IPFire-SCM

ipfire-scm@lists.ipfire.org

7833 discussions

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 06a6788e51a863097fc2c6946767e8bf1b144e2f
by Arne Fitzenreiter 18 Feb '24

18 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 06a6788e51a863097fc2c6946767e8bf1b144e2f (commit) from 1d1f9a9a064b6423eb2f448d8c03213553adf085 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 06a6788e51a863097fc2c6946767e8bf1b144e2f Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Feb 18 07:59:18 2024 +0100 core184: fix rtl8812au module compression Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/184/update.sh | 4 ++++ 1 file changed, 4 insertions(+) Difference in files: diff --git a/config/rootfiles/core/184/update.sh b/config/rootfiles/core/184/update.sh index 3bf38ff8b..aa593047d 100644 --- a/config/rootfiles/core/184/update.sh +++ b/config/rootfiles/core/184/update.sh @@ -73,6 +73,10 @@ ldconfig # Filesytem cleanup /usr/local/bin/filesystem-cleanup +# fix module compression of rtl8812au +xz -d /lib/modules/6.6.15-ipfire/extra/wlan/8812au.ko.xz +xz --check=crc32 --lzma2=dict=512KiB /lib/modules/6.6.15-ipfire/extra/wlan/8812au.ko + # Apply local configuration to sshd_config /usr/local/bin/sshctrl hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5a1b6efa009684a1a3c5c8d3f63dc187d96345f5
by Peter Müller 17 Feb '24

17 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 5a1b6efa009684a1a3c5c8d3f63dc187d96345f5 (commit) from 0b29422c936281a555c710c3122a098a7acf3cce (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5a1b6efa009684a1a3c5c8d3f63dc187d96345f5 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 17 20:48:10 2024 +0000 libloc: Embed more recent database Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/libloc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Difference in files: diff --git a/lfs/libloc b/lfs/libloc index 5c67d1195..35a711286 100644 --- a/lfs/libloc +++ b/lfs/libloc @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config VER = 0.9.17 -DB_DATE = 2023-08-09 +DB_DATE = 2024-02-17 THISAPP = libloc-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -44,7 +44,7 @@ $(DL_FILE) = https://source.ipfire.org/releases/libloc/$(DL_F location-$(DB_DATE).db.xz = https://location.ipfire.org/databases/1/archive/location-$(DB_DATE).db.xz $(DL_FILE)_BLAKE2 = b0bf860ebaccd3cb49c58c066c430f7a1f936a2029957db9b88e22c04240af0268a8f6388e8ca512102f14033037a2ab8bbb93fe83e525b9859c790c5c382df4 -location-$(DB_DATE).db.xz_BLAKE2 = 24ad4dc2496d3c0a7fe645374a02c8d4bf4724796ccf4ed00d2de9adfaa08f31cb70314afa5d8f7b7acebd4ccbd4d1f8a15b8da09a27b0092d74412cf30aa721 +location-$(DB_DATE).db.xz_BLAKE2 = 36432bed306871e96a741d364fdefaa677d47245e38596d1c7fb6a8f0a143e3ffa549e16effa58289b5481220b0a2560255e75b0bfe53219b1400d6d250aa02b install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0b29422c936281a555c710c3122a098a7acf3cce
by Peter Müller 17 Feb '24

17 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0b29422c936281a555c710c3122a098a7acf3cce (commit) via d6511c820d09f7873780130b8054093fa43ba90c (commit) via 6336428ef8083719909e944d5785a8f498d7f84d (commit) via 2038b640e6c96a854b9ce47ed4872bcc6cab7272 (commit) via b8f2d9da4cb911061cd13c22b29b9b92c5d6a362 (commit) via ef2846e46d29fe5d1f434ff00821d6e29e118176 (commit) from 1ec11ba5150bfd4716c9a1081e4bb0c56f21e1be (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0b29422c936281a555c710c3122a098a7acf3cce Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 17 20:45:41 2024 +0000 Core Update 185: Remove orphaned uncritical non-library files See: https://patchwork.ipfire.org/project/ipfire/patch/c21b6fed-28cd-47ce-8a99-b… Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> commit d6511c820d09f7873780130b8054093fa43ba90c Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 17 20:42:28 2024 +0000 Core Update 185: Delete orphaned linux-firmware files See: https://patchwork.ipfire.org/project/ipfire/patch/c21b6fed-28cd-47ce-8a99-b… Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> commit 6336428ef8083719909e944d5785a8f498d7f84d Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 17 20:40:39 2024 +0000 Core Update 185: Ensure correct permissions of /etc/sudoers.d/ Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> commit 2038b640e6c96a854b9ce47ed4872bcc6cab7272 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 17 20:39:41 2024 +0000 Core Update 185: Ship forgotten linux-firmware files See: https://patchwork.ipfire.org/project/ipfire/patch/c21b6fed-28cd-47ce-8a99-b… Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> commit b8f2d9da4cb911061cd13c22b29b9b92c5d6a362 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 17 20:37:04 2024 +0000 Core Update 185: Restart ntp Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> commit ef2846e46d29fe5d1f434ff00821d6e29e118176 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 17 20:35:02 2024 +0000 Core Update 185: Ship libcap and all packages dependant on it See: https://patchwork.ipfire.org/project/ipfire/patch/c21b6fed-28cd-47ce-8a99-b… Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: .../{oldcore/154 => core/185}/filelists/arping | 0 config/rootfiles/core/185/filelists/files | 45 ++++++++++++++++++++++ .../{oldcore/106 => core/185}/filelists/iproute2 | 0 .../{oldcore/104 => core/185}/filelists/iputils | 0 .../{oldcore/104 => core/185}/filelists/libcap | 0 .../{oldcore/100 => core/185}/filelists/ntp | 0 config/rootfiles/core/185/update.sh | 35 ++++++++++++++++- 7 files changed, 79 insertions(+), 1 deletion(-) copy config/rootfiles/{oldcore/154 => core/185}/filelists/arping (100%) create mode 100644 config/rootfiles/core/185/filelists/files copy config/rootfiles/{oldcore/106 => core/185}/filelists/iproute2 (100%) copy config/rootfiles/{oldcore/104 => core/185}/filelists/iputils (100%) copy config/rootfiles/{oldcore/104 => core/185}/filelists/libcap (100%) copy config/rootfiles/{oldcore/100 => core/185}/filelists/ntp (100%) Difference in files: diff --git a/config/rootfiles/core/185/filelists/arping b/config/rootfiles/core/185/filelists/arping new file mode 120000 index 000000000..5662e8d92 --- /dev/null +++ b/config/rootfiles/core/185/filelists/arping @@ -0,0 +1 @@ +../../../common/arping \ No newline at end of file diff --git a/config/rootfiles/core/185/filelists/files b/config/rootfiles/core/185/filelists/files new file mode 100644 index 000000000..1fc68ec00 --- /dev/null +++ b/config/rootfiles/core/185/filelists/files @@ -0,0 +1,45 @@ +etc/sudoers.d/logwatch-mdadm +lib/firmware/brcm/BCM-0a5c-6410.hcd +lib/firmware/brcm/brcmfmac43012-sdio.bin +lib/firmware/brcm/brcmfmac43012-sdio.clm_blob +lib/firmware/brcm/brcmfmac43430-sdio.clm_blob +lib/firmware/brcm/brcmfmac43430-sdio.raspberrypi,model-zero-w.txt +lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m2-plus.txt +lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m2-ultra.txt +lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m2-zero.txt +lib/firmware/brcm/brcmfmac43430-sdio.sinovoip,bpi-m3.txt +lib/firmware/brcm/brcmfmac43455-sdio.clm_blob +lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,3-model-a-plus.txt +lib/firmware/brcm/brcmfmac43455-sdio.Raspberry_Pi_Foundation-Raspberry_Pi_4_Model_B.txt +lib/firmware/brcm/brcmfmac43455-sdio.Raspberry_Pi_Foundation-Raspberry_Pi_Compute_Module_4.txt +lib/firmware/brcm/brcmfmac4354-sdio.clm_blob +lib/firmware/brcm/brcmfmac4356-pcie.clm_blob +lib/firmware/brcm/brcmfmac4356-sdio.clm_blob +lib/firmware/brcm/brcmfmac4356-sdio.khadas,vim2.txt +lib/firmware/brcm/brcmfmac43570-pcie.clm_blob +lib/firmware/brcm/brcmfmac4373-sdio.clm_blob +lib/firmware/brcm/brcmfmac54591-pcie.bin +lib/firmware/brcm/brcmfmac54591-pcie.clm_blob +lib/firmware/cxgb4/t4-config.txt +lib/firmware/cxgb4/t5-config.txt +lib/firmware/cxgb4/t6-config.txt +lib/firmware/intel/ice/ddp/ice.pkg +lib/firmware/netronome/flower/nic_AMDA0058-0011_1x100.nffw +lib/firmware/netronome/flower/nic_AMDA0058-0011_2x40.nffw +lib/firmware/netronome/flower/nic_AMDA0058-0011_4x10_1x40.nffw +lib/firmware/netronome/flower/nic_AMDA0058-0011_8x10.nffw +lib/firmware/netronome/flower/nic_AMDA0058-0012_1x100.nffw +lib/firmware/netronome/flower/nic_AMDA0058-0012_2x40.nffw +lib/firmware/netronome/flower/nic_AMDA0058-0012_4x10_1x40.nffw +lib/firmware/netronome/flower/nic_AMDA0058-0012_8x10.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0011_1x100.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0011_2x40.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0011_4x10_1x40.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0011_8x10.