Captive-Portal: create dir for cative logfiles

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add captive dirs and files to configroot

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add captive chains to firewall initscript

When loading the initscript of the firewall the neccessary chains for
the captive portalneed to be created.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add crontab and cleanup scripts

The cleanup script is called every hour and deletes expired clients from
the clients file.
every night the captivectrl warpper runs once to flush the chains and
reload rules for active clients

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add web-part

Introduce new Captive-Portal.
Here we add the menu, apache configuration (vhost), IPFire configuration
website and Captive-Portal Access site. Also the languagefiles are
updated.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

captivectrl: Move sure that the settings are always initialised

This just removes a compiler warning.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wirelessctrl: Disable MAC filter on blue if captive portal is enabled

Fixes #11038

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Add missing space character

The iptables argument list was botched. Oops. Sorry.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Support unlimited leases

When the expiry time equals zero, the lease will have
no time constraints. The IP address will also be removed
as it might probably change.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Allow empty IP addresses

Probably required for very long leases

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Change format of clients configuration

We store the start of the lease now and the time in
seconds after the lease expires

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive Portal: add c-wrapper captivectrl

This wrapper reads the captive settings and clients and sets the
firewall access rules. It is called every time the config changed or
everytime that a client changes. Also this wrapper is later called once
hourly to flush the chains and rebuild rules for actual clients.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

core114: Update apache configuration of all add-ons that have one

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated apache2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache2: Download source from IPFire servers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update to apache 2.4.27

- Updated to apache 2.4
- Updated the htpasswd generation to use the more secure bcrypt algorithm

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apr and aprutil: Added as requirement for apache 2.4

- APR 1.6.2 is a requirement for building apache httpd 2.4
- APR-Util 1.6.0 is a requirement for building apache httpd 2.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fix WebUI system information leak

Disable unauthenticated access to cgi-bin/credits.cgi. The page
leaks the currently installed version of IPFire and the hardware
architecture.

Both information might make a successful attack much easier.

This issue can be reproduced by accessing https://[IPFire-IP]:444/cgi-bin/credits.cgi
and accepting a SSL certificate warning (if any).

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update german translations

- Unify translations of various terms.
- Unify translations of week days.
- Correct some typos and grammar errors.
- Modify some phrases which were not fully translated.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core114: add unbound initskript to updater.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: flush negative and bogus at update forwarders

this resolves problems that negative answers from
a forwarder was still used after setting new servers.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: run time fix also after update forwarder

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

strongswan: Update to 5.6.0

Fixes CVE-2017-11185:

Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
when verifying RSA signatures, which requires decryption with the operation m^e mod n,
where m is the signature, and e and n are the exponent and modulus of the public key.
The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
This result wasn't handled properly causing a null-pointer dereference.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 3.5.27

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated gnutls

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.15

For details see:
https://lists.gnupg.org/pipermail/gnutls-devel/2017-August/008483.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.5

Changelog:

"21 Aug 2017: Wouter
- Fix install of trust anchor when two anchors are present, makes both
  valid.  Checks hash of DS but not signature of new key.  This fixes installs between
  sep11 and oct11 2017."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated hdparm

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 114

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hdparm: Update to 9.52

Changes from 9.50 to 9.52:
- add support for Jmicron USB-SATA bridges, courtesy Jan Friesse <jfriesse@gmail.com>.
- New --security-prompt-for-password flag for use with the various --security- actions.
- Makefile tweak from Mike Frysinger.
- fix spelling/typos in man page and "removable", courtesy of Alex Mestiashvili.
- fix spelling/typos in --sanitize-crypto-scramble, courtesy of Tom Yan.
- fix NULL password handling in --security-unlock, courtesy of Tom Yan.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

close core113

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

unbound: update dns hints and keys

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core113: Ship openvpn which has been missing in core112 updater

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rootfile updates: nano, misc-progs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core113: add strongswan-padlock to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Actually build iftop

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core113: Ship packages that have not been shipped with 112

