ipfire-2.x.git
15 months agoFixes for 'backup.pl' (Bug #11816)
Matthias Fischer [Tue, 14 Aug 2018 19:34:38 +0000 (21:34 +0200)] 
Fixes for 'backup.pl' (Bug #11816)

Hi,

Fixes #11816
(https://bugzilla.ipfire.org/show_bug.cgi?id=11816 and
https://bugzilla.ipfire.org/attachment.cgi?id=608):

"[root@ipfire ~]# backupctrl exclude
...
tar: The following options were used after any non-optional arguments in
archive create or update mode.  These options are positional and affect
only arguments that follow them.  Please, rearrange them properly.
tar: --exclude-from '/var/ipfire/backup/exclude.user' has no effect
tar: Exiting with failure status due to previous errors"

Please test - I got no errors anymore.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore123: Ship openssl-compat, too
Michael Tremer [Tue, 14 Aug 2018 19:37:54 +0000 (20:37 +0100)] 
core123: Ship openssl-compat, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore123: Ship updated openssl
Arne Fitzenreiter [Tue, 14 Aug 2018 18:29:03 +0000 (20:29 +0200)] 
core123: Ship updated openssl

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agoMerge remote-tracking branch 'ms/aws-cli' into next
Michael Tremer [Tue, 14 Aug 2018 18:14:58 +0000 (19:14 +0100)] 
Merge remote-tracking branch 'ms/aws-cli' into next

15 months agoopenssl: Update to 1.1.0i and 1.0.2p
Michael Tremer [Tue, 14 Aug 2018 18:12:53 +0000 (19:12 +0100)] 
openssl: Update to 1.1.0i and 1.0.2p

 Changes between 1.1.0h and 1.1.0i [14 Aug 2018]

  *) Client DoS due to large DH parameter

     During key agreement in a TLS handshake using a DH(E) based ciphersuite a
     malicious server can send a very large prime value to the client. This will
     cause the client to spend an unreasonably long period of time generating a
     key for this prime resulting in a hang until the client has finished. This
     could be exploited in a Denial Of Service attack.

     This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
     (CVE-2018-0732)
     [Guido Vranken]

  *) Cache timing vulnerability in RSA Key Generation

     The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
     a cache timing side channel attack. An attacker with sufficient access to
     mount cache timing attacks during the RSA key generation process could
     recover the private key.

     This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
     Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
     (CVE-2018-0737)
     [Billy Brumley]

  *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
     parameter is no longer accepted, as it leads to a corrupt table.  NULL
     pem_str is reserved for alias entries only.
     [Richard Levitte]

  *) Revert blinding in ECDSA sign and instead make problematic addition
     length-invariant. Switch even to fixed-length Montgomery multiplication.
     [Andy Polyakov]

  *) Change generating and checking of primes so that the error rate of not
     being prime depends on the intended use based on the size of the input.
     For larger primes this will result in more rounds of Miller-Rabin.
     The maximal error rate for primes with more than 1080 bits is lowered
     to 2^-128.
     [Kurt Roeckx, Annie Yousar]

  *) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
     [Kurt Roeckx]

  *) Add blinding to ECDSA and DSA signatures to protect against side channel
     attacks discovered by Keegan Ryan (NCC Group).
     [Matt Caswell]

  *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
     now allow empty (zero character) pass phrases.
     [Richard Levitte]

  *) Certificate time validation (X509_cmp_time) enforces stricter
     compliance with RFC 5280. Fractional seconds and timezone offsets
     are no longer allowed.
     [Emilia Käsper]

  *) Fixed a text canonicalisation bug in CMS

     Where a CMS detached signature is used with text content the text goes
     through a canonicalisation process first prior to signing or verifying a
     signature. This process strips trailing space at the end of lines, converts
     line terminators to CRLF and removes additional trailing line terminators
     at the end of a file. A bug in the canonicalisation process meant that
     some characters, such as form-feed, were incorrectly treated as whitespace
     and removed. This is contrary to the specification (RFC5485). This fix
     could mean that detached text data signed with an earlier version of
     OpenSSL 1.1.0 may fail to verify using the fixed version, or text data
     signed with a fixed OpenSSL may fail to verify with an earlier version of
     OpenSSL 1.1.0. A workaround is to only verify the canonicalised text data
     and use the "-binary" flag (for the "cms" command line application) or set
     the SMIME_BINARY/PKCS7_BINARY/CMS_BINARY flags (if using CMS_verify()).
     [Matt Caswell]

