ipsec-interfaces: Resolve any remote hostnames

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Move conditional block into the loop

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Drop delayed restart setting

This is a very bad race-condition situation and is not solved by
an unintuitive setting.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Drop VPN_IP setting

This is now a per-connection setting

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add translation strings for recent changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-*: Name some more configuration variables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Uses local IP address from connection first, then default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Correct open ports for connections on aliases

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Allow to select local IP address used for peer on UI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Re-arrange inputs for peer addresses, subnets, etc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Don't allow to select VTI in transport mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Don't populate GREEN subnet when green doesn't exist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Fix typo in variable name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: No longer create any routes automatically

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Filter better for GRE/VTI interfaces

This tried to delete the GREEN interface before

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: TTL only applies for GRE interfaces and not VTI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Find correct RED IP address when using %defaultroute

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Log a message when an interface could not be created

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Don't add any interfaces when IPsec is disabled

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "ipsec-interfaces: Run when IPsec is disabled"

This reverts commit 3c3a1cfdb9b473fae9b792e8c211c9940fafc658.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Move advanced IPsec settings to connection page

This is required to make the initial setup easier for GRE/VTI connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Run when IPsec is disabled

This needs to run even when IPsec is disable to remove
and interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Use correct righthost variable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Do not allow 0.0.0.0/0 as remote subnet

This renders the whole machine inaccessible

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: Create IPsec interfaces when network is brought up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsecctrl: Call ipsec-interfaces script when turning up/shutting down connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add (experimental) script that creates GRE/VTI interfaces

Signed-off-by: root <root@interim-edge-a.ec2.internal>

IPsec: Use left/rightprotoport in GRE mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsecctrl: Don't wait when a connection is to be started

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Don't install any block rules for connections with an interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Permit GRE traffic for GRE connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Variables don't match those from the CGI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Parse all configuration settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Move opening ports from ipsecctrl into ipsec-policy script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Rename ipsec-block script to ipsec-policy

This is a more general name for a script that will be extended
soon to do more than just add blocking rules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Update ipsec.conf for GRE/VTI changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add UI for set interface MTU

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add option to configure IP address for tunnel interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Set default inactivity timeout to half an hour

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: New connections should defatul to on-demand mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add dropdown to select tunnel interface mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Correctly carry over INACTIVITY_TIMEOUT

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Write tunnel/transport mode to strongSwan configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add selection for transport/tunnel mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python3-msgpack: Fix build on i586

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python3-dateutil: Update rootfiles

Changed because of new python3-setuptools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcpcd: Update to 7.1.0

For some informations about this update see:
https://roy.marples.name/blog/dhcpcd-7-1-0-released

"dhcpcd-7.1.0 has been released with the following changes:

- OpenBSD: works alongside slaacd(8)
- NetBSD: sets SO_RERROR on to detect receive socket overflow
- BSD: route improvements to avoid listening for own changes
- Linux: use NETLINK_BROADCAST_ERROR
- BSD: avoid late address deletion messages by testing address existance
- IP6: implement IP6 address sharing
- BSD: catch UP/DOWN events when interfaces does support media changes
- IPv4LL: remember old address when carrier is lost

Many other minor fixes and documenation updates have been submitted by various
community members for this release..."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated curl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: Update to 7.63.0

For details see:
https://curl.haxx.se/changes.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update.sh: Delete .rnd files

Since RANDFILE has been disabled in OpenSSL configurations, .rnd files are not needed anymore.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated apr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Updated apr, stabilized apache build

- Updated apr to 1.6.5
- Stabilized apache build (rebuild)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python3-llfuse: fix rootfile for non x86_64 builds

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.97

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

haproxy: Bump version to support TLSv1.3 (and PCRE JIT)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Restart updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache: Update to 2.4.38

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.38

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship AWS scripts again

It seems that this was missing in Core Update 125/126 so not all
bug fixes made it into the release.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package borgbackup

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-msgpack

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-llfuse

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-setuptools-scm

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package python3-settuptools

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Delete SSE2-optimised legacy OpenSSL libraries, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated OpenSSL configuration files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

del_rand: Deletion of RAND file in openssl config

Fixes #11943

Since the kernel RNG should do this, there is no need for this anymore.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ghostscript: Update to 9.26

For details see:
https://www.ghostscript.com/doc/9.26/News.htm

This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")

Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-4286563.html

I saw this article and found it could be the time for an update...

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Enable some performance tuning

These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.

Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.

On a slower system (apu1d) no performance improvement or loss
could have been measured.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy: Show error messages in English by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.3.2

See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated ca-certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated openssh

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenSSH: update to 7.9p1

Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

kernel: update to 4.14.95

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xtables-addons: Fix generating GeoIP database

Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.

This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.

This patch changes this so that the last 12 bytes are just being dropped.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated tzdata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: update to 2018i

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Update to 5.7.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: x86_64 encrease NR_CPUS to 64

fixes #11963

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.94

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: Ship updated xt_geoip_update script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated logrotate

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.15

For details see:
https://github.com/logrotate/logrotate/releases

- timer unit: change trigger fuzz from 12h to 1h (#230)
- service unit: only run if /var/log is mounted (#230)
- preserve fractional part of timestamps when compressing (#226)
- re-indent source code using spaces only (#188)
- minage: avoid rounding issue while comparing the amount of seconds (#36)
- never remove old log files if rotate -1 is specified (#202)
- return non-zero exit status if a config file contains an error (#199)
- make copytruncate work with rotate 0 (#191)
- warn user if both size and the time interval options are used (#192)
- pass rotated log file name as the 2nd argument of the postrotate script
  when sharedscript is not enabled (#193)
- rename logrotate-default to logrotate.conf (#187)

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

core127: run xt_geoip_update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: ovpn ca index.txt is also missing on some installations

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

xt_geoip_updte: fix download url

the maxmind server delivers an old version if there are
two slashes before the database filename.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: fix typo

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add ovpn ca changes to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add xt_geoip_update to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add bind to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: set reboot needed flag

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: add general-functions.pl to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core127: fix updater for aarch64 and armv5tel

if a arch specific filelist has the same name as the common the common filelist was ignored

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>