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0012_1x100.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0012_2x40.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0012_4x10_1x40.nffw +lib/firmware/netronome/flower/nic_AMDA0078-0012_8x10.nffw +lib/firmware/nvidia/tegra124/vic.bin +lib/firmware/nvidia/tegra186/vic.bin +lib/firmware/nvidia/tegra210/vic.bin diff --git a/config/rootfiles/core/185/filelists/iproute2 b/config/rootfiles/core/185/filelists/iproute2 new file mode 120000 index 000000000..05f0f71fb --- /dev/null +++ b/config/rootfiles/core/185/filelists/iproute2 @@ -0,0 +1 @@ +../../../common/iproute2 \ No newline at end of file diff --git a/config/rootfiles/core/185/filelists/iputils b/config/rootfiles/core/185/filelists/iputils new file mode 120000 index 000000000..361c28f71 --- /dev/null +++ b/config/rootfiles/core/185/filelists/iputils @@ -0,0 +1 @@ +../../../common/iputils \ No newline at end of file diff --git a/config/rootfiles/core/185/filelists/libcap b/config/rootfiles/core/185/filelists/libcap new file mode 120000 index 000000000..ed67d950a --- /dev/null +++ b/config/rootfiles/core/185/filelists/libcap @@ -0,0 +1 @@ +../../../common/libcap \ No newline at end of file diff --git a/config/rootfiles/core/185/filelists/ntp b/config/rootfiles/core/185/filelists/ntp new file mode 120000 index 000000000..7542d86cb --- /dev/null +++ b/config/rootfiles/core/185/filelists/ntp @@ -0,0 +1 @@ +../../../common/ntp \ No newline at end of file diff --git a/config/rootfiles/core/185/update.sh b/config/rootfiles/core/185/update.sh index 3321567e3..903fe1753 100644 --- a/config/rootfiles/core/185/update.sh +++ b/config/rootfiles/core/185/update.sh @@ -17,7 +17,7 @@ # along with IPFire; if not, write to the Free Software # # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # # # -# Copyright (C) 2023 IPFire-Team <info(a)ipfire.org>. # +# Copyright (C) 2024 IPFire-Team <info(a)ipfire.org>. # # # ############################################################################ # @@ -32,11 +32,39 @@ for (( i=1; i<=$core; i++ )); do done # Stop services +/etc/init.d/ntp stop # Extract files extract_files # Remove files +rm -rvf \ + /etc/pango \ + /lib/firmware/ath10k/WCN3990/hw1.0/notice.txt_wlanmdsp \ + /lib/firmware/ath11k/IPQ6018/hw1.0/Notice.txt \ + /lib/firmware/ath11k/IPQ8074/hw2.0/Notice.txt \ + /lib/firmware/ath11k/QCA6390/hw2.0/Notice.txt \ + /lib/firmware/ath11k/QCN9074/hw1.0/Notice.txt \ + /lib/firmware/ath11k/WCN6855/hw2.0/Notice.txt \ + /lib/firmware/intel-ucode/06-86-04 \ + /lib/firmware/intel-ucode/06-86-05 \ + /sbin/xtables-multi \ + /srv/web/ipfire/html/themes/ipfire-rounded \ + /usr/lib/crda/pubkeys/linville.key.pub.pem \ + /usr/lib/grub/i386-pc/efiemu{32,64}.o \ + /usr/lib/grub/i386-pc/verifiers.* \ + /usr/lib/grub/i386-pc/verify.* \ + /usr/lib/grub/x86_64-efi/shim_lock.* \ + /usr/lib/grub/x86_64-efi/verifiers.* \ + /usr/lib/grub/x86_64-efi/verify.* \ + /usr/lib/snort_dynamic* \ + /usr/local/bin/snortctrl \ + /usr/share/usb_modeswitch/1033:0035 \ + /usr/share/vim/vim7* \ + /var/ipfire/geoip-functions.pl \ + /var/ipfire/dhcpc/dhcpcd-hooks/00-linux \ + /var/ipfire/dhcpc/dhcpcd-hooks/02-dump \ + /var/lib/location/tmp* # update linker config ldconfig @@ -50,10 +78,15 @@ ldconfig # Apply local configuration to sshd_config /usr/local/bin/sshctrl +# Fix permissions of /etc/sudoers.d/ +chmod -v 750 /etc/sudoers.d +chmod -v 640 /etc/sudoers.d/* + # Start services telinit u /etc/init.d/suricata restart /etc/init.d/unbound restart +/etc/init.d/ntp start # This update needs a reboot... #touch /var/run/need_reboot hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 1d1f9a9a064b6423eb2f448d8c03213553adf085
by Arne Fitzenreiter 17 Feb '24

17 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 1d1f9a9a064b6423eb2f448d8c03213553adf085 (commit) via 51fd73ea2b1c04204cfb3005425b5e9794d833e8 (commit) from c9c9580c4e5ef2e726ffe6368ae85b3209917ce1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1d1f9a9a064b6423eb2f448d8c03213553adf085 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Feb 17 19:46:34 2024 +0100 rtl8812au: fix module compression the kernel cannot load the compressed module so fix compression parameters. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 51fd73ea2b1c04204cfb3005425b5e9794d833e8 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Feb 16 16:17:47 2024 +0100 cpufrequtils: fix initskript for amd-pstate the initskript loads a test-modul for amd-pstate (which traces on intel) and off course reports errors if firmware settings are missing. this also fix the error at start because also amd-pstate doesn't support ondemand mode. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/cpufrequtils | 2 +- lfs/rtl8812au | 2 +- src/initscripts/packages/cpufreq | 45 ++++++++++++++++++++-------------------- 3 files changed, 25 insertions(+), 24 deletions(-) Difference in files: diff --git a/lfs/cpufrequtils b/lfs/cpufrequtils index dab2540142..4bd5d0e513 100644 --- a/lfs/cpufrequtils +++ b/lfs/cpufrequtils @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = cpufrequtils -PAK_VER = 12 +PAK_VER = 13 DEPS = diff --git a/lfs/rtl8812au b/lfs/rtl8812au index fd3128f426..b7f9b86577 100644 --- a/lfs/rtl8812au +++ b/lfs/rtl8812au @@ -87,7 +87,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) /lib/modules/$$(uname -r)$(KCFG)/build/certs/signing_key.pem \ /lib/modules/$$(uname -r)$(KCFG)/build/certs/signing_key.x509 \ $$f; \ - xz $$f; \ + xz --check=crc32 --lzma2=dict=512KiB $$f; \ install -m 644 $$f.xz $(MODPATH); \ done diff --git a/src/initscripts/packages/cpufreq b/src/initscripts/packages/cpufreq index beee532b50..f133f3488b 100644 --- a/src/initscripts/packages/cpufreq +++ b/src/initscripts/packages/cpufreq @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -22,13 +22,15 @@ . /etc/sysconfig/rc . ${rc_functions} +GOV="ondemand" + case "${1}" in start) boot_mesg -n "Starting cpufreq... " # try cpufreq hardware depend modules for i in $(find /lib/modules/$(uname -r)/kernel/drivers/cpufreq \ - ! -name speedstep-lib.ko.xz ! -name p4-clockmod.ko.xz ! -name "cpufreq_*" ! -name mperf.ko.xz | sort -d -r); do + ! -name speedstep-lib.ko.xz ! -name p4-clockmod.ko.xz ! -name amd-pstate* ! -name "cpufreq_*" ! -name mperf.ko.xz | sort -d -r); do module=$(basename $i | cut -d. -f1); modprobe $module > /dev/null 2>&1; if [ ${?} = 0 ]; then @@ -46,28 +48,27 @@ case "${1}" in driver=`cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver 2>/dev/null` case "$driver" in - intel_pstate) - # pstate use internal gov so skip this setting + *pstate*) + # pstate not support ondemand so use powersave + GOV="powersave" echo_ok; ;; - *) - CPUCOUNT=`ls /sys/devices/system/cpu/cpu*/cpufreq/affected_cpus 2> /dev/null | wc -l `; - let CPUCOUNT-=1 - # Set the governor to ondemand to test if it works - cpufreq-set -g ondemand - if [ ${?} = 0 ]; then - # Set the governor to ondemand for all cpus - for i in `seq 0 $CPUCOUNT`; - do - cpufreq-set -c $i -g ondemand - done - echo_ok; - else - echo_failure; - fi - ;; - esac - exit 0; + esac + CPUCOUNT=`ls /sys/devices/system/cpu/cpu*/cpufreq/affected_cpus 2> /dev/null | wc -l `; + let CPUCOUNT-=1 + # Set the governor to test if it works + cpufreq-set -g $GOV + if [ ${?} = 0 ]; then + # Set the governor to ondemand for all cpus + for i in `seq 0 $CPUCOUNT`; + do + cpufreq-set -c $i -g $GOV + done + echo_ok; + else + echo_failure; + fi + exit 0 ;; *) echo "Usage: ${0} {start}" hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1ec11ba5150bfd4716c9a1081e4bb0c56f21e1be
by Arne Fitzenreiter 17 Feb '24

17 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 1ec11ba5150bfd4716c9a1081e4bb0c56f21e1be (commit) from d36a58ef6bdf0cdd9c6792526b2f2c36bfef4dae (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1ec11ba5150bfd4716c9a1081e4bb0c56f21e1be Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Feb 17 19:46:34 2024 +0100 rtl8812au: fix module compression the kernel cannot load the compressed module so fix compression parameters. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/rtl8812au | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/lfs/rtl8812au b/lfs/rtl8812au index fd3128f42..b7f9b8657 100644 --- a/lfs/rtl8812au +++ b/lfs/rtl8812au @@ -87,7 +87,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) /lib/modules/$$(uname -r)$(KCFG)/build/certs/signing_key.pem \ /lib/modules/$$(uname -r)$(KCFG)/build/certs/signing_key.x509 \ $$f; \ - xz $$f; \ + xz --check=crc32 --lzma2=dict=512KiB $$f; \ install -m 644 $$f.xz $(MODPATH); \ done hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 90e40b194873b596c138cbc25d559e765824f155
