ids.cgi: Lock page while autoupdate script is running

Fixes #11991

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

update-ids-ruleset: Lock and Unlock the IDS page during runtime

Reference #11991

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add code to lock/unlock ids page while autoupdating the ruleset

Reference #11991

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Show "Update Ruleset"-Button only if automatic updates are disabled

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

aliases.cgi: Handle suricata related actions when dealing with aliases

When working with aliases (adding/modifying/removing), the file which
contains the HOME_NET declarations needs to be re-generated and suricata
requires a restart afterwards.

Fixes #11990

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Call helper script when red interface gets up

The helper script will be automatically called when the red interface gets up
and will re-generate the HOME_NET file, to take care if the IP-address of this
interface has changed.

Fixes #11989

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Edit german translation for "ids oinkcode required".

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Check if the selected ruleset requires an oinkcode

Fixes #11983

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Only perform actions when saving ruleset settings, if there are no error messages

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Do not send HEAD requests to sourcefire (snort.org) servers

Using this feature to fetch the size of the requested tarball is not allowed by these
servers, so skip this feature for their rulesets.

Fixes #11987

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "ids-functions.pl: Use GET method to fetch Header data of a file"

Using the GET method will download the file twice and does not provide the
desired mechanism here.

This reverts commit 81592314ebe93ae942f28a1bc9037185f155ccda.

ids.cgi: Fix HTML formated spaces.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework "Enable IPS" section

Just use one language string for a maximum of flexiblity for the
transloators.

Fixes #11986

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Do not display messages when starting up

Fixes #11979.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Change lang string from "Activate IPS" to "Enable IPS"

Reference #11986

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Rename IDS strings to IPS

Reference: #11986

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Stop suricata when the rulest source has been changed

If the ruleset source has been changed, it has to be configured again.
This happens because of different rule categories, filenames rule ID's etc.

In case suricata currently is running it has to be stopped and after the configuration
has been done by the user, it can be launched again.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Fix downloading rules if source changed

Fix the if statement to detect wheater the ruleset has been
changed and automatically download the new one.

Fixes #11984.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Update automatic download texts

Update the showed texts in the dropdown box as mentioned in the
bug report.

Fixes #11985

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Use GET method to fetch Header data of a file

The sourcfire web servers does not support the HEAD request so we have to do
this with a GET here.

Fixes #11987

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Fix show HTTP error code and message

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

strongswan: Do not create any NAT rules when using VTI/GRE

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop "OpenVPN" part from VPN N2N stats page

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add routed IPsec connections to traffic graphs section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Write correct rules bound to interface for routes IPsec tunnels

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Resolve any remote hostnames

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Move conditional block into the loop

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Drop delayed restart setting

This is a very bad race-condition situation and is not solved by
an unintuitive setting.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Drop VPN_IP setting

This is now a per-connection setting

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add translation strings for recent changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-*: Name some more configuration variables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Uses local IP address from connection first, then default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Correct open ports for connections on aliases

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Allow to select local IP address used for peer on UI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Re-arrange inputs for peer addresses, subnets, etc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Don't allow to select VTI in transport mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Don't populate GREEN subnet when green doesn't exist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Fix typo in variable name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: No longer create any routes automatically

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Filter better for GRE/VTI interfaces

This tried to delete the GREEN interface before

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: TTL only applies for GRE interfaces and not VTI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Find correct RED IP address when using %defaultroute

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Log a message when an interface could not be created

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Don't add any interfaces when IPsec is disabled

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "ipsec-interfaces: Run when IPsec is disabled"

This reverts commit 3c3a1cfdb9b473fae9b792e8c211c9940fafc658.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Move advanced IPsec settings to connection page

This is required to make the initial setup easier for GRE/VTI connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Run when IPsec is disabled

This needs to run even when IPsec is disable to remove
and interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Use correct righthost variable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Do not allow 0.0.0.0/0 as remote subnet

This renders the whole machine inaccessible

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: Create IPsec interfaces when network is brought up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsecctrl: Call ipsec-interfaces script when turning up/shutting down connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add (experimental) script that creates GRE/VTI interfaces

Signed-off-by: root <root@interim-edge-a.ec2.internal>

IPsec: Use left/rightprotoport in GRE mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsecctrl: Don't wait when a connection is to be started

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Don't install any block rules for connections with an interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Permit GRE traffic for GRE connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Variables don't match those from the CGI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Parse all configuration settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Move opening ports from ipsecctrl into ipsec-policy script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Rename ipsec-block script to ipsec-policy

This is a more general name for a script that will be extended
soon to do more than just add blocking rules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Update ipsec.conf for GRE/VTI changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add UI for set interface MTU

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add option to configure IP address for tunnel interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Set default inactivity timeout to half an hour

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: New connections should defatul to on-demand mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add dropdown to select tunnel interface mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Correctly carry over INACTIVITY_TIMEOUT

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Write tunnel/transport mode to strongSwan configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add selection for transport/tunnel mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python3-msgpack: Fix build on i586

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python3-dateutil: Update rootfiles

Changed because of new python3-setuptools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcpcd: Update to 7.1.0

For some informations about this update see:
https://roy.marples.name/blog/dhcpcd-7-1-0-released

"dhcpcd-7.1.0 has been released with the following changes:

- OpenBSD: works alongside slaacd(8)
- NetBSD: sets SO_RERROR on to detect receive socket overflow
- BSD: route improvements to avoid listening for own changes
- Linux: use NETLINK_BROADCAST_ERROR
- BSD: avoid late address deletion messages by testing address existance
- IP6: implement IP6 address sharing
- BSD: catch UP/DOWN events when interfaces does support media changes
- IPv4LL: remember old address when carrier is lost

Many other minor fixes and documenation updates have been submitted by various
community members for this release..."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated curl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: Update to 7.63.0

For details see:
https://curl.haxx.se/changes.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update.sh: Delete .rnd files

Since RANDFILE has been disabled in OpenSSL configurations, .rnd files are not needed anymore.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated apr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Updated apr, stabilized apache build

- Updated apr to 1.6.5
- Stabilized apache build (rebuild)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python3-llfuse: fix rootfile for non x86_64 builds

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.97

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

haproxy: Bump version to support TLSv1.3 (and PCRE JIT)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Restart updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache: Update to 2.4.38

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.38

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship AWS scripts again

It seems that this was missing in Core Update 125/126 so not all
bug fixes made it into the release.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package borgbackup

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-msgpack

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-llfuse

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-setuptools-scm

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-settuptools

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata.yaml: Add port 222 to list of SSH Ports

The SSH-server listened on port "222" as default on IPFire in the past.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Grab address for RED by using get_red_address() function.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add function to the the current assigned IP-address of RED.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Automatically download ruleset if the ruleset source has been changed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core128: Delete SSE2-optimised legacy OpenSSL libraries, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

initscripts/suricata: Generate firewall rules on start and reload

Fixes #11978

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add RED address and aliases to the HOME_NET

Reference: #11981

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add get_aliases()

This subfunction is used to get all configured and enabled aliases
for the RED network zone. They will be returned as an array.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

update-ids-ruleset: Improve error reporting if the system is offline

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Dynamically generate SHOW/HIDE for expanding or collapsing a ruleset category

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Show IDS setting area only if a ruleset is present.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>