* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6504ab1d36ff9fa4fc2a90136150d477ee039b30
@ 2024-12-13 14:38 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2024-12-13 14:38 UTC (permalink / raw)
To: ipfire-scm
[-- Attachment #1: Type: text/plain, Size: 9226 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 6504ab1d36ff9fa4fc2a90136150d477ee039b30 (commit)
via 804ac341a18718e5593ef8d77670d28018515aa7 (commit)
via 0712a67744c6da9f0e4ddb3510af7b42d5a6c223 (commit)
via 955f8b14571d56cfd132710cdd29db30645aba67 (commit)
via 1a4d5cfd92bb1f52e6670399ef94a36fe97cdf6a (commit)
via a730bf9ed18a7cec7e820d5382b8a4b04e0b1e33 (commit)
via 106fbe6a650220e0638c77d330e4d8867439d7fd (commit)
via 38067c08c727086c92899042ef40e2f7e17115e7 (commit)
from c004ed4755890f575729aefefad567ac033c8cb5 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 6504ab1d36ff9fa4fc2a90136150d477ee039b30
Merge: a730bf9ed1 804ac341a1
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Dec 13 14:37:54 2024 +0000
Merge branch 'master' into next
commit a730bf9ed18a7cec7e820d5382b8a4b04e0b1e33
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Fri Dec 13 14:35:18 2024 +0000
core191: Ship suricata
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 106fbe6a650220e0638c77d330e4d8867439d7fd
Author: Adolf Belka <adolf.belka(a)ipfire.org>
Date: Thu Dec 12 20:59:56 2024 +0100
suricata: Update to version 7.0.8
- Update from version 7.0.7 to 7.0.8
- Update of rootfile not required
- Changelog
7.0.8
Security #7412: tcp: generic detection bypass using TCP urgent support (7.0.x
backport)(HIGH - CVE 2024-55629)
Security #7405: dns: quadratic complexity in logging and invalid json as output
(7.0.x backport)(HIGH - CVE 2024-55628)
Security #7404: tcp: segfault on StreamingBufferSlideToOffsetWithRegions (7.0.x
backport)(CRITICAL - CVE 2024-55627)
Security #7367: bpf: oversized bpf file can lead to buffer overflow (7.0.x
backport)(LOW - CVE 2024-55626)
Security #7306: detect: write to read-only memory in transforms (7.0.x backport)
(CRITICAL - CVE 2024-55605)
Bug #7445: dpdk: RSS key length missmatch on ice (E810) card with DPDK version
22.11.6 (7.0.x backport)
Bug #7434: requires: rules with unmet requirements are still loaded (7.0.x
backport)
Bug #7432: detect: decoder event rules fail to match on invalid packets (7.0.x
backport)
Bug #7407: detect: missing app-layer metadata in alerts (7.0.x backport)
Bug #7368: flow: flow timeout pseudo packet triggers unexpected alert (7.0.x
backport)
Bug #7362: rules: unknown internal events not being detected as errors (7.0.x
backport)
Bug #7339: rust: different int types turn garbage on FFI boundary (7.0.x backport)
Bug #7335: asan/profiling: global-buffer-overflow error (7.0.x backport)
Bug #7327: http: FN with prefilter if the first of multi buffer did not match
(7.0.x backport)
Bug #7324: mqtt: wrong and missing direction for keywords (7.0.x backport)
Bug #7310: http: incorrect file direction handling (7.0.x backport)
Bug #7308: conf: memleak if yaml parser is initialized before checking if file
exists (7.0.x backport)
Bug #7307: detect: memleak in case of errors during initialization (7.0.x
backport)
Bug #7301: output: oversized records lead to invalid json (7.0.x backport)
Bug #7295: detect: sip.stat_code keyword uses wrong buffer name
Bug #7294: conf: nullptr dereference if mem alloc fails for a node in yaml
parser (7.0.x backport)
Optimization #7316: template: remove usage of template-rust (7.0.x backport)
Optimization #7275: tcp/reassemble: GetBlock takes O(nlgn) in worst case (7.0.x
backport)
Feature #7439: eve/alert: enrich decoder event rules (7.0.x backport)
Task #7427: flowint: add isnotset support (7.0.x backport)
Task #7288: schema: add missing tls fields certificate and chain (7.0.x backport)
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/backup/include | 1 +
config/rootfiles/common/openssh | 1 +
config/rootfiles/{oldcore/131 => core/191}/filelists/suricata | 0
config/rootfiles/core/191/update.sh | 1 +
config/rootfiles/oldcore/190/update.sh | 8 ++++++++
