We require this because Suricata might be restarted due to development
or rule refreshment purposes. We should then try to resume any
decoders/app-layers wherever possible.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Set this value to the same as the exception-policy to keep in sync and
hopefully have the same behaviour. In case this option is not set an
ugly message about a not correctly set value will be logged to syslog
during startup.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This will limit the suricata process to only read and write to a certain
files/directories.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This simply will skip processing a packet that caused an exception and will
allow Suricata to process all following packets of a flow.
Reference: #13638
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Updata the configuration file for suricata 7.
This includes:
* Default values for newly introduced features and parsers
* Enable recently added protocol parsers for HTTP2, QUIC, Telnet and Torrent
* Update of URL for documentation
* Fixes of various typos and other clarifications
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This change causes that if suricata crashes, the NFQUEUE will no longer
fall into a mode where ALL packets are being accepted. This used the be
the case before which opened the entire firewall.
If suricata randomly crashes, we will fall back to the "bypass" mode
where packets will bypass suricata, but nothing else.
Fixes: #13642
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
because if this file exist the cleanap script will remove the older version after downgrade
and the system still use the malewared version.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This gives us a lot of benefits:
* Speed up the extraction process
* More supported archive types due the power of libarchive
* Support of passphrase protected archives
It also fixes a problem with non extracted files next to a zero sized
file inside an archive.
Fixes#13632.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
As very simple XS based perl binding for libarchive
to get header data and extract files.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is a runtime dependency of perl-Archive-Peek-Libarchive
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is only a build dependency for perl-Arhive-Peek-Libarchive and
will not be installed on a system
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is only a build dependency for perl-Config-AutoConf and
will not be installed on a system
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is a precautionary step to avoid that we have any issues to face
because of a downgrade as new symbols have been added to liblzma 5.6.0.
Furthermore, this should avoid shipping any traces of any other
potential malware in XZ that has been added in 5.6.0 or after.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- xz version 5.6.0 and 5.6.1 discovered to have been backdoored by what looks to have
been one of the xz devs.
- IPFire looks not to be affected by the problem as we don't patch openssh to be linked
with liblzma
- However due to question marks about what else might be in these 5.6.x versions it is
better to revert back to a version that did not have the build-to-host.m4 file with the
code that modifies the build if it meets certain criteria.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- This v2 patch corrects that the previous script was looking for =on. If a user had
modified the preferences to change it to =off then the script would have resulted in
both =on and =off versions being in the settings file.
- This patch ensures that those people who updated to CU184 before the CU184-update.sh
patch fix to add the logging entries was added will get their optionsfw settings file
correctly updated with CU185
- This only adds the LOGDROPHOSTILEIN & LOGDROPHOSTILEOUT entries if they do not already
exist in the optionsfw settings file.
- This change also does the check for LOGDROPHOSTILEIN and LOGDROPHOSTILEOUT as two
separate checks and then runs the firewall update command
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- From shadow-15.0.0 all references to cracklib were removed from shadow. Apparently
some functions were no longer accessible and the shadow team decided to remove cracklib
references completely. This was not mentioned in the changelkog for 15.0.0
- This resulkts in gettinbg the message configuration error - unknown item
'CRACKKLIB_DICTPATH' ( notify administrator ) when logging in to the console.
- The login to the console occurs successfully so the message is only a warning that
cracklib is no longer used.
- IPfire does not use cracklkib anyway so this patch removes the section referring to
cracklib from the login.defs configuration file.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- This patch ensures that those people who updated to CU184 before the CU184-update.sh
patch fix to add the logging entries was added will get their optionsfw settings file
correctly updated with CU185
- This only adds the LOGDROPHOSTILEIN & LOGDROPHOSTILEOUT entries if they do noit already
exist in the optionsfw settings file.
