make.sh: Fix wrong function call to setup build environment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'master' into next

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bump toolchain version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop vdr_vnsiserver5

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

directfb: Update to 1.7.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipset: Don't (re-)build kernel module here

The reason why this comes up is that we currently don't build
a kernel for aarch64 and therefore building ipset fails.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dfb++: Drop package

This does not seem to be needed by anything

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Update to 1.64.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iftop: Drop package

This is not maintained upstream any more and I cannot get this to build.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tcpick: Drop package

This FTBFS and is not maintained upstream any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Build autoconf and automake before berkeley

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Drop installmake()

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Drop ipfiremake() which is identical to lfsmake2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fuse: Update to 2.9.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iperf: Update to 2.0.9

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

crda: Compile fix for newer GCC

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lcr: Fix compilation with GCC 6

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ghostscript: Delete all bundled libraries

ghostscript ships a number of bundled libraries
that is needs to be build and at runtime.

This patch removes them all which causes ghostcript
to automatically fall back to the libraries installed
in the system.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

linux: Do not build GCC plugins

Our version of GCC has plugins enabled and built but for
some reason they are not properly detected.

Hence they are disabled for now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl: Fix Errno.pm generation for GCC >= 5

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libdvbpsi: Fails to build with newer GCC

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fontconfig: Fix build with glibc >= 2.25

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop paxctl

Since the new toolchain the flags are not compiled into the
binaries any more which causes paxctl to fail.

On top of that, PaX and grsecurity won't be available freely
any more which requires us to remove it from the distribution.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: Fix compile error in gnulib with newer GCCs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python: Update to 2.7.13

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mysql: Fix build with newer GCC

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Do not enable stack-smashing protector in toolchain stage

This is causing build errors on some systems where the host
system does or does not use SSP.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ncurses-compat: Fix build with GCC 6

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Pass BUILD_PLATFORM variable to build environment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pam: Compile fix for newer glibcs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Make package compile on all arches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

udev: Remove old compile fix for older versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Cleanup makefile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Install obsolete RPC headers

Some programs still use these and therefore we need to install
them here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sysklogd: Fix build with GCC 6

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

stage2: Make sure to install lib64 symlinks on all 64 bit architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Remove some deprecated configure options in 2nd toolchain pass

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Test toolchain after build

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Perform full bootstrap on ARM32

The build fails with various reasons and a full bootstrap
always succeeds. This takes a very long time so we try to
avoid it where ever possible.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Do not build libmpx on x86 in first pass in toolchain

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cleanup-toolchain: Fix TARGET for toolchain and non-toolchain pass

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Use a better marker to determine if toolchain is present

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

stage1: New build script

Creates some basic directories and symlinks in toolchain stage

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Always pass --disable-multilib

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Use enterchroot function in ipfiredist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Let lfsmake2 use the new enterchroot function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Create a function to execute a command in chroot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Correctly configure ccache in toolchain stage

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Cleanup of polluted environment

The build environment is using a number of variables which
occasionally conflicted with some other build systems.

This patch cleans that up by renaming some variables and
later unexporting them in the lfs files.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cleanup-toolchain: Use TOOLCHAIN variable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Drop modifying CFLAGS in PASS=1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Enable hard float abi when compiling for armv7hl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Build with hard floating point support on armv7hl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

armv7hl: Build without -mthumb

Causes some linking problems when bootstrapping the toolchain

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

linux: Install ARM headers for armv7hl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Support building for armv7hl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

toolchain: Drop first pass of cleanup-toolchain script

This is no longer necessary

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Cleanup makefiles by using the new TOOLCHAIN variable

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Remove some unnecessary compiler options

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Don't bootstrap in second pass

GCC does not need to be bootstrapped in the second pass
any more since the toolchain is not built hardened

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Remove unnecessary compiler options

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Build for aarch64 by default on aarch64 hosts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Allow building for aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

toolchain: Build without hardening

The toolchain will be built without hardening which makes
the entire bootstrapping process way more complicated than
necessary and sometimes fail on some host distribution.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pkg-config: Remove accidentially commited line

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Update to 2.25

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Update to version 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Update to version 6.3.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pkg-config: Fix compilation with newer GCCs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Package doesn't support build in parallel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Enable --with-float only on armv5tel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core111: Ship updated cpio

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cpio: Update to 2.12

FTBFS on aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ccache: Cleanup makefile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Set TOOLCHAIN=1 in toolchain stage

This allows better lfs files and fewer ifdefs in toolchain stage.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Adjust toolchain PATH in lfsmake1 instead of globally

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel headers: Install correct headers for all architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fake-environ: Fix typos

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Show last lines of log when build aborts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 111

