ipfire-2.x.git
25 hours agosuricata: disable dns flood protection master next
Arne Fitzenreiter [Wed, 8 Apr 2020 15:48:20 +0000 (15:48 +0000)] 
suricata: disable dns flood protection

this causes errors in unbound and also other linux clients if
a dns rule triggers.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
25 hours agosuricata: update ET rulesets sources for suricata 5
Arne Fitzenreiter [Wed, 8 Apr 2020 15:43:35 +0000 (15:43 +0000)] 
suricata: update ET rulesets sources for suricata 5

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
35 hours agoicinga: bump PAKVER
Arne Fitzenreiter [Wed, 8 Apr 2020 05:44:45 +0000 (07:44 +0200)] 
icinga: bump PAKVER

some installations has a copy installed that still try to include
perl-5.12.3 libs.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
35 hours agocore143: touch need reboot flag
Arne Fitzenreiter [Wed, 8 Apr 2020 05:43:50 +0000 (07:43 +0200)] 
core143: touch need reboot flag

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agopcengines-apu-firmware: update rootfile
Arne Fitzenreiter [Tue, 7 Apr 2020 13:14:39 +0000 (15:14 +0200)] 
pcengines-apu-firmware: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agopcengines-apu-firmware: fix lfs file
Arne Fitzenreiter [Tue, 7 Apr 2020 09:15:03 +0000 (11:15 +0200)] 
pcengines-apu-firmware: fix lfs file

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agocore143: add zoneconf.cgi
Arne Fitzenreiter [Tue, 7 Apr 2020 08:59:32 +0000 (08:59 +0000)] 
core143: add zoneconf.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agozoneconf.cgi: Skip checks for non-existing zones
Michael Tremer [Mon, 6 Apr 2020 17:38:38 +0000 (17:38 +0000)] 
zoneconf.cgi: Skip checks for non-existing zones

On systems with RED on PPP and no BLUE or ORANGE zones,
there would always be an error when handling non-existant input.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agopcengines-apu-firmware: update to v4.11.0.5
Arne Fitzenreiter [Mon, 6 Apr 2020 16:42:35 +0000 (18:42 +0200)] 
pcengines-apu-firmware: update to v4.11.0.5

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agocore143: add unbmound initskript
Arne Fitzenreiter [Tue, 7 Apr 2020 08:57:50 +0000 (08:57 +0000)] 
core143: add unbmound initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agounbound: Set domains with local data into type transparent mode
Michael Tremer [Mon, 6 Apr 2020 15:10:25 +0000 (15:10 +0000)] 
unbound: Set domains with local data into type transparent mode

Records which are from the same domain than the IPFire hostname
might not be returned by unbound. This change explicitely instructs
unbound to check local data before checking the global DNS.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 days agocore143: add suricata http port changes
Arne Fitzenreiter [Tue, 7 Apr 2020 08:54:27 +0000 (08:54 +0000)] 
core143: add suricata http port changes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 days agoIDS: Dynamically generate and import the HTTP ports.
Stefan Schantl [Fri, 3 Apr 2020 14:25:01 +0000 (16:25 +0200)] 
IDS: Dynamically generate and import the HTTP ports.

With this commit suricata reads the HTTP port declarations from a newly
introduced external file
(/var/ipfire/suricata/suricata-http-ports.yaml).

This file dynamically will be generated. HTTP ports always are the
default port "80" and "81" for update Accelerator and HTTP access to the
WUI. In case the Web-proxy is used, the configured proxy port and/or Transparent
Proxy port also will be declared as a HTTP port and written to that file.

In case one of the proxy ports will be changed, the HTTP port file will
be re-generated and suricate restarted if launched. Also if an old
backup with snort will be restored the convert script handles the
generation of the HTTP ports file.

Finally the suricata-generate-http-ports-file as a tiny script which
simply generates the http ports file and needs to be launched during the
installation of a core update. (The script will no be required
anymore, so it could be deleted afterwards.)

