Merge pull request #19085 from hardfalcon/unbound-1.16.2

unbound: update to 1.16.2, fix CVE-2022-30698, CVE-2022-30699

ksmbd-tools: add package with hotplug.d script for auto sharing

One of common use cases for SMB3 server in routers is sharing hotplugged
drives. Users make many attempts setting that up which often are not
optimal.

This script handles it in the cleanest way by using:
1. hotplug.d mount subsystem
2. runtime config in the /var/run/config/

It provides a working basic solution that can be later adjusted by
modifying provided hotplug script.

A pretty much idential solution was part of the samba36 package. It was
added in the OpenWrt commit ef1efa756e0d0 ("samba36: add package with
hotplug.d script for auto sharing") as an answer for feature required by
the Rosinson company.

Cc: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

ksmbd-tools: append config from /var/run/config/ for runtime shares

Dynamically created shares shouldn't be stored in the /etc/config/
because of:
1. Flash wearing
2. Risk of inconsistent state on reboots

With this change all automation/hotplug.d scripts can store runtime in
the /var/run/config/samba. It's useful e.g. for USB drives that user
wants to be automatically shared.

Also: automated scripts should never call "uci [foo] commit" as that
could flush incomplete config. This problem also gets solved.

Identical feature was added to samba36 in the OpenWrt commit
5a59e2c059866 ("samba36: append config from /var/run/config/ for runtime
shares") but wasn't ported to ksmbd until now.

Cc: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

Merge pull request #19146 from pprindeville/strongswan-include-mgf1

strongswan: bundle mgf1 with everything

shadowsocks-libev: ss-rules: nft rule cleanup on reload

Remove nft rules file generated by ss-rules if ss-rules was or should be
turned off for by configuration.  Use "fw4 restart" instead of "fw4
reload" to force the runtime rule reloading

Ref: https://github.com/openwrt/packages/pull/17937#issuecomment-1207357037
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

shadowsocks-libev: ss-rules: setup policy rules for udp/ip6

Supersedes: https://github.com/openwrt/packages/pull/18852
Fixes: https://github.com/openwrt/packages/issues/18850
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

strongswan: bundle mgf1 with everything

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

Merge pull request #19145 from Thermi/strongswan-5.9.7-model-kdf-dependencies

strongswan: try to model kdf optional dependencies

strongswan: try to model kdf optional dependencies

Signed-off-by: Noel Kuntze <noel.kuntze@thermi.consulting>

cgi-io: update to latest Git HEAD

901b0f0 main: fix two one-byte overreads in header_value()

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Merge pull request #19128 from pprindeville/strongswan-update-5.9.7

strongswan: Update to 5.9.7

Merge pull request #19084 from jtkohl/watchcat-ping-bugfix

watchcat: fix broken ping invocation for no-address-family configuration

Merge pull request #19125 from hirnpfirsich/master

prometheus-node-exporter-lua: add realtek-poe exporter

strongswan: Update to 5.9.7

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

Merge pull request #19130 from mhei/php8-update-8.1.9

php8: update to 8.1.9

prometheus-node-exporter-lua: add realtek-poe exporter

exposes PoE metrics obtained from realtek-poe

 # HELP realtek_poe_switch_info information about the poe controller
 # TYPE realtek_poe_switch_info gauge
 realtek_poe_switch_info{mcu="ST Micro ST32F100 Microcontroller",firmware="v22.4"} 1

 # HELP realtek_poe_switch_budget_watts overall power budget
 # TYPE realtek_poe_switch_budget_watts gauge
 realtek_poe_switch_budget_watts 77

 # HELP realtek_poe_switch_consumption_watts overall power consumption
 # TYPE realtek_poe_switch_consumption_watts gauge
 realtek_poe_switch_consumption_watts 5

 # HELP realtek_poe_port_priority poe priority of port
 # TYPE realtek_poe_port_priority gauge
 realtek_poe_port_priority{device="lan1"} 1
 realtek_poe_port_priority{device="lan2"} 1
 [...]

 # HELP realtek_poe_port_consumption_watts per port power consumption
 # TYPE realtek_poe_port_consumption_watts gauge
 realtek_poe_port_consumption_watts{device="lan1"} 0
 realtek_poe_port_consumption_watts{device="lan2"} 0
 [...]

