remote.cgi: Move SSH Agent Forwarding to the top

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sshctrl: Fix syntax of generated sed command

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core131: Ship PTR changes in hosts.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unbound: do not generate PTR if the user requested not to, do so

Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add option for selective PTR generation on hosts.cgi

In some cases, it might be useful to create an additional
host (i.e. for round robin loadbalancing) without assigning
another PTR to the IP address specified.

This patch introduces the ability to check or uncheck
PTR generation for each host individually.

Partially fixes #12030

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

udev: Rename interfaces when MACs are uppercase

The script relied on the configuration being in lowercase.

If people manually editied their configuration file they might
not have paid attention to this and therefore this script now
also accepts uppercase MAC addresses.

Fixes: #12047
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Take as much off of the CPU as possible

https://suricata.readthedocs.io/en/suricata-4.1.3/performance/high-performance-config.html

This will compile the ruleset as efficient as possible and
allows the IPS to run faster on smaller systems.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core131: Ship updated setup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ids.cgi: Display oinkcode section after page load when neccessary.

Fixes #12048.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPS logging: Fix date comparison for last entry

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPS logging: There is no distinguation between suricata & snort required

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IPS logging: Fix reading date

The CGI script only compares mm/dd and does not care about the year.

Suricata, however, logs the year as well which has to be ignored here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: Bugfix for /etc/sudoers.d/zabbix.user

Files containing an '~' or '.' are ignored by sudo when placed in the includedir /etc/sudoers.d This makes the file useless. The file is renamed to "zabbix" instead of "zabbix.user" to fix this.

See: https://www.sudo.ws/man/1.8.13/sudoers.man.html#Including_other_files_from_within_sudoers

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zabbix_agentd: update to 4.2.0

Relase Notes: https://www.zabbix.com/rn/rn4.2.0

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer+setup: Update French translation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: fix syntax error

i have merged master>next and not deleted this line.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

Merge remote-tracking branch 'origin/master' into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

wget: Update to 1.20.3

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

"2019-04-05  Tim Ruehsen  <tim.ruehsen@gmx.de>

Fix a buffer overflow vulnerability
* src/iri.c(do_conversion): Reallocate the output buffer to a larger
  size if it is already full"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

apache: Update to 2.4.39

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: insert a core update for urgent fixes.

the bigger changes for suricata and kernel need longer time for test
so we insert a core with smaller but important fixes.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: ship strongswan

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: Ship perl-Net-SSLeay

This was still using the old version of OpenSSL.

Instead of linking the module (which we should have found earlier)
the module uses dlopen :(

Fixes: #12044
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Manually install all routes for non-routed VPNs

This is a regression from disabling charon.install_routes.

VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.

Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated wget

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.2

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

* Changes in Wget 1.20.2
** NTLM authentication will retry under certain cases
** Fixed a buffer overflow vulnerability"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.2

For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html

"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

convert-snort: Re-order steps at end of script

This will ensure that the whole IDS is configured property, if
no or an empty snort config file is present.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

convert-snort: Fix logic for detecting enough free disk space.

The subfunction only will return something if the check fails - so the logic
of the if statement was wrong set and the downloader only was called if
this check failed and to less diskspace would be available.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship SSH Agent Forwarding changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

change AllowAgentForwarding in SSHD configuration if, necessary

Fixes #11931

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

allow SSH agent forwarding to be configured via WebUI

Fixes #11931

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add language strings for SSH agent forwarding settings

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rename core130 -> core131

we need to insert a core update to fix urgent bugs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.111

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

strongswan: Manually install all routes for non-routed VPNs

This is a regression from disabling charon.install_routes.

VPNs are routing fine as long as traffic is passing through
the firewall. Traps are not propertly used as long as these
routes are not present and therefore we won't trigger any
tunnels when traffic originates from the firewall.

Fixes: #12045
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: update pakfire database after version change

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: Ship perl-Net-SSLeay

This was still using the old version of OpenSSL.

