Merge branch 'next'

core110: finish update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

squid: Update to 3.5.25

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid 3.5.24: latest patches (14149-14153)

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid 3.5.24: latest patches (14144-14148)

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid 3.5.24: latest patch (14143)

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DNS: Show DNSSEC status on index page if deavtivated

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core110: Ship updated ntp package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ntp: Update to 4.2.8p10

"It addresses 6 medum- and 5 low-severity security issues, 4 informational security topics,
15 bugfixes, and contains other improvements over 4.2.8p9."

For a complete list, see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mpd 0.20.6: fixes for lfs-file

Package refused to build without initscript.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

motion 4.0.1: suggested new rootfile

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

motion: Update to 4.0.1

'ffmpeg' seems to need this update.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: Create route to gateway

Some hosters have their gateway in a different subnet than
the RED interface is to save IPv4 address space.

This patch sets a host route to that gateway so that
IPFire can be installed in data centres that use such
technique.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

setup: Allow setting netmask to 255.255.255.255

Some hosters require that the subnet mask of the RED network
is set to 255.255.255.255. This was not possible to save before.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Increase memory size on even larger systems

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Double buffer size

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Increase size of send/receive buffers

This will allow to not drop any packets when there is a
peak in queries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Re-use UDP sockets

This will make UDP queries faster

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Increase number of parallel queries

The parameters are the recommended values for libevent

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mpd: update to 0.20.6

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec: Do not reject connections in on-demand mode

When an on-demand VPN connection is not up, the packets will
traverse the firewall and be rejected by the IPSECBLOCK chain
which will cause that an ICMP error message will be sent to
the client. If that does not happen and the packet is being
silently dropped, the client will retransmit and by then
the VPN connection will hopefully be up.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix updated graphs in legacy theme

The images are now a little bigger and will be scaled down
here, but the iframe box never grows bigger than the max.
size of the container.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ffmpeg and ffmpeg-libs: update to 3.2.4

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "BUG11278: enable creation from subnets of internal networks"

This reverts commit ff6cc71107ae50e913c87a9bc77b3af4b31ec932.

This patch causes that no new networks can be created and
an error message is shown that the created network is the GREEN
network which is incorrect.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Improve graphs

The graphs are using an iframe and PNG images where the resolution
did often not fit and the browser had to resize the image. That
led to blurred fonts and hard to read graphs.

This patch increases the size of the box and the image. With that
higher resolution resizing should not be too much of an issue, but
since the sizes of the iframe and image have been aligned should
not even be necessary.

Reported-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Disable IPv6 by default

IPFire 2 does not have IPv6 connectivity with exception of a
few systems for testing where IPsec connections become a little
bit unstable when trying to connect over IPv6.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apcupsd: update to 3.14.14

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Disable netfilter on all bridges per default

Fixes: #11301
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xinetd: fix the call of INSTALL_INITSCRIPT

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix rootfile of keepalived after initscript changes

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Midnight Commander: Update to 4.8.19

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'initscripts-cleanup' of git://git.ipfire.org/people/jschlag/ipfire-2.x into next

Move the position of the initscripts lfs in the build process

We need the directory /etc/rc.d/init.d earlier in the build process
because the initscripts are copied in the lfs files like in lfs/mysql

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

Strongswan: Remove unnecessary commands concern initscripts

It is not necessary to copy the init scripts and remove the symlinks for
runnlevel interaction.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

core110: Ship updated conntrack-tools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core110: Ship updated nettle

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nettle: Update to 3.3

Added '--disable-documentation' because we don't need this.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

conntrack-tools: Update to 1.4.4

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Remove unused applejuice script

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

cyrus-sasl: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

miniupnpd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

minidlna: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

miau: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

cyrus-imapd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

monit: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

mediatomb: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

imspector: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

gnump3d: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

vsftpd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

lcd4linux: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

netsnmpd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

dbus: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

lcdproc: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

vdradmin: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

vdr: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

Merge branch 'next' into initscripts-cleanup

BUG11296: Fix build on EFI systems

fixes: #11296

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sslh: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

mpd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

spamassassin: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

lcr: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

fetchmail: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

rtpproxy: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

tftpd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

core110: Ship updated lm_sensors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lm_sensors: Update to 3.4.0

For details see:
https://github.com/groeck/lm-sensors/blob/master/CHANGES

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache: Allow more processes/connections as the same time

In large networks, when ever multiple clients connect at the
same time and request the proxy.pac configuration file, apache
rate-limited requests so that some clients did not get a response
and therefore could not connect to the Internet.