Fixes #12308.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 days agosuricata.yaml: Re-add EVE log section.
Stefan Schantl [Sun, 5 Apr 2020 11:03:24 +0000 (13:03 +0200)] 
suricata.yaml: Re-add EVE log section.

Hopefully the EVE log will display some more content when trying to
debug suricata events and rules.

Fixes #12315.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 days agoids.cgi: Fix logic if suricata needs to be restarted.
Stefan Schantl [Mon, 6 Apr 2020 12:34:21 +0000 (14:34 +0200)] 
ids.cgi: Fix logic if suricata needs to be restarted.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 days agocore143: add backup include and ids-functions
Arne Fitzenreiter [Sun, 5 Apr 2020 07:58:07 +0000 (07:58 +0000)] 
core143: add backup include and ids-functions

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 days agoIDS: Add GREEN and BLUE addresses to the list of DNS servers.
Stefan Schantl [Fri, 3 Apr 2020 14:59:12 +0000 (16:59 +0200)] 
IDS: Add GREEN and BLUE addresses to the list of DNS servers.

Fixes #12349.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 days agoBackup: Add idsrules tarball.
Stefan Schantl [Fri, 3 Apr 2020 10:50:04 +0000 (12:50 +0200)] 
Backup: Add idsrules tarball.

The tarball is required to generate and restore the IDS ruleset.

Fixes #12319.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 days agoBackup: Add suricata rules-settings file.
Stefan Schantl [Fri, 3 Apr 2020 10:50:03 +0000 (12:50 +0200)] 
Backup: Add suricata rules-settings file.

This file contains the configured ruleset and oinkcode settings and
therefore needs to be backuped and restored.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 days agosuricata: increase dns flood trigger
Arne Fitzenreiter [Thu, 2 Apr 2020 16:31:18 +0000 (16:31 +0000)] 
suricata: increase dns flood trigger

on slow lines unbound trigger the floodprotection at init.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 days agopaks: fix meta size entry
Arne Fitzenreiter [Thu, 2 Apr 2020 16:28:39 +0000 (16:28 +0000)] 
paks: fix meta size entry

remove the doublequotes around the size because pakfire not
accept this.

fixes: #12348

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agocore143: stop/start updated services
Arne Fitzenreiter [Wed, 1 Apr 2020 14:59:42 +0000 (14:59 +0000)] 
core143: stop/start updated services

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agocore143: add suricata.yaml
Arne Fitzenreiter [Wed, 1 Apr 2020 14:50:47 +0000 (14:50 +0000)] 
core143: add suricata.yaml

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agoOpenSSL: update to 1.1.1f
Peter Müller [Wed, 1 Apr 2020 12:17:00 +0000 (12:17 +0000)] 
OpenSSL: update to 1.1.1f

Fixes #12345 (yes, that's the real bug ID :-) )

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agoSuricata: Add port 81 (UpdateAccelerator) to group of HTTP ports.
Stefan Schantl [Wed, 1 Apr 2020 09:02:06 +0000 (11:02 +0200)] 
Suricata: Add port 81 (UpdateAccelerator) to group of HTTP ports.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agocore143: add ids.cgi
Arne Fitzenreiter [Wed, 1 Apr 2020 14:42:55 +0000 (14:42 +0000)] 
core143: add ids.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agoids.cgi: Restart suricata if necessary when altering the ruleset.
Stefan Schantl [Wed, 1 Apr 2020 08:32:40 +0000 (10:32 +0200)] 
ids.cgi: Restart suricata if necessary when altering the ruleset.

Suricata does support re-reading it's configuration files and therfore
we need to restart it, if one or more ruleset files should be loaded or
not loaded anymore.

If simple some rules inside the same files are activated or deactivated
we are still fine to call the reload method to send suricata the signal
to reload its ruleset.

Fixes #12340.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agostrongswan: Build sha3 plugin
Michael Tremer [Tue, 31 Mar 2020 09:49:04 +0000 (09:49 +0000)] 
strongswan: Build sha3 plugin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 days agostrongswan: Update to 5.8.4
Michael Tremer [Tue, 31 Mar 2020 09:49:03 +0000 (09:49 +0000)] 
strongswan: Update to 5.8.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 days agocore143: add dma, mail.cgi and vpnmain.cgi
Arne Fitzenreiter [Mon, 30 Mar 2020 19:13:08 +0000 (19:13 +0000)] 
core143: add dma, mail.cgi and vpnmain.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 days agoamazon-ssm-agent: Allow to overcommit memory
Michael Tremer [Mon, 30 Mar 2020 17:24:42 +0000 (17:24 +0000)] 
amazon-ssm-agent: Allow to overcommit memory

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 days agoamazon-ssm-agent: Update to 2.3.930.0
Michael Tremer [Mon, 30 Mar 2020 17:24:41 +0000 (17:24 +0000)] 
amazon-ssm-agent: Update to 2.3.930.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 days agovpnmain.cgi: fix string
Arne Fitzenreiter [Mon, 30 Mar 2020 17:25:08 +0000 (17:25 +0000)] 
vpnmain.cgi: fix string

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 days agoFix accidentially reverted IKE lifetime limit to 24 hours
Michael Tremer [Tue, 10 Mar 2020 13:37:18 +0000 (13:37 +0000)] 
Fix accidentially reverted IKE lifetime limit to 24 hours

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agocore143: apply changed sysctl settings
Arne Fitzenreiter [Mon, 30 Mar 2020 17:09:34 +0000 (17:09 +0000)] 
core143: apply changed sysctl settings

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agosysctl.conf: Turn on hard- and symlink protection
Peter Müller [Thu, 23 Jan 2020 21:28:00 +0000 (21:28 +0000)] 
sysctl.conf: Turn on hard- and symlink protection

Cc: Michael Tremer <michael.tremer@ipfire.org>
Cc: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agoupdate language files for mail.cgi changes
Peter Müller [Mon, 3 Feb 2020 18:35:00 +0000 (18:35 +0000)] 
update language files for mail.cgi changes

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agomail.cgi: add support for implicit TLS usage
Peter Müller [Mon, 3 Feb 2020 18:35:00 +0000 (18:35 +0000)] 
mail.cgi: add support for implicit TLS usage

The second version of this patchset fixes reading empty configuration
files and superseds the first version (duh!).

Fixes #12161

Reported-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Tested-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agodma: update to 0.12
Peter Müller [Sat, 1 Feb 2020 20:26:00 +0000 (20:26 +0000)] 
dma: update to 0.12

All of the dma patches in src/patches/ were merged into its upstream
repository by now, thus becoming obsolete and deleted by this patch.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agocore143: add oinkmaster.conf
Arne Fitzenreiter [Mon, 30 Mar 2020 16:43:50 +0000 (16:43 +0000)] 
core143: add oinkmaster.conf

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agooinkmaster: Do not skip threshold.conf
Stefan Schantl [Thu, 30 Jan 2020 12:58:16 +0000 (13:58 +0100)] 
oinkmaster: Do not skip threshold.conf

Fixes #12096.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agocore143: set user of /var/spool/cron to cron
Arne Fitzenreiter [Mon, 30 Mar 2020 16:39:06 +0000 (16:39 +0000)] 
core143: set user of /var/spool/cron to cron

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agofcron: Fix reloading crontab
Michael Tremer [Wed, 5 Feb 2020 11:23:34 +0000 (11:23 +0000)] 
fcron: Fix reloading crontab

fcrontab -z fails on a freshly installed system since
/var/spool/cron is now owned by cron:cron and a temporary
file cannot be created.

