Commit Graph

8967 Commits

Author SHA1 Message Date
Stefan Schantl
4e4c3f1459 ids-functions.pl: Require ruleset-sources file for provider details.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
70cc13158d ids-functions.pl: Add get_ruleset_providers() function.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
179b75107e ids-functions.pl: Make downloader work with new ruleset-sources file
format.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
5e891296f0 ruleset-sources: Rework file format and data.
The file now contains a lot more of data and easily can be extended
to provide more and new providers.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-19 13:21:51 +01:00
Stefan Schantl
d088562406 suricata: Do not load rules for dnp3 and modbus.
The parsers for those are disabled in the suricata config so
the rules are not needed, on the contrary they massively will spam
warnings when launching suricate because of the disabled parsers.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2021-12-16 20:04:41 +01:00
Stefan Schantl
f23e0e5a7f suricata: Cleanup default loaded rules file.
There are no such rules file available and therefore cannot be loaded.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:49:41 +00:00
Stefan Schantl
74070fe153 suricata: Move default loaded rulefiles to own included file.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:49:22 +00:00
Adolf Belka
3b1482e939 pcengines-apu-firmware: Update to version 4.15.0.1
- Update from 4.14.0.4 to 4.15.0.1
- Update of rootfile
- Changelog
    v4.15.0.1
        rebased with official coreboot repository commit 6973a3e7
    v4.14.0.6
        rebased with official coreboot repository commit d06c0917
        Re-added GPIO bindings to fix LED and button functionality
    v4.14.0.5
        rebased with official coreboot repository commit d4c55353
        Updated CPU declarations in ACPI to comply with newer ACPI standard
        Removed GPIO bindings to fix conflict with OS drivers

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:46:12 +00:00
Jon Murphy
ccf19569ab manualpages: Complete the list of user manual pages
Jon Murphy gathered all the links and made the updated file
available on the mailing list:
https://lists.ipfire.org/pipermail/development/2021-October/011383.html
https://lists.ipfire.org/pipermail/development/2021-December/011737.html

With kind permission from him, this patch contains the completed list.
The list was successfully checked with "./make.sh check-manualpages".

Signed-off-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
Reported-by: Jon Murphy <jcmurphy26@gmail.com>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-11 09:45:27 +00:00
Arne Fitzenreiter
65067248d1 kernel: update to 5.15.6
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-12-02 11:34:38 +01:00
Arne Fitzenreiter
b7cf050eeb core162: add systctl.conf to updater
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-30 09:58:27 +01:00
Arne Fitzenreiter
ffd857d098 sysctl: kernel 5.13 has removed some scheduler variables.
sched_min_granularity_ns and sched_migration_cost_ns are not
available for sysctl anymore. They can only altered via debugfs
if scheduler debugging is enabled.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-30 09:50:38 +01:00
Arne Fitzenreiter
5a7f7dd587 issue/motd: add architecture warning also to console and ssh logins.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-30 09:35:19 +01:00
Arne Fitzenreiter
616de7524f core162: add index.cgi
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-30 09:34:20 +01:00
Arne Fitzenreiter
ef972dcf7a kernel: update arm config and rootfile (oldconfig)
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-29 09:14:33 +00:00
Arne Fitzenreiter
b6ddee66fc core162: add rpi-firmware
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-27 14:24:18 +00:00
Arne Fitzenreiter
ee3da7ef37 rpi-firmware: update to 20211127
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-27 14:21:31 +00:00
Arne Fitzenreiter
4f6ef73542 cfgroot: install manualpages file
this fix the 500 internal server error becuase this file
was not installed by the patch that add the wiki links.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-25 23:57:28 +01:00
Arne Fitzenreiter
c6e9069099 suricata: rootfile update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-24 19:09:01 +00:00
Peter Müller
53055098f2 libseccomp: Update to 2.5.3
Release annnouncement as per https://github.com/seccomp/libseccomp/releases/tag/v2.5.3:

    Version 2.5.3 - November 5, 2021
        Update the syscall table for Linux v5.15
        Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2
        Document that seccomp_rule_add() may return -EACCES
        Fix issues with test 11-basic-basic_errors on old kernels (API level < 5)

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 14:05:55 +00:00
Peter Müller
a1484cc31a Core Update 162: Ship ddns
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 10:02:33 +00:00
Peter Müller
a2b127c3e1 Core Update 162: Ship and restart OpenVPN
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 10:01:21 +00:00
Peter Müller
20371c8294 Core Update 162: Remove jwhois, ship currently maintained whois client
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:58:23 +00:00
Adolf Belka
30edf752e2 jwhois: Remove jwhois and all associated patches
- jwhois being replaced with whois
- Removal of jwhois lfs, rootfile and assoicated patch files.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:51:17 +00:00
Adolf Belka
c56eb6cbef whois: Installation of aan actively maintained whois client
- This whois client is being actively maintained. This version 5.5.10 was released on
   June 6th 2021 and regular updates have been ocurring several times per year.
- This client has all of its default whois servers compiled into it. These can be seen
   by reading the source files in the tarball.
- Therefore the whois.conf file is available for any additional servers that are decided
   to be required but as provided is empty.
- Installed on a vm testbed and worked to identify the details of ip addresses. Selecting
   an IP in the WUI logs screen also gets the ip information provided so it is working
   well with the WUI.

Tested-by:Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:42:11 +00:00
Peter Müller
82760a506b Core Update 162: Ship dhcpcd
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:41:22 +00:00
Peter Müller
d07fb5668d Core Update 162: Ship slang
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:40:32 +00:00
Adolf Belka
0b95de5cbf slang: Update to version 2.3.2
- Update from 2.3.0 to 2.3.2
- Update rootfile
- Changelog is too large to include here. Details can be found in the changes.txt file in
   the source tarball.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2021-11-24 09:37:51 +00:00
Peter Müller
8799c54e98 Core Update 162: Ship sshfs
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:33:25 +00:00
Adolf Belka
549f5294c3 sslh: Update to version 1.22c
- Update from 1.7a (2013) to 1.22c (2021)
- Update rootfile
- Changelog is too large to include here. Full details can be read in the ChangeLog file
   in the source tarball

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2021-11-24 09:32:02 +00:00
Peter Müller
496dfedfa2 Core Update 162: Ship bind and libuv
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:30:56 +00:00
Adolf Belka
689246f594 libuv: Required for build and run of bind utilities
- Install libuv lfs and rootfile
- Add libuv to make.sh
- Tested by running bind utilities on a vm testbed

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2021-11-24 09:30:22 +00:00
Adolf Belka
405e359ee6 bind: Update to version 9.16.22
- Update from 9.11.32 to 9.16.22
- 9.11 is an ESV (Extended Support Version) that will go EOL in December 2021
  9.16 is the replacement ESV whose EOL is not yet defined but will be at least 4 years
   so should be supported until at least March 2024 as the 9.16 branch was started in 2020
- Update rootfile
- libuv is now required both to build the bind libraries and for the running of the
   utilities.
- Changelog is difficult to define here as this is a change of branch from 9.11 to 9.16
   both of which have been running in parallel. However all the changes from the start of
   9.16.0 can be found in the CHANGES file in the source tarball.
- nslookup, host and dig utilities tested out by installing this on a vm testbed. All
   these utilities worked as the previous version
   nsupdate was not able to be tested other than confirming that running nsupdate
   opened an interactive session. This utility would be good to be tested by someone
   familiar with how to run it.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2021-11-24 09:29:56 +00:00
Peter Müller
0deb3dacda Core Update 162: Ship changed firewall initscript
Restarting the firewall is not necessary during the upgrade procedure,
and the user is asked to reboot the machine afterwards either way.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:27:17 +00:00
Peter Müller
fddcbfd4f5 Core Update 162: Ship vpnmain.cgi
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:15:17 +00:00
Peter Müller
45221cc614 Core Update 162: Ship proxy.cgi
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:14:12 +00:00
Adolf Belka
241d8a753a meson: Update to version 0.59.2
- Update from 0.58.0 to 0.59.2
- Update rootfile
- Changelog is too long to include here.
   Full details can be read at https://mesonbuild.com/Release-notes-for-0-59-0.html

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-11-24 09:10:16 +00:00
Adolf Belka
2ae78be081 bison: Update to version 3.8.2
- Update from 3.7.6 to 3.8.2
- Update rootfile
- Changelog
   Noteworthy changes in release 3.8.2 (2021-09-25) [stable]
     Fixed portability issues of bison on Cygwin.
     Improvements in glr2.cc: add support for custom error messages (`%define
      parse.error custom`), allow linking several parsers together.
   Noteworthy changes in release 3.8.1 (2021-09-11) [stable]
     The generation of prototypes for yylex and yyerror in Yacc mode is
      breaking existing grammar files.  To avoid breaking too many grammars, the
      prototypes are now generated when `-y/--yacc` is used *and* the
      `POSIXLY_CORRECT` environment variable is defined.
     Avoid using `-y`/`--yacc` simply to comply with Yacc's file name
      conventions, rather, use `-o y.tab.c`.  Autoconf's AC_PROG_YACC macro uses
      `-y`.  Avoid it if possible, for instance by using gnulib's gl_PROG_BISON.
   Noteworthy changes in release 3.8 (2021-09-07) [stable]
    ** Backward incompatible changes
     In conformance with the recommendations of the Graphviz team
      (https://marc.info/?l=graphviz-devel&m=129418103126092), `-g`/`--graph`
      now generates a *.gv file by default, instead of *.dot.  A transition
      started in Bison 3.4.
     To comply with the latest POSIX standard, in Yacc compatibility mode
      (options `-y`/`--yacc`) Bison now generates prototypes for yyerror and
      yylex.  In some situations, this is breaking compatibility: if the user
      has already declared these functions but with some differences (e.g., to
      declare them as static, or to use specific attributes), the generated
      parser will fail to compile.  To disable these prototypes, #define yyerror
      (to `yyerror`), and likewise for yylex.
    ** Deprecated features
     Support for the YYPRINT macro is removed. It worked only with yacc.c and
      only for tokens.  It was obsoleted by %printer, introduced in Bison 1.50
      (November 2002).
     It has always been recommended to prefer `%define api.value.type foo` to
      `#define YYSTYPE foo`.  The latter is supported in C for compatibility
      with Yacc, but not in C++.  Warnings are now issued if `#define YYSTYPE`
      is used in C++, and eventually support will be removed.
     In C++ code, prefer value_type to semantic_type to denote the semantic
      value type, which is specified by the `api.value.type` %define variable.
    ** New features
    *** A skeleton for the D programming language
     The "lalr1.d" skeleton is now officially part of Bison.
     It was originally contributed by Oliver Mangold, based on Paolo Bonzini's
      lalr1.java, and was improved by H. S. Teoh.  Adela Vais then took over
      maintenance and invested a lot of efforts to complete, test and document
      it.
     It now supports all the bells and whistles of the other deterministic
      parsers, which include: pull/push interfaces, verbose and custom error
      messages, lookahead correction, token constructors, internationalization,
      locations, printers, token and symbol prefixes, etc.
     Two examples demonstrate the D parsers: a basic one (examples/d/simple),
      and an advanced one (examples/d/calc).
    *** Option -H, --header and directive %header
     The option `-H`/`--header` supersedes the option `--defines`, and the
      directive %header supersedes %defines.  Both `--defines` and `%defines`
      are, of course, maintained for backward compatibility.
    *** Option --html
     Since version 2.4 Bison can be used to generate HTML reports.  However it
      was a two-step process: first bison must be invoked with option `--xml`,
      and then xsltproc must be run to the convert the XML reports into HTML.
     The new option `--html` combines these steps.  The xsltproc program must
      be available.
    *** A C++ native GLR parser
     A new version of the C++ GLR parser was added: "glr2.cc".  It generates
      "true C++11", instead of a C++ wrapper around a C parser as does the
      existing "glr.cc" parser.  As a first significant consequence, it supports
      `%define api.value.type variant`, contrary to glr.cc.
     It should be upward compatible in terms of interface, feature and
      performance to "glr.cc". To try it out, simply use
      %skeleton "glr2.cc"
     It will eventually replace "glr.cc".  However we need user feedback on
      this skeleton.  _Please_ report your results and comments about it.
    *** Counterexamples
     Counterexamples now show the rule numbers, and always show ε for rules
      with an empty right-hand side.  For instance
        exp
        ↳ 1: e1       e2     "a"
             ↳ 3: ε • ↳ 1: ε
      instead of
        exp
        ↳ e1  e2  "a"
          ↳ • ↳ ε
    *** Lookahead correction in Java
     The Java skeleton (lalr1.java) now supports LAC, via the `parse.lac`
      %define variable.
    *** Abort parsing for memory exhaustion (C)
     User actions may now use `YYNOMEM` (similar to `YYACCEPT` and `YYABORT`)
      to abort the current parse with memory exhaustion.
    *** Printing locations in debug traces (C)
     The `YYLOCATION_PRINT(File, Loc)` macro prints a location.  It is defined
      when (i) locations are enabled, (ii) the default type for locations is
      used, (iii) debug traces are enabled, and (iv) `YYLOCATION_PRINT` is not
      already defined.
     Users may define `YYLOCATION_PRINT` to cover other cases.
    *** GLR traces
     There were no debug traces for deferred calls to user actions.  They are
      logged now.
   Noteworthy changes in release 3.7.6 (2021-03-08) [stable]
    ** Bug fixes
    *** Reused Push Parsers
     When a push-parser state structure is used for multiple parses, it was
      possible for some state to leak from one run into the following one.
    *** Fix Table Generation
     In some very rare conditions, when there are many useless tokens, it was
      possible to generate incorrect parsers.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-11-24 09:09:47 +00:00
Michael Tremer
eab7754d1e suricata: Drop extra rootfiles
These are all the same and not different from what is in
config/rootfiles/common/suricata.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-11-24 09:07:29 +00:00
Michael Tremer
112441db22 rust: Drop Cargo home directory after build
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-11-24 09:06:55 +00:00
Michael Tremer
30f411694c suricata: Include all default rules
These rules do not drop anything, but only alert when internal parts of
the engine trigger an event. This will allow us more insight on what is
happening.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2021-11-24 09:06:14 +00:00
Peter Müller
f542b16328 Core Update 162: Ship jansson
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:05:34 +00:00
Adolf Belka
d3a4c2fc50 jansson: Update to version 2.14
- Update from 2.12 to 2.14
- Update rootfile
- Changelog
   Version 2.14 Released 2021-09-09
    * New Features:
      - Add `json_object_getn`, `json_object_setn`, `json_object_deln`, and the
        corresponding `nocheck` functions. (#520, by Maxim Zhukov)
    * Fixes:
      - Handle `sprintf` corner cases (#537, by Tobias Stoeckmann)
    * Build:
      - Symbol versioning for all exported symbols (#540, by Simon McVittie)
      - Fix compiler warnings (#555, by Kelvin Lee)
    * Documentation:
      - Small fixes (#544, #546, by @i-ky)
      - Sphinx 3 compatibility (#543, by Pierce Lopez)
   Version 2.13.1 Released 2020-05-07
    * Build:
      - Include `jansson_version_str()` and `jansson_version_cmp()` in
        shared library. (#534)
      - Include ``scripts/`` in tarball. (#535)
   Version 2.13 Released 2020-05-05
    * New Features:
      - Add `jansson_version_str()` and `jansson_version_cmp()` for runtime
        version checking (#465).
      - Add `json_object_update_new()`, `json_object_update_existing_new()`
        and `json_object_update_missing_new()` functions (#499).
      - Add `json_object_update_recursive()` (#505).
    * Build:
      - Add ``-Wno-format-truncation`` to suppress format truncation warnings (#489).
    * Bug fixes:
      - Remove ``strtod`` macro definition for MinGW (#498).
      - Add infinite loop check in `json_deep_copy()` (#490).
      - Add ``pipe`` macro definition for MinGW (#500).
      - Enhance ``JANSSON_ATTRS`` macro to support earlier C standard(C89) (#501).
      - Update version detection for sphinx-build (#502).
    * Documentation:
      - Fix typos (#483, #494).
      - Document that call the custom free function to free the return value
        of `json_dumps()` if you have a custom malloc/free (#490).
      - Add vcpkg installation instructions (#496).
      - Document that non-blocking file descriptor is not supported on
        `json_loadfd()` (#503).

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2021-11-24 09:05:10 +00:00
Peter Müller
5c581bbb87 Core Update 162: Ship libhtp and Suricata, restart the latter
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:04:09 +00:00
Peter Müller
db584cb746 Core Update 162: Ship libxcrypt
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2021-11-24 09:01:20 +00:00
Arne Fitzenreiter
efcd60effb core162: add connections.cgi
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-24 08:56:23 +00:00
Arne Fitzenreiter
654eb3c3c5 core162: add unbound initskript
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-24 07:52:04 +00:00
Arne Fitzenreiter
2a8a964609 core162: apply local sshd config and restart
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-24 02:46:45 +00:00
Arne Fitzenreiter
d63838f4b9 core162: remove old kernel
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-24 02:43:47 +00:00
Arne Fitzenreiter
93b4cc6c91 core162: add changed files to updater
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2021-11-24 02:42:31 +00:00