python3-botocore: Required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws-cli: New package

Needed to communicate with AWS services like EC2, S3, etc...

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logs.cgi/ids.dat: Rework linking to external rule documentation.

Check if the sid of a rule belongs to sourcefire and link to the
changed URL for gathering more details. If the sid of the rule belongs
to emergingthreads now link to the emergingthreads documentation.

Fixes #11806.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "usbutils: update to 010"

This reverts commit b07b1bef22eae7038e7d0fcba0bfd53813f85258.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "core123: Ship updated usbutils"

This reverts commit a65d07ec6d36a712882294b608e718db2d56b24e.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "usbutils: Update rootfile"

This reverts commit 9aefd1ed07eee7d83e5b274d4a83240811f9e091.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "avahi: Build without dbus"

This reverts commit 5221a852e80526d188306b05202e595616f0c065.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Execute user-data script while we have networking up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Fix include of used rulefiles yaml

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Use HOME_NET declaration from external file

Use the gernerated HOME_NET details from
/var/ipfire/suricata/suricata-homenet.yaml which will be
generated by the WUI.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Add reload option to initscript

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Add code to start/stop/reload the IDS when neccessary

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add function to call suricatactrl binary

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

intel-microcode: update to 20180807

fixes #11590

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

avahi: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

avahi: Build without dbus

We don't have any services connected to dbus, so what is the
point of avahi trying to connect to it?

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

avahi: Build with -U_FORTIFY_SOURCE

Avahi locks up when built with -D_FORTIFY_SOURCE=2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

avahi: Update to 0.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "avahi: Drop package"

This reverts commit aa6ee515c59cd42b12d69981329a2438e4d6e933.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssh: Disable password authentication by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Dynamically generate the HOME_NET details for suricata.

Introduce generate_home_net_file() which uses the current network
config to obtain the network address and subnetmask for each
available network zone, generate and write these HOME_NET information
into a yaml compatible file which can be included into the suricata
configuration file.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

kernel: fix build on x86_64

oops i deleted a wrong line...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: fix build on armv5tel

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ids.cgi: Rename form name from SNORT to IDS

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

kernel: apu2 leds: update string for newer bios

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

ids.cgi: Display if the IDS is running

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add function to check if the IDS is running

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

initrd: add early microcode load

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ids.cgi: Rework section to configure the IDS

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

tor: Update to version 0.3.3.9

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nginx: Update to version 1.15.1

Deleted last slash in --prefix configure option to prevent such -->
https://forum.ipfire.org/viewtopic.php?t=19213#p109787 problems.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rng-tools: Update to 6.3.1

Bugfix release, for details see:
https://github.com/nhorman/rng-tools/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Add command to update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids-functions.pl: Add function to get the available network zones

The get_available_network_zones() function uses the /var/ipfire/ethernet/settings
file and translates the configured mode into an array, which contains the names
of the configured network zones.

The array will be returned and easily can be used to loop over this list of
available network zones and perform any kind of actions in other scripts.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

collectd: fix cpufreq plugin enable

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

backup: Bump release number in ISO download script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Call suricatactrl for restarting the IDS

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

oinkmaster: Install config file to /var/ipfire/suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

daq: Drop package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

snort: Drop package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

initscripts: Link against suricata initscript in runlevels and red.up hook

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

misc-progs: Rename snortctrl to suricatactrl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

linux-firmware: update to 30.7.2018

include new amd microcodes for Spectre updates

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Add ids-ruleset-source

I accidently forgot to commit this file in 1d9b87914053e54550c6f2a76377a8001bbf1da6

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Introduce basic initscript

Add a very basic initscript, which currently allows to start/stop/restart suricata and
check if the daemon is running.

The script will detect when starting suricata how many CPU cores are present on the system and
will launch suricata in inline mode (NFQUEUE) and listen to as much queues as CPU cores are
detected.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-ruleset-sources: Update download URL for snort rules

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Rename ruleset-sources.list to ruleset-sources

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-ruleset-sources: New package

Move the file which contains the download URL's for the IDS rulesets
into an own common package. This will allow us in future to easily ship
a changed file with a core update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

configroot: Move from snort to suricata

Create /var/ipfire/suricata and /var/ipfire/suricata/settings instead of
/var/ipfire/snort and /var/ipfire/snort/settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Install very basic config file

This config file is mostly based on the example configuration shipped
by the suricata project and needs to be enhanched.

