start core136

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

close core135

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.138

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

dhcpcd: add noip4ll parameter to config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

initskripts: smt: hide error on cpu's that not support smt at all

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

partresize: check for apu only if dmi is present

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

sysctl: add seperate sysctl-x86_64.conf and move x86_64 only parameters

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core135: add updated leds initskript to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core135: add u-boot changes to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core135: add missing kernel rootfiles

core135: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.137

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

clamav: update to 0.101.3

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

setup: add ignore to all no nic assigned errors

u-boot-friendlyarm: add u-boot for nanopi-r1 to boot from eMMC

this is a heavy patched version and should replaced when stock
u-boot is able to boot from h3 eMMC.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: enable boot from additional mmc device

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: switch default sunxi dtb to nanopi-r1

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

led initskript: add nanopi-r1

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

partresize: add copy of broadcom firmware settings for nanopi-r1

I added this to partresize like the APU scon enable because this
is the only script that runs on flashimage at first boot only and
remount root writeable.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

rpi-firmware: create copy of RPI3 brcm 43430 configfile.

the AP21xx need a different config so store the rpi version as backup.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: remove old modules folder before kernel build

the build fails at creating source symlinks for external
modules build if it already exists.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update arm-multi patchset

this add FriendlyElec nanopi-r1 devicetree file.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pcenginges-firmware: skip build on arm

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bird: Update to 2.0.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pcengines-firmware: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pcengines-firmware: update to 4.9.0.7

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

iperf3: update to 3.7

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

iperf: update to 2.0.13

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

initskripts: fix i586 rootfile

unbound: rework dns-forwader handling

add check if red interface has an IPv4 address before test the servers at
red up and simply remove forwarders at down process.

This also fix the hung at dhcpd shutdown.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound-dhcp-leases-bridge: handle PTR generation parameter

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reported-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: update root.hints to 2019070301

IPv4 of server B has changed. Other changes are whitespace only.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core135: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 4.8

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Core Update 135: ship updated tzdata

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core135: Ship updated sysctl.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sysctl: improve KASLR effectiveness for mmap

By feeding more random bits into mmap allocation, the
effectiveness of KASLR will be improved, making attacks
trying to bypass address randomisation more difficult.

Changed sysctl values are:

vm.mmap_rnd_bits = 32 (default: 28)
vm.mmap_rnd_compat_bits = 16 (default: 8)

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: check if red/iface exists before read it

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

tzdata: update to 2019b

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core135: Ship forgotten ddns package

This was updated before, but I forgot to ship it in the updater.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core135: Ship cloud-init changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "Generate a VHD image"

This reverts commit ee0e3beb39da302fb9735b8b3846ee675192b350.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

azure: Do not drop last byte of MAC addresses

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Enable serial console on all Azure instances

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cloud-init: Move detection functions into initscript function library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Generate a VHD image

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cloud-init: Import experimental configuration script for Azure

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cloud-init: Execute setup script for Azure if needed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cloud-init: Add function to detect if we are running on Azure

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rename AWS initscript to cloud-init

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flash-image: Align image to 1MB boundary

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core135: Ship updated packages/files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 135

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nettle: Update to 3.5.1

For details see:
https://git.lysator.liu.se/nettle/nettle/blob/master/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcpcd: Update to 7.2.3

For details see: Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
https://roy.marples.name/blog/dhcpcd-7-2-3-released

"Minor update with the following changes:

   OpenBSD: compiles again
   BSD: Check RTM lengths incase of kernel issues
   DHCP6: Don't stop even when last router goes away
   DHCP6: Fix inform from RA
   hostname: Fix short hostname check"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: use nic carrier instead of /var/ipfire/red/active

This speed boot with static settings and no link and
dhcp on intel nics if the mtu is changed by the dhcp lease
because the nic loose the carrier and restart the dhcp action
at mtu set.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.131

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

linux: Fix rootfile to ship GeoIP modules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mc: Update to 4.8.23

For details see:
http://midnight-commander.org/wiki/NEWS-4.8.23

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

intel-microcode: update to 20190618

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

kernel: 4.14.129

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

finish core134

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Update contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core134: Ship updated firewall initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core134: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.8

For Details see:
https://downloads.isc.org/isc/bind9/9.11.8/RELEASE-NOTES-bind-9.11.8.html

"Security Fixes
    A race condition could trigger an assertion failure when a large number
    of incoming packets were being rejected.
    This flaw is disclosed in CVE-2019-6471. [GL #942]"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG12015: Redirecting to Captive portal does not work after IPFire restart

When the Captive portal is enabled, the needed firewall rules are applied. But when restarting IPFire,
the rules are not applied because there is no call to do so.
Added call to captivectrl in the initscrip 'firewall'.

