core124: Ship updated rng-tools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rng-tools: Update to 6.4

Also add a patch that keeps RDRAND enabled on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes: #11853

logs.cgi/ids.dat: Dont display/export empty events.

Check if the current processed event has at least datetime and a title.
Otherwise skip it.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

logs.cgi/ids.dat: Ease list of reported events

Just ease the strict layout by adding a simple line break.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

logs.cgi/ids.dat: Adjust code to show suricata events

As default show the events generated by suricata and if
for a certain selected date no suricata log is available
try to fall-back to read the events from the old snort
alert files (if available).

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

aws: Don't update the system on first boot

This will violate AWS policy and therefore had to be removed.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Hide rules config section if no rules a present

Do not show the rules config section anymore if there is not
ruleset available.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Enable threshold file in suricata.yaml

Enable and specify the path to the threshold-file in the suricata.yaml,
otherwise the programm is trying to read it from a build-in default
location and prints the following error message:

Error opening file: "/etc/suricata//threshold.config": No such file or directory

Fixes #11837.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Add files to be backuped

Now all oinkmaster related config files and suricata
related yaml files in "/var/ipfire/suricata/" will be
included into the backups.

Also the entire ruleset is part of the backup, so after a
backup has been restored, the IDS can be used in the same way
as before.

Fixes #11835.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Rule files are now located in /var/lib/suricata

Place the rulefiles from now in "/var/lib/suricata".

Fixes #11834

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Do not ship an example configuration file

Stop shipping a full example configuration file for suricata.

Fixes #11836.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Create file for used rulefiles on first execution if not present

Create this file on first execution of the script if it does not exist yet.
This will allow suricata to imediately be started. Otherwise the ruleset has
to be downloaded and configured before this file has been created and suricata
could be launched.

Fixes #11833.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Fix get_memory_usage()

Change the get_memory_usage() function to grab and return the
memory usage of the entire process, containing all sub-processes and
threads.

Fixes #11821

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'master' into next

kernel: fix dtb handling

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ids-functions.pl: Early abort downloadruleset() if no ruleset is configured

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core124: Ship latest pakfire changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Remove any reference to counter.py

The concept has been retired a very log time ago
and the web service only responds with 200 what ever
it is being sent.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Remove mirror health check

This is not really necessary because pakfire will automatically
failover to the next mirror anyways and that a mirror responds
to an ICMP echo request doesn't necessarily mean that it can
deliver the requested file.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids-functions.pl: Also check and fix the permissions of rulespath

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Fix rootfile

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'core123' of git.ipfire.org:/pub/git/ipfire-2.x into core123

intel-microcode: update to 20180807a

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

lfs/suricata: Move classification and reference config to /etc/suricata/rules

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add priviate function _check_rulesdir_permissions()

This function checks if all files located in /etc/suricata/rules are
writable by the effective user and group (nobody:nobody) and if not
calls suricatactl to fix it.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricatactrl: Add fix-rules-dir command

This command is used to set the ownership and permissions
back to nobody:nobdoy which is used by the WUI to write the
ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricatactrl: Add reload command

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata.yaml: Start moving to IPFire specific configuration

Remove a lot of stuff and options which are deactivated during compiling,
unsupported by the plattform or not used in IPFire.

Add an advice to the full documented suricata-example.yaml file which also
is shipped by IPFire.

More work needs to be done.

See #11808

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core124: Ship updated ntp package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ntp: Update to 4.2.8p12

For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated fwhosts.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11825: firewall: Renaming a network/host group doesn't update rules

Code only changed field 6 of hash (target group) and not field 4 (source group).
Also if using geoip it was only field 4 of hash (source group) and not field 6 of hash (target group)
Added new code that changes both fields to reflect the change in the firewallrules immediately.

fixes: #11825

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata.yaml: Adjust classification and reference config location

Both files are included in the various rulesets, therefore use them
from the rules folder.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata.yaml: Fix include statement for homenet file

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Fix initscript when using a single core machine

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Create oinkmaster related files at first call

With this commit, the CGI file will create the oinkmaster related
files during first run if they does not exist.

Fixes #11822.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add function to create empty files

This generic function can be used to create any kind of emtpy files -
it just requires the full path and filename to work.

If the specified file exists at calltime, the function will abort
to prevent from overwriting existing files and content.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IPsec: Show connected status for waiting connections that are active

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

setup: Don't write any mount errors over the GUI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

localnet: Set FQDN without using domainname command

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix merge conflicts during merge of next and the suricata branch

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

core124: Ship updated firewall.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11805: Firewall rule with source orange and target firewall-interface-orange not possible

Now its possible to create a rule with orange source and target orange interface of the firewall.