by Michael Tremer 16 Feb '24

16 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 90e40b194873b596c138cbc25d559e765824f155 (commit) via 407548690c672bc58b02123787aa443d44d9f49d (commit) via c9c9580c4e5ef2e726ffe6368ae85b3209917ce1 (commit) from c73a75cb70d4e66c37ea4cc6ba5c4b114308ef2e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 90e40b194873b596c138cbc25d559e765824f155 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Thu Feb 15 13:58:35 2024 +0100 ruleset-sources: removal of PT Attack & Secureworks + addition of ThreatFox - The PT Attack ruleset has not been updated since 2021 and made read-only in 2022 The PT Attack website no longer has any reference to Suricata Rulesets. The PT Attack ruleset is being removed. - The Secureworks three rulesets are no longer available. The website path gives a 404 error. No mention of Suricata rulesets in the Secureworks website. The Secureworks three rulesets are being removed. - ThreatFox ruleset has been added to the list. Both a plain and archive version of the rules are available but the plain version is being regularly updated while the archive version was last updated 5 days ago. So this patch has implemented the plain version. - All above was discussed in the January Developers Conference call. - Tested out on my vm testbed. I had PT Attack selected as one of the providers. As mentioned by Stefan removing PT Attack means it is not available in the list of providers but the provider stays in the providers table but with the line shown in red. I will update the wiki to mention the red highlight and what it means. Suggested-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 407548690c672bc58b02123787aa443d44d9f49d Merge: c73a75cb70 c9c9580c4e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Fri Feb 16 12:29:05 2024 +0000 Merge branch 'master' into next ----------------------------------------------------------------------- Summary of changes: config/suricata/ruleset-sources | 44 +++++++---------------------------------- lfs/freeradius | 4 ++-- 2 files changed, 9 insertions(+), 39 deletions(-) Difference in files: diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources index 14d1b865f3..2b3b4ffcb7 100644 --- a/config/suricata/ruleset-sources +++ b/config/suricata/ruleset-sources @@ -97,44 +97,14 @@ our %Providers = ( dl_type => "plain", }, - # Positive Technologies Attack Detection Team rules. - attack_detection => { - summary => "PT Attack Detection Team Rules", - website => "https://github.com/ptresearch/AttackDetection", - tr_string => "attack detection team rules", + # ThreatFox + threatfox => { + summary => "ThreatFox Indicators Of Compromise Rules", + website => "https://threatfox.abuse.ch/", + tr_string => "threatfox rules", requires_subscription => "False", - dl_url => "https://raw.githubusercontent.com/ptresearch/AttackDetection/master/pt.rule…", - dl_type => "archive", - }, - - # Secureworks Security rules. - secureworks_security => { - summary => "Secureworks Security Ruleset", - website => "https://www.secureworks.com", - tr_string => "secureworks security ruleset", - requires_subscription => "True", - dl_url => "https://ws.secureworks.com/ti/ruleset/<subscription_code>/Suricata_suricata-security_latest.tgz", - dl_type => "archive", - }, - - # Secureworks Malware rules. - secureworks_malware => { - summary => "Secureworks Malware Ruleset", - website => "https://www.secureworks.com", - tr_string => "secureworks malware ruleset", - requires_subscription => "True", - dl_url => "https://ws.secureworks.com/ti/ruleset/<subscription_code>/Suricata_suricata-malware_latest.tgz", - dl_type => "archive", - }, - - # Secureworks Enhanced rules. - secureworks_enhanced => { - summary => "Secureworks Enhanced Ruleset", - website => "https://www.secureworks.com", - tr_string => "secureworks enhanced ruleset", - requires_subscription => "True", - dl_url => "https://ws.secureworks.com/ti/ruleset/<subscription_code>/Suricata_suricata-enhanced_latest.tgz", - dl_type => "archive", + dl_url => "https://threatfox.abuse.ch/downloads/threatfox_suricata.rules", + dl_type => "plain", }, # Travis B. Green hunting rules. diff --git a/lfs/freeradius b/lfs/freeradius index 5ce1a2528f..df59bd63b9 100644 --- a/lfs/freeradius +++ b/lfs/freeradius @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = freeradius -PAK_VER = 19 +PAK_VER = 20 DEPS = libtalloc samba hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. c9c9580c4e5ef2e726ffe6368ae85b3209917ce1
by Michael Tremer 16 Feb '24

16 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via c9c9580c4e5ef2e726ffe6368ae85b3209917ce1 (commit) from dd24668627fd9ee1c8ef912840904a556e5a690b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c9c9580c4e5ef2e726ffe6368ae85b3209917ce1 Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Thu Feb 15 21:47:57 2024 +0100 freeradius: Increment PAK_VER & ship freeradius to link to the updated libssl version - OpenSSL was updated to 3.1.4 in CU181 and to 3.2.1 in CU183 but in both cases freeradius was not incremented to cause it to be shipped. - This patch increments the freeradius PAK_VER to ensure it will be shipped. Fixes: Bug#13590 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/freeradius | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/lfs/freeradius b/lfs/freeradius index 5ce1a2528..df59bd63b 100644 --- a/lfs/freeradius +++ b/lfs/freeradius @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = freeradius -PAK_VER = 19 +PAK_VER = 20 DEPS = libtalloc samba hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. c73a75cb70d4e66c37ea4cc6ba5c4b114308ef2e
by Michael Tremer 14 Feb '24

14 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via c73a75cb70d4e66c37ea4cc6ba5c4b114308ef2e (commit) via 5db2b07c890b526cfe4c032c7123f11016ae4744 (commit) via dd24668627fd9ee1c8ef912840904a556e5a690b (commit) via c5b441a4e62004171ed5957254a1322c7a4431a3 (commit) via 64300f2212afbc083b3a0b926904cc62079432bc (commit) via 2071b2964fed10cbcf62bd2d7da3b7e718f8a88f (commit) via f3d7ce3b5d83222c78bc2b246f6afd5766af4dc9 (commit) via 4fb7b188434b69a7dc6c5e40e827f6a8f389a86f (commit) via e705636a854de570987817d2f847bec980db928f (commit) via 0698daa3fb935ede4c027e8b507e7b3106391a86 (commit) via de9e44e82daa1e650a38e3cb5235a59caaedb66b (commit) via 935da8b7a22fc3cc365c21d3bdd11f93cebcc2f9 (commit) via b6d47f727a5726cedcc3dc3ec8aa540c34a2597e (commit) via 4a9fe2eaaa45e25428ce72f0076c0a38fe9b291a (commit) via ee4c8d28e493862cb630e79b7ffadd6807b465fa (commit) via 89941c3d131176a2cbc81f18dda2ab8a312e4aa0 (commit) via 456aad9443bade55b2e8ef337191729c02632aed (commit) via 8c43d1481a99743ce23d8b92879ea04f7e0153c1 (commit) via 7f7cbd68b8fc15de7d8a10569684611704f005b7 (commit) via 664eac84834676fd0bd64b7a90c93e4c612a860c (commit) via fdad4cf48f53556086fea1965b3e79b2c68ed3d5 (commit) via 83338946dc2121d1f0d332d4e5f2f13b1bf078d5 (commit) via 38c1be257f5d740a502112ee8eae3566d8f2ac4e (commit) from a4f29a53477951513a7621f52c313541e87bf735 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c73a75cb70d4e66c37ea4cc6ba5c4b114308ef2e Merge: 5db2b07c89 a4f29a5347 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 19:07:30 2024 +0000 Merge remote-tracking branch 'origin/next' into next commit 5db2b07c890b526cfe4c032c7123f11016ae4744 Merge: c5b441a4e6 dd24668627 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 19:06:35 2024 +0000 Merge branch 'master' into next commit c5b441a4e62004171ed5957254a1322c7a4431a3 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 19:04:48 2024 +0000 core185: Ship unbound and BIND again Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 64300f2212afbc083b3a0b926904cc62079432bc Merge: 935da8b7a2 2071b2964f Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 19:03:52 2024 +0000 Merge branch 'master' into next commit 935da8b7a22fc3cc365c21d3bdd11f93cebcc2f9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 11:52:36 2024 +0000 The IPFire time service has moved to time.ipfire.org Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit b6d47f727a5726cedcc3dc3ec8aa540c34a2597e Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 11:51:33 2024 +0000 make.sh: Bump toolchain version Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/graphs.pl | 237 ++++++++++++++------- config/rootfiles/common/bind | 14 +- config/rootfiles/common/unbound | 2 +- .../{oldcore/100 => core/185}/filelists/bind | 0 .../{oldcore/106 => core/185}/filelists/unbound | 0 config/rootfiles/core/185/update.sh | 1 + .../185 => oldcore/183}/filelists/aarch64/glibc | 0 .../oldcore/{131 => 183}/filelists/libhtp | 0 .../185 => oldcore/183}/filelists/riscv64/glibc | 0 .../{core/185 => oldcore/183}/filelists/suricata | 0 .../185 => oldcore/183}/filelists/x86_64/glibc | 0 config/rootfiles/oldcore/183/update.sh | 5 +- .../rootfiles/oldcore/{100 => 184}/filelists/bind | 0 config/rootfiles/oldcore/184/filelists/files | 1 + .../oldcore/{106 => 184}/filelists/unbound | 0 config/rootfiles/oldcore/184/update.sh | 1 + lfs/bind | 6 +- lfs/unbound | 6 +- make.sh | 2 +- src/initscripts/system/unbound | 2 +- src/installer/dracut-module/70-dhcpcd.exe | 2 +- 21 files changed, 182 insertions(+), 97 deletions(-) copy config/rootfiles/{oldcore/100 => core/185}/filelists/bind (100%) copy config/rootfiles/{oldcore/106 => core/185}/filelists/unbound (100%) copy config/rootfiles/{core/185 => oldcore/183}/filelists/aarch64/glibc (100%) copy config/rootfiles/oldcore/{131 => 183}/filelists/libhtp (100%) copy config/rootfiles/{core/185 => oldcore/183}/filelists/riscv64/glibc (100%) copy config/rootfiles/{core/185 => oldcore/183}/filelists/suricata (100%) copy config/rootfiles/{core/185 => oldcore/183}/filelists/x86_64/glibc (100%) copy config/rootfiles/oldcore/{100 => 184}/filelists/bind (100%) copy config/rootfiles/oldcore/{106 => 184}/filelists/unbound (100%) Difference in files: diff --git a/config/cfgroot/graphs.pl b/config/cfgroot/graphs.pl index a23e49c980..96c6c26ead 100644 --- a/config/cfgroot/graphs.pl +++ b/config/cfgroot/graphs.pl @@ -13,7 +13,7 @@ # This program is distributed in the hope that it will be useful, # # but WITHOUT ANY WARRANTY; without even the implied warranty of # # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # +# GNU General Public License for more details. #update.sh # # # You should have received a copy of the GNU General Public License # # along with this program. If not, see <http://www.gnu.org/licenses/>. # @@ -676,84 +676,163 @@ sub updatevpnn2ngraph { sub updatefwhitsgraph { my $period = $_[0]; - RRDs::graph( - @GRAPH_ARGS, - "-", - "--start", - "-1".$period, - "-r", - "-t ".$Lang::tr{'firewall hits per'}." ".$Lang::tr{$period."-graph"}, - "-v ".$Lang::tr{'bytes per second'}, - "--color=SHADEA".$color{"color19"}, - "--color=SHADEB".$color{"color19"}, - "--color=BACK".$color{"color21"}, - "DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYOUT/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE", - "DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYIN/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE", - "DEF:forward=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYFWD/ipt_bytes-DROP_FORWARD.rrd:value:AVERAGE", - "DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE", - "DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE", - "DEF:spoofedmartian=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-SPOOFED_MARTIAN/ipt_bytes-DROP_SPOOFED_MARTIAN.rrd:value:AVERAGE", - "DEF:hostilein=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_IN/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", - "DEF:hostileout=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_OUT/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", - "DEF:hostilelegacy=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", - - # This creates a new combined hostile segment. - # Previously we did not split into incoming/outgoing, but we cannot go back in time. This CDEF will take the values - # from the old RRD database unless those are UNKNOWN (i.e. we started collected IN/OUT). If the values are unknown, - # we replace them with them sum of IN + OUT. - "CDEF:hostile=hostilelegacy,UN,hostilein,hostileout,+,hostilelegacy,IF", - - "COMMENT:".sprintf("%-26s",$Lang::tr{'caption'}), - "COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}), - "COMMENT:".sprintf("%15s",$Lang::tr{'average'}), - "COMMENT:".sprintf("%14s",$Lang::tr{'minimal'}), - "COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j", - "AREA:output".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (OUTPUT)"), - "GPRINT:output:MAX:%8.1lf %sBps", - "GPRINT:output:AVERAGE:%8.1lf %sBps", - "GPRINT:output:MIN:%8.1lf %sBps", - "GPRINT:output:LAST:%8.1lf %sBps\\j", - "STACK:forward".$color{"color23"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (FORWARD)"), - "GPRINT:forward:MAX:%8.1lf %sBps", - "GPRINT:forward:AVERAGE:%8.1lf %sBps", - "GPRINT:forward:MIN:%8.1lf %sBps", - "GPRINT:forward:LAST:%8.1lf %sBps\\j", - "STACK:input".$color{"color24"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (INPUT)"), - "GPRINT:input:MAX:%8.1lf %sBps", - "GPRINT:input:AVERAGE:%8.1lf %sBps", - "GPRINT:input:MIN:%8.1lf %sBps", - "GPRINT:input:LAST:%8.1lf %sBps\\j", - "STACK:newnotsyn".$color{"color14"}."A0:".sprintf("%-25s","NewNotSYN"), - "GPRINT:newnotsyn:MAX:%8.1lf %sBps", - "GPRINT:newnotsyn:AVERAGE:%8.1lf %sBps", - "GPRINT:newnotsyn:MIN:%8.1lf %sBps", - "GPRINT:newnotsyn:LAST:%8.1lf %sBps\\j", - "STACK:portscan".$color{"color16"}."A0:".sprintf("%-25s",$Lang::tr{'portscans'}), - "GPRINT:portscan:MAX:%8.1lf %sBps", - "GPRINT:portscan:AVERAGE:%8.1lf %sBps", - "GPRINT:portscan:MIN:%8.1lf %sBps", - "GPRINT:portscan:LAST:%8.1lf %sBps\\j", - "STACK:spoofedmartian".$color{"color12"}."A0:".sprintf("%-25s",$Lang::tr{'spoofed or martians'}), - "GPRINT:spoofedmartian:MAX:%8.1lf %sBps", - "GPRINT:spoofedmartian:AVERAGE:%8.1lf %sBps", - "GPRINT:spoofedmartian:MIN:%8.1lf %sBps", - "GPRINT:spoofedmartian:LAST:%8.1lf %sBps\\j", - "STACK:hostilein".$color{"color13"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks in'}), - "GPRINT:hostilein:MAX:%8.1lf %sBps", - "GPRINT:hostilein:AVERAGE:%8.1lf %sBps", - "GPRINT:hostilein:MIN:%8.1lf %sBps", - "GPRINT:hostilein:LAST:%8.1lf %sBps\\j", - "STACK:hostileout".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks out'}), - "GPRINT:hostileout:MAX:%8.1lf %sBps", - "GPRINT:hostileout:AVERAGE:%8.1lf %sBps", - "GPRINT:hostileout:MIN:%8.1lf %sBps", - "GPRINT:hostileout:LAST:%8.1lf %sBps\\j", - "LINE:hostile#000000A0:".sprintf("%-25s",$Lang::tr{'hostile networks total'}), - "GPRINT:hostile:MAX:%8.1lf %sBps", - "GPRINT:hostile:AVERAGE:%8.1lf %sBps", - "GPRINT:hostile:MIN:%8.1lf %sBps", - "GPRINT:hostile:LAST:%8.1lf %sBps\\j", - ); + if ( -e "$mainsettings{'RRDLOG'}/collectd/localhost/iptables-filter-HOSTILE_DROP/ipt_bytes-DROP_HOSTILE.rrd" ) { + RRDs::graph( + @GRAPH_ARGS, + "-", + "--start", + "-1".$period, + "-r", + "-t ".$Lang::tr{'firewall hits per'}." ".$Lang::tr{$period."-graph"}, + "-v ".$Lang::tr{'bytes per second'}, + "--color=SHADEA".$color{"color19"}, + "--color=SHADEB".$color{"color19"}, + "--color=BACK".$color{"color21"}, + "DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYOUT/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE", + "DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYIN/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE", + "DEF:forward=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYFWD/ipt_bytes-DROP_FORWARD.rrd:value:AVERAGE", + "DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE", + "DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE", + "DEF:spoofedmartian=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-SPOOFED_MARTIAN/ipt_bytes-DROP_SPOOFED_MARTIAN.rrd:value:AVERAGE", + "DEF:hostilein=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_IN/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + "DEF:hostileout=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_OUT/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + "DEF:hostilelegacy=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + + # This creates a new combined hostile segment. + # Previously we did not split into incoming/outgoing, but we cannot go back in time. This CDEF will take the values + # from the old RRD database if it exists and if those values are UNKNOWN (time period after Hostile was split into In and Out), + # we replace them with the sum of IN + OUT. + "CDEF:hostile=hostilelegacy,UN,hostilein,hostileout,+,hostilelegacy,IF", + + "COMMENT:".sprintf("%-26s",$Lang::tr{'caption'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'average'}), + "COMMENT:".sprintf("%14s",$Lang::tr{'minimal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j", + "AREA:output".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (OUTPUT)"), + "GPRINT:output:MAX:%8.1lf %sBps", + "GPRINT:output:AVERAGE:%8.1lf %sBps", + "GPRINT:output:MIN:%8.1lf %sBps", + "GPRINT:output:LAST:%8.1lf %sBps\\j", + "STACK:forward".$color{"color23"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (FORWARD)"), + "GPRINT:forward:MAX:%8.1lf %sBps", + "GPRINT:forward:AVERAGE:%8.1lf %sBps", + "GPRINT:forward:MIN:%8.1lf %sBps", + "GPRINT:forward:LAST:%8.1lf %sBps\\j", + "STACK:input".