core130: update pakfire database after version change

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: ship setup binary

The setup contain a IPFire version string.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: ship pakfire version update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Postfix: update to 3.4.5

See http://www.postfix.org/announcements/postfix-3.4.5.html for
release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.3

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

"2019-04-05  Tim Ruehsen  <tim.ruehsen@gmx.de>

Fix a buffer overflow vulnerability
* src/iri.c(do_conversion): Reallocate the output buffer to a larger
  size if it is already full"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Disable CPU affinity

Benchmarks have shown, that this is making the IPS slower
across various hardware

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.110

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: Do not search for sensors on AWS

This causes some i2c drivers to load and tons of error messages
being created in syslog. So we skip searching for any sensors
that do not exist.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Set MTU to a default when editing an old connection

This field is required and therefore we need to initialize it
for old connections. Right now, the CGI throws an error message
when editing an existing connection without the MTU being filled
in.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated wget

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.2

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

* Changes in Wget 1.20.2
** NTLM authentication will retry under certain cases
** Fixed a buffer overflow vulnerability"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated nettle

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nettle: Update to 3.4.1

For details see:
https://fossies.org/linux/nettle/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated GnuTLS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.6.7.1

For details see:
https://lists.gnupg.org/pipermail/gnutls-help/2019-March/004497.html

Please note:
A few days after the "3.6.7" release, "3.6.7.1" came out.

See:
https://www.gnupg.org/ftp/gcrypt/gnutls/v3.6/

But the compressed directory version is still versioned 3.6.7.

Because of this, the fourth (sub)-version number required some lfs adjustments.

And:
This version requires "nettle 3.4.1", which is sent in another commit.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache: Update to 2.4.39

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

freeradius: Fix extra whitespace

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

freeradius: handle special LDFLAGS to configure

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pcengines-apu-firmware: New package

This package ships the latest BIOS for PC Engines APU boards.

With help of the firmware-update package, this can be very easily
updated when running IPFire.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firmware-update: New package

This is a script that can update firmware on PC Engines APU systems

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flashrom: New package

This is required to flash firmware

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable some debugging in expactation to increase performance

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable strict checks for /dev/mem

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

freeradius: Fix build on armv5tel

Reported-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IDS: Rename sourcefire VRT rulesets to Talos VRT rulesets

Fixes #12019

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

Update borgbackup to version 1.1.9

Fixes: #12016
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.109

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update user regd patch from openwrt

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'ms/dfs' into next

freeradius: Update to version 3.0.18

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.2

For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html

"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound-dhcp-leases-bridge: Replace leases file atomically

When there is a large number of leases, writing the file may
take a long time. When unbound is re-reading its configuration
in that time, the file might syntactically incorrect.

This change writes the file first and then moves it
to the right place in one transaction.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Enable CPU affinity

This will tie the detection threads to a certain CPU and
slightly increases throughput on my system.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Tie queues to a CPU core

This should improve performance by a small margin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nginx: Update to 1.15.9

Fixes #12023 .
Added support for http2.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

freeradius: Bump version because package is linked against old version of OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Remove double colon

In some languages, there were double colons in the DNS Update section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

GeoIP: Do not crash when locations database does not exist

Fixes: #12021
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Build libedit very early

Many packages can make use of this

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated lua

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lua: Update to 5.3.5

For details see:

http://www.lua.org/bugs.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship rrdtool and collectd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rrdtool: Update to 1.7.1

Disabled 'lua' because otherwise building failed.

I didn't find any place or reason where 'lua' was used by 'rrdtool', so it
was deactivated.

Disabling had no noticeable effects by now. Running.

Please note:
'/usr/lib/collectd/rrdcached.so' and '/usr/lib/collectd/rrdtool.so' have to
be updated, too.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpn: Remove subnet check for static pools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Update to 1.3.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Install some symlinks to start the service

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Add backup include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Core 130: Remove files after convert-snort has been launched

The converter requires /etc/snort/snort.conf to grab the used rule files
(categories). After all settings have been converted, we are fine to delete all
snort related files, because none of them is needed anymore.

Also the /var/ipfire/snort directory needs to be deleted. If it will be left on the
system and at any later time a backup will get restored, the converter will be
started by the backup script, because it detects that a snort settins dir exists
and would be restore the old snort settings and replaces all current IPS settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsforward.cgi: Add DNSSEC option to legend

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsforward.cgi: Check DISABLE_DNSSEC checkbox when editing

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Always enable 80 MHz channel width for 802.11ac

This is mandatory to support by all hardware and works well.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Automatically disassociate any clients with high error rates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable debugging for Atheros drivers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable DFS support for ath*k drivers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: make client isolation configurable via WebUI

hostapd supports client-isolation, but this feature could
not be configured via the WebUI so far. Since it might be
desired in public wireless networks, or even private ones,
it makes sense to provide a radio button to let the user
decide on.

Fixes #11974.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ensure Tor daemon files have correct permissions

Set permissions for /var/lib/tor and /var/ipfire/tor to
tor:tor, regardless whether Tor user has been created before
or not.

This ensures Tor starts properly on existing systems after
reinstallation of the add-on. Thanks to Michael for the hint.

Further, a comment for new Tor user in /etc/passwd has been added.

Fixes #11779.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.9.1

For details see:
https://nlnetlabs.nl/pipermail/unbound-users/2019-March/011415.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated ntp

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ntp: Update to 4.2.8p13

For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Fix ownership and file permissions of files inside /var/lib/suricata.

These files needs to have nobody.nobody as owner but requires read-acces from everyone
to allow the suricata user reading-in this files during startup.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logs.cgi/ids.dat: Fixup processing dates from logfiles which contains a year

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix python3-yaml rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Fix another error in rootfile

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Fix errors in rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update IPS translation

* Fix typos
* Fix compound nouns (especially in German)
* Remove unused strings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nut: Disable parallel build

nut just fails to build when running in parallel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship suricata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'stevee/next-suricata' into next

core130: Ship updated firewall script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add IPtables chain for outgoing Tor traffic

If Tor is operating in relay mode, it has to open a lot of outgoing
TCP connections. These should be separated from any other outgoing
connections, as allowing _all_ outgoing traffic will be unwanted and
risky in most cases.

Thereof, Tor will be running as a dedicated user (see second patch),
allowing usage of user-based IPtables rulesets.

Partially fixes #11779.

Singed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

run Tor under dedicated user

This allows more-fine granular firewall rules (see first patch for
further information). Further, it prevents other services running as
"nobody" (Apache, ...) from reading Tor relay keys.

Fixes #11779.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 130

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Fix amount of listened nfqueues

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

amavisd: update to 2.11.1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.4.3

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Set the clock correctly when installing over network

If a system has a not very up to date clock, downloading files
over HTTPS is impossible.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: finish update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: try to boot without ramdisk if the system cannot load it

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

knot: update to 2.8.0 and build/install only kdig

This fix compile errors on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

groff: update to 1.22.4

This fix compile problems on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

suricata: Remove unneeded stuff during build

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "kernel: cleanup unused rpi patch"

This reverts commit a2d49659f3947e5a5a77cbc1bf384eb0b2760ca9.

The patch is still needed to prevent strange crashes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated dnsforward.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'ms/dns-forwarding' into next

core129: Ship updated dhcp.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'ms/dhcp' into next

Tor WebUI: drop relay bandwith options < 1 MBit/s

Tor requires at least 1 MBit/s in order to participate.

Fixes #12001

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Limit to fewer concurrent build processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>