core129: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 4.6

For details see:
http://www.squid-cache.org/Versions/v4/changesets/

The 'configure'-option "--disable-ipv6" was removed, it is no longer necessary.

See:
https://lists.ipfire.org/pipermail/development/2016-April/002046.html

"The --disable-ipv6 build option is now deprecated.
...
Squid-3.5.7 and later will perform IPv6 availability tests on startup in
all builds.

- Where IPv6 is unavailable Squid will continue exactly as it would
have had the build option not been used.

These Squid can have the build option removed now."

The warning message concerning a "BCP 177 violation" while
starting 'squid' can be ignored.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

spectre-meltdown-checker: New package

This makes it easy to install the script and check the vulnerability status
of a system IPFire is running on.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Ship strings & readelf

This is needed by the spectre meltdown checker script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update German translation

Mainly adds translation for new IPsec features

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update of French translation

- Several syntax / vocabulary improvements
- A 2 text missing in the French version
- Improvement of text offering a donation for the users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update openssl rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Update to 1.1.1b

This is a bug fix only release

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated credits.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated OpenVPN

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Update to version 2.4.7

Changelog can be found in here https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update Tor to 0.3.5.8

See https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312
for release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update metrics links in Tor WebUI

https://atlas.torproject.org/ is deprecated in favour of
https://metrics.torproject.org/ by now.

Fixes #11781.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated libgcrypt

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: update to 1.8.4

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.9.0

For details see:
https://nlnetlabs.nl/svn/unbound/tags/release-1.9.0/doc/Changelog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship changes from ipsec branch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'ipsec' into next

Start Core Update 129

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add script to search for missing libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Drop old openssl engines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cups: Depends on bluetooth library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: add openldap to update

openldap was linked against old openssl lib

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: add sse2 openssl libs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: apply local sshd config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.103

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: finish core128

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: import cve-2019-8912 patch

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: stop apache before replacing files

apache will not restart without stopped before
the files was replaced.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: apu leds: add more id's

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

partresize: add "apu1" for apus with new bios.

core128: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: cleanup unused rpi patch

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.102

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

partresize: enable serial console on PC Engines APU

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update apu led patch for apu3 and 4

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: Drop certificates for local control connection

These are a cause of worry because they are sometimes generated with
an invalid timestamp and therefore render unbound being unusable.

There is no strong reason to use self-signed certificates for extra
security here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Added 'CONFIG_X86_MSR=y for 'powertop' to i586 and x86_64 builds for fixing #11997

Triggered by:
https://forum.ipfire.org/viewtopic.php?f=69&t=22274

This - probably - fixes Bug #11997.

Needs testing on 64bit installations!

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix ownership of sendEmail script

The script used to be owned by a non-privileged user and it should
just be owned by root.root like any other binary.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

borgbackup: fix build on armv5tel

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: enable PCA953X GPIO extender for ClearFog boards

fixes: #12000

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.101

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: Ship kdig

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

knot: Reduced version of knot with kdig only

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship libedit

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libedit: A command line editor library

Dependency for knot (kdig).

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

powertop: Update to 2.10

Hi,

Triggered by:
https://forum.ipfire.org/viewtopic.php?f=69&t=22274

For details see:
https://01.org/powertop/downloads/powertop-v2.10

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcpcd: Update to 7.1.1

For details see:
https://roy.marples.name/blog/dhcpcd-7-1-1-released

"A minor update, highlights include:

 IPv4LL: Fixed build with this disabled
 IPv4LL: Remember last address between carrier resets
 BSD: Fixed initial link infos reported as LINK_STATE_UNKNOWN
 FreeBSD: Avoid panicing kernel when RTA_IFP is set for IPv6 prefix routes"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: Update to 7.64.0

Hi,

For details see:
https://curl.haxx.se/changes.html

This came rather unexpected - if I'd known, I'd have waited with 7.63.0.

"Changes:
cookies: leave secure cookies alone
hostip: support wildcard hosts
http: Implement trailing headers for chunked transfers
http: added options for allowing HTTP/0.9 responses
timeval: Use high resolution timestamps on Windows

Bugfixes:
CVE-2018-16890: NTLM type-2 out-of-bounds buffer read
CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow
CVE-2019-3823: SMTP end-of-response out-of-bounds read
FAQ: remove mention of sourceforge for github
OS400: handle memory error in list conversion
OS400: upgrade ILE/RPG binding.
README: add codacy code quality badge
Revert http_negotiate: do not close connection
THANKS: added several missing names from year <= 2000
build: make 'tidy' target work for metalink builds
cmake: added checks for variadic macros
cmake: updated check for HAVE_POLL_FINE to match autotools
cmake: use lowercase for function name like the rest of the code
configure: detect xlclang separately from clang
configure: fix recv/send/select detection on Android
configure: rewrite --enable-code-coverage
conncache_unlock: avoid indirection by changing input argument type
cookie: fix comment typo
cookies: allow secure override when done over HTTPS
cookies: extend domain checks to non psl builds
cookies: skip custom cookies when redirecting cross-site
curl --xattr: strip credentials from any URL that is stored
curl -J: refuse to append to the destination file
curl/urlapi.h: include "curl.h" first
curl_multi_remove_handle() don't block terminating c-ares requests
darwinssl: accept setting max-tls with default min-tls
disconnect: separate connections and easy handles better
disconnect: set conn->data for protocol disconnect
docs/version.d: mention MultiSSL
docs: fix the --tls-max description
docs: use $(INSTALL_DATA) to install man page
docs: use meaningless port number in CURLOPT_LOCALPORT example
gopher: always include the entire gopher-path in request
http2: clear pause stream id if it gets closed
if2ip: remove unused function Curl_if_is_interface_name
libssh: do not let libssh create socket
libssh: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION for libssh
libssh: free sftp_canonicalize_path() data correctly
libtest/stub_gssapi: use "real" snprintf
mbedtls: use VERIFYHOST
multi: multiplexing improvements
multi: set the EXPIRE_*TIMEOUT timers at TIMER_STARTSINGLE time
ntlm: fix NTMLv2 compliance
ntlm_sspi: add support for channel binding
openssl: adapt to 3.0.0, OpenSSL_version_num() is deprecated
openssl: fix the SSL_get_tlsext_status_ocsp_resp call
openvms: fix OpenSSL discovery on VAX
openvms: fix typos in documentation
os400: add a missing closing bracket
os400: fix extra parameter syntax error
pingpong: change default response timeout to 120 seconds
pingpong: ignore regular timeout in disconnect phase
printf: fix format specifiers
runtests.pl: Fix perl call to include srcdir
schannel: fix compiler warning
schannel: preserve original certificate path parameter
schannel: stop calling it "winssl"
sigpipe: if mbedTLS is used, ignore SIGPIPE
smb: fix incorrect path in request if connection reused
ssh: log the libssh2 error message when ssh session startup fails
test1558: verify CURLINFO_PROTOCOL on file:// transfer
test1561: improve test name
test1653: make it survive torture tests
tests: allow tests to pass by 2037-02-12
tests: move objnames-* from lib into tests
timediff: fix math for unsigned time_t
timeval: Disable MSVC Analyzer GetTickCount warning
tool_cb_prg: avoid integer overflow
travis: added cmake build for osx
urlapi: Fix port parsing of eol colon
urlapi: distinguish possibly empty query
urlapi: fix parsing ipv6 with zone index
urldata: rename easy_conn to just conn
winbuild: conditionally use /DZLIB_WINAPI
wolfssl: fix memory-leak in threaded use
spnego_sspi: add support for channel binding"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.98

todo: check if RPi dwc dma patch still need to reverted before release

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

borgbackup: Fix build on i586

Fixes

...
'/usr/src/config/rootfiles/packages//borgbackup' -> '/install/packages/package/ROOTFILES'
tar: usr/lib/python3.6/site-packages/borg/chunker.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/compress.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/crypto.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/hashindex.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/platform_linux.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: Exiting with failure status due to previous errors
make: *** [borgbackup:58: dist] Error 2
...

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python3-llfuse: Fix build on i586

Fixes

"tar: usr/lib/python3.6/site-packages/llfuse.cpython-36m-i586-linux-gnu.so:
Cannot stat: No such file or directory"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Ship updated firewall initscript

Require reboot after the update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apply default firewall policy for ORANGE, too

If firewall default policy is set to DROP, this setting was not
applied to outgoing ORANGE traffic as well, which was misleading.

Fixes #11973

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Cc: Oliver Fuhrer <oliver.fuhrer@bluewin.ch>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Tor: update to 0.3.5.7

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Do not create any NAT rules when using VTI/GRE

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop "OpenVPN" part from VPN N2N stats page

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add routed IPsec connections to traffic graphs section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Write correct rules bound to interface for routes IPsec tunnels

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Resolve any remote hostnames

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Move conditional block into the loop

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Drop delayed restart setting

This is a very bad race-condition situation and is not solved by
an unintuitive setting.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Drop VPN_IP setting

This is now a per-connection setting

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Add translation strings for recent changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-*: Name some more configuration variables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Uses local IP address from connection first, then default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Correct open ports for connections on aliases

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Allow to select local IP address used for peer on UI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Re-arrange inputs for peer addresses, subnets, etc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Don't allow to select VTI in transport mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Don't populate GREEN subnet when green doesn't exist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Fix typo in variable name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: No longer create any routes automatically

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Filter better for GRE/VTI interfaces

This tried to delete the GREEN interface before

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: TTL only applies for GRE interfaces and not VTI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Find correct RED IP address when using %defaultroute

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Log a message when an interface could not be created

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Don't add any interfaces when IPsec is disabled

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "ipsec-interfaces: Run when IPsec is disabled"

This reverts commit 3c3a1cfdb9b473fae9b792e8c211c9940fafc658.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Move advanced IPsec settings to connection page

This is required to make the initial setup easier for GRE/VTI connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Run when IPsec is disabled

This needs to run even when IPsec is disable to remove
and interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Use correct righthost variable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Do not allow 0.0.0.0/0 as remote subnet

This renders the whole machine inaccessible

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: Create IPsec interfaces when network is brought up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsecctrl: Call ipsec-interfaces script when turning up/shutting down connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add (experimental) script that creates GRE/VTI interfaces

Signed-off-by: root <root@interim-edge-a.ec2.internal>

IPsec: Use left/rightprotoport in GRE mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsecctrl: Don't wait when a connection is to be started

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Don't install any block rules for connections with an interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Permit GRE traffic for GRE connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Variables don't match those from the CGI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-policy: Parse all configuration settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Move opening ports from ipsecctrl into ipsec-policy script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Rename ipsec-block script to ipsec-policy

This is a more general name for a script that will be extended
soon to do more than just add blocking rules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Update ipsec.conf for GRE/VTI changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add UI for set interface MTU

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Add option to configure IP address for tunnel interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>