Commit Graph

13381 Commits

Author SHA1 Message Date
Michael Tremer
f33d28978d unbound: Use correct parameter for IP addresses and hostnames
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-19 21:00:21 +01:00
Michael Tremer
cb8a25e5ec DNS Forwarding: Let UI accept hostnames, too
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-19 20:47:41 +01:00
Michael Tremer
1a26564e95 DNS Forwarding: Allow passing multiple name servers (separated by comma)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-19 20:42:46 +01:00
Michael Tremer
c9ae511ecf unbound: Allow forwarding to multiple servers at the same time
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-19 20:23:59 +01:00
Michael Tremer
086bb132ec ipvsadm: Update to 1.29
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-19 18:55:23 +00:00
Michael Tremer
4af8d6964b pcre: Enable JIT
This is now possible because we no longer run grsecurity-enabled
kernels. The performance of PCRE increases dramatically and applications
like the IDS benefit hugely:

  https://blog.inliniac.net/2011/10/12/suricata-and-pcre-performance/

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-19 15:44:32 +00:00
Jonatan Schlag
909549b1d6 Update libvirt to version 4.10
This partially fixes #11941 as libvirt now states clearly that seccomp
needs to be disabled

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-18 22:33:07 +00:00
Michael Tremer
452e537092 core127: Ship updated squid
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-18 22:32:07 +00:00
Matthias Fischer
a2bcb4135b squid: Update to 4.4 (stable)
For details see:
http://www.squid-cache.org/Versions/v4/changesets/

In July 2018, 'squid 4' was "released for production use", see:
https://wiki.squid-cache.org/Squid-4

"The features have been set and large code changes are reserved for later versions."

I've tested almost all 4.x-versions and patch series before with good results.
Right now, 4.4 is running here with no seen problems together with
'squidclamav', 'squidguard' and 'privoxy'.

I too would declare this version stable.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-18 22:30:51 +00:00
erik.kapfer
27801da089 unbound: Add TFO support for unbound
For further informations, see https://tools.ietf.org/html/rfc7413

Signed-off-by: erik.kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-18 22:30:39 +00:00
Matthias Fischer
cab2314ac4 bind: Update to 9.11.5-P1
For details see:
http://ftp.isc.org/isc/bind9/9.11.5-P1/RELEASE-NOTES-bind-9.11.5-P1.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-18 22:29:39 +00:00
Michael Tremer
a38eb040bf sqlite: Update to 3.26.0
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-18 22:28:59 +00:00
Stefan Schantl
8353c3fd36 ids.cgi: Allways use the whitelist
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-18 15:19:30 +01:00
Stefan Schantl
25b6545a6e ids-functions.pl: Use temporary file in downloader.
Download the requested rules tarball into a temporay file
and if every thing is fine, replace the old by the
downloaded one.

In addition with the previously implemented file size check,
we are saved now from a corrupt rules tarball on disk.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-18 15:14:08 +01:00
Stefan Schantl
96da5803a7 ids-functions.pl: Introduce filesize check for downloader
The downloader now requests the html header for the rulestarball
and obtain the size of the file bevore downloading it.

After success the size of the downloaded file will be compared with
the requested one before. If they do not match, an error will be gained.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-18 14:16:13 +01:00
Stefan Schantl
1201c1e746 ids-functions.pl: Fix sub _cleanup_rulesdir() function
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-18 14:12:52 +01:00
Stefan Schantl
f5ad510e3c suricata: Use "2" as repeat-mark and repeat-mask.
The previous used "1" was already used to mark source-natted
packets.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-17 15:04:48 +01:00
Stefan Schantl
208cb3363f suricata: Update to 4.0.6
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-17 15:03:10 +01:00
Michael Tremer
57c04aa49d Revert "make.sh: Build in ramdisk"
This reverts commit 6174b7b1c7.

This had absolutely no effect on build time or rather made it
slower. So this is being reverted to save ourselves the RAM.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-16 22:23:50 +00:00
Michael Tremer
6174b7b1c7 make.sh: Build in ramdisk
This is an experimental change that I want to trial to speed up
the nightly builds. The build environment will be mounted in a
ramdisk and the build will be performed in there.

This will hopefully reduce IO on the (slow) replicated disks.

If there is no significant performance gain from this, this
commit will be reverted.