Fixes: #11805
Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Fix typo in rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated AWS setup scripts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop the network-trigger script

This is done at boot time and doesn't normally need to be done again.

On AWS or in the setup, renaming any network interfaces is being
handled automatically.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firstsetup: There is no need to restart udev here

All network interfaces are renamed accordingly in setup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Let udev rename all network interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

oinkmaster: Ship IPFire specific config file

Ship an IPFire specific configuration file for oinkmaster.

This allows oinkmaster to do all the great rule modifications which
have been introduced by the new ids.cgi file.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Rework handling of enabled/disabled sids

Now the enabled or disabled sids are stored in a single
hash instead of two arrays, which easily can be modified.

When saving the ruleset, the new read_enabled_disabled_sids() function
will be used to read-in the current (old) saved enabled or disabled sids
and add them to the new hash structure.

After adding or modifiying sids to the hash, the entries will be written
to the corresponding files.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Add function to read the enabled/disabled sid files

This function is used to read-in the files for enabled or disabled sid
files and stores the sid and their state into a temporary hash which will
be returned by the function.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

nano: Update to 2.9.8

For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Fix check if the IDS is running

The correct function name is ids_is_running()!

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core124: Ship updated backup include/exclude files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Add root's SSH keys and settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Add custom squid configuration files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Order incldue/exclude alphabetically

Nothing has been added or removed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: x86_64 add libspp to rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core123: ship libssp (was missing on x86_64)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

gcc: x86_64 add libspp to rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ids.cgi: Add backend code to handle switch between IDS and IPS mode

This commit adds the required backend code to allow switching
between IDS and IPS mode of suricata.

Technically the behaviour of suricata is specified by the rules -
each of them can contain the action "alert" or "drop" (There are
more actions supported but these two are currently the important one)

When running in IDS mode, the ruleset does not need to be touched,
because the default action is "alert". When switching to IPS mode,
the CGI writes a single line to "oinkmaster-modify-sids.conf" which
is included by oinkmaster and modify the action for each single rule
from alert to drop.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Allow to switch between IDS/IPS mode

Add the option to select the runmode for suricata, wheater it
should run in intrusion detection mode or intrusion prevention mode.

If the option has not configured yet, it defaults to IPS mode.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Display error if oinkmaster cannot be executed

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core123: ship xtables-addons.

xtables are build for installed iptables version so we need
to ship it even if it was not updated.
Also clean /lib/xtables because some modules are renamed.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ids-functions.pl: Log correct error message if download fails

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Fix detection of enabled IDS on zone in initscript

I accidently commited the wrong file in the previous commit.
This is the fixed and working version.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Give 644 permissions to the suricata pidfile

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ruleset-sources: Move to suricata optimized ruleset when using emerginthreads.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core123: ship openssl sse2 version on i586

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bind: Update to 9.11.4-P1

Fixes CVE-2018-5740 and CVE-2018-5738.

For details see:
http://ftp.isc.org/isc/bind9/9.11.4-P1/RELEASE-NOTES-bind-9.11.4-P1.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated pciutils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pciutils: update to 3.5.6

The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated ids.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

download ET IDS rules via HTTPS

The Emerging Threats ruleset server supports HTTPS. It should
be used for downloading the ruleset in IPFire, too.

This also needs to be applied on the upcoming ids.cgi file for Suricata
which I will do in a second patch.

The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.3.1

This updates Postfix to recent 3.3.x series, which contains
some new features. Release announcement available at
http://www.postfix.org/announcements/postfix-3.3.1.html

The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Add code to create iptables rules to the initscript

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

firewall: Add chains for IPS (suricata)

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

core124: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.4

For details see:
http://ftp.isc.org/isc/bind9/9.11.4/RELEASE-NOTES-bind-9.11.4.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Don't re-generate the initrd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Re-install bootloader during update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship EFI changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/efi' into next

core124: Ship update localnet init script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 124

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

localnet: Properly format and quote variables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

localnet: Correctly set domain name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: ship updated unbound initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

aws: Hide pakfire update output

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Write user-data log to file only

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Execute reboot when an update requires one

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix typo in unbound initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Set PATH to search in /usr/local/(s)bin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Import pakfire keys before the first launch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Log output of user-data script to /root/user-data.log

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: ship updated logs.cgi/ids.dat

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

aws: Install all available updates first

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Setup DNS during init phase

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: set pakfire version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>