 Changes between 1.0.2o and 1.0.2p [14 Aug 2018]

  *) Client DoS due to large DH parameter

     During key agreement in a TLS handshake using a DH(E) based ciphersuite a
     malicious server can send a very large prime value to the client. This will
     cause the client to spend an unreasonably long period of time generating a
     key for this prime resulting in a hang until the client has finished. This
     could be exploited in a Denial Of Service attack.

     This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
     (CVE-2018-0732)
     [Guido Vranken]

  *) Cache timing vulnerability in RSA Key Generation

     The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
     a cache timing side channel attack. An attacker with sufficient access to
     mount cache timing attacks during the RSA key generation process could
     recover the private key.

     This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
     Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
     (CVE-2018-0737)
     [Billy Brumley]

  *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
     parameter is no longer accepted, as it leads to a corrupt table.  NULL
     pem_str is reserved for alias entries only.
     [Richard Levitte]

  *) Revert blinding in ECDSA sign and instead make problematic addition
     length-invariant. Switch even to fixed-length Montgomery multiplication.
     [Andy Polyakov]

  *) Change generating and checking of primes so that the error rate of not
     being prime depends on the intended use based on the size of the input.
     For larger primes this will result in more rounds of Miller-Rabin.
     The maximal error rate for primes with more than 1080 bits is lowered
     to 2^-128.
     [Kurt Roeckx, Annie Yousar]

  *) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
     [Kurt Roeckx]

  *) Add blinding to ECDSA and DSA signatures to protect against side channel
     attacks discovered by Keegan Ryan (NCC Group).
     [Matt Caswell]

  *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
     now allow empty (zero character) pass phrases.
     [Richard Levitte]

  *) Certificate time validation (X509_cmp_time) enforces stricter
     compliance with RFC 5280. Fractional seconds and timezone offsets
     are no longer allowed.
     [Emilia Käsper]

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-s3transfer: Fix rootfile
Michael Tremer [Tue, 14 Aug 2018 14:13:24 +0000 (15:13 +0100)] 
python3-s3transfer: Fix rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-pyasn1: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:52:33 +0000 (14:52 +0100)] 
python3-pyasn1: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-rsa: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:44:30 +0000 (14:44 +0100)] 
python3-rsa: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-s3transfer: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:38:11 +0000 (14:38 +0100)] 
python3-s3transfer: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-yaml: New paclage as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:19:33 +0000 (14:19 +0100)] 
python3-yaml: New paclage as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-docutils: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:11:38 +0000 (14:11 +0100)] 
python3-docutils: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-colorama: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:04:03 +0000 (14:04 +0100)] 
python3-colorama: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-jmespath: New package as required by python3-botocore
Michael Tremer [Tue, 14 Aug 2018 12:57:02 +0000 (13:57 +0100)] 
python3-jmespath: New package as required by python3-botocore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-six: New package as required by python3-dateutil
Michael Tremer [Tue, 14 Aug 2018 12:18:00 +0000 (13:18 +0100)] 
python3-six: New package as required by python3-dateutil

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-dateutil: New package required by python3-botocore
Michael Tremer [Tue, 14 Aug 2018 12:13:07 +0000 (13:13 +0100)] 
python3-dateutil: New package required by python3-botocore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-botocore: Required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 11:54:23 +0000 (12:54 +0100)] 
python3-botocore: Required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws-cli: New package
Michael Tremer [Tue, 14 Aug 2018 11:45:38 +0000 (12:45 +0100)] 
aws-cli: New package

Needed to communicate with AWS services like EC2, S3, etc...

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agologs.cgi/ids.dat: Rework linking to external rule documentation.
Stefan Schantl [Tue, 14 Aug 2018 10:01:53 +0000 (12:01 +0200)] 
logs.cgi/ids.dat: Rework linking to external rule documentation.

Check if the sid of a rule belongs to sourcefire and link to the
changed URL for gathering more details. If the sid of the rule belongs
to emergingthreads now link to the emergingthreads documentation.

