This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 6ccbd48aa9b999880c5944e9c1eb2bb1dca81b13 (commit) via 2be32bfb99176062ad0ec4649578cf6e6c79bc88 (commit) via 76b6bc3e9d4a40624c2bc80b5f408844359346ba (commit) from 57853da08b5dbc722df4c38d6ef33a39d97242e1 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 6ccbd48aa9b999880c5944e9c1eb2bb1dca81b13 Author: Arne Fitzenreiter arne_f@ipfire.org Date: Tue Nov 5 14:34:35 2024 +0100

core190: ship intel-microcode

Signed-off-by: Arne Fitzenreiter arne_f@ipfire.org

commit 2be32bfb99176062ad0ec4649578cf6e6c79bc88 Author: Adolf Belka adolf.belka@ipfire.org Date: Wed Oct 30 14:28:38 2024 +0100

intel-microcode: Update to version 20241029

- Update from version 20240910 to 20241029 - Update of rootfile not required - Changelog 20241029 Update for functional issues. Refer to 14th/13th Generation Intel® Core™ Processor Specification Update for details at https://cdrdv2.intel.com/v1/dl/getContent/740518 Updated Platforms Processor Stepping F-M-S/PI Old Ver New Ver Products RPL-E/HX/S B0 06-b7-01/32 00000129 0000012b Core Gen13/Gen14

Signed-off-by: Adolf Belka adolf.belka@ipfire.org Signed-off-by: Arne Fitzenreiter arne_f@ipfire.org

commit 76b6bc3e9d4a40624c2bc80b5f408844359346ba Author: Michael Tremer michael.tremer@ipfire.org Date: Mon Oct 21 17:03:06 2024 +0000

suricata: Explicitly ignore IPsec traffic unless enabled

Signed-off-by: Michael Tremer michael.tremer@ipfire.org Signed-off-by: Arne Fitzenreiter arne_f@ipfire.org

-----------------------------------------------------------------------

Summary of changes: .../121 => core/190}/filelists/x86_64/intel-microcode | 0 lfs/intel-microcode | 4 ++-- src/initscripts/system/suricata | 12 ++++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/121 => core/190}/filelists/x86_64/intel-microcode (100%)

Difference in files: diff --git a/config/rootfiles/core/190/filelists/x86_64/intel-microcode b/config/rootfiles/core/190/filelists/x86_64/intel-microcode new file mode 120000 index 0000000000..d5ac074e2e --- /dev/null +++ b/config/rootfiles/core/190/filelists/x86_64/intel-microcode @@ -0,0 +1 @@ +../../../../common/x86_64/intel-microcode \ No newline at end of file diff --git a/lfs/intel-microcode b/lfs/intel-microcode index 7b77c25432..1d14b0524b 100644 --- a/lfs/intel-microcode +++ b/lfs/intel-microcode @@ -24,7 +24,7 @@

include Config

-VER = 20240910 +VER = 20241029

THISAPP = Intel-Linux-Processor-Microcode-Data-Files-microcode-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_BLAKE2 = b4c353dd340ef8004e5be2e596de0ebaf8366684a3371207e14d3d8c0e4bbdc5a9c75d8279d280d1029452368556a0c2e7bf85f3fe75f1b1560e16c953f223b7 +$(DL_FILE)_BLAKE2 = 22b6b4a4a667e972da6663195bd22facb2473fb6204936f1f548529f2fb03eb4d8c8ec7c87cb3fa51f9845a26e738df245da97e3459127c7352d16bffb9482b2

install : $(TARGET)

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index a753e32e68..a0f6079712 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -111,6 +111,18 @@ generate_fw_rules() { if [ "${!status}" = "on" ]; then # Handle IPsec packets case "${zone}" in + RED) + # If IPsec is not enabled, skip everything that is IPsec traffic + if [ "${ENABLE_IDS_IPSEC}" != "on" ]; then + for intf in $(network_get_intfs "${zone}"); do + iptables -w -t mangle -A IPS_SCAN_IN \ + -i "${intf}" -m policy --pol ipsec --dir in -j RETURN + iptables -w -t mangle -A IPS_SCAN_OUT \ + -o "${intf}" -m policy --pol ipsec --dir out -j RETURN + done + fi + ;; + IPSEC) iptables -w -t mangle -A IPS_SCAN_IN \ -m policy --pol ipsec --dir in -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"

hooks/post-receive -- IPFire 2.x development tree