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound/ntp: move not working DNS fallback from ntp to unbound initskript

the ntp initskript will only run at first connection try. If this fails
and the connection can established later DNS will not work if the clock
is too far away.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

serial-console: remove baudrate from inittab

new versions of agetty missinterpretes the baudrate and set it as TERM
without the parameter agetty use the previous rate that was set by the
kernel via console=XXX,Baudrate parameter.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

WIO: wio.cgi edit how to get the ips for the networks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Fix source tarball checksum

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core113: Add latest packages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iftop: This is an Update release to ver. 1.0pre4

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.12.3

For details see:
https://github.com/logrotate/logrotate/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nano: Update to 2.8.6

For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pcre: Update to 8.41

For details see:
http://www.pcre.org/original/changelog.txt

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.2

For details see:
https://ftp.isc.org/isc/bind9/9.11.2/RELEASE-NOTES-bind-9.11.2.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.14

For details see:
https://lists.gnupg.org/pipermail/gnutls-devel/2017-May/008427.html
https://lists.gnupg.org/pipermail/gnutls-devel/2017-June/008446.html
https://lists.gnupg.org/pipermail/gnutls-devel/2017-July/008469.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: Update to 1.8.0

Changes (see: https://gnupg.org/download/release_notes.html):

"gpg: Sending very large keys to the keyservers works again.
gpg: Validity strings in key listings are now again translatable.
gpg: Emit FAILURE status lines to help GPGME.
gpg: Does not anymore link to Libksba to reduce dependencies.
gpgsm: Export of secret keys via Assuan is now possible.
agent: Raise the maximum passphrase length from 100 to 255 bytes.
agent: Fix regression using EdDSA keys with ssh.
Does not anymore use a build timestamp by default.
The fallback encoding for broken locale settings changed from Latin-1 to UTF-8.
Many code cleanups and improved internal documentation.
Various minor bug fixes."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.6

For details see:
https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.4

Hi, ("...back in town...") ;-)

For details see:
http://www.unbound.net/download.html

I had to remove the patch file: it wouldn't apply.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 0.3.0.10

Fixes CVE-2017-0377 and others.

For details see:
https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.10

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid 3.5.26: latest patches (14169-14182)

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: minor changes

correct typo in wio.en.pl language file
add button in wio.cgi to change to systems logs (section wio)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: patch log.dat to show wio logs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: first addon release v1.3.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 113

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util-linux: update rootfile (armv5tel)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ncftp: drop addon package

it is outdated and will not build with new gcc/glibc

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make-functions: move MAKETUNING before make

this is needed to edit MAKTUNING in the lfs file
which is used by boost and cmake to build on
machines with less than 4GB Memory.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

close core112

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core112: reload init to allow correct unmount at reboot

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

toolchain: filter -mfpu from CFLAGS for first pass

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: remove wrong 2nd partition

the new sfdisk seems not able to skip a partition anymore.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bump TOOLCHAIN version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: remove unsupported sfdisk switches

New util-linux sfdisk does not have -D and -H / -S
switches.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core112: Ship updated util-linux

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util-linux: update to 2.28.2

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Reviewed-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: ignore missing .symtab in modules

old binutis add an empty .symtab section at stripping
and grub check that this exists also on modules that export
no symbols.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

checknewlog: skip cmake because log contain space in filenames

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

this grep fails on debian and the output is useless II

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Archive Core Updates 110 + 111

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Package Core Update 112

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for armv5tel toolchain

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipfire-netboot: Update to version v1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Fix crash of daemon at startup

getentropy() cannot be used on our platform.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop architecture-dependent and unused package fwhits

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

directfb: Fix compilation on ARM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpn: Update to 2.3.17

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unbound - rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh remove double build pcre

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Disable all libraries that don't build on armv7hl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Properly use CFLAGS & CXXFLAGS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: fix amba modules build with gcc6

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: rpi build fix

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

glibc: Don't use locale-archive

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cmake: update to 3.8.1

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 3.0.8

For details see:
https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.8

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netcat 0.7.1: Update for rootfile

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>