Development March 2019

development@lists.ipfire.org

17 participants
64 discussions

IPFire meets Suricata - Call for tester
by Stefan Schantl 05 Mar '19

05 Mar '19

Hello list followers, some time ago development for the new implementation of the Intrusion Detection functionality in IPFire has been started. The main goal, in a nutshell, was to give IPFire a modern, feature-rich and user-friendly Intrusion Detection Engine. During this progress, the detection framework has been replaced - now suricata is used instead of snort. Suricata uses a very modern and multi-threaded detection engine with support to perform actions on malicious traffic. So it provides the functionality of detecting any kind of intrusion attempts and the ability of guardian to block them under the same hood. It was a lot of work, but finaly I'm happy to announce the first test version. It is almost feature complete and without any kind of bigger issues. Because Intrusion Detection is a key feature of a firewall system, a lot of testing is required until the new implementation can become part of IPFire - therefore we need your help! Download the test image ( https://people.ipfire.org/~stevee/suricata/Images/), do a lot of hard testing and provide your feedback or suggestions on the develoment mailing list (https://lists.ipfire.org/mailman/listinfo/development). If you find any bugs please file them in the IPFire Bugtracker ( https://bugzilla.ipfire.org/). Many thanks in advance, -Stefan

7 49

[PATCH] ipset: Update to version 7.1
by Erik Kapfer 03 Mar '19

03 Mar '19

Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- config/rootfiles/common/ipset | 7 ++++--- lfs/ipset | 6 +++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/ipset b/config/rootfiles/common/ipset index 24f5e95f5..b3fcb640b 100644 --- a/config/rootfiles/common/ipset +++ b/config/rootfiles/common/ipset @@ -3,6 +3,7 @@ etc/ipset #usr/include/libipset/args.h #usr/include/libipset/data.h #usr/include/libipset/errcode.h +#usr/include/libipset/ipset.h #usr/include/libipset/linux_ip_set.h #usr/include/libipset/linux_ip_set_bitmap.h #usr/include/libipset/linux_ip_set_hash.h @@ -16,12 +17,12 @@ etc/ipset #usr/include/libipset/session.h #usr/include/libipset/transport.h #usr/include/libipset/types.h -#usr/include/libipset/ui.h #usr/include/libipset/utils.h #usr/lib/libipset.la #usr/lib/libipset.so -usr/lib/libipset.so.11 -usr/lib/libipset.so.11.1.0 +usr/lib/libipset.so.13 +usr/lib/libipset.so.13.1.0 #usr/lib/pkgconfig/libipset.pc usr/sbin/ipset +#usr/share/man/man3/libipset.3 #usr/share/man/man8/ipset.8 diff --git a/lfs/ipset b/lfs/ipset index d33e9327f..3382c668c 100644 --- a/lfs/ipset +++ b/lfs/ipset @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 6.38 +VER = 7.1 THISAPP = ipset-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0e5d9c85f6b78e7dff0c996e2900574b +$(DL_FILE)_MD5 = 72b477d1ce076d681b0799f88280f2f3 install : $(TARGET) -- 2.12.2

2 1

[PATCH 00/20] Suricata Configuration Updates
by Michael Tremer 03 Mar '19

03 Mar '19

I have worked on suricata's configuration. My objective was to use more system resources (because suricata did not use much RAM, etc.) to make it faster and to be able to have some deeper decoding and matching. Please review these changes and let me know what you think. All in all, suricata should not use more than 1G of RAM which I think is a very good amount. If your system is weaker than that, there is no point in running an IPS. On my system in my office, this runs with a hand full of rules enabled from the Emerging Threats Community set at around 110MB of RAM. Michael Tremer (20): Revert "Suricata: detect DNS events on port 853, too" suricata: Set max-pending-packets to 1024 suricata: Set default packet size to 1514 suricata: Set detection profile to high suricata: Drop profiling section from configuration suricata: Drop some commented stuff from configuration suricata: Drop sections that require Rust suricata: Configure HTTP decoder suricata: Allow 32MB of RAM for DNS decoding suricata: Drop parsers I have never heard of suricata: We do not use any IP reputation lists suricata: Log to syslog suricata: Use the correct path for the magic database suricata: Use 64MB of RAM for defragmentation suricata: Use up to 256MB of RAM for the flow cache suricata: Log to syslog like a normal process suricata: Increase memory size for the stream engine suricata: Disable decoding for Teredo suricata: Start capture first and then load rules suricata: Fix syntax error config/etc/syslog.conf | 2 +- config/suricata/suricata.yaml | 282 +++++------------------------------------- 2 files changed, 30 insertions(+), 254 deletions(-) -- 2.12.2

