core130: ship strongswan

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: Ship perl-Net-SSLeay

This was still using the old version of OpenSSL.

Instead of linking the module (which we should have found earlier)
the module uses dlopen :(

Fixes: #12044
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Manually install all routes for non-routed VPNs

This is a regression from disabling charon.install_routes.

VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.

Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated wget

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.2

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

* Changes in Wget 1.20.2
** NTLM authentication will retry under certain cases
** Fixed a buffer overflow vulnerability"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.2

For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html

"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

amavisd: update to 2.11.1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.4.3

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Set the clock correctly when installing over network

If a system has a not very up to date clock, downloading files
over HTTPS is impossible.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: finish update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: try to boot without ramdisk if the system cannot load it

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

knot: update to 2.8.0 and build/install only kdig

This fix compile errors on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

groff: update to 1.22.4

This fix compile problems on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Revert "kernel: cleanup unused rpi patch"

This reverts commit a2d49659f3947e5a5a77cbc1bf384eb0b2760ca9.

The patch is still needed to prevent strange crashes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated dnsforward.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'ms/dns-forwarding' into next

core129: Ship updated dhcp.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'ms/dhcp' into next

Tor WebUI: drop relay bandwith options < 1 MBit/s

Tor requires at least 1 MBit/s in order to participate.

Fixes #12001

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Limit to fewer concurrent build processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated less

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

less: update to 530

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.4.1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

slang: revert parallelized build

This partially reverts https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=lfs/slang;h=217e74c77317d4c829913f934458779fd278bf29;hb=23164efba5f57b3d8ccb07a166b613f2f951e1b6

'slang 2.3.0' doesn't like "$(MAKETUNING)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

/etc/group: Order groups by ID

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

/etc/passwd: Order users by ID

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agent: Create /var/run/zabbix in initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agent: Ensure that the user exists on all systems

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: New addon

New addon for monitoring IPFire by Zabbix Monitoring (https://www.zabbix.com/features).
See https://forum.ipfire.org/viewtopic.php?f=52&t=22039 and https://lists.ipfire.org/pipermail/development/2019-February/005324.html for further details.

Best regards,
Alex

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iptables: Commented legacy ip(6)tables entries from ROOTFILE

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Download ISO via HTTPS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "boost: Build with -O2 only"

This reverts commit 9ff5b381eb8a4e129978c34f969e312c302ea7b1.

Boost wants to build with -O3 no matter what

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Mark domains as insecure from DNS forwarding

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DNS Forwarding: Add UI to Allow to disable DNSSEC for a zone

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'ipsec-on-demand' into next

vpnmain.cgi: Make on-demand mode default for IPsec VPNs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Carry over START_ACTION attribute correctly

This setting was not carried correctly and therefore the default was ignored.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Fit more processes into memory

Because we have a good way to limit processes now, we should
increase the default size a little bit

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Build with -O2 only

This should increase build speed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Config: Builds don't seem to like the space

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

perl: Limit build to 23 parallel processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Introduce MAX_PARALLELISM

This will now adjust MAKETUNING to not launch more processes
than MAX_PARALLELISM. Handy to limit builds that use a lot of memory.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Drop MAKETUNING

This is now set in lfs/Config

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Introduce DEFAULT_PARALLELISM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Use variable instead of calling system_processors function again

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Rename HOST_MEM to SYSTEM_MEMORY

We had two variables holding the same data

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Pass number of processors and total memory so that we can adjust MAKETUNING

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Parallelized build for several packages

Added $(MAKETUNING) to several packages.
Marked packages that do not support parallel build.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship wpa_supplicant

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wpa_supplicant: Update to 2.7

For details see:
https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.7

For details see:
https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog

This patch sticks to 'wpa_supplicant: Update to 2.7'.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmp: Fix rootfile to build on other architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmpd: OpenSSL patch is incl. in new version

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

netsnmpd: Update to version 5.8

Overview of the changes can be found in here https://sourceforge.net/p/net-snmp/mailman/message/36386084/ .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iptables: Update to 1.8.2

netfilter-layer7 has also been updated to v2.23 .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unpack intel microcode before initramfs images are being built

Previously, the microcode updates were not packaged in the shipped
initramfs images which causes that Intel processors are still running
on outdated microcode.

This patch moves intel-microcode before we build the initramfs images.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated proxy.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bug 12008 - Typo in 'proxy.cgi' leads to wrong path for 'basic_ldap_auth'

Hi,

This should fix https://bugzilla.ipfire.org/show_bug.cgi?id=12008

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated ipset

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipset: Update to version 7.1

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated tar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tar: Update to 1.32

For details see:
http://git.savannah.gnu.org/cgit/tar.git/log/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.6

For details see:
http://ftp.isc.org/isc/bind9/9.11.6/RELEASE-NOTES-bind-9.11.6.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 4.6

For details see:
http://www.squid-cache.org/Versions/v4/changesets/

The 'configure'-option "--disable-ipv6" was removed, it is no longer necessary.

See:
https://lists.ipfire.org/pipermail/development/2016-April/002046.html

"The --disable-ipv6 build option is now deprecated.
...
Squid-3.5.7 and later will perform IPv6 availability tests on startup in
all builds.

- Where IPv6 is unavailable Squid will continue exactly as it would
have had the build option not been used.

These Squid can have the build option removed now."

The warning message concerning a "BCP 177 violation" while
starting 'squid' can be ignored.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

spectre-meltdown-checker: New package

This makes it easy to install the script and check the vulnerability status
of a system IPFire is running on.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Ship strings & readelf

This is needed by the spectre meltdown checker script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update German translation

Mainly adds translation for new IPsec features

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update of French translation

- Several syntax / vocabulary improvements
- A 2 text missing in the French version
- Improvement of text offering a donation for the users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sysctl.conf: Revert enabling busy loop waiting on sockets

This causes the firmware in my ath10k module to crash.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update openssl rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Update to 1.1.1b

This is a bug fix only release

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Fix error when editing a newly added fixed lease

They key was remembered but then the array was sorted which resulted
the key showing a wrong line.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Restart server in background

This allows for the CGI to return quicker.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Escape slashes in filename

Fixes: #12006
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated credits.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated OpenVPN

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Update to version 2.4.7

Changelog can be found in here https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update Tor to 0.3.5.8

See https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312
for release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update metrics links in Tor WebUI

https://atlas.torproject.org/ is deprecated in favour of
https://metrics.torproject.org/ by now.

Fixes #11781.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated libgcrypt

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: update to 1.8.4

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.9.0

For details see:
https://nlnetlabs.nl/svn/unbound/tags/release-1.9.0/doc/Changelog

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core129: Ship changes from ipsec branch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'ipsec' into next

Start Core Update 129

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add script to search for missing libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: Drop old openssl engines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cups: Depends on bluetooth library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core128: add openldap to update

openldap was linked against old openssl lib

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: add sse2 openssl libs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: apply local sshd config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.103

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core128: finish core128

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>