ipfire-2.x.git
5 months agocore132: Ship updated dhcpcd
Michael Tremer [Tue, 7 May 2019 22:46:36 +0000 (23:46 +0100)] 
core132: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agodhcpcd: Update to 7.2.2
Matthias Fischer [Sat, 4 May 2019 19:59:15 +0000 (21:59 +0200)] 
dhcpcd: Update to 7.2.2

For details see:
https://roy.marples.name/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agofirewall: Allow SNAT rules with RED interface
Michael Tremer [Tue, 7 May 2019 22:44:44 +0000 (23:44 +0100)] 
firewall: Allow SNAT rules with RED interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosuricata: Update to 4.1.4
Stefan Schantl [Wed, 1 May 2019 18:19:01 +0000 (20:19 +0200)] 
suricata: Update to 4.1.4

This is a minor update to the latest available version from
the suricata 4.1 series.

Fixes #12068.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Wed, 1 May 2019 16:04:36 +0000 (18:04 +0200)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

5 months agosuricata: Remove PID file on stop
Stefan Schantl [Wed, 1 May 2019 15:03:06 +0000 (17:03 +0200)] 
suricata: Remove PID file on stop

Force the initscript to remove the PID file when calling "stop" section.

If suricata crashes during startup, the PID file still remains and the service
cannot be started anymore until the file has been deleted.

Now when calling "stop" or "restart" the PID file will be deleted and the service
can be used again.

Fixes #12067.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agoupdate-ids-ruleset: Set correct ownership for the rulestarball.
Stefan Schantl [Wed, 1 May 2019 14:49:25 +0000 (16:49 +0200)] 
update-ids-ruleset: Set correct ownership for the rulestarball.

The script usualy will be executed by cron which will start it with
root permissions, so the downloaded tarball is owned by this user.

This has to be changed to the user which runs the WUI (nobody:nobody) to
allow, changing the ruleset to an other one and to display the ruleset area.

Fixes #12066

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agocore132: Ship updated firewall rules generator
Michael Tremer [Tue, 30 Apr 2019 09:58:31 +0000 (10:58 +0100)] 
core132: Ship updated firewall rules generator

This patch also requires a reboot after installing this update
so that the changed ruleset is being applied.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agofirewall: Fix source/destination interface settings
Michael Tremer [Tue, 30 Apr 2019 09:56:05 +0000 (10:56 +0100)] 
firewall: Fix source/destination interface settings

When a forwarding rule is being created, we sometimes create
INPUT/OUTPUT rules, too. Those were slightly invalid because
the source and destination interfaces where passed, too.

This could render some rules in certain circumstances useless.

This patch fixes this and only adds -i for INPUT and -o for
OUTPUT rules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agofirewall: Add more rules to input/output when adding rules to forward
Michael Tremer [Tue, 30 Apr 2019 09:45:34 +0000 (10:45 +0100)] 
firewall: Add more rules to input/output when adding rules to forward

The special_input/output_targets array assumed that firewall access
will always be denied. However, rules also need to be created when
access is granted. Therefore the ACCEPT target needs to be included
in this list and rules must be created in INPUTFW/OUTGOINGFW too
when ACCEPT rules are created in FORWARDFW.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agogrub: Update rootfile on i586
Michael Tremer [Tue, 30 Apr 2019 09:45:02 +0000 (10:45 +0100)] 
grub: Update rootfile on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agogrub: Fix rootfile
Michael Tremer [Sun, 28 Apr 2019 08:41:50 +0000 (09:41 +0100)] 
grub: Fix rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agogrub: Fix relocation type issue
Michael Tremer [Sat, 27 Apr 2019 02:58:44 +0000 (03:58 +0100)] 
grub: Fix relocation type issue

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoipfire-netboot: Fix compiling and linking with new GCC & binutils
Michael Tremer [Sat, 27 Apr 2019 00:40:43 +0000 (01:40 +0100)] 
ipfire-netboot: Fix compiling and linking with new GCC & binutils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosarg: Fix build with newer GCCs
Michael Tremer [Fri, 26 Apr 2019 23:21:39 +0000 (00:21 +0100)] 
sarg: Fix build with newer GCCs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoMerge branch 'master' into next
Arne Fitzenreiter [Fri, 26 Apr 2019 17:39:55 +0000 (19:39 +0200)] 
Merge branch 'master' into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agogrub: Fix build error with GCC 8
Michael Tremer [Fri, 26 Apr 2019 15:11:17 +0000 (16:11 +0100)] 
grub: Fix build error with GCC 8