 # HELP realtek_poe_port_state per port poe state
 # TYPE realtek_poe_port_state gauge
 realtek_poe_port_state{device="lan1",state="Disabled"} 0
 realtek_poe_port_state{device="lan1",state="Searching"} 1
 [...]
 (states: Disabled, Searching, Delivering power, Fault, Other fault, Requesting power)

 # HELP realtek_poe_port_mode per port poe mode
 # TYPE realtek_poe_port_mode gauge
 realtek_poe_port_mode{device="lan1",mode="PoE"} 0
 realtek_poe_port_mode{device="lan1",mode="PoE+"} 1
 [...]
 (modes: PoE, Legacy, pre-PoE+, PoE+)

Signed-off-by: Gregor Michels <hirnpfirsich@brainpeach.de>

Merge pull request #19114 from commodo/squashfs-tools-zstd

squashfs-tools: enable zstd compression by default

php8: update to 8.1.9

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Merge pull request #18628 from mcb30/openconnect-proxy

OpenConnect proxy support

prometheus-node-exporter-lua: fix hostapd stations

We can only utilize statistics from interfaces having ubus interface.

Signed-off-by: Nick Hainke <vincent@systemli.org>

Merge pull request #18834 from jpds/prometheus-selinux-collector

prometheus-node-exporter-lua: Added selinux.lua.

openconnect: Allow reconnect timeout to be specified

Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>

openconnect: Support use of a proxy server

Allow connection via a proxy server (required on some sites where
direct outbound HTTP(S) access is not permitted).

Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>

Merge pull request #19126 from PolynomialDivision/update-gnutls

gnutls: update to 3.7.7

gnutls: update to 3.7.7

- libgnutls: Fixed double free during verification of pkcs7 signatures.
  Reported by Jaak Ristioja (#1383). [GNUTLS-SA-2022-07-07, CVSS: medium]
  [CVE-2022-2509]

- libgnutls: gnutls_hkdf_expand now only accepts LENGTH argument less than or
  equal to 255 times hash digest size, to comply with RFC 5869 2.3.

- libgnutls: Length limit for TLS PSK usernames has been increased
  from 128 to 65535 characters (#1323).

- libgnutls: AES-GCM encryption function now limits plaintext
  length to 2^39-256 bits, according to SP800-38D 5.2.1.1.

- libgnutls: New block cipher functions have been added to transparently
  handle padding.  gnutls_cipher_encrypt3 and gnutls_cipher_decrypt3 can be
  used in combination of GNUTLS_CIPHER_PADDING_PKCS7 flag to automatically
  add/remove padding if the length of the original plaintext is not a multiple
  of the block size.

- libgnutls: New function for manual FIPS self-testing.

API and ABI modifications:
- gnutls_fips140_run_self_tests: New function
- gnutls_cipher_encrypt3: New function
- gnutls_cipher_decrypt3: New function
- gnutls_cipher_padding_flags_t: New enum

Signed-off-by: Nick Hainke <vincent@systemli.org>

yq: Update to 4.27.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

mxml: update to 3.3.1

Signed-off-by: Espen Jürgensen <espenjurgensen+openwrt@gmail.com>

luajit: patch: PPC/e500 SPE: use soft float instead of failing

makes LuaJit builds for mpc85xx targets with SPE ISA extension
enabled possible

Quoting inner commit message:

This allows building LuaJit for systems with Power ISA SPE
extension[^1] support by using soft float on LuaJit side.

While e500 CPU cores support SPE instruction set extension
allowing them to perform floating point arithmetic natively,
this isn't required. They can function with software floating
point to integer arithmetic translation as well,
just like FPU-less PowerPC CPUs without SPE support.

Therefore I see no need to prevent them from running LuaJit
explicitly.

[^1]: https://www.nxp.com/docs/en/reference-manual/SPEPEM.pdf

Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>

squashfs-tools: enable zstd compression by default

Requested via:
  https://github.com/openwrt/packages/issues/19111

PKG_RELEASE is set to AUTORELEASE, so no need to bump.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

Merge pull request #19104 from janh/python-paho-mqtt-depends-uuid

python-paho-mqtt: add missing dependency

kea: bump to 2.0.3

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

squeezelite: update to 1.9.9-1403

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #19083 from pprindeville/drop-parallel-support-non-x86

lcdproc: don't enable LPT support on non-x86 architectures

Merge pull request #18781 from paper42/fail2ban-py310

fail2ban: fix patch for python 3.10

Merge pull request #19021 from borkra/fix_dependencies

Avoid building unused package dependencies

lcdproc: don't enable LPT support on non-x86 architectures

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

python-paho-mqtt: add missing dependency

The uuid module has been split out into a separate package with the
update to Python 3.10.