This will have to be manually changed in the updater by
calling:

  chown cron:cron /var/spool/cron

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agospectre-meltdown-checker: update to 0.43
Peter Müller [Sat, 21 Mar 2020 19:40:00 +0000 (19:40 +0000)] 
spectre-meltdown-checker: update to 0.43

Please refer to https://github.com/speed47/spectre-meltdown-checker/releases/tag/v0.43
for release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 days agoOpenVPN: Delete RRD dir if connection is deleted
Erik Kapfer [Sat, 28 Mar 2020 08:32:24 +0000 (09:32 +0100)] 
OpenVPN: Delete RRD dir if connection is deleted

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
11 days agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Sun, 29 Mar 2020 06:35:21 +0000 (06:35 +0000)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

11 days agosmartmontools: update rootfile
Arne Fitzenreiter [Sun, 29 Mar 2020 06:34:18 +0000 (06:34 +0000)] 
smartmontools: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
11 days agobind: Update to 9.11.17
Matthias Fischer [Wed, 25 Mar 2020 11:33:49 +0000 (12:33 +0100)] 
bind: Update to 9.11.17

For details see:
https://downloads.isc.org/isc/bind9/9.11.17/RELEASE-NOTES-bind-9.11.17.html

"Notes for BIND 9.11.17

Feature Changes

The configure option --with-libxml2 now uses pkg-config to detect
libxml2 library availability. You will either have to install pkg-config
or specify the exact path where libxml2 has been installed on your
system. [GL #1635]

Bug Fixes

Fixed re-signing issues with inline zones which resulted in records
being re-signed late or not at all."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
12 days agoRevert "core143: add dhcp"
Arne Fitzenreiter [Sat, 28 Mar 2020 08:42:20 +0000 (09:42 +0100)] 
Revert "core143: add dhcp"

This reverts commit 804deb1b23f24daa35d0cf052d8d0eac82c3319f.

12 days agoRevert "dhcp: Update to 4.4.2"
Arne Fitzenreiter [Sat, 28 Mar 2020 08:40:21 +0000 (09:40 +0100)] 
Revert "dhcp: Update to 4.4.2"

dhcp 4.4.2 internally includes bind 9.11.14
this version not work on arm 32bit.

This reverts commit 417fd66045433d8101c11bea669e14a39af4db13.

13 days agocore143: update local openssh config
Arne Fitzenreiter [Thu, 26 Mar 2020 18:26:07 +0000 (18:26 +0000)] 
core143: update local openssh config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agocore143: add backup.pl
Arne Fitzenreiter [Thu, 26 Mar 2020 18:03:19 +0000 (18:03 +0000)] 
core143: add backup.pl

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agovnstat: remove wrong tag file
Arne Fitzenreiter [Thu, 26 Mar 2020 17:56:23 +0000 (17:56 +0000)] 
vnstat: remove wrong tag file

fixes #12305

I had created this tag file to ship the folder but vnstat doesn't like empty files.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agovnstat: Add restart command.
Markus Untersee [Thu, 30 Jan 2020 12:41:36 +0000 (13:41 +0100)] 
vnstat: Add restart command.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agoovpnmain.cgi: Validate CCDNet name when renaming it.
Stefan Schantl [Tue, 28 Jan 2020 10:51:50 +0000 (11:51 +0100)] 
ovpnmain.cgi: Validate CCDNet name when renaming it.

Fixes #12282

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agocore143: add firewall initskript
Arne Fitzenreiter [Thu, 26 Mar 2020 17:50:26 +0000 (17:50 +0000)] 
core143: add firewall initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agoavoid emitting VPN traffic to the internet if the IPS crashed
Peter Müller [Mon, 27 Jan 2020 15:04:00 +0000 (15:04 +0000)] 
avoid emitting VPN traffic to the internet if the IPS crashed

Due to strange NFQUEUE behaviour, traffic to remote VPN (IPsec or
OpenVPN) destinations was emitted to the internet (ppp0 or red0
interface) directly if the IPS was enabled but crashed during operation.

This patch places the IPSECBLOCK and OVPNBLOCK chains before the
ones responsible for forwarding traffic into the IPS.

Thanks to Michael for his debugging effort.