This allows apache to handle more connections at the same time.

Suggested-by: Thoralf Söldenwagner <soeldenwagner@brecht-schule.hamburg>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DNS: Fall back to permissive mode if recursor mode is unavailable

The tests when assigning DNS name servers has been extended so that
if no working forwarder can be found, we will test if the local recursor
mode is an option.

If not, we will configure unbound's validator module into permissive
mode so that at least some DNS functionality is available.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 110

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssh: Update to 7.4p1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile updates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

avahi: Update to 0.6.32

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ghostscript: Update to 9.20

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cups: Use avahi and DBUS

These services are quite handy to make the printing
capabilities available to the network.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound depends on expat

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

client175: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

amavisd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

gnutls: New package

Another TLS library that is required by CUPS for SSL support

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

epson-inkjet-printer-escpr: Update to 1.6.12

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

x86_64: Ship libssp.so as on all other architectures, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

stunnel: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

cpufrequtils: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

motion: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

Merge branch 'next' into initscripts-cleanup

Various rootfile fixes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update CUPS to 2.2.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pound: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

transmission: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

apcupsd: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

sane: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

nut: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

samba: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

mysql: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

keepalived: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

haproxy: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

bluetooth: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

dnsdist: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>

unbound: Update to 1.6.1

For details see:
http://www.unbound.net/download.html

"Features

    configure --enable-systemd and lets unbound use systemd sockets if you enable use-systemd:
    yes in unbound.conf. Also there are contrib/unbound.socket and contrib/unbound.service:
    systemd files for unbound, install them in /usr/lib/systemd/system. Contributed by Sami Kerola
    and Pavel Odintsov.
    [bugzilla: 1185 ]
    Source IP rate limiting, patch from Larissa Feng.
    [bugzilla: 1184 ]
    Log DNS replies. This includes the same logging information that DNS queries and response
    code and response size, patch from Larissa Feng.
    Include root trust anchor id 20326 in unbound-anchor.
    64bit is default for windows builds.

Bug Fixes

    [bugzilla: 1176 ] Fix stack size too small for Alpine Linux.
    Fix unbound-control and ipv6 only.
    [bugzilla: 1182 ] Fix Resource leak (socket), at startup.
    [bugzilla: 1178 ] Fix attempt to fix setup error at end, pop result values at end of install.
    iana portlist update
    Fix inet_ntop and inet_pton warnings in windows compile.
    [bugzilla: 1191 ] Fix remove comment about view deletion.
    [bugzilla: 1188 ] Fix unresolved symbol 'fake_dsa' in libunbound.so when built with Nettle
    [bugzilla: 1190 ] Fix to not echo back EDNS options in local-zone error response.
    [bugzilla: 1194 ] Fix if cross build fails when $host isn't `uname` for getentropy.
    Fix reload chdir failure when also chrooted to that directory.
    Fix to return formerr for queries for meta-types, to avoid packet amplification if this meta-type
    is sent on to upstream.
    [bugzilla: 1201 ] Fix missing unlock in answer_from_cache error condition.
    [bugzilla: 1202 ] Fix code comment that packed_rrset_data is not always 'packed'.
    Fix to also block meta types 128 through to 248 with formerr.
    [bugzilla: 1206 ] Fix that some view-related commands are missing from 'unbound-control -h'
    Fix to rename ub_callback_t to ub_callback_type, because POSIX reserves _t typedefs.
    Fix to rename internally used types from _t to _type, because _t type names are reserved by
    POSIX.
    Increase MAX_MODULE to 16.
    [bugzilla: 1211 ] Fix can't enable interface-automatic if no IPv6 with more helpful error message.
    fix root_anchor test for updated icannbundle.pem lower certificates.
    Fix compile on solaris of the fix to use $host detect.
    Fix for type name change and fix warning on windows compile.
    Fix pythonmod for typedef changes.
    Fix dnstap for warning of set but not used.
    Fix autoconf of systemd check for lack of pkg-config."

Best, Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

asterisk: move initscript to src/initscripts/packages and use new macro

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>