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
At least these informations are required to display something usefull
on the webgui, even if a provider has been dropped.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 2.5.0 to commit e1266c7
- Update of rootfile
- When ppp-2.5.0 was released it had a bug bin it that the lock and run directories
had non standard defaults but also that if the directory did not exist ppp just
ignored it and continued to start but would then have error messages in the logs about
not being able to cretae the lock file
- This issue was raised in the ppp github issues and a set of patches merged into ppp.
- The plan was written in Nov 2023 that this would be released as 2.5.1, however nearly
three months later there is no sight of 2.5.1 being released and people continue to
flag up the lock directory issues and have to apply a workaround to create the directory
in local.rc
- This patch has taken the zip source tarball of master at the commit e1266c7. The zip
tarball was then extracted and then tar'd back up as a tar.gz file with the version set
at e1266c7 rather than master. I could not find any other way to get a source tarball\
created at a certain commit stage.
- The patch ppp-2.5.0-2-everywhere-O_CLOEXEC-harder.patch had to be updated due to some
changes in the source files.
- The patch ppp-2.5.0-7-add-configure-check-to-see-if-we-have-struct-sockaddr_ll.patch
was removed as the changes are now built into the source tarball.
- This will need to be tested thoroughly by people with ppp to confirm that the lock
directory is created if it doesn't exist on the system. I can't test that as I have
no access to a ppp connection system.
- For a view of the changelog between 2.5.0 and e1266c7 the github commits list needs to
be reviewed. https://github.com/ppp-project/ppp/commits/master/?before=e1266c76d1ad39f98f11676e34f180f78c5a510c+35
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- My drop hostile patch set updated the WUI entries to include in and out logging options
but the values need to be added to the optionsfw entries for existing systems being
upgraded.
- After the existing CU184 update the LOGDROPHOSTILEIN and LOGDROPHO)STILEOUT entries
are not in the settings file which trewats them as being set to off, even though they
are enabled in the WUI update.
- This patch adds the LOGDROPHOSTILEIN and LOGDROPHOSTILEOUT entries into the settings
file and then runs the firewallctrl command to apply to the firewall.
- Ran a CU184 update on a CU183 vm system and then ran the comands added into the update.sh
script and then did a reboot. Entries include and DROP_HOSTILE entries start to be
logged again.
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 2.6.1 to 2.6.2
- Update of rootfile
- Changelog
2.6.2
Security fixes:
#839#842 CVE-2024-28757 -- Prevent billion laughs attacks with
isolated use of external parsers. Please see the commit
message of commit 1d50b80cf31de87750103656f6eb693746854aa8
for details.
Bug fixes:
#839#841 Reject direct parameter entity recursion
and avoid the related undefined behavior
Other changes:
#847 Autotools: Fix build for DOCBOOK_TO_MAN containing spaces
#837 Add missing #821 and #824 to 2.6.1 change log
#838#843 Version info bumped from 10:1:9 (libexpat*.so.1.9.1)
to 10:2:9 (libexpat*.so.1.9.2); see https://verbump.de/
for what these numbers do
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 5.6.0 to 5.6.1
- Update of rootfile
- Changelog
5.6.1
* liblzma: Fixed two bugs relating to GNU indirect function (IFUNC)
with GCC. The more serious bug caused a program linked with
liblzma to crash on start up if the flag -fprofile-generate was
used to build liblzma. The second bug caused liblzma to falsely
report an invalid write to Valgrind when loading liblzma.
* xz: Changed the messages for thread reduction due to memory
constraints to only appear under the highest verbosity level.
* Build:
- Fixed a build issue when the header file <linux/landlock.h>
was present on the system but the Landlock system calls were
not defined in <sys/syscall.h>.
- The CMake build now warns and disables NLS if both gettext
tools and pre-created .gmo files are missing. Previously,
this caused the CMake build to fail.
* Minor improvements to man pages.
