Commit Graph

15366 Commits

Author SHA1 Message Date
Michael Tremer
0f2d70a313 core153: Ship bash
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-03 10:39:08 +00:00
Peter Müller
987826deb1 Bash: apply patches 12 through 18 as well
Those fix some unintentional behaviour regarding autocompletion I
stumbled across the other day. While there seems nothing security
relevant in this, it irons out a few bugs.

The full and up-to-date list of all Bash 5.0 patches can be obtained
from https://ftp.gnu.org/gnu/bash/bash-5.0-patches/ .

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-03 10:38:25 +00:00
Michael Tremer
1b2ddfa449 core153: Ship hwdata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-03 10:37:56 +00:00
Peter Müller
3e2668dcfa hwdata: update PCI/USB databases
PCI IDs: 2020-10-25 03:15:01
USB IDs: 2020-08-26 20:34:09

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-03 10:37:01 +00:00
Arne Fitzenreiter
58b374c255 samba: remove pid at killproc in initscript
sometime a stale nmbd or smbd process prevent start of samba.
this change should kill all processes.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-11-03 10:36:59 +00:00
Michael Tremer
9c6fd77927 core153: Ship libarchive
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 16:29:39 +00:00
Michael Tremer
62efd2e9d2 libarchive: Ship on core system
Some tools link against this

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 16:29:02 +00:00
Michael Tremer
7f5d63c9e6 core153: Ship usb_modeswitch
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 15:20:33 +00:00
Ramax Lo
5cbc22ffa6 usb_modeswitch_data: update to 20191128
Signed-off-by: Ramax Lo <ramaxlo@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 15:18:04 +00:00
Ramax Lo
588f1223f2 usb_modeswitch: update to 2.6.1
Signed-off-by: Ramax Lo <ramaxlo@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 15:18:01 +00:00
Michael Tremer
9d29a52d7d core153: Ship NTP changes
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 15:11:05 +00:00
Michael Tremer
ef7b7b1af8 ntp: Allow CLI tools to talk to ntpd
Fixes: #12518
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 15:09:50 +00:00
Michael Tremer
d941effbcf ntp: Make /etc/ntp owned by root
This is required for ntpd being able to write its own drift file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 15:08:55 +00:00
Michael Tremer
4e49d67990 ntp: Move configuration into an own file
We should not write files like that in the LFS scripts.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-30 15:08:44 +00:00
Arne Fitzenreiter
e1f7cc9077 samba: update to 4.13.1
This is a security release in order to address
CVE-2020-14318 (Missing handle permissions check in SMB1/2/3 ChangeNotify),
CVE-2020-14323 (Unprivileged user can crash winbind) and
CVE-2020-14383 (An authenticated user can crash the DCE/RPC DNS with easily
crafted records).

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2020-10-30 07:35:23 +01:00
Michael Tremer
ae432a5f39 core153: Ship language files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-29 13:49:40 +00:00
Stefan Schantl
66970ccba3 suricata: Proper use confgured LDFLAGS.
Fixes #12513.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-29 11:30:23 +00:00
Stéphane Pautrel
5e1579023a Update French translation
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-29 10:38:09 +00:00
Michael Tremer
af94be24fe core153: Ship logwatch
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-28 11:55:48 +00:00
Matthias Fischer
5e11ef0f67 logwatch: Added upstream patch for Bug #12242
Added upstream patch from:

https://sourceforge.net/p/logwatch/mailman/message/37106642/

and

https://sourceforge.net/p/logwatch/mailman/message/37106883/

Fixes the display of "Unknown Entries: reuse_lease: ... " in dhpcd-logs.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-28 11:55:16 +00:00
Michael Tremer
8a2105b284 core153: Ship updated index.cgi and vpnmain.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 18:38:35 +00:00
Michael Tremer
1f3f2d676e IPsec: Fix showing tunnels as connecting when they are established
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 18:38:03 +00:00
Michael Tremer
aa81aaf836 suricata: Link against libatomic on armv5tel
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 18:22:05 +00:00
Peter Müller
7e5045312c make.sh: no longer build Amavis, SpamAssassin and perl-Net-LibIDN
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:58:54 +00:00
Peter Müller
4ea6112ff0 drop perl-Net-LibIDN
This add-on was solely needed as a dependency for Amavis and is
therefore no longer needed.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:58:44 +00:00
Peter Müller
3e19f681a1 drop SpamAssassin add-on
This package has not been maintained well and is thereof outdated. At
the time of writing, we neither
(a) have a maintainer for this nor
(b) believe it is wise to run a full-featured content scanner on a
    firewall for security purposes. (We can make do with Postfix, as it
    is known for being a very robust MTA and providess less attack
    surface than something actually inspecting transferred messages.)

Thereof, this patch drops the SpamAssassin add-on. In case it is desired
in future versions of IPFire, it can be easily reverted, restoring the
functionality and behaviour before.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:58:35 +00:00
Peter Müller
6483ec30b9 drop Amavis add-on
This package has not been maintained well and is thereof outdated. At
the time of writing, we neither
(a) have a maintainer for this nor
(b) believe it is wise to run a full-featured content scanner on a
    firewall for security purposes. (We can make do with Postfix, as it
    is known for being a very robust MTA and providess less attack
    surface than something actually inspecting transferred messages.)

Thereof, this patch drops the Amavis add-on. In case it is desired in
future versions of IPFire, it can be easily reverted, restoring the
functionality and behaviour before.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:58:20 +00:00
Michael Tremer
13cbb92ad4 hostapd: Allow to make Management Frame Protection optional
WPA3 mandates MFP, but many clients do not support it at all.

