libarchive: update to version 3.4.1 (security fix)

Fixes CVE-2019-19221

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from df634dcc926650de22248b89620c649c0fef7602)
(cherry picked from commit ba43556aed90705bc04fd074d39ee6ea012a71f2)

php7: update to version 7.2.30

Fixes:
CVE-2020-7066
CVE-2020-7064

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 09738290a319cc2af74a0be9a52aa5a76b6ca98e)

php7: fix dependencies for mysqlnd (fixes #11113)

When during the build the openssl extension is also selected, then
the mysqlnd extension depends on it, too.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 50b1cd3757497a569538d751f4681a40df1b1202)

Merge pull request #11926 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix: start downloads on cold boot/fresh install

simple-adblock: bugfix: start downloads on cold boot

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #11907 from BKPepe/18.06-git

[18.06] git: update to version 2.20.4

git: update to version 2.20.4

Fixes CVE-2020-11008

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11857 from BKPepe/18.06-git

[18.06] git: update to version 2.20.3

Merge pull request #11883 from yousong/wget1806

[18.06] acme: depends on wget-ssl

acme: depends on wget-ssl

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit d917d662aedd9c133217b5c6d8c5a4f4a6bd3dea)

wget: make the ssl variant provides wget-ssl

This is to address the need for specifying dependency on a wget
implementation with ssl support.

Now we have a game of names for opkg

 1. uclient-fetch: minimal version by openwrt project
 2. wget-nossl: gnu wget w/o ssl support
 3. wget-ssl: for the moment since this commit, gnu wget w/ ssl support
 4. wget: uclient-fetch, wget-nossl, or wget-ssl
 5. gnu-wget: wget-nossl or wget-ssl

By the time we provide some dummy package like uclient-fetch-ssl and
make it also provide wget-ssl, I guess by then we will also need
gnu-wget-ssl...

Ref: https://github.com/openwrt/packages/issues/11534
Ref: https://github.com/openwrt/packages/pull/9941
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 585e4a38feca24c9650d4e762b44146ecd75d4d0 &
resolved conflict)

wget: do not provide itself

The package wget should not say that it provides itself.

This also make gnu-wget provide general so it is not written in Makefile
twice.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 75f2be7d509e802f2d946d732e7a7539c2b27d2e &
resolved conflict)

ruby: update to 2.5.8

This release includes security fixes, specially:

* CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix)
* CVE-2020-10933: Heap exposure vulnerability in the socket library

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

git: update to version 2.20.3

Fixes CVE-2020-5260

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nlbwmon: update to latest Git HEAD

34a1887 nfnetlink: disable sequence number checking

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 53c48fae1502e7f87fd93ff299db98cd119fa304)

Merge pull request #11821 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: bugfix: memory leak

https-dns-proxy: bugfix: memory leak

Signed-off-by: Stan Grishin <stangri@melmac.net>

nlbwmon: update to latest Git HEAD

e757e06 nfnetlink: allow specifying the socket buffer size
33c77cb nfnetlink: properly handle nl_recvmsgs() failures
95cced5 protocol: Include whitespace when reading names

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d81d777a0f009fe74d233de307a03f9951d6b960)

nlbwmon: bump to latest git

e921ca0a Add further commonly used protocols to the protocol file.

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry picked from commit 5e140462e42af3e5cb7680863794339f11ddda7d)

nlbwmon: add procd reload trigger for nlbwmon config

Signed-off-by: Richard Yu <yurichard3839@gmail.com>
(cherry picked from commit d5517583104c8521d978a911bff921588ba0e988)

nlbwmon: receive dhcp interface triggers

Not all interfaces may have been allocated address at nlbwmon startup so
it may not collect statistics as expected/configured.

Add interface triggers to catch dhcp events and restart as required.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit 662d3f16d2702fe55116c852f5d456e90891ee89)

net/nlbwmon: run with lower priority

Even on a powerful platform a nlbwmon process'
activities are sometimes affecting throoughput and
latency. This is a backgroud process, that should not
be running with default priority.
Even if it is a little deplayed, that is not a worry in
this case. The routing should be the main priority,
bandwidth stats collection can wait a bit.