* Minor improvements to tests.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 8.6.13 to 8.6.14
- Update of rootfile
- Changelog
8.6.14
This is a patch release, so it primarily includes bug fixes and corrections
to erratic behavior. Highlighted changes are noted below. The changes file
at the root of the source tree contains a more complete list. The Timelines
of all changes are online.
http://core.tcl-lang.org/tcl/timelinehttp://core.tcl-lang.org/tk/timeline
* [TIP 402] revise path normalization for x-platform UNC path support
*** POTENTIAL INCOMPATIBILITY ***
* Harmonize Tk's parse of numbers (screen distance, etc) with Tcl
*** POTENTIAL INCOMPATIBILITY ***
* Iconlist ignores options db for fg text color; affects dialogs
*** POTENTIAL INCOMPATIBILITY ***
* Aqua: XPutImage() swaps red and blue channels
*** POTENTIAL INCOMPATIBILITY ***
* [encoding convertfrom] handling of incomplete code sequences
*** POTENTIAL INCOMPATIBILITY ***
* Harmonize handling of ~ in paths across platforms.
*** POTENTIAL INCOMPATIBILITY ***
* Fix menu clone binding misbehavior, menu-20.1[2-6].
*** POTENTIAL INCOMPATIBILITY ***
* Improved performance of [exec] and [open |$cmd] on unix-lke
systems, especially with large memory footprints.
* Improve performance of large treeview destruction.
* Improve performance of large image insertions into text.
* Improve widget creation performance due to poor font caching.
* Fix notebook tab appearances when placed on edge other than top.
* Enable treeview display of partial final line.
* Win: restore [exec %var%] that was dropped in 8.6.13.
* Allow [chan create {} $cmd]. Enables simulation of server channels.
* Allow return from [tk scaling] in safe interps.
* Prevent navigation by word exposing clues to masked entry contents.
* Fix crashes or hangs in...
- [chan pop] with pending input
- thread finalization of reflected channels
- [label .l -bitmap floppy]
- [set tcl_precision 15; expr 6.4623485355705287e-27]
- [tk busy forget] and [tk busy hold]
- channel read into "string" Tcl_Obj can BO, and perform poorly
- KVO crash after destroying Aqua's first root toplevel
- Test treeview-6ee162c3f9
- Test tailcall-bug-784befb0ba
- Tests menu-40.[12]
* Repair memory leaks and errors
- Eliminate undefined realloc() calls
- Silence many warnings from -fsanitize=function
- Flawed interfacing with XIM
- Tcl_UtfToExternal writing to one-byte buffer
- Tcl_UtfToUniChar() handling of 0xC1.
- Tk_ConfigureValue could call wrong free() routine.
- tests getuncichar-1.* in utf.test
- ...and many more
* No more support for 32-bit Cygwin
* ::tcl_platform(osVersion) updated to report Windows 11
* Accommodate macOS deprecation of sprintf()
* Silence macOS 14 warnings about secure restorable state.
* Code changes to support ASan use-after-return detection
* Revise Tcl_MakeFileChannel() to better partner with pledge()
* Prevent false [clock format] error reports on FreeBSD
* Region clip & copy make better use of OS facilities.
* Update handling of Apple FourCC creator codes.
* Text selection omits first character, text-38.1
* Windows: improved support of non-BMP pathnames
* Fixed some Y2038 limitations
* Fix photo color drawing on X11 32-bit visuals.
* Fix <<MenuSelect>> regression on menus with -tearoff
* Correct rounding of [nsFont pointSize].
* zlib comment/filename error handling (zlib-8.19, zlib-8.2[012])
* Prevent theme change attempts after Tk finalize.
* Make dialogs robust against parent destruction.
* Make [tk_chooseColor] robust against failed grab.
* Fix menu parsing of @x,y indices. menu-22.[6-9]
* Fix inconsistent results from [font measure].
* Fixed [clock scan|add] handling of abbreviated options
* Avoid endless loops replacing [unknown] or [history].
* Fix polluted error messages from [send -option].
* PNG photo image decoder missed a 0xFF entry.
