openvpn: Add an initscript for N2N connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpnctrl: Remove the stuff we no longer need

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

initscripts: Start the OpenVPN Authenticator, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

initscripts: Add an initscript for OpenVPN RW

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Split OpenVPN INPUT chains for RW & N2N

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove option to enable on ORANGE/BLUE

There is no point in not making this service available to any local
networks when it always has to be reachable from the Internet.

This still has to be reflected in the initscripts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Migrate to subnet topology

For dynamic pools, this change is easy and does not require any extra
steps. For CCD clients however, we need to update the configuration to
replace the server IP address with the subnet mask.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Create functions to read CCD client/server routes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove comment that a restart is required

This is incorrect as we can change CCD data without restarting the
server.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Refactor writing CCD files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Drop validdotmask()

This is a totally braindead function that prevented some basic usability
by using the more modern prefix notation. It simply checks if there is a
freaking dot. Great!

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Drop hostsinnet

This is no longer needed as we can use the function that lists all
addresses that are in use and count them.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Refactor listing CCD addresses

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Refactor ccdmaxclients()

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Refactor modccnet()

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Refactor addccdnet()

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Move function to check CCD names here

This was in general-functions.pl for some reason.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Refactor function to remove a static pool

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove enabled marker files

Nothing is using these any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove any left-over traces of DH replacement

Since there is no way for the user to manipulate this any more, there is
no point in checking and showing the DH parameters.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove excess whitespace

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove more dead code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Force NCP on clients

This change requires that all clients support NCP if they are set up
with a new connection. Existing clients remain supported using the
fallback cipher option.

This will result that connections with OpenVPN <= 2.3 cannot be set up
any more which is totally fine since that version is EOL.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpn: Update to 2.6.9

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Completely remove compression for RW clients

We will use the "compress migrate" option which disables compression by
default. If a client has been found that wants to use compression, the
server will push "stub-v2" to disable it. If that does not work, the
server might fall back to compression.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Implement cipher negotiation for RW clients

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove presetting removed options

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove dead code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Use SHA512 for hashing by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Keep the fallback cipher disabled by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Allow to disable the fallback cipher

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Rename cipher selection to fallback cipher

This is to keep ancient clients and clients that have NCP disabled
happy.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lang: Update because of OpenVPN changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

CSS: Make all <select> and <textarea> use all available space

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Fix the completely fucked table layout

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Move the cryptographic options to the advanced page

Since we don't want people play too much with these, we move them to the
advanced settings page.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Fix resetting compression setting

The compression option was reset (disabled) when the Save button on the
main was being clicked.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove crypto error/warning boxes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove authorship comments

These are not very useful.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Don't mess with the OpenVPN status file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Move things that belong together together

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Don't create CCD configuration files on every call

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Reorganise loading external modules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Don't include lang.pl again when its already loaded in header.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Don't load colours when they are already loaded in header.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove unused variable hack

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Drop newcleanssldatabase()

I have no idea why this was added when there is a function that does the
same already. The remove function also had typos in the path which
probably resulted in it not working very well.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Use the formatting function we already have

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Drop unused refresh code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Tidy up starting/restarting the RW server

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Use default functions to check what subnets exist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Remove certificate warnings

I believe that these don't really work and are always shown.
Please see #13634.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Fix some whitespace issues

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Enable debugging

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

linux-firmware: ship needed config txt files.

these files are parsed by the kernel at firmware load and are needed!
don't remove it again.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 6.6.63

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: rootfile update aarch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: rebase aarch64 patchset and add nanopi r2s plus oc devicetree

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

transmission: add minipnpc as dependency

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

miniupnpc: change to addon pak

transmission need the lib at runtime.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 6.6.62

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

collectd: fix errormessage on fresh installations

the /etc/collectd.d/ folder must have at least one file in it
so this add an file with a comment that custom configs should placed
there.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 6.6.60

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

networking/red: remove leftover debugging messages.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

hostapd: fix start/stop buttons

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

network-functions: fix add newline in $wireless_status

with the other syntax perl suggest this change.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core190: ship intel-microcode

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

intel-microcode: Update to version 20241029

- Update from version 20240910 to 20241029
- Update of rootfile not required
- Changelog
    20241029
Update for functional issues. Refer to 14th/13th Generation Intel® Core™
 Processor Specification Update for details at
 https://cdrdv2.intel.com/v1/dl/getContent/740518
Updated Platforms
 Processor   Stepping  F-M-S/PI     Old Ver   New Ver   Products
 RPL-E/HX/S  B0        06-b7-01/32  00000129  0000012b  Core Gen13/Gen14

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

suricata: Explicitly ignore IPsec traffic unless enabled

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core190: ship bind

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bind: Update to 9.20.3

For details see:
https://downloads.isc.org/isc/bind9/9.20.3/doc/arm/html/notes.html#notes-for-bind-9-20-3

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: Update to 1.22.0

For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-22-0

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core190: ship unbound-dhcp-leases-bridge

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound-dhcp-leases-bridge: Fix expiry check on leases

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound-dhcp-leases-bridge: Don't overwrite static leases

When we import all static leases, their remark will be used as hostname
(because WTF?) and might be overwritten if the device is not sending any
or even the same hostname.

This patch avoids that static leases will be modified.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound-dhcp-leases-bridge: Fix typo

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound-dhcp-leases-bridge: Don't export expired leases to Unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core190: ship dhcp client changes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

networking: Allow changing DHCP Option Rapid Commit

This option needs to be configurable since some (braindead) ISPs have
started running broken DHCP servers to be bug-compatible with cheap
broken plastic routers.

By default we keep this option enabled, but it can now be turned off
whenever needed.

Suggested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core190: ship files with fixed chown syntax

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

chown: Replace . with : on all shipped scripts

I don't like this messy bootup screen that we have with all sorts of
warnings that actually don't cause any problems, but make the boot
messy and send the wrong message to users.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core190: ship network-hotplug-bridges

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

udev: network-hotplug-bridges: Silence a warning when interfaces have gone away

It can happen that udev has an event for an interface in the queue that
has already gone away - or even just being renamed.

Then reading the MAC address fails. Because the shell expands the
"$(<...)" statement before running the whole line, the read check is
useless.

Because the code would get too complicated otherwise, I decided to use
cat. Not cool, but this does the job.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

wlanap.cgi: Use the correct array to fetch the current interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

hostapd: Enable logging to syslog

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 6.6.59

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

gdb: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Config: add ROOTFILE_APPEND variable to select rootfile

also gcc on riscv64 has to different rootfile at build so make
the selection of an additional rootfile univarsal.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: fix riscv64 rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update riscv64 config and rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

gdb: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ruby: make rootfile arch independend

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

gdb: update aarch64 rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 6.6.58

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

cdrom: add serial console to uEFI menu

this is only needed on systems that support both video out and serial
console to force serial.

flash-images: move sleep 1 to a better place

kpartx trigger the automount feature of some desktop environments
which result in a mounted filesystem if it was created to fast after
kpartx.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: add sleep 1 after umount the images

sometime zerofree will not able to write without this delay.
I have no idea why?

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

vdr: update to version 2.6.9

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

lfs/Config: fix used rootfile for linux headers

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

nmap: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>