people/pmueller/ipfire-2.x.git
9 months agoIPsec: Update ipsec.conf for GRE/VTI changes
Michael Tremer [Wed, 28 Nov 2018 20:37:32 +0000 (20:37 +0000)] 
IPsec: Update ipsec.conf for GRE/VTI changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoIPsec: Add UI for set interface MTU
Michael Tremer [Wed, 28 Nov 2018 14:46:15 +0000 (14:46 +0000)] 
IPsec: Add UI for set interface MTU

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoIPsec: Add option to configure IP address for tunnel interface
Michael Tremer [Wed, 28 Nov 2018 14:38:11 +0000 (14:38 +0000)] 
IPsec: Add option to configure IP address for tunnel interface

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoIPsec: Set default inactivity timeout to half an hour
Michael Tremer [Wed, 28 Nov 2018 14:24:03 +0000 (14:24 +0000)] 
IPsec: Set default inactivity timeout to half an hour

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoIPsec: New connections should defatul to on-demand mode
Michael Tremer [Wed, 28 Nov 2018 14:23:26 +0000 (14:23 +0000)] 
IPsec: New connections should defatul to on-demand mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoIPsec: Add dropdown to select tunnel interface mode
Michael Tremer [Wed, 28 Nov 2018 14:21:33 +0000 (14:21 +0000)] 
IPsec: Add dropdown to select tunnel interface mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agovpnmain.cgi: Correctly carry over INACTIVITY_TIMEOUT
Michael Tremer [Wed, 28 Nov 2018 14:07:30 +0000 (14:07 +0000)] 
vpnmain.cgi: Correctly carry over INACTIVITY_TIMEOUT

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoIPsec: Write tunnel/transport mode to strongSwan configuration
Michael Tremer [Tue, 27 Nov 2018 18:42:07 +0000 (18:42 +0000)] 
IPsec: Write tunnel/transport mode to strongSwan configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoIPsec: Add selection for transport/tunnel mode
Michael Tremer [Tue, 27 Nov 2018 18:38:51 +0000 (18:38 +0000)] 
IPsec: Add selection for transport/tunnel mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopython3-msgpack: Fix build on i586
Jonatan Schlag [Tue, 5 Feb 2019 18:33:31 +0000 (18:33 +0000)] 
python3-msgpack: Fix build on i586

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopython3-dateutil: Update rootfiles
Michael Tremer [Mon, 4 Feb 2019 07:00:13 +0000 (07:00 +0000)] 
python3-dateutil: Update rootfiles

Changed because of new python3-setuptools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated dhcpcd
Michael Tremer [Mon, 4 Feb 2019 00:40:02 +0000 (00:40 +0000)] 
core128: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agodhcpcd: Update to 7.1.0
Matthias Fischer [Mon, 4 Feb 2019 17:38:44 +0000 (18:38 +0100)] 
dhcpcd: Update to 7.1.0

For some informations about this update see:
https://roy.marples.name/blog/dhcpcd-7-1-0-released

"dhcpcd-7.1.0 has been released with the following changes:

- OpenBSD: works alongside slaacd(8)
- NetBSD: sets SO_RERROR on to detect receive socket overflow
- BSD: route improvements to avoid listening for own changes
- Linux: use NETLINK_BROADCAST_ERROR
- BSD: avoid late address deletion messages by testing address existance
- IP6: implement IP6 address sharing
- BSD: catch UP/DOWN events when interfaces does support media changes
- IPv4LL: remember old address when carrier is lost

Many other minor fixes and documenation updates have been submitted by various
community members for this release..."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated curl
Michael Tremer [Mon, 4 Feb 2019 00:15:24 +0000 (00:15 +0000)] 
core128: Ship updated curl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocurl: Update to 7.63.0
Matthias Fischer [Mon, 4 Feb 2019 17:30:54 +0000 (18:30 +0100)] 
curl: Update to 7.63.0

For details see:
https://curl.haxx.se/changes.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoupdate.sh: Delete .rnd files
Erik Kapfer [Sat, 2 Feb 2019 07:46:12 +0000 (08:46 +0100)] 
update.sh: Delete .rnd files

