kernel: update to 4.14.173

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Revert "kernel: update to 4.14.172"

This reverts commit 1773544d025591d4096ee91bcc598dac19fa0f24.

with 4.14.172 klogd is not updated and the firewall log/graphs are not
working

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

suricata: use KILL is suricata not shut down normal.

sometimes suricata hung and lock the pidfile at
suricata stop.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: start suricata before unbound after update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add unbound.conf to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: Disable using mixed case for DNS queries

This seems to cause that some resolvers do not respond
to queries any more until unbound falls back.

To ensure better DNS performance, we disabled this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: Only launch one process

When unbound is running multiple threads, we have observed
that queries where sent for each thread.

Since no user should have so much DNS traffic that more than
one processor core is being saturated, this is a safe change.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound.conf: Do not set defaults explicitly

In order to keep configuration files small and easy to review/audit,
omitting defaults makes more sense than configure them explicitly (have
changed my mind here).

Unbound comes with a good default confiuration, and we should only make
changes when they are necessary. In addition, this patch updates the
documentation's URL to the current one.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

dns.cgi: restart suricata before unbound reload

if unbound is reloaded it start a bunch of dns queries
so suricata needs to now which servers should used.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

backup: Fix saving DNS settings

There was a typo in /var/ipfire/dns/servers and the settings
file was not explicitely included in the backup.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound/red.up: run unbound update-forwarders after suricata init.

The old suricata instance blocks dns requests if the red ip has changed.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: fix typo's at remove/update dns forwareders changes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.172

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

backup: add /var/ipfire/dns/server to include

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: drop remove-dns-fowarders at red.down

this functions has only reloaded unbound config
which is useless at shutting down the red interface.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

udev: build after kmod

eudev depends on kmod to install all needed rules

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: stop squid and suricata while update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: speed-up remove forwarders

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: ship unbound initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: fix typo at safesearch for googe

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: run "time-fix" before savesearch resolves

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: update savesearch after reload configfiles

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

lang: Improvements to French translation

This patch adds translations for the new DNS part as well
as various improvements.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add kmod to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kmod: Update to 26

This patch links kmod against OpenSSL which is required to
decode the kernel modules' PKCS#7 signatures.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: add core to version string

this make it easier to find the unstable and testing build for a core update in fireinfo.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

dnsdist: a compile thread needs two gigabyte of ram

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: replace "pakfire remove"

i have cut and paste this from older core but its not working

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: remove dropped packages

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: fix typo

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pakfire: Re-install previous core update when in testing mode

Fixes: #12302
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Tested-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: ship updated fireinfo.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

fireinfo.cgi: Use pakfire lib to gather the pakfire version.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ppp: Add upstream patch to fix bounds check in EAP code.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

w_scan: fix country and satalite selection menu

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: split rpi aarch64 quirk into parts

on of the changed variables was used before the old quirk.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Tor: update to 0.4.2.6

Please refer to https://blog.torproject.org/new-releases-tor-0426-0418
for release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add changed u-boot files to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: add quirk for rpi on aarch64

the current rpi u-boot will not load the ramdisk correctly so the kernel will
crash with loaded ramdisk.
Remove ramdisk and replace root UUID by /dev/mmcblk0p3 if boot was on
armv8 and rpi.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: remove kirkwood kernel detection from bootscript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

red.up: move update-dns-forwareders behind the firewall

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: update the uENV root UUID also on arch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add ppp to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ppp: Update to 2.4.8

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

elinks: suppress welcome dialog

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

dehydrated: Fix various syntax errors

* The backup include file was missing a leading slash
which caused no files to be backed up.

* The shell escaping was broken so a new configuration file
was useless.