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agogrub: Disable efiemu on PC builds
Michael Tremer [Fri, 26 Apr 2019 15:10:25 +0000 (16:10 +0100)] 
grub: Disable efiemu on PC builds

This won't compile with GCC 8 and we do not need it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agonasm: Update to 2.14.02
Michael Tremer [Fri, 26 Apr 2019 15:05:20 +0000 (16:05 +0100)] 
nasm: Update to 2.14.02

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoltrace: Bump package version
Michael Tremer [Fri, 26 Apr 2019 15:06:10 +0000 (16:06 +0100)] 
ltrace: Bump package version

This package needs to be rebuilt because it uses elfutils
which has had an soname bump.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoelfutils: Update to 0.176
Michael Tremer [Fri, 26 Apr 2019 15:04:48 +0000 (16:04 +0100)] 
elfutils: Update to 0.176

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoOpenVPN: Fixed certificate generation in French
Erik Kapfer [Fri, 26 Apr 2019 15:08:35 +0000 (17:08 +0200)] 
OpenVPN: Fixed certificate generation in French

Fixes #12060

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoinitscripts/suricata: Rework creation of firewall rules.
Stefan Schantl [Thu, 25 Apr 2019 17:31:48 +0000 (19:31 +0200)] 
initscripts/suricata: Rework creation of firewall rules.

The script now will use the previously introduced seperate firewall chains called
IPS_INPUT, IPS_FORWARD and IPS_OUTPUT.

The commit also creates an AND connection between the choosen network zones in the UI and
the final firwall rules.

Fixes #12062.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agoinitscripts/suricata: Move functions order and always use flush_fw_chain function
Stefan Schantl [Thu, 25 Apr 2019 17:31:47 +0000 (19:31 +0200)] 
initscripts/suricata: Move functions order and always use flush_fw_chain function

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agofirewall: Use seperate firewall chains for passing traffic to the IPS
Stefan Schantl [Thu, 25 Apr 2019 17:31:46 +0000 (19:31 +0200)] 
firewall: Use seperate firewall chains for passing traffic to the IPS

Create and use seperate iptables chain called IPS_INPUT, IPS_FORWARD and IPS_OUTPUT
to be more flexible which kind of traffic should be passed to suricata.

Reference #12062

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agohostapd: bump package version
Arne Fitzenreiter [Fri, 26 Apr 2019 05:43:21 +0000 (07:43 +0200)] 
hostapd: bump package version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 months agohostap: Fix wiring of checkboxes for client isolation
Michael Tremer [Wed, 24 Apr 2019 10:24:33 +0000 (11:24 +0100)] 
hostap: Fix wiring of checkboxes for client isolation

The checkboxes were swapped which lead to client isolation
being enabled when the UI said disabled and vice-versa.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agohostap: Translate configuration settings
Michael Tremer [Wed, 24 Apr 2019 10:31:28 +0000 (11:31 +0100)] 
hostap: Translate configuration settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agohostap: Fix wiring of checkboxes for client isolation
Michael Tremer [Wed, 24 Apr 2019 10:24:33 +0000 (11:24 +0100)] 
hostap: Fix wiring of checkboxes for client isolation

The checkboxes were swapped which lead to client isolation
being enabled when the UI said disabled and vice-versa.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agohostap: Remove deprecated directive
Michael Tremer [Wed, 24 Apr 2019 10:08:36 +0000 (11:08 +0100)] 
hostap: Remove deprecated directive

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agohostap: Enable 80MHz bandwidth by default (when using ACS)
Michael Tremer [Wed, 24 Apr 2019 09:43:50 +0000 (10:43 +0100)] 
hostap: Enable 80MHz bandwidth by default (when using ACS)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agohostap: Enable option to force clients to use 802.11w
Michael Tremer [Wed, 24 Apr 2019 09:39:25 +0000 (10:39 +0100)] 
hostap: Enable option to force clients to use 802.11w

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agohostap: Allow to use Automatic Channel Selection (ACS)
Michael Tremer [Wed, 24 Apr 2019 09:12:29 +0000 (10:12 +0100)] 
hostap: Allow to use Automatic Channel Selection (ACS)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoconvert-snort: Fix ownership of the generated homenet file.
Stefan Schantl [Tue, 23 Apr 2019 18:33:02 +0000 (20:33 +0200)] 
convert-snort: Fix ownership of the generated homenet file.