Partially fixes #12257

Cc: Michael Tremer <michael.tremer@ipfire.org>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agocore143: add libtool
Arne Fitzenreiter [Thu, 26 Mar 2020 17:48:18 +0000 (17:48 +0000)] 
core143: add libtool

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agolibtool: Update 2.4.6
Matthias Fischer [Sat, 25 Jan 2020 19:13:06 +0000 (20:13 +0100)] 
libtool: Update 2.4.6

For details see:
https://savannah.gnu.org/forum/forum.php?forum_id=8210

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agocore143: add dhcp
Arne Fitzenreiter [Thu, 26 Mar 2020 17:46:05 +0000 (17:46 +0000)] 
core143: add dhcp

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agodhcp: Update to 4.4.2
Matthias Fischer [Sat, 25 Jan 2020 19:04:26 +0000 (20:04 +0100)] 
dhcp: Update to 4.4.2

For details see:
https://downloads.isc.org/isc/dhcp/4.4.2/dhcp-4.4.2-RELNOTES

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agocore143: add logwatch
Arne Fitzenreiter [Thu, 26 Mar 2020 17:44:08 +0000 (17:44 +0000)] 
core143: add logwatch

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agologwatch: Update to 7.5.3
Matthias Fischer [Sat, 25 Jan 2020 18:57:24 +0000 (19:57 +0100)] 
logwatch: Update to 7.5.3

For details see:
https://sourceforge.net/p/logwatch/activity/?page=0&limit=100#5e27da933241d23c845e8cce

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agocore143: add openssh
Arne Fitzenreiter [Thu, 26 Mar 2020 17:41:57 +0000 (17:41 +0000)] 
core143: add openssh

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agossh_config: Do not set defaults explicitly
Peter Müller [Mon, 20 Jan 2020 20:05:00 +0000 (20:05 +0000)] 
ssh_config: Do not set defaults explicitly

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agosshd_config: Do not set defaults explicitly
Peter Müller [Mon, 20 Jan 2020 20:04:00 +0000 (20:04 +0000)] 
sshd_config: Do not set defaults explicitly

In order to keep configurations as small as possible and to make them
easier to read/audit, this patch omits all default configuration in the
OpenSSH server configuration file.

Further, it mentions where to refer for the full documentation.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agoOpenSSH: update to 8.2p1
Peter Müller [Sat, 21 Mar 2020 20:08:00 +0000 (20:08 +0000)] 
OpenSSH: update to 8.2p1

Please refer to https://www.openssh.com/txt/release-8.2 for release
announcements. Since glibc < 2.31 is used, no additional patching was
required in order to restore correct login functionality.

Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 days agosmartmontools: update rootfile
Arne Fitzenreiter [Thu, 26 Mar 2020 17:38:32 +0000 (17:38 +0000)] 
smartmontools: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add localnet initscript
Arne Fitzenreiter [Thu, 26 Mar 2020 10:09:14 +0000 (10:09 +0000)] 
core143: add localnet initscript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoresolv.conf: Add "trust-ad" option
Michael Tremer [Wed, 5 Feb 2020 11:45:47 +0000 (11:45 +0000)] 
resolv.conf: Add "trust-ad" option

Since we are running unbound locally which always runs DNSSEC
validation, we can simply trust it and pass the ad flag on to
applications which make use of it.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: netother.cgi
Arne Fitzenreiter [Thu, 26 Mar 2020 10:04:15 +0000 (10:04 +0000)] 
core143: netother.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agonetother.cgi: show content of routing table 220
Peter Müller [Sat, 21 Mar 2020 16:03:00 +0000 (16:03 +0000)] 
netother.cgi: show content of routing table 220

Since IPsec routing information do not show up in the normal routing
table, also displaying the contents of table 220 on netother.cgi might
be useful for debugging purposes.