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/master' into next

Merge remote-tracking branch 'ms/wlanclient' into next

index.cgi: Show WiFi properties on front page

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WiFi: Show EAP status on wireless client page

This patch adds some status information so that we know what
authentication an access point is using.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 0.3.0.7

Fixes various security vulnerabilities of medium severity in
the relay component.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Italian translations in it.pl after 110

Missing or incorrect translations.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

web-user-interface: Fix for rootfile

Added 'back.png' for Firewall-GUI

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Fix typo

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wlan client: Generate wpa_supplicant configuration file for EAP

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wlan client: Allow configuration of EAP-PEAP and EAP-TTLS on web user interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

GUI: Some simple FW-Log cosmetics

I altered 'showrequestfromcountry.dat', 'showrequestfromip.dat' and 'showrequestfromport.dat'
in the same manner as the 'Loggraphs'-Pages in commit

Each 'Details'-page got a unique title.

Furthermore, I added a 'Back'-Button to go back to the previous page. For this, I used
'back.png' from 'wio' (thanks Stephan! ;-) ) since I found no other appropriate image.

'ipinfo.cgi' got a centered 'Back'-Button, too.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG 11305: Suggested fix for '/var/log/btmp' permissions

Fixes BUG 11305, for details see:
https://bugzilla.ipfire.org/show_bug.cgi?id=11305

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update dnssec-status file

The status file was not updated when DNSSEC was disabled
before and has been enabled after which always caused
the webif to show that DNSSEC was disabled.

Fixes #11315

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.2

For details see:
http://www.unbound.net/download.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.1

For details see:
https://ftp.isc.org/isc/bind9/9.11.1/RELEASE-NOTES-bind-9.11.1.html

"Security Fixes

rndc "" could trigger an assertion failure in named. This flaw is disclosed
in (CVE-2017-3138). [RT #44924]

Some chaining (i.e., type CNAME or DNAME) responses to upstream queries could
trigger assertion failures. This flaw is disclosed in CVE-2017-3137. [RT #44734]

dns64 with break-dnssec yes; can result in an assertion failure. This flaw is
disclosed in CVE-2017-3136. [RT #44653]

If a server is configured with a response policy zone (RPZ) that rewrites an
answer with local data, and is also configured for DNS64 address mapping, a NULL
pointer can be read triggering a server crash. This flaw is disclosed in
CVE-2017-3135. [RT #44434]

A coding error in the nxdomain-redirect feature could lead to an assertion failure
if the redirection namespace was served from a local authoritative data source such
as a local zone or a DLZ instead of via recursive lookup. This flaw is disclosed in
CVE-2016-9778. [RT #43837]

named could mishandle authority sections with missing RRSIGs, triggering an
assertion failure. This flaw is disclosed in CVE-2016-9444. [RT #43632]

named mishandled some responses where covering RRSIG records were returned without
the requested data, resulting in an assertion failure. This flaw is disclosed in
CVE-2016-9147. [RT #43548]

named incorrectly tried to cache TKEY records which could trigger an assertion failure
when there was a class mismatch. This flaw is disclosed in CVE-2016-9131. [RT #43522]

It was possible to trigger assertions when processing responses containing answers of
type DNAME. This flaw is disclosed in CVE-2016-8864. [RT #43465]

Added the ability to specify the maximum number of records permitted in a zone
(max-records #;). This provides a mechanism to block overly large zone transfers, which
is a potential risk with slave zones from other parties, as described in CVE-2016-6170.
[RT #42143]

Bug Fixes

A synthesized CNAME record appearing in a response before the associated DNAME could be
cached, when it should not have been. This was a regression introduced while addressing
CVE-2016-8864. [RT #44318]

named could deadlock if multiple changes to NSEC/NSEC3 parameters for the same zone were
being processed at the same time. [RT #42770]

named could trigger an assertion when sending NOTIFY messages. [RT #44019]

Referencing a nonexistent zone in a response-policy statement could cause an assertion
failure during configuration. [RT #43787]

rndc addzone could cause a crash when attempting to add a zone with a type other than
master or slave. Such zones are now rejected. [RT #43665]

named could hang when encountering log file names with large apparent gaps in version
number (for example, when files exist called "logfile.0", "logfile.1", and
"logfile.1482954169"). This is now handled correctly. [RT #38688]

If a zone was updated while named was processing a query for nonexistent data, it could
return out-of-sync NSEC3 records causing potential DNSSEC validation failure. [RT #43247]"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nano: Update to 2.8.1

For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.12.1

For details see:
https://github.com/logrotate/logrotate/blob/master/ChangeLog.md

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Mark SHA1 as weak

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Use SHA512 by default

This will break compatibility with old clients like
Windows XP, but these are too old now to be supported.

SHA1 is considered to be weak and should not be used any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>