Fixes #11806.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoRootfile update
Michael Tremer [Tue, 14 Aug 2018 07:36:19 +0000 (08:36 +0100)] 
Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "usbutils: update to 010"
Michael Tremer [Mon, 13 Aug 2018 18:50:06 +0000 (19:50 +0100)] 
Revert "usbutils: update to 010"

This reverts commit b07b1bef22eae7038e7d0fcba0bfd53813f85258.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "core123: Ship updated usbutils"
Michael Tremer [Mon, 13 Aug 2018 18:49:58 +0000 (19:49 +0100)] 
Revert "core123: Ship updated usbutils"

This reverts commit a65d07ec6d36a712882294b608e718db2d56b24e.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "usbutils: Update rootfile"
Michael Tremer [Mon, 13 Aug 2018 18:49:48 +0000 (19:49 +0100)] 
Revert "usbutils: Update rootfile"

This reverts commit 9aefd1ed07eee7d83e5b274d4a83240811f9e091.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "avahi: Build without dbus"
Michael Tremer [Mon, 13 Aug 2018 17:59:10 +0000 (18:59 +0100)] 
Revert "avahi: Build without dbus"

This reverts commit 5221a852e80526d188306b05202e595616f0c065.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoaws: Execute user-data script while we have networking up
Michael Tremer [Mon, 13 Aug 2018 11:14:49 +0000 (12:14 +0100)] 
aws: Execute user-data script while we have networking up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agointel-microcode: update to 20180807
Arne Fitzenreiter [Sat, 11 Aug 2018 12:45:56 +0000 (14:45 +0200)] 
intel-microcode: update to 20180807

fixes #11590

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agoavahi: Bump package version
Michael Tremer [Fri, 10 Aug 2018 11:20:38 +0000 (12:20 +0100)] 
avahi: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoavahi: Build without dbus
Michael Tremer [Fri, 10 Aug 2018 11:20:06 +0000 (12:20 +0100)] 
avahi: Build without dbus

We don't have any services connected to dbus, so what is the
point of avahi trying to connect to it?

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoavahi: Build with -U_FORTIFY_SOURCE
Michael Tremer [Fri, 10 Aug 2018 11:18:29 +0000 (12:18 +0100)] 
avahi: Build with -U_FORTIFY_SOURCE

Avahi locks up when built with -D_FORTIFY_SOURCE=2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoavahi: Update to 0.7
Michael Tremer [Fri, 10 Aug 2018 10:19:25 +0000 (11:19 +0100)] 
avahi: Update to 0.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "avahi: Drop package"
Michael Tremer [Fri, 10 Aug 2018 10:08:09 +0000 (11:08 +0100)] 
Revert "avahi: Drop package"

This reverts commit aa6ee515c59cd42b12d69981329a2438e4d6e933.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoopenssh: Disable password authentication by default
Michael Tremer [Thu, 9 Aug 2018 15:28:14 +0000 (16:28 +0100)] 
openssh: Disable password authentication by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agokernel: fix build on x86_64
Arne Fitzenreiter [Wed, 8 Aug 2018 08:26:38 +0000 (10:26 +0200)] 
kernel: fix build on x86_64

oops i deleted a wrong line...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agokernel: fix build on armv5tel
Arne Fitzenreiter [Tue, 7 Aug 2018 17:05:35 +0000 (19:05 +0200)] 
kernel: fix build on armv5tel

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agokernel: apu2 leds: update string for newer bios
Arne Fitzenreiter [Sun, 5 Aug 2018 15:19:52 +0000 (17:19 +0200)] 
kernel: apu2 leds: update string for newer bios

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Sun, 5 Aug 2018 15:19:36 +0000 (17:19 +0200)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

16 months agoinitrd: add early microcode load
Arne Fitzenreiter [Sun, 5 Aug 2018 11:32:36 +0000 (13:32 +0200)] 
initrd: add early microcode load

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agotor: Update to version 0.3.3.9
Erik Kapfer [Sat, 4 Aug 2018 11:52:32 +0000 (13:52 +0200)] 
tor: Update to version 0.3.3.9

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agonginx: Update to version 1.15.1
Erik Kapfer [Sat, 4 Aug 2018 11:49:00 +0000 (13:49 +0200)] 
nginx: Update to version 1.15.1

Deleted last slash in --prefix configure option to prevent such -->
https://forum.ipfire.org/viewtopic.php?t=19213#p109787 problems.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agorng-tools: Update to 6.3.1
Matthias Fischer [Sat, 4 Aug 2018 06:35:05 +0000 (08:35 +0200)] 
rng-tools: Update to 6.3.1

Bugfix release, for details see:
https://github.com/nhorman/rng-tools/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agomake.sh: Add command to update list of contributors
Michael Tremer [Sat, 4 Aug 2018 12:39:00 +0000 (13:39 +0100)] 
make.sh: Add command to update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agocollectd: fix cpufreq plugin enable
Arne Fitzenreiter [Fri, 3 Aug 2018 14:13:12 +0000 (16:13 +0200)] 
collectd: fix cpufreq plugin enable

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agobackup: Bump release number in ISO download script
Michael Tremer [Tue, 31 Jul 2018 15:23:07 +0000 (16:23 +0100)] 
backup: Bump release number in ISO download script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agolinux-firmware: update to 30.7.2018
Arne Fitzenreiter [Thu, 2 Aug 2018 19:15:11 +0000 (21:15 +0200)] 
linux-firmware: update to 30.7.2018

include new amd microcodes for Spectre updates

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agoaws: Disable SSH password authentication by default
Michael Tremer [Mon, 30 Jul 2018 15:54:50 +0000 (16:54 +0100)] 
aws: Disable SSH password authentication by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agocore123: Ship and restart squid and apache
Michael Tremer [Thu, 26 Jul 2018 13:46:53 +0000 (14:46 +0100)] 
core123: Ship and restart squid and apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agosquid: Update to 3.5.28
Matthias Fischer [Tue, 17 Jul 2018 18:50:41 +0000 (20:50 +0200)] 
squid: Update to 3.5.28

For details see:
http://www.squid-cache.org/Versions/v3/3.5/changesets/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoApache: Update to 2.4.34
Wolfgang Apolinarski [Tue, 17 Jul 2018 18:13:30 +0000 (20:13 +0200)] 
Apache: Update to 2.4.34

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoaws: Add support for a script that can be executed at first boot
Michael Tremer [Fri, 20 Jul 2018 15:19:46 +0000 (16:19 +0100)] 
aws: Add support for a script that can be executed at first boot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoaws: Always exit the init script cleanly
Michael Tremer [Tue, 17 Jul 2018 17:05:07 +0000 (18:05 +0100)] 
aws: Always exit the init script cleanly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoasterisk: Don't optimise for builder
Michael Tremer [Fri, 20 Jul 2018 14:21:36 +0000 (14:21 +0000)] 
asterisk: Don't optimise for builder

Asterisk enables -march=native which renders the code
incompatible to most systems.

Fixes: #11793

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agofireinfo: Import latest patches
Michael Tremer [Fri, 20 Jul 2018 12:06:11 +0000 (12:06 +0000)] 
fireinfo: Import latest patches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agokernel: aarch64: enable virtio drivers
Arne Fitzenreiter [Thu, 19 Jul 2018 08:30:47 +0000 (09:30 +0100)] 
kernel: aarch64: enable virtio drivers

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agou-boot: boot aarch64 kernel without -multi extension
Arne Fitzenreiter [Thu, 19 Jul 2018 08:29:44 +0000 (09:29 +0100)] 
u-boot: boot aarch64 kernel without -multi extension

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agokernel: apply multi arch patchset for aarch64
Arne Fitzenreiter [Thu, 19 Jul 2018 08:28:27 +0000 (09:28 +0100)] 
kernel: apply multi arch patchset for aarch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
16 months agoAWS: Give setup user permissions to read its own SSH keys
Michael Tremer [Sat, 14 Jul 2018 14:06:39 +0000 (15:06 +0100)] 
AWS: Give setup user permissions to read its own SSH keys

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoaws: Unlock setup account
Michael Tremer [Thu, 12 Jul 2018 14:37:59 +0000 (15:37 +0100)] 
aws: Unlock setup account