Instead of linking the module (which we should have found earlier)
the module uses dlopen :(

Fixes: #12044
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: remove lm_sensors config

the sensor search has to redone after boot the new kernel.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: ship setup binary

The setup contain a IPFire version string.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: ship pakfire version update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Postfix: update to 3.4.5

See http://www.postfix.org/announcements/postfix-3.4.5.html for
release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.3

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

"2019-04-05  Tim Ruehsen  <tim.ruehsen@gmx.de>

Fix a buffer overflow vulnerability
* src/iri.c(do_conversion): Reallocate the output buffer to a larger
  size if it is already full"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Disable CPU affinity

Benchmarks have shown, that this is making the IPS slower
across various hardware

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.110

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core130: Do not search for sensors on AWS

This causes some i2c drivers to load and tons of error messages
being created in syslog. So we skip searching for any sensors
that do not exist.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Set MTU to a default when editing an old connection

This field is required and therefore we need to initialize it
for old connections. Right now, the CGI throws an error message
when editing an existing connection without the MTU being filled
in.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated wget

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.2

For details see:
https://fossies.org/linux/wget/ChangeLog

Excerpt from "NEWS":

* Changes in Wget 1.20.2
** NTLM authentication will retry under certain cases
** Fixed a buffer overflow vulnerability"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated nettle

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nettle: Update to 3.4.1

For details see:
https://fossies.org/linux/nettle/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated GnuTLS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.6.7.1

For details see:
https://lists.gnupg.org/pipermail/gnutls-help/2019-March/004497.html

Please note:
A few days after the "3.6.7" release, "3.6.7.1" came out.

See:
https://www.gnupg.org/ftp/gcrypt/gnutls/v3.6/

But the compressed directory version is still versioned 3.6.7.

Because of this, the fourth (sub)-version number required some lfs adjustments.

And:
This version requires "nettle 3.4.1", which is sent in another commit.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

apache: Update to 2.4.39

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

freeradius: Fix extra whitespace

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

freeradius: handle special LDFLAGS to configure

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

pcengines-apu-firmware: New package

This package ships the latest BIOS for PC Engines APU boards.

With help of the firmware-update package, this can be very easily
updated when running IPFire.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firmware-update: New package

This is a script that can update firmware on PC Engines APU systems

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flashrom: New package

This is required to flash firmware

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable some debugging in expactation to increase performance

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable strict checks for /dev/mem

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

freeradius: Fix build on armv5tel

Reported-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

IDS: Rename sourcefire VRT rulesets to Talos VRT rulesets

Fixes #12019

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

Update borgbackup to version 1.1.9

Fixes: #12016
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.109

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update user regd patch from openwrt

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'ms/dfs' into next

freeradius: Update to version 3.0.18

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.2

For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html

"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound-dhcp-leases-bridge: Replace leases file atomically

When there is a large number of leases, writing the file may
take a long time. When unbound is re-reading its configuration
in that time, the file might syntactically incorrect.

This change writes the file first and then moves it
to the right place in one transaction.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Enable CPU affinity

This will tie the detection threads to a certain CPU and
slightly increases throughput on my system.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Tie queues to a CPU core

This should improve performance by a small margin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nginx: Update to 1.15.9

Fixes #12023 .
Added support for http2.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

freeradius: Bump version because package is linked against old version of OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

DHCP: Remove double colon

In some languages, there were double colons in the DNS Update section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

GeoIP: Do not crash when locations database does not exist

Fixes: #12021
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Build libedit very early

Many packages can make use of this

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship updated lua

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lua: Update to 5.3.5

For details see:

http://www.lua.org/bugs.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core130: Ship rrdtool and collectd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rrdtool: Update to 1.7.1

Disabled 'lua' because otherwise building failed.

I didn't find any place or reason where 'lua' was used by 'rrdtool', so it
was deactivated.

Disabling had no noticeable effects by now. Running.

Please note:
'/usr/lib/collectd/rrdcached.so' and '/usr/lib/collectd/rrdtool.so' have to
be updated, too.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvpn: Remove subnet check for static pools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Update to 1.3.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Install some symlinks to start the service

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsdist: Add backup include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Core 130: Remove files after convert-snort has been launched

The converter requires /etc/snort/snort.conf to grab the used rule files
(categories). After all settings have been converted, we are fine to delete all
snort related files, because none of them is needed anymore.

Also the /var/ipfire/snort directory needs to be deleted. If it will be left on the
system and at any later time a backup will get restored, the converter will be
started by the backup script, because it detects that a snort settins dir exists
and would be restore the old snort settings and replaces all current IPS settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsforward.cgi: Add DNSSEC option to legend

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dnsforward.cgi: Check DISABLE_DNSSEC checkbox when editing

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>