apr and aprutil: Added as requirement for apache 2.4

- APR 1.6.2 is a requirement for building apache httpd 2.4
- APR-Util 1.6.0 is a requirement for building apache httpd 2.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fix WebUI system information leak

Disable unauthenticated access to cgi-bin/credits.cgi. The page
leaks the currently installed version of IPFire and the hardware
architecture.

Both information might make a successful attack much easier.

This issue can be reproduced by accessing https://[IPFire-IP]:444/cgi-bin/credits.cgi
and accepting a SSL certificate warning (if any).

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update german translations

- Unify translations of various terms.
- Unify translations of week days.
- Correct some typos and grammar errors.
- Modify some phrases which were not fully translated.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core114: add unbound initskript to updater.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: flush negative and bogus at update forwarders

this resolves problems that negative answers from
a forwarder was still used after setting new servers.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

unbound: run time fix also after update forwarder

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

strongswan: Update to 5.6.0

Fixes CVE-2017-11185:

Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation
when verifying RSA signatures, which requires decryption with the operation m^e mod n,
where m is the signature, and e and n are the exponent and modulus of the public key.
The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this.
So if m equals n the calculation results in 0, in which case mpz_export() returns NULL.
This result wasn't handled properly causing a null-pointer dereference.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 3.5.27

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated gnutls

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.15

For details see:
https://lists.gnupg.org/pipermail/gnutls-devel/2017-August/008483.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.5

Changelog:

"21 Aug 2017: Wouter
- Fix install of trust anchor when two anchors are present, makes both
  valid.  Checks hash of DS but not signature of new key.  This fixes installs between
  sep11 and oct11 2017."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core114: Ship updated hdparm

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 114

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hdparm: Update to 9.52

Changes from 9.50 to 9.52:
- add support for Jmicron USB-SATA bridges, courtesy Jan Friesse <jfriesse@gmail.com>.
- New --security-prompt-for-password flag for use with the various --security- actions.
- Makefile tweak from Mike Frysinger.
- fix spelling/typos in man page and "removable", courtesy of Alex Mestiashvili.
- fix spelling/typos in --sanitize-crypto-scramble, courtesy of Tom Yan.
- fix NULL password handling in --security-unlock, courtesy of Tom Yan.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

close core113

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

unbound: update dns hints and keys

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core113: Ship openvpn which has been missing in core112 updater

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rootfile updates: nano, misc-progs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core113: add strongswan-padlock to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh: Actually build iftop

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core113: Ship packages that have not been shipped with 112

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound/ntp: move not working DNS fallback from ntp to unbound initskript

the ntp initskript will only run at first connection try. If this fails
and the connection can established later DNS will not work if the clock
is too far away.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

serial-console: remove baudrate from inittab

new versions of agetty missinterpretes the baudrate and set it as TERM
without the parameter agetty use the previous rate that was set by the
kernel via console=XXX,Baudrate parameter.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

WIO: wio.cgi edit how to get the ips for the networks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Fix source tarball checksum

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core113: Add latest packages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iftop: This is an Update release to ver. 1.0pre4

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.12.3

For details see:
https://github.com/logrotate/logrotate/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nano: Update to 2.8.6

For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pcre: Update to 8.41

For details see:
http://www.pcre.org/original/changelog.txt

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.2

For details see:
https://ftp.isc.org/isc/bind9/9.11.2/RELEASE-NOTES-bind-9.11.2.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.14

For details see:
https://lists.gnupg.org/pipermail/gnutls-devel/2017-May/008427.html
https://lists.gnupg.org/pipermail/gnutls-devel/2017-June/008446.html
https://lists.gnupg.org/pipermail/gnutls-devel/2017-July/008469.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: Update to 1.8.0

Changes (see: https://gnupg.org/download/release_notes.html):

