nut: Disable parallel build

nut just fails to build when running in parallel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship suricata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'stevee/next-suricata' into next

core130: Ship updated firewall script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add IPtables chain for outgoing Tor traffic

If Tor is operating in relay mode, it has to open a lot of outgoing
TCP connections. These should be separated from any other outgoing
connections, as allowing _all_ outgoing traffic will be unwanted and
risky in most cases.

Thereof, Tor will be running as a dedicated user (see second patch),
allowing usage of user-based IPtables rulesets.

Partially fixes #11779.

Singed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

run Tor under dedicated user

This allows more-fine granular firewall rules (see first patch for
further information). Further, it prevents other services running as
"nobody" (Apache, ...) from reading Tor relay keys.

Fixes #11779.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 130

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Fix amount of listened nfqueues

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

amavisd: update to 2.11.1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.4.3

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Set the clock correctly when installing over network

If a system has a not very up to date clock, downloading files
over HTTPS is impossible.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: finish update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: try to boot without ramdisk if the system cannot load it

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

knot: update to 2.8.0 and build/install only kdig

This fix compile errors on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

groff: update to 1.22.4

This fix compile problems on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

suricata: Remove unneeded stuff during build

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "kernel: cleanup unused rpi patch"

This reverts commit a2d49659f3947e5a5a77cbc1bf384eb0b2760ca9.

The patch is still needed to prevent strange crashes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated dnsforward.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'ms/dns-forwarding' into next

core129: Ship updated dhcp.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'ms/dhcp' into next

Tor WebUI: drop relay bandwith options < 1 MBit/s

Tor requires at least 1 MBit/s in order to participate.

Fixes #12001

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Limit to fewer concurrent build processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated less

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

less: update to 530

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.4.1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

slang: revert parallelized build

This partially reverts https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=lfs/slang;h=217e74c77317d4c829913f934458779fd278bf29;hb=23164efba5f57b3d8ccb07a166b613f2f951e1b6

'slang 2.3.0' doesn't like "$(MAKETUNING)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IDS: Set owner of suricata logging directory to correct user

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Rename snort user and group to suricata

This only affects new installations.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Run as non-root user

This patch does not have any effect (yet) and is untested
because suricata needs to be built against libcap-ng which
is currently not being packaged for IPFire.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Update to 4.1.3

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Move IDS/IPS menu entry to firewall section

Fixes #12011.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

/etc/group: Order groups by ID

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

/etc/passwd: Order users by ID

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agent: Create /var/run/zabbix in initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agent: Ensure that the user exists on all systems

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: New addon

New addon for monitoring IPFire by Zabbix Monitoring (https://www.zabbix.com/features).
See https://forum.ipfire.org/viewtopic.php?f=52&t=22039 and https://lists.ipfire.org/pipermail/development/2019-February/005324.html for further details.

Best regards,
Alex

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iptables: Commented legacy ip(6)tables entries from ROOTFILE

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Download ISO via HTTPS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "boost: Build with -O2 only"

This reverts commit 9ff5b381eb8a4e129978c34f969e312c302ea7b1.

Boost wants to build with -O3 no matter what

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Mark domains as insecure from DNS forwarding

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DNS Forwarding: Add UI to Allow to disable DNSSEC for a zone

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'ipsec-on-demand' into next

vpnmain.cgi: Make on-demand mode default for IPsec VPNs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Carry over START_ACTION attribute correctly

This setting was not carried correctly and therefore the default was ignored.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Fit more processes into memory

Because we have a good way to limit processes now, we should
increase the default size a little bit

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Build with -O2 only

This should increase build speed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Config: Builds don't seem to like the space

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl: Limit build to 23 parallel processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Introduce MAX_PARALLELISM

This will now adjust MAKETUNING to not launch more processes
than MAX_PARALLELISM. Handy to limit builds that use a lot of memory.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Drop MAKETUNING

This is now set in lfs/Config

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Introduce DEFAULT_PARALLELISM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Use variable instead of calling system_processors function again