See #11808.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Generate suricata compatiple used-rulefiles file

 * Rename filename to suricata-used-rulefiles.yaml
 * Adjust file generation as a yaml file to be compatible with suricata
 * Adjust code to correctly read-in and parse the changed file

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

backup: Make backup ISO bootable on EFI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids-functions.pl: Move path details from snort to suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'next-new-ids.cgi' into next-suricata-and-cgi

suricata: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

aws: Disable SSH password authentication by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libhtp: New package

This is build and runtime dependency for suricata.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

yaml: New package

This is a build and runtime dependency for suricata.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Rework error and log handling in ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Introduce settingsdir variable

The $settingsdir variable is declared in the ids-functions.pl and used to to
store the path where the various files which contains the settings for the IDS and
oinkmaster is located.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Move rulepath declaration to ids-functions.pl

This will help if the path ever changed. Also remove hard coded rulepath
from oinkmaster call.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rename snortrules hash to idsrules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core123: Ship and restart squid and apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 3.5.28

For details see:
http://www.squid-cache.org/Versions/v3/3.5/changesets/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Apache: Update to 2.4.34

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Drop code which is detecting if oinkmaster is running

This code is not longer required and therefore can be dropped.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Reimplement function to lock page and show working notice

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Also log errors to syslog

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Use pure perl to log oinkmaster result to syslog

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Make variables globally accessible

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework CGI logic to download a new ruleset

* Drop function to show a notice about snort is working.
* Introduce the log_error function which is responsible for log any
  error messages. Currently it writes it to a tempory file, which will
  be read by the WUI, the message will be displayed and the temporary file
  will be released again.
* Introduce a tiny function to easily perform a reload of the generated
  webpage.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Use tarball information from ids-functions.pl

Directly use the value from the ids-functions.pl for the
location and filename of the tarball which includes the snort ruleset.

This will save to declare this information twice and prevents from any
failures if the location of filname every changes.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop dirty hook for updating the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move function to call oinkmaster to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move downloader code to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Use ids-functions.pl for checking available discspace

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Introduce ids-functions.pl.

This library will contain a set of functions used by the IDS CGI script
and the planned update script for auto-updating the snort ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop loading of File::Copy module.

This is not required, at any time by the script.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

logs.cgi/log.dat: Add support for oinkmaster

This will allow to display the logged output of oinkmaster
via the webinterface.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework snort configuration area

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Pipe the oinkmaster output to the logger binary

This will allow anybody, to access the log of oinkmaster and
get detailed information about any changes which have been done
on the ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework downloader for rulesets

Doing the rules download in pure perl instead of using
the external wget.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop old control code

The control file are not longer required, because the
initscript uses the settings file to determine if snort
should be started and binded to which interfaches.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

snort: Introduce ruleset-sources.list

This file contains the ruleset vendors and download urls and
will be used by the ids.cgi.

If an url or filename changes, we easily can adjust this file. In most
cases this will be needed when performing a snort update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

general-functions.pl: readhash() Add code to handle optional comments in files

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Call oinkmaster without a log target

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Introduce ruleset-source.list

This new file will contain the vendor information and url
for downloading their ruleset. In future if the download location
or filename changes, we only need to adjust this one file and ship
it via a core update.

Also extend the downloadrulesfile to be able to directly call the
subfunction.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Adjust code for saving snort settings

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Remove logfile after wget has successfully downloaded the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework code which shows if oinkmaster is working

Move the code for displaying a notice that snort currently is working
into an own subfunction which will be called if oinkmaster currently
is started.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop old code for debuging purposes

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Add check when altering the ruleset

Add a check if the currently processing sid is nummeric, otherwise skip it.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework code for downloading/updating the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move call of oinkmaster to an own subfunction

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Always write config files for enabled/disabled rule files

If a single sid has been activated and then disabled without doing
any other ruleset modifications only one of the oinkmaster files
for enabled / disabled rules has been modified.

In this case it was possible, that the same sid, was part of the
file for enabled rules and part of the file for disabled rules at the
same time.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Process enabled rulefiles in an own loop

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Drop enabled/disabled rules from cgiparams hash

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>