config/ssh/sshd_config | 4 +++-
lfs/openssh | 4 ++++
lfs/suricata | 4 ++--
8 files changed, 20 insertions(+), 3 deletions(-)
copy config/rootfiles/{oldcore/131 => core/191}/filelists/suricata (100%)
Difference in files:
diff --git a/config/backup/include b/config/backup/include
index f0708c87f..0bf9440d3 100644
--- a/config/backup/include
+++ b/config/backup/include
@@ -10,6 +10,7 @@ etc/logrotate.d
etc/passwd
etc/shadow
etc/ssh/sshd_config
+etc/ssh/sshd_config.d
etc/ssh/ssh_host*
etc/squid/squid.conf.local
etc/squid/squid.conf.pre.local
diff --git a/config/rootfiles/common/openssh b/config/rootfiles/common/openssh
index f7b479f55..d25651348 100644
--- a/config/rootfiles/common/openssh
+++ b/config/rootfiles/common/openssh
@@ -8,6 +8,7 @@ etc/ssh/ssh_config
#etc/ssh/ssh_host_rsa_key
#etc/ssh/ssh_host_rsa_key.pub
etc/ssh/sshd_config
+etc/ssh/sshd_config.d
usr/bin/scp
usr/bin/sftp
usr/bin/ssh
diff --git a/config/rootfiles/core/191/filelists/suricata b/config/rootfiles/core/191/filelists/suricata
new file mode 120000
index 000000000..f671f6993
--- /dev/null
+++ b/config/rootfiles/core/191/filelists/suricata
@@ -0,0 +1 @@
+../../../common/suricata
\ No newline at end of file
diff --git a/config/rootfiles/core/191/update.sh b/config/rootfiles/core/191/update.sh
index f1c254611..b466e3fad 100644
--- a/config/rootfiles/core/191/update.sh
+++ b/config/rootfiles/core/191/update.sh
@@ -63,6 +63,7 @@ ldconfig
/usr/local/bin/filesystem-cleanup
# Start services
+/etc/init.d/suricata restart
# This update needs a reboot...
#touch /var/run/need_reboot
diff --git a/config/rootfiles/oldcore/190/update.sh b/config/rootfiles/oldcore/190/update.sh
index cec9492eb..400cb08ff 100644
--- a/config/rootfiles/oldcore/190/update.sh
+++ b/config/rootfiles/oldcore/190/update.sh
@@ -104,6 +104,14 @@ ldconfig
# Filesytem cleanup
/usr/local/bin/filesystem-cleanup
+# Load the RSA key on systems that still have one
+if [ -e "/etc/ssh/ssh_host_rsa_key" ]; then
+ (
+ echo "# Load the legacy RSA key - Deprecated in Core Update 190"
+ echo "HostKey /etc/ssh/ssh_host_rsa_key"
+ ) > /etc/ssh/sshd_config.d/rsa.conf
+fi
+
# Apply local configuration to sshd_config
/usr/local/bin/sshctrl
diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config
index e338f8cef..7b687457c 100644
--- a/config/ssh/sshd_config
+++ b/config/ssh/sshd_config
@@ -27,7 +27,6 @@ MACs hmac-sha2-512-etm(a)openssh.com,hmac-sha2-256-etm(a)openssh.com,umac-128-etm(a)op
# Only allow cryptographically safe SSH host keys (adjust paths if needed)
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_ecdsa_key
-HostKey /etc/ssh/ssh_host_rsa_key
# Only allow login via public key by default
PubkeyAuthentication yes
@@ -57,4 +56,7 @@ TCPKeepAlive no
# Add support for SFTP
Subsystem sftp /usr/lib/openssh/sftp-server
+# Include additional sshd config files.
+Include /etc/ssh/sshd_config.d/*.conf
+
# EOF
diff --git a/lfs/openssh b/lfs/openssh
index c14c8267c..b1c9a1635 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -91,5 +91,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
install -v -m 644 $(DIR_SRC)/config/ssh/ssh_config \
/etc/ssh/ssh_config
+ # Create directory for additional config
+ # config files.
+ mkdir -pv /etc/ssh/sshd_config.d/
+
@rm -rf $(DIR_APP)
@$(POSTBUILD)
diff --git a/lfs/suricata b/lfs/suricata
index b563ff9da..2b05c3c54 100644
--- a/lfs/suricata
+++ b/lfs/suricata
@@ -24,7 +24,7 @@
include Config
-VER = 7.0.7
+VER = 7.0.8
THISAPP = suricata-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = dc39279b99880762bee2b1788fea9046dc63c01560332ffc167844673314165456dcbff3b0d05d32c931741b397fd68e9e294d2ee6c526a3d286445c2a83b789
+$(DL_FILE)_BLAKE2 = 8571a6368b90e18046cdcf71f53e1b59e895ea8fe2d8f996ef614a890b520671f5dcac10014555880e408060913df1dab4c473bf083e7c0451c6a4b93bedd047
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-12-13 14:38 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-12-13 14:38 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6504ab1d36ff9fa4fc2a90136150d477ee039b30 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox