Commit Graph

18363 Commits

Author SHA1 Message Date
Stefan Schantl
2acb3c8d00 ids.cgi: Remove accidently commited commented code snipped.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:59 +01:00
Stefan Schantl
bb4c30c653 ids.cgi: Correctly use "enabled" for checked checkboxes.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:59 +01:00
Stefan Schantl
aba3cbe5bc ids.cgi: Read-in providers settings file when neccessary.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:58 +01:00
Stefan Schantl
4c067847c5 ids.cgi: Add code to add/edit a ruleset provider.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:58 +01:00
Stefan Schantl
18fb2dbd5c Update language files.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:58 +01:00
Stefan Schantl
a8d36d3e1f ids-functions.pl: Introduce providers_settings_file.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:58 +01:00
Stefan Schantl
2f252efa0d ids.cgi: Rework rulesetsettings section.
* The page and section now supports multiple ruleset providers at once.
* Adding / Editing a ruleset provider has been moved to a own sub-page.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:58 +01:00
Stefan Schantl
a49a30d1ba ruleset-sources: Fix website details for emergingthreats provider.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:58 +01:00
Stefan Schantl
77351a6b76 ids.cgi: Move configuration of ruleset autoupdate intervall to IDS main
section.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:58 +01:00
Stefan Schantl
87df37da7a ids.cgi: Stop showing ruleset date on customize rulest sub-page.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:22:47 +01:00
Stefan Schantl
4efc8ccd8a ids.cgi: Add "Back" button to customize ruleset sub-page.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
2bbe6ede23 ids.cgi: Move / Splitt main page and customize ruleset subpage.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
a468b62b62 ids.cgi: Only read-in ruleset if neccessary.
This process takes some time, especially on huge rulesets.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
dd2ce333f7 ids.cgi: Add button to customize the ruleset.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
019e5e9baf ids.cgi: Introduce and use get_provider_name() function.
This function is used to grab the name of a provider by the given
handle.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
fed57fe7f0 ids.cgi: Move the section to customize the IDS ruleset to a function.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
1033cf2d0a ids.cgi: Remove unused rulesetsources hashes.
They have been superseeded by the new ruleset sources file.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
4e4c3f1459 ids-functions.pl: Require ruleset-sources file for provider details.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
3e12c6e688 ids.cgi: Make CGI work with new ruleset-sources file.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
70cc13158d ids-functions.pl: Add get_ruleset_providers() function.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
179b75107e ids-functions.pl: Make downloader work with new ruleset-sources file
format.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
5e891296f0 ruleset-sources: Rework file format and data.
The file now contains a lot more of data and easily can be extended
to provide more and new providers.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
41b52755b8 Merge branch 'master' of ssh://git.ipfire.org/pub/git/ipfire-2.x 2021-12-19 13:19:03 +01:00
Peter Müller
5cb56f865d Core Update 163: Ship updated CA certificates
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-19 11:40:17 +01:00
Peter Müller
5556965d50 update ca-certificates CA bundle
Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-19 11:39:54 +01:00
Peter Müller
48834bfa07 Tor: update to 0.4.6.9
Full changelog as per https://gitweb.torproject.org/tor.git/plain/ChangeLog:

Changes in version 0.4.6.9 - 2021-12-15
  This version fixes several bugs from earlier versions of Tor. One important
  piece is the removal of DNS timeout metric from the overload general signal.
  See below for more details.

  o Major bugfixes (relay, overload):
    - Don't make Tor DNS timeout trigger an overload general state.
      These timeouts are different from DNS server timeout. They have to
      be seen as timeout related to UX and not because of a network
      problem. Fixes bug 40527; bugfix on 0.4.6.1-alpha.

  o Minor feature (reproducible build):
    - The repository can now build reproducible tarballs which adds the
      build command "make dist-reprod" for that purpose. Closes
      ticket 26299.

  o Minor features (compilation):
    - Give an error message if trying to build with a version of
      LibreSSL known not to work with Tor. (There's an incompatibility
      with LibreSSL versions 3.2.1 through 3.4.0 inclusive because of
      their incompatibility with OpenSSL 1.1.1's TLSv1.3 APIs.) Closes
      ticket 40511.

  o Minor features (fallbackdir):
    - Regenerate fallback directories generated on December 15, 2021.

  o Minor features (geoip data):
    - Update the geoip files to match the IPFire Location Database, as
      retrieved on 2021/12/15.

  o Minor bugfixes (compilation):
    - Fix our configuration logic to detect whether we had OpenSSL 3:
      previously, our logic was reversed. This has no other effect than
      to change whether we suppress deprecated API warnings. Fixes bug
      40429; bugfix on 0.3.5.13.

  o Minor bugfixes (relay):
    - Reject IPv6-only DirPorts. Our reachability self-test forces
      DirPorts to be IPv4, but our configuration parser allowed them to
      be IPv6-only, which led to an assertion failure. Fixes bug 40494;
      bugfix on 0.4.5.1-alpha.

  o Documentation (man, relay):
    - Missing "OverloadStatistics" in tor.1 manpage. Fixes bug 40504;
      bugfix on 0.4.6.1-alpha.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-19 11:39:27 +01:00
Peter Müller
e19e5722a6 Merge branch 'next' into temp-c163-development 2021-12-17 11:30:41 +01:00
Stefan Schantl
68b5761089 suricata: Do not load rules for dnp3 and modbus.
The parsers for those are disabled in the suricata config so
the rules are not needed, on the contrary they massively will spam
warnings when launching suricate because of the disabled parsers.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-17 08:06:26 +00:00
Stefan Schantl
d088562406 suricata: Do not load rules for dnp3 and modbus.
The parsers for those are disabled in the suricata config so
the rules are not needed, on the contrary they massively will spam
warnings when launching suricate because of the disabled parsers.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-16 20:04:41 +01:00
Stefan Schantl
a52ea4b008 Merge branch 'master' of ssh://git.ipfire.org/pub/git/ipfire-2.x 2021-12-16 20:00:18 +01:00
Peter Müller
bc95a6cc00 Core Update 163: Ship backup.pl
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-14 14:40:58 +01:00
Michael Tremer
45a5df5a5e backup: Fork ISO job into the background in CGI script
In order to be able to run the ISO command on command line it is helpful
that the script does not go into background halfway through the process.

