IPFire-SCM April 2020

ipfire-scm@lists.ipfire.org

1 participants
46 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 21be3871b9ac2ca3d5d744c22890f55cdf334006
by Arne Fitzenreiter 07 Apr '20

07 Apr '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 21be3871b9ac2ca3d5d744c22890f55cdf334006 (commit) via bb90622c2cfdd7b3bbbabcdbba8a573a36d9edc1 (commit) via 154bb705b1b3ce52c9916457379321649bedde3e (commit) via cce7aa9bb8252e00a89c93ca0cc19ecd8833f036 (commit) via 1b6b8d97aac8a8056a4ef5c9d571a1947551e17f (commit) via e4013c9dabd55f399b57939a4ad9b5192aac8077 (commit) from e698090e7f696923ff146b272b587a3eeca34c6c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 21be3871b9ac2ca3d5d744c22890f55cdf334006 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 7 08:59:32 2020 +0000 core143: add zoneconf.cgi Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit bb90622c2cfdd7b3bbbabcdbba8a573a36d9edc1 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 6 17:38:38 2020 +0000 zoneconf.cgi: Skip checks for non-existing zones On systems with RED on PPP and no BLUE or ORANGE zones, there would always be an error when handling non-existant input. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 154bb705b1b3ce52c9916457379321649bedde3e Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Apr 6 18:42:35 2020 +0200 pcengines-apu-firmware: update to v4.11.0.5 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> Reviewed-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit cce7aa9bb8252e00a89c93ca0cc19ecd8833f036 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 7 08:57:50 2020 +0000 core143: add unbmound initskript Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 1b6b8d97aac8a8056a4ef5c9d571a1947551e17f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Mon Apr 6 15:10:25 2020 +0000 unbound: Set domains with local data into type transparent mode Records which are from the same domain than the IPFire hostname might not be returned by unbound. This change explicitely instructs unbound to check local data before checking the global DNS. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit e4013c9dabd55f399b57939a4ad9b5192aac8077 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 7 08:54:27 2020 +0000 core143: add suricata http port changes Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/143/filelists/files | 4 ++ config/rootfiles/core/143/update.sh | 7 +++- config/suricata/suricata-generate-http-ports-file | 47 ----------------------- html/cgi-bin/zoneconf.cgi | 2 + lfs/pcengines-apu-firmware | 21 ++++++---- src/initscripts/system/unbound | 12 +++++- 6 files changed, 35 insertions(+), 58 deletions(-) delete mode 100644 config/suricata/suricata-generate-http-ports-file Difference in files: diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index 816fffe9a..9cb36e78c 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -4,6 +4,7 @@ srv/web/ipfire/cgi-bin/credits.cgi var/ipfire/langs etc/rc.d/init.d/firewall etc/rc.d/init.d/localnet +etc/rc.d/init.d/unbound etc/suricata/suricata.yaml srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/fireinfo.cgi @@ -11,8 +12,11 @@ srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/mail.cgi srv/web/ipfire/cgi-bin/netother.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi +srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi +srv/web/ipfire/cgi-bin/zoneconf.cgi usr/lib/firewall/rules.pl +usr/sbin/convert-snort var/ipfire/backup/bin/backup.pl var/ipfire/backup/include var/ipfire/ids-functions.pl diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index cb07bbb59..9cd426447 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -75,6 +75,11 @@ telinit u # Apply local configuration to sshd_config /usr/local/bin/sshctrl +# Generate new http ports file for suricata +perl -e "require '/var/ipfire/ids-functions.pl'; \ + &IDS::generate_http_ports_file(); \ + &IDS::set_ownership(\"\$IDS::http_ports_file\"); " + # Start services /usr/local/bin/ipsecctrl S /etc/init.d/unbound restart @@ -100,8 +105,6 @@ done # Filesytem cleanup /usr/local/bin/filesystem-cleanup -# Start services - # This update needs a reboot... #touch /var/run/need_reboot diff --git a/config/suricata/suricata-generate-http-ports-file b/config/suricata/suricata-generate-http-ports-file deleted file mode 100644 index f0d6bb823..000000000 --- a/config/suricata/suricata-generate-http-ports-file +++ /dev/null @@ -1,47 +0,0 @@ -#!