Fixes: #12015
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core134: ship core133 late fixes again

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

kernel: remove RPi DMA allignment revert

TODO: test if RPi works without now or if we need to
revert more of the allignment patches.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Kernel: update to 4.14.128

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core134: Ship updated vim

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove old vim 7.4 data

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vim: Update to 8.1

Please note:
If this gets merged, the update process must deal with the otherwise remaining
files in '/usr/share/vim74' (~16 MB).

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update French translation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core134: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

kernel: update to 4.14.127

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

linux-pae: fix grub.conf creation on pv machines

on some systems it seems that grub2 and it config also exist.

core134: Ship changed general-functions.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG12070: Its not possible to use the underscore in email addresses

Using IPFire's Mailservice does not allow to enter a senders mail address with the underscore.
The function used to verify that is used from general-functions.pl.
Now the function 'validemail' allows the underscore in the address.

Fixes: #12070
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core134: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.9.2

For details see:
https://nlnetlabs.nl/pipermail/unbound-users/2019-June/011632.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Fix writing ESP settings for PFS ciphers

The changes introduced due to #12091 caused IPsec ESP
to be invalid if PFS ciphers were selected. Code has
to read "!$pfs" instead of just "$pfs", as it should trigger
for ciphers _without_ Perfect Forward Secrecy.

Fixes #12099

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'master' into next

vpnmain.cgi: remove wrongh "shift-space"

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

hyperscan: increase min RAM per buildprocess to 1GB

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core133: Ship jansson in update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

finish core133

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core134: Ship updated OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenSSL: lower priority for CBC ciphers in default cipherlist

In order to avoid CBC ciphers as often as possible (they contain
some known vulnerabilities), this changes the OpenSSL default
ciphersuite to:

TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(256) Mac=SHA384
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(256) Mac=SHA384
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256
ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(128) Mac=SHA256
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256
ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(128) Mac=SHA256
DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH       Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256
DHE-RSA-CAMELLIA256-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA256
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256
DHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA256
ECDHE-ECDSA-AES256-SHA  TLSv1 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA1
ECDHE-ECDSA-AES128-SHA  TLSv1 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA1
ECDHE-RSA-AES256-SHA    TLSv1 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1
ECDHE-RSA-AES128-SHA    TLSv1 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1
AES256-GCM-SHA384       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(256) Mac=AEAD
AES128-GCM-SHA256       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(128) Mac=AEAD
AES256-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA256
CAMELLIA256-SHA256      TLSv1.2 Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA256
AES128-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA256
CAMELLIA128-SHA256      TLSv1.2 Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA256
AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
CAMELLIA256-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA1
AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
CAMELLIA128-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA1

Since TLS servers usually override the clients' preference with their
own, this will neither break existing setups nor introduce huge
differences in the wild. Unfortunately, CBC ciphers cannot be disabled
at all, as they are still used by popular web sites.

TLS 1.3 ciphers will be added implicitly and can be omitted in the
ciphersting. Chacha20/Poly1305 is preferred over AES-GCM due to missing
AES-NI support for the majority of installations reporting to Fireinfo
(see https://fireinfo.ipfire.org/processors for details, AES-NI support
is 28.22% at the time of writing).

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 134

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Make some zones type-transparent

If we remove other records (like MX) from the response, we won't
be able to send mail to those hosts any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Add yandex.com to safe search feature

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: safe search: Resolve hosts at startup

unbound is not able to expand CNAMEs in local-data. Therefore we
have to do it manually at startup.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Tor: fix permissions after updating, too

Fixes #12088

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reported-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core133: Ship updated wpa_supplicant

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Update to 2.8

For details see:
https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

smt: Only disable SMT when the kernel thinks it is vulnerable

On virtual machines, it does not make sense to disable SMT for the
virtual cores. This has to be done by the hypervisor.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>