Bump release of all packages linked against OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Ship everything that is linked against OpenSSL

This will make sure that everything is using the new version
of the library.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Disable Path MTU discovery

This seems to be a failed concept and causes issues with transferring
large packets through an IPsec tunnel connection.

This configures the kernel to still respond to PMTU ICMP discovery
messages, but will not try this on its own.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Fix typo in initscript name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcp: Allow adding extra DHCP interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Ship missing OpenSSL configuration file for update

Core 115 delivered a patch which prevents the '--ns-cert-type server is deprecated' message
and introduced also '--remote-cert-tls server' -->
https://patchwork.ipfire.org/patch/1441/ whereby the changed ovpn.cnf has not been delivered.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: New AES-GCM cipher for N2N and RW

AES-GCM 128, 196 and 256 bit has been added to Net-to-Net and Roadwarrior section.

HMAC selection for N2N will be disabled if AES-GCM is used since GCM provides an own message authentication (GMAC).
    'auth *' line in N2N.conf will be deleted appropriately if AES-GCM is used since '--tls-auth' is not available for N2N.
HMAC selection menu for Roadwarriors is still available since '--tls-auth' is available for RWs
    which uses the configuered HMAC even AES-GCM has been applied.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl-compat: Do not try to apply missing padlock patch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl-compat: Add missing library path

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Remove deprecated sshd configuration option

This just created a warning and is now dropped

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "wget: Link against GnuTLS instead of OpenSSL"

This reverts commit a46b159a8dc0d191ee57cf48b66be8a39fd7d9ec.

wget 1.19.4 supports linking against OpenSSL 1.1.0.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Remove forgotten PHP file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Ship updated OpenSSL 1.1.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'openssl-11' into next

Start Core Update 120

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core119: Reload apache after configuration changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

disable Apache server signature

Sending the server signature is unnecessary and might leak
some internal information (although ServerTokens is already
set to "Prod").

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Don't backup apache configuration, keys only

In the past the apache configuration was part of the backup
and may have been restored after Core Update 118 was installed
with PHP being dropped amongst other things.

This patch will make sure that only keys are being backuped.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Update to 5.6.2

Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS
signatures that was caused by insufficient input validation.
One of the configurable parameters in algorithm identifier
structures for RSASSA-PSS signatures is the mask generation
function (MGF). Only MGF1 is currently specified for this purpose.
However, this in turn takes itself a parameter that specifies
the underlying hash function. strongSwan's parser did not
correctly handle the case of this parameter being absent,
causing an undefined data read.

This vulnerability has been registered as CVE-2018-6459.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Try to restart always-on tunnels immediately

When a tunnel that is in always-on configuration closes
unexpectedly, we can instruct strongSwan to restart it
immediately which is precisely what we do now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for armv5tel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

haproxy: Link against libatomic on ARM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

i2c-tools: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flac: Update to 1.3.2

The previous version fails to build on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Added needed directive for v2.4 update

script-security: The support for the 'system' flag has been removed due to security implications
    with shell expansions when executing scripts via system() call.
    For more informations: https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage .

ncp-disable: Negotiable crypto parameters has been disabled for the first.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core119: Ship changed proxy.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy.cgi: remove excessive newlines in generated proxy.pac

Remove excessive newlines in generated proxy.pac

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bump toolchain version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for glibc on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nagios-plugins: Update rootfiles

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zlib: Fix name of logfile in toolchain build

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sslh: Build without tcpwrappers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

toolchain: Add zlib

ccache needs this and usually comes with an own bundled
version but fails to build in version 3.4.1.

Since this is a small library only and we really want
ccache to use compression, we will build this indepently
and let ccache use it from the system.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bump toolchain version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Cleanup toolchain scripts

No functional changes, just some tidy up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ccache: Update to 3.4.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

PAM: Drop shipped configuration

This is outdated, broken and has hardcoded passwords.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop perl-DBD-mysql

This package is not used by anything and depends on MySQL
which has been dropped, too.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop MySQL

This is outdated and still on 5.0.x and nobody volunteered to
update this package.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

asterisk: Do not depend on MySQL any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Don't depend on amavis

This can be used together but there is no need to
always install amavis when someone wants to use postfix

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Don't depend on MySQL any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Don't ship our own configuration

This is outdated and half of it is not maintained any more.

