Commit Graph

22800 Commits

Author SHA1 Message Date
Vincent Li
cf5df05796 flash-images: add serial console linux command
Add the missing serial linux command so the
flash image can be converted to qcow2, the
bpfire qcow2 image can be deployed in KVM
virtual environment through serial console
installation.

for exmaple:

virsh define BPFire-VM.xml
virsh start BPFire-VM
virsh console BPFire-VM

we will have serial console access to BPFire
VM and the installation will start.

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-22 17:46:39 -08:00
Vincent Li
4f473b785a flash-images: mount bpffs for XDP program
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-22 17:45:04 -08:00
Vincent Li
bc2ac2db5b yt6801: remove xz compression of driver
no need to compress since other drivers are
not compressed.

had one instance that when system boots up
from the flash image USB drive, and when
setup the network, the driver is not loaded.
it is caused when kernel is rebuilt, yt6801
also need to be rebuilt, but linux-initrd
initramfs is not rebuilt which actually
runs the module dependencies, so linux-initrd
also need to rebuilt together.

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-22 11:40:38 -08:00
Vincent Li
cfefb2a884 xdp-tools: add xdp-tools
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-22 11:28:31 -08:00
Vincent Li
d88bdd74b3 perf: add linux perf tool
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-21 18:00:47 -08:00
Vincent Li
51ff36eb32 bpftool: add bpftool
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-21 17:57:09 -08:00
Vincent Li
708556b443 libbpf: add libbpf
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-21 17:56:33 -08:00
Vincent Li
379faf9f47 suricata: enable compile and install suricata
add rust back and enable compile and install suricata

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-21 15:50:47 -08:00
Vincent Li
5d628cf3bf flash-images: increase disk space
build error when create flash image, increase the size

tar: var/lib/location/ipset: Cannot mkdir: No space left on device

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-21 15:38:41 -08:00
Vincent Li
1c3c9da5cf llvm-project: add llvm/clang to compile BPF program
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-21 10:20:12 -08:00
Vincent Li
2e5f7966ac yt6801: add yt6801 driver for loongson NUC
yt6801 ethernet driver is out of kernel tree
add lfs/yt6801 to build yt6801 driver

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-20 14:05:08 -08:00
Vincent Li
e3dff6fb65 kernel: enable BPF/BTF config
rebase the kernel config from fedora loongarch kernel
6.12, and enable kernel BTF/BPF feature config

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-20 09:07:23 -08:00
Vincent Li
ae6af66e21 pahole: add pahole for kernel BTF generation
CONFIG_DEBUG_INFO_BTF=y requires pahole installed

steps to prepare pahole:

git clone --recurse-submodules  https://kernel.googlesource.com/pub/scm/devel/pahole/pahole.git
cd pahole
git checkout -b v1.28 v1.28
cd ..
mv pahole pahole-1.28
tar czvf pahole-1.28.tar.gz pahole-1.28
b2sum pahole-1.28.tar.gz

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-20 08:06:59 -08:00
Vincent Li
342323fa0c initscripts: stop fireinfo startup during boot
fireinfo startup script requires user intervention
due to python error, remove it for now

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-19 12:42:27 -08:00
Vincent Li
5a8bacb23d linux: upgrade kernel to 6.12.5
upgrade kernel to 6.12.5 with Loongson ethernet
controller driver support.

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-19 11:54:06 -08:00
Vincent Li
23ae73dde4 loongarch64: major changes for flash image and iso
Initial list of changes required to build iso
and flash image successfully:

1 softwares require config.guess and config.stub
  update with loongarch support

2 no rust build and no suricata which depends on rust

3 comment out python 3.10 lib-dynload and config-3.10-xxxMACHINExxx-linux-gnu

4 lfs/cdrom lfs/Config loongarch seems requiring capital EFI boot image name
  to boot properly

5 comment out a few softwares that are not needed for now

iso can be installed to loongarch PC hard drive, but
fail to boot.

flash image can be dd to USB drive, then boot loongarch
PC from USB drive, then dd from USB drive to loongarch
PC hard drive

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-19 11:42:59 -08:00
Vincent Li
30339c14a1 toolchain: fix gcc custom linker path
Loongarch64 requires gcc/config/loongarch/gnu-user.h
change for custom linker path when compiling gcc
tool chain

fix: https://github.com/vincentmli/BPFire/issues/67

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-17 12:45:57 -08:00
Vincent Li
a0eed98b22 Add linker path to toolchain build
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-16 18:46:13 -08:00
Vincent Li
8a0ca16bae Loongarch64: initial change for tool chain build
1. add loongarch64 in make.sh

