strongswan: Update to 5.7.1

Fixes security vulnerabilities: CVE-2018-16151, CVE-2018-16152 and
CVE-2018-17540.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

haproxy: Update to 1.8.14

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'haproxy' into next

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

Merge branch 'toolchain' into next

Merge branch 'glibc-2.28' into next

core125: Ship glibc for i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove removed files from rootfiles

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

graphs: add NVMe disks

Add NVMe disks to media and hardwaregraphs.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

hostapd: add switch to disable neigborhood scan

this may violate regulatory rules because 40Mhz channels should disabled
if there are other networks but nearly every commercial router ignore this.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

json-c: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libaio: Link against standard libraries

This patch fixes a build error when stack smashing protecion
is being enabled and __stack_chk_fail_local needs to be pulled
from libc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl: Fix build in toolchain

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

toolchain: Bump version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

coreutils+gzip: Allow building with 32 bit time_t on 32 bit arches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Config: Set IS_32BIT when running on 32 bit

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update langs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Remove option to enable/disable checks for updates

This does not change anything

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Update to 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libvirt: Update to 4.6.0

Fixes builds against glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

parted: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

syslinux: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: remove set of pmbr_boot on gpt partitions

this fix the efi boot on hdd's larger than 2TB and raid installations.

fixes: #11890

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

collectd: Fix compiling against newer xfsprogs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

haproxy: Log to syslog and install logrotate script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

haproxy: Make /dev/log available in chroot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nfs: Update to 2.3.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

keyutils: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ntfs-3g: Update to 2017.3.23

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xfsprogs: Update to 4.18.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

reiserfsprogs: Update to 3.6.27

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

LVM2: Update to 2.02.181

Update required to build against newer versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libaio: New package

This library is required by newer version of LVM2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ppp: Build against openssl

libcrypt has been removed from glibc and openssl
can be used instead for cryptographic operations.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Build openssl earlier in the build process

This is a basic library that is used by so many other packages
and more and more are being added. To have those packages take
advantage of it, we build it very early.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated kmod

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

udev: Migrate to eudev

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kmod: Update to version 25

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sysvinit: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gzip: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

findutils: Fix building against glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

e2fsprogs: Update to 1.44.4

Fixes build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bison: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

m4: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

coreutils: Update to 8.30

Builds with newer versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated SSH configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fix broken SFTP in OpenSSH server

Fixes #11887

The second version of this patch uses the correct path on IPFire systems
and supersedes the first one. It also referrs to the correct issue ID.

Thanks to Matthias Fischer for reporting this.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcpcd: Update to 7.0.8

Hi,

No explicit changelog. I used:
https://roy.marples.name/search/query:dhcpcd

Running here.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.8.1

For details see:
https://nlnetlabs.nl/projects/unbound/download/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Compile with debugging messages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Add support for 802.11ac

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Update language files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update OpenSSH default port in language files

Fixes #11881

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.100.2

Hi,

"This is a patch release to address several vulnerabilities..."

For details see:
https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated GnuTLS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.19

Hi,

For changelogs since '3.5.15' see:

https://lists.gnupg.org/pipermail/gnutls-devel/2017-October/008523.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-January/008538.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-February/008540.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-July/008583.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Apply changed sysctl.conf immediately

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Allow kernel to swap memory on high demand

Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Fixes: Bug 11839
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.4-P2

For details see:
http://ftp.isc.org/isc/bind9/9.11.4-P2/RELEASE-NOTES-bind-9.11.4-P2.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Apache: Update to 2.4.35

For details see:

http://apache.mirror.digionline.de//httpd/CHANGES_2.4.35

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship recently updated sqlite

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 125

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sqlite: Update to 3.25.2.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids-functions.pl: Rework &_cleanup_rulesdir() function

* Use a directory listing and delete the files.
* Keep files with "config" as file extension.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Fix typo

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Call &_cleanup_rulesdir() function before calling oinkmaster.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Add private function to cleanup the rules directory.

This private function is used to remove any files which are stored in the
IDS rules directory and prevent from any old (unneeded or conflicting) files
after an update or complete change of the ruleset source.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata: Rootfile update

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

suricata: Set correct ownership for /var/lib/suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge branch 'core124' of git.ipfire.org:/pub/git/ipfire-2.x into core124

core124: add apache initskript and nsswitch.conf to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: don't remove network trigger script

this script is still needed if /var/ipfire is on an extra partition.
New installations works without this script.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: fix removing old initrd files on arm systems

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.72

this commit has many important driver updates so we need to ship it fast...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata

ids.cgi: Add support for autoupdate of the IDS ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Update language files

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

stage2: Rootfile update for update-ids-ruleset script

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

IDS: Introduce update-ids-ruleset

This script periodly will be called by fcron
and is responsible for downloading and altering
the ruleset, if autoupdate of the configured ruleset is
enabled.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Merge remote-tracking branch 'origin/master' into core124

ids-functions.pl: Add backend code to handle the "cron" function of suricatactrl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricatactrl: Add "cron" command

This command allows to enable the automatic update
of the used IDS ruleset and to specify the update interval.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids.cgi: Only write oinkmaster-modify-sids.conf if neccessary.

Only write to the file if the runmode of the IDS has been changed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ssh: Revert MaxAuthTries setting

This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.

It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: fix updater

fix some missing files on arm
remove not needed rebuild initrd because we ship it already built

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

nano: Update to 3.1

Hi,

This update was published just a few days after my "3.0"-commit - running.

For details see:

https://www.nano-editor.org/news.php

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: finish updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

arm: boot.scr: add setting to edit fdt via uEnv.txt

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

rebuild-initrd: update for grub2

this was was not used for years because we usually ship a prebuild ramdisk
so this incompatiblity was not noticed long time...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.71

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: Ship updated iproute2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iproute2: Update to 4.18.0

Triggered by https://bugzilla.ipfire.org/show_bug.cgi?id=11866 ;-)

For details see:
https://lwn.net/Articles/762515/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>