Signed-off-by: Jan Hoffmann <jan@3e8.eu>

sexpect: updated to 2.3.11

Signed-off-by: Clark Wang <dearvoid@gmail.com>

python-jsonschema: Update to 4.9.0

Signed-off-by: Javier Marcet <javier@marcet.info>

docker-compose: Update to version 2.9.0

Signed-off-by: Javier Marcet <javier@marcet.info>

unbound: update to 1.16.2, fix CVE-2022-30698, CVE-2022-30699

Maintainer: @EricLuehrsen
Compile tested: x86/64
Run tested: x86/64
Description: Update to 1.16.2, fix CVE-2022-30698 and CVE-2022-30699.

Signed-off-by: Pascal Ernster <git@hardfalcon.net>

nano: update to 6.4

Update nano editor to version 6.4.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

coremark: bump to 2022-07-27

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>

watchcat: fix broken ping invocation for no-address-family configuration

Fix for issue #19010

Signed-off-by: John Kohl <jtk.git@bostonpog.org>
Signed-off-by: Michal Kowalski <18610805+kofec@users.noreply.github.com>

gnutls: Avoid building unused gnutls dependency

Avoid building unused gnutls dependency

Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>

gensio: Avoid building unused python and libstdcpp dependecies

Avoid building unused python and libstdcpp dependecies

Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>

chrony: Avoid building unused gnutls and ca dependencies

Avoid building unused gnutls and ca dependencies

Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>

realtek-poe: Add package to control PoE for Realtek 838x devices

The realtek-poe package is used to configure the Power-over-Ethernet
controller found on Realtex 838x based switches. On many such
switches, the PoE doesn't work without this package.

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>

Merge pull request #19055 from pprindeville/issue#18975

lcdproc: don't detect parallel port on build host

lcdproc: don't detect parallel port on build host

Also, limit builds to x86 and x86_64.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

Merge pull request #18931 from alinnastac/libxml2-iconv

libxml2: add libiconv path to pkg-config file

Merge pull request #19073 from jempatel/apinger-rrd-graph

apinger: add rrd graph support

apinger: add rrd graph support

- add package apinger-rrd for RRD graphs
- add RPC to get an overview and update graphs
- fix interface hotplug to restart apinger instance
- add patch to split alarms list in the status

Signed-off-by: Jaymin Patel <jem.patel@gmail.com>

stunnel: update version to 5.65

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

frr: update to 8.3.0

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

domoticz: fix read of "disabled" uci configuration parameter

The domoticz init script didn't properly read the "disabled"
configuration parameter and instead the service was always started.

Signed-off-by: Robert Högberg <robert.hogberg@gmail.com>

ffmpeg: update to 5.1

Bump to latest upstream version, manually rebased: 050-glibc.patch

Tested using:
ffmpeg -f lavfi -i testsrc=duration=10:size=1280x720:rate=30 testsrc.mpg

Resulting mpg was good.

Build system: x86_64
Build-tested: bcm2711/RPi4B
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <therealgraysky@proton.me>

tar: add PKG_CONFIG_DEPENDS

fixes compilation when deselecting options.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

hfsprogs: remove unused libbsd

hfsprogs uses libbsd for strlcpy(), but the strlcpy() calls are inside
`#ifdef` and don't show up on the OpenWRT package.

Signed-off-by: Guilherme Janczak <guilherme.janczak@yandex.com>

rclone: update to 1.59.0

Release note: https://rclone.org/changelog/#v1-59-0-2022-07-09

Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>

Merge pull request #18993 from mhei/php8-update-8.1.8

php8: update to 8.1.8

Merge pull request #18930 from pprindeville/isc-dhcp-drop-allow-update

isc-dhcp: don't use allow-update in bind config

Merge pull request #19060 from MoetaYuko/patch-1

kitty-terminfo: Fix license

kitty-terminfo: Fix license

Signed-off-by: Jitao Lu <dianlujitao@gmail.com>

Merge pull request #18914 from stangri/master-nebula

nebula: update to 1.6.0

zmq: remove libbsd dependency

Not really needed for anything. Patch taken from upstream.

