[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6ccbd48aa9b999880c5944e9c1eb2bb1dca81b13

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6ccbd48aa9b999880c5944e9c1eb2bb1dca81b13

[Arne Fitzenreiter]

[-- Attachment #1: Type: text/plain, Size: 4700 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  6ccbd48aa9b999880c5944e9c1eb2bb1dca81b13 (commit)
       via  2be32bfb99176062ad0ec4649578cf6e6c79bc88 (commit)
       via  76b6bc3e9d4a40624c2bc80b5f408844359346ba (commit)
      from  57853da08b5dbc722df4c38d6ef33a39d97242e1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6ccbd48aa9b999880c5944e9c1eb2bb1dca81b13
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date:   Tue Nov 5 14:34:35 2024 +0100

    core190: ship intel-microcode
    
    Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>

commit 2be32bfb99176062ad0ec4649578cf6e6c79bc88
Author: Adolf Belka <adolf.belka(a)ipfire.org>
Date:   Wed Oct 30 14:28:38 2024 +0100

    intel-microcode: Update to version 20241029
    
    - Update from version 20240910 to 20241029
    - Update of rootfile not required
    - Changelog
        20241029
    	Update for functional issues. Refer to 14th/13th Generation Intel® Core™
    	 Processor Specification Update for details at
    	 https://cdrdv2.intel.com/v1/dl/getContent/740518
    	Updated Platforms
    	 Processor   Stepping  F-M-S/PI     Old Ver   New Ver   Products
    	 RPL-E/HX/S  B0        06-b7-01/32  00000129  0000012b  Core Gen13/Gen14
    
    Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
    Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>

commit 76b6bc3e9d4a40624c2bc80b5f408844359346ba
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Mon Oct 21 17:03:06 2024 +0000

    suricata: Explicitly ignore IPsec traffic unless enabled
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
    Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 .../121 => core/190}/filelists/x86_64/intel-microcode        |  0
 lfs/intel-microcode                                          |  4 ++--
 src/initscripts/system/suricata                              | 12 ++++++++++++
 3 files changed, 14 insertions(+), 2 deletions(-)
 copy config/rootfiles/{oldcore/121 => core/190}/filelists/x86_64/intel-microcode (100%)

Difference in files:
diff --git a/config/rootfiles/core/190/filelists/x86_64/intel-microcode b/config/rootfiles/core/190/filelists/x86_64/intel-microcode
new file mode 120000
index 0000000000..d5ac074e2e
--- /dev/null
+++ b/config/rootfiles/core/190/filelists/x86_64/intel-microcode
@@ -0,0 +1 @@
+../../../../common/x86_64/intel-microcode
\ No newline at end of file
diff --git a/lfs/intel-microcode b/lfs/intel-microcode
index 7b77c25432..1d14b0524b 100644
--- a/lfs/intel-microcode
+++ b/lfs/intel-microcode
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 20240910
+VER        = 20241029
 
 THISAPP    = Intel-Linux-Processor-Microcode-Data-Files-microcode-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = b4c353dd340ef8004e5be2e596de0ebaf8366684a3371207e14d3d8c0e4bbdc5a9c75d8279d280d1029452368556a0c2e7bf85f3fe75f1b1560e16c953f223b7
+$(DL_FILE)_BLAKE2 = 22b6b4a4a667e972da6663195bd22facb2473fb6204936f1f548529f2fb03eb4d8c8ec7c87cb3fa51f9845a26e738df245da97e3459127c7352d16bffb9482b2
 
 install : $(TARGET)
 
diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index a753e32e68..a0f6079712 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -111,6 +111,18 @@ generate_fw_rules() {
 		if [ "${!status}" = "on" ]; then
 			# Handle IPsec packets
 			case "${zone}" in
+				RED)
+					# If IPsec is not enabled, skip everything that is IPsec traffic
+					if [ "${ENABLE_IDS_IPSEC}" != "on" ]; then
+						for intf in $(network_get_intfs "${zone}"); do
+							iptables -w -t mangle -A IPS_SCAN_IN \
+								-i "${intf}" -m policy --pol ipsec --dir in -j RETURN
+							iptables -w -t mangle -A IPS_SCAN_OUT \
+								-o "${intf}" -m policy --pol ipsec --dir out -j RETURN
+						done
+					fi
+					;;
+
 				IPSEC)
 					iptables -w -t mangle -A IPS_SCAN_IN \
 						-m policy --pol ipsec --dir in -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"


hooks/post-receive
--
IPFire 2.x development tree