2 26

[PATCH] libcap-ng: Update to 0.7.9
by Stefan Schantl 03 Mar '19

03 Mar '19

* Re-enabled testsuite Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- libcap-ng/libcap-ng.nm | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libcap-ng/libcap-ng.nm b/libcap-ng/libcap-ng.nm index 54e0e20a9..ddc640d06 100644 --- a/libcap-ng/libcap-ng.nm +++ b/libcap-ng/libcap-ng.nm @@ -4,7 +4,7 @@ ############################################################################### name = libcap-ng -version = 0.7.4 +version = 0.7.9 release = 1 groups = System/Libraries @@ -25,7 +25,9 @@ build python end - # The testsuite is broken by the package developers + test + make check + end end packages -- 2.20.1

1 0

[PATCH] Bug 12008 - Typo in 'proxy.cgi' leads to wrong path for 'basic_ldap_auth'
by Matthias Fischer 03 Mar '19

03 Mar '19

Hi, This should fix https://bugzilla.ipfire.org/show_bug.cgi?id=12008 Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/proxy.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index 9082a7994..6daa7fbd2 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -101,7 +101,7 @@ my $cre_svhosts = "${General::swroot}/proxy/advanced/cre/supervisors"; my $identhosts = "$identdir/hosts"; -my $authdir = "/usr/lib/squid/"; +my $authdir = "/usr/lib/squid"; my $errordir = "/usr/lib/squid/errors"; my $acl_src_subnets = "$acldir/src_subnets.acl"; -- 2.18.0

1 0

[PATCH] tar: Update to 1.32
by Matthias Fischer 02 Mar '19

02 Mar '19

For details see: http://git.savannah.gnu.org/cgit/tar.git/log/ Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/tar | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tar b/lfs/tar index 953613d51..f5c280fb2 100644 --- a/lfs/tar +++ b/lfs/tar @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.31 +VER = 1.32 THISAPP = tar-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 77afa35b696c8d760331fa0e12c2fac9 +$(DL_FILE)_MD5 = 17917356fff5cb4bd3cd5a6c3e727b05 install : $(TARGET) -- 2.18.0

1 0

[PATCH] bind: Update to 9.11.6
by Matthias Fischer 02 Mar '19

02 Mar '19

For details see: http://ftp.isc.org/isc/bind9/9.11.6/RELEASE-NOTES-bind-9.11.6.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 14 +++++++------- lfs/bind | 7 ++++--- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index bbe0e0741..8c8a55d19 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -266,27 +266,27 @@ usr/bin/nsupdate #usr/lib/libbind9.la #usr/lib/libbind9.so usr/lib/libbind9.so.161 -usr/lib/libbind9.so.161.0.0 +usr/lib/libbind9.so.161.0.1 #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libdns.so.1104 -usr/lib/libdns.so.1104.0.1 +usr/lib/libdns.so.1105 +usr/lib/libdns.so.1105.0.0 #usr/lib/libisc.la #usr/lib/libisc.so usr/lib/libisc.so.1100 -usr/lib/libisc.so.1100.0.0 +usr/lib/libisc.so.1100.0.1 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 -usr/lib/libisccc.so.161.0.0 +usr/lib/libisccc.so.161.0.1 #usr/lib/libisccfg.la #usr/lib/libisccfg.so usr/lib/libisccfg.so.163 -usr/lib/libisccfg.so.163.0.0 +usr/lib/libisccfg.so.163.0.1 #usr/lib/liblwres.la #usr/lib/liblwres.so usr/lib/liblwres.so.161 -usr/lib/liblwres.so.161.0.0 +usr/lib/liblwres.so.161.0.1 #usr/share/man/man1/dig.1 #usr/share/man/man1/host.1 #usr/share/man/man1/nslookup.1 diff --git a/lfs/bind b/lfs/bind index 44b649fcb..f2286fe1f 100644 --- a/lfs/bind +++ b/lfs/bind @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 9.11.5-P1 +VER = 9.11.6 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2825d818db51008f88a0030507edfa8a +$(DL_FILE)_MD5 = 4882bd3eeef779e05b515b32354cc081 install : $(TARGET) @@ -78,6 +78,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --prefix=/usr \ --enable-threads \ --with-libtool \ + --without-python \ --disable-static cd $(DIR_APP) && make -C lib/isc install cd $(DIR_APP) && make -C lib/dns install -- 2.18.0