/usr/bin/perl -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2012 IPFire Development Team <info(a)ipfire.org> # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -use strict; - -require '/var/ipfire/general-functions.pl'; -require "${General::swroot}/ids-functions.pl"; - -exit unless(-f $IDS::ids_settings_file and -f $IDS::rules_settings_file); - -# -## Step 1: Generate and write the HTTP ports file. -# - -# Call subfunction to generate the HTTP ports file. -&IDS::generate_http_ports_file(); - -# Set correct ownership. -&IDS::set_ownership("$IDS::http_ports_file"); - -# -## Step 2: Restart suricata if necessary. -# - -# Check if the IDS should be started. -if(&IDS::ids_is_running()) { - # Call suricatactrl and reload the rules. - &IDS::call_suricatactrl("restart"); -} diff --git a/html/cgi-bin/zoneconf.cgi b/html/cgi-bin/zoneconf.cgi index 6b8642818..d99a3e611 100644 --- a/html/cgi-bin/zoneconf.cgi +++ b/html/cgi-bin/zoneconf.cgi @@ -211,6 +211,8 @@ if ($cgiparams{"ACTION"} eq $Lang::tr{"save"}) { my $mac = $_->[0]; my $nic_access = $cgiparams{"ACCESS $uc $mac"}; + next unless ($nic_access); + if ($nic_access ne "NONE") { if ($VALIDATE_nic_check{"RESTRICT $mac"}) { # If this interface is already assigned to RED in PPP mode, throw an error $VALIDATE_error = $Lang::tr{"zoneconf val ppp assignment error"}; diff --git a/lfs/pcengines-apu-firmware b/lfs/pcengines-apu-firmware index dd76004f8..e430ad9a2 100644 --- a/lfs/pcengines-apu-firmware +++ b/lfs/pcengines-apu-firmware @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,14 +24,14 @@ include Config -VER = 4.10.0.3 +VER = 4.11.0.5 THISAPP = pcengines-apu-firmware-$(VER) DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = pcengines-apu-firmware -PAK_VER = 4 +PAK_VER = 5 SUP_ARCH = i586 x86_64 DEPS = firmware-update @@ -53,11 +53,11 @@ apu3_v$(VER).rom = $(DL_FROM)/apu3_v$(VER).rom apu4_v$(VER).rom = $(DL_FROM)/apu4_v$(VER).rom apu5_v$(VER).rom = $(DL_FROM)/apu5_v$(VER).rom -apu1_v$(VER).rom_MD5 = f996d2272685683b1bf8be1f27b44f18 -apu2_v$(VER).rom_MD5 = 1ec2df4c0f9be2443192fead8e3b49e9 -apu3_v$(VER).rom_MD5 = 4a5cee9b621432627d7f3dcbb6191904 -apu4_v$(VER).rom_MD5 = a4a8bd06ebfa88907f5a4ddb6d7c3edc -apu5_v$(VER).rom_MD5 = c389d490d02810bf65f0f3abb461070e +apu1_v$(VER).rom_MD5 = eb9513cdb9bb212db524307d71d9f87c +apu2_v$(VER).rom_MD5 = e3ce78e1cbc1eb35b10d97349afabf04 +apu3_v$(VER).rom_MD5 = 42ece2873efc4a4b86bb507df40423c6 +apu4_v$(VER).rom_MD5 = e5eb7a15efbfc1a434d3bd48d1bc5062 +apu5_v$(VER).rom_MD5 = f2924f98bbb1e2816760103ab045a175 install : $(TARGET) @@ -96,3 +96,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) /lib/firmware/pcengines/apu @$(POSTBUILD) +eb9513cdb9bb212db524307d71d9f87c cache/apu1_v4.11.0.5.rom +e3ce78e1cbc1eb35b10d97349afabf04 cache/apu2_v4.11.0.5.rom +42ece2873efc4a4b86bb507df40423c6 cache/apu3_v4.11.0.5.rom +e5eb7a15efbfc1a434d3bd48d1bc5062 cache/apu4_v4.11.0.5.rom +f2924f98bbb1e2816760103ab045a175 cache/apu5_v4.11.0.5.rom diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index 1cf26ec0e..35477ae28 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -72,8 +72,18 @@ write_hosts_conf() { echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${HOSTNAME}\"" done - # Add all hosts local enabled address hostname domainname generateptr + + # Find all unique domain names + while IFS="," read -r enabled address hostname domainname generateptr; do + [ "${enabled}" = "on" ] || continue + + echo "${domainname}" + done < /var/ipfire/main/hosts | sort -u | while read -r domainname; do + echo "local-zone: ${domainname} typetransparent" + done + + # Add all hosts while IFS="," read -r enabled address hostname domainname generateptr; do [ "${enabled}" = "on" ] || continue hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. e698090e7f696923ff146b272b587a3eeca34c6c
by Arne Fitzenreiter 06 Apr '20

