This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 6504ab1d36ff9fa4fc2a90136150d477ee039b30 (commit) via 804ac341a18718e5593ef8d77670d28018515aa7 (commit) via 0712a67744c6da9f0e4ddb3510af7b42d5a6c223 (commit) via 955f8b14571d56cfd132710cdd29db30645aba67 (commit) via 1a4d5cfd92bb1f52e6670399ef94a36fe97cdf6a (commit) via a730bf9ed18a7cec7e820d5382b8a4b04e0b1e33 (commit) via 106fbe6a650220e0638c77d330e4d8867439d7fd (commit) via 38067c08c727086c92899042ef40e2f7e17115e7 (commit) from c004ed4755890f575729aefefad567ac033c8cb5 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 6504ab1d36ff9fa4fc2a90136150d477ee039b30 Merge: a730bf9ed1 804ac341a1 Author: Michael Tremer michael.tremer@ipfire.org Date: Fri Dec 13 14:37:54 2024 +0000

Merge branch 'master' into next

commit a730bf9ed18a7cec7e820d5382b8a4b04e0b1e33 Author: Michael Tremer michael.tremer@ipfire.org Date: Fri Dec 13 14:35:18 2024 +0000

core191: Ship suricata

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 106fbe6a650220e0638c77d330e4d8867439d7fd Author: Adolf Belka adolf.belka@ipfire.org Date: Thu Dec 12 20:59:56 2024 +0100

suricata: Update to version 7.0.8

- Update from version 7.0.7 to 7.0.8 - Update of rootfile not required - Changelog 7.0.8 Security #7412: tcp: generic detection bypass using TCP urgent support (7.0.x backport)(HIGH - CVE 2024-55629) Security #7405: dns: quadratic complexity in logging and invalid json as output (7.0.x backport)(HIGH - CVE 2024-55628) Security #7404: tcp: segfault on StreamingBufferSlideToOffsetWithRegions (7.0.x backport)(CRITICAL - CVE 2024-55627) Security #7367: bpf: oversized bpf file can lead to buffer overflow (7.0.x backport)(LOW - CVE 2024-55626) Security #7306: detect: write to read-only memory in transforms (7.0.x backport) (CRITICAL - CVE 2024-55605) Bug #7445: dpdk: RSS key length missmatch on ice (E810) card with DPDK version 22.11.6 (7.0.x backport) Bug #7434: requires: rules with unmet requirements are still loaded (7.0.x backport) Bug #7432: detect: decoder event rules fail to match on invalid packets (7.0.x backport) Bug #7407: detect: missing app-layer metadata in alerts (7.0.x backport) Bug #7368: flow: flow timeout pseudo packet triggers unexpected alert (7.0.x backport) Bug #7362: rules: unknown internal events not being detected as errors (7.0.x backport) Bug #7339: rust: different int types turn garbage on FFI boundary (7.0.x backport) Bug #7335: asan/profiling: global-buffer-overflow error (7.0.x backport) Bug #7327: http: FN with prefilter if the first of multi buffer did not match (7.0.x backport) Bug #7324: mqtt: wrong and missing direction for keywords (7.0.x backport) Bug #7310: http: incorrect file direction handling (7.0.x backport) Bug #7308: conf: memleak if yaml parser is initialized before checking if file exists (7.0.x backport) Bug #7307: detect: memleak in case of errors during initialization (7.0.x backport) Bug #7301: output: oversized records lead to invalid json (7.0.x backport) Bug #7295: detect: sip.stat_code keyword uses wrong buffer name Bug #7294: conf: nullptr dereference if mem alloc fails for a node in yaml parser (7.0.x backport) Optimization #7316: template: remove usage of template-rust (7.0.x backport) Optimization #7275: tcp/reassemble: GetBlock takes O(nlgn) in worst case (7.0.x backport) Feature #7439: eve/alert: enrich decoder event rules (7.0.x backport) Task #7427: flowint: add isnotset support (7.0.x backport) Task #7288: schema: add missing tls fields certificate and chain (7.0.x backport)

Signed-off-by: Adolf Belka adolf.belka@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/backup/include | 1 + config/rootfiles/common/openssh | 1 + config/rootfiles/{oldcore/131 => core/191}/filelists/suricata | 0 config/rootfiles/core/191/update.sh | 1 + config/rootfiles/oldcore/190/update.sh | 8 ++++++++ config/ssh/sshd_config | 4 +++- lfs/openssh | 4 ++++ lfs/suricata | 4 ++-- 8 files changed, 20 insertions(+), 3 deletions(-) copy config/rootfiles/{oldcore/131 => core/191}/filelists/suricata (100%)