Tested on Netgear R7800
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
(cherry picked from commit 9b3ecbd64a6328e13981165660d8930e8bb2446a)

Merge pull request #11803 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfixes: remove escape chars from log, restore from cache on boot

simple-adblock: bugfixes: remove escape chars from log, restore from cache on boot

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9.2

Update nano editor to version 4.9.2

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit f11833d46cf71be65439397e2a7e03643fc78af2)

Merge pull request #11773 from BKPepe/msmtp

[18.06] msmtp: update to version 1.8.7

msmtp: update to version 1.8.7

- It brings oauthbearer support
- It switches from OpenSSL to GnuTLS, which is fully compatible and
  brings more parameters

Makefile changes:
- Fix SPDX License Identifier
- Add PKG_CPE_ID
- The Project does not use sourceforce anymore.
- Uses GnuTLS instead of OpenSSL, which was discouraged

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nano: update to 4.9.1

Update nano editor to version 4.9.1

 2020.03.31 - GNU nano 4.9.1 "Sapperdeflap"
 Two bugs introduced in version 4.9 are fixed: the cursor
 getting misplaced when undoing line cuts, and filtering
 of the whole buffer to a new buffer not working.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit f5c47a2606cea00ef70ae696224cd201ca1aceb8)

Merge pull request #11756 from gladiac1337/haproxy-1.8.25-openwrt-18.06

[openwrt-18.06] haproxy: Update HAProxy to v1.8.25

haproxy: Update HAProxy to v1.8.25

- Update haproxy download URL and hash
- This fixes CVE-2020-11100 (http://git.haproxy.org/?p=haproxy-1.8.git;a=commit;h=525fbbe388ba033d638ff2a4efb83ae6526db5ab)

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #11700 from stangri/18.06-simple-adblock

[18.06] simple-adblock: support multiple dnsmasq instances + internal refactoring

simple-adblock: support multiple dnsmasq instances; rework communication between principal package and luci app

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9

Update nano editor to version 4.9

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 09fd4445b3f7c426212ed61b3989e1994255a8aa)

Merge pull request #11626 from nxhack/18_06_icu_fix_CVE-2020-10531

[openwrt-18.06] icu: fix CVE-2020-10531

Merge pull request #11616 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: support for dnsmasq noresolv option

icu: fix CVE-2020-10531

FIX CVE-2020-10531
 An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

https-dns-proxy: support for dnsmasq noresolv option

Signed-off-by: Stan Grishin <stangri@melmac.net>

openvswitch: fix PIE build against 4.14 kernel

Reported-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Ref: https://github.com/openwrt/packages/pull/11567
(cherry picked from commit e9d6414437d27803a16b5d96c48b45140e989e5e)

php7: update to 7.2.28

This fixes:
  - CVE-2020-7062
  - CVE-2020-7063

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 95c72d8abaa8a99471275ae0723e4d941f36d81a)

php7: update to 7.2.27

This fixes:
  - CVE-2020-7059
  - CVE-2020-7060

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 3cf0c61f2ee1b94c8b09adb8c1cbc79281cfc32d)

xl2tpd: fix building failure caused by pfc

Fixes openwrt/packages#10270

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 0412c20f1b2d2e1f8b8c7e101aae6f66be50690a)

xl2tpd: bump to version 1.3.15

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Ref: https://github.com/openwrt/packages/issues/11418
(cherry picked from commit 620ba386b4ffd38911e7ddf0c864979c0f834a11)

icu: bump proper variable.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

icu: backport upstream ARC patch

Signed-off-by: Rosen Penev <rosenp@gmail.com>

nano: update to 4.8

Update nano editor to version 4.8

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 7bc96280d31470b7dda75315154c8df72bde222a)