06 Apr '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via e698090e7f696923ff146b272b587a3eeca34c6c (commit) via 6084e66e70bc5a8f598029b075eeda1fc842fa00 (commit) via 1622e5c1f3781f1b6e370cb540ecabe17383acad (commit) from b563d5bd69c862c9ae1dd53fb1acff3d76af8761 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e698090e7f696923ff146b272b587a3eeca34c6c Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Apr 3 16:25:01 2020 +0200 IDS: Dynamically generate and import the HTTP ports. With this commit suricata reads the HTTP port declarations from a newly introduced external file (/var/ipfire/suricata/suricata-http-ports.yaml). This file dynamically will be generated. HTTP ports always are the default port "80" and "81" for update Accelerator and HTTP access to the WUI. In case the Web-proxy is used, the configured proxy port and/or Transparent Proxy port also will be declared as a HTTP port and written to that file. In case one of the proxy ports will be changed, the HTTP port file will be re-generated and suricate restarted if launched. Also if an old backup with snort will be restored the convert script handles the generation of the HTTP ports file. Finally the suricata-generate-http-ports-file as a tiny script which simply generates the http ports file and needs to be launched during the installation of a core update. (The script will no be required anymore, so it could be deleted afterwards.) Fixes #12308. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 6084e66e70bc5a8f598029b075eeda1fc842fa00 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Sun Apr 5 13:03:24 2020 +0200 suricata.yaml: Re-add EVE log section. Hopefully the EVE log will display some more content when trying to debug suricata events and rules. Fixes #12315. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Acked-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 1622e5c1f3781f1b6e370cb540ecabe17383acad Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Mon Apr 6 14:34:21 2020 +0200 ids.cgi: Fix logic if suricata needs to be restarted. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/ids-functions.pl | 51 +++++ config/suricata/convert-snort | 18 +- ...sids-file => suricata-generate-http-ports-file} | 27 +-- config/suricata/suricata.yaml | 213 ++++++++++++++++++++- html/cgi-bin/ids.cgi | 17 +- html/cgi-bin/proxy.cgi | 36 +++- 6 files changed, 329 insertions(+), 33 deletions(-) copy config/suricata/{convert-ids-modifysids-file => suricata-generate-http-ports-file} (73%) Difference in files: diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index 7a2d98f03..f124b12be 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -37,6 +37,9 @@ our $homenet_file = "$settingsdir/suricata-homenet.yaml"; # File where the addresses of the used DNS servers are stored. our $dns_servers_file = "$settingsdir/suricata-dns-servers.yaml"; +# File where the HTTP ports definition is stored. +our $http_ports_file = "$settingsdir/suricata-http-ports.yaml"; + # File which contains the enabled sids. our $enabled_sids_file = "$settingsdir/oinkmaster-enabled-sids.conf"; @@ -89,6 +92,10 @@ my @suricatactrl_cmds = ( 'start', 'stop', 'restart', 'reload', 'fix-rules-dir', # Array with supported cron intervals. my @cron_intervals = ('off', 'daily', 'weekly' ); +# Array which contains the HTTP ports, which statically will be declared as HTTP_PORTS in the +# http_ports_file. +my @http_ports = ('80', '81'); + # ## Function to check and create all IDS related files, if the does not exist. # @@ -753,6 +760,50 @@ sub generate_dns_servers_file() { close(FILE); } +# +# Function to generate and write the file which contains the HTTP_PORTS definition. +# +sub generate_http_ports_file() { + my %proxysettings; + + # Read-in proxy settings + &General::readhash("${General::swroot}/proxy/advanced/settings", \%proxysettings); + + # Check if the proxy is enabled. + if (( -e "${General::swroot}/proxy/enable") || (-e "${General::swroot}/proxy/enable_blue")) { + # Add the proxy port to the array of HTTP ports. + push(@http_ports, $proxysettings{'PROXY_PORT'}); + } + + # Check if the transparent mode of the proxy is enabled. + if ((-e "${General::swroot}/proxy/transparent") || (-e "${General::swroot}/proxy/transparent_blue")) { + # Add the transparent proxy port to the array of HTTP ports. + push(@http_ports, $proxysettings{'TRANSPARENT_PORT'}); + } + + # Format HTTP_PORTS declaration. + my $line = ""; + + # Generate line which will be written to the http ports file. + $line = join(",", @http_ports); + + # Open file to store the HTTP_PORTS. + open(FILE, ">$http_ports_file") or die "Could not open $http_ports_file. $!