$color{"color24"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (INPUT)"), + "GPRINT:input:MAX:%8.1lf %sBps", + "GPRINT:input:AVERAGE:%8.1lf %sBps", + "GPRINT:input:MIN:%8.1lf %sBps", + "GPRINT:input:LAST:%8.1lf %sBps\\j", + "STACK:newnotsyn".$color{"color14"}."A0:".sprintf("%-25s","NewNotSYN"), + "GPRINT:newnotsyn:MAX:%8.1lf %sBps", + "GPRINT:newnotsyn:AVERAGE:%8.1lf %sBps", + "GPRINT:newnotsyn:MIN:%8.1lf %sBps", + "GPRINT:newnotsyn:LAST:%8.1lf %sBps\\j", + "STACK:portscan".$color{"color16"}."A0:".sprintf("%-25s",$Lang::tr{'portscans'}), + "GPRINT:portscan:MAX:%8.1lf %sBps", + "GPRINT:portscan:AVERAGE:%8.1lf %sBps", + "GPRINT:portscan:MIN:%8.1lf %sBps", + "GPRINT:portscan:LAST:%8.1lf %sBps\\j", + "STACK:spoofedmartian".$color{"color12"}."A0:".sprintf("%-25s",$Lang::tr{'spoofed or martians'}), + "GPRINT:spoofedmartian:MAX:%8.1lf %sBps", + "GPRINT:spoofedmartian:AVERAGE:%8.1lf %sBps", + "GPRINT:spoofedmartian:MIN:%8.1lf %sBps", + "GPRINT:spoofedmartian:LAST:%8.1lf %sBps\\j", + "STACK:hostilein".$color{"color13"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks in'}), + "GPRINT:hostilein:MAX:%8.1lf %sBps", + "GPRINT:hostilein:AVERAGE:%8.1lf %sBps", + "GPRINT:hostilein:MIN:%8.1lf %sBps", + "GPRINT:hostilein:LAST:%8.1lf %sBps\\j", + "STACK:hostileout".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks out'}), + "GPRINT:hostileout:MAX:%8.1lf %sBps", + "GPRINT:hostileout:AVERAGE:%8.1lf %sBps", + "GPRINT:hostileout:MIN:%8.1lf %sBps", + "GPRINT:hostileout:LAST:%8.1lf %sBps\\j", + "LINE:hostile#000000A0:".sprintf("%-25s",$Lang::tr{'hostile networks total'}), + "GPRINT:hostile:MAX:%8.1lf %sBps", + "GPRINT:hostile:AVERAGE:%8.1lf %sBps", + "GPRINT:hostile:MIN:%8.1lf %sBps", + "GPRINT:hostile:LAST:%8.1lf %sBps\\j", + ); + }else{ + RRDs::graph( + @GRAPH_ARGS, + "-", + "--start", + "-1".$period, + "-r", + "-t ".$Lang::tr{'firewall hits per'}." ".$Lang::tr{$period."-graph"}, + "-v ".$Lang::tr{'bytes per second'}, + "--color=SHADEA".$color{"color19"}, + "--color=SHADEB".$color{"color19"}, + "--color=BACK".$color{"color21"}, + "DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYOUT/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE", + "DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYIN/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE", + "DEF:forward=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYFWD/ipt_bytes-DROP_FORWARD.rrd:value:AVERAGE", + "DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE", + "DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE", + "DEF:spoofedmartian=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-SPOOFED_MARTIAN/ipt_bytes-DROP_SPOOFED_MARTIAN.rrd:value:AVERAGE", + "DEF:hostilein=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_IN/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + "DEF:hostileout=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_OUT/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + + # This creates a new combined hostile segment. + # If we started collecting IN/OUT, ie the old single Hostile RRD database is not available then this CDEF will take the values + # from the sum of IN + OUT. + "CDEF:hostile=hostilein,hostileout,+", + + "COMMENT:".sprintf("%-26s",$Lang::tr{'caption'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'average'}), + "COMMENT:".sprintf("%14s",$Lang::tr{'minimal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j", + "AREA:output".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (OUTPUT)"), + "GPRINT:output:MAX:%8.1lf %sBps", + "GPRINT:output:AVERAGE:%8.1lf %sBps", + "GPRINT:output:MIN:%8.1lf %sBps", + "GPRINT:output:LAST:%8.1lf %sBps\\j", + "STACK:forward".$color{"color23"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (FORWARD)"), + "GPRINT:forward:MAX:%8.1lf %sBps", + "GPRINT:forward:AVERAGE:%8.1lf %sBps", + "GPRINT:forward:MIN:%8.1lf %sBps", + "GPRINT:forward:LAST:%8.1lf %sBps\\j", + "STACK:input".$color{"color24"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (INPUT)"), + "GPRINT:input:MAX:%8.1lf %sBps", + "GPRINT:input:AVERAGE:%8.1lf %sBps", + "GPRINT:input:MIN:%8.1lf %sBps", + "GPRINT:input:LAST:%8.1lf %sBps\\j", + "STACK:newnotsyn".$color{"color14"}."A0:".sprintf("%-25s","NewNotSYN"), + "GPRINT:newnotsyn:MAX:%8.1lf %sBps", + "GPRINT:newnotsyn:AVERAGE:%8.1lf %sBps", + "GPRINT:newnotsyn:MIN:%8.1lf %sBps", + "GPRINT:newnotsyn:LAST:%8.1lf %sBps\\j", + "STACK:portscan".$color{"color16"}."A0:".sprintf("%-25s",$Lang::tr{'portscans'}), + "GPRINT:portscan:MAX:%8.1lf %sBps", + "GPRINT:portscan:AVERAGE:%8.1lf %sBps", + "GPRINT:portscan:MIN:%8.1lf %sBps", + "GPRINT:portscan:LAST:%8.1lf %sBps\\j", + "STACK:spoofedmartian".$color{"color12"}."A0:".sprintf("%-25s",$Lang::tr{'spoofed or martians'}), + "GPRINT:spoofedmartian:MAX:%8.1lf %sBps", + "GPRINT:spoofedmartian:AVERAGE:%8.1lf %sBps", + "GPRINT:spoofedmartian:MIN:%8.1lf %sBps", + "GPRINT:spoofedmartian:LAST:%8.1lf %sBps\\j", + "STACK:hostilein".$color{"color13"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks in'}), + "GPRINT:hostilein:MAX:%8.1lf %sBps", + "GPRINT:hostilein:AVERAGE:%8.1lf %sBps", + "GPRINT:hostilein:MIN:%8.1lf %sBps", + "GPRINT:hostilein:LAST:%8.1lf %sBps\\j", + "STACK:hostileout".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks out'}), + "GPRINT:hostileout:MAX:%8.1lf %sBps", + "GPRINT:hostileout:AVERAGE:%8.1lf %sBps", + "GPRINT:hostileout:MIN:%8.1lf %sBps", + "GPRINT:hostileout:LAST:%8.1lf %sBps\\j", + "LINE:hostile#000000A0:".sprintf("%-25s",$Lang::tr{'hostile networks total'}), + "GPRINT:hostile:MAX:%8.1lf %sBps", + "GPRINT:hostile:AVERAGE:%8.1lf %sBps", + "GPRINT:hostile:MIN:%8.1lf %sBps", + "GPRINT:hostile:LAST:%8.1lf %sBps\\j", + ); + } $ERROR = RRDs::error; return "Error in RRD::graph for firewallhits: ".$ERROR."\n" if $ERROR; } diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 230b2e595f..96859c8db4 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -271,24 +271,24 @@ usr/bin/nsupdate #usr/include/pk11/site.h #usr/include/pkcs11 #usr/include/pkcs11/pkcs11.h -usr/lib/libbind9-9.16.45.so +usr/lib/libbind9-9.16.48.so #usr/lib/libbind9.la #usr/lib/libbind9.so -usr/lib/libdns-9.16.45.so +usr/lib/libdns-9.16.48.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libirs-9.16.45.so +usr/lib/libirs-9.16.48.so #usr/lib/libirs.la #usr/lib/libirs.so -usr/lib/libisc-9.16.45.so +usr/lib/libisc-9.16.48.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.16.45.so +usr/lib/libisccc-9.16.48.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.16.45.so +usr/lib/libisccfg-9.16.48.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.16.45.so +usr/lib/libns-9.16.48.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 78c5a31ae2..1badd605ab 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.23 +usr/lib/libunbound.so.8.1.24 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/config/rootfiles/core/185/filelists/bind b/config/rootfiles/core/185/filelists/bind new file mode 120000 index 0000000000..48a0ebaefd --- /dev/null +++ b/config/rootfiles/core/185/filelists/bind @@ -0,0 +1 @@ +../../../common/bind \ No newline at end of file diff --git a/config/rootfiles/core/185/filelists/unbound b/config/rootfiles/core/185/filelists/unbound new file mode 120000 index 0000000000..66adf09242 --- /dev/null +++ b/config/rootfiles/core/185/filelists/unbound @@ -0,0 +1 @@ +../../../common/unbound \ No newline at end of file diff --git a/config/rootfiles/core/185/update.sh b/config/rootfiles/core/185/update.sh index beb061f4ab..3321567e36 100644 --- a/config/rootfiles/core/185/update.sh +++ b/config/rootfiles/core/185/update.sh @@ -53,6 +53,7 @@ ldconfig # Start services telinit u /etc/init.d/suricata restart +/etc/init.d/unbound restart # This update needs a reboot... #touch /var/run/need_reboot diff --git a/config/rootfiles/oldcore/183/filelists/aarch64/glibc b/config/rootfiles/oldcore/183/filelists/aarch64/glibc new file mode 120000 index 0000000000..d13849ff91 --- /dev/null +++ b/config/rootfiles/oldcore/183/filelists/aarch64/glibc @@ -0,0 +1 @@ +../../../../common/aarch64/glibc \ No newline at end of file diff --git a/config/rootfiles/oldcore/183/filelists/libhtp b/config/rootfiles/oldcore/183/filelists/libhtp new file mode 120000 index 0000000000..676e2c5e87 --- /dev/null +++ b/config/rootfiles/oldcore/183/filelists/libhtp @@ -0,0 +1 @@ +../../../common/libhtp \ No newline at end of file diff --git a/config/rootfiles/oldcore/183/filelists/riscv64/glibc b/config/rootfiles/oldcore/183/filelists/riscv64/glibc