Merge pull request #11252 from neheb/i22p

i2pd: fix various issues in 18.06

i2pd: move chmod command

Similar change to upstream.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

i2pd: Move DATADIR to /var/lib/i2pd, fix #5693

Original author: dartraiden <wowemuh@gmail.com>

Signed-off-by: David Yang <mmyangfl@gmail.com>

Merge pull request #11227 from micmac1/sqlite3-18.06-2

[18.06] sqlite3: bump to 3.31.1

sqlite3: bump to 3.31.1

Upstreamed patch removed.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Merge pull request #11186 from micmac1/18.06-maria-10.1.44

[18.06] mariadb: security bump to 10.1.44

mariadb: security bump to 10.1.44

Addresses CVE-2020-2574. Patches refreshed.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

ddns-scripts: Change protocols of afraid.org urls to HTTPS.

- Use HTTPS protocol for updating urls for afraid.org to protect the password.
- Bump/align package version number.

Signed-off-by: Kwonjin Jeong <gram25gwh@gmail.com>
(cherry-picked from e25b55899927eb5638cc6a13a568ee4271eed2b2)

node-hid: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1aa55f86b56766074677bcda23f19cd7e5b5601f)

node-serialport: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1ce1ca6e0622c6ad7fb61e44b7c96b028939186a)

Merge pull request #11124 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: fix deleting server items, configurable dnsmasq settings change

Merge pull request #11127 from micmac1/18.06-tiff

[18.06] tiff: update to 4.1.0

tiff: update version to 4.1.0

Signed-off-by: Jiri Slachta <jiri@slachta.eu>

tiff: patch security issues

Fixes
CVE-2019-7663
CVE-2019-6128

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

https-dns-proxy: fix deleting server items, configurable dnsmasq settings change

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #9795 from LoEE/jpc/git-macos-cross

[18.06]git: fix cross compilation on macOS

libsoup: fix intltool host dependency. Cleaup some build args

Signed-off-by: Ted Hess <thess@kitschensync.net>
(cherry-picked from 0daec55ce50d4dffae040645227a718ce528b978)

avrdude: Fix GPIO path building

%ud is a GNU extension. It's not really supported elsewhere.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 536c6b8be7cb620f6258cbcb7e85a50662976f2b)

zerotier: add /etc/config/zerotier as configuration file

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

libseccomp: add seccomp-syscalls.h to InstallDev

In the version 2.4.2, there was introduced a new header file.
Ship it to InstallDev

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11023 from jefferyto/golang-goarm-fix-openwrt-18.06

[openwrt-18.06] golang: Fix selection of GOARM value

golang: Fix selection of GOARM value

This fixes how GOARM is selected for arm platforms, based on support for
VFP/VFPv3 rather than CPU version.

Fixes #10967.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #10995 from BKPepe/libseccomp-18.06

[18.06] libseccomp: update to version 2.4.2

libseccomp: update to version 2.4.2

Fixes CVE-2019-9893

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

transmission: sync with master

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #10832 from BKPepe/git-18.06

[OpenWrt 18.06] git: Update to version 2.16.6 (security fix)

git: Update to version 2.16.6 (security fix)

Fixes CVEs:
CVE-2018-17456
CVE-2019-1348
CVE-2019-1349
CVE-2019-1350
CVE-2019-1351
CVE-2019-1352
CVE-2019-1353
CVE-2019-1354
CVE-2019-1387

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10858 from BKPepe/wget-18.06

[OpenWrt 18.06] wget: fix CVE-2019-5953

lcdgrilo: Fix compilation with newer Vala

It seems semantics changed slightly.

Cleaned up Makefile for consistency between packages.

Added PKG_BUILD_PARALLEL for faster compilation.

