~vcs-imports/ipfire/ipfire-2.x : changes

~vcs-imports/ipfire/ipfire-2.x » Changes from revision 12542

From Revision 11389 to 11370

Rev	Summary	Authors	Date
11389	suricata: Update to 6.0.12 suricata: Update to 6.0.12 "6.0.12 -- 2023-05-08 Bug #6040: tcp: failed assertion ASSERT: !(ssn->state != TCP_SYN_SENT) (6.0.x backport) Bug #6039: TCP resets have incorrect len, nh in IPv6 (6.0.x backport) Bug #6034: time: integer comparison with different signs (6.0.x backport) Bug #6031: af-packet: reload not occurring until packets are seen (6.0.x backport) Bug #6020: smtp: fuzz debug assertion trigger (6.0.x backport) Bug #6018: scan-build warning for mime decoder (6.0.x backport) Bug #6017: scan-build warnings for ac implementations (6.0.x backport) Bug #6016: scan-build warnings in radix implementation (6.0.x backport) Bug #6015: scan-build warning for detect sigordering (6.0.x backport) Bug #6014: scan-build warnings for detect address handling (6.0.x backport) Bug #6013: scan-build warning for detect port handling (6.0.x backport) Bug #6007: Unexpected behavior of `endswith` in combination with negated content matches (6.0.x backport) Bug #5999: exception/policy: make work with simulated flow memcap (6.0.x backport) Bug #5997: perf shows excessive time in IPOnlyMatchPacket (6.0.x backport) Bug #5980: rust: warning for future compile errors Bug #5961: smb: wrong endian conversion when parse NTLM Negotiate Flags (6.0.x backport) Bug #5958: bpf: postpone IPS check after IPS runmode is determined from the configuration file (6.0.x backport) Bug #5934: app-layer-htp: Condition depending on enabled IPS mode never true (6.0.x backport) Optimization #6033: detect using uninitialized engine mode (6.0.x backport) Feature #5996: Add support for 'inner' PF_RING clustering modes (6.0.x backport) Task #6052: github-ci: add windows + windivert build (6.0.x backport)" Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>	Matthias Fischer	1 year ago
11388	core175: Remove file that has been deleted through reverts core175: Remove file that has been deleted through reverts Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11387	Revert "web-user-interface: Addition of new icon for secure ... Revert "web-user-interface: Addition of new icon for secure connection certificate download" This reverts commit 18bece0edbd817933f48fdbffcffffd074e42c05. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11386	Revert "en.pl: Update to language wording for secure connect... Revert "en.pl: Update to language wording for secure connection icon" This reverts commit 070abb0d011ff71e5aefd170dcb366d81bdf2497. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11385	Revert "de.pl: Change language text for secure icon wording" Revert "de.pl: Change language text for secure icon wording" This reverts commit 82822934ba769bca4235cd2a02f848cdc8511120. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11384	Revert "ovpnmain.cgi: Fix for bug#11048 - insecure download ... Revert "ovpnmain.cgi: Fix for bug#11048 - insecure download icon shown for connections with a password" This reverts commit 762c88ec4d85e3a4f7265b887f054cbe7703eb7c. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11383	Revert "update.sh: Adds code to update an existing ovpnconfi... Revert "update.sh: Adds code to update an existing ovpnconfig with pass or no-pass" This reverts commit 9cac1034bcfe423c4a5e0f547664fbabcf9050e6. https://lists.ipfire.org/pipermail/development/2023-May/015952.html Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11382	Revert "core175: Ship updated clwarn.cgi" Revert "core175: Ship updated clwarn.cgi" This reverts commit 9fae7ab32b1dacf9c6476e9733f6ebe905343aa8. This file is not part of the core distribution, but part of the squidclamav package. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11381	core175: Ship updated clwarn.cgi core175: Ship updated clwarn.cgi Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11380	clwarn.cgi: Remove XSS clwarn.cgi: Remove XSS Fixes: #12966 Fixes: CVE-2022-44392 Reported-by: Arthur Naullet <arthur.naullet@epita.fr> Reported-by: Rafael Lima <isec-researcher@protonmail.com> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>	Michael Tremer	1 year ago
11379	ovpnmain.cgi: Fixes Bug#13117 - adds legacy option to openss... ovpnmain.cgi: Fixes Bug#13117 - adds legacy option to openssl commands for cert & key extraction - Any insecure connections made with openssl-3.x can have the cert and key extracted but if the insecure connection was made from prior to CU175 Testing then it used openssl-1.1.1 which causes an error under openssl-3.x due to the old version being able to accept older ciphers no longer accepted by openssl-3.x - Adding the -legacy option to the openssl commands enables openssl-3.x to successfully open them and extract the cert and key - Successfully tested on a vm system. Confirmed that the downloaded version under openssl-3.x worked exactly the same as the version downloaded under openssl-1.1.1 Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>	Adolf Belka	1 year ago
