captive: Log into default apache log files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive-portal: Design changes

When choosing voucher as authentication type there is no need to display the license agreement textbox

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11141: Redesign of configuration website

To improve the user experience, the configuration part of generating new vouchers has been reworked.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11140: Captive logo dimensions

Now the min and max logo dimensions are shown in webinterface.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11137: Captive save action messes up the form

When configuring the captiveportal for the first time the form
will be empty after clicking on save button if not all relevant fields are set.

Now the settings are stored even if there is an error.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG11139: Captive voucher table too wide

Set table to 100% and the remark textfield to 96% (cellwidth)

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Improve the wording of the Captive Portal configuration site

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive-Portal: fix fontsize of generated voucher

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: Fix folder permissions

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: fix some typos and missing dir

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: Add logo upload feature

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-portal: Add directory for logo upload

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

captivectrl: Add protection against DNS tunnels

Limit the amount of DNS traffic for each client that
has not registered, yet.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Skip all lines that start with #

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive-Portal: fix cleanup script

The cleanup-script did not write back the hash after the expired voucher
was delted

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add Errormessage when wrong code is entered

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: fix wrong expiretime of unused vouchers

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: fix voucher form

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add logging to syslog

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: SHow always licencebox in config

Also fix index.cgi to show individual title

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: several design changes

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: redesign Webinterface

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: fix some rootfiles

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add backup-part

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add captive logdir to apache2 rootfile

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add files to configroot rootfile

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: Add files for webinterface tio rootfile

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add vhost config to apache2 rootfile

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: create dir for cative logfiles

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add captive dirs and files to configroot

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add captive chains to firewall initscript

When loading the initscript of the firewall the neccessary chains for
the captive portalneed to be created.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add crontab and cleanup scripts

The cleanup script is called every hour and deletes expired clients from
the clients file.
every night the captivectrl warpper runs once to flush the chains and
reload rules for active clients

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

Captive-Portal: add web-part

Introduce new Captive-Portal.
Here we add the menu, apache configuration (vhost), IPFire configuration
website and Captive-Portal Access site. Also the languagefiles are
updated.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

captivectrl: Move sure that the settings are always initialised

This just removes a compiler warning.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wirelessctrl: Disable MAC filter on blue if captive portal is enabled

Fixes #11038

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Add missing space character

The iptables argument list was botched. Oops. Sorry.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Support unlimited leases

When the expiry time equals zero, the lease will have
no time constraints. The IP address will also be removed
as it might probably change.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Allow empty IP addresses

Probably required for very long leases

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

captivectrl: Change format of clients configuration

We store the start of the lease now and the time in
seconds after the lease expires

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Captive Portal: add c-wrapper captivectrl

This wrapper reads the captive settings and clients and sets the
firewall access rules. It is called every time the config changed or
everytime that a client changes. Also this wrapper is later called once
hourly to flush the chains and rebuild rules for actual clients.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>

core114: Update apache configuration of all add-ons that have one

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated apache2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache2: Download source from IPFire servers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update to apache 2.4.27

- Updated to apache 2.4
- Updated the htpasswd generation to use the more secure bcrypt algorithm

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apr and aprutil: Added as requirement for apache 2.4

- APR 1.6.2 is a requirement for building apache httpd 2.4
- APR-Util 1.6.0 is a requirement for building apache httpd 2.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fix WebUI system information leak

Disable unauthenticated access to cgi-bin/credits.cgi. The page
leaks the currently installed version of IPFire and the hardware
architecture.

Both information might make a successful attack much easier.

This issue can be reproduced by accessing https://[IPFire-IP]:444/cgi-bin/credits.cgi
and accepting a SSL certificate warning (if any).

