people/pmueller/ipfire-2.x.git
8 months agosysctl.conf: Revert enabling busy loop waiting on sockets
Michael Tremer [Thu, 28 Feb 2019 18:53:22 +0000 (18:53 +0000)] 
sysctl.conf: Revert enabling busy loop waiting on sockets

This causes the firmware in my ath10k module to crash.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoAdd script to search for missing libraries
Michael Tremer [Sun, 24 Feb 2019 11:45:55 +0000 (11:45 +0000)] 
Add script to search for missing libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore128: Drop old openssl engines
Michael Tremer [Sun, 24 Feb 2019 04:06:52 +0000 (04:06 +0000)] 
core128: Drop old openssl engines

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocups: Depends on bluetooth library
Michael Tremer [Sun, 24 Feb 2019 04:04:51 +0000 (04:04 +0000)] 
cups: Depends on bluetooth library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agocore128: add openldap to update
Arne Fitzenreiter [Sun, 24 Feb 2019 19:50:16 +0000 (20:50 +0100)] 
core128: add openldap to update

openldap was linked against old openssl lib

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agocore128: add sse2 openssl libs
Arne Fitzenreiter [Sun, 24 Feb 2019 16:04:44 +0000 (17:04 +0100)] 
core128: add sse2 openssl libs

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agocore128: apply local sshd config
Arne Fitzenreiter [Sun, 24 Feb 2019 09:55:49 +0000 (10:55 +0100)] 
core128: apply local sshd config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: update to 4.14.103
Arne Fitzenreiter [Sat, 23 Feb 2019 14:56:21 +0000 (15:56 +0100)] 
kernel: update to 4.14.103

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agocore128: finish core128
Arne Fitzenreiter [Fri, 22 Feb 2019 20:33:45 +0000 (21:33 +0100)] 
core128: finish core128

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: import cve-2019-8912 patch
Arne Fitzenreiter [Fri, 22 Feb 2019 20:20:57 +0000 (21:20 +0100)] 
kernel: import cve-2019-8912 patch

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agocore128: stop apache before replacing files
Arne Fitzenreiter [Fri, 22 Feb 2019 18:26:08 +0000 (19:26 +0100)] 
core128: stop apache before replacing files

apache will not restart without stopped before
the files was replaced.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: apu leds: add more id's
Arne Fitzenreiter [Fri, 22 Feb 2019 17:02:45 +0000 (18:02 +0100)] 
kernel: apu leds: add more id's

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agopartresize: add "apu1" for apus with new bios.
Arne Fitzenreiter [Fri, 22 Feb 2019 17:01:18 +0000 (18:01 +0100)] 
partresize: add "apu1" for apus with new bios.

8 months agocore128: add kernel to updater
Arne Fitzenreiter [Thu, 21 Feb 2019 18:23:05 +0000 (19:23 +0100)] 
core128: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: cleanup unused rpi patch
Arne Fitzenreiter [Thu, 21 Feb 2019 18:13:27 +0000 (19:13 +0100)] 
kernel: cleanup unused rpi patch

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: update to 4.14.102
Arne Fitzenreiter [Thu, 21 Feb 2019 09:50:15 +0000 (10:50 +0100)] 
kernel: update to 4.14.102

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agopartresize: enable serial console on PC Engines APU
Arne Fitzenreiter [Tue, 19 Feb 2019 12:48:12 +0000 (13:48 +0100)] 
partresize: enable serial console on PC Engines APU

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: update apu led patch for apu3 and 4
Arne Fitzenreiter [Tue, 19 Feb 2019 00:04:19 +0000 (01:04 +0100)] 
kernel: update apu led patch for apu3 and 4

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agounbound: Drop certificates for local control connection
Michael Tremer [Sun, 17 Feb 2019 13:46:51 +0000 (13:46 +0000)] 
unbound: Drop certificates for local control connection

These are a cause of worry because they are sometimes generated with
an invalid timestamp and therefore render unbound being unusable.

There is no strong reason to use self-signed certificates for extra
security here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoAdded 'CONFIG_X86_MSR=y for 'powertop' to i586 and x86_64 builds for fixing #11997
Matthias Fischer [Sun, 10 Feb 2019 19:21:22 +0000 (20:21 +0100)] 
Added 'CONFIG_X86_MSR=y for 'powertop' to i586 and x86_64 builds for fixing #11997

Triggered by:
https://forum.ipfire.org/viewtopic.php?f=69&t=22274

This - probably - fixes Bug #11997.

Needs testing on 64bit installations!

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoFix ownership of sendEmail script
Rob Brewer [Wed, 13 Feb 2019 22:49:11 +0000 (22:49 +0000)] 
Fix ownership of sendEmail script

The script used to be owned by a non-privileged user and it should
just be owned by root.root like any other binary.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
8 months agoborgbackup: fix build on armv5tel
Arne Fitzenreiter [Sat, 16 Feb 2019 21:49:47 +0000 (22:49 +0100)] 
borgbackup: fix build on armv5tel

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: enable PCA953X GPIO extender for ClearFog boards
Arne Fitzenreiter [Sat, 16 Feb 2019 20:40:50 +0000 (21:40 +0100)] 
kernel: enable PCA953X GPIO extender for ClearFog boards

fixes: #12000

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
8 months agokernel: update to 4.14.101
Arne Fitzenreiter [Fri, 15 Feb 2019 16:46:54 +0000 (17:46 +0100)] 
kernel: update to 4.14.101

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore128: Ship kdig
Michael Tremer [Wed, 13 Feb 2019 11:32:00 +0000 (11:32 +0000)] 
core128: Ship kdig

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoknot: Reduced version of knot with kdig only
Erik Kapfer [Sat, 9 Feb 2019 07:41:15 +0000 (08:41 +0100)] 
knot: Reduced version of knot with kdig only

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship libedit
Michael Tremer [Wed, 13 Feb 2019 11:31:24 +0000 (11:31 +0000)] 
core128: Ship libedit

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agolibedit: A command line editor library
Erik Kapfer [Sat, 9 Feb 2019 07:41:14 +0000 (08:41 +0100)] 
libedit: A command line editor library

Dependency for knot (kdig).

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopowertop: Update to 2.10
Matthias Fischer [Sun, 10 Feb 2019 19:13:17 +0000 (20:13 +0100)] 
powertop: Update to 2.10

Hi,

Triggered by:
https://forum.ipfire.org/viewtopic.php?f=69&t=22274

For details see:
https://01.org/powertop/downloads/powertop-v2.10

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agodhcpcd: Update to 7.1.1
Matthias Fischer [Sat, 9 Feb 2019 09:59:08 +0000 (10:59 +0100)] 
dhcpcd: Update to 7.1.1

For details see:
https://roy.marples.name/blog/dhcpcd-7-1-1-released

"A minor update, highlights include:

 IPv4LL: Fixed build with this disabled
 IPv4LL: Remember last address between carrier resets
 BSD: Fixed initial link infos reported as LINK_STATE_UNKNOWN
 FreeBSD: Avoid panicing kernel when RTA_IFP is set for IPv6 prefix routes"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocurl: Update to 7.64.0
Matthias Fischer [Sat, 9 Feb 2019 09:37:22 +0000 (10:37 +0100)] 
curl: Update to 7.64.0

Hi,

For details see:
https://curl.haxx.se/changes.html

This came rather unexpected - if I'd known, I'd have waited with 7.63.0.

"Changes:
cookies: leave secure cookies alone
hostip: support wildcard hosts
http: Implement trailing headers for chunked transfers
http: added options for allowing HTTP/0.9 responses
timeval: Use high resolution timestamps on Windows

Bugfixes:
CVE-2018-16890: NTLM type-2 out-of-bounds buffer read
CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow
CVE-2019-3823: SMTP end-of-response out-of-bounds read
FAQ: remove mention of sourceforge for github
OS400: handle memory error in list conversion
OS400: upgrade ILE/RPG binding.
README: add codacy code quality badge
Revert http_negotiate: do not close connection
THANKS: added several missing names from year <= 2000
build: make 'tidy' target work for metalink builds
cmake: added checks for variadic macros
cmake: updated check for HAVE_POLL_FINE to match autotools
cmake: use lowercase for function name like the rest of the code
configure: detect xlclang separately from clang
configure: fix recv/send/select detection on Android
configure: rewrite --enable-code-coverage
conncache_unlock: avoid indirection by changing input argument type
cookie: fix comment typo
cookies: allow secure override when done over HTTPS
cookies: extend domain checks to non psl builds
cookies: skip custom cookies when redirecting cross-site
curl --xattr: strip credentials from any URL that is stored
curl -J: refuse to append to the destination file
curl/urlapi.h: include "curl.h" first
curl_multi_remove_handle() don't block terminating c-ares requests
darwinssl: accept setting max-tls with default min-tls
disconnect: separate connections and easy handles better
disconnect: set conn->data for protocol disconnect
docs/version.d: mention MultiSSL
docs: fix the --tls-max description
docs: use $(INSTALL_DATA) to install man page
docs: use meaningless port number in CURLOPT_LOCALPORT example
gopher: always include the entire gopher-path in request
http2: clear pause stream id if it gets closed
if2ip: remove unused function Curl_if_is_interface_name
libssh: do not let libssh create socket
libssh: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION for libssh
libssh: free sftp_canonicalize_path() data correctly
libtest/stub_gssapi: use "real" snprintf
mbedtls: use VERIFYHOST
multi: multiplexing improvements
multi: set the EXPIRE_*TIMEOUT timers at TIMER_STARTSINGLE time
ntlm: fix NTMLv2 compliance
ntlm_sspi: add support for channel binding
openssl: adapt to 3.0.0, OpenSSL_version_num() is deprecated
openssl: fix the SSL_get_tlsext_status_ocsp_resp call
openvms: fix OpenSSL discovery on VAX
openvms: fix typos in documentation
os400: add a missing closing bracket
os400: fix extra parameter syntax error
pingpong: change default response timeout to 120 seconds
pingpong: ignore regular timeout in disconnect phase
printf: fix format specifiers
runtests.pl: Fix perl call to include srcdir
schannel: fix compiler warning
schannel: preserve original certificate path parameter
schannel: stop calling it "winssl"
sigpipe: if mbedTLS is used, ignore SIGPIPE
smb: fix incorrect path in request if connection reused
ssh: log the libssh2 error message when ssh session startup fails
test1558: verify CURLINFO_PROTOCOL on file:// transfer
test1561: improve test name
test1653: make it survive torture tests
tests: allow tests to pass by 2037-02-12
tests: move objnames-* from lib into tests
timediff: fix math for unsigned time_t
timeval: Disable MSVC Analyzer GetTickCount warning
tool_cb_prg: avoid integer overflow
travis: added cmake build for osx
urlapi: Fix port parsing of eol colon
urlapi: distinguish possibly empty query
urlapi: fix parsing ipv6 with zone index
urldata: rename easy_conn to just conn
winbuild: conditionally use /DZLIB_WINAPI
wolfssl: fix memory-leak in threaded use
spnego_sspi: add support for channel binding"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agokernel: update to 4.14.98
Arne Fitzenreiter [Fri, 8 Feb 2019 19:50:37 +0000 (20:50 +0100)] 
kernel: update to 4.14.98

todo: check if RPi dwc dma patch still need to reverted before release

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agoborgbackup: Fix build on i586
Matthias Fischer [Fri, 8 Feb 2019 11:01:42 +0000 (12:01 +0100)] 
borgbackup: Fix build on i586

Fixes

...
'/usr/src/config/rootfiles/packages//borgbackup' -> '/install/packages/package/ROOTFILES'
tar: usr/lib/python3.6/site-packages/borg/chunker.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/compress.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/crypto.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/hashindex.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: usr/lib/python3.6/site-packages/borg/platform_linux.cpython-36m-i586-linux-gnu.so: Cannot stat: No such file or directory
tar: Exiting with failure status due to previous errors
make: *** [borgbackup:58: dist] Error 2
...

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopython3-llfuse: Fix build on i586
Matthias Fischer [Fri, 8 Feb 2019 10:57:47 +0000 (11:57 +0100)] 
python3-llfuse: Fix build on i586

Fixes

"tar: usr/lib/python3.6/site-packages/llfuse.cpython-36m-i586-linux-gnu.so:
Cannot stat: No such file or directory"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated firewall initscript
Michael Tremer [Thu, 7 Feb 2019 15:13:50 +0000 (15:13 +0000)] 
core128: Ship updated firewall initscript

Require reboot after the update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoapply default firewall policy for ORANGE, too
Peter Müller [Wed, 6 Feb 2019 21:00:00 +0000 (21:00 +0000)] 
apply default firewall policy for ORANGE, too

If firewall default policy is set to DROP, this setting was not
applied to outgoing ORANGE traffic as well, which was misleading.

Fixes #11973

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Cc: Oliver Fuhrer <oliver.fuhrer@bluewin.ch>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoTor: update to 0.3.5.7
Peter Müller [Wed, 6 Feb 2019 19:21:00 +0000 (19:21 +0000)] 
Tor: update to 0.3.5.7

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopython3-msgpack: Fix build on i586
Jonatan Schlag [Tue, 5 Feb 2019 18:33:31 +0000 (18:33 +0000)] 
python3-msgpack: Fix build on i586

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopython3-dateutil: Update rootfiles
Michael Tremer [Mon, 4 Feb 2019 07:00:13 +0000 (07:00 +0000)] 
python3-dateutil: Update rootfiles

Changed because of new python3-setuptools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated dhcpcd
Michael Tremer [Mon, 4 Feb 2019 00:40:02 +0000 (00:40 +0000)] 
core128: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agodhcpcd: Update to 7.1.0
Matthias Fischer [Mon, 4 Feb 2019 17:38:44 +0000 (18:38 +0100)] 
dhcpcd: Update to 7.1.0

For some informations about this update see:
https://roy.marples.name/blog/dhcpcd-7-1-0-released

"dhcpcd-7.1.0 has been released with the following changes:

- OpenBSD: works alongside slaacd(8)
- NetBSD: sets SO_RERROR on to detect receive socket overflow
- BSD: route improvements to avoid listening for own changes
- Linux: use NETLINK_BROADCAST_ERROR
- BSD: avoid late address deletion messages by testing address existance
- IP6: implement IP6 address sharing
- BSD: catch UP/DOWN events when interfaces does support media changes
- IPv4LL: remember old address when carrier is lost

Many other minor fixes and documenation updates have been submitted by various
community members for this release..."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated curl
Michael Tremer [Mon, 4 Feb 2019 00:15:24 +0000 (00:15 +0000)] 
core128: Ship updated curl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocurl: Update to 7.63.0
Matthias Fischer [Mon, 4 Feb 2019 17:30:54 +0000 (18:30 +0100)] 
curl: Update to 7.63.0

For details see:
https://curl.haxx.se/changes.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoupdate.sh: Delete .rnd files
Erik Kapfer [Sat, 2 Feb 2019 07:46:12 +0000 (08:46 +0100)] 
update.sh: Delete .rnd files

Since RANDFILE has been disabled in OpenSSL configurations, .rnd files are not needed anymore.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated apr
Michael Tremer [Sun, 3 Feb 2019 21:42:43 +0000 (21:42 +0000)] 
core128: Ship updated apr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoUpdated apr, stabilized apache build
Wolfgang Apolinarski [Sun, 3 Feb 2019 14:11:58 +0000 (15:11 +0100)] 
Updated apr, stabilized apache build

- Updated apr to 1.6.5
- Stabilized apache build (rebuild)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agopython3-llfuse: fix rootfile for non x86_64 builds
Arne Fitzenreiter [Sun, 3 Feb 2019 14:28:52 +0000 (15:28 +0100)] 
python3-llfuse: fix rootfile for non x86_64 builds

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agokernel: update to 4.14.97
Arne Fitzenreiter [Sun, 3 Feb 2019 11:45:52 +0000 (12:45 +0100)] 
kernel: update to 4.14.97

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agohaproxy: Bump version to support TLSv1.3 (and PCRE JIT)
Michael Tremer [Fri, 1 Feb 2019 17:34:02 +0000 (17:34 +0000)] 
haproxy: Bump version to support TLSv1.3 (and PCRE JIT)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Restart updated apache
Michael Tremer [Fri, 1 Feb 2019 17:12:23 +0000 (17:12 +0000)] 
core128: Restart updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoapache: Update to 2.4.38
Matthias Fischer [Fri, 1 Feb 2019 17:06:38 +0000 (18:06 +0100)] 
apache: Update to 2.4.38

For details see:
http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.38

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship AWS scripts again
Michael Tremer [Fri, 1 Feb 2019 17:08:44 +0000 (17:08 +0000)] 
core128: Ship AWS scripts again

It seems that this was missing in Core Update 125/126 so not all
bug fixes made it into the release.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package borgbackup
Jonatan Schlag [Fri, 1 Feb 2019 11:52:45 +0000 (11:52 +0000)] 
Add new package borgbackup

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-msgpack
Jonatan Schlag [Fri, 1 Feb 2019 11:52:44 +0000 (11:52 +0000)] 
Add new package python3-msgpack

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-llfuse
Jonatan Schlag [Fri, 1 Feb 2019 11:52:43 +0000 (11:52 +0000)] 
Add new package python3-llfuse

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-setuptools-scm
Jonatan Schlag [Fri, 1 Feb 2019 11:52:42 +0000 (11:52 +0000)] 
Add new package python3-setuptools-scm

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoAdd new package python3-settuptools
Jonatan Schlag [Fri, 1 Feb 2019 11:52:41 +0000 (11:52 +0000)] 
Add new package python3-settuptools

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Delete SSE2-optimised legacy OpenSSL libraries, too
Michael Tremer [Wed, 30 Jan 2019 18:37:26 +0000 (18:37 +0000)] 
core128: Delete SSE2-optimised legacy OpenSSL libraries, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated OpenSSL configuration files
Michael Tremer [Tue, 29 Jan 2019 13:51:37 +0000 (13:51 +0000)] 
core128: Ship updated OpenSSL configuration files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agodel_rand: Deletion of RAND file in openssl config
Erik Kapfer [Tue, 8 Jan 2019 19:33:32 +0000 (20:33 +0100)] 
del_rand: Deletion of RAND file in openssl config

Fixes #11943

Since the kernel RNG should do this, there is no need for this anymore.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoghostscript: Update to 9.26
Matthias Fischer [Sun, 27 Jan 2019 17:38:04 +0000 (18:38 +0100)] 
ghostscript: Update to 9.26

For details see:
https://www.ghostscript.com/doc/9.26/News.htm

This version fixes CVE-2019-6116 ("code execution via subroutines within pseudo-operators")

Some details (german) can be found here:
https://www.heise.de/security/meldung/Boeser-Bug-in-PostScript-trifft-ghostscript-und-damit-Viele-mehr-4286563.html

I saw this article and found it could be the time for an update...

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoEnable some performance tuning
Michael Tremer [Thu, 24 Jan 2019 12:31:27 +0000 (12:31 +0000)] 
Enable some performance tuning

These parameters increase the throughput on various (large-ish)
systems by 5-10% on the slight expense of higher power consumption.

Socket buffers are increases and the system is configured to be
less aggressive when scheduling processes from one processor to
another one which ensures that the cache remains "hot" for longer.

On a slower system (apu1d) no performance improvement or loss
could have been measured.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoproxy: Show error messages in English by default
Michael Tremer [Wed, 23 Jan 2019 06:21:53 +0000 (06:21 +0000)] 
proxy: Show error messages in English by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoPostfix: update to 3.3.2
Peter Müller [Wed, 23 Jan 2019 20:34:13 +0000 (21:34 +0100)] 
Postfix: update to 3.3.2

See http://www.postfix.org/announcements/postfix-3.3.2.html for release
note. This makes Postfix TLS 1.3/OpenSSL 1.1.1a ready.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated ca-certificates
Michael Tremer [Wed, 23 Jan 2019 05:40:41 +0000 (05:40 +0000)] 
core128: Ship updated ca-certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoupdate ca-certificates CA bundle
Peter Müller [Wed, 23 Jan 2019 19:59:41 +0000 (20:59 +0100)] 
update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated openssh
Michael Tremer [Wed, 23 Jan 2019 05:40:04 +0000 (05:40 +0000)] 
core128: Ship updated openssh

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoOpenSSH: update to 7.9p1
Peter Müller [Wed, 23 Jan 2019 19:54:07 +0000 (20:54 +0100)] 
OpenSSH: update to 7.9p1

Update OpenSSH to 7.9p1 (release note is available at
https://www.openssh.com/txt/release-7.9). Patching support
for OpenSSL 1.1.0 is no longer required, thus the orphaned
patchfile has been deleted.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoMerge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Wed, 23 Jan 2019 20:19:01 +0000 (21:19 +0100)] 
Merge remote-tracking branch 'origin/master' into next

9 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Wed, 23 Jan 2019 20:18:44 +0000 (21:18 +0100)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

9 months agokernel: update to 4.14.95
Arne Fitzenreiter [Wed, 23 Jan 2019 17:38:14 +0000 (18:38 +0100)] 
kernel: update to 4.14.95

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agouse HTTPS for downloading GeoIP database files
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)] 
use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoxtables-addons: Fix generating GeoIP database
Michael Tremer [Wed, 23 Jan 2019 04:10:23 +0000 (04:10 +0000)] 
xtables-addons: Fix generating GeoIP database

Perl seems to have a very funny feature where you cannot rely on
how it formats IP addresses into a binary string.

This seems to be 16 bytes long for IPv4 addresses when we (and the kernel)
only expect 4.

This patch changes this so that the last 12 bytes are just being dropped.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated tzdata
Michael Tremer [Wed, 23 Jan 2019 03:06:07 +0000 (03:06 +0000)] 
core128: Ship updated tzdata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agotzdata: update to 2018i
Peter Müller [Wed, 23 Jan 2019 15:00:57 +0000 (16:00 +0100)] 
tzdata: update to 2018i

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agostrongswan: Update to 5.7.2
Michael Tremer [Tue, 22 Jan 2019 05:31:21 +0000 (05:31 +0000)] 
strongswan: Update to 5.7.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agokernel: x86_64 encrease NR_CPUS to 64
Arne Fitzenreiter [Tue, 22 Jan 2019 06:46:08 +0000 (07:46 +0100)] 
kernel: x86_64 encrease NR_CPUS to 64

fixes #11963

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agokernel: update to 4.14.94
Arne Fitzenreiter [Tue, 22 Jan 2019 06:41:18 +0000 (07:41 +0100)] 
kernel: update to 4.14.94

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore128: Ship updated xt_geoip_update script
Michael Tremer [Mon, 21 Jan 2019 21:04:10 +0000 (21:04 +0000)] 
core128: Ship updated xt_geoip_update script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agouse HTTPS for downloading GeoIP database files
Peter Müller [Mon, 21 Jan 2019 20:40:50 +0000 (21:40 +0100)] 
use HTTPS for downloading GeoIP database files

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship updated logrotate
Michael Tremer [Mon, 21 Jan 2019 10:20:29 +0000 (10:20 +0000)] 
core128: Ship updated logrotate

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agologrotate: Update to 3.15
Matthias Fischer [Sun, 20 Jan 2019 17:07:47 +0000 (18:07 +0100)] 
logrotate: Update to 3.15

For details see:
https://github.com/logrotate/logrotate/releases

- timer unit: change trigger fuzz from 12h to 1h (#230)
- service unit: only run if /var/log is mounted (#230)
- preserve fractional part of timestamps when compressing (#226)
- re-indent source code using spaces only (#188)
- minage: avoid rounding issue while comparing the amount of seconds (#36)
- never remove old log files if rotate -1 is specified (#202)
- return non-zero exit status if a config file contains an error (#199)
- make copytruncate work with rotate 0 (#191)
- warn user if both size and the time interval options are used (#192)
- pass rotated log file name as the 2nd argument of the postrotate script
  when sharedscript is not enabled (#193)
- rename logrotate-default to logrotate.conf (#187)

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoMerge remote-tracking branch 'origin/master' into next
Arne Fitzenreiter [Sat, 19 Jan 2019 18:58:48 +0000 (19:58 +0100)] 
Merge remote-tracking branch 'origin/master' into next

9 months agocore127: run xt_geoip_update
Arne Fitzenreiter [Sat, 19 Jan 2019 16:24:47 +0000 (17:24 +0100)] 
core127: run xt_geoip_update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: ovpn ca index.txt is also missing on some installations
Arne Fitzenreiter [Sat, 19 Jan 2019 16:20:51 +0000 (17:20 +0100)] 
core127: ovpn ca index.txt is also missing on some installations

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agoxt_geoip_updte: fix download url
Arne Fitzenreiter [Sat, 19 Jan 2019 14:16:43 +0000 (15:16 +0100)] 
xt_geoip_updte: fix download url

the maxmind server delivers an old version if there are
two slashes before the database filename.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: fix typo
Arne Fitzenreiter [Sat, 19 Jan 2019 11:08:07 +0000 (12:08 +0100)] 
core127: fix typo

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: add ovpn ca changes to update
Arne Fitzenreiter [Sat, 19 Jan 2019 09:02:17 +0000 (10:02 +0100)] 
core127: add ovpn ca changes to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: add xt_geoip_update to update
Arne Fitzenreiter [Sat, 19 Jan 2019 09:01:40 +0000 (10:01 +0100)] 
core127: add xt_geoip_update to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: add bind to update
Arne Fitzenreiter [Sat, 19 Jan 2019 09:00:54 +0000 (10:00 +0100)] 
core127: add bind to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: set reboot needed flag
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:39 +0000 (13:53 +0100)] 
core127: set reboot needed flag

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: add general-functions.pl to updater
Arne Fitzenreiter [Fri, 18 Jan 2019 12:53:06 +0000 (13:53 +0100)] 
core127: add general-functions.pl to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agocore127: fix updater for aarch64 and armv5tel
Arne Fitzenreiter [Fri, 18 Jan 2019 06:52:17 +0000 (07:52 +0100)] 
core127: fix updater for aarch64 and armv5tel

if a arch specific filelist has the same name as the common the common filelist was ignored

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
9 months agoRevert "Disable Path MTU discovery"
Michael Tremer [Thu, 17 Jan 2019 19:24:46 +0000 (19:24 +0000)] 
Revert "Disable Path MTU discovery"

This reverts commit 1c0cfaa5949e4303e8e4e2f041af86a812f3fe6c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agodrop orphaned OpenSSL patches
Peter Müller [Mon, 5 Nov 2018 15:21:43 +0000 (16:21 +0100)] 
drop orphaned OpenSSL patches

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Remove openssl-compat package
Michael Tremer [Thu, 17 Jan 2019 14:41:54 +0000 (14:41 +0000)] 
core128: Remove openssl-compat package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agodrop openssl-compat package
Peter Müller [Mon, 5 Nov 2018 15:12:40 +0000 (16:12 +0100)] 
drop openssl-compat package

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agocore128: Ship recently updated openssl and apache
Michael Tremer [Thu, 17 Jan 2019 14:39:14 +0000 (14:39 +0000)] 
core128: Ship recently updated openssl and apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agoStart Core Update 128
Michael Tremer [Thu, 17 Jan 2019 14:38:01 +0000 (14:38 +0000)] 
Start Core Update 128

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
9 months agohttpd: include TLS 1.3 cipher suites
Peter Müller [Tue, 15 Jan 2019 14:39:25 +0000 (15:39 +0100)] 
httpd: include TLS 1.3 cipher suites

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Cc: Erik Kapfer <erik.kapfer@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>