2. updated many source tar balls with config.guss
   and config.sub with loongarch64 support

3. remove rust and surricata for now

4. workaround binary env dynamic linker missing
   by symbolic link tools_loongarch64/lib to lib64
   when ./make.sh build

   cd build_loongarch64; ln -s tools_loongarch64/lib lib64

./make.sh toolchain to build tool chain
./make clean to start fresh
./make.sh gettoolchain to extract tool chaina from cache
./make.sh build to build software and image

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2024-12-15 09:09:28 -08:00
Michael Tremer
0d774f0db5 flash-image: Create a journal when the filesystem is being created
We recently started to have problems when a new installation was
launched from the flash image that creating the journal corrupted the
filesystem on the next mount operation.

Since we would like all IPFire installations to have a journal, we
create this now when we create the image and won't try to add it later.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-14 12:06:43 +00:00
Michael Tremer
ca81c65144 installer: Remove the option to install without journal
It was possible to install a new system without a journal. I think this
is a very outdated concept now and should be avoided in favour of
filesystem integrity.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-14 12:06:42 +00:00
Michael Tremer
f2fce26932 Config: Don't interpret file names as regular expressions
When we are searching for changes in rootfiles, we walk through each
file that we have found in the build and check if it exists in the
rootfile. That check interpreted filenames as regular expressions which
caused a problem in the case of "/usr/bin/[".

This patch changes that grep will only search for an exact string match
(-F) and the string must be the entire line (-x).

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-14 12:06:30 +00:00
Michael Tremer
804ac341a1 core190: Load SSH RSA key on legacy systems
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-13 14:37:35 +00:00
Michael Tremer
0712a67744 OpenSSH: No longer try to load the RSA key
This key has been removed on new installations.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-13 14:37:35 +00:00
Stefan Schantl
955f8b1457 backup: Add /etc/ssh/sshd_config.d
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-13 14:36:51 +00:00
Stefan Schantl
1a4d5cfd92 openssh: Introduce include directory for additional sshd config files
This patch adds the prosibility to place additional *.config files in /etc/ssh/sshd_config.d/
which will be included and loaded during the daemon startup process.

