a slower system (apu1d) no performance improvement or loss
could have been measured.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 06:21:53 +0000 (06:21 +0000)]
proxy: Show error messages in English by default
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 20:34:13 +0000 (21:34 +0100)]
Postfix: update to 3.3.2
See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 05:40:41 +0000 (05:40 +0000)]
core128: Ship updated ca-certificates
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 19:59:41 +0000 (20:59 +0100)]
update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.
The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 05:40:04 +0000 (05:40 +0000)]
core128: Ship updated openssh
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 19:54:07 +0000 (20:54 +0100)]
OpenSSH: update to 7.9p1
Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Wed, 23 Jan 2019 20:19:01 +0000 (21:19 +0100)]
Merge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Wed, 23 Jan 2019 20:18:44 +0000 (21:18 +0100)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Wed, 23 Jan 2019 17:38:14 +0000 (18:38 +0100)]
kernel: update to 4.14.95
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)]
use HTTPS for downloading GeoIP database files
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 04:10:23 +0000 (04:10 +0000)]
xtables-addons: Fix generating GeoIP database
Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.
This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.
This patch changes this so that the last 12 bytes are just being dropped.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 23 Jan 2019 03:06:07 +0000 (03:06 +0000)]
core128: Ship updated tzdata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 23 Jan 2019 15:00:57 +0000 (16:00 +0100)]
tzdata: update to 2018i
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Tue, 22 Jan 2019 14:36:00 +0000 (15:36 +0100)]
convert-snort: Settings converter from snort to suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 22 Jan 2019 12:25:13 +0000 (13:25 +0100)]
ids.cgi: Move and rename GenerateIgnoreList() function to ids-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Michael Tremer [Tue, 22 Jan 2019 05:31:21 +0000 (05:31 +0000)]
strongswan: Update to 5.7.2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>