Commit Graph

5388 Commits

Author SHA1 Message Date
Peter Müller
689fed340a gnupg: update to 1.4.22
Update GnuPG to 1.4.22, which fixes some security vulnerabilities,
such as the memory side channel attack CVE-2017-7526.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-26 19:03:24 +01:00
Arne Fitzenreiter
66b5b4d12c kernel: update to 4.14.30
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-25 20:26:47 +02:00
Arne Fitzenreiter
37b86fa99b xr819-firmware: add firmware for xradio xr-819 wlan
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-25 13:27:03 +02:00
Arne Fitzenreiter
0a21d63f26 kernel: updated arm config and image build
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-25 11:41:20 +02:00
Arne Fitzenreiter
ea9d53c822 inittab: change tty1 to console
this reduce the differences between tty and scon installations
and make it easier to switch between.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-24 13:26:32 +01:00
Arne Fitzenreiter
5bc33236ca swconfig: remove old swconfig utility
this is not compatible with kernel 4.14
todo: replace swconfig calls in initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-24 12:49:10 +01:00
Arne Fitzenreiter
4df5cc2f75 rpi-firmware: update to 2018-03-16
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-24 12:41:57 +01:00
Arne Fitzenreiter
2a0947f2e3 u-boot: update to 2018.03
todo: check wandboard version. there are internal changes to merge
the different wandboard images to one and u-boot.imx is not build
anymore. Which file is needed to boot on wandboard?

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-24 11:14:24 +01:00
Arne Fitzenreiter
832770a868 kernel: update to 4.14.29
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-22 13:16:37 +01:00
Matthias Fischer
a05af852c5 vnstat: Update to 1.18
For details see: https://humdi.net/vnstat/CHANGES

Changed "SaveInterval 5" to "SaveInterval 1" in '/etc/vnstat.conf', triggered by
https://forum.ipfire.org/viewtopic.php?f=22&t=20448 to avoid data loss with 1Gbit
connections and high traffic.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-20 20:35:30 +00:00
Michael Tremer
eb68e27dd2 pakfire: Import key when system boots up
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-19 19:44:50 +00:00
Michael Tremer
5876642d17 ffmpeg: Ship libraries correctly
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-19 18:07:49 +00:00
Matthias Fischer
27ef66c26c hdparm: Update to 9.55
Changelogs against 9.53:

"hdparm-9.55:
	- added #include <sys/sysmacros.h> for major()/minor() macros

hdparm-9.54:
	- Partial revert of Jmicron changes, from Jan Friesse."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-19 11:56:35 +00:00
Matthias Fischer
71e5a29c81 dmidecode 3.1: Added patch (Fix firmware version of TPM device)
For details see:
http://git.savannah.gnu.org/cgit/dmidecode.git/commit/?id=174387405e98cd94c627832ae23abcb9be7e5623

"Both the operator (detected by clang, reported by Xorg) and the mask
for the minor firmware version field of TPM devices were wrong."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-19 11:56:19 +00:00
Matthias Fischer
9e9fdb39e6 unbound: Update to 1.7.0
For details see:
http://www.unbound.net/download.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-18 13:49:40 +00:00
Matthias Fischer
399c2f9ccc logrotate: Update to 3.14.0
For details see:
https://github.com/logrotate/logrotate/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-18 13:44:27 +00:00
Matthias Fischer
4e316ae0a0 htop: Update to 2.1.0
For details see:
https://hisham.hm/htop/index.php?page=downloads

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-18 13:44:25 +00:00
Matthias Fischer
9051f3c9d7 bind: Update to 9.11.3
For details see:
http://ftp.isc.org/isc/bind9/9.11.3/RELEASE-NOTES-bind-9.11.3.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-18 13:44:19 +00:00
Matthias Fischer
1c1c1ac238 nano: Update to 2.9.4
For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-18 13:44:14 +00:00
Matthias Fischer
8aeec0ba89 rsync: Update to 3.1.3
For details see:
https://download.samba.org/pub/rsync/src/rsync-3.1.3-NEWS

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-18 13:44:12 +00:00
Arne Fitzenreiter
62777ff407 kernel: update to 4.14.27
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-16 20:49:22 +01:00
Erik Kapfer
cdc1a0e901 OpenVPN: Update to version 2.4.5
This is primarily a maintenance release, with further improved OpenSSL 1.1 integration, several minor bug fixes and other minor improvements.
Further information can be found in here https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-245 and
here https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 .

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-16 14:38:02 +00:00
Arne Fitzenreiter
bf19f5c6a0 kernel: drop rpi kernel
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-14 19:39:23 +01:00
Arne Fitzenreiter
ce8a4ba6a0 kernel: update to 4.14.26
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-13 11:37:36 +01:00
Arne Fitzenreiter
7fab74918d kernel: update to 4.14.25
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-03-09 23:05:06 +01:00
Stephan Feddersen
f0e9ed78a2 WIO: increment PAK_VER
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-09 15:39:56 +00:00
Stephan Feddersen via Development
a25c95b3a0 WIO: Update to Version 1.3.2 several changes in many files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-09 15:39:48 +00:00
Matthias Fischer
d536c178ec ntp: Update to 4.2.8p11
For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

"This release addresses five security issues in ntpd:

	LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral
	association attack
		While fixed in ntp-4.2.8p7, there are significant additional protections for
		this issue in 4.2.8p11.
		Reported by Matt Van Gundy of Cisco.
	INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun
	leads to undefined behavior and information leak
		Reported by Yihan Lian of Qihoo 360.
	LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations
		Reported on the questions@ list.
	LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover
	from bad state
		Reported by Miroslav Lichvar of Red Hat.
	LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset
	authenticated interleaved association
		Reported by Miroslav Lichvar of Red Hat.

one security issue in ntpq:

	MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its
	buffer limit
		Reported by Michael Macnair of Thales-esecurity.com.

and provides over 33 bugfixes and 32 other improvements."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-07 18:44:04 +00:00
Matthias Fischer
cc4816a1af clamav 0.99.4: removed gcc patch
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-07 18:43:44 +00:00
Peter Müller
9d5e5eb012 Tor: update to 0.3.2.10
Update Tor to 0.3.2.10, which fixes some security and DoS
issues especially important for relays.

The release notes are available at:
https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes: #11662
2018-03-05 15:12:28 +00:00
Peter Müller
a12d488682 ClamAV: update to 0.99.4
Update ClamAV to 0.99.4 which fixes four security issues
and compatibility issues with GCC 6 and C++ 11.

The release note can be found here: http://blog.clamav.net/2018/03/clamav-0994-has-been-released.html

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-03-05 15:11:55 +00:00
Arne Fitzenreiter
d5e0428c15 kernel: 4.14.23
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-02-28 16:20:17 +01:00
Michael Tremer
263d1e6484 openssl: Apply ciphers patch before running Configure
This works just fine here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-28 11:49:47 +00:00
Peter Müller via Development
5929493445 set OpenSSL 1.1.0 DEFAULT cipher list to secure value
Only use secure cipher list for the OpenSSL DEFAULT list:
* ECDSA is preferred over RSA since it is faster and more scalable
* TLS 1.2 suites are preferred over anything older
* weak ciphers such as RC4 and 3DES have been eliminated
* AES-GCM is preferred over AES-CBC (known as "mac-then-encrypt" problem)
* ciphers without PFS are moved to the end of the cipher list

This patch leaves AES-CCM, AES-CCM8 and CHACHA20-POLY1305 suites
where they are since they are considered secure and there is no
need to change anything.

