ipfire-netboot: Fix compiling and linking with new GCC & binutils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sarg: Fix build with newer GCCs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'master' into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

grub: Fix build error with GCC 8

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: Disable efiemu on PC builds

This won't compile with GCC 8 and we do not need it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nasm: Update to 2.14.02

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ltrace: Bump package version

This package needs to be rebuilt because it uses elfutils
which has had an soname bump.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

elfutils: Update to 0.176

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Fixed certificate generation in French

Fixes #12060

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

initscripts/suricata: Rework creation of firewall rules.

The script now will use the previously introduced seperate firewall chains called
IPS_INPUT, IPS_FORWARD and IPS_OUTPUT.

The commit also creates an AND connection between the choosen network zones in the UI and
the final firwall rules.

Fixes #12062.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

initscripts/suricata: Move functions order and always use flush_fw_chain function

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

firewall: Use seperate firewall chains for passing traffic to the IPS

Create and use seperate iptables chain called IPS_INPUT, IPS_FORWARD and IPS_OUTPUT
to be more flexible which kind of traffic should be passed to suricata.

Reference #12062

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

hostapd: bump package version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

hostap: Fix wiring of checkboxes for client isolation

The checkboxes were swapped which lead to client isolation
being enabled when the UI said disabled and vice-versa.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostap: Translate configuration settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostap: Fix wiring of checkboxes for client isolation

The checkboxes were swapped which lead to client isolation
being enabled when the UI said disabled and vice-versa.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostap: Remove deprecated directive

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostap: Enable 80MHz bandwidth by default (when using ACS)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostap: Enable option to force clients to use 802.11w

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostap: Allow to use Automatic Channel Selection (ACS)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

convert-snort: Fix ownership of the generated homenet file.

Fixes #12059.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Use device ppp0 if PPPoE dialin is used.

Fixes #12058.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: EXTERNAL_NET should equal any

This enables that we scan servers in ORANGE for clients in
GREEN which absolutely makes sense.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Do not always convert rules to be bi-directional

This creates some overhead that we do not need and rules need to
be adjusted to match any direction they are supposed to match.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core132: Ship updated suricata initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core132: Ship updated convert-snort script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

convert-snort: Fix ownership of the generated homenet file.

Fixes #12059.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core132: Bugfix for typo in filelist

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Use device ppp0 if PPPoE dialin is used.

Fixes #12058.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: EXTERNAL_NET should equal any

This enables that we scan servers in ORANGE for clients in
GREEN which absolutely makes sense.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core132: Ship updated list of mime types

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache / WPAD: Add correct MIME type for wpad.dat and proxy.pac

Some clients require the correct MIME type to be set for accepting/handling the Proxy-Settings properly.

See: http://findproxyforurl.com/deploying-wpad/

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Do not always convert rules to be bi-directional

This creates some overhead that we do not need and rules need to
be adjusted to match any direction they are supposed to match.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core131: add services.cgi to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

finish core131

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

kernel: update 4.14.113

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Update contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core132: Ship WPAD/proxy changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translation

Fix some apostrophe and spelling errors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid / WPAD: Add Wiki-Link for required further adjustments to GUI

This patch adds a notice with a link to the Wiki-page https://wiki.ipfire.org/configuration/network/proxy/extend/wpad to the new WebGUI-Setion to make the user aware of the fact, that WPAD will only work correctly if he makes further adjustments:

- Add DHCP-Options for WPAD via DHCP
- Add HOST-Entries to DNS and Apache-vhost or haproxy-frontend/backend or firewall-redirect for WPAD via DNS

These additional options depend on the users environment and can not be shipped by default as they might break the users setups.

Note: The translations are only done for "en" and "de" yet!

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid / WPAD: Add GUI for exception-files for generation of proxy.pac

This patch adds the missing Web-GUI for the WPAD-Exceptions to proxy.cgi

Note: The translations are only done for "en" and "de" yet!

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid / WPAD: Add exception-files for generation of proxy.pac

This patch extends the script /srv/web/ipfire/cgi-bin/proxy.cgi by additional code for reading exceptions for URL's and IP's/Subnets from two new files:

- /var/ipfire/proxy/advanced/acls/dst_noproxy_url.acl
- /var/ipfire/proxy/advanced/acls/dst_noproxy_ip.acl

as described in: https://wiki.ipfire.org/configuration/network/proxy/extend/add_distri

These can be used to define additional URL's, IP's and Subnets that should be retrieved "DIRECT" and not via the proxy. The files have to be created by the user, as the WPAD-Feature is not enabled by default anyway. If the files are not present or their size is 0, nothing is done. I'll revise the wiki-page, after the patch is merged and the core update is released.