1 0

[PATCH] squid: Update to 4.6
by Matthias Fischer 02 Mar '19

02 Mar '19

For details see: http://www.squid-cache.org/Versions/v4/changesets/ The 'configure'-option "--disable-ipv6" was removed, it is no longer necessary. See: https://lists.ipfire.org/pipermail/development/2016-April/002046.html "The --disable-ipv6 build option is now deprecated. ... Squid-3.5.7 and later will perform IPv6 availability tests on startup in all builds. - Where IPv6 is unavailable Squid will continue exactly as it would have had the build option not been used. These Squid can have the build option removed now." The warning message concerning a "BCP 177 violation" while starting 'squid' can be ignored. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 9 ++++----- ...rs.patch => squid-4.6-fix-max-file-descriptors.patch} | 0 2 files changed, 4 insertions(+), 5 deletions(-) rename src/patches/squid/{squid-4.5-fix-max-file-descriptors.patch => squid-4.6-fix-max-file-descriptors.patch} (100%) diff --git a/lfs/squid b/lfs/squid index 6033ab394..0115cad82 100644 --- a/lfs/squid +++ b/lfs/squid @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.5 +VER = 4.6 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8275da5846f9f2243ad2625e5aef2ee0 +$(DL_FILE)_MD5 = e25e7cc37754ad14d8aa368c0c210e54 install : $(TARGET) @@ -72,7 +72,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-4.5-fix-max-file-descriptors.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-4.6-fix-max-file-descriptors.patch cd $(DIR_APP) && autoreconf -vfi cd $(DIR_APP)/libltdl && autoreconf -vfi @@ -91,7 +91,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --disable-kqueue \ --disable-esi \ --disable-arch-native \ - --enable-ipv6 \ --enable-poll \ --enable-ident-lookups \ --enable-storeio=aufs,diskd,ufs \ diff --git a/src/patches/squid/squid-4.5-fix-max-file-descriptors.patch b/src/patches/squid/squid-4.6-fix-max-file-descriptors.patch similarity index 100% rename from src/patches/squid/squid-4.5-fix-max-file-descriptors.patch rename to src/patches/squid/squid-4.6-fix-max-file-descriptors.patch -- 2.18.0

1 0

Re: Re: [PATCH] suricata: Run as non-root user
by Michael Tremer 02 Mar '19

02 Mar '19

Please also note this: https://bugzilla.ipfire.org/show_bug.cgi?id=12013

1 0

[PATCH] suricata: Run as non-root user
by Michael Tremer 02 Mar '19

02 Mar '19

This patch does not have any effect (yet) and is untested because suricata needs to be built against libcap-ng which is currently not being packaged for IPFire. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/suricata/suricata.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 8b4ab8c3b..3701fe9c6 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -268,6 +268,15 @@ asn1-max-frames: 256 ## ############################################################################## +## +## Run Options +## + +# Run suricata as user and group. +run-as: + user: nobody + group: nobody + # Suricata core dump configuration. Limits the size of the core dump file to # approximately max-dump. The actual core dump size will be a multiple of the # page size. Core dumps that would be larger than max-dump are truncated. On -- 2.12.2

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2019