* Fix failing winTime-2.1 on Windows
* test string-2.20.1 failed on big endian platforms
* Updated bundled packages, libraries, standards, data
- Itcl 4.2.4
- sqlite3 3.44.2
- Thread 2.8.9
- TDBC* 1.1.7
- tcltest 2.5.7
- libtommath 1.2.1
- zlib 1.3.1
- Unicode 15.1
- tzdata 2024a
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 2.28.5 to 2.30.1
- Update of rootfile
- Changelog
2.30.1
Fixed a regression causing SDL_WaitEvent() to return spurious failures
Fixed X11 cursors on the latest release of GNOME
Wayland windows automatically have OpenGL enabled again
Fixed memory corruption when converting signed 16-bit audio to float
Fixed audio artifacts when converting signed 8-bit audio to float
Fixed the clip rectangle not being updated when the viewport changes in the SDL renderer
Convert mouse wheel coordinates to the rendering view in the SDL renderer
Fixed a crash handling controllers on macOS
Fixed a crash setting a window fullscreen with Emscripten
Fixed the keyboard automatically popping up when resuming an application on Android
2.30.0
In addition to lots of bug fixes, here are the major changes in this release:
General:
Added support for 2 bits-per-pixel indexed surface formats
Added the function SDL_GameControllerGetSteamHandle() to get the Steam API handle for a controller, if available
Added the event SDL_CONTROLLERSTEAMHANDLEUPDATED which is sent when the Steam API handle for a controller changes. This could also change the name, VID, and PID of the controller.
Added the environment variable SDL_LOGGING to control default log output
macOS:
Added the hint SDL_HINT_JOYSTICK_IOKIT to control whether the IOKit controller driver should be used
Added the hint SDL_HINT_JOYSTICK_MFI to control whether the GCController controller driver should be used
Added the hint SDL_HINT_RENDER_METAL_PREFER_LOW_POWER_DEVICE to choose whether high or low power GPU should be used for rendering, in the case where there are multiple GPUs available
Xbox:
Added the function SDL_GDKGetDefaultUser()
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 24.01.0 to 24.03.0
- Update of rootfile
- find-dependencies run due to sobump. No issues found
- Changelog
24.03.0:
core:
* Fix opening some malformed files. Issue #1447
* Skip drawing image when it has singular matrix. Issue #1114
* Fix crash on malformed files
* Small internal code cleanup
utils:
* pdfdetach: Fix potential directory traversal
* pdfimages: Enable to print filenames to stdout.
* pdfsig: Add visible name/date when signing an existing form signature field
24.02.0:
core:
* Fix reading some JBIG2 streams. Issue #1319
* Fix saving some annotation interior color when it's empty
* Make searching for fonts when adding annotations a bit faster
* Make sure images are compressed when adding them
* Small internal code cleanup
utils:
* pdfimages: return exit code 2 when error opening output files
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 1.4 to 1.5.1
- Update of rootfile
- Changelog
1.5.1
Opus 1.5.1 fixes the meson build that was broken in 1.5.
1.5
Opus 1.5 is the first release to make extended use of ML in the encoder and
decoder. You can read all the details in the release demo page. In summary, major
changes since 1.4 include:
Significant improvement to packet loss robustness using Deep Redundancy (DRED)
Improved packet loss concealment through Deep PLC
Low-bitrate speech quality enhancement down to 6 kb/s wideband
Improved x86 (AVX2) and Arm (Neon) optimizations
Support for 4th and 5th order ambisonics
In addition to the improvements above, this release includes many minor bug fixes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 1.3.1 to 1.4.0
- Update of rootfile
- Changelog is available on meson website https://mesonbuild.com/Release-notes-for-1-4-0.html
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 6.7.0 to 6.8.0
- Update of rootfile
- Changelog is only available from the git commits.
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 20231114 to 20240312
- Update of rootfile
- For the changelog details see the releasenote.md file in the source tarball.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer