Commit Graph

10430 Commits

Author SHA1 Message Date
Arne Fitzenreiter
00d2007b04 strongswan: fix rootfile (padlock)
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2017-01-09 18:09:43 +01:00
Michael Tremer
544cc6c725 sarg: Update to 2.3.10
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-09 15:26:54 +00:00
Michael Tremer
5f1546328e lang: Add string for "Guardian"
This is shown in the log section even when the add-on is not
installed and was rendered as an empty field

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-09 14:57:24 +00:00
Jonatan Schlag
d2d13b36f4 Libvirt: Rootfile fixes
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-04 14:37:02 +00:00
Matthias Fischer
f2a309dc08 tmux: Update to 2.3
For details see:
https://raw.githubusercontent.com/tmux/tmux/master/CHANGES

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-04 11:25:05 +00:00
Michael Tremer
9a657e9b3b core109: Ship updated backupiso script
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-04 11:22:02 +00:00
Jonatan Schlag
b1b6e9f396 Fix the backup iso script once again.
In commit 391560854f was an error in the
case statement. On i?586 the check fails. Removing the "" fixes the
error.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-04 11:21:28 +00:00
Jonatan Schlag
391560854f Improvement of backup iso script
The backup iso script did not check the arch of the host. On x86_64 host
the wrong iso was downloaded.

Furthermore, there were some if clauses which could cause trouble which
I also tried to improve.
(For example: -e is valid if we have a directory or a file, but we want
to check for a file only )

Fixes: 11258

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-02 19:12:14 +00:00
Jonatan Schlag
9a015b5bd5 Update libvirt to 2.5
For Changelog see:
https://libvirt.org/news-2016.html

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-02 14:43:23 +00:00
Jonatan Schlag
a29910adf8 Update qemu to 2.8
For Changelog see:

http://wiki.qemu.org/ChangeLog/2.8
http://wiki.qemu.org/ChangeLog/2.7

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-02 14:43:21 +00:00
Matthias Fischer
188acee830 nano: Update to 2.7.3
Sorry, they did it again...:

For details see:
https://www.nano-editor.org/news.php

"GNU nano 2.7.3 "Ontbijtkoek" wipes away a handful of bugs:
your editor is now able to handle filenames that contain
newlines, avoids a brief flash of color when switching
between buffers that are governed by different syntaxes,
makes the Shift+Ctrl+Arrow keys select text again on a
Linux console, is more resistant against malformations
in the positionlog file, and does not crash when ^C is
typed on systems where it produces the code KEY_CANCEL.
Oh, and it no longer mistakenly warns about editing an
unlocked file just after saving a new one.  That's it.
Tastes great with thick butter."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-02 12:20:32 +00:00
Matthias Fischer
5d1dac2d8c logrotate: Update to 3.9.1
For details see:
https://fedorahosted.org/logrotate/browser/tags/r3-9-1/CHANGES

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2017-01-02 12:20:30 +00:00
Jonatan Schlag
593de24f30 Use a better naming scheme for physical devices.
Instead of orange0phys we should use orangephys0 this patch implements
the necessary changes.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-31 14:05:56 +00:00
Jonatan Schlag
c2336f6bed Use MAC addresses to define a slave
It is now also possible to use the MAC address to define a slave of a
bridge.
Simply add the mac address to the ZONE_SLAVES=''.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-31 14:05:54 +00:00
Jonatan Schlag
18b6da69b6 core109: Ship network bridge changes
Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-29 20:34:23 +00:00
Jonatan Schlag
3fbf7bed79 network: Rename MACVTAP script
This script is creating common bridges now, too and therefore
needs a more generic name.

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-29 20:34:22 +00:00
Jonatan Schlag
4aef53d50d network: Support bridge mode for zones
This bridge mode is supposed to be used for virtual environments
to create a network zone as a bridge and have virtual machines inside
it. Other physical interfaces can also be added to the bridge.

This is very similar to the MACVTAP bridge feature but still works
when the link of any (or all) physical interfaces is down.

Fixes: #11252

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-29 20:34:21 +00:00
Jonatan Schlag
1857244ea4 udev: Do not use MACVTAP for any wireless devices
Fixes #11179

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-29 20:34:19 +00:00
Michael Tremer
8fa523e028 libpng: Update to version 1.2.57
These all fix a potential "NULL dereference" bug that has existed in libpng
since version 0.71 of June 26, 1995.  To be vulnerable, an application
has to load a text chunk into the png structure, then delete all text, then
add another text chunk to the same png structure, which seems to be
an unlikely sequence, but it has happened.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-29 16:04:29 +00:00
Matthias Fischer
22dbd018f1 squid 3.5.23: latest patch (14129)
Seems to be a serious one.
"Bug #3940 pt2: Make 'cache deny' do what is documented".
(Duplicate of Bug 3783)

For details see:

http://bugs.squid-cache.org/show_bug.cgi?id=3940

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-29 15:37:07 +00:00
Matthias Fischer
fb7cd4cb4f nano: Update to 2.7.2
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-27 11:40:10 +01:00
Arne Fitzenreiter
e11038354b hwdata: update databases
pci.ids 2016.12.19
usb.ids 2016.12.05

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2016-12-22 21:53:39 +01:00
Arne Fitzenreiter
7ba5691854 start core109 updater
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2016-12-22 20:39:38 +01:00
Matthias Fischer
dcc3b47f00 bind: Update to 9.11.0-P1
http://ftp.isc.org/isc/bind9/9.11.0-P1/RELEASE-NOTES-bind-9.11.0-P1.html:
"BIND 9.11.0-P1 addresses the security issue described in CVE-2016-8864"

https://access.redhat.com/security/cve/cve-2016-8864:
"A denial of service flaw was found in the way BIND handled responses
containing a DNAME answer. A remote attacker could use this flaw to
make named exit unexpectedly with an assertion failure via a specially
crafted DNS response."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-19 12:08:34 +00:00
Matthias Fischer
ba6fc476fb snort: Update to 2.9.9.0
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-18 15:19:52 +00:00
Matthias Fischer
a1bc7f3ab9 squid: Update to 3.5.23
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-17 17:26:38 +00:00
Matthias Fischer
3c22a549ab squid 3.5.22: latest patches (14123-14126)
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-17 17:26:36 +00:00
Michael Tremer
c2adb460d6 Revert "unbound: Deactivate qname-minimization & harden-below-nxdomain"
This reverts commit 86e9d04bfb.

This seems to be working with unbound 1.6.0 so that this can be
re-enabled for better privacy.

http://lists.ipfire.org/pipermail/development/2016-December/002807.html
2016-12-16 11:59:59 +00:00
Matthias Fischer
ef2bb43402 unbound: Update to 1.6.0
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>

For details, see:
http://www.unbound.net/download.html
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-16 10:29:18 +00:00
Michael Tremer
b2f96a94e3 unbound: EDNS buffer size defaults to 4096
If this is changed, a warning will be shown.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-14 12:51:46 +00:00
Michael Tremer
8f3034d0db unbound: Test for working EDNS buffer size and adjust accordingly
Some networks have equipment that fails to forward DNS queries
with EDNS and the DO bit set. They might even lose the replies.

This patch will adjust unbound so that it will not try to receive
too large replies and falls back to TCP earlier. This creates
some higher load on the DNS servers but at least gives us
working DNS.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-14 12:45:07 +00:00
Arne Fitzenreiter
b26b242a9c finish core108
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2016-12-13 23:29:21 +01:00
Matthias Fischer
a5f09f8e5b squid 3.5.22: latest patches (14119-14122)
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-12 11:20:21 +00:00
Matthias Fischer
d15c59e6e5 nano: Update to 2.7.1
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-12 10:58:21 +00:00
Michael Tremer
6426c4066f core108: Ship updated squid
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-06 14:20:16 +00:00
Matthias Fischer
4ce082a4dd squid 3.5.22: latest patches (14114-14118)
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-06 14:19:20 +00:00
Matthias Fischer
262c48be60 squid 3.5.22: latest patches (14103-14113)
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-06 14:19:12 +00:00
Matthias Fischer
cc8f79f95f squid 3.5.22: latest patches (14100-14102)
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-06 14:19:06 +00:00
Matthias Fischer
cc2a2209d8 squid 3.5.22: latest patch (14099)
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-06 14:19:03 +00:00
Michael Tremer
67214dc2eb core108: Ship updated NTP
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-06 14:17:05 +00:00
Matthias Fischer
31986a351c ntp: Update to 4.2.8p9
"It addresses 1 high-, 2 medium-, 2 medium-/low-, and 5 low-severity
security issues, 28 bugfixes, and contains other improvements over 4.2.8p8."

For a complete list, see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-06 14:15:19 +00:00
Michael Tremer
6268c62384 tor: Update to 0.2.8.10
Brings various major bugfixes and privacy enhancements

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-03 13:30:02 +00:00
Michael Tremer
2aa15dee66 unbound: Fix DNS forwarder test
The previous version aborted when the validation test
suceeded, but this is not always sufficient in case a
provider filters any DNSKEY, DS or RRSIG records.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-12-01 17:13:07 +00:00
Michael Tremer
cd812106b1 unbound: Do not try removing forwarders when unbound is not running
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-11-29 12:28:23 +00:00
Michael Tremer
adb11e90df Always enable asynchronous logging
This patch always enables asynchronous logging which slows
down the system a lot on slow storage and some virtual environments.

It also removes the configuration options in the web
user interface, since this is not configurable any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-11-29 12:18:41 +00:00
Michael Tremer
b7f2fe819b core108: Ship updated ddns
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-11-28 21:51:13 +00:00
Stefan Schantl
0b5b6a594c ddns: Import patches for schokokeks.org support.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-11-28 21:50:24 +00:00
Michael Tremer
49750f72de Start Core Update 108
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-11-28 21:48:21 +00:00
Michael Tremer
e2b19d984c strongswan: Update to 5.5.1
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-11-28 21:38:29 +00:00
Michael Tremer
86e9d04bfb unbound: Deactivate qname-minimization & harden-below-nxdomain
This causes trouble when you try to resolve a record like
a.b.blah.com where b.blah.com responds with NXDOMAIN. unbound
won't try to resolve a.b.blah.com because it is assumed that
everything longer than b.blah.com does not exist which is
probably not good usability.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2016-11-25 17:45:39 +00:00