Users should configure postfix themselves based on the
default configuration.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop pammysql

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop tcpwrapper

This library has been unused for quite a while

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop mISDN userspace tools

This is unsupported for quite a while and nobody should be using this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop capi4k-utils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core119: Remove dropped lcr package during update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core119: Import changed packages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 119

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for bison

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Mark unsecure ciphers and DH-parameter as 'weak' in WUI menu

64 bit block ciphers like Blowfish, TDEA and CAST5 are vulnerable to the so called 'Birthday attacks' .
    Infos for 'Sweet32' Birthday attacks can be found in here
        https://sweet32.info/ .
    An Overview of 64 bit clock ciphers can also be found in here
        http://en.citizendium.org/wiki/Block_cipher/Catalogs/Cipher_list#64-bit_blocks

1024 bit Diffie-Hellman parameter has also been marked as weak causing the 'Logjam Attack' .
   Infos for 'Logjam Attack' can be found in here
        https://weakdh.org/ .

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

index.cgi: Properly show IPsec subnets

Fixes: #11604
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

CRL updater: Update script for OpenVPNs CRL

Update script for OpenVPNs CRL cause OpenVPN refactors the CRL handling since v.2.4.0 .
    Script checks the next update field from the CRL and executes an update before it expires.
    Script is placed under fcron.daily for daily checks.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Properly pass CFLAGS and LDFLAGS to build

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Package openssl-compat (1.0.2.n)

This is provided for compatibility with binaries that have
been compiled against this version of OpenSSL.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Update to version 2.4.4

Changed LFS and ROOTFILE for OpenVPN 2.4.4 update.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python-m2crypto: Install in correct directory

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Enable engines

Some tools that depend on openssl won't compile without it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Link against GnuTLS instead of OpenSSL

This version does not seem to be compatible with OpenSSL 1.1
and might be changed back to OpenSSL when ever it will compile.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python-m2crypto: Update to 0.27.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python-typing: Required for m2crypto

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

transmission: Patch to build against OpenSSL 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

net-snmp: Patch to build against OpenSSL 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

elinks: Patch to build against OpenSSL 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ncat: Update to 7.60

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

krb5: Update to 1.15.2 to build against OpenSSL 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssh: Update to 7.6p1 and patch against OpenSSL 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Net-SSLeay: Update to 1.82

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cyrus-sasl: Disable OTP to build against OpenSSL 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Update to version 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Bump toolchain version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

qemu: Make it build with newer glibcs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nfs: Fix building with newer glibcs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Enable obsolete NSL

This will re-activate the deprecated NIS code on which lots of
software relies on so that we can have some extra time to migrate.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Config: Set PREFIX either to TOOLS_DIR or /usr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: CFLAGS: There is no evidence that supports enabling retpoline in user space is a good idea

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libtirpc: Fix build against newer glibcs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Update to 2.30

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dma: Don't only use TLSv1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Temporarily disable NIS

This makes postfix FTBFS because glibc has removed their
RPC headers.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Update to 2.27

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flex: Patch against SEGV with newer glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "make.sh: Add -fstack-clash-protection on platforms that support it"

This reverts commit 18b82970b81a5bbd31b8922440a97e43d6f01566.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Enable cheap out-of-bounds checks in C++ standard library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Add -fstack-clash-protection on platforms that support it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: CFLAGS remove --param=ssp-buffer-size=4

This flag is useless with -fstack-protector-strong

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pam: Update to 1.30.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: make requires pkg-config to run autoconf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iproute2: Update to 4.14.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostname: Update to 3.20

Drops dependency to obsolete RPCSVC code in glibc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make: Patch against SEGV when using globbing functions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

toolchain: Add bison

This is required by glibc 2.27

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: fix gmp download

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>