\n"; + + # Print yaml header. + print FILE "%YAML 1.1\n"; + print FILE "---\n\n"; + + # Print notice about autogenerated file. + print FILE "#Autogenerated file. Any custom changes will be overwritten!\n"; + + # Print the generated HTTP_PORTS declaration to the file. + print FILE "HTTP_PORTS:\t\"[$line]\"\n"; + + # Close file handle. + close(FILE); +} + # ## Function to generate and write the file for used rulefiles. # diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort index ee52548e9..3e938137e 100644 --- a/config/suricata/convert-snort +++ b/config/suricata/convert-snort @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2019 IPFire Development Team <info(a)ipfire.org> # +# Copyright (C) 2020 IPFire Development Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -298,7 +298,17 @@ if (-f $IDS::rulestarball) { &IDS::set_ownership("$IDS::dns_servers_file"); # -## Step 11: Setup automatic ruleset updates. +## Step 11: Generate file which contains the HTTP ports. +# + +# Call subfunction to generate the file. +&IDS::generate_http_ports_file(); + +# Set correct ownership for the http_ports_file. +&IDS::set_ownership("$IDS::http_ports_file"); + +# +## Step 12: Setup automatic ruleset updates. # # Check if a ruleset is configured. @@ -308,7 +318,7 @@ if($rulessettings{"RULES"}) { } # -## Step 12: Grab used ruleset files from snort config file and convert +## Step 13: Grab used ruleset files from snort config file and convert ## them into the new format. # @@ -354,7 +364,7 @@ close(SNORTCONF); &IDS::write_used_rulefiles_file(@enabled_rule_files); # -## Step 13: Start the IDS if enabled. +## Step 14: Start the IDS if enabled. # # Check if the IDS should be started. diff --git a/config/suricata/suricata-generate-http-ports-file b/config/suricata/suricata-generate-http-ports-file new file mode 100644 index 000000000..f0d6bb823 --- /dev/null +++ b/config/suricata/suricata-generate-http-ports-file @@ -0,0 +1,47 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2012 IPFire Development Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/ids-functions.pl"; + +exit unless(-f $IDS::ids_settings_file and -f $IDS::rules_settings_file); + +# +## Step 1: Generate and write the HTTP ports file. +# + +# Call subfunction to generate the HTTP ports file. +&IDS::generate_http_ports_file(); + +# Set correct ownership. +&IDS::set_ownership("$IDS::http_ports_file"); + +# +## Step 2: Restart suricata if necessary. +# + +# Check if the IDS should be started. +if(&IDS::ids_is_running()) { + # Call suricatactrl and reload the rules. + &IDS::call_suricatactrl("restart"); +} diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 54016a887..1f33ea0f3 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -30,7 +30,9 @@ vars: ENIP_SERVER: "$HOME_NET" port-groups: - HTTP_PORTS: "[80,81]" + # Incluse HTTP_PORTS declaration from external file. + include: /var/ipfire/suricata/suricata-http-ports.yaml + SHELLCODE_PORTS: "!80" ORACLE_PORTS: 1521 SSH_PORTS: "[22,222]" @@ -90,6 +92,215 @@ outputs: threads: no # per thread stats #null-values: yes # print counters that have value 0 + # Extensible Event Format (nicknamed EVE) event log in JSON format + - eve-log: + enabled: no + filetype: regular #regular|syslog|unix_dgram|unix_stream|redis + filename: eve.json + #prefix: "@cee: " # prefix to prepend to each log entry + # the following are valid when type: syslog above + #identity: "suricata" + #facility: local5 + #level: Info ## possible levels: Emergency, Alert, Critical, + ## Error, Warning, Notice, Info, Debug + #redis: + # server: 127.0.0.1 + # port: 6379 + # async: true ## if redis replies are