Remove obsolete libpthread and librt dependencies.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libwebp: bump to version 1.2.3

Drop upstreamed patch '001-fix-cmake-webpmux-linking.patch'.
Re-adapted patch '010-mips16.patch'

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

telegraf: Update to version 1.23.3

Signed-off-by: Jonathan Pagel <jonny_tischbein@systemli.org>

Merge pull request #19047 from liudf0716/xfrpc

xfrpc: Update to 1.07.582

xfrpc: Update to 1.07.582

Signed-off-by: Dengfeng Liu <liudf0716@gmail.com>

dockerd: Update to v20.10.17

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

docker: Update to v20.10.17

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

libnetwork: Update to f6ccccb for Docker v20.10.17

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

containerd: Update to v1.6.6 for Docker v20.10.17

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

runc: Update to v1.1.2 for Docker v20.10.17

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

modemmanager: fix mm_log() invocations in 25-modemmanager* files

Definition of mm_log() was changed in
45a56a889943b437f78fa2bfca3d5d8ac555c77e but 25-modemmanager* weren't
changed.

Signed-off-by: Arkadiusz Drabczyk <arkadiusz@drabczyk.org>

dawn: update to 2022-07-24

edca4d2 network: rework network status callbacks

Signed-off-by: Nick Hainke <vincent@systemli.org>

ruby: fix build with LibreSSL over v3.5

LibreSSL 3.5 and later provide and need to use
PEM_write_bio_PrivateKey_traditional()

upstream commit:
https://github.com/ruby/openssl/commit/e25fb0d0d86da5a9398ebdc9216b2ea89f80fa3d
https://github.com/ruby/openssl/commit/b02815271fcc295cb8b07ef740684b88a10f2760

Signed-off-by: ZiMing Mo <msylgj@immortalwrt.org>

erlang: workaround LibreSSL-3.5.0 compat issues

Cherry-pick four upstream commits that prevent building of
otp_test_engine when LibreSSL-3.5.0 is used.

Since OpenWrt bumped LibreSSL to 3.5.3 the erlang host builds fail to
complete.

 CC ../priv/obj/x86_64-pc-linux-gnu/otp_test_engine.o
otp_test_engine.c: In function 'test_engine_md5_init':
otp_test_engine.c:144:34: error: dereferencing pointer to incomplete type 'EVP_MD_CTX' {aka 'struct env_md_ctx_st'}
 #define data(ctx) ((MD5_CTX *)ctx->md_data)
                                  ^~

Also switch to AUTORELEASE.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

curl: switch default SSL to mbedTLS

The decision to switch the default to wolfSSL was taken because of
hostapd back from when curl was in base. Unfortunately, not only is
wolfSSL bigger but it has also been causing issues recently. There's
also no relation between hostapd and curl.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

python3: update patches for libressl v3.5

Based upon patches from OpenBSD[0] and Gentoo[1].

Switched to the LibreSSL provided LIBRESSL_VERSION_NUMBER macro, which
makes OPENWRT_HOST_BUILD redundant.

[0] https://github.com/openbsd/ports/tree/master/lang/python/3.10/patches
[1] https://github.com/gentoo/libressl/tree/master/dev-lang/python/files

Signed-off-by: Andre Heider <a.heider@gmail.com>

cryptsetup: fix library paths by calling autoreconf

Use PKG_FIXUP:=autoreconf when building cryptsetup to prevent
accidental linkage against host libraries.

Fixes: #19011
Reported-by: @dreirund
Signed-off-by: Daniel Golle <daniel@makrotopia.org>

yt-dlp: update to 2022.7.18

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

dawn: update to 2022-07-22

10fb043 network: dump detail on ping pong received

Signed-off-by: Nick Hainke <vincent@systemli.org>

Merge pull request #18966 from commodo/django-bump

django: bump to version 4.0.6

crelay: update to 0.14.1

Also add a meson.build file to avoid iconv hacks.