Since RANDFILE has been disabled in OpenSSL configurations, .rnd files are not needed anymore.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated apr
Michael Tremer [Sun, 3 Feb 2019 21:42:43 +0000 (21:42 +0000)] 
core128: Ship updated apr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoUpdated apr, stabilized apache build
Wolfgang Apolinarski [Sun, 3 Feb 2019 14:11:58 +0000 (15:11 +0100)] 
Updated apr, stabilized apache build

- Updated apr to 1.6.5
- Stabilized apache build (rebuild)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopython3-llfuse: fix rootfile for non x86_64 builds
Arne Fitzenreiter [Sun, 3 Feb 2019 14:28:52 +0000 (15:28 +0100)] 
python3-llfuse: fix rootfile for non x86_64 builds

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agokernel: update to 4.14.97
Arne Fitzenreiter [Sun, 3 Feb 2019 11:45:52 +0000 (12:45 +0100)] 
kernel: update to 4.14.97

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agohaproxy: Bump version to support TLSv1.3 (and PCRE JIT)
Michael Tremer [Fri, 1 Feb 2019 17:34:02 +0000 (17:34 +0000)] 
haproxy: Bump version to support TLSv1.3 (and PCRE JIT)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Restart updated apache
Michael Tremer [Fri, 1 Feb 2019 17:12:23 +0000 (17:12 +0000)] 
core128: Restart updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoapache: Update to 2.4.38
Matthias Fischer [Fri, 1 Feb 2019 17:06:38 +0000 (18:06 +0100)] 
apache: Update to 2.4.38

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.38

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship AWS scripts again
Michael Tremer [Fri, 1 Feb 2019 17:08:44 +0000 (17:08 +0000)] 
core128: Ship AWS scripts again

It seems that this was missing in Core Update 125/126 so not all
bug fixes made it into the release.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package borgbackup
Jonatan Schlag [Fri, 1 Feb 2019 11:52:45 +0000 (11:52 +0000)] 
Add new package borgbackup

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-msgpack
Jonatan Schlag [Fri, 1 Feb 2019 11:52:44 +0000 (11:52 +0000)] 
Add new package python3-msgpack

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-llfuse
Jonatan Schlag [Fri, 1 Feb 2019 11:52:43 +0000 (11:52 +0000)] 
Add new package python3-llfuse

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-setuptools-scm
Jonatan Schlag [Fri, 1 Feb 2019 11:52:42 +0000 (11:52 +0000)] 
Add new package python3-setuptools-scm

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-settuptools
Jonatan Schlag [Fri, 1 Feb 2019 11:52:41 +0000 (11:52 +0000)] 
Add new package python3-settuptools

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Delete SSE2-optimised legacy OpenSSL libraries, too
Michael Tremer [Wed, 30 Jan 2019 18:37:26 +0000 (18:37 +0000)] 
core128: Delete SSE2-optimised legacy OpenSSL libraries, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated OpenSSL configuration files
Michael Tremer [Tue, 29 Jan 2019 13:51:37 +0000 (13:51 +0000)] 
core128: Ship updated OpenSSL configuration files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agodel_rand: Deletion of RAND file in openssl config
Erik Kapfer [Tue, 8 Jan 2019 19:33:32 +0000 (20:33 +0100)] 
del_rand: Deletion of RAND file in openssl config

Fixes #11943

Since the kernel RNG should do this, there is no need for this anymore.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoghostscript: Update to 9.26
Matthias Fischer [Sun, 27 Jan 2019 17:38:04 +0000 (18:38 +0100)] 
ghostscript: Update to 9.26

For details see:
https://www.ghostscript.com/doc/9.26/News.htm

This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")

Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-4286563.html

I saw this article and found it could be the time for an update...

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoEnable some performance tuning
Michael Tremer [Thu, 24 Jan 2019 12:31:27 +0000 (12:31 +0000)] 
Enable some performance tuning

These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.

Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.

