commit 8e1259a31b148fce90ba56f8e4c3ca3e05b35bc1 Author: Arne Fitzenreiter Date: Sun Sep 29 18:03:58 2024 +0200 hostapd: update to git 64d60bb4 Signed-off-by: Arne Fitzenreiter Signed-off-by: Michael Tremer commit 6f7bbb38c9460e1f179f064d9e0a0b2cf4bf45da Author: Michael Tremer Date: Fri Sep 20 14:12:07 2024 +0200 wlanap.cgi: Fix copying configuration This allows to uncheck checkboxes again. Signed-off-by: Michael Tremer commit d56df86ce26d5c35a89ffde492a0eb708396ee7e Author: Michael Tremer Date: Fri Sep 20 13:55:40 2024 +0200 wlanap.cgi: Change broadcast SSID to hide SSID Signed-off-by: Michael Tremer commit 375d1dc6dd46783900b9eb2f4fb3e3e25e7e0778 Author: Michael Tremer Date: Fri Sep 20 13:19:10 2024 +0200 wlanap.cgi: Default to channel 0 for ACS Signed-off-by: Michael Tremer commit 5474f9b32ffb2c41c89e30560919854584ed8169 Author: Michael Tremer Date: Fri Sep 20 13:17:59 2024 +0200 wlanap.cgi: Enable Neighbourhood Scan by default Signed-off-by: Michael Tremer commit b165dcdd803ba278013b1af03a8269f8994cb5f7 Author: Michael Tremer Date: Fri Sep 20 13:16:44 2024 +0200 wlanap.cgi: Don't try to show status if there is no interface Signed-off-by: Michael Tremer commit 03a71cd52131be601e2fc5101e3425e82e654ec9 Author: Michael Tremer Date: Fri Sep 20 13:13:41 2024 +0200 wlanap.cgi: Correctly show broadcast SSID status Signed-off-by: Michael Tremer commit 69bb956729ffc7268a40400cb1e01335ab919ea9 Author: Michael Tremer Date: Fri Sep 20 11:30:03 2024 +0100 wlanap.cgi: Disable generating Perl warnings Reported-by: Waynie Signed-off-by: Michael Tremer commit ff599dd2cb0d0cb9cac7019f1970b4d516bb2c36 Author: Michael Tremer Date: Tue Oct 8 08:43:39 2024 +0000 core189: Ship rules.pl Signed-off-by: Michael Tremer commit 5cee03da1e29e6cde5d4fe121b22b86768006775 Author: Michael Tremer Date: Mon Oct 7 09:13:12 2024 +0000 firewall: Flush SYN_FLOOD_PROTECTION This chain was not flushed when the firewall was being reloaded which made any ports appear as open when rules have been disabled or deleted. This has no security implications, but nevertheless isn't right. Reported-by: Adolf Belka Signed-off-by: Michael Tremer commit 01782a41f8feea008b92ea3e349c15dc7994588b Author: Michael Tremer Date: Mon Oct 7 10:22:33 2024 +0000 core189: Ship ncat This is required for the new Unbound/DHCP Leases bridge to work. Signed-off-by: Michael Tremer commit 7eec7e2c8b99bfe577d5b9cbd0bc0559f52f8020 Author: Michael Tremer Date: Mon Oct 7 10:18:57 2024 +0000 ncat: Make this package part of the core system The nc command is required for the Unbound/DHCP leases bridge. Signed-off-by: Michael Tremer commit 74f5f41372571c29b80db217a3d852ef0e613c6f Author: Michael Tremer Date: Fri Oct 4 11:46:22 2024 +0000 core189: Ship and restart Unbound Signed-off-by: Michael Tremer commit b38609d64d0ea20f510d6a692d7114d9d331bd77 Author: Matthias Fischer Date: Fri Oct 4 10:41:17 2024 +0200 unbound: Update to 1.21.1 For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-21-1 "Fix CVE-2024-8508, unbounded name compression could lead to denial of service." Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit a7ac62f4a67fa2016edc27735cec71bc1474c2b7 Author: Michael Tremer Date: Thu Sep 26 20:40:04 2024 +0000 ovpnmain.cgi: Remove using dropped &General::getlastip() function Signed-off-by: Michael Tremer commit 0555434effc70080d8278ca3db38fef51bba1efa Author: Michael Tremer Date: Thu Sep 26 14:13:10 2024 +0000 header.pl: Force browsers to reload rrdimage.js Signed-off-by: Michael Tremer commit d1a3fd9e0debf994055a410fbc7e5ba7c7c074b0 Author: Michael Tremer Date: Sun Sep 22 14:33:03 2024 +0000 ovpnmain.cgi: Fix IP address calculation with static pools Signed-off-by: Michael Tremer commit 84b04cb6d38eb0ca0fca426e4d6e0c0a2c467d9e Author: Michael Tremer Date: Tue Sep 24 08:53:40 2024 +0000 core189: Ship suricata changes Signed-off-by: Michael Tremer commit d99826dc71146a6d019341892d6f2d7b69ee2407 Author: Michael Tremer Date: Tue Sep 24 10:33:22 2024 +0200 suricata: Enable scanning IPsec packets Signed-off-by: Michael Tremer commit e5da7dea66167602b9255ac6b77d9ab32398a23d Author: Michael Tremer Date: Sun Sep 22 17:22:48 2024 +0200 ids.cgi: Add UI to enable scanning on IPsec Signed-off-by: Michael Tremer commit db151ad716beefcb9ab9fadd2bb3ac9934748793 Author: Michael Tremer Date: Sun Sep 22 17:08:03 2024 +0200 suricata: Add support for zones having multiple interfaces Signed-off-by: Michael Tremer commit 09831e9ca9c27b024d305f40655298d8106cdf5c Author: Michael Tremer Date: Sun Sep 22 17:06:21 2024 +0200 suricata: Split marking packets off into a separate chain This is required so that we can have different policies for incoming and outgoing packets. Signed-off-by: Michael Tremer commit 75a89ddf4aaccaf397e320a98bf1ecf65c78cff4 Author: Michael Tremer Date: Sat Sep 21 17:55:09 2024 +0200 suricata: Clear IPS bits after use Signed-off-by: Michael Tremer commit 6826eed0a4a892bf6ef24abd312bad474568c988 Author: Michael Tremer Date: Sat Sep 21 12:39:32 2024 +0200 suricata: Always count the whitelisted packets Even if there are no rules, if this does not exist, collectd will be unhappy and we cannot generate the graph. Signed-off-by: Michael Tremer commit 4efa4c4b714f117cb561201f7f6c122cb7da624a Author: Michael Tremer Date: Sat Sep 21 12:37:09 2024 +0200 ids.cgi: Don't show the graph if there is no RRD data Signed-off-by: Michael Tremer commit 0c5a683b7ed3cb268648c573bcbeead20f824e95 Author: Michael Tremer Date: Sat Sep 21 12:34:56 2024 +0200 ids.cgi: Fix empty states of tables Signed-off-by: Michael Tremer commit d98d10f7df7bd8715b338c6c3b30801f65243977 Author: Michael Tremer Date: Sat Sep 21 12:28:50 2024 +0200 graphs.pl: Fix suricata graph name Signed-off-by: Michael Tremer commit cf44d8d149dbda8aa8dccd89dd5e3ff75af628b9 Author: Michael Tremer Date: Tue Sep 17 04:04:07 2024 +0200 firewall: Move the IPS back to INPUT/FORWARD/OUTPUT We cannot use the PREROUTING/POSTROUTING chains here because Suricata will fail to track NAT-ed connections. Signed-off-by: Michael Tremer commit 5da15c5d3b1772f133d10a309d99b3588b98be0f Author: Michael Tremer Date: Fri Sep 13 10:12:30 2024 +0200 suricata: Track whitelisted traffic and add it to the IPS graph Signed-off-by: Michael Tremer commit 4721fac3c88069d5ca426f6be750f9b860efecaa Author: Michael Tremer Date: Wed Sep 11 00:43:59 2024 +0200 IPS: Ada a graph that shows the IPS throughput This graph is split into three parts. One shows bypassed packets, the next one shows the actually scanned packets and lastly we show the total throughput. Signed-off-by: Michael Tremer commit a85924cc2534c65eb10b800375ade8a5bb311dc1 Author: Michael Tremer Date: Tue Sep 10 23:45:53 2024 +0200 suricata: Collect metrics on scanned and bypassed packets Signed-off-by: Michael Tremer commit 8b73307b15a74b3e0781cfb3430298403e849ed6 Author: Michael Tremer Date: Tue Sep 10 23:23:38 2024 +0200 suricata: Force Suricata to write a PID file again The PID file does not get written when Suricata is not being started in daemon mode and therefore we need to pass it as a command line parameter. The initscript should not deal with the PID file when starting but needs it to terminate the process and to check the process status. The web UI can use the PID file again. Signed-off-by: Michael Tremer commit 63f4b3a7bc4bd80b036c02f2483fd82ac5810aca Author: Michael Tremer Date: Tue Sep 10 23:23:18 2024 +0200 suricata: Fix syntax error in watcher script Signed-off-by: Michael Tremer commit 0d38ebeb059cca9f97316f4980ee4437110ddf55 Author: Michael Tremer Date: Tue Sep 10 23:17:20 2024 +0200 suricata: Remove debugging code Signed-off-by: Michael Tremer commit 525ff6d74dac833854dde69a152e98f1b5fd14d2 Author: Michael Tremer Date: Tue Sep 10 11:37:38 2024 +0200 firewall: Move the IPS after the NAT marking This is because we might still land in the scenario where Suricata crashes and NFQUEUE will simply ACCEPT all packets which will terminate the processing of the mangle table. Therefore the NFQUEUE rule should be the last one so that we never skip any of the other processing. Signed-off-by: Michael Tremer commit 2438c6c2497015e92e823ecd2fbe9071a2cda575 Author: Michael Tremer Date: Tue Sep 10 11:35:18 2024 +0200 ids.cgi: Fix detection for the Suricata process We don't seem to have a PID file any more. Signed-off-by: Michael Tremer commit d3db0465703fe15855b02c3487859c8ca5a0db2b Author: Michael Tremer Date: Tue Sep 10 11:24:01 2024 +0200 ids.cgi: Remove box from the top section Signed-off-by: Michael Tremer commit d2f7d18e338975fa5d6a6f89b3eb86378e124612 Author: Michael Tremer Date: Tue Sep 10 11:22:59 2024 +0200 ids.cgi: Sort whitelist entries Signed-off-by: Michael Tremer commit 891702cad16def266ab4ab1e8dde79367dd3d140 Author: Michael Tremer Date: Tue Sep 10 11:17:33 2024 +0200 ids.cgi: Use new-style table for whitelist entries Signed-off-by: Michael Tremer commit 119cb837067ab16f6bf6ea88f512f8f8c38ea49c Author: Michael Tremer Date: Tue Sep 10 11:09:58 2024 +0200 ids.cgi: Use new style tables for rulesets Signed-off-by: Michael Tremer commit 50f3e2a534d99ad4606535709e02f40ac89260fd Author: Michael Tremer Date: Tue Sep 10 11:01:52 2024 +0200 suricata: Fix broken spacing in the settings section Signed-off-by: Michael Tremer commit 1b7d1abdf0978be4dfd57f339313ce811322aaf9 Author: Michael Tremer Date: Tue Sep 10 10:50:15 2024 +0200 suricata: Add option to scan WireGuard Signed-off-by: Michael Tremer commit 72d501f9235e290c974b2e4207b822b164d3a2fc Author: Michael Tremer Date: Tue Sep 10 10:42:11 2024 +0200 suricata: Don't load /var/ipfire/ethernet/settings We no longer need this directly as it is being pulled in from the network functions. Signed-off-by: Michael Tremer commit eb3156ed6b4a1de646259295db47c6cbeaa438ae Author: Michael Tremer Date: Tue Sep 10 10:41:19 2024 +0200 suricata: Remove superfluous bits from the initscript I don't know why these hacks are here. Signed-off-by: Michael Tremer commit 79cce701a94fb903e94838faf4c2e1016a24ba62 Author: Michael Tremer Date: Tue Sep 10 10:40:28 2024 +0200 suricata: Restore the interface selection Signed-off-by: Michael Tremer commit 7e1c564ec8f25cb00c49a5ceecdb004c0b186555 Author: Michael Tremer Date: Mon Sep 9 23:08:11 2024 +0200 suricata: Start the new watcher in the background Signed-off-by: Michael Tremer commit 17887e69a82dc92880136940ccdff1254c612233 Author: Michael Tremer Date: Mon Sep 9 20:09:22 2024 +0200 suricata: Add a watcher to restart on unexpected termination This patch adds a watcher process that will restart suricata when it is being killed by SIGKILL (e.g. by the OOM killer) or after a SEGV. Signed-off-by: Michael Tremer commit e088c2115843cb6d70ea5bc21af818f5dbd7e822 Author: Michael Tremer Date: Mon Sep 9 19:38:47 2024 +0200 suricata: Be more efficient with marks This patch changes that we introduce a new mark which allows us to identify any newly bypassed connections and permanently store the bypass flag. We also only restore marks from the connection tracking when a packet has no marks, yet. Tested-by: Adolf Belka Signed-off-by: Michael Tremer commit 54a58a2891910ece5174ec8f20504ae2f80841e2 Author: Michael Tremer Date: Mon Sep 9 19:37:56 2024 +0200 suricata: Replace removed CPU count function Signed-off-by: Michael Tremer commit 84a73d5f3997be2f1907c5eb4ad7a7069611ab4a Author: Michael Tremer Date: Mon Sep 9 12:46:23 2024 +0200 suricata: Add whitelist to iptables This allows us to workaround better against any problems in Suricata because we never send any whitelisted packets to the IPS in the first place. Signed-off-by: Michael Tremer