Revert "IPsec: Try to restart always-on tunnels immediately"

This reverts commit a261cb06c6cdd3ba14ad0163c8c9e714ae94fc5b.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mpd: bump package to remove link against tcpwrapper

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core119: set pakfire version to 119

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core119: restart init after unpack new glibc

this is needed to prevent problems at unmout filesystems at reboot.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core119: Ship updated libgcc_s.so.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/next'

core119: Reload apache after configuration changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

disable Apache server signature

Sending the server signature is unnecessary and might leak
some internal information (although ServerTokens is already
set to "Prod").

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Don't backup apache configuration, keys only

In the past the apache configuration was part of the backup
and may have been restored after Core Update 118 was installed
with PHP being dropped amongst other things.

This patch will make sure that only keys are being backuped.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Update to 5.6.2

Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS
signatures that was caused by insufficient input validation.
One of the configurable parameters in algorithm identifier
structures for RSASSA-PSS signatures is the mask generation
function (MGF). Only MGF1 is currently specified for this purpose.
However, this in turn takes itself a parameter that specifies
the underlying hash function. strongSwan's parser did not
correctly handle the case of this parameter being absent,
causing an undefined data read.

This vulnerability has been registered as CVE-2018-6459.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPsec: Try to restart always-on tunnels immediately

When a tunnel that is in always-on configuration closes
unexpectedly, we can instruct strongSwan to restart it
immediately which is precisely what we do now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for armv5tel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

haproxy: Link against libatomic on ARM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

i2c-tools: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flac: Update to 1.3.2

The previous version fails to build on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core119: Ship changed proxy.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

proxy.cgi: remove excessive newlines in generated proxy.pac

Remove excessive newlines in generated proxy.pac

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bump toolchain version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for glibc on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nagios-plugins: Update rootfiles

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zlib: Fix name of logfile in toolchain build

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sslh: Build without tcpwrappers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

toolchain: Add zlib

ccache needs this and usually comes with an own bundled
version but fails to build in version 3.4.1.

Since this is a small library only and we really want
ccache to use compression, we will build this indepently
and let ccache use it from the system.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Bump toolchain version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Cleanup toolchain scripts

No functional changes, just some tidy up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ccache: Update to 3.4.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

PAM: Drop shipped configuration

This is outdated, broken and has hardcoded passwords.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop perl-DBD-mysql

This package is not used by anything and depends on MySQL
which has been dropped, too.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop MySQL

This is outdated and still on 5.0.x and nobody volunteered to
update this package.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

asterisk: Do not depend on MySQL any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Don't depend on amavis

This can be used together but there is no need to
always install amavis when someone wants to use postfix

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Don't depend on MySQL any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Don't ship our own configuration

This is outdated and half of it is not maintained any more.

Users should configure postfix themselves based on the
default configuration.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop pammysql

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop tcpwrapper

This library has been unused for quite a while

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop mISDN userspace tools

This is unsupported for quite a while and nobody should be using this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop capi4k-utils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core119: Remove dropped lcr package during update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core119: Import changed packages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 119

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for bison

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Mark unsecure ciphers and DH-parameter as 'weak' in WUI menu

64 bit block ciphers like Blowfish, TDEA and CAST5 are vulnerable to the so called 'Birthday attacks' .
    Infos for 'Sweet32' Birthday attacks can be found in here
        https://sweet32.info/ .
    An Overview of 64 bit clock ciphers can also be found in here
        http://en.citizendium.org/wiki/Block_cipher/Catalogs/Cipher_list#64-bit_blocks

1024 bit Diffie-Hellman parameter has also been marked as weak causing the 'Logjam Attack' .
   Infos for 'Logjam Attack' can be found in here
        https://weakdh.org/ .

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

index.cgi: Properly show IPsec subnets

Fixes: #11604
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Bump toolchain version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

qemu: Make it build with newer glibcs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nfs: Fix building with newer glibcs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Enable obsolete NSL

This will re-activate the deprecated NIS code on which lots of
software relies on so that we can have some extra time to migrate.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Config: Set PREFIX either to TOOLS_DIR or /usr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: CFLAGS: There is no evidence that supports enabling retpoline in user space is a good idea

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libtirpc: Fix build against newer glibcs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Update to 2.30

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dma: Don't only use TLSv1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Temporarily disable NIS

This makes postfix FTBFS because glibc has removed their
RPC headers.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Update to 2.27

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flex: Patch against SEGV with newer glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "make.sh: Add -fstack-clash-protection on platforms that support it"

This reverts commit 18b82970b81a5bbd31b8922440a97e43d6f01566.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Enable cheap out-of-bounds checks in C++ standard library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Add -fstack-clash-protection on platforms that support it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: CFLAGS remove --param=ssp-buffer-size=4

This flag is useless with -fstack-protector-strong

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pam: Update to 1.30.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: make requires pkg-config to run autoconf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iproute2: Update to 4.14.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostname: Update to 3.20

Drops dependency to obsolete RPCSVC code in glibc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make: Patch against SEGV when using globbing functions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

toolchain: Add bison

This is required by glibc 2.27

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: fix gmp download

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

toolchain: update to gcc-7.3.0 and enable retpolines on x86_64 and i586

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

mdadm: fix build with gcc-7

sarg: update to 2.3.11 (needed for gcc-7)

powertop: update to v2.9 (needed for gcc-7)

bwm-ng: update to 0.6.1-f54b3fa (needed for gcc-7)

diffultis: update to 3.1.6 (needed for gcc-7)

u-boot: link missing header for gcc-7

vdr: disabled because it will not build with gcc-7

unbound: Fix reverse lookup zones

These should be stubs and overlay the internal zones that
unbound comes with.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes: #11625

Merge commit '0da2f155fdfa9b060840e9d7ee6229577cb52162'

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Fix capitalisation of "Root Certificate"

Reported-by: Tom Rymes <trymes@rymes.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes: #10595

Update: nut to 2.7.4

Signed-off-by: Paul T. Simmons <mbatranch@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bacula: Update to 9.0.6

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop lcr

Does not build with newer versions of Asterisk

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

asterisk: Update to 13.18.5

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Add new package: jansson

A JSON library required by asterisk >= 13

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvmtools: Update to 10.2.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

haproxy: Update to version 1.8.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

stunnel: Update to 5.44

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nginx: Update to 1.13.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

swig: Update to 3.0.12

Required to build recent versions of m2crypto.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

postfix: Update to 3.2.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop libevent2-compat which doesn't build against OpenSSL 1.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core118: Ship changed vpnmain.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

syslogdctrl: Fix sed syntax issues

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core118: Ship changed ovpnmain.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'origin/next'

remove dropped pakages to make sure that apache not miss php files.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/next'

core118: Ship forgotten menu file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>