To enable this, USE_RAMDISK must be set to 1 in .config.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-16 16:50:13 +00:00
Matthias Fischer
53ac9dd222 unbound: Update to 1.8.3
For details see:
https://nlnetlabs.nl/svn/unbound/tags/release-1.8.3/doc/Changelog

"Fix dns64 allocation in wrong region for returned internal queries."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-13 13:14:35 +00:00
Michael Tremer
edff2bb851 core127: Ship updated grub
It doesn't need to be re-installed because no system with
that configuration should exist right now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-13 13:11:01 +00:00
Stefan Schantl
848ac69009 grub: xfs: Accept filesystem with sparse inodes
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Tested-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-13 13:07:53 +00:00
Michael Tremer
81e1e80e38 AWS: Prefer red* or eth* when importing configuration
This change is necessary to make sure that the script prefers
are link with internet access. That would usually be red (after
the second boot) or eth* (on the first boot).

That allows (and ensures) that we can install packages in
the user-data script.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-12 11:36:44 +00:00
Stefan Schantl
a13ddf04d9 Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-12 09:27:59 +01:00
Michael Tremer
58e840bd96 installer: Intialize part_boot_efi_idx
This variable was not initialized on systems where EFI was not
in use. Therefore the generated parted command line was not
valid and caused the installation to abort.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-11 20:43:24 +00:00
Michael Tremer
de4f303186 core127: Ship updated unbound
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-11 19:46:10 +00:00
Matthias Fischer
707846392e unbound: Update to 1.8.2
For details see:
https://nlnetlabs.nl/projects/unbound/download/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-11 19:45:28 +00:00
Matthias Fischer
5df66de303 clamav: Update to 0.101.0
For details see:
https://blog.clamav.net/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-11 19:42:22 +00:00
Michael Tremer
8b02a92fe7 core127: Ship updated fireinfo
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-11 19:41:31 +00:00
Michael Tremer
66f7b646cd Start Core Update 127
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-11 19:41:09 +00:00
Michael Tremer
7e17de5f86 fireinfo: Add authentication for upstream proxies
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-11 19:38:21 +00:00
Arne Fitzenreiter
adde1ca8ce Merge branch 'master' into next 2018-12-11 08:01:59 +01:00
Arne Fitzenreiter
ed4bbe44d1 kernel: fix dwc2 (usb) dma crashes on RPi1-3
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-10 20:45:54 +01:00
Michael Tremer
c519be4226 haproxy: Create/restore backup when package is installed/uninstalled
Fixes: #11946
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-10 00:36:04 +00:00
Arne Fitzenreiter
ede4314397 core126: finish core126
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-08 17:47:16 +01:00
Arne Fitzenreiter
c030bfba2e core126: fix "need reboot display"
The display should displayed always except the linux-pae
packages is planned to be installed after this update.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-07 21:16:43 +01:00
Arne Fitzenreiter
d05fe8e3e5 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next 2018-12-07 21:06:45 +01:00
Arne Fitzenreiter
23a3aec100 cpufrequtils: update initskript for xz compressed modules
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-07 21:05:50 +01:00
Michael Tremer
f354601bbe initscripts: Import pakfire keys before importing AWS configuration
This is useful when the user-data script is installing
packages. For that it will need valid keys for course.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-07 11:38:55 +00:00
Arne Fitzenreiter
56726ed954 rngd: update initskript and add hwrngtty support
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-06 22:33:05 +01:00
Arne Fitzenreiter
8d638b63f8 core126: add kernel files to update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-06 16:05:31 +01:00
Arne Fitzenreiter
19f37f2493 core126: add kernel to updater
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-06 11:27:46 +01:00
Arne Fitzenreiter
827dd0faa4 kernel: update to 4.14.86
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-06 11:18:37 +01:00
Michael Tremer
93363446e4 AWS: Add a timestamp to user-data.log
This way, multiple (failed) runs of the script won't
overwrite the log file.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-05 14:42:54 +00:00
Michael Tremer
1022b203ad AWS: Write user-data.log to /var/log
This should not be in /root at all.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-05 14:38:28 +00:00
Michael Tremer
87487585c0 make.sh: Build for x86_64 by default
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-02 10:23:15 +00:00
Arne Fitzenreiter
91e08f20ff kernel: update to 4.14.85
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-12-02 00:01:37 +01:00
Michael Tremer
e0986954d4 bird: Launch service on install and add symlinks to start at boot time
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-01 16:13:25 +00:00
Michael Tremer
a4e3a76af9 bird: Add initscript
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-12-01 16:13:25 +00:00