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoaws: Install SSH keys only for setup user
Michael Tremer [Thu, 12 Jul 2018 12:57:19 +0000 (13:57 +0100)] 
aws: Install SSH keys only for setup user

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoaws: setup user should not be a system user
Michael Tremer [Thu, 12 Jul 2018 12:55:38 +0000 (13:55 +0100)] 
aws: setup user should not be a system user

Login is not permitted for system users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRootfile update for aarch64 kernel
Michael Tremer [Sat, 14 Jul 2018 12:43:13 +0000 (13:43 +0100)] 
Rootfile update for aarch64 kernel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoaarch64: Remove -multi suffix from kernel
Michael Tremer [Thu, 5 Jul 2018 22:28:15 +0000 (23:28 +0100)] 
aarch64: Remove -multi suffix from kernel

This gets in the way for authoring the CD and we will
never have any other kernels but the main one.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agolinux: Simplify compiling and installing the kernel
Michael Tremer [Thu, 5 Jul 2018 22:27:24 +0000 (23:27 +0100)] 
linux: Simplify compiling and installing the kernel

There was loads of duplicated code which could have been
made shorter by adding one variable.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoiptables: Ship all modules
Michael Tremer [Thu, 12 Jul 2018 09:04:37 +0000 (10:04 +0100)] 
iptables: Ship all modules

These have been all disabled with the last update of
the iptables package.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoRootfile update
Michael Tremer [Thu, 12 Jul 2018 09:03:34 +0000 (10:03 +0100)] 
Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoaws: Don't start ssh right away
Michael Tremer [Thu, 12 Jul 2018 08:59:31 +0000 (09:59 +0100)] 
aws: Don't start ssh right away

sshctrl calls sshd directly which won't work at time of the first boot
because no keys will be generated.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoOpenVPN: Deleted mtu-disc completely since it has been dropped.
Erik Kapfer [Fri, 6 Jul 2018 03:57:59 +0000 (05:57 +0200)] 
OpenVPN: Deleted mtu-disc completely since it has been dropped.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoclamav: Update to 0.100.1
Matthias Fischer [Mon, 9 Jul 2018 18:53:45 +0000 (20:53 +0200)] 
clamav: Update to 0.100.1

For details see:
https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoaws: Create "setup" user to run setup
Michael Tremer [Tue, 10 Jul 2018 17:32:20 +0000 (18:32 +0100)] 
aws: Create "setup" user to run setup

Amazon does not permit that a user logs in as root directly.
Instead they insist on using sudo.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agousbutils: Update rootfile
Michael Tremer [Tue, 3 Jul 2018 19:01:46 +0000 (20:01 +0100)] 
usbutils: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agospice-protocol: rootfile update
Arne Fitzenreiter [Tue, 3 Jul 2018 15:03:37 +0000 (16:03 +0100)] 
spice-protocol: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
17 months agolibgcrypt: rootfile update
Arne Fitzenreiter [Tue, 3 Jul 2018 15:01:35 +0000 (16:01 +0100)] 
libgcrypt: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
17 months agoUpdate translations
Michael Tremer [Tue, 3 Jul 2018 14:33:04 +0000 (15:33 +0100)] 
Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoOpenVPN: x509 and DH-parameter check with Warnings and error messages in WUI
Erik Kapfer [Wed, 27 Jun 2018 07:34:21 +0000 (09:34 +0200)] 
OpenVPN: x509 and DH-parameter check with Warnings and error messages in WUI

Changes includes:
Own crypto warning and error message in WUI (can be extended to configuration too).
Check if DH-parameter is < 2048 bit with an error message and howto fix it.
Check if md5 is still in use with an error message and suggestion how to proceed further to fix it.
Check for soon needed RFC3280 TLS rules compliants and suggestion how to proceed further to fix it.
Disabled 1024 bit DH-parameter upload.
Changed de and en language files for DH-parameter upload (deleted 1024 bit).
Added explanations to de and en language files for the above changes.
Fixed Typo in en language file.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoRevert "OpenVPN: Clarify fundamental crypto errors but also warnings in WUI"
Michael Tremer [Tue, 3 Jul 2018 14:32:42 +0000 (15:32 +0100)] 
Revert "OpenVPN: Clarify fundamental crypto errors but also warnings in WUI"