11378	openssl: Fix for Bug#13117 - adds legacy option in for opens... openssl: Fix for Bug#13117 - adds legacy option in for openssl extraction of cert & key - OpenSSL-3.x gives an error when trying to open insecure .p12 files to extract the cert and key for the insecure package download option. - To make this work the -legacy option is needed in the openssl command, which requires the legacy.so library to be available. - Successfully tested on a vm system. - Patch set built on Master (CU175 Testing) Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>	Adolf Belka	1 year ago
11377	kernel: update to 6.1.29 kernel: update to 6.1.29 Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>	Arne Fitzenreiter	1 year ago
11376	rsnapshot: New addon rsnapshot: New addon - What is it? rsnapshot is a filesystem snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of the ipfire device. The code makes extensive use of hard links whenever possible, to greatly reduce the disk space required. See: https://rsnapshot.org - Why is it needed? Rsnapshot backups run multiple times per day (e.g., once per day up to 24 times per day). Rsnapshot is much easier to configure, setup and use than the borg backup add-on. (I found borg somewhat confusing). Rsnapshot completes each backup very fast. Unlike borg, rsnapshot does not compress each backup before storage. During a complete rebuild, borg backup need installation of the borg add-on to recover archived files. Rsnapshot backups can be copied directly from the backup drive. Current backups (backup.pl or borg) could corrupt sqlite3 databases by running a backup during a database write. This add-on includes a script specifically for sqlite backups. - IPFire Wiki In process at: https://wiki.ipfire.org/addons/rsnapshot Thanks to Gerd for creating a first build and a nice template for me! Signed-off-by: Jon Murphy <jon.murphy@ipfire.org>	Jon Murphy	1 year ago
11375	Core Update 175: Ship harfbuzz Core Update 175: Ship harfbuzz Signed-off-by: Peter Müller <peter.mueller@ipfire.org>	Peter Müller	1 year ago
11374	Core Update 175: Merely reload firewall engine, instead of r... Core Update 175: Merely reload firewall engine, instead of restart it The latter will not work until a reboot due to the Core Update featuring a new kernel, and will instead result in the following error: modprobe: FATAL: Module nf_log_ipv4 not found in directory /lib/modules/6.1.27-ipfire Signed-off-by: Peter Müller <peter.mueller@ipfire.org>	Peter Müller	1 year ago
11373	Core Update 175: Ship necessary files for OpenVPN CGI change... Core Update 175: Ship necessary files for OpenVPN CGI changes Signed-off-by: Peter Müller <peter.mueller@ipfire.org>	Peter Müller	1 year ago
11372	update.sh: Adds code to update an existing ovpnconfig with p... update.sh: Adds code to update an existing ovpnconfig with pass or no-pass - The code checks first if ovpnconfig exists and is not empty. - Then it makes all net2net connections no-pass since they do not use encryption - Then it cycles through all .p12 files and checks with openssl if a password exists or not. If a password is present then pass is added to index 41 and if not then no-pass is added to index 41 - This code should be left in update.sh for future Core Updates in case people don't update with Core Update 175 but leave it till later. This code works fine on code that already has pass or no-pass entered into index 41 in ovpnconfig Fixes: Bug#11048 Suggested-by: Erik Kapfer <ummeegge@ipfire.org> Suggested-by: Adolf Belka <adolf.belka@ipfire.org> Tested-by: Erik Kapfer <ummeegge@ipfire.org> Tested-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>	Adolf Belka	1 year ago
11371	web-user-interface: Addition of new icon for secure connecti... web-user-interface: Addition of new icon for secure connection certificate download - This uses a padlock icon from https://commons.wikimedia.org/wiki/File:Encrypted.png - The license for this image is the following:- This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. This library is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose. See version 2.1 and version 3 of the GNU Lesser General Public License for more details. - Based on the above license I believe it can be used by IPFire covered by the GNU General Public License that is used for it. - The icon image was made by taking the existing openvpn.png file and superimposing the padlock icon on top of it at a 12x12 pixel format and naming it openvpn_encrypted.png Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>	Adolf Belka	1 year ago
11370	en.pl: Update to language wording for secure connection icon en.pl: Update to language wording for secure connection icon Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>	Adolf Belka	1 year ago