ipfire-2.x.git
2 days agode.pl: fix misleading translation master
Peter Müller [Sat, 2 May 2020 09:52:25 +0000 (11:52 +0200)] 
de.pl: fix misleading translation

The 'geoip' key is being used in the firewall.cgi for configuring GeoIP
as a source or destination. "konfigurieren" is misleading in this
context.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 days agolibloc: fix i586 perl module
Arne Fitzenreiter [Mon, 3 Aug 2020 17:52:38 +0000 (19:52 +0200)] 
libloc: fix i586 perl module

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agolibloc: Only update database once a week
Stefan Schantl [Wed, 29 Jul 2020 16:57:43 +0000 (18:57 +0200)] 
libloc: Only update database once a week

Ensure to download and update the database only once a week, even the
script will be called by cron each hour.

Fixes #12462.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agostage2: fix rootfile 2nd try
Arne Fitzenreiter [Wed, 29 Jul 2020 13:42:28 +0000 (13:42 +0000)] 
stage2: fix rootfile 2nd try

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agostage2: fix aarch64 rootfile
Arne Fitzenreiter [Wed, 29 Jul 2020 10:33:36 +0000 (10:33 +0000)] 
stage2: fix aarch64 rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agostage2: update x86_64 rootfile
Arne Fitzenreiter [Wed, 29 Jul 2020 10:28:21 +0000 (10:28 +0000)] 
stage2: update x86_64 rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore148: add network-functions.pl
Arne Fitzenreiter [Tue, 28 Jul 2020 18:38:40 +0000 (18:38 +0000)] 
core148: add network-functions.pl

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agonetwork-functions.pl: add missing unit tests for changed, network membership procedure
Peter Müller [Sat, 25 Jul 2020 19:08:37 +0000 (19:08 +0000)] 
network-functions.pl: add missing unit tests for changed, network membership procedure

Cc: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Cc: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agonetwork-functions.pl: fix network membership test
Peter Müller [Sat, 25 Jul 2020 19:08:07 +0000 (19:08 +0000)] 
network-functions.pl: fix network membership test

This is based on an orphaned patch provided by Tim FitzGeorge and
_finally_ fixes incorrect network membership calculations. Those were
are usability pain in the ass deluxe, as they rendered some combinations
of configuring OpenVPN and IPsec services unusable.

Fixes: #11235
Fixes: #12263

Cc: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Cc: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agobacula: Correction to 9.6.5
Adolf Belka [Tue, 28 Jul 2020 18:17:43 +0000 (18:17 +0000)] 
bacula: Correction to 9.6.5

- Corrected Download URL to remove filename from the end of it. This is defined separately.
- Corrected to include install command for backup file which was missed in previous patch.
- Added backup file to rootfiles list.
Signed-off-by: Adolf Belka<ahb.ipfire@gmail.com>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore148: add networking/any initskript
Arne Fitzenreiter [Tue, 28 Jul 2020 18:34:31 +0000 (18:34 +0000)] 
core148: add networking/any initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agonetwork: Fix typo for MTU value
Michael Tremer [Tue, 28 Jul 2020 18:04:46 +0000 (18:04 +0000)] 
network: Fix typo for MTU value

Reported here:

  https://community.ipfire.org/t/strange-etc-init-d-networking-any-for-blue/2831

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agolocation: Restart IPsec after firewall was restarted
Michael Tremer [Tue, 28 Jul 2020 17:18:18 +0000 (17:18 +0000)] 
location: Restart IPsec after firewall was restarted

strongswan creates rules in iptables which are being dropped when
the firewall is being restarted.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore148: Do not update the location database straight away
Michael Tremer [Tue, 28 Jul 2020 17:18:19 +0000 (17:18 +0000)] 
core148: Do not update the location database straight away

This process takes a long time and stalls the update process.

Since the cronjob is being called once an hour, all systems will
very quickly pull a recent database which will then be extracted
in the background not disrupting the Core Update process.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agoFix typo in german translation
Matthias Fischer [Mon, 27 Jul 2020 15:50:50 +0000 (17:50 +0200)] 
Fix typo in german translation

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agomc: Update to 4.8.25
Matthias Fischer [Sat, 25 Jul 2020 18:19:20 +0000 (20:19 +0200)] 
mc: Update to 4.8.25

For details see:
http://midnight-commander.org/wiki/NEWS-4.8.25

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agolibloc: Apply -fstack-protector only on i586
Michael Tremer [Tue, 21 Jul 2020 12:48:55 +0000 (12:48 +0000)] 
libloc: Apply -fstack-protector only on i586

All other architectures build fine and we do not need to
weaken the Perl module unnecessarily.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agofr: Update French translation
Stéphane Pautrel [Mon, 27 Jul 2020 18:09:27 +0000 (18:09 +0000)] 
fr: Update French translation

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 weeks agocore148: Update crontab with recent changes
Arne Fitzenreiter [Mon, 27 Jul 2020 18:05:06 +0000 (18:05 +0000)] 
core148: Update crontab with recent changes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 weeks agolibloc: use regular stack-protector on i586
Arne Fitzenreiter [Wed, 22 Jul 2020 18:46:13 +0000 (20:46 +0200)] 
libloc: use regular stack-protector on i586

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 weeks agostage2: update aarch64 rootfile
Arne Fitzenreiter [Tue, 21 Jul 2020 17:41:39 +0000 (19:41 +0200)] 
stage2: update aarch64 rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 weeks agolibloc: Add upstream patch to fix a buffer issue.
Stefan Schantl [Sun, 19 Jul 2020 18:21:41 +0000 (20:21 +0200)] 
libloc: Add upstream patch to fix a buffer issue.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 weeks agolibloc: Apply patch to compile the perl module without stack protector.
Stefan Schantl [Sun, 19 Jul 2020 09:22:52 +0000 (11:22 +0200)] 
libloc: Apply patch to compile the perl module without stack protector.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 weeks agoconvert-to-location: Regenerate firewall chains.
Stefan Schantl [Sat, 11 Jul 2020 10:11:02 +0000 (12:11 +0200)] 
convert-to-location: Regenerate firewall chains.

The firewall chain for location based rules has been renamed to
LOCATIONBLOCK and therefore the fiewall needs to be restarted and
the chains regenerated.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 weeks agoconvert-to-location: Fix double patch declaration
Stefan Schantl [Sat, 11 Jul 2020 10:11:01 +0000 (12:11 +0200)] 
convert-to-location: Fix double patch declaration

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 weeks agolibloc: Update to 0.9.3
Stefan Schantl [Fri, 10 Jul 2020 15:42:34 +0000 (17:42 +0200)] 
libloc: Update to 0.9.3

* Also bump the shipped database to 2020-07-10 for a more recent version

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
4 weeks agocore148: add libloc changes
Arne Fitzenreiter [Fri, 10 Jul 2020 20:07:56 +0000 (22:07 +0200)] 
core148: add libloc changes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
5 weeks agoipinfo.cgi: Fix calling get_continent_code().
Stefan Schantl [Wed, 8 Jul 2020 17:28:36 +0000 (19:28 +0200)] 
ipinfo.cgi: Fix calling get_continent_code().

This function is provided by the Location perl module and directly can
be called.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
5 weeks ago:xMerge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-switch...
Stefan Schantl [Fri, 3 Jul 2020 16:48:30 +0000 (18:48 +0200)] 
:xMerge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-switch-to-libloc

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
6 weeks agoupdate credits.cgi and langs doku v2.25-core147
Arne Fitzenreiter [Thu, 2 Jul 2020 11:22:17 +0000 (11:22 +0000)] 
update credits.cgi and langs doku

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - shutdown function removed, adjustments to IPsec status display
Stephan Feddersen [Sun, 28 Jun 2020 10:48:59 +0000 (12:48 +0200)] 
WIO - shutdown function removed, adjustments to IPsec status display

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - shutdown function removed, adjustments to IPsec status display
Stephan Feddersen [Sun, 28 Jun 2020 10:47:54 +0000 (12:47 +0200)] 
WIO - shutdown function removed, adjustments to IPsec status display

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - shutdown function removed, adjustments to IPsec status display
Stephan Feddersen [Sun, 28 Jun 2020 10:47:01 +0000 (12:47 +0200)] 
WIO - shutdown function removed, adjustments to IPsec status display

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - hutdown function removed, adjustments to IPsec status display
Stephan Feddersen [Sun, 28 Jun 2020 10:45:41 +0000 (12:45 +0200)] 
WIO - hutdown function removed, adjustments to IPsec status display

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - shutdown function removed, adjustments to IPsec status display
Stephan Feddersen [Sun, 28 Jun 2020 10:44:18 +0000 (12:44 +0200)] 
WIO - shutdown function removed, adjustments to IPsec status display

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - shutdown function removed, adjustments to IPsec status display
Stephan Feddersen [Sun, 28 Jun 2020 10:41:55 +0000 (12:41 +0200)] 
WIO - shutdown function removed, adjustments to IPsec status display

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - cleaned up language files
Stephan Feddersen [Sun, 28 Jun 2020 10:34:18 +0000 (12:34 +0200)] 
WIO - cleaned up language files

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoWIO - new version 1.3.2-9
Stephan Feddersen [Sun, 28 Jun 2020 10:29:26 +0000 (12:29 +0200)] 
WIO - new version 1.3.2-9

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoremove nf_log_ipv4 from sysctl.conf
Arne Fitzenreiter [Wed, 1 Jul 2020 12:17:11 +0000 (12:17 +0000)] 
remove nf_log_ipv4 from sysctl.conf

the revert commit has failed and sysctl.conf should still shipped to fix
machines in next tree.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agofirewall: Configure TRACE target to log to syslog
Michael Tremer [Mon, 29 Jun 2020 14:53:17 +0000 (14:53 +0000)] 
firewall: Configure TRACE target to log to syslog

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agocore147: add ntp
Arne Fitzenreiter [Wed, 1 Jul 2020 12:11:51 +0000 (12:11 +0000)] 
core147: add ntp

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agontp: Update to 4.2.8p15
Matthias Fischer [Sun, 28 Jun 2020 07:01:33 +0000 (09:01 +0200)] 
ntp: Update to 4.2.8p15

For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agocore147: add proxy.cgi
Arne Fitzenreiter [Wed, 1 Jul 2020 12:09:45 +0000 (12:09 +0000)] 
core147: add proxy.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoRevert "proxy: Remove AUTH_IPCACHE_TTL"
Peter Müller [Sun, 21 Jun 2020 10:57:29 +0000 (10:57 +0000)] 
Revert "proxy: Remove AUTH_IPCACHE_TTL"

This reverts commit dc637f087fe07ab26ae1dee00133da69bab5e6a1.

Rationale: "authenticate_ip_ttl" can be safely used as it does not
introduces an authentication bypass, but saves relationships between
successfully authenticated users and their IP addresses.

"max_user_ip" depends on such an authentication cache, so credential
sharing between several IPs (on purpose or by chance) can be detected
properly. This is useful in case of crompromised machines and/or
attackers in internal networks having stolen proxy authentication
credentials.

Quoted from squid.conf.documented or man 5 squid.conf:

>       acl aclname max_user_ip [-s] number
>         # This will be matched when the user attempts to log in from more
>         # than <number> different ip addresses. The authenticate_ip_ttl
>         # parameter controls the timeout on the ip entries. [fast]
>         # If -s is specified the limit is strict, denying browsing
>         # from any further IP addresses until the ttl has expired. Without
>         # -s Squid will just annoy the user by "randomly" denying requests.
>         # (the counter is reset each time the limit is reached and a
>         # request is denied)
>         # NOTE: in acceleration mode or where there is mesh of child proxies,
>         # clients may appear to come from multiple addresses if they are
>         # going through proxy farms, so a limit of 1 may cause user problems.

Fixes: #11994

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoproxy.cgi: remove old CVS licence clutter
Peter Müller [Sun, 21 Jun 2020 10:57:00 +0000 (10:57 +0000)] 
proxy.cgi: remove old CVS licence clutter

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agocore147: add openssh
Arne Fitzenreiter [Sat, 27 Jun 2020 14:34:22 +0000 (14:34 +0000)] 
core147: add openssh

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoOpenSSH: update to 8.3p1
Peter Müller [Mon, 22 Jun 2020 15:39:33 +0000 (15:39 +0000)] 
OpenSSH: update to 8.3p1

Fixes: #12418

Cc: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agocore147: add ca-certificates
Arne Fitzenreiter [Sat, 27 Jun 2020 14:28:18 +0000 (14:28 +0000)] 
core147: add ca-certificates

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoupdate ca-certificates CA bundle
Peter Müller [Sat, 20 Jun 2020 09:37:22 +0000 (09:37 +0000)] 
update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agocore147: add bind
Arne Fitzenreiter [Sat, 27 Jun 2020 14:24:44 +0000 (14:24 +0000)] 
core147: add bind

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agobind: Update to 9.11.20
Matthias Fischer [Fri, 19 Jun 2020 17:18:21 +0000 (19:18 +0200)] 
bind: Update to 9.11.20

For details see:
https://downloads.isc.org/isc/bind9/9.11.20/RELEASE-NOTES-bind-9.11.20.html

"Security Fixes

    It was possible to trigger an INSIST failure when a zone with
    an interior wildcard label was queried in a certain pattern. This
    was disclosed in CVE-2020-8619. [GL #1111] [GL #1718]

New Features

    dig and other tools can now print the Extended DNS Error (EDE)
    option when it appears in a request or a response. [GL #1835]

Bug Fixes

    When fully updating the NSEC3 chain for a large zone via IXFR,
    a temporary loss of performance could be experienced on the
    secondary server when answering queries for nonexistent data that
    required DNSSEC proof of non-existence (in other words, queries that
    required the server to find and to return NSEC3 data). The
    unnecessary processing step that was causing this delay has now been
    removed. [GL #1834]

    A data race in lib/dns/resolver.c:log_formerr() that could lead
    to an assertion failure was fixed. [GL #1808]

    Previously, provide-ixfr no; failed to return up-to-date responses
    when the serial number was greater than or equal to the current
    serial number. [GL #1714]

    named-checkconf -p could include spurious text in server-addresses
    statements due to an uninitialized DSCP value. This has been fixed.
    [GL #1812]

    The ARM has been updated to indicate that the TSIG session key is
    generated when named starts, regardless of whether it is needed. [GL
    #1842]"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agoinstaller: update filecount
Arne Fitzenreiter [Sat, 27 Jun 2020 10:27:10 +0000 (12:27 +0200)] 
installer: update filecount

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 weeks agogmp: update arm rootfiles
Arne Fitzenreiter [Sat, 27 Jun 2020 05:47:43 +0000 (07:47 +0200)] 
gmp: update arm rootfiles

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 weeks agolinux-firmware: update to 20200519
Arne Fitzenreiter [Sat, 20 Jun 2020 06:55:06 +0000 (08:55 +0200)] 
linux-firmware: update to 20200519

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 weeks agoremove old core146 openvpn symlink that break build.
Arne Fitzenreiter [Sat, 20 Jun 2020 06:53:31 +0000 (08:53 +0200)] 
remove old core146 openvpn symlink that break build.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 weeks agocore174: Ship updated files from gcloud branch
Michael Tremer [Fri, 19 Jun 2020 12:44:14 +0000 (12:44 +0000)] 
core174: Ship updated files from gcloud branch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agobacula: Update to 9.6.5
Adolf Belka [Tue, 16 Jun 2020 18:43:52 +0000 (20:43 +0200)] 
bacula: Update to 9.6.5

- Update bacula from version 9.0.6 to 9.6.5
  Version 9.0.6 is over two and a half years old.
- Update config options in lfs to include bacula recommended smartalloc option.
  "This enables the inclusion of the Smartalloc orphaned buffer detection
  code. This option is highly recommended. Because we never build without this option,
  you may experience problems if it is not enabled. In this case, simply re-enable the
  option. We strongly recommend keeping this option enabled as it helps detect memory
  leaks. This configuration parameter is used while building Bacula"
- Add install, uninstall and update files in src/paks/bacula
- Updated backup/includes to backup the config file and the File Daemon state file.

Signed-off-by: Adolf Belka <ahb.ipfire@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agocore147: Ship dhcpcd
Michael Tremer [Thu, 18 Jun 2020 10:39:03 +0000 (10:39 +0000)] 
core147: Ship dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agodhcpcd: Update to 9.1.2
Matthias Fischer [Tue, 16 Jun 2020 17:48:35 +0000 (19:48 +0200)] 
dhcpcd: Update to 9.1.2

For details see:
https://roy.marples.name/blog/dhcpcd-9-1-2-released.html

    "Fix installing dhcpcd-definitions.conf rather than embedding it
    NetBSD: free ARP state once IPv4LL address announced
    Linux: fix compile for older distros
    udev: disable plugin for non Linux OS's
    BSD: Mark RA dervied addresses as AUTOCONF on NetBSD-current
    BSD: Only mark static routes from dhcpcd.conf as static
    DHCP6: Ensure requested addresses are requested
    DHCP6: Fix prefix length calculation when no prefix specified
    privsep: Implement a resource limited sandbox [1]
    privsep: Remove inet and dns pledges from master process
    privsep: call getifaddrs when the BSD lacks SIOCGIFALIAS
    privsep: free getifaddrs the right way if from privsep or not

[1] You will see a control proxy process now. This is for the resource
limited sandbox so that we can isolate requests over the control socket.
For NetBSD, FreeBSD and derivatives such as DragonFlyBSD this is
a massive win as these OS now enjoy a similar level of protection
as Capsicum or Pledge, but without the syscall filtering."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agosysctl: Load nf_log_ipv4 as default logging module for TRACE target
Michael Tremer [Tue, 16 Jun 2020 15:42:33 +0000 (15:42 +0000)] 
sysctl: Load nf_log_ipv4 as default logging module for TRACE target

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agofirewall: Always enable connection tracking for GRE
Michael Tremer [Tue, 16 Jun 2020 15:40:44 +0000 (15:40 +0000)] 
firewall: Always enable connection tracking for GRE

If this module is not being loaded, the kernel will mark any
GRE connection as INVALID in connection tracking, which will
be then silently dropped by a firewall rule.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agosquidGuard: Update to 1.6.0
Michael Tremer [Tue, 16 Jun 2020 15:40:20 +0000 (15:40 +0000)] 
squidGuard: Update to 1.6.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agosquidGuard: Update to 1.6.0
Michael Tremer [Tue, 16 Jun 2020 10:35:26 +0000 (10:35 +0000)] 
squidGuard: Update to 1.6.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agocore147: Ship squidguard
Michael Tremer [Tue, 16 Jun 2020 09:01:24 +0000 (09:01 +0000)] 
core147: Ship squidguard

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agosquidguard: Update to 1.5-beta
Matthias Fischer [Sat, 31 Dec 2016 15:59:19 +0000 (16:59 +0100)] 
squidguard: Update to 1.5-beta

Changelog:

"Release 1.5

2010-09-09 Fixed inconsistent blocking (bug 59).  Replaced defined routine
in sgDB.c

2010-09-08 Added Russian translation from Vladimir Ipatov to squidGuard.cgi.in.

2009-10-19 Fixed two bypass problems with URLs which length is close to the limit
defined by MAX_BUF. The resulting proxy line exceeds this limit and causes
either squid or squidGuard to properly block a site.

2009-10-15 Fixed a problem with very long URLs. SquidGuard will go into
emergency mode when a overlong URLs are encountered. The emergency mode causes an
entire stop of blocking. This is not appropriate in this situation.

2009-09-30 Added patch by beber and gentoo (thank you!) to fix a problem when cross
compiling (bug 56).

2009-09-27 Added patch by gentoo to fix alocal warnings (bug 57).

2009-09-15 Added a feature to send log messages to syslog based on the patch from
Jun Jiang (thank you). (bug 42) In order to use syslog you have to run
configure with the new option "--with-syslog". In the configuration file you need to add a
line "syslog enable". If any other value but "enable" is used syslog is disabled and logging
to squidGuard.log takes place as usual. The following log level are used: DEBUG, NOTICE,
WARN, ERROR and EMERG. The local4 syslog facility is used by default. If you want to change
this, use the configure option "--with-syslog-facility=<facility>".

2009-09-12 Anonymized passwords (for connecting to the ldap or mysql server) written
to logfiles when squidGuard is starting. Added two configure options for choosing
different location for the LDAP include and library files.

2009-08-25 Added patch to check IP addresses against LDAP. Patch by Denis Bonnenfant
(bug 41) - thank you.

2009-08-23 Added patch to allow quoted strings in the configuration file (bug 53).
For more information see README.QuotedStrings. Thanks to Iain Fothergill for providing
the patch. Removed the fix for usernames starting with a number because it breaks the
time declarations.

2009-05-08 Added patch by INL to enable blocking against DNS based blacklists (bug 55).
Fixed re-opened bug 12: a problem with regular expressions. An entry like "www\.google\.de"
did not block www.google.de which it was supposed to do.
Solving this issue solved bug 46 as well.

2009-03-08 Fixed bug 52: Sometimes squidGuard crashes with an overflow
error message for vsprintf. Thanks to Dirk Schoebel for suggesting the proper fix.
Fixed bug 49: Using numeric username made squidGuard goes into emergency mode. This
has been fixed. Usernames can now start with a number, be numeric and can additionally
contain the following characters: @,à,é,è,ñ,á,ì,í,ò,ó,ù,ú."

Signed-off-by: Matthias Fischer <matthias.fischer at ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agostrace: This package now links against elfutils
Michael Tremer [Wed, 10 Jun 2020 08:19:51 +0000 (08:19 +0000)] 
strace: This package now links against elfutils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agocore147: Ship iproute2
Michael Tremer [Tue, 16 Jun 2020 08:49:36 +0000 (08:49 +0000)] 
core147: Ship iproute2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agoiproute2: Update to 5.7.0
Matthias Fischer [Sun, 14 Jun 2020 06:50:13 +0000 (08:50 +0200)] 
iproute2: Update to 5.7.0

For details see:
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/?h=v5.7.0

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agojoe: Update to 4.6
Matthias Fischer [Sat, 13 Jun 2020 22:13:30 +0000 (00:13 +0200)] 
joe: Update to 4.6

For details see:
https://joe-editor.sourceforge.io/NEWS.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agocore147: Ship updated crypto libraries
Michael Tremer [Tue, 16 Jun 2020 08:46:51 +0000 (08:46 +0000)] 
core147: Ship updated crypto libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogmp 6.2.0: Fixed rootfile for i586
Matthias Fischer [Thu, 11 Jun 2020 17:20:08 +0000 (19:20 +0200)] 
gmp 6.2.0: Fixed rootfile for i586

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agolibgpg-error: Update to 1.38
Matthias Fischer [Thu, 11 Jun 2020 16:07:29 +0000 (18:07 +0200)] 
libgpg-error: Update to 1.38

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agolibassuan: Update to 2.5.3
Matthias Fischer [Thu, 11 Jun 2020 16:06:27 +0000 (18:06 +0200)] 
libassuan: Update to 2.5.3

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agolibgcrypt: Update to 1.8.5
Matthias Fischer [Thu, 11 Jun 2020 16:05:05 +0000 (18:05 +0200)] 
libgcrypt: Update to 1.8.5

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogmp 6.2.0: Fixed lfs for i586
Matthias Fischer [Thu, 11 Jun 2020 10:02:45 +0000 (12:02 +0200)] 
gmp 6.2.0: Fixed lfs for i586

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogmp: Update to 6.2.0
Matthias Fischer [Wed, 10 Jun 2020 22:08:13 +0000 (00:08 +0200)] 
gmp: Update to 6.2.0

Needed for gnutls 3.6.14

For details see:
https://gmplib.org/gmp6.2

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agognutls: Update to 3.6.14
Matthias Fischer [Wed, 10 Jun 2020 22:08:12 +0000 (00:08 +0200)] 
gnutls: Update to 3.6.14

For details see:
https://lists.gnupg.org/pipermail/gnutls-help/2020-June/004648.html

"** libgnutls: Fixed insecure session ticket key construction, since 3.6.4.
   The TLS server would not bind the session ticket encryption key with a
   value supplied by the application until the initial key rotation, allowing
   attacker to bypass authentication in TLS 1.3 and recover previous
   conversations in TLS 1.2 (#1011).
   [GNUTLS-SA-2020-06-03, CVSS: high]

** libgnutls: Fixed handling of certificate chain with cross-signed
   intermediate CA certificates (#1008).

** libgnutls: Fixed reception of empty session ticket under TLS 1.2 (#997).

** libgnutls: gnutls_x509_crt_print() is enhanced to recognizes commonName
   (2.5.4.3), decodes certificate policy OIDs (!1245), and prints Authority
   Key Identifier (AKI) properly (#989, #991).

** certtool: PKCS #7 attributes are now printed with symbolic names (!1246).

** libgnutls: Added several improvements on Windows Vista and later releases
   (!1257, !1254, !1256). Most notably the system random number generator now
   uses Windows BCrypt* API if available (!1255).

** libgnutls: Use accelerated AES-XTS implementation if possible (!1244).
   Also both accelerated and non-accelerated implementations check key block
   according to FIPS-140-2 IG A.9 (!1233).

** libgnutls: Added support for AES-SIV ciphers (#463).

** libgnutls: Added support for 192-bit AES-GCM cipher (!1267).

** libgnutls: No longer use internal symbols exported from Nettle (!1235)

** API and ABI modifications:
GNUTLS_CIPHER_AES_128_SIV: Added
GNUTLS_CIPHER_AES_256_SIV: Added
GNUTLS_CIPHER_AES_192_GCM: Added
gnutls_pkcs7_print_signature_info: Added"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agoborgbackup: Update to 1.1.13
Matthias Fischer [Wed, 10 Jun 2020 21:51:21 +0000 (23:51 +0200)] 
borgbackup: Update to 1.1.13

For details see:
https://borgbackup.readthedocs.io/en/stable/changes.html#changelog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agohaproxy: Update to 2.1.7
Matthias Fischer [Wed, 10 Jun 2020 21:46:15 +0000 (23:46 +0200)] 
haproxy: Update to 2.1.7

For details see:
http://www.haproxy.org/download/2.1/src/CHANGELOG

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agocore147: Ship squid
Michael Tremer [Tue, 16 Jun 2020 08:37:48 +0000 (08:37 +0000)] 
core147: Ship squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agosquid: Update to 4.12
Matthias Fischer [Wed, 10 Jun 2020 21:38:52 +0000 (23:38 +0200)] 
squid: Update to 4.12

For details see:
http://www.squid-cache.org/Versions/v4/changesets/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agoStart Core Update 147
Michael Tremer [Tue, 16 Jun 2020 08:35:09 +0000 (08:35 +0000)] 
Start Core Update 147

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agonetworking: Set configured MTU to all network zones
Michael Tremer [Mon, 15 Jun 2020 15:32:41 +0000 (15:32 +0000)] 
networking: Set configured MTU to all network zones

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogcp: Google Cloud only supports an MTU of 1460
Michael Tremer [Mon, 15 Jun 2020 15:22:00 +0000 (15:22 +0000)] 
gcp: Google Cloud only supports an MTU of 1460

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agoaws: Configure MTU to maximum of 9001 on GREEN/ORANGE
Michael Tremer [Mon, 15 Jun 2020 15:20:49 +0000 (15:20 +0000)] 
aws: Configure MTU to maximum of 9001 on GREEN/ORANGE

AWS supports jumbo-frames which IPFire can take advantage of
to increase network throughput internally.

The MTU for RED was left as 1500 to avoid packet fragmentation
in the cloud network and have IPFire do that job.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agoweb: Hide certain menu items when running in cloud environments
Michael Tremer [Mon, 15 Jun 2020 15:07:35 +0000 (15:07 +0000)] 
web: Hide certain menu items when running in cloud environments

This used to be only hidden on AWS.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogcloud: Add function to detect whether we are running on GCP
Michael Tremer [Mon, 15 Jun 2020 15:07:15 +0000 (15:07 +0000)] 
gcloud: Add function to detect whether we are running on GCP

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agoaws-functions.pl: Drop file and move functions to general-functions.pl
Michael Tremer [Mon, 15 Jun 2020 15:01:42 +0000 (15:01 +0000)] 
aws-functions.pl: Drop file and move functions to general-functions.pl

There is not enough stuff that it is justified to have an own file.

This patch therefore merges everything into general-functions.pl.

There are no functional changes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogcp: Add host route for gateway during initialisation
Michael Tremer [Fri, 12 Jun 2020 16:05:00 +0000 (16:05 +0000)] 
gcp: Add host route for gateway during initialisation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogcp: Always automatically enable serial console
Michael Tremer [Fri, 12 Jun 2020 10:43:26 +0000 (10:43 +0000)] 
gcp: Always automatically enable serial console

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agogcp: Add initscript to import configuration
Michael Tremer [Fri, 12 Jun 2020 10:40:56 +0000 (10:40 +0000)] 
gcp: Add initscript to import configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 weeks agocloud-init: Launch custom script when detecting Google Cloud
Michael Tremer [Wed, 28 Aug 2019 11:51:22 +0000 (11:51 +0000)] 
cloud-init: Launch custom script when detecting Google Cloud

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 weeks agocore146: add openvpn core146 v2.25-core146
Arne Fitzenreiter [Tue, 16 Jun 2020 11:36:20 +0000 (11:36 +0000)] 
core146: add openvpn

openvpn was missed in core145 so add it again.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 weeks agolibloc: Update to 0.9.2
Stefan Schantl [Mon, 15 Jun 2020 17:47:07 +0000 (19:47 +0200)] 
libloc: Update to 0.9.2

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
8 weeks agoAdd convert-to-location converter.
Stefan Schantl [Mon, 15 Jun 2020 16:03:11 +0000 (18:03 +0200)] 
Add convert-to-location converter.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2 months agofwhosts.cgi: Fix function call.
Stefan Schantl [Sat, 13 Jun 2020 17:10:38 +0000 (19:10 +0200)] 
fwhosts.cgi: Fix function call.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2 months agofirewall-lib.pl: Fix typo.
Stefan Schantl [Sat, 13 Jun 2020 17:10:15 +0000 (19:10 +0200)] 
firewall-lib.pl: Fix typo.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2 months agovulnerabilities.cgi: add srdbs (CVE-2020-0543)
Arne Fitzenreiter [Sat, 13 Jun 2020 10:23:46 +0000 (12:23 +0200)] 
vulnerabilities.cgi: add srdbs (CVE-2020-0543)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 months agocredits.cgi: Remove hint about used MaxMind database and software.
Stefan Schantl [Fri, 12 Jun 2020 18:04:21 +0000 (20:04 +0200)] 
credits.cgi: Remove hint about used MaxMind database and software.

We do not rely anymore on data and software from this vendor, so
we safely can drop this notice.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2 months agoRootfiles update.
Stefan Schantl [Fri, 12 Jun 2020 18:01:48 +0000 (20:01 +0200)] 
Rootfiles update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>