On a slower system (apu1d) no performance improvement or loss
could have been measured.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoproxy: Show error messages in English by default
Michael Tremer [Wed, 23 Jan 2019 06:21:53 +0000 (06:21 +0000)] 
proxy: Show error messages in English by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoPostfix: update to 3.3.2
Peter Müller [Wed, 23 Jan 2019 20:34:13 +0000 (21:34 +0100)] 
Postfix: update to 3.3.2

See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated ca-certificates
Michael Tremer [Wed, 23 Jan 2019 05:40:41 +0000 (05:40 +0000)] 
core128: Ship updated ca-certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoupdate ca-certificates CA bundle
Peter Müller [Wed, 23 Jan 2019 19:59:41 +0000 (20:59 +0100)] 
update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated openssh
Michael Tremer [Wed, 23 Jan 2019 05:40:04 +0000 (05:40 +0000)] 
core128: Ship updated openssh

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoOpenSSH: update to 7.9p1
Peter Müller [Wed, 23 Jan 2019 19:54:07 +0000 (20:54 +0100)] 
OpenSSH: update to 7.9p1

Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoMerge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Wed, 23 Jan 2019 20:19:01 +0000 (21:19 +0100)] 
Merge remote-tracking branch 'origin/master' into next

9 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Wed, 23 Jan 2019 20:18:44 +0000 (21:18 +0100)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

9 months agokernel: update to 4.14.95
Arne Fitzenreiter [Wed, 23 Jan 2019 17:38:14 +0000 (18:38 +0100)] 
kernel: update to 4.14.95

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agouse HTTPS for downloading GeoIP database files
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)] 
use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoxtables-addons: Fix generating GeoIP database
Michael Tremer [Wed, 23 Jan 2019 04:10:23 +0000 (04:10 +0000)] 
xtables-addons: Fix generating GeoIP database

Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.

This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.

This patch changes this so that the last 12 bytes are just being dropped.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated tzdata
Michael Tremer [Wed, 23 Jan 2019 03:06:07 +0000 (03:06 +0000)] 
core128: Ship updated tzdata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agotzdata: update to 2018i
Peter Müller [Wed, 23 Jan 2019 15:00:57 +0000 (16:00 +0100)] 
tzdata: update to 2018i

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agostrongswan: Update to 5.7.2
Michael Tremer [Tue, 22 Jan 2019 05:31:21 +0000 (05:31 +0000)] 
strongswan: Update to 5.7.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agokernel: x86_64 encrease NR_CPUS to 64
Arne Fitzenreiter [Tue, 22 Jan 2019 06:46:08 +0000 (07:46 +0100)] 
kernel: x86_64 encrease NR_CPUS to 64

fixes #11963

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agokernel: update to 4.14.94
Arne Fitzenreiter [Tue, 22 Jan 2019 06:41:18 +0000 (07:41 +0100)] 
kernel: update to 4.14.94

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore128: Ship updated xt_geoip_update script
Michael Tremer [Mon, 21 Jan 2019 21:04:10 +0000 (21:04 +0000)] 
core128: Ship updated xt_geoip_update script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agouse HTTPS for downloading GeoIP database files
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)] 
use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated logrotate
Michael Tremer [Mon, 21 Jan 2019 10:20:29 +0000 (10:20 +0000)] 
core128: Ship updated logrotate

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agologrotate: Update to 3.15
Matthias Fischer [Sun, 20 Jan 2019 17:07:47 +0000 (18:07 +0100)] 
logrotate: Update to 3.15

For details see:
https://github.com/logrotate/logrotate/releases

- timer unit: change trigger fuzz from 12h to 1h (#230)
- service unit: only run if /var/log is mounted (#230)
- preserve fractional part of timestamps when compressing (#226)
- re-indent source code using spaces only (#188)
- minage: avoid rounding issue while comparing the amount of seconds (#36)
- never remove old log files if rotate -1 is specified (#202)
- return non-zero exit status if a config file contains an error (#199)
- make copytruncate work with rotate 0 (#191)
- warn user if both size and the time interval options are used (#192)
- pass rotated log file name as the 2nd argument of the postrotate script
  when sharedscript is not enabled (#193)
- rename logrotate-default to logrotate.conf (#187)

