webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-05-10 01:08:28 +02:00
Code Issues Packages Projects Releases Wiki Activity
15,573 Commits 2 Branches 1 Tag
5b4e33bc3b754dd14ecc279bc421ec232a489507
Commit Graph

7888 Commits

Author SHA1 Message Date
Michael Tremer
4e58ab4bbf aws-functions.pl: Drop file and move functions to general-functions.pl 
There is not enough stuff that it is justified to have an own file.

This patch therefore merges everything into general-functions.pl.

There are no functional changes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2020-06-19 17:14:58 +00:00
Michael Tremer
89b10e7095 gcp: Add initscript to import configuration 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2020-06-19 17:14:58 +00:00
Arne Fitzenreiter
46bccfc219 core146: add openvpn 
openvpn was missed in core145 so add it again.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-16 11:36:20 +00:00
Stefan Schantl
f1d982cce6 Add convert-to-location converter. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-15 18:21:57 +02:00
Stefan Schantl
18c9fd2820 firewall-lib.pl: Fix typo. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-13 19:10:15 +02:00
Arne Fitzenreiter
e9c62e37f4 vulnerabilities.cgi: add srdbs (CVE-2020-0543) 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-13 12:23:46 +02:00
Stefan Schantl
d0faaf61d6 Rootfiles update. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-12 20:01:48 +02:00
Stefan Schantl
006e3c6c31 firewall-lib.pl: Rework code to use location-functions.pl 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-12 19:21:27 +02:00
Stefan Schantl
b1229cf610 50-firewall.menu: Rename geoipblock to locationblock 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-12 19:12:00 +02:00
Stefan Schantl
46269ee5fb Transform geoipblock into locationblock settings file. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-12 19:09:29 +02:00
Stefan Schantl
5730a5bcdf firewall/rules.pl: Rework code to use location-functions.pl 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-12 19:06:01 +02:00
Arne Fitzenreiter
4d43b3dcb1 intel-microcode: update to 20200609 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-12 17:47:29 +02:00
Stefan Schantl
48152fae62 Transform geoip-functions.pl into location-functions.pl 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-12 17:42:41 +02:00
Michael Tremer
c556242efd location: Remove "GeoIP" from crontab 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2020-06-12 16:12:49 +02:00
Arne Fitzenreiter
f3a59d63e2 kernel: update to 4.14.184 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-12 16:04:48 +02:00
Michael Tremer
0e6eca78b8 firewall: Rename GEOIPBLOCK table to LOCATIONBLOCK 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2020-06-12 16:00:34 +02:00
Stefan Schantl
d00923cef8 libloc: Rootfile update. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-11 08:19:07 +02:00
Stefan Schantl
4852f77e33 Revert "firewall/rules.pl: Add code to collect and export all required country" 
This reverts commit ad47d2ae80.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-10 21:29:04 +02:00
Stefan Schantl
38a8d40142 Revert "firewall/rules.pl: Only try to export locations if needed." 
This reverts commit 693b8513df.
 2020-06-10 21:28:16 +02:00
Stefan Schantl
e7b1b002c9 Revert "geoip-functions.pl: Add functions to export locations and to flush them." 
This reverts commit e758c76384.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-10 21:27:06 +02:00
Stefan Schantl
304abbae22 Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-switch-to-libloc 2020-06-10 18:01:14 +02:00
Peter Müller
92e828b3b0 kernel: disable CONFIG_UPROBES 
Quoted from #12433:
> Uprobes is the user-space counterpart to kprobes: they enable instrumentation
> applications (such as 'perf probe') to establish unintrusive probes in
> user-space binaries and libraries, by executing handler functions when the
> probes are hit by user-space applications.
>
> ( These probes come in the form of single-byte breakpoints, managed by the
> kernel and kept transparent to the probed application. )

IMHO this can be safely disabled, as there is little if any need to debug
userspace programs _that_ deeply on an IPFire machine.

Fixes: #12433

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-10 15:18:36 +00:00
Peter Müller
a5e577d083 kernel: enable CONFIG_FORTIFY_SOURCE on armv5tel 
Partially fixes: #12369

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-10 15:17:40 +00:00
Peter Müller
3eb393ff2e kernel: enable CONFIG_FORTIFY_SOUCRE on aarch64 
Partially fixes: #12369

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-10 15:17:24 +00:00
Peter Müller
4ee87ee248 kernel: enable CONFIG_SLUB_DEBUG on aarch64 and armv5tel 
Fixes: #12377

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-10 15:16:57 +00:00
Arne Fitzenreiter
325a2680c8 kernel: fix diabling CONFIG_MODFIFY_LDT_SYSCALL 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-10 16:21:49 +02:00
Arne Fitzenreiter
2b51e4aeab Revert "kernel: enable CONFIG_RANDOMIZE_BASE on aarch64" 
with enabled CONFIG_RAMDOIZE_BASE the linking of xtables
and maybee other external kernel modules fail on aarch64

This reverts commit 8379ab44b8.
 2020-06-10 16:20:34 +02:00
Peter Müller
e694bbd17f kernel: enable CONFIG_RANDOMIZE_BASE on armv5tel 
Partially fixes: #12363

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-09 22:20:26 +00:00
Peter Müller
8379ab44b8 kernel: enable CONFIG_RANDOMIZE_BASE on aarch64 
Partially fixes: #12363

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-09 22:19:50 +00:00
Peter Müller
e4d1f96869 kernel: enable CONFIG_HARDENED_USERCOPY on aarch64 and armv5tel 
Fixes: #12365

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-09 15:37:33 +00:00
Peter Müller
7617da3bba kernel: enable CONFIG_SECCOMP on aarch64 and armv5tel 
Fixes: #12366

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-08 21:22:44 +00:00
Peter Müller
d7174d7c3a kernel: disable CONFIG_ACPI_CUSTOM_METHOD on x86_64 and i586 
This is dangerous as it allows replacing the running kernel without
rebooting. Kernel Self Protection Project people recommend to keep it
disabled.

Fixes: #12372

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-08 21:22:32 +00:00
Peter Müller
b1f24c4353 kernel: disable CONFIG_MODIFY_LDT_SYSCALL on i586 and x86_64 
Fixes: #12382

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-08 21:22:05 +00:00
Stefan Schantl
d2b364f032 red.up: Do not download/update location database. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-08 21:20:17 +02:00
Arne Fitzenreiter
625104ec57 Merge branch 'master' into next 2020-06-04 15:16:39 +00:00
Michael Tremer
405c7326d2 core145: Remove double-added configuration lines for OpenVPN 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-04 15:13:33 +00:00
Arne Fitzenreiter
90c1e763b6 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next 2020-06-04 08:59:28 +02:00
Arne Fitzenreiter
7674247947 start core146 and add the kernel 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-04 08:49:28 +02:00
Arne Fitzenreiter
a43b370411 kernel: update to 4.14.183 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-04 08:37:00 +02:00
Stefan Schantl
51b6f07ce5 geoip-functions.pl: Provide the available locations in upper case. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-03 19:29:55 +02:00
Stefan Schantl
decef80c7e geoip-functions.pl: Remove non existing country codes. 
o1 (Other country) and yu (Yugoslavia) have been used in the past
and are not part of libloc and therefore cannot be used anymore.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2020-06-03 19:15:43 +02:00
Michael Tremer
4963d555f6 core145: Update OpenVPN server configuration only when necessary 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-03 14:46:31 +00:00
Michael Tremer
495613fb35 core145: Update OpenVPN server configuration only when necessary 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-03 14:45:04 +00:00
Arne Fitzenreiter
5b0c35e092 drop xen-inage-builder 
this depends on linux-pae and has failed to boot
since a while.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-02 18:37:22 +02:00
Arne Fitzenreiter
83d5892a86 kernel: drop extra i586-pae kernel 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-02 18:34:44 +02:00
Peter Müller
e6514b3af8 kernel: disable CONFIG_DEBUG_LIST on i586(-pae) 
Fixes: #12378

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-02 11:15:51 +00:00
Peter Müller
4264e41a61 kernel: enable CONFIG_SCHED_STACK_END_CHECK on x86_64, armv5tel and aarch64 
> This option checks for a stack overrun on calls to schedule(). If the stack
> end location is found to be over written always panic as the content of the
> corrupted region can no longer be trusted. This is to ensure no erroneous
> behaviour occurs which could result in data corruption or a sporadic crash at a
> later stage once the region is examined. The runtime overhead introduced is
> minimal.

Fixes: #12376

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-02 11:15:34 +00:00
Peter Müller
c2749c1bed kernel: disable CONFIG_USELIB on x86_64 and i586(-pae) 
> This option enables the uselib syscall a system call used in the dynamic
> linker from libc5 and earlier. glibc does not use this system call. If you
> intend to run programs built on libc5 or earlier you may need to enable this
> syscall. Current systems running glibc can safely disable this.

In my point of view, the last sentence matches our situation.

Fixes: #12379

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-02 11:15:13 +00:00
Peter Müller
b5e1ccaee2 kernel: enable CONFIG_DEBUG_WX on aarch64 
Since this is described as 'Generate a warning if any W+X mappings are
found at boot.', it most likely does not break anything and can be
safely enabled.

Fixes: #12373

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-02 11:14:50 +00:00
Peter Müller
efd508e9f6 kernel: enable page poisoning on x86_64 
This is already active on i586 and prevents information leaks from freed
data.

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2020-06-02 11:14:15 +00:00