Difference in files: diff --git a/config/backup/include b/config/backup/include index f0708c87f..0bf9440d3 100644 --- a/config/backup/include +++ b/config/backup/include @@ -10,6 +10,7 @@ etc/logrotate.d etc/passwd etc/shadow etc/ssh/sshd_config +etc/ssh/sshd_config.d etc/ssh/ssh_host* etc/squid/squid.conf.local etc/squid/squid.conf.pre.local diff --git a/config/rootfiles/common/openssh b/config/rootfiles/common/openssh index f7b479f55..d25651348 100644 --- a/config/rootfiles/common/openssh +++ b/config/rootfiles/common/openssh @@ -8,6 +8,7 @@ etc/ssh/ssh_config #etc/ssh/ssh_host_rsa_key #etc/ssh/ssh_host_rsa_key.pub etc/ssh/sshd_config +etc/ssh/sshd_config.d usr/bin/scp usr/bin/sftp usr/bin/ssh diff --git a/config/rootfiles/core/191/filelists/suricata b/config/rootfiles/core/191/filelists/suricata new file mode 120000 index 000000000..f671f6993 --- /dev/null +++ b/config/rootfiles/core/191/filelists/suricata @@ -0,0 +1 @@ +../../../common/suricata \ No newline at end of file diff --git a/config/rootfiles/core/191/update.sh b/config/rootfiles/core/191/update.sh index f1c254611..b466e3fad 100644 --- a/config/rootfiles/core/191/update.sh +++ b/config/rootfiles/core/191/update.sh @@ -63,6 +63,7 @@ ldconfig /usr/local/bin/filesystem-cleanup

# Start services +/etc/init.d/suricata restart

# This update needs a reboot... #touch /var/run/need_reboot diff --git a/config/rootfiles/oldcore/190/update.sh b/config/rootfiles/oldcore/190/update.sh index cec9492eb..400cb08ff 100644 --- a/config/rootfiles/oldcore/190/update.sh +++ b/config/rootfiles/oldcore/190/update.sh @@ -104,6 +104,14 @@ ldconfig # Filesytem cleanup /usr/local/bin/filesystem-cleanup

+# Load the RSA key on systems that still have one +if [ -e "/etc/ssh/ssh_host_rsa_key" ]; then + ( + echo "# Load the legacy RSA key - Deprecated in Core Update 190" + echo "HostKey /etc/ssh/ssh_host_rsa_key" + ) > /etc/ssh/sshd_config.d/rsa.conf +fi + # Apply local configuration to sshd_config /usr/local/bin/sshctrl

diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config index e338f8cef..7b687457c 100644 --- a/config/ssh/sshd_config +++ b/config/ssh/sshd_config @@ -27,7 +27,6 @@ MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@op # Only allow cryptographically safe SSH host keys (adjust paths if needed) HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_ecdsa_key -HostKey /etc/ssh/ssh_host_rsa_key

# Only allow login via public key by default PubkeyAuthentication yes @@ -57,4 +56,7 @@ TCPKeepAlive no # Add support for SFTP Subsystem sftp /usr/lib/openssh/sftp-server

+# Include additional sshd config files. +Include /etc/ssh/sshd_config.d/*.conf + # EOF diff --git a/lfs/openssh b/lfs/openssh index c14c8267c..b1c9a1635 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -91,5 +91,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \ /etc/ssh/ssh_config

+ # Create directory for additional config + # config files. + mkdir -pv /etc/ssh/sshd_config.d/ + @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/lfs/suricata b/lfs/suricata index b563ff9da..2b05c3c54 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@

include Config

-VER = 7.0.7 +VER = 7.0.8

THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_BLAKE2 = dc39279b99880762bee2b1788fea9046dc63c01560332ffc167844673314165456dcbff3b0d05d32c931741b397fd68e9e294d2ee6c526a3d286445c2a83b789 +$(DL_FILE)_BLAKE2 = 8571a6368b90e18046cdcf71f53e1b59e895ea8fe2d8f996ef614a890b520671f5dcac10014555880e408060913df1dab4c473bf083e7c0451c6a4b93bedd047

install : $(TARGET)

hooks/post-receive -- IPFire 2.x development tree