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoMerge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Sat, 19 Jan 2019 18:58:48 +0000 (19:58 +0100)] 
Merge remote-tracking branch 'origin/master' into next

9 months agocore127: run xt_geoip_update
Arne Fitzenreiter [Sat, 19 Jan 2019 16:24:47 +0000 (17:24 +0100)] 
core127: run xt_geoip_update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: ovpn ca index.txt is also missing on some installations
Arne Fitzenreiter [Sat, 19 Jan 2019 16:20:51 +0000 (17:20 +0100)] 
core127: ovpn ca index.txt is also missing on some installations

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agoxt_geoip_updte: fix download url
Arne Fitzenreiter [Sat, 19 Jan 2019 14:16:43 +0000 (15:16 +0100)] 
xt_geoip_updte: fix download url

the maxmind server delivers an old version if there are
two slashes before the database filename.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: fix typo
Arne Fitzenreiter [Sat, 19 Jan 2019 11:08:07 +0000 (12:08 +0100)] 
core127: fix typo

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: add ovpn ca changes to update
Arne Fitzenreiter [Sat, 19 Jan 2019 09:02:17 +0000 (10:02 +0100)] 
core127: add ovpn ca changes to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: add xt_geoip_update to update
Arne Fitzenreiter [Sat, 19 Jan 2019 09:01:40 +0000 (10:01 +0100)] 
core127: add xt_geoip_update to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: add bind to update
Arne Fitzenreiter [Sat, 19 Jan 2019 09:00:54 +0000 (10:00 +0100)] 
core127: add bind to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: set reboot needed flag
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:39 +0000 (13:53 +0100)] 
core127: set reboot needed flag

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: add general-functions.pl to updater
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:06 +0000 (13:53 +0100)] 
core127: add general-functions.pl to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: fix updater for aarch64 and armv5tel
Arne Fitzenreiter [Fri, 18 Jan 2019 06:52:17 +0000 (07:52 +0100)] 
core127: fix updater for aarch64 and armv5tel

if a arch specific filelist has the same name as the common the common filelist was ignored

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agoRevert "Disable Path MTU discovery"
Michael Tremer [Thu, 17 Jan 2019 19:24:46 +0000 (19:24 +0000)] 
Revert "Disable Path MTU discovery"

This reverts commit 1c0cfaa5949e4303e8e4e2f041af86a812f3fe6c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agodrop orphaned OpenSSL patches
Peter Müller [Mon, 5 Nov 2018 15:21:43 +0000 (16:21 +0100)] 
drop orphaned OpenSSL patches

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agocore128: Remove openssl-compat package
Michael Tremer [Thu, 17 Jan 2019 14:41:54 +0000 (14:41 +0000)] 
core128: Remove openssl-compat package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agodrop openssl-compat package
Peter Müller [Mon, 5 Nov 2018 15:12:40 +0000 (16:12 +0100)] 
drop openssl-compat package

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agocore128: Ship recently updated openssl and apache
Michael Tremer [Thu, 17 Jan 2019 14:39:14 +0000 (14:39 +0000)] 
core128: Ship recently updated openssl and apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoStart Core Update 128
Michael Tremer [Thu, 17 Jan 2019 14:38:01 +0000 (14:38 +0000)] 
Start Core Update 128

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agohttpd: include TLS 1.3 cipher suites
Peter Müller [Tue, 15 Jan 2019 14:39:25 +0000 (15:39 +0100)] 
httpd: include TLS 1.3 cipher suites

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Erik Kapfer <erik.kapfer@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoopenssl: Update to version 1.1.1a
Erik Kapfer [Tue, 15 Jan 2019 14:43:01 +0000 (15:43 +0100)] 
openssl: Update to version 1.1.1a

Disabled MD2 and Aria cipher.

TLSv1.3 is now available with:

TLS_CHACHA20_POLY1305_SHA256 TLSv1.3
TLS_AES_256_GCM_SHA384  TLSv1.3
TLS_AES_128_GCM_SHA256  TLSv1.3

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agocore127: set pakfire version to 127
Arne Fitzenreiter [Wed, 16 Jan 2019 21:31:43 +0000 (22:31 +0100)] 
core127: set pakfire version to 127

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agokeepalived: Move change of conntrack sysctl option into package
Michael Tremer [Sun, 13 Jan 2019 11:50:26 +0000 (12:50 +0100)] 
keepalived: Move change of conntrack sysctl option into package

The setting cannot be set on the default system because the ip_vs
module is not loaded by default and there is no reason to load it
just because we would be able to set the setting.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoGeoIP: Add accidentially removed paths to database
Michael Tremer [Sun, 13 Jan 2019 11:28:10 +0000 (12:28 +0100)] 
GeoIP: Add accidentially removed paths to database

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agofirewall-lib.pl: Fix incorrect path to geoip-functions.pl
Michael Tremer [Sun, 13 Jan 2019 10:53:41 +0000 (11:53 +0100)] 
firewall-lib.pl: Fix incorrect path to geoip-functions.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agolinux-initrd: fix build of uInit on aarch64
Arne Fitzenreiter [Sat, 12 Jan 2019 19:01:00 +0000 (20:01 +0100)] 
linux-initrd: fix build of uInit on aarch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agocore127: fix xtables kmod rootfiles for arm32 builds
Arne Fitzenreiter [Sat, 12 Jan 2019 08:04:23 +0000 (09:04 +0100)] 
core127: fix xtables kmod rootfiles for arm32 builds

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
10 months agoxtables 3.2: Fix for rootfile
Matthias Fischer [Fri, 11 Jan 2019 13:41:57 +0000 (14:41 +0100)] 
xtables 3.2: Fix for rootfile

Found during the test builds...

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoRevert "geoip-functions.pl: Re-write code to lookup the iso country code of a given...
Stefan Schantl [Fri, 11 Jan 2019 09:05:24 +0000 (10:05 +0100)] 
Revert "geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address."

Enhanching the code to fix the lookup will rapidely slow down the lookup speed. Because using
the GeoIP2 module is no option ( the reasons have been described in the commit message which will
now reverted), we have decided to temporary switch back to the old module until a nice solution has
been found.

This reverts commit ff21ff90d24de0f648d24bb906c45738b81ce67a.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoRevert "GeoIP: Drop legacy GeoIP perl module."
Stefan Schantl [Fri, 11 Jan 2019 09:05:23 +0000 (10:05 +0100)] 
Revert "GeoIP: Drop legacy GeoIP perl module."

This reverts commit 9d1708e081d7e7ba490db3620509dcce29cb0ae8.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoxtables-addons: Fix typo in lfs
Matthias Fischer [Fri, 11 Jan 2019 00:32:37 +0000 (01:32 +0100)] 
xtables-addons: Fix typo in lfs

Just some typos...

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoBump kernel version to ship a new PAE kernel
Michael Tremer [Thu, 10 Jan 2019 22:48:25 +0000 (22:48 +0000)] 
Bump kernel version to ship a new PAE kernel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agocore127: Ship updated kernel modules for xtables
Michael Tremer [Thu, 10 Jan 2019 22:46:31 +0000 (22:46 +0000)] 
core127: Ship updated kernel modules for xtables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agocore127: Ship updated firewall functions library
Michael Tremer [Thu, 10 Jan 2019 22:43:45 +0000 (22:43 +0000)] 
core127: Ship updated firewall functions library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agofirewall-lib.pl: Use get_geoip_locations from geoip-functions.pl
Stefan Schantl [Thu, 10 Jan 2019 19:40:04 +0000 (20:40 +0100)] 
firewall-lib.pl: Use get_geoip_locations from geoip-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agogeoip-locations.pl: Add get_geoip_locations().
Stefan Schantl [Thu, 10 Jan 2019 19:40:03 +0000 (20:40 +0100)] 
geoip-locations.pl: Add get_geoip_locations().

This function is used to get all available GeoIP locations.

The functions returns them as array, sorted in alphabetical order.

