webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-12 20:16:49 +02:00
Code Issues Packages Projects Releases Wiki Activity
13,257 Commits 2 Branches 1 Tag
a86bc6dfc6f391ed4c91a9a0ecb503da2ee8a80d
Commit Graph

13257 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Tremer
a86bc6dfc6 suricata: EXTERNAL_NET should equal any 
This enables that we scan servers in ORANGE for clients in
GREEN which absolutely makes sense.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-23 22:04:30 +02:00
Michael Tremer
56f6d107ff suricata: Do not always convert rules to be bi-directional 
This creates some overhead that we do not need and rules need to
be adjusted to match any direction they are supposed to match.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-23 22:03:33 +02:00
Arne Fitzenreiter
7b0c8a80af core131: add services.cgi to update 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-23 19:21:30 +02:00
Arne Fitzenreiter
c33a6e7103 finish core131 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-20 18:12:21 +02:00
Arne Fitzenreiter
e7a52c52d1 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next 2019-04-20 17:35:54 +02:00
Arne Fitzenreiter
08639bc2a9 kernel: update 4.14.113 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-20 17:21:03 +02:00
Arne Fitzenreiter
5fa063f859 kernel: update to 4.14.112 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-17 22:30:19 +02:00
Michael Tremer
26dc79a6fe suricata: Do not let oinkmaster be too verbose 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-17 21:24:25 +01:00
Michael Tremer
e96adc7797 suricata: Redirect oinkmaster output to perl function 
The output was written to stderr before and landed in apache's
error log where we do not want it.

Fixes: #12004
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-17 20:59:55 +01:00
Michael Tremer
9e65aa9ed6 Revert "hostapd: Always enable 80 MHz channel width for 802.11ac" 
This reverts commit c31c8078cf.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-17 19:15:44 +01:00
Michael Tremer
c25a386523 unbound: Drop unused function 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-17 19:15:29 +01:00
Michael Tremer
64aed99df6 suricata: Change runmode to workers 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-17 19:15:29 +01:00
Arne Fitzenreiter
e91c83490b wireless-regdb: update to 2019.03.01 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-16 18:05:18 +02:00
Michael Tremer
fea27a56f7 haproxy: Backup certificates, too 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-16 13:23:17 +01:00
Michael Tremer
175f5c060e backup: Allow passing name of tarball for creation/restore 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-16 13:22:10 +01:00
Michael Tremer
820b290982 Move IPS to a higher position in the Firewall menu 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 23:32:57 +01:00
Michael Tremer
0851afba33 remote.cgi: Move SSH Agent Forwarding to the top 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 23:24:54 +01:00
Michael Tremer
5e39f3c08a sshctrl: Fix syntax of generated sed command 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 23:22:14 +01:00
Michael Tremer
e8b389e0f0 core131: Ship PTR changes in hosts.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 23:02:57 +01:00
Michael Tremer
316d14c43a Update list of contributors 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 23:00:25 +01:00
Peter Müller
6874a5765b Unbound: do not generate PTR if the user requested not to, do so 
Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 22:59:42 +01:00
Michael Tremer
5b2ec053c2 Update translations 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 22:58:35 +01:00
Peter Müller
c3c2ae4475 add option for selective PTR generation on hosts.cgi 
In some cases, it might be useful to create an additional
host (i.e. for round robin loadbalancing) without assigning
another PTR to the IP address specified.

This patch introduces the ability to check or uncheck
PTR generation for each host individually.

Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 22:58:03 +01:00
Michael Tremer
32e7b93c28 udev: Rename interfaces when MACs are uppercase 
The script relied on the configuration being in lowercase.

If people manually editied their configuration file they might
not have paid attention to this and therefore this script now
also accepts uppercase MAC addresses.

Fixes: #12047
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 21:59:41 +01:00
Michael Tremer
dccbdf5b97 suricata: Take as much off of the CPU as possible 
https://suricata.readthedocs.io/en/suricata-4.1.3/performance/high-performance-config.html

This will compile the ruleset as efficient as possible and
allows the IPS to run faster on smaller systems.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-12 17:59:21 +01:00
Michael Tremer
2c44da1382 core131: Ship updated setup 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 10:29:56 +01:00
Stefan Schantl
0d34a479c8 ids.cgi: Display oinkcode section after page load when neccessary. 
Fixes #12048.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 10:28:19 +01:00
Michael Tremer
d51d3c5b93 IPS logging: Fix date comparison for last entry 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-12 17:36:54 +01:00
Michael Tremer
2eb0c326da IPS logging: There is no distinguation between suricata & snort required 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-12 17:33:39 +01:00
Michael Tremer
19c066b602 IPS logging: Fix reading date 
The CGI script only compares mm/dd and does not care about the year.

