packages: Compress in parallel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix localisations

Voucher was used instead of coupon in English, and Coupon
was used instead of Gutschein in German.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Simplify coupon time selection

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Reindent code for better readability

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Localise GREEN/BLUE

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship logrotate

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.13.0

For details see:
https://github.com/logrotate/logrotate/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

PDF-API2: Add optional dependencies to read TrueType fonts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Make perl-PDF-API2 part of the base system

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

PDF-API2: Update to 2.033

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Update to 2.6

For details see:
https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

KRACK attack: Patch wpa_supplicant & hostapd

A vulnerability was found in how a number of implementations can be
triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by
replaying a specific frame that is used to manage the keys. Such
reinstallation of the encryption key can result in two different types
of vulnerabilities: disabling replay protection and significantly
reducing the security of encryption to the point of allowing frames to
be decrypted or some parts of the keys to be determined by an attacker
depending on which cipher is used.

This fixes: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
  CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
  CVE-2017-13087, CVE-2017-13088

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

KRACK attack: Patch wpa_supplicant & hostapd

A vulnerability was found in how a number of implementations can be
triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by
replaying a specific frame that is used to manage the keys. Such
reinstallation of the encryption key can result in two different types
of vulnerabilities: disabling replay protection and significantly
reducing the security of encryption to the point of allowing frames to
be decrypted or some parts of the keys to be determined by an attacker
depending on which cipher is used.

This fixes: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
  CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
  CVE-2017-13087, CVE-2017-13088

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Allow PDF export of coupons

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Add headline to T&C box

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Download sources via HTTPS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Fix detection if we have the correct ISO image mounted

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Allow download of ISO images over HTTPS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipfire-netboot: Update to v2.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.7

For details see:
http://www.unbound.net/download.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

also force TLS when requiring user authentication in WebUI

Force TLS _and_ a valid login when accessing protected directories.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

generate ECDSA key on existing installations

This is required since Apache crashes if any of the key/certificate files
does not exist.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ship changed files for Apache and ECDSA

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

enable dual-stack ECDSA and RSA certificates in Apache

Note: Apache crashes if any of these files does not exist. Thereof it
is necessary to generate missing keys on existing installations.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

generate ECDSA key on existing installations

Generate ECDSA key (and sign it) in case it does not exist. That way,
httpscert can be ran on existing installations without breaking already
generated (RSA) keys.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

prefer ECDSA over RSA and remove clutter

Priorize ECDSA before RSA and remove unused cipher suites.
Remove redundant OpenSSL directives to make SSL configuration more readable.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

web-user-interface: Removed 'dial.cgi' from lfs-file

'dial.cgi' was removed in

https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=dc6ed83537e1bcc1347ad16bee095ef4d641bc69

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netboot: Update to 1.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Allow editing terms in coupon mode

Since the terms are always shown when set, we need a way
to edit them in coupon mode as well.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship updated extrahd.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove PRINT-line in extrahd.pl

As shown in https://forum.ipfire.org/viewtopic.php?f=50&t=19563#p111055
PRINT-output somehow garbles bash-prompt.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship latest OpenVPN changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Fix for '--ns-cert-type server is deprecated' .

- Added extended key usage based on RFC3280 TLS rules for OpenVPNs OpenSSL configuration,
so '--remote-cert-tls' can be used instead of the old and deprecated '--ns-cert-type'
if the host certificate are newely generated with this options.
Nevertheless both directives (old and new) will work also with old CAs.

- Automatic detection if the host certificate uses the new options.
If it does, '--remote-cert-tls server' will be automatically set into the client
configuration files for Net-to-Net and Roadwarriors connections.

If it does NOT, the old '--ns-cert-type server' directive will be set in the client
configuration file.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

remove unused dial.cgi directives from Apache vhosts config

Remove configuration lines in Apache vhosts files which
are not used anymore (old dial.cgi stuff).

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

delete unused dial.cgi file

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: No need to reload apache after it has been restarted

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Regenerate IPsec configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add missing check for Curve25519 in vpnmain.cgi

This fixes bug #11501 which causes IPsec connections to crash if
Curve25519 has been enabled.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Rebuild language cache during update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache: Update to 2.4.28

http://apache.mirror.digionline.de//httpd/CHANGES_2.4.28

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix saving empty terms

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Download ISO images from https://downloads.ipfire.org

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Pull latest translations for installer & setup from Transifex

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Include captive portal in updater

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Add captive portal cron jobs to updater

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive portal: Correctly initialise an array for 8h timeout

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive portal: Reload firewall rules after cleanup

This is not necessary to stop any clients from accessing the
Internet, but if we know that we don't need a line for certain
any more, we can as well remove the firewall rule straight away.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Remove unused code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive portal: Don't remove unlimited access after one hour

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'captive-portal' into next

captive portal: Allow sessions to expire after 8 hours

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive-portal: Serve Ubuntu font files locally

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add Ubuntu font family package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship extrahd.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Apache 2.4.27 breaks ExtraHD-GUI

Opening 'extrahd.cgi' led to:
"Response header name 'scanhd idescanhd partitionsCache-control' contains
invalid characters, aborting request".

https://forum.ipfire.org/viewtopic.php?f=27&t=19550#p111030
https://forum.ipfire.org/viewtopic.php?f=50&t=19563&sid=575337ac1caf1df492fced01ca6243de#p111048
https://forum.ipfire.org/viewtopic.php?f=22&t=19563#p111052

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship update for OpenVPN

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpn: Update to 2.3.18

Fixes CVE-2017-12166: out of bounds write in key-method 1

For details see:

https://community.openvpn.net/openvpn/wiki/CVE-2017-12166

Changelog:
https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.18

Removed an unrecognized 'configure'-option.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 3.1.7

Fixes TROVE-2017-008 and CVE-2017-0380 and others....

For details see  https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.1.7
"Tor 0.3.1.7 is the first stable release in the 0.3.1 series."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship cosmetic improvements in proxy.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy.cgi: Some cosmetics for the absolutely lazy ones (V2)

Added clickable links for 'URL filter' and 'Update accelerator' for faster access,
this time without the need to alter the language-files.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

start core115

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'master' into next

core114: add php to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

wpa_supplicant: Update to 2.6

For details see:
https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/next'

finish core114

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core114: force update addons after core update

apache needs new vhost configs so all addons must updated to work with new
apache.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

captive: Update configuration for Apache 2.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Show access page in browser language

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Tested-by: Daniel Weismüller <daniel.weismüller@ipfire.org>

captive: Do not try to execute the favicon

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix passing redirection URL

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Run apache in HTTP/1.0 mode

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Tested-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix another typo in captivectrl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix typo in German translation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Let apache follow symlinks to load bootstrap

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix directory permissions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Logo directory no longer exists

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache2: Create captive portal logging directory

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Actually build bootstrap

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update German translation for captive portal

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Link .map files as well

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bootstrap: Install map files, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Show message when an invalid coupon code was entered

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Do not show checkbox when in coupon mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Verify that the user actually accepted the terms and conditions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Style any error messages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Show a message when no coupon code was entered

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix some template updates that I forgot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Drop duplicate function to list active clients

There was a function with different name but essentially
same functionality which is already existant in &show_clients().

Therefore this patch drops the old function without any functional
changes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Redesign clients list box

Mostly code cleanup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Redesign generated coupons table

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Correctly set coupon lifetime

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Remember selected coupon expiry time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Allow creating multiple coupons in bulk

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Reformat times

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Cleanup coupon generation block

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>