Reference #11959

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoclamav: Update to 0.101.1
Matthias Fischer [Thu, 10 Jan 2019 14:30:49 +0000 (15:30 +0100)] 
clamav: Update to 0.101.1

For details see:
https://blog.clamav.net/2019/01/clamav-01011-patch-has-been-released.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agocore127: Ship updated tar
Michael Tremer [Mon, 7 Jan 2019 01:32:46 +0000 (01:32 +0000)] 
core127: Ship updated tar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agotar: Update to 1.31, including fix for bug #11958
Matthias Fischer [Thu, 10 Jan 2019 13:29:22 +0000 (14:29 +0100)] 
tar: Update to 1.31, including fix for bug #11958

For details see:

http://savannah.gnu.org/forum/forum.php?forum_id=9344

"- Fix heap-buffer-overrun with --one-top-level.
- Support for zstd compression.
- The -K option interacts properly with member names given in the command line.
- Fix CVE-2018-20482"

This patch was reverted because 'tar 1.31' crashed when installing PakFire packages
with the option '--no-overwrite-dir'.
See: https://bugzilla.ipfire.org/show_bug.cgi?id=11958

Included is now a patch from https://savannah.gnu.org/bugs/?55413, which seems to fix this issue.
The test cases given in https://savannah.gnu.org/bugs/?55413#comment1 ran without problems.

As always, please check and confirm.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agocore127: Ship updated GeoIP functions
Michael Tremer [Mon, 7 Jan 2019 01:28:38 +0000 (01:28 +0000)] 
core127: Ship updated GeoIP functions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agogeoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address.
Stefan Schantl [Thu, 10 Jan 2019 12:00:17 +0000 (13:00 +0100)] 
geoip-functions.pl: Re-write code to lookup the iso country code of a given IP-address.

Drop the usage of the old legacy GeoIP perl module which was not able to handle the
new GeoLite2 databases.

Write some code to directly access the databases and extract the required data.

Usage of the GeoIP2 perl module would provide a lot of more functionality which is not
used/needed. Unfortunately ir requires at lot of additional perl modules which are
not available on IPFire and would only be build and shipped for this module. Buildig all
of them will slow down the entire build process, mess up the system and requires a lot
more space on disk.

Fixes #11962.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoGeoIP: Drop legacy GeoIP perl module.
Stefan Schantl [Thu, 10 Jan 2019 12:00:16 +0000 (13:00 +0100)] 
GeoIP: Drop legacy GeoIP perl module.

The legacy GeoIP perl module cannot handle the new GeoLite2 databases
provided from maxmind and therefore needs to be dropped.

Reference #11960

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoxt_geoip_update: Adjust script to download and use the GeoLite2 database
Stefan Schantl [Thu, 10 Jan 2019 12:00:15 +0000 (13:00 +0100)] 
xt_geoip_update: Adjust script to download and use the GeoLite2 database

Fixes #11961.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoxtables-addons: Use shipped xt_geoip_build
Stefan Schantl [Thu, 10 Jan 2019 12:00:14 +0000 (13:00 +0100)] 
xtables-addons: Use shipped xt_geoip_build

Use the shipped xt_geoip_build directly instead of holding a copy in our GIT.

Reference #11959

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoxtables-addons: Update to 3.2
Stefan Schantl [Thu, 10 Jan 2019 12:00:13 +0000 (13:00 +0100)] 
xtables-addons: Update to 3.2

Reference #11959

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoperl-Net-CIDR-Lite: Make rootfile work on other arches
Michael Tremer [Mon, 7 Jan 2019 00:34:30 +0000 (00:34 +0000)] 
perl-Net-CIDR-Lite: Make rootfile work on other arches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoperl-Net-CIDR-Lite: Fix whitespace
Michael Tremer [Mon, 7 Jan 2019 00:31:46 +0000 (00:31 +0000)] 
perl-Net-CIDR-Lite: Fix whitespace

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
10 months agoperl-Net-CIDR-Lite: New package.
Stefan Schantl [Thu, 10 Jan 2019 12:00:12 +0000 (13:00 +0100)] 
perl-Net-CIDR-Lite: New package.

This is a runtime dependency of the xt_geoip_build perl script
shipped by xtables-addons in version 3.2.

Reference #11960.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>