Because this files will not be overwritten by any update, they can be used to place custom
or other persistent settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-13 14:36:51 +00:00
Adolf Belka
38067c08c7 suricata: Update to version 7.0.8
- Update from version 7.0.7 to 7.0.8
- Update of rootfile not required
- Changelog
    7.0.8
	Security #7412: tcp: generic detection bypass using TCP urgent support (7.0.x
	 backport)(HIGH - CVE 2024-55629)
	Security #7405: dns: quadratic complexity in logging and invalid json as output
	 (7.0.x backport)(HIGH - CVE 2024-55628)
	Security #7404: tcp: segfault on StreamingBufferSlideToOffsetWithRegions (7.0.x
	 backport)(CRITICAL - CVE 2024-55627)
	Security #7367: bpf: oversized bpf file can lead to buffer overflow (7.0.x
	 backport)(LOW - CVE 2024-55626)
	Security #7306: detect: write to read-only memory in transforms (7.0.x backport)
	 (CRITICAL - CVE 2024-55605)
	Bug #7445: dpdk: RSS key length missmatch on ice (E810) card with DPDK version
	 22.11.6  (7.0.x backport)
	Bug #7434: requires: rules with unmet requirements are still loaded (7.0.x
	 backport)
	Bug #7432: detect: decoder event rules fail to match on invalid packets (7.0.x
	 backport)
	Bug #7407: detect: missing app-layer metadata in alerts (7.0.x backport)
	Bug #7368: flow: flow timeout pseudo packet triggers unexpected alert (7.0.x
	 backport)
	Bug #7362: rules: unknown internal events not being detected as errors (7.0.x
	 backport)
	Bug #7339: rust: different int types turn garbage on FFI boundary (7.0.x backport)
	Bug #7335: asan/profiling: global-buffer-overflow error (7.0.x backport)
	Bug #7327: http: FN with prefilter if the first of multi buffer did not match
	 (7.0.x backport)
	Bug #7324: mqtt: wrong and missing direction for keywords (7.0.x backport)
	Bug #7310: http: incorrect file direction handling (7.0.x backport)
	Bug #7308: conf: memleak if yaml parser is initialized before checking if file
	 exists (7.0.x backport)
	Bug #7307: detect: memleak in case of errors during initialization (7.0.x
	 backport)
	Bug #7301: output: oversized records lead to invalid json (7.0.x backport)
	Bug #7295: detect: sip.stat_code keyword uses wrong buffer name
	Bug #7294: conf: nullptr dereference if mem alloc fails for a node in yaml
	 parser (7.0.x backport)
	Optimization #7316: template: remove usage of template-rust (7.0.x backport)
	Optimization #7275: tcp/reassemble: GetBlock takes O(nlgn) in worst case (7.0.x
	 backport)
	Feature #7439: eve/alert: enrich decoder event rules (7.0.x backport)
	Task #7427:  flowint: add isnotset support (7.0.x backport)
	Task #7288: schema: add missing tls fields certificate and chain (7.0.x backport)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-12-13 14:32:58 +00:00
Arne Fitzenreiter
1e2abd66fb linux-firmware: ship needed config txt files.
these files are parsed by the kernel at firmware load and are needed!
don't remove it again.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-26 12:02:50 +01:00
Arne Fitzenreiter
58b611a6ab kernel: update to 6.6.63
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-25 18:32:27 +01:00
Arne Fitzenreiter
5380ebc7c3 kernel: rootfile update aarch64
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-20 15:51:39 +01:00
Arne Fitzenreiter
c3d1de3ee8 kernel: rebase aarch64 patchset and add nanopi r2s plus oc devicetree
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-20 09:47:59 +01:00
Arne Fitzenreiter
8f36e4c896 transmission: add minipnpc as dependency
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-19 20:32:47 +01:00
Arne Fitzenreiter
adb153f64f miniupnpc: change to addon pak
transmission need the lib at runtime.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-19 20:32:30 +01:00
Arne Fitzenreiter
a6fac033ba kernel: update to 6.6.62
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-19 19:19:28 +01:00
Arne Fitzenreiter
28636c46cb collectd: fix errormessage on fresh installations
the /etc/collectd.d/ folder must have at least one file in it
so this add an file with a comment that custom configs should placed
there.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-09 09:46:53 +01:00
Arne Fitzenreiter
ac7c2b8270 kernel: update to 6.6.60
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-09 09:46:24 +01:00
Arne Fitzenreiter
e8b7c0bc3f networking/red: remove leftover debugging messages.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-08 18:49:52 +01:00
Arne Fitzenreiter
afd54bb41a hostapd: fix start/stop buttons
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-06 11:49:11 +01:00
Arne Fitzenreiter
3cf9dba6b4 network-functions: fix add newline in $wireless_status
with the other syntax perl suggest this change.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 17:48:17 +01:00
Arne Fitzenreiter
6ccbd48aa9 core190: ship intel-microcode
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 14:34:35 +01:00
Adolf Belka
2be32bfb99 intel-microcode: Update to version 20241029
- Update from version 20240910 to 20241029
- Update of rootfile not required
- Changelog
    20241029
	Update for functional issues. Refer to 14th/13th Generation Intel® Core™
	 Processor Specification Update for details at
	 https://cdrdv2.intel.com/v1/dl/getContent/740518
	Updated Platforms
	 Processor   Stepping  F-M-S/PI     Old Ver   New Ver   Products
	 RPL-E/HX/S  B0        06-b7-01/32  00000129  0000012b  Core Gen13/Gen14

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 14:32:43 +01:00
Michael Tremer
76b6bc3e9d suricata: Explicitly ignore IPsec traffic unless enabled
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 14:29:53 +01:00
Arne Fitzenreiter
57853da08b core190: ship bind
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:19:23 +01:00
Matthias Fischer
ce45a76778 bind: Update to 9.20.3
For details see:
https://downloads.isc.org/isc/bind9/9.20.3/doc/arm/html/notes.html#notes-for-bind-9-20-3

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:17:29 +01:00
Matthias Fischer
07abe4e2f6 unbound: Update to 1.22.0
For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-22-0

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:15:06 +01:00
Arne Fitzenreiter
3a92419680 core190: ship unbound-dhcp-leases-bridge
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:13:56 +01:00
Michael Tremer
e595fa1176 unbound-dhcp-leases-bridge: Fix expiry check on leases
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:12:30 +01:00
Michael Tremer
131bcfa999 unbound-dhcp-leases-bridge: Don't overwrite static leases
When we import all static leases, their remark will be used as hostname
(because WTF?) and might be overwritten if the device is not sending any
or even the same hostname.

This patch avoids that static leases will be modified.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:12:17 +01:00
Michael Tremer
a81eefa265 unbound-dhcp-leases-bridge: Fix typo
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:11:55 +01:00
Michael Tremer
17a9ad2f52 unbound-dhcp-leases-bridge: Don't export expired leases to Unbound
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-11-05 09:11:43 +01:00