read asynchronously + # mode: list ## possible values: list|lpush (default), rpush, channel|publish + # ## lpush and rpush are using a Redis list. "list" is an alias for lpush + # ## publish is using a Redis channel. "channel" is an alias for publish + # key: suricata ## key or channel to use (default to suricata) + # Redis pipelining set up. This will enable to only do a query every + # 'batch-size' events. This should lower the latency induced by network + # connection at the cost of some memory. There is no flushing implemented + # so this setting as to be reserved to high traffic suricata. + # pipelining: + # enabled: yes ## set enable to yes to enable query pipelining + # batch-size: 10 ## number of entry to keep in buffer + + # Include top level metadata. Default yes. + #metadata: no + + # include the name of the input pcap file in pcap file processing mode + pcap-file: false + + # Community Flow ID + # Adds a 'community_id' field to EVE records. These are meant to give + # a records a predictable flow id that can be used to match records to + # output of other tools such as Bro. + # + # Takes a 'seed' that needs to be same across sensors and tools + # to make the id less predictable. + + # enable/disable the community id feature. + community-id: false + # Seed value for the ID output. Valid values are 0-65535. + community-id-seed: 0 + + # HTTP X-Forwarded-For support by adding an extra field or overwriting + # the source or destination IP address (depending on flow direction) + # with the one reported in the X-Forwarded-For HTTP header. This is + # helpful when reviewing alerts for traffic that is being reverse + # or forward proxied. + xff: + enabled: no + # Two operation modes are available, "extra-data" and "overwrite". + mode: extra-data + # Two proxy deployments are supported, "reverse" and "forward". In + # a "reverse" deployment the IP address used is the last one, in a + # "forward" deployment the first IP address is used. + deployment: reverse + # Header name where the actual IP address will be reported, if more + # than one IP address is present, the last IP address will be the + # one taken into consideration. + header: X-Forwarded-For + + types: + - alert: + # payload: yes # enable dumping payload in Base64 + # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log + # payload-printable: yes # enable dumping payload in printable (lossy) format + # packet: yes # enable dumping of packet (without stream segments) + # metadata: no # enable inclusion of app layer metadata with alert. Default yes + # http-body: yes # Requires metadata; enable dumping of http body in Base64 + # http-body-printable: yes # Requires metadata; enable dumping of http body in printable format + + # Enable the logging of tagged packets for rules using the + # "tag" keyword. + tagged-packets: yes + - anomaly: + # Anomaly log records describe unexpected conditions such + # as truncated packets, packets with invalid IP/UDP/TCP + # length values, and other events that render the packet + # invalid for further processing or describe unexpected + # behavior on an established stream. Networks which + # experience high occurrences of anomalies may experience + # packet processing degradation. + # + # Anomalies are reported for the following: + # 1. Decode: Values and conditions that are detected while + # decoding individual packets. This includes invalid or + # unexpected values for low-level protocol lengths as well + # as stream related events (TCP 3-way handshake issues, + # unexpected sequence number, etc). + # 2. Stream: This includes stream related events (TCP + # 3-way handshake issues, unexpected sequence number, + # etc). + # 3. Application layer: These denote application layer + # specific conditions that are unexpected, invalid or are + # unexpected given the application monitoring state. + # + # By default, anomaly logging is disabled. When anomaly + # logging is enabled, applayer anomaly reporting is + # enabled. + enabled: yes + # + # Choose one or more types of anomaly logging and whether to enable + # logging of the packet header for packet anomalies. + types: + # decode: no + # stream: no + # applayer: yes + #packethdr: no + - http: + extended: yes # enable this for extended logging information + # custom allows additional http fields to be included in eve-log + # the example below adds three additional fields when uncommented + #custom: [Accept-Encoding, Accept-Language, Authorization] + # set this value to one and only one among {both, request, response} + # to dump all http headers for every http request and/or response + # dump-all-headers: none + - dns: + # This configuration uses the new DNS logging format, + # the old configuration is still available: + # https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#d… + + # As of Suricata 5.0, version 2 of the eve dns output + # format is the default. + #version: 2 + + # Enable/disable this logger. Default: enabled. + #enabled: yes + + # Control logging of requests and responses: + # - requests: enable logging of DNS queries + # - responses: enable logging of DNS answers + # By default both requests and responses are logged. + #requests: no + #responses: no + + # Format of answer logging: + # - detailed: array item per answer + # - grouped: answers aggregated by type + # Default: all + #formats: [detailed, grouped] + + # Types to log, based on the query type. + # Default: all. + #types: [a, aaaa, cname, mx, ns, ptr, txt] + - tls: + extended: yes # enable this for extended logging information + # output TLS transaction where the session is resumed using a + # session id + #session-resumption: no + # custom allows to control which tls fields that are included + # in eve-log + #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s] + - files: + force-magic: no # force logging magic on all logged files + # force logging of checksums, available hash functions are md5, + # sha1 and sha256 + #force-hash: [md5] + #- drop: + # alerts: yes # log alerts that caused drops + # flows: all # start or all: 'start' logs only a single drop + # # per flow direction. All logs each dropped pkt. + - smtp: + #extended: yes # enable this for extended logging information + # this includes: bcc, message-id, subject, x_mailer, user-agent + # custom fields logging from the list: + # reply-to, bcc, message-id, subject, x-mailer, user-agent, received, + # x-originating-ip, in-reply-to, references, importance, priority, + # sensitivity, organization, content-md5, date + #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc] + # output md5 of fields: body, subject + # for the body you need to set app-layer.protocols.smtp.mime.body-md5 + # to yes + #md5: [body, subject] + + #- dnp3 + - ftp + #- rdp + - nfs + - smb + - tftp + - ikev2 + - krb5 + - snmp + #- sip + - dhcp: + enabled: yes + # When extended mode is on, all DHCP messages are logged + # with full detail. When extended mode is off (the + # default), just enough information to map a MAC address + # to an IP address is logged. + extended: no + - ssh + - stats: + totals: yes # stats for all threads merged together + threads: no # per thread stats + deltas: no # include delta values + # bi-directional flows + - flow + # uni-directional flows + #- netflow + + # Metadata event type. Triggered whenever a pktvar is saved + # and will include the pktvars, flowvars, flowbits and + # flowints. + #- metadata + logging: # The default log level, can be overridden in an output section. # Note that debug level logging will only be emitted if Suricata was diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index c3e5eefdb..bc31a341f 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -417,17 +417,17 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # Loop through the hash of idsrules. foreach my $rulefile(keys %idsrules) { + # Check if the state of the rulefile has been changed. + unless ($cgiparams{$rulefile} eq $idsrules{$rulefile}{'Rulefile'}{'State'}) { + # A restart of suricata is required to apply the changes of the used rulefiles. + $suricata_restart_required = 1; + } + # Check if the rulefile is enabled. if ($cgiparams{$rulefile} eq "on") { # Add rulefile to the array of enabled rulefiles. push(@enabled_rulefiles, $rulefile); - # Check if