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Enable seccomp support for qemu

Fixes: #11941
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package libseccomp

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core132: Ship changed suricata configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Disable stats.log

This log is mainly needed for debugging the IPS. It writes some stats
every couple of seconds and will create some load on SD cards and other
cheap storage that we do not need.

Fixes #12056.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 132

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.112

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

suricata: Do not let oinkmaster be too verbose

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Redirect oinkmaster output to perl function

The output was written to stderr before and landed in apache's
error log where we do not want it.

Fixes: #12004
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "hostapd: Always enable 80 MHz channel width for 802.11ac"

This reverts commit c31c8078cffcf3f933f567cb02a366ceedd6d5da.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Drop unused function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Change runmode to workers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wireless-regdb: update to 2019.03.01

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

haproxy: Backup certificates, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Allow passing name of tarball for creation/restore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Move IPS to a higher position in the Firewall menu

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

remote.cgi: Move SSH Agent Forwarding to the top

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sshctrl: Fix syntax of generated sed command

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core131: Ship PTR changes in hosts.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unbound: do not generate PTR if the user requested not to, do so

Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add option for selective PTR generation on hosts.cgi

In some cases, it might be useful to create an additional
host (i.e. for round robin loadbalancing) without assigning
another PTR to the IP address specified.

This patch introduces the ability to check or uncheck
PTR generation for each host individually.

Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

udev: Rename interfaces when MACs are uppercase

The script relied on the configuration being in lowercase.

If people manually editied their configuration file they might
not have paid attention to this and therefore this script now
also accepts uppercase MAC addresses.

Fixes: #12047
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Take as much off of the CPU as possible

https://suricata.readthedocs.io/en/suricata-4.1.3/performance/high-performance-config.html

This will compile the ruleset as efficient as possible and
allows the IPS to run faster on smaller systems.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core131: Ship updated setup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Display oinkcode section after page load when neccessary.

Fixes #12048.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPS logging: Fix date comparison for last entry

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPS logging: There is no distinguation between suricata & snort required

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPS logging: Fix reading date

The CGI script only compares mm/dd and does not care about the year.

Suricata, however, logs the year as well which has to be ignored here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: Bugfix for /etc/sudoers.d/zabbix.user

Files containing an '~' or '.' are ignored by sudo when placed in the includedir /etc/sudoers.d This makes the file useless. The file is renamed to "zabbix" instead of "zabbix.user" to fix this.

See: https://www.sudo.ws/man/1.8.13/sudoers.man.html#Including_other_files_from_within_sudoers

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: update to 4.2.0

Relase Notes: https://www.zabbix.com/rn/rn4.2.0

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer+setup: Update French translation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: fix syntax error

i have merged master>next and not deleted this line.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

Merge remote-tracking branch 'origin/master' into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

wget: Update to 1.20.3

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

"2019-04-05  Tim Ruehsen  <tim.ruehsen@gmx.de>

Fix a buffer overflow vulnerability
* src/iri.c(do_conversion): Reallocate the output buffer to a larger
  size if it is already full"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

apache: Update to 2.4.39

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: insert a core update for urgent fixes.

the bigger changes for suricata and kernel need longer time for test
so we insert a core with smaller but important fixes.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: ship strongswan

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: Ship perl-Net-SSLeay

This was still using the old version of OpenSSL.

Instead of linking the module (which we should have found earlier)
the module uses dlopen :(

Fixes: #12044
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Manually install all routes for non-routed VPNs

This is a regression from disabling charon.install_routes.

VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.

Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated wget

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.2

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

* Changes in Wget 1.20.2
** NTLM authentication will retry under certain cases
** Fixed a buffer overflow vulnerability"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.2

For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html

"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

convert-snort: Re-order steps at end of script

This will ensure that the whole IDS is configured property, if
no or an empty snort config file is present.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

convert-snort: Fix logic for detecting enough free disk space.

The subfunction only will return something if the check fails - so the logic
of the if statement was wrong set and the downloader only was called if
this check failed and to less diskspace would be available.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship SSH Agent Forwarding changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

change AllowAgentForwarding in SSHD configuration if, necessary

Fixes #11931

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

allow SSH agent forwarding to be configured via WebUI

Fixes #11931

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add language strings for SSH agent forwarding settings

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rename core130 -> core131

we need to insert a core update to fix urgent bugs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.111

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

strongswan: Manually install all routes for non-routed VPNs

This is a regression from disabling charon.install_routes.

VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.

Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>