update-ids-ruleset: Improve error reporting if the system is offline

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Dynamically generate SHOW/HIDE for expanding or collapsing a ruleset category

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Show IDS setting area only if a ruleset is present.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Diplay reason, why a ruleset could not be downloaded, if the system is offline.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Also download the ruleset when saving the ruleset settings

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Add dropdown option for Emergingthreats.net Pro rules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Only show "update ruleset" button if a ruleset is present

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Draw daemon status and setting in the same box.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Show/Hide subscription code area dynamically.

Dynamically (Java Script) show/hide the area for entering the
subscription code / oinkcode based on the choosen ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Remove help text for obtaining an oinkcode

This information is only valid for sourcefire (snort) rulesets, may
confuse users and therefore should be handled in the wiki.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Scan outgoing traffic, too

Connections from the firewall and through the proxy must be filtered, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Suricata: drop unused cuda HW acceleration

As stated in https://bugzilla.ipfire.org/show_bug.cgi?id=11808#c5 ,
Cuda hardware acceleration is unused and so the configuration file
section can be removed.

This partially addresses #11808.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "Add DDNS to core 107."

This reverts commit 197033fab234d4698b097fdb1b653b8ae39b1aae.

update-ids-ruleset: Set correct ownership for rulesdir and files

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

convert-snort: Use set_ownership() from ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ruleset-sources: Add Emerging-Threads Pro ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

logs.cgi/log.dat: Change search pattern from snort to suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Set correct ownership for the stored error file.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add set_ownership() function.

This function is used to change the ownership of a given file
or directory to the user "nobody" and the group "nobody", which is
used by the WUI.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

backup.pl: Run snort to suricata converter when a backup gets restored.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Install snort to suricata converter

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

ghostscript: Update to 9.26

For details see:
https://www.ghostscript.com/doc/9.26/News.htm

This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")

Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-4286563.html

I saw this article and found it could be the time for an update...

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

Enable some performance tuning

These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.

Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.

On a slower system (apu1d) no performance improvement or loss
could have been measured.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy: Show error messages in English by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.3.2

See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated ca-certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated openssh

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenSSH: update to 7.9p1

Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

kernel: update to 4.14.95

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xtables-addons: Fix generating GeoIP database

Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.

This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.

This patch changes this so that the last 12 bytes are just being dropped.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated tzdata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: update to 2018i

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

convert-snort: Settings converter from snort to suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Move and rename GenerateIgnoreList() function to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

strongswan: Update to 5.7.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: x86_64 encrease NR_CPUS to 64

fixes #11963

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.94

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: Ship updated xt_geoip_update script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

core128: Ship updated logrotate

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.15

For details see:
https://github.com/logrotate/logrotate/releases

- timer unit: change trigger fuzz from 12h to 1h (#230)
- service unit: only run if /var/log is mounted (#230)
- preserve fractional part of timestamps when compressing (#226)
- re-indent source code using spaces only (#188)
- minage: avoid rounding issue while comparing the amount of seconds (#36)
- never remove old log files if rotate -1 is specified (#202)
- return non-zero exit status if a config file contains an error (#199)
- make copytruncate work with rotate 0 (#191)
- warn user if both size and the time interval options are used (#192)
- pass rotated log file name as the 2nd argument of the postrotate script
  when sharedscript is not enabled (#193)
- rename logrotate-default to logrotate.conf (#187)

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

core127: run xt_geoip_update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: ovpn ca index.txt is also missing on some installations

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

xt_geoip_updte: fix download url

the maxmind server delivers an old version if there are
two slashes before the database filename.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: fix typo

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add ovpn ca changes to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add xt_geoip_update to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add bind to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: set reboot needed flag

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add general-functions.pl to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: fix updater for aarch64 and armv5tel

if a arch specific filelist has the same name as the common the common filelist was ignored

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Revert "Disable Path MTU discovery"

This reverts commit 1c0cfaa5949e4303e8e4e2f041af86a812f3fe6c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

drop orphaned OpenSSL patches

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Remove openssl-compat package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

drop openssl-compat package

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship recently updated openssl and apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 128

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

httpd: include TLS 1.3 cipher suites

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Erik Kapfer <erik.kapfer@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Update to version 1.1.1a

Disabled MD2 and Aria cipher.

