hplip: Update to version 3.18.6

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

guardian: Update to 2.0.2

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

guardian.cgi: Remove support for owncloud

Owncloud as an addon has been dropped for IPFire. As a result of this,
we do not need this code anymore.

Fixes #11572.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship updated sysctl.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hide kernel addresses in /proc

Make sure kernel address space is hidden from files somewhere
in /proc . This reduces attack surface and partially addresses #11659.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship updated usbutils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

usbutils: update to 010

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship updated GeoIP.dat

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update GeoIP.dat database

There are two GeoIP databases used in IPFire: One for firewall
rules, which is downloaded and installed automatically, and a
second one ("GeoIP.dat") for WebUI lookups via the Perl interface.

The latter one is not updated automatically and was outdated.
libloc will make things much easier here...

Fixes #11777.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

multipath-tools: Update to 0.7.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nss-myhostname: FTBFS on aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship changed vpnmain.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add ChaCha20/Poly1305 to IPsec WebUI

The algorithm is selected by default since it is considered
to be both secure and state-of-the-art. This required Linux kernel
> 4.2, which is satisfied by Core Update 2.12 122.

Fixes #11549

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update cryptography settings in StrongSwan LFS file

The RC2 plugin was never supported by the WebUI and is insecure,
so it became obsolete here. To support new ChaCha20/Poly1305, the
corresponding module needs to be enabled.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship updated packages and files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy.cgi: The group name cannot be in quotes

Squid interprets the quotes as part of the group name, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

smartmontools: update to 6.6.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lynis: update to 2.6.4

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update StrongSwan to 5.6.3

This also takes advantage of changed crypto plugins (see first
patch) and updates the rootfile.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: update to 1.8.3

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.7.3

For details see:
http://www.unbound.net/download.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Update to version 2.4.6

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

conntrack-tools: update to 1.4.5

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnetfilter_conntrack: update to 1.0.7

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iptables: update to 1.6.2

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Remove unused code that prevented the page from loading without GREEN

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Don't show proxy configuration pages when GREEN is not available

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Hide certain things on the web UI

Those are practically unusable on AWS.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Store instance id

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Re-enable check if we are actually running on EC2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Suppress any output from ending dhclient

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: No need to wake up udev again

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Suppress more warnings when initialising without GREEN

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Rename network interfaces only when necessary

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Import SSH keys before meddling with the network

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Allow starting without a green interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: No need to restart udev any more

The renames the network interfaces itself now

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

localnet: Don't write local hostname to /etc/hosts

This is now being provided by nss-myhostname

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nsswitch.conf: Use nss-myhostname to resolve local hostname

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nss-myhostname: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Rename all interfaces when booting up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Apply SSH configuration changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssh: Write port 22 into the default configuration file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Restart udev to rename network interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Add support for ORANGE

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Remove some debugging line

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Calculate gateway and DNS IP addresses only for RED

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Use correct IP address for the internal DNS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Write HOSTNAME and DOMAINNAME when not set

Previously we expected the entire settings file to be empty
but since we are now shipping some defaults for other settings.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Ship default settings for language, theme, etc. in all images

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Ensure that SSH checkbox is enabled, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aws: Enable SSH on the first start

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

setup: Write /etc/hosts in initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

setup: Don't write configuration files for TCP wrapper any more

This has been removed from the distribution a long time ago

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache: Write hostname into configuration at boot time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Import aws setup script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcp: Ship dhclient

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ssh: Update default configuration

This patch removes an old switch to enable SSH 1 and
makes port 22 the default port.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add initscript that automatically configures IPFire on AWS EC2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flash-image: Make sure that GRUB boots the first entry

This is required when importing an image into AWS EC2 or
the import of the image fails.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship updated iana-etc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iana-etc: update to 2.30

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libstatgrab: Update tp 0.91

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Delete 1024 bit DH-parameter from menu

Since OpenVPN-2.4.x do not accepts 1024 bit DH-parameter for security concerns anymore,
    it has been removed from the menu.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship /var/ipfire/backup/exclude

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Exclude OpenVPNs ovpn.cnf from backup

This fixes also bug #11773

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core123: Ship updated gnupg

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnupg: update to 1.4.23

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Prevent that a Roadwarrior name will be set two times

Fixes bug #11307

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 123

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Fix upload check for root and host certificate

Fix for #11766 .
Since the new OpenSSL output differs in the 'Subject' section, the regex needed to be adapted.
Old and new output should now be possible.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Set default of 730 days for client certificate validity

Since OpenSSL 1.1.0x it is required to set a value for the 'valid til (days)' field.
The WUI delivers now a guide value of two years.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipset: Update to 6.38

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Valid til days is required with OpenVPN-2.4.x

Check has been integrated that the OpenSSL maximum of '999999' valid days can not be exceeded.
Check for needed entry in 'Valid til days' field has been integrated.
Asterisk for 'Valid til days' field has been set to mark it as required field.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tmux: Update to 2.7

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mtr: Update to 0.92

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fping: update to 4.0

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ovpnmain.cgi: Add missing closing bracket

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

validate certificates in ids.cgi

Fixes #11770.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: update to 2018e

Some lines in the rootfile were sort incorrectly, this has been fixed.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

coreutils: update to 8.29

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: update to 1.8.2

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

attr: fix rootfile

There was a man page missing in the attr rootfile.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: update to 0.3.3.7

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: update to 3.2.6

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: update to 1.7.2

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Allow to configure a connection in waiting state

This allows to create an IPsec connection that will never actively
try to reach the other peer. It helps in environments where this is
not desired or impossible because of NAT.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Bump toolchain date

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bump version to 2.21

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core121: Create updater

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tar: Update to 1.30 (V3)

For details see:
https://www.gnu.org/software/tar/

Since new 'tar' has changes in commandline option parsing,
it was necessary to adjust 'lfs/Config, 'lfs/cdrom' and
'lfs/core-updates' (thanks to Marcel for diffs and Michael for
corrections).

I have tried to make only the most necessary changes.

As always, please check.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flash-image: increase boot partition to match with iso install

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Config: follow symlinks at rootfile check

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.48

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

aarch64: Rootfile update for Python 3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcp: Update to 4.4.1

For details see:
https://kb.isc.org/article/AA-01571/82/DHCP-4.4.1-Release-Notes.html

This should close https://bugzilla.ipfire.org/show_bug.cgi?id=11697 and
https://bugzilla.ipfire.org/show_bug.cgi?id=11293.

This update required some changes as described in:
https://bugzilla.ipfire.org/show_bug.cgi?id=11697#c6

Thanks to all testers! ;-)

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

aarch64: Fix rootfile for Python

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cpufrequtils: fix version numbers

I had incremented the VER instead of PAK_VER

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Import rootfiles for aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>