Fixes #12059.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosuricata: Use device ppp0 if PPPoE dialin is used.
Stefan Schantl [Tue, 23 Apr 2019 19:27:53 +0000 (21:27 +0200)] 
suricata: Use device ppp0 if PPPoE dialin is used.

Fixes #12058.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosuricata: EXTERNAL_NET should equal any
Michael Tremer [Tue, 23 Apr 2019 19:45:42 +0000 (20:45 +0100)] 
suricata: EXTERNAL_NET should equal any

This enables that we scan servers in ORANGE for clients in
GREEN which absolutely makes sense.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosuricata: Do not always convert rules to be bi-directional
Michael Tremer [Sun, 21 Apr 2019 00:32:07 +0000 (01:32 +0100)] 
suricata: Do not always convert rules to be bi-directional

This creates some overhead that we do not need and rules need to
be adjusted to match any direction they are supposed to match.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agocore132: Ship updated suricata initscript
Michael Tremer [Tue, 23 Apr 2019 19:56:07 +0000 (20:56 +0100)] 
core132: Ship updated suricata initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agocore132: Ship updated convert-snort script
Michael Tremer [Tue, 23 Apr 2019 19:55:22 +0000 (20:55 +0100)] 
core132: Ship updated convert-snort script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoconvert-snort: Fix ownership of the generated homenet file.
Stefan Schantl [Tue, 23 Apr 2019 18:33:02 +0000 (20:33 +0200)] 
convert-snort: Fix ownership of the generated homenet file.

Fixes #12059.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agocore132: Bugfix for typo in filelist
Alexander Koch [Tue, 23 Apr 2019 18:46:11 +0000 (20:46 +0200)] 
core132: Bugfix for typo in filelist

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosuricata: Use device ppp0 if PPPoE dialin is used.
Stefan Schantl [Tue, 23 Apr 2019 19:27:53 +0000 (21:27 +0200)] 
suricata: Use device ppp0 if PPPoE dialin is used.

Fixes #12058.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosuricata: EXTERNAL_NET should equal any
Michael Tremer [Tue, 23 Apr 2019 19:45:42 +0000 (20:45 +0100)] 
suricata: EXTERNAL_NET should equal any

This enables that we scan servers in ORANGE for clients in
GREEN which absolutely makes sense.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agocore132: Ship updated list of mime types
Michael Tremer [Tue, 23 Apr 2019 19:20:14 +0000 (20:20 +0100)] 
core132: Ship updated list of mime types

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agoapache / WPAD: Add correct MIME type for wpad.dat and proxy.pac
Alexander Koch [Wed, 17 Apr 2019 23:54:18 +0000 (01:54 +0200)] 
apache / WPAD: Add correct MIME type for wpad.dat and proxy.pac

Some clients require the correct MIME type to be set for accepting/handling the Proxy-Settings properly.

See: http://findproxyforurl.com/deploying-wpad/

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agosuricata: Do not always convert rules to be bi-directional
Michael Tremer [Sun, 21 Apr 2019 00:32:07 +0000 (01:32 +0100)] 
suricata: Do not always convert rules to be bi-directional

This creates some overhead that we do not need and rules need to
be adjusted to match any direction they are supposed to match.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
5 months agocore131: add services.cgi to update
Arne Fitzenreiter [Tue, 23 Apr 2019 17:21:30 +0000 (19:21 +0200)] 
core131: add services.cgi to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agofinish core131
Arne Fitzenreiter [Sat, 20 Apr 2019 16:12:21 +0000 (18:12 +0200)] 
finish core131

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Sat, 20 Apr 2019 15:35:54 +0000 (17:35 +0200)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

6 months agokernel: update 4.14.113
Arne Fitzenreiter [Sat, 20 Apr 2019 15:21:03 +0000 (17:21 +0200)] 
kernel: update 4.14.113

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agoUpdate contributors
Michael Tremer [Sat, 20 Apr 2019 13:21:46 +0000 (14:21 +0100)] 
Update contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore132: Ship WPAD/proxy changes
Michael Tremer [Sat, 20 Apr 2019 13:20:06 +0000 (14:20 +0100)] 
core132: Ship WPAD/proxy changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoUpdate translation
Michael Tremer [Sat, 20 Apr 2019 13:18:17 +0000 (14:18 +0100)] 
Update translation