the state of the rulefile has been changed. - unless ($cgiparams{$rulefile} eq $idsrules{$rulefile}{'Rulefile'}{'State'}) { - # A restart of suricata is required to apply the changes of the used rulefiles. - $suricata_restart_required = 1; - } - # Drop item from cgiparams hash. delete $cgiparams{$rulefile}; } @@ -625,6 +625,9 @@ if ($cgiparams{'RULESET'} eq $Lang::tr{'save'}) { # Generate file to the store the DNS servers. &IDS::generate_dns_servers_file(); + # Generate file to store the HTTP ports. + &IDS::generate_http_ports_file(); + # Write the modify sid's file and pass the taken ruleaction. &IDS::write_modify_sids_file(); diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index 06aca579b..73646a5ae 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2013 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -37,6 +37,8 @@ require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/ids-functions.pl"; + my @squidversion = `/usr/sbin/squid -v`; my $http_port='81'; my $https_port='444'; @@ -550,6 +552,29 @@ ERROR: if ($proxysettings{'VALID'} eq 'yes') { + # Determine if suricata may needs to be restarted. + my $suricata_proxy_ports_changed; + + # Check if the IDS is running + if(&IDS::ids_is_running()) { + my %oldproxysettings; + + # Read-in current proxy settings and store them as oldsettings hash. + &General::readhash("${General::swroot}/proxy/advanced/settings", \%oldproxysettings); + + # Check if the proxy port has been changed. + unless ($proxysettings{'PROXY_PORT'} eq $oldproxysettings{'PROXY_PORT'}) { + # Port has changed, suricata needs to be adjusted. + $suricata_proxy_ports_changed = 1; + } + + # Check if the transparent port has been changed. + unless ($proxysettings{'TRANSPARENT_PORT'} eq $oldproxysettings{'TRANSPARENT_PORT'}) { + # Transparent port has changed, suricata needs to be adjusted. + $suricata_proxy_ports_changed = 1; + } + } + &write_acls; delete $proxysettings{'SRC_SUBNETS'}; @@ -627,6 +652,15 @@ ERROR: if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) { system('/usr/local/bin/squidctrl restart >/dev/null 2>&1'); } if ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}) { system('/usr/local/bin/squidctrl reconfigure >/dev/null 2>&1'); } + + # Check if the suricata_proxy_ports_changed flag has been set. + if ($suricata_proxy_ports_changed) { + # Re-generate HTTP ports file. + &IDS::generate_http_ports_file(); + + # Restart suricata. + &IDS::call_suricatactrl("restart"); + } } } hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. b563d5bd69c862c9ae1dd53fb1acff3d76af8761
by Arne Fitzenreiter 05 Apr '20

05 Apr '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via b563d5bd69c862c9ae1dd53fb1acff3d76af8761 (commit) via 7b97359b99add6f343a4687d5f2f6a8a86304b4f (commit) via 92206da35aef825891d5e46aeb28bb0cda043510 (commit) via 00a083aaf2003ef8f970a9c69ccf0e8020391176 (commit) from 2f8a33e182f981153a61568261ba4daf3cd7492b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b563d5bd69c862c9ae1dd53fb1acff3d76af8761 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Apr 5 07:58:07 2020 +0000 core143: add backup include and ids-functions Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 7b97359b99add6f343a4687d5f2f6a8a86304b4f Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Apr 3 16:59:12 2020 +0200 IDS: Add GREEN and BLUE addresses to the list of DNS servers. Fixes #12349. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 92206da35aef825891d5e46aeb28bb0cda043510 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Apr 3 12:50:04 2020 +0200 Backup: Add idsrules tarball. The tarball is required to generate and restore the IDS ruleset. Fixes #12319. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 00a083aaf2003ef8f970a9c69ccf0e8020391176 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Apr 3 12:50:03 2020 +0200 Backup: Add suricata rules-settings file. This file contains the configured ruleset and oinkcode settings and therefore needs to be backuped and restored. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/backup/include | 2 ++ config/cfgroot/ids-functions.pl | 15 +++++++++++++++ config/rootfiles/core/143/filelists/files | 2 ++ 3 files changed, 19 insertions(+) Difference in files: diff --git a/config/backup/include b/config/backup/include index 0153272f7..5db452cda 100644 --- a/config/backup/include +++ b/config/backup/include @@ -49,6 +49,7 @@ /var/ipfire/qos/bin/qos.sh /var/ipfire/suricata/*.conf /var/ipfire/suricata/*.yaml +/var/ipfire/suricata/rules-settings /var/ipfire/*/settings /var/ipfire/time/ /var/ipfire/urlfilter @@ -58,3 +59,4 @@ /var/log/rrd/* /var/log/rrd/collectd /var/log/vnstat +/var/tmp/idsrules.tar.gz diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index af8a927e0..7a2d98f03 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -711,13 +711,28 @@ sub generate_dns_servers_file() { # Get the used DNS servers. my @nameservers = &General::get_nameservers(); + # Get network settings. + my %netsettings; + &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); + # Format dns servers declaration. my $line = ""; # Check if the system has configured nameservers. if (@nameservers) { + # Add the GREEN address as DNS servers. + push(@nameservers, $netsettings{'GREEN_ADDRESS'}); + + # Check if a BLUE zone exists. + if ($netsettings{'BLUE_ADDRESS'}) { + # Add the BLUE address to the array of nameservers. + push(@nameservers, $netsettings{'BLUE_ADDRESS'}); + } + + # Generate the line which will be written to the DNS servers file. $line = join(",", @nameservers); } else { + # External net simply contains (any). $line = "\$EXTERNAL_NET"; } diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index 28c759fe3..816fffe9a 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -14,4 +14,6 @@ srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/firewall/rules.pl var/ipfire/backup/bin/backup.pl +var/ipfire/backup/include +var/ipfire/ids-functions.pl var/ipfire/suricata/oinkmaster.conf hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 2f8a33e182f981153a61568261ba4daf3cd7492b
by Arne Fitzenreiter 02 Apr '20

02 Apr '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 2f8a33e182f981153a61568261ba4daf3cd7492b (commit) from 702b59cd028018d0002d90f0ed9afbfa2248ed6a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2f8a33e182f981153a61568261ba4daf3cd7492b Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Apr 2 16:31:18 2020 +0000 suricata: increase dns flood trigger on slow lines unbound trigger the floodprotection at init. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/suricata/suricata.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index cb7ececb4..54016a887 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -224,7 +224,7 @@ app-layer: # How many unreplied DNS requests are considered a flood. # If the limit is reached, app-layer-event:dns.flooded; will match. - request-flood: 512 + request-flood: 2048 tcp: enabled: yes hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 702b59cd028018d0002d90f0ed9afbfa2248ed6a
by Arne Fitzenreiter 02 Apr '20

02 Apr '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 702b59cd028018d0002d90f0ed9afbfa2248ed6a (commit) from 0b0a3634cdb241335f629e3173b607c3f4c3f304 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 702b59cd028018d0002d90f0ed9afbfa2248ed6a Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Apr 2 16:28:39 2020 +0000 paks: fix meta size entry remove the doublequotes around the size because pakfire not accept this. fixes: #12348 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/Config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/lfs/Config b/lfs/Config index faf01ca1a..a278b0155 100644 --- a/lfs/Config +++ b/lfs/Config @@ -283,7 +283,7 @@ define PAK -e "s/VER/$(VER)/g" \ -e "s/RELEASE/$(PAK_VER)/g" \ -e "s/DEPS/$(DEPS)/g" \ - -e "s/SIZE/$$(stat --format=\"%s\" /install/packages/$(PROG)-$(VER)-$(PAK_VER).ipfire)/g" \ + -e "s/SIZE/$$(stat --format=%s /install/packages/$(PROG)-$(VER)-$(PAK_VER).ipfire)/g" \ < /usr/src/src/pakfire/meta > /install/packages/meta-$(PROG) endef hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0b0a3634cdb241335f629e3173b607c3f4c3f304
by Arne Fitzenreiter 01 Apr '20

01 Apr '20

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM April 2020