Skip to content
  1. Dec 09, 2022
  3. Dec 08, 2022
  5. Dec 07, 2022
    • Stijn Tintel's avatar
      Merge pull request #19933 from stintel/vallumd · fbe0e832
      Stijn Tintel authored 
      vallumd: updates
      fbe0e832
    • John Audia's avatar
      snort3: unified configs: local.lua and homenet.lua · d6b712cd
      John Audia authored 
      This commit adds /etc/snort/local.lua and /etc/snort/homenet.lua for user
defined config options which is more simplistic than modifying upstream
files directly. That can be tedious and decisive to maintain in sync with
upstream changes.  The init script has been adjusted accordingly.

Acknowledgment to amish who maintains the Arch Linux snort-nfqueue package[1]
for these ideas and initial code.

Another modification is dropping the following args in the call to
/usr/bin/snort by the init system as these options are provided in
/etc/snort/local.lua:

 * --daq-dir /usr/lib/daq/
 * -A "$alert_module"

Instructions to configure snort3:
1. Edit /etc/snort/homenet.lua and redefine HOME_NET and EXTERNAL_NET, for example:

   HOME_NET = [[ 10.9.8.0/24 192.168.1.0/24 ]]
   EXTERNAL_NET = "!$HOME_NET"

2. Edit /etc/snort/local.lua to setup options unique to your use case of snort.
   The default ones I included should be sane for the role of IDS (alert only),
   but users may easily uncomment some options therein to use IPS (drop) mode.

3. Install or symlink rules to /etc/snort/rules/snort.rules and optionally
   edit /etc/snort/local.lua to define extra rules files if not using a unified
   'snort.rules'

References:
1. https://aur.archlinux.org/packages/snort-nfqueue



Signed-off-by: default avatarJohn Audia <therealgraysky@proton.me>
      d6b712cd
    • Tianling Shen's avatar
      golang: Update to 1.19.4 · 6a0ee524
      Tianling Shen authored 
      

go1.19.4 (released 2022-12-06) includes security fixes to the net/http
and os packages, as well as bug fixes to the compiler, the runtime,
and the crypto/x509, os/exec, and sync/atomic packages.

Signed-off-by: default avatarTianling Shen <cnsztl@immortalwrt.org>
      6a0ee524
    • Tianling Shen's avatar
      Merge pull request #20036 from ysc3839/natmap-fix · 5c17cd1c
      Tianling Shen authored 
      natmap: merge "ipv4" and "ipv6" options into single "family" option
      5c17cd1c
    • Linus Lüssing's avatar
      bpfcountd: remove incomplete/broken namespace feature · f22370b1
      Linus Lüssing authored 
      

The original idea of the extra namespace variable was to set up
bpfcountd from other daemons etc. independent of what a user configured
in /etc/config/bpfcountd for instance. Like:

 $ UCI_CONFIG_DIR=/var/run/bpfcountd/gluon-config \
   /etc/init.d/bpfcountd start "" gluon

However there are still issues with this approach:

1) Instance specific stop calls like:

 $ /etc/init.d/bpfcountd stop <instance-name> <namespace>"

will not  stop the according namespaced instance, as the stop() in
/etc/rc.common will call procd_kill() without the namespace prefix.
And we can't overwrite that behaviour. And asking a user to use
"... start <in> <ns>" and "... stop <ns>.<in>" is confusing.
(and currently "... stop <ns>.<in>" would not remove the correct
unix socket).

2) A stop call without an instance/config name would always stop all
instances. So the namespace variable would be ignored.
While start without an instance "works", but:

3) It would stop any process that is not in the currently selected
UCI_CONFIG_DIR.

As all this is not easily fixable without changing OpenWrt internals,
just remove the whole namespace idea for now.

Signed-off-by: default avatarLinus Lüssing <linus.luessing@c0d3.blue>
      f22370b1
    • Richard Yu's avatar
      natmap: merge "ipv4" and "ipv6" options into single "family" option · 190e04ca
      Richard Yu authored 
      

Signed-off-by: default avatarRichard Yu <yurichard3839@gmail.com>
      190e04ca