Fix some apostrophe and spelling errors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosquid / WPAD: Add Wiki-Link for required further adjustments to GUI
Alexander Koch [Sun, 21 Apr 2019 21:56:59 +0000 (23:56 +0200)] 
squid / WPAD: Add Wiki-Link for required further adjustments to GUI

This patch adds a notice with a link to the Wiki-page https://wiki.ipfire.org/configuration/network/proxy/extend/wpad to the new WebGUI-Setion to make the user aware of the fact, that WPAD will only work correctly if he makes further adjustments:

- Add DHCP-Options for WPAD via DHCP
- Add HOST-Entries to DNS and Apache-vhost or haproxy-frontend/backend or firewall-redirect for WPAD via DNS

These additional options depend on the users environment and can not be shipped by default as they might break the users setups.

Note: The translations are only done for "en" and "de" yet!

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosquid / WPAD: Add GUI for exception-files for generation of proxy.pac
Alexander Koch [Sun, 21 Apr 2019 21:56:58 +0000 (23:56 +0200)] 
squid / WPAD: Add GUI for exception-files for generation of proxy.pac

This patch adds the missing Web-GUI for the WPAD-Exceptions to proxy.cgi

Note: The translations are only done for "en" and "de" yet!

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosquid / WPAD: Add exception-files for generation of proxy.pac
Alexander Koch [Sun, 14 Apr 2019 10:08:43 +0000 (12:08 +0200)] 
squid / WPAD: Add exception-files for generation of proxy.pac

This patch extends the script /srv/web/ipfire/cgi-bin/proxy.cgi by additional code for reading exceptions for URL's and IP's/Subnets from two new files:

- /var/ipfire/proxy/advanced/acls/dst_noproxy_url.acl
- /var/ipfire/proxy/advanced/acls/dst_noproxy_ip.acl

as described in: https://wiki.ipfire.org/configuration/network/proxy/extend/add_distri

These can be used to define additional URL's, IP's and Subnets that should be retrieved "DIRECT" and not via the proxy. The files have to be created by the user, as the WPAD-Feature is not enabled by default anyway. If the files are not present or their size is 0, nothing is done. I'll revise the wiki-page, after the patch is merged and the core update is released.

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoEnable seccomp support for qemu
Jonatan Schlag [Sat, 13 Apr 2019 14:55:16 +0000 (15:55 +0100)] 
Enable seccomp support for qemu

Fixes: #11941

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoAdd new package libseccomp
Jonatan Schlag [Sat, 13 Apr 2019 14:55:15 +0000 (15:55 +0100)] 
Add new package libseccomp

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore132: Ship changed suricata configuration
Michael Tremer [Sat, 20 Apr 2019 13:10:12 +0000 (14:10 +0100)] 
core132: Ship changed suricata configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosuricata: Disable stats.log
Stefan Schantl [Sun, 21 Apr 2019 07:26:45 +0000 (09:26 +0200)] 
suricata: Disable stats.log

This log is mainly needed for debugging the IPS. It writes some stats
every couple of seconds and will create some load on SD cards and other
cheap storage that we do not need.

Fixes #12056.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoStart Core Update 132
Michael Tremer [Sat, 20 Apr 2019 13:07:43 +0000 (14:07 +0100)] 
Start Core Update 132

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agokernel: update to 4.14.112
Arne Fitzenreiter [Wed, 17 Apr 2019 20:30:19 +0000 (22:30 +0200)] 
kernel: update to 4.14.112

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agosuricata: Do not let oinkmaster be too verbose
Michael Tremer [Wed, 17 Apr 2019 20:24:25 +0000 (21:24 +0100)] 
suricata: Do not let oinkmaster be too verbose

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosuricata: Redirect oinkmaster output to perl function
Michael Tremer [Wed, 17 Apr 2019 19:59:55 +0000 (20:59 +0100)] 
suricata: Redirect oinkmaster output to perl function

The output was written to stderr before and landed in apache's
error log where we do not want it.

Fixes: #12004
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoRevert "hostapd: Always enable 80 MHz channel width for 802.11ac"
Michael Tremer [Wed, 17 Apr 2019 18:15:44 +0000 (19:15 +0100)] 
Revert "hostapd: Always enable 80 MHz channel width for 802.11ac"

This reverts commit c31c8078cffcf3f933f567cb02a366ceedd6d5da.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agounbound: Drop unused function
Michael Tremer [Wed, 17 Apr 2019 06:38:27 +0000 (07:38 +0100)] 
unbound: Drop unused function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosuricata: Change runmode to workers
Michael Tremer [Wed, 17 Apr 2019 04:16:05 +0000 (05:16 +0100)] 
suricata: Change runmode to workers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agowireless-regdb: update to 2019.03.01
Arne Fitzenreiter [Tue, 16 Apr 2019 16:05:18 +0000 (18:05 +0200)] 
wireless-regdb: update to 2019.03.01

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agohaproxy: Backup certificates, too
Michael Tremer [Tue, 16 Apr 2019 12:23:17 +0000 (13:23 +0100)] 
haproxy: Backup certificates, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agobackup: Allow passing name of tarball for creation/restore
Michael Tremer [Tue, 16 Apr 2019 12:22:10 +0000 (13:22 +0100)] 
backup: Allow passing name of tarball for creation/restore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoMove IPS to a higher position in the Firewall menu
Michael Tremer [Thu, 11 Apr 2019 22:32:57 +0000 (23:32 +0100)] 
Move IPS to a higher position in the Firewall menu

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoremote.cgi: Move SSH Agent Forwarding to the top
Michael Tremer [Thu, 11 Apr 2019 22:24:28 +0000 (23:24 +0100)] 
remote.cgi: Move SSH Agent Forwarding to the top

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosshctrl: Fix syntax of generated sed command
Michael Tremer [Thu, 11 Apr 2019 22:22:14 +0000 (23:22 +0100)] 
sshctrl: Fix syntax of generated sed command

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore131: Ship PTR changes in hosts.cgi
Michael Tremer [Thu, 11 Apr 2019 22:02:57 +0000 (23:02 +0100)] 
core131: Ship PTR changes in hosts.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoUpdate list of contributors
Michael Tremer [Thu, 11 Apr 2019 22:00:25 +0000 (23:00 +0100)] 
Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoUnbound: do not generate PTR if the user requested not to, do so
Peter Müller [Mon, 8 Apr 2019 18:04:00 +0000 (18:04 +0000)] 
Unbound: do not generate PTR if the user requested not to, do so

Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoUpdate translations
Michael Tremer [Thu, 11 Apr 2019 21:58:35 +0000 (22:58 +0100)] 
Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoadd option for selective PTR generation on hosts.cgi
Peter Müller [Mon, 8 Apr 2019 18:04:00 +0000 (18:04 +0000)] 
add option for selective PTR generation on hosts.cgi

In some cases, it might be useful to create an additional
host (i.e. for round robin loadbalancing) without assigning
another PTR to the IP address specified.

This patch introduces the ability to check or uncheck
PTR generation for each host individually.

Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoudev: Rename interfaces when MACs are uppercase
Michael Tremer [Thu, 11 Apr 2019 20:59:41 +0000 (21:59 +0100)] 
udev: Rename interfaces when MACs are uppercase

The script relied on the configuration being in lowercase.

If people manually editied their configuration file they might
not have paid attention to this and therefore this script now
also accepts uppercase MAC addresses.

Fixes: #12047
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosuricata: Take as much off of the CPU as possible
Michael Tremer [Fri, 12 Apr 2019 16:59:21 +0000 (17:59 +0100)] 
suricata: Take as much off of the CPU as possible

https://suricata.readthedocs.io/en/suricata-4.1.3/performance/high-performance-config.html

This will compile the ruleset as efficient as possible and
allows the IPS to run faster on smaller systems.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore131: Ship updated setup
Michael Tremer [Thu, 11 Apr 2019 09:29:56 +0000 (10:29 +0100)] 
core131: Ship updated setup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoids.cgi: Display oinkcode section after page load when neccessary.
Stefan Schantl [Fri, 12 Apr 2019 16:21:01 +0000 (18:21 +0200)] 
ids.cgi: Display oinkcode section after page load when neccessary.