This reverts commit 15a3aa45cf27c61a581f892b5f3a3905335a12b0.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agocollect: fix cpufreq graph on some machines.
Arne Fitzenreiter [Tue, 3 Jul 2018 13:07:41 +0000 (15:07 +0200)] 
collect: fix cpufreq graph on some machines.

the file cpuinfo_cur_freq does not exist on all systems that support collect
cpufreq data.

fixes #11739

17 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Tue, 3 Jul 2018 10:52:18 +0000 (11:52 +0100)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

17 months agoMerge branch 'aarch64' into next
Arne Fitzenreiter [Tue, 3 Jul 2018 10:52:05 +0000 (11:52 +0100)] 
Merge branch 'aarch64' into next

Conflicts:
config/rootfiles/core/121/filelists/acpid
config/rootfiles/core/121/filelists/apache2
config/rootfiles/core/121/filelists/apr
config/rootfiles/core/121/filelists/aprutil
config/rootfiles/core/121/filelists/armv5tel/files
config/rootfiles/core/121/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/core/121/filelists/armv5tel/linux-initrd-multi
config/rootfiles/core/121/filelists/armv5tel/linux-kirkwood
config/rootfiles/core/121/filelists/armv5tel/linux-multi
config/rootfiles/core/121/filelists/armv5tel/rpi-firmware
config/rootfiles/core/121/filelists/armv5tel/u-boot
config/rootfiles/core/121/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/core/121/filelists/armv5tel/u-boot-mkimage
config/rootfiles/core/121/filelists/beep
config/rootfiles/core/121/filelists/cmake
config/rootfiles/core/121/filelists/crda
config/rootfiles/core/121/filelists/dhcp
config/rootfiles/core/121/filelists/flex
config/rootfiles/core/121/filelists/i586/grub
config/rootfiles/core/121/filelists/i586/intel-microcode
config/rootfiles/core/121/filelists/i586/linux
config/rootfiles/core/121/filelists/i586/linux-initrd
config/rootfiles/core/121/filelists/iw
config/rootfiles/core/121/filelists/jwhois
config/rootfiles/core/121/filelists/libidn
config/rootfiles/core/121/filelists/multipath-tools
config/rootfiles/core/121/filelists/pcre
config/rootfiles/core/121/filelists/tar
config/rootfiles/core/121/filelists/unbound
config/rootfiles/core/121/filelists/wget
config/rootfiles/core/121/filelists/x86_64/grub
config/rootfiles/core/121/filelists/x86_64/intel-microcode
config/rootfiles/core/121/filelists/x86_64/linux
config/rootfiles/core/121/filelists/x86_64/linux-initrd
config/rootfiles/core/122/filelists/aarch64/files
config/rootfiles/core/122/filelists/acpid
config/rootfiles/core/122/filelists/apache2
config/rootfiles/core/122/filelists/apr
config/rootfiles/core/122/filelists/aprutil
config/rootfiles/core/122/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/core/122/filelists/armv5tel/linux-initrd-multi
config/rootfiles/core/122/filelists/armv5tel/linux-kirkwood
config/rootfiles/core/122/filelists/armv5tel/linux-multi
config/rootfiles/core/122/filelists/armv5tel/rpi-firmware
config/rootfiles/core/122/filelists/armv5tel/u-boot
config/rootfiles/core/122/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/core/122/filelists/armv5tel/u-boot-mkimage
config/rootfiles/core/122/filelists/beep
config/rootfiles/core/122/filelists/cmake
config/rootfiles/core/122/filelists/crda
config/rootfiles/core/122/filelists/dhcp
config/rootfiles/core/122/filelists/flex
config/rootfiles/core/122/filelists/i586/grub
config/rootfiles/core/122/filelists/i586/intel-microcode
config/rootfiles/core/122/filelists/i586/linux
config/rootfiles/core/122/filelists/i586/linux-initrd
config/rootfiles/core/122/filelists/iw
config/rootfiles/core/122/filelists/jwhois
config/rootfiles/core/122/filelists/libidn
config/rootfiles/core/122/filelists/multipath-tools
config/rootfiles/core/122/filelists/pcre
config/rootfiles/core/122/filelists/tar
config/rootfiles/core/122/filelists/unbound
config/rootfiles/core/122/filelists/wget
config/rootfiles/core/122/filelists/x86_64/grub
config/rootfiles/core/122/filelists/x86_64/intel-microcode
config/rootfiles/core/122/filelists/x86_64/linux
config/rootfiles/core/122/filelists/x86_64/linux-initrd
config/rootfiles/core/123/filelists/unbound
config/rootfiles/oldcore/121/filelists/acpid
config/rootfiles/oldcore/121/filelists/apache2
config/rootfiles/oldcore/121/filelists/apr
config/rootfiles/oldcore/121/filelists/aprutil
config/rootfiles/oldcore/121/filelists/armv5tel/files
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-multi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-rpi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/linux-multi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-rpi
config/rootfiles/oldcore/121/filelists/armv5tel/rpi-firmware
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot-mkimage
config/rootfiles/oldcore/121/filelists/beep
config/rootfiles/oldcore/121/filelists/cmake
config/rootfiles/oldcore/121/filelists/crda
config/rootfiles/oldcore/121/filelists/dhcp
config/rootfiles/oldcore/121/filelists/flex
config/rootfiles/oldcore/121/filelists/i586/grub
config/rootfiles/oldcore/121/filelists/i586/intel-microcode
config/rootfiles/oldcore/121/filelists/i586/linux
config/rootfiles/oldcore/121/filelists/i586/linux-initrd
config/rootfiles/oldcore/121/filelists/iw
config/rootfiles/oldcore/121/filelists/jwhois
config/rootfiles/oldcore/121/filelists/libidn
config/rootfiles/oldcore/121/filelists/multipath-tools
config/rootfiles/oldcore/121/filelists/pcre
config/rootfiles/oldcore/121/filelists/tar
config/rootfiles/oldcore/121/filelists/wget
config/rootfiles/oldcore/121/filelists/x86_64/grub
config/rootfiles/oldcore/121/filelists/x86_64/intel-microcode
config/rootfiles/oldcore/121/filelists/x86_64/linux
config/rootfiles/oldcore/121/filelists/x86_64/linux-initrd
make.sh