Fixed license information.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 16fb706641222ac44f61aaee6161b2cb4596336d)

lcdgrilo: Depend on vala/host instead

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 5935670ba14ed575799e4df4e4227826e3fef682)

lcdgrilo: remove check dependency

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 2e8b7358c4c336a5a5845351db642e8f45aa61d2)

nano: update to 4.7

Update nano to version 4.7

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit c62f8962ba3cf4e044941e372a155a97e5438ebd)

Merge pull request #10889 from EricLuehrsen/unbound_196_1806

[18.06] unbound: update to 1.9.6

unbound: update to 1.9.6

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>

grilo: copy vapi files to versioned vala dir

The version is obtained via `valac --api-version`

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 8d0c849e561bd5a984ccd2e99c67a7f9c4ed68f1)

grilo: update vapi files, copy to unversioned dir

Updates vapigen-generated vapi files to vala-0.34.
Files are now copied to $(STAGING_DIR_HOSTPKG)/share/vala/vapi, without
the vala version being hardcoded.
Removed copyright line, and redundant PKG_BUILD_DEPENDS and
TARGET_LDFLAGS.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 1b794e93e356c35b7c4d09019a0364e237efdbc6)

lcdproc: Fix non x86 platforms on musl

Musl only specifies in/outb for x86/x86. Use the fallback path in case
musl is used.

This should fail compilation during the linking stage but for some reason
does not. Will do if -Werror=implicit-function-declaration is specified.

Fixed up license information.

Other small cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from fa40b85f20f697e4c0b7b96b77b3a40902c72605)

Merge pull request #10763 from leonghui/wiki-link-update-18.06

[18.06] treewide: replace old wiki links

php7: update to 7.2.26

This fixes:
  - CVE-2019-11046
  - CVE-2019-11044
  - CVE-2019-11045
  - CVE-2019-11050
  - CVE-2019-11047

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit d5c18b1d5e7171a23e17ec9fd3604f794a336f1e)

bind: Update to version 9.11.14

Add patch to fix compile issue:
stats.c: In function 'setcounter':
stats.c:300:29: error: 'val' undeclared (first use in this function); did you mean 'value'?
  stats->counters[counter] = val;
                             ^~~
                             value

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

wget: fix CVE-2019-5953

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10855 from BKPepe/python3-18.06

[OpenWrt 18.06] python3: Updated to version 3.6.10

python3: Updated to version 3.6.10

Remove backported patches:
025-bpo-34155-Dont-parse-domains-containing-GH-13079-GH-.patch
026-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch

Fixes CVE-2019-16056

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10846 from cshoredaniel/pr-18.06-fix-nut-cgi-initscript

nut: Fix NUT CGI startup script

nut: Fix NUT CGI startup script

Commit c1aa1f784c737283b281da7a541921a88a81e684 which backported
a number of fixes from master, missed one fix for nut-cgi.  If
nut-cgi is installed standalone or nut-cgi starts before nut-server
(the default in 18.04.5) then the configuration file directory does
not get create and therefore there is no CGI configuration file.
This commit fixes that.

Closes: #10687
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

Merge pull request #10752 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: switch to https-dns-proxy package name

git: Update to version 2.16.6 (security fix)

Fixes CVEs:
CVE-2018-17456
CVE-2019-1348
CVE-2019-1349
CVE-2019-1350
CVE-2019-1351
CVE-2019-1352
CVE-2019-1353
CVE-2019-1354
CVE-2019-1387

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

https-dns-proxy: switch to https-dns-proxy package name

Signed-off-by: Stan Grishin <stangri@melmac.net>

treewide: update wiki links

Signed-off-by: Leong Hui Wong <wong.leonghui@gmail.com>

Merge pull request #10744 from luizluca/libvpx-fixcve

[18.06] libvpx: backport security fixes

libvpx: backport security fixes

Fixes CVE-2019-9232 CVE-2019-9325 CVE-2019-9371 CVE-2019-9433.

From: openwrt/telephony#492

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

luajit: install libluajit-5.1.so.2

Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry-picked from commit 30d5958)

luajit: add .hpp to InstallDev

Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry-picked from commit efb7d0be6dd7882748d337391c5568d829bf17f5)

nano: update to 4.6

Update nano editor to version 4.6

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 421dae85a3525f9772bbada523758490a926be3c)

Merge pull request #10678 from gladiac1337/haproxy-1.8.23-openwrt-18.06

[openwrt-18.06] haproxy: Update HAProxy to v1.8.23