boost: Build with -O2 only

This should increase build speed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Config: Builds don't seem to like the space

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl: Limit build to 23 parallel processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Introduce MAX_PARALLELISM

This will now adjust MAKETUNING to not launch more processes
than MAX_PARALLELISM. Handy to limit builds that use a lot of memory.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Drop MAKETUNING

This is now set in lfs/Config

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Introduce DEFAULT_PARALLELISM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Use variable instead of calling system_processors function again

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Rename HOST_MEM to SYSTEM_MEMORY

We had two variables holding the same data

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Pass number of processors and total memory so that we can adjust MAKETUNING

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Parallelized build for several packages

Added $(MAKETUNING) to several packages.
Marked packages that do not support parallel build.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship wpa_supplicant

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Update to 2.7

For details see:
https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.7

For details see:
https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog

This patch sticks to 'wpa_supplicant: Update to 2.7'.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmp: Fix rootfile to build on other architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmpd: OpenSSL patch is incl. in new version

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmpd: Update to version 5.8

Overview of the changes can be found in here https://sourceforge.net/p/net-snmp/mailman/message/36386084/ .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iptables: Update to 1.8.2

netfilter-layer7 has also been updated to v2.23 .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libcap-ng: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop parsers I have never heard of

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Configure HTTP decoder

This will now scan all request and response bodies where possible
and use up to 256MB of RAM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "Suricata: detect DNS events on port 853, too"

This reverts commit ad99f959e2b83dd9f1275c1d385140271c8926ae.

It does not make any sense to try to decode the TLS connection
with the DNS decoder.

Therefore should 853 (TCP only) be added to the TLS decoder.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Unpack intel microcode before initramfs images are being built

Previously, the microcode updates were not packaged in the shipped
initramfs images which causes that Intel processors are still running
on outdated microcode.

This patch moves intel-microcode before we build the initramfs images.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated proxy.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bug 12008 - Typo in 'proxy.cgi' leads to wrong path for 'basic_ldap_auth'

Hi,

This should fix https://bugzilla.ipfire.org/show_bug.cgi?id=12008

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated ipset

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipset: Update to version 7.1

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated tar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tar: Update to 1.32

For details see:
http://git.savannah.gnu.org/cgit/tar.git/log/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.6

For details see:
http://ftp.isc.org/isc/bind9/9.11.6/RELEASE-NOTES-bind-9.11.6.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 4.6

For details see:
http://www.squid-cache.org/Versions/v4/changesets/

The 'configure'-option "--disable-ipv6" was removed, it is no longer necessary.

See:
https://lists.ipfire.org/pipermail/development/2016-April/002046.html

"The --disable-ipv6 build option is now deprecated.
...
Squid-3.5.7 and later will perform IPv6 availability tests on startup in
all builds.

- Where IPv6 is unavailable Squid will continue exactly as it would
have had the build option not been used.

These Squid can have the build option removed now."

The warning message concerning a "BCP 177 violation" while
starting 'squid' can be ignored.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

spectre-meltdown-checker: New package

This makes it easy to install the script and check the vulnerability status
of a system IPFire is running on.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Ship strings & readelf

This is needed by the spectre meltdown checker script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update German translation

Mainly adds translation for new IPsec features

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update of French translation

- Several syntax / vocabulary improvements
- A 2 text missing in the French version
- Improvement of text offering a donation for the users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Use highest bit to mark packets

We are using the netfilter MARK in IPsec & QoS and this
is causing conflicts.

Therefore, we use the highest bit in the IPS chain now
and clear it afterwards because we do not really care about
this after the packets have been passed through suricata.

Then, no other application has to worry about suricata.

Fixes: #12010
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Fix syntax error

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Start capture first and then load rules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Disable decoding for Teredo

This decoder is not very accurate and Teredo has been
disabled in Windows by default. Nobody will use this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Increase memory size for the stream engine

This change also ensures that suricata has a decent number
of streams preallocated to be able to handle any bursts in traffic.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Log to syslog like a normal process

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Use up to 256MB of RAM for the flow cache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Use 64MB of RAM for defragmentation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Use the correct path for the magic database

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Log to syslog

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: We do not use any IP reputation lists

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Allow 32MB of RAM for DNS decoding

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop sections that require Rust

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop some commented stuff from configuration

The file is really large and we should not carry anything we will
never use.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop profiling section from configuration

This is not compiled in as it slows down detection and is
only really useful for debugging

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Set detection profile to high

This will merge rules more aggressively so that the engine
is only processing those that can actually match.

Memory is cheap. People with little memory should not run
suricata anyways.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Set default packet size to 1514

We usually use a MTU of 1500 + Ethernet header

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Set max-pending-packets to 1024

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Suricata: detect TLS traffic on port 444, too

This is the default port for IPFire's administrative web interface
and should be monitored by Suricata, too.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
c: Stefan Schantl <stefan.schantl@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

sysctl.conf: Revert enabling busy loop waiting on sockets

This causes the firmware in my ath10k module to crash.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update openssl rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Update to 1.1.1b

This is a bug fix only release

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Fix error when editing a newly added fixed lease

They key was remembered but then the array was sorted which resulted
the key showing a wrong line.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Restart server in background

This allows for the CGI to return quicker.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Escape slashes in filename

Fixes: #12006
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated credits.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated OpenVPN

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Update to version 2.4.7

Changelog can be found in here https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update Tor to 0.3.5.8

See https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312
for release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update metrics links in Tor WebUI

https://atlas.torproject.org/ is deprecated in favour of
https://metrics.torproject.org/ by now.

Fixes #11781.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated libgcrypt

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: update to 1.8.4

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.9.0

For details see:
https://nlnetlabs.nl/svn/unbound/tags/release-1.9.0/doc/Changelog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship changes from ipsec branch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'ipsec' into next

Start Core Update 129

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add script to search for missing libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Drop old openssl engines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cups: Depends on bluetooth library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: add openldap to update

openldap was linked against old openssl lib

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: add sse2 openssl libs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: apply local sshd config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.103

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: finish core128

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: import cve-2019-8912 patch

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: stop apache before replacing files

apache will not restart without stopped before
the files was replaced.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: apu leds: add more id's

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

partresize: add "apu1" for apus with new bios.

convert-snort: Try to download ruleset if none is present.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core128: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: cleanup unused rpi patch

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.102

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

partresize: enable serial console on PC Engines APU

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update apu led patch for apu3 and 4

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

convert-snort: Set correct ownership after modify_sids_file has been generated.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Add language string for ignored hosts section.

Fixes #12002.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

general-functions.pl: Only skip lines with a # at the beginning

This accidientially dropped all lines that include #. That resulted
in colour codes not being loaded from file any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Tune rules to always monitor in both directions.

This will allow to scan the traffic from an EXTERNAL_NET to the HOME_NET and from
the HOME_NET to the EXTERNAL_NET.

Reference: 10273

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Swith to "16" as repeat-mark and repeat-mask.

Marks "1-3" are used for marking source-natted packets on the
interfaces and 4 up to 6 for TOS and QOS. The mark "32" is used by IPsec.

See commit: f5ad510e3c0f416a1507999f5ad20ab171df9c07

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

unbound: Drop certificates for local control connection

These are a cause of worry because they are sometimes generated with
an invalid timestamp and therefore render unbound being unusable.

There is no strong reason to use self-signed certificates for extra
security here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Added 'CONFIG_X86_MSR=y for 'powertop' to i586 and x86_64 builds for fixing #11997

Triggered by:
https://forum.ipfire.org/viewtopic.php?f=69&t=22274

This - probably - fixes Bug #11997.

Needs testing on 64bit installations!

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>