The DEFAULT cipher list is now (output of "openssl ciphers -v"):

ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES256-CCM8 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM8(256) Mac=AEAD
ECDHE-ECDSA-AES256-CCM  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-CCM8 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM8(128) Mac=AEAD
ECDHE-ECDSA-AES128-CCM  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(256) Mac=SHA384
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256
ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=Camellia(128) Mac=SHA256
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(256) Mac=SHA384
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256
ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=Camellia(128) Mac=SHA256
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH       Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
DHE-RSA-AES256-CCM8     TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM8(256) Mac=AEAD
DHE-RSA-AES256-CCM      TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM(256) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-CCM8     TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM8(128) Mac=AEAD
DHE-RSA-AES128-CCM      TLSv1.2 Kx=DH       Au=RSA  Enc=AESCCM(128) Mac=AEAD
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256
DHE-RSA-CAMELLIA256-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA256
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256
DHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA256
ECDHE-ECDSA-AES256-SHA  TLSv1 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA1
ECDHE-ECDSA-AES128-SHA  TLSv1 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA1
ECDHE-RSA-AES256-SHA    TLSv1 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1
ECDHE-RSA-AES128-SHA    TLSv1 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1
AES256-GCM-SHA384       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(256) Mac=AEAD
AES256-CCM8             TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM8(256) Mac=AEAD
AES256-CCM              TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM(256) Mac=AEAD
AES128-GCM-SHA256       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(128) Mac=AEAD
AES128-CCM8             TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM8(128) Mac=AEAD
AES128-CCM              TLSv1.2 Kx=RSA      Au=RSA  Enc=AESCCM(128) Mac=AEAD
AES256-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA256
CAMELLIA256-SHA256      TLSv1.2 Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA256
AES128-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA256
CAMELLIA128-SHA256      TLSv1.2 Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA256
AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
CAMELLIA256-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA1
AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
CAMELLIA128-SHA         SSLv3 Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA1

This has been discussed at 2017-12-04 (https://wiki.ipfire.org/devel/telco/2017-12-04)
and for a similar patch written for OpenSSL 1.0.x.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-28 11:45:03 +00:00
Arne Fitzenreiter
031ea15b00 kernel: update to 4.14.22
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-02-27 15:25:50 +01:00
Arne Fitzenreiter
1a7cfc2f10 Merge remote-tracking branch 'origin/core119' into kernel-4.14
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-02-27 12:38:18 +01:00
Arne Fitzenreiter
7eb86ee39e mpd: bump package to remove link against tcpwrapper
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-02-26 20:08:56 +01:00
Michael Tremer
ca4c354e08 Bump release of all packages linked against OpenSSL
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-26 16:28:16 +00:00
Arne Fitzenreiter
e5ef944d6e kernel: update to 4.14.21
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-02-23 19:33:15 +01:00
Michael Tremer
87484f5c78 openssl-compat: Do not try to apply missing padlock patch
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-22 18:52:03 +00:00
Michael Tremer
b9c56c9e9c openssl-compat: Add missing library path
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-22 18:50:38 +00:00
Michael Tremer
c2646dff80 Revert "wget: Link against GnuTLS instead of OpenSSL"
This reverts commit a46b159a8d.

wget 1.19.4 supports linking against OpenSSL 1.1.0.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-21 12:55:36 +00:00
Michael Tremer
9434bffaf2 Merge branch 'openssl-11' into next 2018-02-21 12:21:10 +00:00
Michael Tremer
ea3b9a4f88 strongswan: Update to 5.6.2
Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS
signatures that was caused by insufficient input validation.
One of the configurable parameters in algorithm identifier
structures for RSASSA-PSS signatures is the mask generation
function (MGF). Only MGF1 is currently specified for this purpose.
However, this in turn takes itself a parameter that specifies
the underlying hash function. strongSwan's parser did not
correctly handle the case of this parameter being absent,
causing an undefined data read.

This vulnerability has been registered as CVE-2018-6459.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-19 23:46:17 +00:00
Arne Fitzenreiter
854b9b994c kernel: update to 4.14.20
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-02-17 20:22:39 +01:00
Michael Tremer
e36a7e3cf2 haproxy: Link against libatomic on ARM
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-17 13:36:37 +00:00
Michael Tremer
429af17883 i2c-tools: New package
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-16 20:01:55 +00:00
Michael Tremer
0f354672a2 flac: Update to 1.3.2
The previous version fails to build on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-16 19:14:33 +00:00
Michael Tremer
909ba0ad4a nagios-plugins: Update rootfiles
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2018-02-13 16:30:24 +00:00
Arne Fitzenreiter
4cd8fd3f6d kernel: update to 4.14.19
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2018-02-13 14:49:32 +01:00