The second version of this patch omits the output if routing table 220
is empty and introduces a custom translation for IPsec routing table
entries instead of just adding the table number to the generic translation.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add smartmontools
Arne Fitzenreiter [Thu, 26 Mar 2020 10:00:20 +0000 (10:00 +0000)] 
core143: add smartmontools

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agosmartmontools: update to 7.1
Peter Müller [Sat, 21 Mar 2020 19:59:00 +0000 (19:59 +0000)] 
smartmontools: update to 7.1

Summary: smartmontools release 7.1
-----------------------------------------------------------
- smartctl: Fixed bogus exception on unknown form factor value (regression).
- smartctl '--json=cg': Suppresses extra spaces also in 'g' format.
- smartctl '-i': ATA ACS-4 and ACS-5 enhancements.
- smartd: No longer truncates very long device names in warning emails.
- smartd: No longer skips scheduled tests if system clock has been adjusted
  to the past.
- smartd '-A': Attribute logs now use local time instead of UTC.
- ATA: Device type '-d jmb39x,N' for drives behind JMicron JMB39x RAID port
  multipliers.
- SCSI: Workaround for incomplete Log subpages response from some SAS SSDs.
- HDD, SSD and USB additions to drive database.
- Autodetection of '-d sntjmicron' type for JMicron USB to NVMe bridges.
- configure: Defines '_FORTIFY_SOURCE=2' if supported and not defined.
- Linux/FreeBSD: Fixed segfault on CCISS transfer sizes > 512 bytes.
- Linux: Fixed smartd.service 'Type' if libsystemd-dev is not available.
- Linux: Fixed '/dev/megaraid_sas_ioctl_node' fd leak.
- Linux: Fixed GPL licensing problem of 'linux_nvme_ioctl.h'.
- FreeBSD update-smart-drivedb: Now uses 'fetch' as default download tool.
- FreeBSD big endian: Fixed NVMe access.
- FreeBSD: Compile fix for FreeBSD 12.
- NetBSD: Fixed device scan crash on empty name list.
- NetBSD: Fixed memory leak in device scan.
- Windows: Fixed log page access via Windows 10 NVMe driver for NVMe 1.2.1+.
- Windows: Allow drive letters as device names for Windows 10 NVMe driver.
- Windows: Workround to allow CSMI access to devices behind AMD RAID drivers.
- Windows: Fixed MinGW options to add relocation info if ASLR is enabled.
- Windows wtssendmsg: No longer writes '\n' line endings to event log.
- Windows wtssendmsg: New options '-t' and '-w'.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add ovpnmain.cgi
Arne Fitzenreiter [Thu, 26 Mar 2020 09:45:17 +0000 (09:45 +0000)] 
core143: add ovpnmain.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoOpenVPN: Stop N2N connection before remove.
Erik Kapfer [Tue, 24 Mar 2020 10:29:05 +0000 (11:29 +0100)] 
OpenVPN: Stop N2N connection before remove.

Fix #12334

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocollectd: run sensors-detect in background
Arne Fitzenreiter [Wed, 25 Mar 2020 06:35:38 +0000 (07:35 +0100)] 
collectd: run sensors-detect in background

on some machines the i2c sensor search take very long time
which cause hang at first boot.

Now the search is started in background and waited for max one
minute before continue load of collectd.
On such machines collectd will not get all sensors at first startup.

fixes #12329

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoncurses: Update to 6.2
Matthias Fischer [Wed, 25 Mar 2020 11:38:02 +0000 (12:38 +0100)] 
ncurses: Update to 6.2

For details see:
https://invisible-island.net/ncurses/announce.html#h2-release-notes

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agonano: Update to 4.9
Matthias Fischer [Wed, 25 Mar 2020 11:51:07 +0000 (12:51 +0100)] 
nano: Update to 4.9

For details see:
https://www.nano-editor.org/news.php

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoconsort.sh: Shebang-Typo
Matthias Fischer [Wed, 25 Mar 2020 11:54:20 +0000 (12:54 +0100)] 
consort.sh: Shebang-Typo

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agopixman: fix build on arm
Arne Fitzenreiter [Thu, 26 Mar 2020 06:02:41 +0000 (06:02 +0000)] 
pixman: fix build on arm