Suricata, however, logs the year as well which has to be ignored here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-12 17:32:02 +01:00
Michael Tremer
a32c219fa4 zabbix_agentd: Bump package version 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 07:55:36 +01:00
Alexander Koch
41b7369f80 zabbix_agentd: Bugfix for /etc/sudoers.d/zabbix.user 
Files containing an '~' or '.' are ignored by sudo when placed in the includedir /etc/sudoers.d This makes the file useless. The file is renamed to "zabbix" instead of "zabbix.user" to fix this.

See: https://www.sudo.ws/man/1.8.13/sudoers.man.html#Including_other_files_from_within_sudoers

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 07:55:10 +01:00
Alexander Koch
854b63c42a zabbix_agentd: update to 4.2.0 
Relase Notes: https://www.zabbix.com/rn/rn4.2.0

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 07:55:07 +01:00
Stéphane Pautrel
a45bfbf1c5 installer+setup: Update French translation 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-11 03:47:44 +01:00
Arne Fitzenreiter
3e11f8257d make.sh: fix syntax error 
i have merged master>next and not deleted this line.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-11 07:34:14 +02:00
Arne Fitzenreiter
d27675b081 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next 2019-04-11 07:31:11 +02:00
Arne Fitzenreiter
a2907cdd9f Merge remote-tracking branch 'origin/master' into next 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-11 07:30:26 +02:00
Matthias Fischer
d01d68913f wget: Update to 1.20.3 
For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

"2019-04-05  Tim Ruehsen  <tim.ruehsen@gmx.de>

Fix a buffer overflow vulnerability
* src/iri.c(do_conversion): Reallocate the output buffer to a larger
  size if it is already full"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-09 12:34:18 +02:00
Michael Tremer
af9aa1556e core130: Ship updated apache 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-09 12:33:50 +02:00
Matthias Fischer
0971726e13 apache: Update to 2.4.39 
For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-09 12:29:41 +02:00
Arne Fitzenreiter
6fc3f2e685 core130: insert a core update for urgent fixes. 
the bigger changes for suricata and kernel need longer time for test
so we insert a core with smaller but important fixes.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-09 07:31:23 +02:00
Arne Fitzenreiter
e7dafc3e3e core130: ship strongswan 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-09 07:30:26 +02:00
Michael Tremer
f0ce8b2c88 core130: Ship perl-Net-SSLeay 
This was still using the old version of OpenSSL.

Instead of linking the module (which we should have found earlier)
the module uses dlopen :(

Fixes: #12044
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-09 07:24:17 +02:00
Michael Tremer
d66433fca6 strongswan: Manually install all routes for non-routed VPNs 
This is a regression from disabling charon.install_routes.

VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.

Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-09 07:22:26 +02:00
Michael Tremer
49ce16f9be core130: Ship updated wget 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-09 07:21:15 +02:00
Matthias Fischer
8d76eb2085 wget: Update to 1.20.2 
For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

* Changes in Wget 1.20.2
** NTLM authentication will retry under certain cases
** Fixed a buffer overflow vulnerability"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-09 07:20:48 +02:00
Matthias Fischer
bfd5cfa9c6 clamav: Update to 0.101.2 
For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html

"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-09 07:19:34 +02:00
Michael Tremer
a485606c27 ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-04-09 07:18:42 +02:00
Stefan Schantl
ee82349a0e convert-snort: Re-order steps at end of script 
This will ensure that the whole IDS is configured property, if
no or an empty snort config file is present.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-08 21:15:35 +01:00
Stefan Schantl
e4bc9b8b6f convert-snort: Fix logic for detecting enough free disk space. 
The subfunction only will return something if the check fails - so the logic
of the if statement was wrong set and the downloader only was called if
this check failed and to less diskspace would be available.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-04-08 21:15:35 +01:00