new file mode 120000 index 0000000000..36b731f7dd --- /dev/null +++ b/config/rootfiles/oldcore/183/filelists/riscv64/glibc @@ -0,0 +1 @@ +../../../../common/riscv64/glibc \ No newline at end of file diff --git a/config/rootfiles/oldcore/183/filelists/suricata b/config/rootfiles/oldcore/183/filelists/suricata new file mode 120000 index 0000000000..f671f69933 --- /dev/null +++ b/config/rootfiles/oldcore/183/filelists/suricata @@ -0,0 +1 @@ +../../../common/suricata \ No newline at end of file diff --git a/config/rootfiles/oldcore/183/filelists/x86_64/glibc b/config/rootfiles/oldcore/183/filelists/x86_64/glibc new file mode 120000 index 0000000000..1119099669 --- /dev/null +++ b/config/rootfiles/oldcore/183/filelists/x86_64/glibc @@ -0,0 +1 @@ +../../../../common/x86_64/glibc \ No newline at end of file diff --git a/config/rootfiles/oldcore/183/update.sh b/config/rootfiles/oldcore/183/update.sh index 77446311a0..6d1e1fd253 100644 --- a/config/rootfiles/oldcore/183/update.sh +++ b/config/rootfiles/oldcore/183/update.sh @@ -113,6 +113,9 @@ ldconfig # Filesytem cleanup /usr/local/bin/filesystem-cleanup +# Relaunch init +telinit u + # Apply local configuration to sshd_config /usr/local/bin/sshctrl @@ -143,7 +146,7 @@ fi if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then /etc/rc.d/init.d/ipsec start fi - +/etc/init.d/suricata restart # Rebuild initial ramdisks dracut --regenerate-all --force diff --git a/config/rootfiles/oldcore/184/filelists/bind b/config/rootfiles/oldcore/184/filelists/bind new file mode 120000 index 0000000000..48a0ebaefd --- /dev/null +++ b/config/rootfiles/oldcore/184/filelists/bind @@ -0,0 +1 @@ +../../../common/bind \ No newline at end of file diff --git a/config/rootfiles/oldcore/184/filelists/files b/config/rootfiles/oldcore/184/filelists/files index dc8a1b28fe..2b0e4df076 100644 --- a/config/rootfiles/oldcore/184/filelists/files +++ b/config/rootfiles/oldcore/184/filelists/files @@ -4,3 +4,4 @@ srv/web/ipfire/cgi-bin/optionsfw.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/firewall/rules.pl var/ipfire/graphs.pl +etc/collectd.conf diff --git a/config/rootfiles/oldcore/184/filelists/unbound b/config/rootfiles/oldcore/184/filelists/unbound new file mode 120000 index 0000000000..66adf09242 --- /dev/null +++ b/config/rootfiles/oldcore/184/filelists/unbound @@ -0,0 +1 @@ +../../../common/unbound \ No newline at end of file diff --git a/config/rootfiles/oldcore/184/update.sh b/config/rootfiles/oldcore/184/update.sh index 024c44be7f..3bf38ff8b2 100644 --- a/config/rootfiles/oldcore/184/update.sh +++ b/config/rootfiles/oldcore/184/update.sh @@ -81,6 +81,7 @@ telinit u /etc/init.d/vnstat start /etc/init.d/collectd restart /etc/init.d/suricata restart +/etc/init.d/unbound restart if [ -f /var/ipfire/proxy/enable ]; then /etc/init.d/squid start fi diff --git a/lfs/bind b/lfs/bind index 63e642ca89..271f8ab53b 100644 --- a/lfs/bind +++ b/lfs/bind @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 9.16.45 +VER = 9.16.48 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 2b6cea5e5b510780fb144cf9fce5fbec4adc6a2bb2186646f95afb4aa486edc326106519f149e600aec373238d55c06dfe7ac65f41016453a0967a28ec67ad7e +$(DL_FILE)_BLAKE2 = 4a503b45df412c435cb0f75b54ee1270140cccce7ecc159cdf3e0e3cbd3c0a0866b7472782f20aacf130f57df12d20a102ac6979498138ce00a2655806d003e7 install : $(TARGET) diff --git a/lfs/unbound b/lfs/unbound index 22bb2e1ceb..b852f75b9b 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.19.0 +VER = 1.19.1 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 66ec2b1cd32ac5930c088c73e884bc1fb4d35526a0c89bdbe209defd3e78326ce9b3c1a523fc1ab28b8fdf0e457280d5de7b300cf560c15d875f460bc361f5c7 +$(DL_FILE)_BLAKE2 = a48c5b9493eb0a9aa2171956e08677e1cfb7c49b53731c1b05f9192434c4d815eba972aab110ba0ee25fee1e7a57192c8b48e59bb21fb76ad7fd1c7d2d260012 install : $(TARGET) diff --git a/make.sh b/make.sh index ab7e0911fc..7b56b7fc8a 100755 --- a/make.sh +++ b/make.sh @@ -35,7 +35,7 @@ GIT_BRANCH="$(git rev-parse --abbrev-ref HEAD)" # Git Branch GIT_TAG="$(git tag | tail -1)" # Git Tag GIT_LASTCOMMIT="$(git rev-parse --verify HEAD)" # Last commit -TOOLCHAINVER=20231206 +TOOLCHAINVER=20240210 # use multicore and max compression ZSTD_OPT="-T0 --ultra -22" diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index 04e43fbce0..24d9256380 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -288,7 +288,7 @@ fix_time_if_dns_fails() { fi # Try to sync time with a known time server - boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..." + boot_mesg "DNS not functioning... Trying to sync time with time.ipfire.org (81.3.27.46)..." loadproc /usr/local/bin/settime 81.3.27.46 } diff --git a/src/installer/dracut-module/70-dhcpcd.exe b/src/installer/dracut-module/70-dhcpcd.exe index d801c8adad..b9693198d9 100755 --- a/src/installer/dracut-module/70-dhcpcd.exe +++ b/src/installer/dracut-module/70-dhcpcd.exe @@ -48,7 +48,7 @@ case "${reason}" in make_resolvconf # Set time - ntpdate "ntp.ipfire.org" + ntpdate "time.ipfire.org" ;; EXPIRE|FAIL|IPV4LL|NAK|NOCARRIER|RELEASE|STOP) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. dd24668627fd9ee1c8ef912840904a556e5a690b
by Michael Tremer 14 Feb '24

14 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via dd24668627fd9ee1c8ef912840904a556e5a690b (commit) from 2071b2964fed10cbcf62bd2d7da3b7e718f8a88f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit dd24668627fd9ee1c8ef912840904a556e5a690b Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Sun Feb 11 14:19:48 2024 +0100 files: Ship collectd.conf for bug#12981 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/184/filelists/files | 1 + 1 file changed, 1 insertion(+) Difference in files: diff --git a/config/rootfiles/core/184/filelists/files b/config/rootfiles/core/184/filelists/files index dc8a1b28f..2b0e4df07 100644 --- a/config/rootfiles/core/184/filelists/files +++ b/config/rootfiles/core/184/filelists/files @@ -4,3 +4,4 @@ srv/web/ipfire/cgi-bin/optionsfw.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/firewall/rules.pl var/ipfire/graphs.pl +etc/collectd.conf hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 2071b2964fed10cbcf62bd2d7da3b7e718f8a88f
by Michael Tremer 14 Feb '24

14 Feb '24

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 2071b2964fed10cbcf62bd2d7da3b7e718f8a88f (commit) via f3d7ce3b5d83222c78bc2b246f6afd5766af4dc9 (commit) via 4fb7b188434b69a7dc6c5e40e827f6a8f389a86f (commit) via e705636a854de570987817d2f847bec980db928f (commit) via 0698daa3fb935ede4c027e8b507e7b3106391a86 (commit) via de9e44e82daa1e650a38e3cb5235a59caaedb66b (commit) from 4a9fe2eaaa45e25428ce72f0076c0a38fe9b291a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2071b2964fed10cbcf62bd2d7da3b7e718f8a88f Author: Adolf Belka <adolf.belka(a)ipfire.org> Date: Wed Feb 14 11:34:36 2024 +0100 graphs.pl: Fixes graph failure when the DROP_HOSTILE directory is missing - If a fresh install is done then only the DROP_HOSTILE_IN & DROP_HOSTILE_OUT rrd directories are created. - With the DROP_HOSTILE directory missing then when the fwhits graph is updated an error message is caused by the inability to open the required files. - This patch adds an if/else loop into the fwhits graph code to deal with the two cases of the DROP_HOSTILE being present or not depending on the history and if a backup with logs has been restored from when DROP_HOSTILE was in use. - Tested on vm testbed and created a historical line for the hostile data when it was not split - There might be a simpler or better approach than this but it was the only option I could identify. I couldn't find anything about being able to use if loops within the RRD::Graph loop Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit f3d7ce3b5d83222c78bc2b246f6afd5766af4dc9 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 19:01:25 2024 +0000 core184: Ship unbound Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 4fb7b188434b69a7dc6c5e40e827f6a8f389a86f Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Feb 14 17:24:52 2024 +0100 unbound: Update to 1.19.1 For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-1 "Bug Fixes Fix CVE-2023-50387, DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers. Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit e705636a854de570987817d2f847bec980db928f Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Feb 14 17:34:10 2024 +0100 unbound 1.19.1: Fix for forgotten rootfile Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit 0698daa3fb935ede4c027e8b507e7b3106391a86 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 14 19:00:03 2024 +0000 core184: Ship bind Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> commit de9e44e82daa1e650a38e3cb5235a59caaedb66b Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Feb 14 17:43:12 2024 +0100 bind: Update to 9.16.48 For details see: https://downloads.isc.org/isc/bind9/9.16.48/doc/arm/html/notes.html#notes-f… Fixes several CVEs. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/cfgroot/graphs.pl | 237 ++++++++++++++------- config/rootfiles/common/bind | 14 +- config/rootfiles/common/unbound | 2 +- .../{oldcore/100 => core/184}/filelists/bind | 0 .../{oldcore/106 => core/184}/filelists/unbound | 0 config/rootfiles/core/184/update.sh | 1 + lfs/bind | 6 +- lfs/unbound | 6 +- 8 files changed, 173 insertions(+), 93 deletions(-) copy config/rootfiles/{oldcore/100 => core/184}/filelists/bind (100%) copy config/rootfiles/{oldcore/106 => core/184}/filelists/unbound (100%) Difference in files: diff --git a/config/cfgroot/graphs.pl b/config/cfgroot/graphs.pl index a23e49c980..96c6c26ead 100644 --- a/config/cfgroot/graphs.pl +++ b/config/cfgroot/graphs.pl @@ -13,7 +13,7 @@ # This program is distributed in the hope that it will be useful, # # but WITHOUT ANY WARRANTY; without even the implied warranty of # # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # +# GNU General Public License for more details. #update.sh # # # You should have received a copy of the GNU General Public License # # along with this program. If not, see <http://www.gnu.org/licenses/>. # @@ -676,84 +676,163 @@ sub updatevpnn2ngraph { sub updatefwhitsgraph { my $period = $_[0]; - RRDs::graph( - @GRAPH_ARGS, - "-", - "--start", - "-1".$period, - "-r", - "-t ".$Lang::tr{'firewall hits per'}." ".$Lang::tr{$period."-graph"}, - "-v ".$Lang::tr{'bytes per second'}, - "--color=SHADEA".$color{"color19"}, - "--color=SHADEB".$color{"color19"}, - "--color=BACK".$color{"color21"}, - "DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYOUT/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE", - "DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYIN/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE", - "DEF:forward=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYFWD/ipt_bytes-DROP_FORWARD.rrd:value:AVERAGE", - "DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE", - "DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE", - "DEF:spoofedmartian=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-SPOOFED_MARTIAN/ipt_bytes-DROP_SPOOFED_MARTIAN.rrd:value:AVERAGE", - "DEF:hostilein=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_IN/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", - "DEF:hostileout=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_OUT/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", - "DEF:hostilelegacy=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", - - # This creates a new combined hostile segment. - # Previously we did not split into incoming/outgoing, but we cannot go back in time. This CDEF will take the values - # from the old RRD database unless those are UNKNOWN (i.e. we started collected IN/OUT). If the values are unknown, - # we replace them with them sum of IN + OUT. - "CDEF:hostile=hostilelegacy,UN,hostilein,hostileout,+,hostilelegacy,IF", - - "COMMENT:".sprintf("%-26s",$Lang::tr{'caption'}), - "COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}), - "COMMENT:".sprintf("%15s",$Lang::tr{'average'}), - "COMMENT:".sprintf("%14s",$Lang::tr{'minimal'}), - "COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j", - "AREA:output".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (OUTPUT)"), - "GPRINT:output:MAX:%8.1lf %sBps", - "GPRINT:output:AVERAGE:%8.1lf %sBps", - "GPRINT:output:MIN:%8.1lf %sBps", - "GPRINT:output:LAST:%8.1lf %sBps\\j", - "STACK:forward".$color{"color23"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (FORWARD)"), - "GPRINT:forward:MAX:%8.1lf %sBps", - "GPRINT:forward:AVERAGE:%8.1lf %sBps", - "GPRINT:forward:MIN:%8.1lf %sBps", - "GPRINT:forward:LAST:%8.1lf %sBps\\j", - "STACK:input".$color{"color24"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (INPUT)"), - "GPRINT:input:MAX:%8.1lf %sBps", - "GPRINT:input:AVERAGE:%8.1lf %sBps", - "GPRINT:input:MIN:%8.1lf %sBps", - "GPRINT:input:LAST:%8.1lf %sBps\\j", - "STACK:newnotsyn".$color{"color14"}."A0:".sprintf("%-25s","NewNotSYN"), - "GPRINT:newnotsyn:MAX:%8.1lf %sBps", - "GPRINT:newnotsyn:AVERAGE:%8.1lf %sBps", - "GPRINT:newnotsyn:MIN:%8.1lf %sBps", - "GPRINT:newnotsyn:LAST:%8.1lf %sBps\\j", - "STACK:portscan".$color{"color16"}."A0:".sprintf("%-25s",$Lang::tr{'portscans'}), - "GPRINT:portscan:MAX:%8.1lf %sBps", - "GPRINT:portscan:AVERAGE:%8.1lf %sBps", - "GPRINT:portscan:MIN:%8.1lf %sBps", - "GPRINT:portscan:LAST:%8.1lf %sBps\\j", - "STACK:spoofedmartian".$color{"color12"}."A0:".sprintf("%-25s",$Lang::tr{'spoofed or martians'}), - "GPRINT:spoofedmartian:MAX:%8.1lf %sBps", - "GPRINT:spoofedmartian:AVERAGE:%8.1lf %sBps", - "GPRINT:spoofedmartian:MIN:%8.1lf %sBps", - "GPRINT:spoofedmartian:LAST:%8.1lf %sBps\\j", - "STACK:hostilein".$color{"color13"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks in'}), - "GPRINT:hostilein:MAX:%8.1lf %sBps", - "GPRINT:hostilein:AVERAGE:%8.1lf %sBps", - "GPRINT:hostilein:MIN:%8.1lf %sBps", - "GPRINT:hostilein:LAST:%8.1lf %sBps\\j", - "STACK:hostileout".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks out'}), - "GPRINT:hostileout:MAX:%8.1lf %sBps", - "GPRINT:hostileout:AVERAGE:%8.1lf %sBps", - "GPRINT:hostileout:MIN:%8.1lf %sBps", - "GPRINT:hostileout:LAST:%8.1lf %sBps\\j", - "LINE:hostile#000000A0:".sprintf("%-25s",$Lang::tr{'hostile networks total'}), - "GPRINT:hostile:MAX:%8.1lf %sBps", - "GPRINT:hostile:AVERAGE:%8.1lf %sBps", - "GPRINT:hostile:MIN:%8.1lf %sBps", - "GPRINT:hostile:LAST:%8.1lf %sBps\\j", - ); + if ( -e "$mainsettings{'RRDLOG'}/collectd/localhost/iptables-filter-HOSTILE_DROP/ipt_bytes-DROP_HOSTILE.rrd" ) { + RRDs::graph( + @GRAPH_ARGS, + "-", + "--start", + "-1".$period, + "-r", + "-t ".$Lang::tr{'firewall hits per'}." ".$Lang::tr{$period."-graph"}, + "-v ".$Lang::tr{'bytes per second'}, + "--color=SHADEA".$color{"color19"}, + "--color=SHADEB".$color{"color19"}, + "--color=BACK".$color{"color21"}, + "DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYOUT/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE", + "DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYIN/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE", + "DEF:forward=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYFWD/ipt_bytes-DROP_FORWARD.rrd:value:AVERAGE", + "DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE", + "DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE", + "DEF:spoofedmartian=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-SPOOFED_MARTIAN/ipt_bytes-DROP_SPOOFED_MARTIAN.rrd:value:AVERAGE", + "DEF:hostilein=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_IN/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + "DEF:hostileout=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_OUT/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + "DEF:hostilelegacy=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + + # This creates a new combined hostile segment. + # Previously we did not split into incoming/outgoing, but we cannot go back in time. This CDEF will take the values + # from the old RRD database if it exists and if those values are UNKNOWN (time period after Hostile was split into In and Out), + # we replace them with the sum of IN + OUT. + "CDEF:hostile=hostilelegacy,UN,hostilein,hostileout,+,hostilelegacy,IF", + + "COMMENT:".sprintf("%-26s",$Lang::tr{'caption'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'average'}), + "COMMENT:".sprintf("%14s",$Lang::tr{'minimal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j", + "AREA:output".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (OUTPUT)"), + "GPRINT:output:MAX:%8.1lf %sBps", + "GPRINT:output:AVERAGE:%8.1lf %sBps", + "GPRINT:output:MIN:%8.1lf %sBps", + "GPRINT:output:LAST:%8.1lf %sBps\\j", + "STACK:forward".$color{"color23"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (FORWARD)"), + "GPRINT:forward:MAX:%8.1lf %sBps", + "GPRINT:forward:AVERAGE:%8.1lf %sBps", + "GPRINT:forward:MIN:%8.1lf %sBps", + "GPRINT:forward:LAST:%8.1lf %sBps\\j", + "STACK:input".$color{"color24"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (INPUT)"), + "GPRINT:input:MAX:%8.1lf %sBps", + "GPRINT:input:AVERAGE:%8.1lf %sBps", + "GPRINT:input:MIN:%8.1lf %sBps", + "GPRINT:input:LAST:%8.1lf %sBps\\j", + "STACK:newnotsyn".