Remove upstreamed patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

docker-compose: Update to version 2.7.0

What's Changed:

 - Enhancements:

   - add support of environment secret during build step by @glours

 - Fixes:

   - networks: prevent issues due to duplicate names by @milas
   - Use appropriate dependency condition for one-shot containers when
   running compose up --wait by @laurazard
   - Fix environment variable expansion by @ulyssessouza in
   compose-spec/compose-go#276
   - Validate depended-on services exist in consistency check by
   @laurazard in compose-spec/compose-go#281
   - Fix hash usage in environment values by @ulyssessouza in
   compose-spec/compose-go#283
   - build: respect dependency order for classic builder by @milas
   - fix: panic caused by empty string argument by @nicksieger
   - (re)start should not impact one-off containers by @ndeloof
   - Fix issue with close networks name on up and down command by
   @glours
   - keep the container reference when volumes_from target a container
   and not a service by @glours
   - build.go: initialize CustomLabels map if nil by @paroque28

Signed-off-by: Javier Marcet <javier@marcet.info>

dawn: update to 2022-07-21

bb362db datastorage: fix ap_array_unlink_entry always returns NULL
47e98ef network: ping pong keepalive for tcp connections
eba0354 network: add timeout for client connections

In the dawn config the con_timeout needs to be added:
  option con_timeout '60'

Signed-off-by: Nick Hainke <vincent@systemli.org>

usteer: update to latest HEAD

9059b9a ubus: derive RSSI from measurement report

Signed-off-by: David Bauer <mail@david-bauer.net>

libxml2: add libiconv path to pkg-config file

Needed for applications that use libxml-2.0.pc Libs.private params
to link with -liconv library.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>

php8: update to 8.1.8

This fixes:
    - CVE-2022-31627

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

mutt: add PKG_CONFIG_DEPENDS

Should fix missing dependencies when manupulating options.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

opusfile: add autoreconf

Fixes compilation under some hosts.

Added PKG_BUILD_PARALLEL for faster compilation.

Some small cleanups for consistency between packages.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

geth: update to 1.10.20

Fix compilation with latest iconv changes.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libulfius: update to 2.7.10

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

glib2: disable fortify source

The glib2 package fails to build when CONFIG_PKG_FORTIFY_SOURCE_1 or
CONFIG_PKG_FORTIFY_SOURCE_2 is enabled in the OpenWrt config:

In file included from ../glib/libcharset/localcharset.c:28:
/home/stijn/Development/OpenWrt/openwrt/staging_dir/toolchain-powerpc64_e5500_gcc-11.2.0_musl/include/fortify/stdio.h: In function 'snprintf':
/home/stijn/Development/OpenWrt/openwrt/staging_dir/toolchain-powerpc64_e5500_gcc-11.2.0_musl/include/fortify/stdio.h:101:9: error: format not a string literal, argument types not checked [-Werror=format-nonliteral]
  101 |         return __orig_snprintf(__s, __n, __f, __builtin_va_arg_pack());
      |         ^~~~~~
/home/stijn/Development/OpenWrt/openwrt/staging_dir/toolchain-powerpc64_e5500_gcc-11.2.0_musl/include/fortify/stdio.h: In function 'sprintf':
/home/stijn/Development/OpenWrt/openwrt/staging_dir/toolchain-powerpc64_e5500_gcc-11.2.0_musl/include/fortify/stdio.h:110:17: error: format not a string literal, argument types not checked [-Werror=format-nonliteral]
  110 |                 __r = __orig_snprintf(__s, __b, __f, __builtin_va_arg_pack());
      |                 ^~~
/home/stijn/Development/OpenWrt/openwrt/staging_dir/toolchain-powerpc64_e5500_gcc-11.2.0_musl/include/fortify/stdio.h:114:17: error: format not a string literal, argument types not checked [-Werror=format-nonliteral]
  114 |                 __r = __orig_sprintf(__s, __f, __builtin_va_arg_pack());
      |                 ^~~

Disable fortify source for the package as a workaround.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

wifidog: fix compilation with more recent wolfssl

Needs an extra header. pthread.h is also no longer implicitly included.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

curl: fix compilation with wolfSSL

options.h header is needed now.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #18919 from mhei/php8-full-libiconv

php8: fixup libiconv usage (refs openwrt/openwrt#10024)

irqbalance: add meson

Fixes compilation when libiconv is missing.

Also remove pthread from glibc. No longer needed.

Cleanup Makefile for consistency between packages.

Signed-off-by: Rosen Penev <rosenp@gmail.com>