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Rename HOST_MEM to SYSTEM_MEMORY

We had two variables holding the same data

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Pass number of processors and total memory so that we can adjust MAKETUNING

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Parallelized build for several packages

Added $(MAKETUNING) to several packages.
Marked packages that do not support parallel build.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship wpa_supplicant

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Update to 2.7

For details see:
https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.7

For details see:
https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog

This patch sticks to 'wpa_supplicant: Update to 2.7'.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmp: Fix rootfile to build on other architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmpd: OpenSSL patch is incl. in new version

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmpd: Update to version 5.8

Overview of the changes can be found in here https://sourceforge.net/p/net-snmp/mailman/message/36386084/ .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iptables: Update to 1.8.2

netfilter-layer7 has also been updated to v2.23 .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libcap-ng: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop parsers I have never heard of

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Configure HTTP decoder

This will now scan all request and response bodies where possible
and use up to 256MB of RAM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "Suricata: detect DNS events on port 853, too"

This reverts commit ad99f959e2b83dd9f1275c1d385140271c8926ae.

It does not make any sense to try to decode the TLS connection
with the DNS decoder.

Therefore should 853 (TCP only) be added to the TLS decoder.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Unpack intel microcode before initramfs images are being built

Previously, the microcode updates were not packaged in the shipped
initramfs images which causes that Intel processors are still running
on outdated microcode.

This patch moves intel-microcode before we build the initramfs images.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated proxy.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bug 12008 - Typo in 'proxy.cgi' leads to wrong path for 'basic_ldap_auth'

Hi,

This should fix https://bugzilla.ipfire.org/show_bug.cgi?id=12008

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated ipset

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipset: Update to version 7.1

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated tar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tar: Update to 1.32

For details see:
http://git.savannah.gnu.org/cgit/tar.git/log/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.6

For details see:
http://ftp.isc.org/isc/bind9/9.11.6/RELEASE-NOTES-bind-9.11.6.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 4.6

For details see:
http://www.squid-cache.org/Versions/v4/changesets/

The 'configure'-option "--disable-ipv6" was removed, it is no longer necessary.

See:
https://lists.ipfire.org/pipermail/development/2016-April/002046.html

"The --disable-ipv6 build option is now deprecated.
...
Squid-3.5.7 and later will perform IPv6 availability tests on startup in
all builds.

- Where IPv6 is unavailable Squid will continue exactly as it would
have had the build option not been used.

These Squid can have the build option removed now."

The warning message concerning a "BCP 177 violation" while
starting 'squid' can be ignored.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

spectre-meltdown-checker: New package

This makes it easy to install the script and check the vulnerability status
of a system IPFire is running on.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Ship strings & readelf

This is needed by the spectre meltdown checker script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update German translation

Mainly adds translation for new IPsec features

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update of French translation

- Several syntax / vocabulary improvements
- A 2 text missing in the French version
- Improvement of text offering a donation for the users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Use highest bit to mark packets

We are using the netfilter MARK in IPsec & QoS and this
is causing conflicts.

Therefore, we use the highest bit in the IPS chain now
and clear it afterwards because we do not really care about
this after the packets have been passed through suricata.

Then, no other application has to worry about suricata.

Fixes: #12010
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Fix syntax error

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Start capture first and then load rules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Disable decoding for Teredo

This decoder is not very accurate and Teredo has been
disabled in Windows by default. Nobody will use this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Increase memory size for the stream engine

This change also ensures that suricata has a decent number
of streams preallocated to be able to handle any bursts in traffic.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Log to syslog like a normal process

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Use up to 256MB of RAM for the flow cache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Use 64MB of RAM for defragmentation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Use the correct path for the magic database

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Log to syslog

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: We do not use any IP reputation lists

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Allow 32MB of RAM for DNS decoding

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop sections that require Rust

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop some commented stuff from configuration

The file is really large and we should not carry anything we will
never use.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Drop profiling section from configuration

This is not compiled in as it slows down detection and is
only really useful for debugging

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>