"gpg: Sending very large keys to the keyservers works again.
gpg: Validity strings in key listings are now again translatable.
gpg: Emit FAILURE status lines to help GPGME.
gpg: Does not anymore link to Libksba to reduce dependencies.
gpgsm: Export of secret keys via Assuan is now possible.
agent: Raise the maximum passphrase length from 100 to 255 bytes.
agent: Fix regression using EdDSA keys with ssh.
Does not anymore use a build timestamp by default.
The fallback encoding for broken locale settings changed from Latin-1 to UTF-8.
Many code cleanups and improved internal documentation.
Various minor bug fixes."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.6

For details see:
https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.4

Hi, ("...back in town...") ;-)

For details see:
http://www.unbound.net/download.html

I had to remove the patch file: it wouldn't apply.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 0.3.0.10

Fixes CVE-2017-0377 and others.

For details see:
https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.10

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid 3.5.26: latest patches (14169-14182)

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: minor changes

correct typo in wio.en.pl language file
add button in wio.cgi to change to systems logs (section wio)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: patch log.dat to show wio logs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

WIO: first addon release v1.3.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 113

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util-linux: update rootfile (armv5tel)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

ncftp: drop addon package

it is outdated and will not build with new gcc/glibc

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make-functions: move MAKETUNING before make

this is needed to edit MAKTUNING in the lfs file
which is used by boost and cmake to build on
machines with less than 4GB Memory.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

close core112

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core112: reload init to allow correct unmount at reboot

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

toolchain: filter -mfpu from CFLAGS for first pass

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: remove wrong 2nd partition

the new sfdisk seems not able to skip a partition anymore.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bump TOOLCHAIN version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: remove unsupported sfdisk switches

New util-linux sfdisk does not have -D and -H / -S
switches.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core112: Ship updated util-linux

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util-linux: update to 2.28.2

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Reviewed-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: ignore missing .symtab in modules

old binutis add an empty .symtab section at stripping
and grub check that this exists also on modules that export
no symbols.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

checknewlog: skip cmake because log contain space in filenames

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

this grep fails on debian and the output is useless II

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Archive Core Updates 110 + 111

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Package Core Update 112

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for armv5tel toolchain

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipfire-netboot: Update to version v1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Fix crash of daemon at startup

getentropy() cannot be used on our platform.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop architecture-dependent and unused package fwhits

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

directfb: Fix compilation on ARM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpn: Update to 2.3.17

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unbound - rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh remove double build pcre

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Disable all libraries that don't build on armv7hl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Properly use CFLAGS & CXXFLAGS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: fix amba modules build with gcc6

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: rpi build fix

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

glibc: Don't use locale-archive

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.6.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cmake: update to 3.8.1

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tor: Update to 3.0.8

For details see:
https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.8

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netcat 0.7.1: Update for rootfile

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

monit: Update to 5.23.0

For details see:
https://mmonit.com/monit/changes/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libxml2: update to 2.9.4

http://xmlsoft.org/news.html

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: update to 3.5.11

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bird: update to 1.6.3

Signed-off-by: Marcel Lorenz <marcel.lorenz@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "Drop paxctl"

This reverts commit ae666b0c234f9204b864292e044a0c8d182e58d2.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 3.5.26

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid 3.5.25: latest patches (14155-14167)

For details see:
http://www.squid-cache.org/Versions/v3/3.5/changesets/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Dropped 'dnsmasq' from System log

I think we don't need this anymore...

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tmux: Update to 2.5

For details see:
https://raw.githubusercontent.com/tmux/tmux/2.5/CHANGES

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Delete unused function from fwhosts.cgi

This function is not used by any other script.

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Fix remote command execution vulnerability

The OINKCODE variable was only validated for proper input
when the Save button was clicked.

Did the user demand to download new rules instead, the
content of that variable was not being validated (again)
and was passed to wget on the shell.

This was done with privileges of the "nobody" user.

Fixes #11401

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cyrus-imapd: enable on all archs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'master' into next

samba: remove winbind tevent poll patch

this not work without matching libtevent

fixes #11390

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/master' into core111

gzip: remove wrong zcat and gunzip symlinks

new gzip version use zcat and gunzip shell scripts that
add the needed parameter to gzip.

fixes: #11399

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>