$color{"color14"}."A0:".sprintf("%-25s","NewNotSYN"), + "GPRINT:newnotsyn:MAX:%8.1lf %sBps", + "GPRINT:newnotsyn:AVERAGE:%8.1lf %sBps", + "GPRINT:newnotsyn:MIN:%8.1lf %sBps", + "GPRINT:newnotsyn:LAST:%8.1lf %sBps\\j", + "STACK:portscan".$color{"color16"}."A0:".sprintf("%-25s",$Lang::tr{'portscans'}), + "GPRINT:portscan:MAX:%8.1lf %sBps", + "GPRINT:portscan:AVERAGE:%8.1lf %sBps", + "GPRINT:portscan:MIN:%8.1lf %sBps", + "GPRINT:portscan:LAST:%8.1lf %sBps\\j", + "STACK:spoofedmartian".$color{"color12"}."A0:".sprintf("%-25s",$Lang::tr{'spoofed or martians'}), + "GPRINT:spoofedmartian:MAX:%8.1lf %sBps", + "GPRINT:spoofedmartian:AVERAGE:%8.1lf %sBps", + "GPRINT:spoofedmartian:MIN:%8.1lf %sBps", + "GPRINT:spoofedmartian:LAST:%8.1lf %sBps\\j", + "STACK:hostilein".$color{"color13"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks in'}), + "GPRINT:hostilein:MAX:%8.1lf %sBps", + "GPRINT:hostilein:AVERAGE:%8.1lf %sBps", + "GPRINT:hostilein:MIN:%8.1lf %sBps", + "GPRINT:hostilein:LAST:%8.1lf %sBps\\j", + "STACK:hostileout".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks out'}), + "GPRINT:hostileout:MAX:%8.1lf %sBps", + "GPRINT:hostileout:AVERAGE:%8.1lf %sBps", + "GPRINT:hostileout:MIN:%8.1lf %sBps", + "GPRINT:hostileout:LAST:%8.1lf %sBps\\j", + "LINE:hostile#000000A0:".sprintf("%-25s",$Lang::tr{'hostile networks total'}), + "GPRINT:hostile:MAX:%8.1lf %sBps", + "GPRINT:hostile:AVERAGE:%8.1lf %sBps", + "GPRINT:hostile:MIN:%8.1lf %sBps", + "GPRINT:hostile:LAST:%8.1lf %sBps\\j", + ); + }else{ + RRDs::graph( + @GRAPH_ARGS, + "-", + "--start", + "-1".$period, + "-r", + "-t ".$Lang::tr{'firewall hits per'}." ".$Lang::tr{$period."-graph"}, + "-v ".$Lang::tr{'bytes per second'}, + "--color=SHADEA".$color{"color19"}, + "--color=SHADEB".$color{"color19"}, + "--color=BACK".$color{"color21"}, + "DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYOUT/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE", + "DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYIN/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE", + "DEF:forward=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYFWD/ipt_bytes-DROP_FORWARD.rrd:value:AVERAGE", + "DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE", + "DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE", + "DEF:spoofedmartian=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-SPOOFED_MARTIAN/ipt_bytes-DROP_SPOOFED_MARTIAN.rrd:value:AVERAGE", + "DEF:hostilein=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_IN/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + "DEF:hostileout=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-HOSTILE_DROP_OUT/ipt_bytes-DROP_HOSTILE.rrd:value:AVERAGE", + + # This creates a new combined hostile segment. + # If we started collecting IN/OUT, ie the old single Hostile RRD database is not available then this CDEF will take the values + # from the sum of IN + OUT. + "CDEF:hostile=hostilein,hostileout,+", + + "COMMENT:".sprintf("%-26s",$Lang::tr{'caption'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'average'}), + "COMMENT:".sprintf("%14s",$Lang::tr{'minimal'}), + "COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j", + "AREA:output".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (OUTPUT)"), + "GPRINT:output:MAX:%8.1lf %sBps", + "GPRINT:output:AVERAGE:%8.1lf %sBps", + "GPRINT:output:MIN:%8.1lf %sBps", + "GPRINT:output:LAST:%8.1lf %sBps\\j", + "STACK:forward".$color{"color23"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (FORWARD)"), + "GPRINT:forward:MAX:%8.1lf %sBps", + "GPRINT:forward:AVERAGE:%8.1lf %sBps", + "GPRINT:forward:MIN:%8.1lf %sBps", + "GPRINT:forward:LAST:%8.1lf %sBps\\j", + "STACK:input".$color{"color24"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}." (INPUT)"), + "GPRINT:input:MAX:%8.1lf %sBps", + "GPRINT:input:AVERAGE:%8.1lf %sBps", + "GPRINT:input:MIN:%8.1lf %sBps", + "GPRINT:input:LAST:%8.1lf %sBps\\j", + "STACK:newnotsyn".$color{"color14"}."A0:".sprintf("%-25s","NewNotSYN"), + "GPRINT:newnotsyn:MAX:%8.1lf %sBps", + "GPRINT:newnotsyn:AVERAGE:%8.1lf %sBps", + "GPRINT:newnotsyn:MIN:%8.1lf %sBps", + "GPRINT:newnotsyn:LAST:%8.1lf %sBps\\j", + "STACK:portscan".$color{"color16"}."A0:".sprintf("%-25s",$Lang::tr{'portscans'}), + "GPRINT:portscan:MAX:%8.1lf %sBps", + "GPRINT:portscan:AVERAGE:%8.1lf %sBps", + "GPRINT:portscan:MIN:%8.1lf %sBps", + "GPRINT:portscan:LAST:%8.1lf %sBps\\j", + "STACK:spoofedmartian".$color{"color12"}."A0:".sprintf("%-25s",$Lang::tr{'spoofed or martians'}), + "GPRINT:spoofedmartian:MAX:%8.1lf %sBps", + "GPRINT:spoofedmartian:AVERAGE:%8.1lf %sBps", + "GPRINT:spoofedmartian:MIN:%8.1lf %sBps", + "GPRINT:spoofedmartian:LAST:%8.1lf %sBps\\j", + "STACK:hostilein".$color{"color13"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks in'}), + "GPRINT:hostilein:MAX:%8.1lf %sBps", + "GPRINT:hostilein:AVERAGE:%8.1lf %sBps", + "GPRINT:hostilein:MIN:%8.1lf %sBps", + "GPRINT:hostilein:LAST:%8.1lf %sBps\\j", + "STACK:hostileout".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'hostile networks out'}), + "GPRINT:hostileout:MAX:%8.1lf %sBps", + "GPRINT:hostileout:AVERAGE:%8.1lf %sBps", + "GPRINT:hostileout:MIN:%8.1lf %sBps", + "GPRINT:hostileout:LAST:%8.1lf %sBps\\j", + "LINE:hostile#000000A0:".sprintf("%-25s",$Lang::tr{'hostile networks total'}), + "GPRINT:hostile:MAX:%8.1lf %sBps", + "GPRINT:hostile:AVERAGE:%8.1lf %sBps", + "GPRINT:hostile:MIN:%8.1lf %sBps", + "GPRINT:hostile:LAST:%8.1lf %sBps\\j", + ); + } $ERROR = RRDs::error; return "Error in RRD::graph for firewallhits: ".$ERROR."\n" if $ERROR; } diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 230b2e595f..96859c8db4 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -271,24 +271,24 @@ usr/bin/nsupdate #usr/include/pk11/site.h #usr/include/pkcs11 #usr/include/pkcs11/pkcs11.h -usr/lib/libbind9-9.16.45.so +usr/lib/libbind9-9.16.48.so #usr/lib/libbind9.la #usr/lib/libbind9.so -usr/lib/libdns-9.16.45.so +usr/lib/libdns-9.16.48.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libirs-9.16.45.so +usr/lib/libirs-9.16.48.so #usr/lib/libirs.la #usr/lib/libirs.so -usr/lib/libisc-9.16.45.so +usr/lib/libisc-9.16.48.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.16.45.so +usr/lib/libisccc-9.16.48.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.16.45.so +usr/lib/libisccfg-9.16.48.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.16.45.so +usr/lib/libns-9.16.48.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 78c5a31ae2..1badd605ab 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.23 +usr/lib/libunbound.so.8.1.24 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/config/rootfiles/core/184/filelists/bind b/config/rootfiles/core/184/filelists/bind new file mode 120000 index 0000000000..48a0ebaefd --- /dev/null +++ b/config/rootfiles/core/184/filelists/bind @@ -0,0 +1 @@ +../../../common/bind \ No newline at end of file diff --git a/config/rootfiles/core/184/filelists/unbound b/config/rootfiles/core/184/filelists/unbound new file mode 120000 index 0000000000..66adf09242 --- /dev/null +++ b/config/rootfiles/core/184/filelists/unbound @@ -0,0 +1 @@ +../../../common/unbound \ No newline at end of file diff --git a/config/rootfiles/core/184/update.sh b/config/rootfiles/core/184/update.sh index 024c44be7f..3bf38ff8b2 100644 --- a/config/rootfiles/core/184/update.sh +++ b/config/rootfiles/core/184/update.sh @@ -81,6 +81,7 @@ telinit u /etc/init.d/vnstat start /etc/init.d/collectd restart /etc/init.d/suricata restart +/etc/init.d/unbound restart if [ -f /var/ipfire/proxy/enable ]; then /etc/init.d/squid start fi diff --git a/lfs/bind b/lfs/bind index 63e642ca89..271f8ab53b 100644 --- a/lfs/bind +++ b/lfs/bind @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 9.16.45 +VER = 9.16.48 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 2b6cea5e5b510780fb144cf9fce5fbec4adc6a2bb2186646f95afb4aa486edc326106519f149e600aec373238d55c06dfe7ac65f41016453a0967a28ec67ad7e +$(DL_FILE)_BLAKE2 = 4a503b45df412c435cb0f75b54ee1270140cccce7ecc159cdf3e0e3cbd3c0a0866b7472782f20aacf130f57df12d20a102ac6979498138ce00a2655806d003e7 install : $(TARGET) diff --git a/lfs/unbound b/lfs/unbound index 22bb2e1ceb..b852f75b9b 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.19.0 +VER = 1.19.1 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 66ec2b1cd32ac5930c088c73e884bc1fb4d35526a0c89bdbe209defd3e78326ce9b3c1a523fc1ab28b8fdf0e457280d5de7b300cf560c15d875f460bc361f5c7 +$(DL_FILE)_BLAKE2 = a48c5b9493eb0a9aa2171956e08677e1cfb7c49b53731c1b05f9192434c4d815eba972aab110ba0ee25fee1e7a57192c8b48e59bb21fb76ad7fd1c7d2d260012 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM