libtalloc: add new package because samba4 not provide this anymore

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

samba: update to 4.13.0

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

samba: remove SO_xxxBUF size definitions from default config

this option is not recommended for samba4

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

rpcsvc-proto: build before samba

samba4 depends on this package

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

perl-Parse-Yapp: add package

samba4 depends on this perl module

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

samba initskript: create needed subdirs for pipes in /var/run/samba

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

samba: default.global: remove unsuppoted "map to guest = false"

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

samba.cgi: remove unsupported DISPLAY CHARSET

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

samba.cgi: remove unsupported security = share

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core150: Ship libloc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

crontab: Update misleading comment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fcron: Fix invalid syntax in update-location-database cronjob

Fixes: #12484
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libloc: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libloc: Update to 0.9.4

Also update to the shipped database to 2020-09-21.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xinetd: Depend on libtirpc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openvmtools: Depend on libtirpc

Fixes: #12487
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'master' into next

index.cgi: Fix CPU architecture check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

make.sh fix i586 code generation.

-fcf-protection insert non i586 instructions that crash on amd k6 and geode
to build a working glibc also the toolchain compiler must build without this
so this need a new toolchain.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

toolchain: fix build with gcc<8 on builder.

gcc-7 not support -fcf-protection so filter it from CFLAGS.
also filter -mtune in first pass because it should optimized for the
actual host.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core150: fix typo at graphs.pl

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

graphs.pl: Standardize localization strings for entropy graphs

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

graphs.pl: Standardize localization strings for disk access graphs

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core150: add conntrack graph changes.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

graphs.pl: Standardize temperature displays

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

netother.cgi: Added missing double quotes

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Changed/fixed translation 'Connection tracking'

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

web UI: Add graph for connection tracking

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

collectd: Enable conntrack plugin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

graphs.pl: Added translation for 'ACPI Thermal Zone'

This patchset is based on https://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=commitdiff;h=4bf0d000ffe961cdc5d9dbd27b3a11f900b3daed

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Language files: Clarify menu entries and page titles for VPN connections.

These pages for RW and N2N statistics only show handle for OpenVPN connections.

Fixes #12476.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core150: add graphs.pl

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

graphs: Fix rendering CPU graphs after number of cores decreased

Fixes: #12193 - cpu graphs cannot created if smt is disabled
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core150: add index.cgi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

index.cgi: Fix CPU architecture check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

htop: Update to 3.0.2

For details see:
https://github.com/htop-dev/htop/blob/master/ChangeLog

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update aarch64 rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: aarch64: disable SSDT_OVERLAYS

this option was visible by enabling ACPI and is enabled by default but adds
an attacking vector.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

nano: Update to 5.2

For details see:
https://www.nano-editor.org/news.php

I wasn't sure about the 'extras' - if we need more, feel free to adjust the rootfile.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

postfix: Update to 3.5.7

- Update postfix from version 3.5.6 to 3.5.7
  see ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/postfix-3.5.7.RELEASE_NOTES

Supporting request from Peter Müller
Signed-off-by: Adolf Belka<ahb@ipfire@gmail.com
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

nagios_nrpe: Fix for bug 12337

- added pid_file=/var/run to the configure statement
  to give the required pid directory in the default nrpe.cfg file

Signed-off-by: Adolf Belka <ahb.ipfire@gmail.com>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: enable ACPI support on ARM64

ACPI (with EFI) is used on ARM systems conforming to the
Server Base Boot Requirements (SBBR) and is an optional
on embedded systems (EBBR).

Up to now the ARM64 boards supported by IPFire use U-Boot and
device tree so ACPI was not turned on.

The immediate use case here is to run under virtualization,
using my muvirt project[1] I can run IPFire on our Traverse Ten64
system. For reasons I'll explain separately it is not
currently possible to run stock IPFire on this system.

This change also enables the EFI RTC driver which is presented
by the qemu arm64 virt machine.

Signed-off-by: Mathew McBride <matt@traverse.com.au>
[1] - https://gitlab.com/traversetech/muvirt
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

clamav: Update to 0.103.0

For details see:
https://blog.clamav.net/2020/09/clamav-01030-released.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.198

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: add patch agains CVE-2020-14386

fixes #12483

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Revert "kernel: add patch against CVE-2020-14386"

This reverts commit f04023b1ca5675ce5463ca47186462179fd7a02a.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: cleanup kirkwood patch apply lines

kirkwood support is removed long time ago and the patch already
removed from tree.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: add patch against CVE-2020-14386

fixes #12483

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.197

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core149: restart init at update

this is needed to allow clean unmount at reboot because
init has some files open and the binary was replaced
at glibc update.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Kernel: update to 4.14.196

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

libvirt: add libtirpc to dependencies

libvirt is linked against libtirpc so this need to installed.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

libvirt: add libtirpc to dependencies

libvirt is linked against libtirpc so this need to installed.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core150: start core150 and add kernel

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.195

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/next'

core149: add vim to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

vim: update to 8.2 and fix crash with gcc-10

the configure.ac has a bug that detects gcc-10 as gcc-1 and so not use
some quirks. Also there is a bug with FORTIFY-SOURCE=2 that crash
if the matchparen plugin is used (enabled by default).

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core149: add files to exclude from older updates

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next'

Core 148: Exclude location related settings files.

This prevents from overwriting existing files, with empty ones
and finally to lose the stored settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Core 148: Exclude location related settings files.

This prevents from overwriting existing files, with empty ones
and finally to lose the stored settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core149: Restart squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 4.13

For details see:
http://www.squid-cache.org/Versions/v4/changesets/

and

http://lists.squid-cache.org/pipermail/squid-users/2020-August/022566.html

Fixes (excerpt):

"* SQUID-2020:8 HTTP(S) Request Splitting
   (CVE-2020-15811)

This problem is serious because it allows any client, including
browser scripts, to bypass local security and poison the browser
cache and any downstream caches with content from an arbitrary
source.

* SQUID-2020:9 Denial of Service processing Cache Digest Response
   (CVE pending allocation)

This problem allows a trusted peer to deliver to perform Denial
of Service by consuming all available CPU cycles on the machine
running Squid when handling a crafted Cache Digest response
message.

* SQUID-2020:10 HTTP(S) Request Smuggling
   (CVE-2020-15810)

This problem is serious because it allows any client, including
browser scripts, to bypass local security and poison the proxy
cache and any downstream caches with content from an arbitrary
source.

* Bug 5051: Some collapsed revalidation responses never expire

* SSL-Bump: Support parsing GREASEd (and future) TLS handshakes

* Honor on_unsupported_protocol for intercepted https_port"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

smt: Fix check to detect if a system is running virtually

/sys/hypervisor exists when a host has loaded the kvm modules.

Fixes: #12472
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

general-functions.pl: Do not check IPsec subnets for VTI/GRE connections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libvirt: Depend on ebtables

libvirtd requires this to create some custom firewall rules

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libvirt: Ship all CPU maps

Reported-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core149: Ship zstd which is now part of the base system

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zstd: Do not ship libstd.so

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rsync: Update to 3.2.3

For details see:
https://download.samba.org/pub/rsync/NEWS#3.2.3

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core149: Fix typo in apache initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zstd 1.4.5: Deleted obsolete files from '/src/paks/'

No longer needed => deleted because of:
https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=c67ff7d72c2232b6994e1ff97277d4040711f97d

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tshark: Update to version 3.2.6

The version jump from 3.2.3 to 3.2.6 includes several changes.
3.2.4 includes only bugfixes.
3.2.5 includes bugfixes and updated protocols.
3.2.6 includes also bugfixes and updated protocols.

For a full overview, the release notes can be found in here -->
https://www.wireshark.org/docs/relnotes/ .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.5.6

Please refer to http://www.postfix.org/announcements/postfix-3.5.6.html
for release announcements.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zstd: Make this part of the core distributions

Many packages link against it and we should make use of it
when we have it.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

qemu: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rsync: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core149: Ship popt

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

popt: Update to 1.18

Recommended for 'rsync 3.2.1'.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rsync: Update to 3.2.1

For details see:
https://download.samba.org/pub/rsync/NEWS#3.2.1

Although 3.2.2 is in "release testing", I decided to push this release now to get things running.

I activated zstd-support and added 'DEPS = zstd'.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

zstd 1.4.5: New package

This packages adds a "lossless compression algorithm" - supported by 'rsync 3.2.1'.

For details see:
https://github.com/facebook/zstd/releases/tag/v1.4.5

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

qemu: Update to 5.0.0

For details see:
https://wiki.qemu.org/ChangeLog/5.0

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

usbredir: Update to 0.8.0

For details see:
https://gitlab.freedesktop.org/spice/usbredir/-/blob/master/ChangeLog

"-Source code and bug tracker hosted in Freedesktop's instance of Gitlab
 -https://gitlab.freedesktop.org/spice/usbredir
-usbredirfilter
 -Fix busy wait due endless recursion when interface_count is zero
-usbredirhost:
 -Fix leak on error
-usbredirserver:
 -Use 'busnum-devnum' instead of 'usbbus-usbaddr'
 -Add support for bind specific address -4 for ipv4, -6 for ipv6
 -Reject empty vendorid from command line
 -Enable TCP keepalive"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libvirt: Update to 6.5.0

For details see:
https://libvirt.org/news.html

This update "just came my way" - I hope its somehow useful.

I also checked updates for dependencies - 'libusbredir 0.8.0' and 'qemu 5.0.0' follow.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Postfix: update to 3.5.4

Please refer to http://www.postfix.org/announcements/postfix-3.5.4.html
for release announcements.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Tor: update to 0.4.3.6

Please refer to https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes
for release announcements.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.102.4

Fixes CVE-2020-3350, CVE-2020-3327, CVE-2020-3481

For details see:
https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core149: Ship bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.21

For details see:
https://downloads.isc.org/isc/bind9/9.11.21/RELEASE-NOTES-bind-9.11.21.html

"Bug Fixes

    named could crash when cleaning dead nodes in lib/dns/rbtdb.c that
    were being reused. [GL #1968]

    Properly handle missing kyua command so that make check does not
    fail unexpectedly when CMocka is installed, but Kyua is not. [GL
    #1950]

    The validator could fail to accept a properly signed RRset if an
    unsupported algorithm appeared earlier in the DNSKEY RRset than
    a supported algorithm. It could also stop if it detected a malformed
    public key. [GL #1689]"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core149: Ship intel microcode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

intel-microcode: update to 20200616

Ice Lake Intel CPUs have been found of being vulnerable to MDS, thus
requiring new microcodes for them. <sarcasm>Yay!</sarcasm> Please refer to
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20200616
for further information.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core149: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.11.0

For details see:
https://lists.nlnetlabs.nl/pipermail/unbound-users/2020-July/006921.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

7zip: Move files to /usr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

u-boot: Fix build with GCC 10

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: Run autoreconf after applying patches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core149: Ship everything that was recently updated

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

socat: New package

Signed-off-by: Marcel Follert (Smooky) <smooky@v16.de>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iproute2: Update to 5.8.0

For details see:
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/?h=v5.8.0

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>