17 months agoUpdate languages
Michael Tremer [Tue, 3 Jul 2018 09:34:57 +0000 (10:34 +0100)] 
Update languages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoOpenVPN: Clarify fundamental crypto errors but also warnings in WUI
Erik Kapfer [Thu, 21 Jun 2018 09:46:36 +0000 (11:46 +0200)] 
OpenVPN: Clarify fundamental crypto errors but also warnings in WUI

Since OpenVPN-2.4.x, a lot of changes has been introduced. This patch should help the users for better understanding of errors in the cryptography.
It includes also potential warnings for upcoming changes and needed adjustments in the system.
This can also be extended in the future for upcoming configuration changes.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoOpenVPN: Prevent internal server error cause of bad header wrapper
Erik Kapfer [Thu, 21 Jun 2018 09:12:53 +0000 (11:12 +0200)] 
OpenVPN: Prevent internal server error cause of bad header wrapper

This fixes #11772 .

If the X509 are deleted, the openvpnctrl output generates a bad header wrapper error from the CGI
which causes an internal server error. The redirection of the openvpnctrl output fixes this.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agohplip: Update to version 3.18.6
Erik Kapfer [Thu, 21 Jun 2018 11:52:13 +0000 (13:52 +0200)] 
hplip: Update to version 3.18.6

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoguardian: Update to 2.0.2
Stefan Schantl [Wed, 27 Jun 2018 17:39:14 +0000 (19:39 +0200)] 
guardian: Update to 2.0.2

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoguardian.cgi: Remove support for owncloud
Stefan Schantl [Wed, 27 Jun 2018 17:39:13 +0000 (19:39 +0200)] 
guardian.cgi: Remove support for owncloud

Owncloud as an addon has been dropped for IPFire. As a result of this,
we do not need this code anymore.