We should rather start it as a background job straight from the CGI
script.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-14 14:39:26 +01:00
Michael Tremer
51ed815f5e backup: Create tarball in one pass
This patch is changing the behaviour of the backup script so that it
creates one tarball and compresses it in one go.

This will save storing the original tarball on disk before compressing
it which on my test system requires significant disk space.

This patch also solves a bug where the backup file included with the ISO
image could not be extracted because it was not gzip-compressed when it
was expected to be.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-14 14:39:21 +01:00
Michael Tremer
d9db91609f backup: Use filename as specified on console
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-14 14:39:17 +01:00
Peter Müller
26d23790c7 Core Update 163: Ship libloc
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-14 10:46:25 +01:00
Peter Müller
b894c8aa56 libloc: Update to 0.9.9
Please refer to https://lists.ipfire.org/pipermail/location/2021-November/000483.html
for this versions' release announcement.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-14 10:45:43 +01:00
Peter Müller
84f9776a8f Core Update 163: Ship and restart Unbound
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-13 12:54:19 +01:00
Matthias Fischer
09b05f200c unbound: Update to 1.14.0
For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-14-0

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-13 12:53:04 +01:00
Peter Müller
d01b47b771 Merge branch 'next' into temp-c163-development
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-13 12:51:26 +01:00
Stefan Schantl
65d5ec52ce suricata: Disable sid 2210059.
This rule emits a massive logspam and temporary will be disabled until
a better solution is found.

Fixes #12738.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:51:24 +00:00
Stefan Schantl
f23e0e5a7f suricata: Cleanup default loaded rules file.
There are no such rules file available and therefore cannot be loaded.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:49:41 +00:00
Stefan Schantl
74070fe153 suricata: Move default loaded rulefiles to own included file.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:49:22 +00:00
Adolf Belka
3b1482e939 pcengines-apu-firmware: Update to version 4.15.0.1
- Update from 4.14.0.4 to 4.15.0.1
- Update of rootfile
- Changelog
    v4.15.0.1
        rebased with official coreboot repository commit 6973a3e7
    v4.14.0.6
        rebased with official coreboot repository commit d06c0917
        Re-added GPIO bindings to fix LED and button functionality
    v4.14.0.5
        rebased with official coreboot repository commit d4c55353
        Updated CPU declarations in ACPI to comply with newer ACPI standard
        Removed GPIO bindings to fix conflict with OS drivers

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:46:12 +00:00
Jon Murphy
ccf19569ab manualpages: Complete the list of user manual pages
Jon Murphy gathered all the links and made the updated file
available on the mailing list:
https://lists.ipfire.org/pipermail/development/2021-October/011383.html
https://lists.ipfire.org/pipermail/development/2021-December/011737.html

With kind permission from him, this patch contains the completed list.
The list was successfully checked with "./make.sh check-manualpages".

Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Reported-by: Jon Murphy <jcmurphy26@gmail.com>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:45:27 +00:00
Peter Müller
3a5b2f68ec Core Update 163: Ship pango, harfbuzz and fribidi
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-09 21:08:54 +01:00
Adolf Belka
4fdddd30dd fribidi: New dependency for pango
- v3 version uses newer version of fribidi
- lfs file created
- rootfile created

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-09 21:08:10 +01:00
Adolf Belka
295985c800 harfbuzz: New dependency for pango
- v3 version has newer harfbuzz version
- lfs file created
- rootfile created

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-09 21:08:06 +01:00
Adolf Belka
0de1daf3bb pango: Update to version 1.50.0
- v3 version has updated pango version
- Update from 1.30.1 (2012) to 1.50.0 (2021)
- Update of rootfile - Pango modules, engines, and config have been removed (#733882) in
   version 1.37.0 in 2014.
- pango now has dependencies of harfbuzz and fribidi so patches for these two are
   included in the following two patches for this series.
- make.sh modified to include
   build of these two packages before pango is built
- Build is done via meson/ninja now
- Changelog is too large to show here but the details can be found in the NEWS file in
   the source tarball.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-09 21:08:00 +01:00
Adolf Belka
f481a92f8d pcengines-apu-firmware: Update to version 4.15.0.1
- Update from 4.14.0.4 to 4.15.0.1
- Update of rootfile
- Changelog
    v4.15.0.1
        rebased with official coreboot repository commit 6973a3e7
    v4.14.0.6
        rebased with official coreboot repository commit d06c0917
        Re-added GPIO bindings to fix LED and button functionality
    v4.14.0.5
        rebased with official coreboot repository commit d4c55353
        Updated CPU declarations in ACPI to comply with newer ACPI standard
        Removed GPIO bindings to fix conflict with OS drivers

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-12-09 21:06:33 +01:00
Michael Tremer
2b676f2e42 findutils: Create /var/lib/locate
This is required for updatedb to store its data.

Fixes: #12670
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2021-12-09 21:04:50 +01:00