TLSv1.3 is now available with:

TLS_CHACHA20_POLY1305_SHA256 TLSv1.3
TLS_AES_256_GCM_SHA384  TLSv1.3
TLS_AES_128_GCM_SHA256  TLSv1.3

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: set pakfire version to 127

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

keepalived: Move change of conntrack sysctl option into package

The setting cannot be set on the default system because the ip_vs
module is not loaded by default and there is no reason to load it
just because we would be able to set the setting.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

GeoIP: Add accidentially removed paths to database

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall-lib.pl: Fix incorrect path to geoip-functions.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

linux-initrd: fix build of uInit on aarch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: fix xtables kmod rootfiles for arm32 builds

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

xtables 3.2: Fix for rootfile

Found during the test builds...

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address."

Enhanching the code to fix the lookup will rapidely slow down the lookup speed. Because using
the GeoIP2 module is no option ( the reasons have been described in the commit message which will
now reverted), we have decided to temporary switch back to the old module until a nice solution has
been found.

This reverts commit ff21ff90d24de0f648d24bb906c45738b81ce67a.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "GeoIP: Drop legacy GeoIP perl module."

This reverts commit 9d1708e081d7e7ba490db3620509dcce29cb0ae8.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xtables-addons: Fix typo in lfs

Just some typos...

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bump kernel version to ship a new PAE kernel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: Ship updated kernel modules for xtables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: Ship updated firewall functions library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall-lib.pl: Use get_geoip_locations from geoip-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

geoip-locations.pl: Add get_geoip_locations().

This function is used to get all available GeoIP locations.

The functions returns them as array, sorted in alphabetical order.

Reference #11959

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.1

For details see:
https://blog.clamav.net/2019/01/clamav-01011-patch-has-been-released.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: Ship updated tar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tar: Update to 1.31, including fix for bug #11958

For details see:

http://savannah.gnu.org/forum/forum.php?forum_id=9344

"- Fix heap-buffer-overrun with --one-top-level.
- Support for zstd compression.
- The -K option interacts properly with member names given in the command line.
- Fix CVE-2018-20482"

This patch was reverted because 'tar 1.31' crashed when installing PakFire packages
with the option '--no-overwrite-dir'.
See: https://bugzilla.ipfire.org/show_bug.cgi?id=11958

Included is now a patch from https://savannah.gnu.org/bugs/?55413, which seems to fix this issue.
The test cases given in https://savannah.gnu.org/bugs/?55413#comment1 ran without problems.

As always, please check and confirm.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: Ship updated GeoIP functions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address.

Drop the usage of the old legacy GeoIP perl module which was not able to handle the
new GeoLite2 databases.

Write some code to directly access the databases and extract the required data.

Usage of the GeoIP2 perl module would provide a lot of more functionality which is not
used/needed. Unfortunately ir requires at lot of additional perl modules which are
not available on IPFire and would only be build and shipped for this module. Buildig all
of them will slow down the entire build process, mess up the system and requires a lot
more space on disk.

Fixes #11962.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

GeoIP: Drop legacy GeoIP perl module.

The legacy GeoIP perl module cannot handle the new GeoLite2 databases
provided from maxmind and therefore needs to be dropped.

Reference #11960

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xt_geoip_update: Adjust script to download and use the GeoLite2 database

Fixes #11961.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xtables-addons: Use shipped xt_geoip_build

Use the shipped xt_geoip_build directly instead of holding a copy in our GIT.

Reference #11959

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xtables-addons: Update to 3.2

Reference #11959

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl-Net-CIDR-Lite: Make rootfile work on other arches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl-Net-CIDR-Lite: Fix whitespace

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl-Net-CIDR-Lite: New package.

This is a runtime dependency of the xt_geoip_build perl script
shipped by xtables-addons in version 3.2.

Reference #11960.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPVS: Enable connection tracking by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids-functions.pl: Downloader should reads settings from correct file

In commit ea5c8eeb83a65791960d6cb5de6c7dc78db02fda the taken settings
for the ruleset have been stored into an own file.

The Downloader now uses this file to read-in which ruleset should be used
and downloaded.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Backup conntrackd's configuration file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add initscript for conntrackd

The daemon will be started by default when a configuration
file exists.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix typo in 'html/cgi-bin/logs.cgi/log.dat'

Translation string uses capital letter: 'Captive' => 'Captive Portal',

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>