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add xz
Arne Fitzenreiter [Tue, 24 Mar 2020 08:59:58 +0000 (08:59 +0000)] 
core143: add xz

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agomake.sh: bump toolchain version
Arne Fitzenreiter [Tue, 24 Mar 2020 08:59:11 +0000 (08:59 +0000)] 
make.sh: bump toolchain version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore-updates: Ensure we have no temporary data in the package
Michael Tremer [Mon, 23 Mar 2020 19:34:59 +0000 (19:34 +0000)] 
core-updates: Ensure we have no temporary data in the package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoConfig: Refactor mastering packages
Michael Tremer [Mon, 23 Mar 2020 19:34:58 +0000 (19:34 +0000)] 
Config: Refactor mastering packages

Those are now created in their own temporary directory, so that
no other files can be included by accident.

We also package with fewer temporary files.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agolfs: Drop quotes in DEPS variable
Michael Tremer [Mon, 23 Mar 2020 19:34:57 +0000 (19:34 +0000)] 
lfs: Drop quotes in DEPS variable

Not sure why this has ever been there. This simply makes it
nicer to read and edit because we can have line-breaks now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocdrom: Cleanup everything after mastering
Michael Tremer [Mon, 23 Mar 2020 19:34:56 +0000 (19:34 +0000)] 
cdrom: Cleanup everything after mastering

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoxz: update to 5.2.5
Marcel Lorenz [Thu, 19 Mar 2020 20:20:49 +0000 (21:20 +0100)] 
xz: update to 5.2.5

2 weeks agocore143: add coreutils
Arne Fitzenreiter [Mon, 23 Mar 2020 18:33:39 +0000 (18:33 +0000)] 
core143: add coreutils

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocoreutils: update rootfiles
Peter Müller [Mon, 3 Feb 2020 17:39:00 +0000 (17:39 +0000)] 
coreutils: update rootfiles

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocoreutils: update to 8.31
Peter Müller [Mon, 3 Feb 2020 17:39:00 +0000 (17:39 +0000)] 
coreutils: update to 8.31

Refer to https://lists.gnu.org/archive/html/coreutils-announce/2019-03/msg00000.html
for release announcements.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add glibc
Arne Fitzenreiter [Sun, 22 Mar 2020 19:10:46 +0000 (19:10 +0000)] 
core143: add glibc

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agovdr: fix build with glibc 2.31
Arne Fitzenreiter [Sun, 22 Mar 2020 19:04:14 +0000 (19:04 +0000)] 
vdr: fix build with glibc 2.31

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoglibc: Update to 2.31
Michael Tremer [Wed, 5 Feb 2020 11:45:46 +0000 (11:45 +0000)] 
glibc: Update to 2.31

Fixes: #12288
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoqemu: Fix build against glibc >= 2.31
Michael Tremer [Wed, 5 Feb 2020 11:45:45 +0000 (11:45 +0000)] 
qemu: Fix build against glibc >= 2.31

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add hwdata
Arne Fitzenreiter [Sat, 21 Mar 2020 16:30:15 +0000 (16:30 +0000)] 
core143: add hwdata

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agohwdata: update PCI/USB databases
Peter Müller [Wed, 19 Feb 2020 19:58:00 +0000 (19:58 +0000)] 
hwdata: update PCI/USB databases

PCI IDs: 2020-02-16 03:15:02
USB IDs: 2020-01-09 20:34:06

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add strongswan
Arne Fitzenreiter [Sat, 21 Mar 2020 16:28:04 +0000 (16:28 +0000)] 
core143: add strongswan

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agostrongSwan: update to 5.8.2
Peter Müller [Wed, 19 Feb 2020 21:48:00 +0000 (21:48 +0000)] 
strongSwan: update to 5.8.2

Please refer to https://wiki.strongswan.org/versions/75 for release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore143: add rules.pl
Arne Fitzenreiter [Sat, 21 Mar 2020 16:26:38 +0000 (16:26 +0000)] 
core143: add rules.pl

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>