webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-18 15:02:59 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,844 Commits 2 Branches 1 Tag
bcbc9897e392a237105fc2e12af2323804bd2a42
Commit Graph

6373 Commits

Author SHA1 Message Date
Stefan Schantl
bcbc9897e3 ids-functions.pl: Grab address for RED by using get_red_address() function. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-31 09:50:47 +01:00
Stefan Schantl
de8e1e5b6c ids-functions.pl: Add function to the the current assigned IP-address of RED. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-31 09:41:35 +01:00
Stefan Schantl
23c0347ac5 ids-functions.pl: Add RED address and aliases to the HOME_NET 
Reference: #11981

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-30 12:51:51 +01:00
Stefan Schantl
77c3130174 ids-functions.pl: Add get_aliases() 
This subfunction is used to get all configured and enabled aliases
for the RED network zone. They will be returned as an array.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-30 11:57:49 +01:00
Peter Müller
8059239661 Suricata: drop unused cuda HW acceleration 
As stated in https://bugzilla.ipfire.org/show_bug.cgi?id=11808#c5 ,
Cuda hardware acceleration is unused and so the configuration file
section can be removed.

This partially addresses #11808.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-29 14:07:43 +01:00
Stefan Schantl
68699ecfff Revert "Add DDNS to core 107." 
This reverts commit 197033fab2.
 2019-01-29 11:23:54 +01:00
Stefan Schantl
36e69d34b1 convert-snort: Use set_ownership() from ids-functions.pl 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-29 09:05:29 +01:00
Stefan Schantl
4fbd88bfad ruleset-sources: Add Emerging-Threads Pro ruleset 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-29 09:01:20 +01:00
Stefan Schantl
3c59b1fab8 ids-functions.pl: Set correct ownership for the stored error file. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-29 08:58:08 +01:00
Stefan Schantl
1fedede6a0 ids-functions.pl: Add set_ownership() function. 
This function is used to change the ownership of a given file
or directory to the user "nobody" and the group "nobody", which is
used by the WUI.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-29 08:50:16 +01:00
Stefan Schantl
8c27372438 backup.pl: Run snort to suricata converter when a backup gets restored. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-29 08:40:34 +01:00
Stefan Schantl
85a62b0523 IDS: Install snort to suricata converter 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-29 08:26:15 +01:00
Stefan Schantl
e4840020ed Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata 2019-01-28 17:29:21 +01:00
Matthias Fischer
61ee842911 ghostscript: Update to 9.26 
For details see:
https://www.ghostscript.com/doc/9.26/News.htm

This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")

Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-4286563.html

I saw this article and found it could be the time for an update...

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-27 22:26:55 +00:00
Stefan Schantl
39155be805 Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata 2019-01-26 12:40:04 +01:00
Michael Tremer
d03916e558 Enable some performance tuning 
These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.

Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.

On a slower system (apu1d) no performance improvement or loss
could have been measured.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-24 12:31:27 +00:00
Michael Tremer
7ec83993e5 proxy: Show error messages in English by default 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-23 06:21:53 +00:00
Michael Tremer
0a44d9bcec core128: Ship updated ca-certificates 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-23 05:40:41 +00:00
Peter Müller
07c36be56f update ca-certificates CA bundle 
Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-23 05:40:21 +00:00
Michael Tremer
bdc8310154 core128: Ship updated openssh 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-23 05:40:04 +00:00
Peter Müller
fee8b1c504 OpenSSH: update to 7.9p1 
Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-23 05:13:47 +00:00
Michael Tremer
26d07ee5da core128: Ship updated tzdata 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-23 03:06:07 +00:00
Peter Müller
0661be620b tzdata: update to 2018i 
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-23 02:53:20 +00:00
Stefan Schantl
5b0b4182a8 convert-snort: Settings converter from snort to suricata 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-22 15:36:00 +01:00
Stefan Schantl
9283e9b9cf ids.cgi: Move and rename GenerateIgnoreList() function to ids-functions.pl 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2019-01-22 13:25:13 +01:00
Michael Tremer
b7ddf23b72 strongswan: Update to 5.7.2 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-22 05:32:42 +00:00
Arne Fitzenreiter
ec7d630b62 kernel: x86_64 encrease NR_CPUS to 64 
fixes #11963

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-22 07:46:08 +01:00
Arne Fitzenreiter
503a6f155b kernel: update to 4.14.94 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-22 07:41:18 +01:00
Michael Tremer
eacf8dc4b7 core128: Ship updated xt_geoip_update script 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-21 21:04:10 +00:00
Stefan Schantl
c1a3401235 Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata 2019-01-21 13:04:13 +01:00
Michael Tremer
f6326e4f77 core128: Ship updated logrotate 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-21 10:20:29 +00:00
Arne Fitzenreiter
9b86a7ec28 Merge remote-tracking branch 'origin/master' into next 2019-01-19 19:58:48 +01:00
Arne Fitzenreiter
f29ff21cd6 core127: run xt_geoip_update 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-19 17:24:47 +01:00
Arne Fitzenreiter
2092280a3a core127: ovpn ca index.txt is also missing on some installations 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-19 17:20:51 +01:00
Arne Fitzenreiter
4cba04ce28 core127: fix typo 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-19 12:08:07 +01:00
Arne Fitzenreiter
3d476ab017 core127: add ovpn ca changes to update 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-19 10:02:17 +01:00
Arne Fitzenreiter
a58c5ca1f2 core127: add xt_geoip_update to update 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-19 10:01:40 +01:00
Arne Fitzenreiter
a6c298b540 core127: add bind to update 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-19 10:00:54 +01:00
Arne Fitzenreiter
99549950fa core127: set reboot needed flag 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-18 13:53:39 +01:00
Arne Fitzenreiter
ad62fda0ad core127: add general-functions.pl to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-18 13:53:06 +01:00
Arne Fitzenreiter
9918b6f40d core127: fix updater for aarch64 and armv5tel 
if a arch specific filelist has the same name as the common the common filelist was ignored

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2019-01-18 07:52:17 +01:00
Michael Tremer
93d516bd70 Revert "Disable Path MTU discovery" 
This reverts commit 1c0cfaa594.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-17 19:24:46 +00:00
Michael Tremer
8f095fb287 core128: Remove openssl-compat package 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-17 14:41:54 +00:00
Peter Müller
63cf6d5cef drop openssl-compat package 
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-17 14:41:07 +00:00
Michael Tremer
ac520af837 core128: Ship recently updated openssl and apache 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-17 14:39:14 +00:00
Michael Tremer
5a39464754 Start Core Update 128 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-17 14:38:01 +00:00
Peter Müller
535dab60d6 httpd: include TLS 1.3 cipher suites 
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Erik Kapfer <erik.kapfer@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-17 14:34:00 +00:00
Erik Kapfer
32ba431458 openssl: Update to version 1.1.1a 
Disabled MD2 and Aria cipher.

TLSv1.3 is now available with:

TLS_CHACHA20_POLY1305_SHA256 TLSv1.3
TLS_AES_256_GCM_SHA384  TLSv1.3
TLS_AES_128_GCM_SHA256  TLSv1.3

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-17 14:33:20 +00:00
Michael Tremer
f0092a6e3e keepalived: Move change of conntrack sysctl option into package 
The setting cannot be set on the default system because the ip_vs
module is not loaded by default and there is no reason to load it
just because we would be able to set the setting.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-13 12:50:26 +01:00
Michael Tremer
d499e86b16 GeoIP: Add accidentially removed paths to database 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2019-01-13 12:28:10 +01:00