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update german translations

- Unify translations of various terms.
- Unify translations of week days.
- Correct some typos and grammar errors.
- Modify some phrases which were not fully translated.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core114: add unbound initskript to updater.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: flush negative and bogus at update forwarders

this resolves problems that negative answers from
a forwarder was still used after setting new servers.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: run time fix also after update forwarder

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

strongswan: Update to 5.6.0

Fixes CVE-2017-11185:

Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
when verifying RSA signatures, which requires decryption with the operation m^e mod n,
where m is the signature, and e and n are the exponent and modulus of the public key.
The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
This result wasn't handled properly causing a null-pointer dereference.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 3.5.27

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated gnutls

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.15

For details see:
https://lists.gnupg.org/pipermail/gnutls-devel/2017-August/008483.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.5

Changelog:

"21 Aug 2017: Wouter
- Fix install of trust anchor when two anchors are present, makes both
  valid.  Checks hash of DS but not signature of new key.  This fixes installs between
  sep11 and oct11 2017."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated hdparm

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 114

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hdparm: Update to 9.52

Changes from 9.50 to 9.52:
- add support for Jmicron USB-SATA bridges, courtesy Jan Friesse <jfriesse@gmail.com>.
- New --security-prompt-for-password flag for use with the various --security- actions.
- Makefile tweak from Mike Frysinger.
- fix spelling/typos in man page and "removable", courtesy of Alex Mestiashvili.
- fix spelling/typos in --sanitize-crypto-scramble, courtesy of Tom Yan.
- fix NULL password handling in --security-unlock, courtesy of Tom Yan.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

close core113

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

unbound: update dns hints and keys

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core113: Ship openvpn which has been missing in core112 updater

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rootfile updates: nano, misc-progs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core113: add strongswan-padlock to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Actually build iftop

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core113: Ship packages that have not been shipped with 112

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound/ntp: move not working DNS fallback from ntp to unbound initskript

the ntp initskript will only run at first connection try. If this fails
and the connection can established later DNS will not work if the clock
is too far away.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

serial-console: remove baudrate from inittab

new versions of agetty missinterpretes the baudrate and set it as TERM
without the parameter agetty use the previous rate that was set by the
kernel via console=XXX,Baudrate parameter.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

WIO: wio.cgi edit how to get the ips for the networks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Fix source tarball checksum

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core113: Add latest packages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iftop: This is an Update release to ver. 1.0pre4

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.12.3

For details see:
https://github.com/logrotate/logrotate/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nano: Update to 2.8.6

For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pcre: Update to 8.41

For details see:
http://www.pcre.org/original/changelog.txt

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.2

For details see:
https://ftp.isc.org/isc/bind9/9.11.2/RELEASE-NOTES-bind-9.11.2.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.14

For details see:
https://lists.gnupg.org/pipermail/gnutls-devel/2017-May/008427.html
https://lists.gnupg.org/pipermail/gnutls-devel/2017-June/008446.html
https://lists.gnupg.org/pipermail/gnutls-devel/2017-July/008469.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: Update to 1.8.0

Changes (see: https://gnupg.org/download/release_notes.html):

"gpg: Sending very large keys to the keyservers works again.
gpg: Validity strings in key listings are now again translatable.
gpg: Emit FAILURE status lines to help GPGME.
gpg: Does not anymore link to Libksba to reduce dependencies.
gpgsm: Export of secret keys via Assuan is now possible.
agent: Raise the maximum passphrase length from 100 to 255 bytes.
agent: Fix regression using EdDSA keys with ssh.
Does not anymore use a build timestamp by default.
The fallback encoding for broken locale settings changed from Latin-1 to UTF-8.
Many code cleanups and improved internal documentation.
Various minor bug fixes."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.6

For details see:
https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.4

Hi, ("...back in town...") ;-)

For details see:
http://www.unbound.net/download.html

I had to remove the patch file: it wouldn't apply.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 0.3.0.10

Fixes CVE-2017-0377 and others.

For details see:
https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.10

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid 3.5.26: latest patches (14169-14182)

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: minor changes

correct typo in wio.en.pl language file
add button in wio.cgi to change to systems logs (section wio)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: patch log.dat to show wio logs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: first addon release v1.3.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 113

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util-linux: update rootfile (armv5tel)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ncftp: drop addon package

it is outdated and will not build with new gcc/glibc

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make-functions: move MAKETUNING before make

this is needed to edit MAKTUNING in the lfs file
which is used by boost and cmake to build on
machines with less than 4GB Memory.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

close core112

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core112: reload init to allow correct unmount at reboot

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

toolchain: filter -mfpu from CFLAGS for first pass

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: remove wrong 2nd partition

the new sfdisk seems not able to skip a partition anymore.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bump TOOLCHAIN version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>