Fixes #12048.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoIPS logging: Fix date comparison for last entry
Michael Tremer [Fri, 12 Apr 2019 16:36:54 +0000 (17:36 +0100)] 
IPS logging: Fix date comparison for last entry

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoIPS logging: There is no distinguation between suricata & snort required
Michael Tremer [Fri, 12 Apr 2019 16:33:39 +0000 (17:33 +0100)] 
IPS logging: There is no distinguation between suricata & snort required

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoIPS logging: Fix reading date
Michael Tremer [Fri, 12 Apr 2019 16:32:02 +0000 (17:32 +0100)] 
IPS logging: Fix reading date

The CGI script only compares mm/dd and does not care about the year.

Suricata, however, logs the year as well which has to be ignored here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agozabbix_agentd: Bump package version
Michael Tremer [Thu, 11 Apr 2019 06:55:36 +0000 (07:55 +0100)] 
zabbix_agentd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agozabbix_agentd: Bugfix for /etc/sudoers.d/zabbix.user
Alexander Koch [Wed, 10 Apr 2019 18:33:31 +0000 (20:33 +0200)] 
zabbix_agentd: Bugfix for /etc/sudoers.d/zabbix.user

Files containing an '~' or '.' are ignored by sudo when placed in the includedir /etc/sudoers.d This makes the file useless. The file is renamed to "zabbix" instead of "zabbix.user" to fix this.

See: https://www.sudo.ws/man/1.8.13/sudoers.man.html#Including_other_files_from_within_sudoers

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agozabbix_agentd: update to 4.2.0
Alexander Koch [Wed, 10 Apr 2019 18:33:30 +0000 (20:33 +0200)] 
zabbix_agentd: update to 4.2.0

Relase Notes: https://www.zabbix.com/rn/rn4.2.0

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoinstaller+setup: Update French translation
Stéphane Pautrel [Thu, 11 Apr 2019 02:47:44 +0000 (03:47 +0100)] 
installer+setup: Update French translation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agomake.sh: fix syntax error
Arne Fitzenreiter [Thu, 11 Apr 2019 05:34:14 +0000 (07:34 +0200)] 
make.sh: fix syntax error

i have merged master>next and not deleted this line.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Thu, 11 Apr 2019 05:31:11 +0000 (07:31 +0200)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

6 months agoMerge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Thu, 11 Apr 2019 05:30:26 +0000 (07:30 +0200)] 
Merge remote-tracking branch 'origin/master' into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agowget: Update to 1.20.3 core130
Matthias Fischer [Fri, 5 Apr 2019 19:55:12 +0000 (21:55 +0200)] 
wget: Update to 1.20.3

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

"2019-04-05  Tim Ruehsen  <tim.ruehsen@gmx.de>

Fix a buffer overflow vulnerability
* src/iri.c(do_conversion): Reallocate the output buffer to a larger
  size if it is already full"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore130: Ship updated apache
Michael Tremer [Thu, 4 Apr 2019 01:04:28 +0000 (02:04 +0100)] 
core130: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agoapache: Update to 2.4.39
Matthias Fischer [Thu, 4 Apr 2019 07:15:00 +0000 (09:15 +0200)] 
apache: Update to 2.4.39

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore130: insert a core update for urgent fixes.
Arne Fitzenreiter [Tue, 9 Apr 2019 05:31:23 +0000 (07:31 +0200)] 
core130: insert a core update for urgent fixes.

the bigger changes for suricata and kernel need longer time for test
so we insert a core with smaller but important fixes.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agocore130: ship strongswan
Arne Fitzenreiter [Tue, 9 Apr 2019 05:30:26 +0000 (07:30 +0200)] 
core130: ship strongswan

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agocore130: Ship perl-Net-SSLeay
Michael Tremer [Mon, 8 Apr 2019 10:56:58 +0000 (11:56 +0100)] 
core130: Ship perl-Net-SSLeay

This was still using the old version of OpenSSL.

Instead of linking the module (which we should have found earlier)
the module uses dlopen :(

Fixes: #12044
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agostrongswan: Manually install all routes for non-routed VPNs
Michael Tremer [Mon, 8 Apr 2019 15:41:24 +0000 (16:41 +0100)] 
strongswan: Manually install all routes for non-routed VPNs

This is a regression from disabling charon.install_routes.

VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.

Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore130: Ship updated wget
Michael Tremer [Thu, 4 Apr 2019 01:07:16 +0000 (02:07 +0100)] 
core130: Ship updated wget

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>