Fixes: #12297
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

paks: remove scripts for elinks and phpSANE

phpSANE is dropped long ago and elinks in core now.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

paks: add/move extract_backup_includes to pak update scripts

this function allow to update the backup filelist before the backup was done in uninstall.sh at packet updates.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: remove old ddns python-2.7 version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ddns: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

cyrus-imapd: Drop package

This package is outdated and unmaintained for many many years.
I am not sure if this even works and if there are any users.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add cloudinit helper to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

cloud-init: Disable using ISP nameservers

This is mostly aesthetic because there are no ISP nameservers
anyways that we could use here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

aws-setup: Remove some excessive whitespace

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add dns.cgi to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

dns.cgi: Do not show table header if no servers are configured

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

guardian: Add upstream patch for HTTP parser.

Fixes #12289.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add ddns to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ddns: Import latest upstream patches for ddns-013

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ddns: Update to 013

This is an update to the first python3-based release of ddns.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add proxy.cgi tp updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

proxy.cgi: Switch to MD5 hashed passwords for local user auth.

The former used default Crypt algorithmus only supports passwords up to
eight signs wheater MD5 does not have any limitation here.

Fixes 12290.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

libpciaccess: Update to 0.16

There are not rootfile changes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add udev network-hotplug-bridges script to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

udev: Set wireless interfaces into AP mode before adding to bridge

Wireless interfaces cannot be added to the bridge when they are
still running in station mode. At boot time, the interface will
be created and it is attempted to attach it to a bridge, which
fails.

This patch now checks whether the wireless interface is going to
be an access point, changes the mode accordingly and then attaches
the interface to the bridge.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Tested-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

udev: Add more logging to bridge hotplug script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

w_scan: Update to 20170107

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

vdradmin: update to 3.6.10

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

vdr: update to 2.4.1

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh remove extra PAKFIRE_CORE version for nightly builds

this is useless because the new nightly also copies the core updaters
to the unstable and testing pakfire trees.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: cleanup unused kirkwood patches

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot-kirkwood: drop package

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop streamripper

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop rtpproxy

This probably has only been used by me and we do not need
it any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop setserial

This package was used internally and we have no script that uses it
any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop icegenerator

This is only useful with icecast.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop icecast

This is unmaintained for a very long time.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop ez-ipupdate

We do not use this at all any more, because it has been replaced
by ddns.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop DirectFB

This package is not very useful on its own and nobody
seems to pull this as dependency any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop check_mk_agent

This add-on is unmaintained in IPFire.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop multicat & bitstream

This reverts commit 0a21ce42e113f6c75f992d4ad1b88812ecc6b150.

These packages have never been updated and nodody in the team
is willing to support them.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop batctl

This package is no longer used. BATMAN is slightly out of fashion
and can be disabled in our kernel, too.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Drop arm

This is a CLI tool for Tor which is no longer maintained upstream.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Build lua before haproxy.

In commit b6ab15eaa2a899944c7edca99769fa4469f215d3 lua support
for haproxy has been enabled, so lua now has to be compiled before
haproxy.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core142: add pakfire changes to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Configure Pakfire to load packages from the correct tree

This will configure Pakfire that people who install a nightly
build will also get the packages for this build, etc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Cleanup code that builds ${SYSTEM_RELEASE}

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Tidy up Git commands

No functional changes. Just making them shorter.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pakfire: Add version suffix when in a certain tree

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pakfire.cgi: Add UI to select repository

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pakfire.cgi: Rename %pakfiresettings to %cgiparams

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pakfire.cgi: Remove some old settings

These can no longer be modified in the GUI and are used nowhere.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pakfire: Automatically compose $version

The tree in which pakfire is looking for packages and Core Updates
has been hardcoded into /opt/pakfire/etc/pakfire.conf.

This patch adds a new function which reads the system release
from /etc/system-release.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

dnsdist: Update to 1.4.0

This patch updates dnsdist to the latest release.

Additionally it includes /etc/sysconfig/dnsdist in the backup
and enables DNS-over-TLS.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

haproxy: Update to 2.1.3

This updates haproxy to the latest version.

In addition, support for Lua scripts is compiled in.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

suricata: Update to 5.0.2

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.171

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: armv5tel rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

qemu: bump pak version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

clamav: Update to 0.102.2

For details see:
https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html

"ClamAV 0.102.2 is a security patch release..."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>