Therefore this can now be set to optional and clients will
fall back to WPA2.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:56:30 +00:00
Michael Tremer
75f3182a39 hostapd: Bump package version
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:56:00 +00:00
Michael Tremer
4744e4f00a hostapd: Import default configuration from hostapd 2.9
This change removes a couple of removed options and adds
new ones. Notable changes are:

* Enable SAE (for WPA3)
* Enable Airtime Policy
* Enable Client Taxonomy
* Enable using the new getrandom() syscall
* Enable using epoll instead of select

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:55:59 +00:00
Michael Tremer
f832c7581f hostapd: Add WPA3 authentication to the web UI
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:55:57 +00:00
Michael Tremer
c472a30f30 core153: Ship suricata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:52:48 +00:00
Stefan Schantl
aa90ed9c20 ruleset-sources: Update snort dl urls.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:51:05 +00:00
Stefan Schantl
0937bd9c01 suricata: Automatically enable JA3 fingerprinting.
Enable JA3 fingerprinting if any rules are enabled which are using this
kind of feature.

Fixes #12507.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:51:00 +00:00
Stefan Schantl
0cdb151831 suricata: Update to 6.0.0.
* Enable RDP and SIP parsers.
* Enable new introduced parsers for RFB and DCERPC.

Because HTTP2 support and parser currently is experimental the suricata
developers decided to disable it at default - we keep this default
setting for now.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:50:56 +00:00
Michael Tremer
150378eae9 Start Core Update 153
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:50:10 +00:00
Michael Tremer
74fd04c335 samba: Bump package release
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:44:34 +00:00
Michael Tremer
a63fe65a2f samba: Make changing shares taking effect immediately
The action was performed after the table has already been
rendered which required reloading the page to show a new
share.

This has now been moved to the top so that new changes
will be shown immediately.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-27 11:37:03 +00:00
Peter Müller
ed3ed3d723 mtr: update to 0.94
Complete changelog since version 0.93:

V0.94
   Aaron Lipinski (10):
         gtk_menu_append -> gtk_menu_shell_append
         GTK_OBJECT -> G_OBJECT
         gtk_button_new_from_stock -> gtk_button_new_with_label
         gtk3
         hbox/vbox -> gtk_box_new
         gtk_menu_popup -> gtk_menu_popup_at_pointer
         show resolved hostname in raw dnsline
         rely on final return NULL
         introduce libasan
         avoid stack use after scope

   Alejandro Leal (2):
         few updates to manual page and README.md
         Updating some comments

   Chongyu Zhu (1):
         probe: fix find_source_addr

   Konrad Bucheli (1):
         fix segmentation fault if there is no IP address on an interface (fixes #320)

   Kulemin Alexander (1):
         report: json: reworked with libjansson

   Mark Egan-Fuller (1):
         Add display of destination.

   Markus Kötter (6):
         simplification - remove sockaddrtop
         simplification - remove addrcpy
         simplification - remove rsa{4,6}
         simplification - address addrcmp
         simplification - improve readability
         ip6 udp - fix probes with local or remote port

   R.E. Wolff (29):
         fix warning on recent compilers.
         Merge branch 'master' of github.com:traviscross/mtr
         net find local address fix by meingtsla
         proposed patch for bsd compile error
         fix closing brace
         Added include errno --obouizi
         Merge branch 'master' of github.com:traviscross/mtr
         More compilation warning fixes from obouizi
         Added extra help text to configure --yvs
         Changed MAXPATH to MAX_PATH for AIX compatibility. -- aixtools
         make the code for gtk2/3 a bit nicer.
         Merge branch 'gtk3_with_fallback' of https://github.com/krisl/mtr
         Merge branch 'master' of github.com:traviscross/mtr
         in hindsight my previous patch wasn't so nice. And nobody told me.

   Sean Wei (1):
         Fix parameter in ui/net.c

   Siyuan Miao (1):
         show mpls information in raw output

   atib (1):
         Added code to print multiple addresses regitered on the same hop count

   atibdialpad (2):
         Change TTL dynamically to adjust for path changes
         TODO list changes

   meingtsla (2):
         asn_{open,close}: Always initialize ipinfo hash table
         Merge branch 'master' of https://github.com/traviscross/mtr into asn-open-always-hcreate

In addition, the "bootstrap.sh" script no longer exists and has
therefore been removed from the LFS file.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 17:27:58 +00:00
Peter Müller
ffad9c5560 Tor: update to 0.4.4.5
Please refer to
https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.4.5 for
the changelog of this release.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 17:20:11 +00:00
Michael Tremer
d4afeb5250 core152: Ship CA certificates
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 15:52:18 +00:00
Peter Müller
b3d8161b88 update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 15:51:54 +00:00
Michael Tremer
82e2a565bb Update credits.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 10:08:07 +00:00
Michael Tremer
21b4b0c78b Update languages
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 10:07:37 +00:00
Leo-Andres Hofmann
c27b8825be Improve DHCP dynamic leases list usability. Active and expired leases are now grouped and the list is divided by a horizontal line. Sorting and creating static leases remains unchanged.
Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 10:07:08 +00:00
Leo-Andres Hofmann
934a376918 Improve indentation and HTML output of PrintActualLeases & leasesort
Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-23 10:07:03 +00:00
Michael Tremer
449b1aeea7 core152: Ship proxy.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-19 09:26:17 +00:00
Steffen Klammer
badd010f86 modified proxy.cgi to make it possible that all subnets declared in "network access control" will be translated from cidr to subnet notation in proxy.pac
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-19 09:25:53 +00:00
Michael Tremer
7ad39d931a core152: Ship suricata
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-15 15:35:13 +00:00
Stefan Schantl
97fbbaa333 suricata: Update to 5.0.4
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-10-15 15:34:39 +00:00