core115: Add captive portal cron jobs to updater

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive portal: Correctly initialise an array for 8h timeout

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive portal: Reload firewall rules after cleanup

This is not necessary to stop any clients from accessing the
Internet, but if we know that we don't need a line for certain
any more, we can as well remove the firewall rule straight away.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Remove unused code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive portal: Don't remove unlimited access after one hour

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'captive-portal' into next

captive portal: Allow sessions to expire after 8 hours

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive-portal: Serve Ubuntu font files locally

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add Ubuntu font family package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship extrahd.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Apache 2.4.27 breaks ExtraHD-GUI

Opening 'extrahd.cgi' led to:
"Response header name 'scanhd idescanhd partitionsCache-control' contains
invalid characters, aborting request".

https://forum.ipfire.org/viewtopic.php?f=27&t=19550#p111030
https://forum.ipfire.org/viewtopic.php?f=50&t=19563&sid=575337ac1caf1df492fced01ca6243de#p111048
https://forum.ipfire.org/viewtopic.php?f=22&t=19563#p111052

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship update for OpenVPN

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpn: Update to 2.3.18

Fixes CVE-2017-12166: out of bounds write in key-method 1

For details see:

https://community.openvpn.net/openvpn/wiki/CVE-2017-12166

Changelog:
https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.18

Removed an unrecognized 'configure'-option.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 3.1.7

Fixes TROVE-2017-008 and CVE-2017-0380 and others....

For details see  https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.1.7
"Tor 0.3.1.7 is the first stable release in the 0.3.1 series."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core115: Ship cosmetic improvements in proxy.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy.cgi: Some cosmetics for the absolutely lazy ones (V2)

Added clickable links for 'URL filter' and 'Update accelerator' for faster access,
this time without the need to alter the language-files.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

start core115

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'master' into next

core114: add php to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

wpa_supplicant: Update to 2.6

For details see:
https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/next'

finish core114

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core114: force update addons after core update

apache needs new vhost configs so all addons must updated to work with new
apache.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

captive: Update configuration for Apache 2.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Show access page in browser language

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Tested-by: Daniel Weismüller <daniel.weismüller@ipfire.org>

captive: Do not try to execute the favicon

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix passing redirection URL

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Run apache in HTTP/1.0 mode

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Tested-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix another typo in captivectrl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix typo in German translation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Let apache follow symlinks to load bootstrap

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix directory permissions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Logo directory no longer exists

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache2: Create captive portal logging directory

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Actually build bootstrap

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update German translation for captive portal

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Link .map files as well

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bootstrap: Install map files, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Show message when an invalid coupon code was entered

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Do not show checkbox when in coupon mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Verify that the user actually accepted the terms and conditions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Style any error messages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Show a message when no coupon code was entered

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix some template updates that I forgot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Drop duplicate function to list active clients

There was a function with different name but essentially
same functionality which is already existant in &show_clients().

Therefore this patch drops the old function without any functional
changes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Redesign clients list box

Mostly code cleanup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Redesign generated coupons table

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Correctly set coupon lifetime

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Remember selected coupon expiry time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Allow creating multiple coupons in bulk

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Reformat times

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Cleanup coupon generation block

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Cleanup logo upload

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Cleanup authentication selection

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Code cleanup

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Allow uploading JPEG images, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Serve logo through an extra CGI script

This CGI script makes saving the logo easier (especially for
backup purposes).

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Save logo in /var/ipfire/captive

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Allow selecting the session expiry time for terms

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Group settings together and create branding section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Some more CGI cleanup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Rename "Voucher" mode to "Coupon"

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Rename "License" mode to "Terms & Conditions"

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Allow selecting highlight colour in web interface

To be able to customise the access page, we now allow the
user to select a brand colour.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Refactor the access page

This brings no functional changes, but cleans up the code
to re-use more and write less.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Get MAC address of a device without calling arp

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Don't compare action string

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Import new design

This is the new design of the access page of the captive
portal. It is based on the Bootstrap 4 grid system and
reboot but does not use anything else from it.

It is responsive and customisable.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bootstrap: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive-portal: Use template engine to render HTML template

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive-portal: Move CGI files to CGI directory

Previously the assets directory has ExecCGI privileges
which is not at all required and potentially dangerous.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive-portal: Code cleanup

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Fix bug with multiple license clients

If one active client with a license existed, any other client
authenticating will overwrite the configuration line.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Do not generally allow access to TCP/1013

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Only make CGI script executable in document root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Reindent apache configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captive: Log into default apache log files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive-portal: Design changes

When choosing voucher as authentication type there is no need to display the license agreement textbox

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11141: Redesign of configuration website

To improve the user experience, the configuration part of generating new vouchers has been reworked.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11140: Captive logo dimensions

Now the min and max logo dimensions are shown in webinterface.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11137: Captive save action messes up the form

When configuring the captiveportal for the first time the form
will be empty after clicking on save button if not all relevant fields are set.

Now the settings are stored even if there is an error.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11139: Captive voucher table too wide

Set table to 100% and the remark textfield to 96% (cellwidth)

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Improve the wording of the Captive Portal configuration site

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive-Portal: fix fontsize of generated voucher

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: Fix folder permissions

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: fix some typos and missing dir

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: Add logo upload feature

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-portal: Add directory for logo upload

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

captivectrl: Add protection against DNS tunnels

Limit the amount of DNS traffic for each client that
has not registered, yet.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Skip all lines that start with #

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive-Portal: fix cleanup script

The cleanup-script did not write back the hash after the expired voucher
was delted

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add Errormessage when wrong code is entered

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: fix wrong expiretime of unused vouchers

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: fix voucher form

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add logging to syslog

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: SHow always licencebox in config

Also fix index.cgi to show individual title

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>