Fixes #11572.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agocore123: Ship updated sysctl.conf
Michael Tremer [Tue, 3 Jul 2018 09:33:23 +0000 (10:33 +0100)] 
core123: Ship updated sysctl.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agohide kernel addresses in /proc
Peter Müller [Sat, 30 Jun 2018 09:44:06 +0000 (11:44 +0200)] 
hide kernel addresses in /proc

Make sure kernel address space is hidden from files somewhere
in /proc . This reduces attack surface and partially addresses #11659.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agocore123: Ship updated usbutils
Michael Tremer [Tue, 3 Jul 2018 09:32:43 +0000 (10:32 +0100)] 
core123: Ship updated usbutils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agousbutils: update to 010
Peter Müller [Sat, 30 Jun 2018 15:04:42 +0000 (17:04 +0200)] 
usbutils: update to 010

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agocore123: Ship updated GeoIP.dat
Michael Tremer [Tue, 3 Jul 2018 09:32:08 +0000 (10:32 +0100)] 
core123: Ship updated GeoIP.dat

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoupdate GeoIP.dat database
Peter Müller [Sat, 30 Jun 2018 15:10:12 +0000 (17:10 +0200)] 
update GeoIP.dat database

There are two GeoIP databases used in IPFire: One for firewall
rules, which is downloaded and installed automatically, and a
second one ("GeoIP.dat") for WebUI lookups via the Perl interface.

The latter one is not updated automatically and was outdated.
libloc will make things much easier here...

Fixes #11777.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agomultipath-tools: Update to 0.7.7
Michael Tremer [Mon, 2 Jul 2018 18:10:36 +0000 (19:10 +0100)] 
multipath-tools: Update to 0.7.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoMerge remote-tracking branch 'origin/master' into aarch64
Arne Fitzenreiter [Mon, 2 Jul 2018 18:07:22 +0000 (19:07 +0100)] 
Merge remote-tracking branch 'origin/master' into aarch64

17 months agonss-myhostname: FTBFS on aarch64
Michael Tremer [Mon, 2 Jul 2018 17:48:50 +0000 (18:48 +0100)] 
nss-myhostname: FTBFS on aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agocore123: Ship changed vpnmain.cgi
Michael Tremer [Sun, 1 Jul 2018 12:34:56 +0000 (13:34 +0100)] 
core123: Ship changed vpnmain.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoadd ChaCha20/Poly1305 to IPsec WebUI
Peter Müller [Sat, 30 Jun 2018 15:18:30 +0000 (17:18 +0200)] 
add ChaCha20/Poly1305 to IPsec WebUI

The algorithm is selected by default since it is considered
to be both secure and state-of-the-art. This required Linux kernel
> 4.2, which is satisfied by Core Update 2.12 122.

Fixes #11549

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoupdate cryptography settings in StrongSwan LFS file
Peter Müller [Sat, 30 Jun 2018 15:15:22 +0000 (17:15 +0200)] 
update cryptography settings in StrongSwan LFS file

The RC2 plugin was never supported by the WebUI and is insecure,
so it became obsolete here. To support new ChaCha20/Poly1305, the
corresponding module needs to be enabled.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agocore123: Ship updated packages and files
Michael Tremer [Sun, 1 Jul 2018 12:34:19 +0000 (13:34 +0100)] 
core123: Ship updated packages and files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoproxy.cgi: The group name cannot be in quotes
Michael Tremer [Sun, 1 Jul 2018 11:38:48 +0000 (12:38 +0100)] 
proxy.cgi: The group name cannot be in quotes

Squid interprets the quotes as part of the group name, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agosmartmontools: update to 6.6.
Peter Müller [Wed, 20 Jun 2018 15:00:36 +0000 (17:00 +0200)] 
smartmontools: update to 6.6.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agolynis: update to 2.6.4
Peter Müller [Wed, 20 Jun 2018 15:04:26 +0000 (17:04 +0200)] 
lynis: update to 2.6.4

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agoupdate StrongSwan to 5.6.3
Peter Müller [Sat, 30 Jun 2018 15:16:37 +0000 (17:16 +0200)] 
update StrongSwan to 5.6.3

This also takes advantage of changed crypto plugins (see first
patch) and updates the rootfile.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
17 months agolibgcrypt: update to 1.8.3
Peter Müller [Sat, 30 Jun 2018 10:07:15 +0000 (12:07 +0200)] 
libgcrypt: update to 1.8.3

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>