openvpn: update to 2.5.3

Fix a possible security issue with OpenSSL config autoloading on Windows (CVE-2021-3606).
Include a number of small improvements and bug fixes.

remove upstreamed: 115-fix-mbedtls-without-renegotiation.patch

Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>

Merge pull request #15855 from JamesVorder/yggdrasil/https

yggdrasil: allow HTTPS connections

Merge pull request #15890 from CodeFetch/patch-11

strongswan: fix PSK config generation

strongswan: fix PSK config generation

There were closing curly braces missing and it was checking for empty
strings while it should have been checking for non-empty strings.

Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>

Merge pull request #15897 from pprindeville/strongswan-fix-dir-typo

strongswan: use correct directory for CA's

strongswan: use correct directory for CA's

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

banip: refine/fix nginx search pattern

* fix issue with nginx search pattern reported in forum support thread

Signed-off-by: Dirk Brenken <dev@brenken.org>

Merge pull request #15875 from CodeFetch/patch-10

apparmor: fix packaging

Merge pull request #15891 from pprindeville/strongswan-update-config

strongswan: fix sharing of ipsec section variables

Merge pull request #15892 from ja-pa/knot-resolver-fix-scheduling

knot-resolver: change scheduling priority

Merge pull request #15894 from Andy2244/samba_4.13.9

samba4: update to 4.13.9

samba4: update to 4.13.9

* update to 4.13.9

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

python-cryptography: bump to version 3.4.7

Dropped patches:
  0004-Replace-EVP_CIPHER_CTX_cleanup-with-EVP_CIPHER_CTX_r.patch
  0005-Switch-get_-Update-APIs-to-get0.patch

Reworked patches:
  0001-Add-new-ASN1_STRING_get0_data-API.patch
  0006-Add-X509_STORE_CTX_trusted_stack-compatibility-macro.patch
These 2 require that we keep only the CUSTOMIZATIONS stuff for now. Maybe
later we can drop this.

Ran 'make package/python-cryptography/refresh'.

Added patch:
  0004-disable-rust.patch
upstream did a sloppy job with the CRYPTOGRAPHY_DONT_BUILD_RUST logic; we
need to patch it, to make sure the setuptools-rust isn't installed.
We may need to carry this patch in our tree for a bit longer than upstream,
because in newer versions, CRYPTOGRAPHY_DONT_BUILD_RUST logic gets removed.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

nano: update to 5.8

Update nano editor version to 5.8.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

strongswan: fix sharing of ipsec section variables

Variables set in config_ipsec() need to be shared with do_postamble()
function, so change scoping to parent (prepare_env()).

Also, remove unused settings like "remote_sourceip", "reqid", and
"packet_marker".

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

Merge pull request #15879 from neheb/lesss

less: update to 590

knot-resolver: change scheduling priority

This should prevent some resolving issues by other router app.

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Merge pull request #15880 from neheb/ogg

libogg: update to 1.3.5

apparmor: fix packaging

Removes the BUILDONLY flag as otherwise no packages will be created.

Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>

Merge pull request #15888 from tru7/linknx

linknx: adopt new libesmtp version

Merge pull request #15882 from neheb/es

libesmtp: update to 1.1.0

libesmtp: update to 1.1.0

New upstream. Uses meson now. Removed outdated patches.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #15878 from neheb/hdpa

hdparm: update to 9.62

linknx: adopt new libesmtp version

Signed-off-by: Othmar Truniger <github@truniger.ch>

yggdrasil: allow HTTPS connections

Signed-off-by: James Vorderbruggen <jamesvorder@gmail.com>

unbound: fix build on non-linux systems

Override places that call uname to detect target features

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Merge pull request #15881 from neheb/capn

libcap-ng: update to 0.8.2

libcap-ng: update to 0.8.2

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libogg: update to 1.3.5

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

less: update to 590

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

hdparm: update to 9.62

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #15876 from mstorchak/tmux

tmux: update to 3.2a

django: bump to version 3.2.4

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

auc: update to version 0.1.7

No longer fail in case a package is part of multiple lists (which may
happen temporarily in case it becomes 'nonshared').
Bump version to prepare for sync accross branches.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Merge pull request #15873 from commodo/netatalk-drop

netatalk: drop package

Merge pull request #15825 from TDT-AG/pr/20210611-dockerd

dockerd: refactoring uciadd and ucidel handling

netatalk: drop package

Link to abandoned packages PR: https://github.com/openwrt/packages-abandoned/pull/18

AppleShare products have been unused for a while now (since Mac OS 9.2.2)
around 2002.
So, there should be fewer users requiring this package.

Last update of netatalk was in December 2018. Not sure if newer updates
will be created.

It's time to cut the cord on our end and move it to the abandoned packages.

Info: https://en.wikipedia.org/wiki/AppleShare

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

Merge pull request #15849 from neheb/ppb

protobuf: update to 3.17.2

Merge pull request #15848 from neheb/als

alsa stuff: update to 1.2.5

Merge pull request #15847 from neheb/assh

autossh: fix compilation without ssh installed

dockerd: refactoring uciadd and ucidel handling

This change makes the handling of adding and deleting interface, device
bridge and firewall more robust.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

python3: Add readline to dependency finder script

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

mg: bump to 6.9

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

tmux: update to 3.2a

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>

Merge pull request #15868 from PowerDNS/pdns-recursor-4.5.2

pdns-recursor: update to 4.5.2

Merge pull request #15869 from PowerDNS/pdns-4.4.1

pdns: update to 4.4.1

pdns: update to 4.4.1

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

pdns-recursor: update to 4.5.2

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

Merge pull request #15864 from commodo/stress-ng-update

stress-ng: bump to version 0.12.10

Merge pull request #15866 from ja-pa/redis-6.2.4

redis: update to version 6.2.4

redis: update to version 6.2.4

Fixes CVE-2021-32625

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

parted: add new package

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>

stress-ng: bump to version 0.12.10

Patch `010-soft-float.patch` can be dropped.
It was upstreamed via https://github.com/ColinIanKing/stress-ng/pull/126

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

auc: fix several issues

 * don't segfault if server reply is incomplete
 * always request 'generic' image on x86/generic and x86/64
 * make SNAPSHOT branches sticky, eg. stay on 21.02-SNAPSHOT and do
   not 'upgrade' to 21.02.0-rc2.
 * output requested server URL when debugging

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

squashfs-tools: build with xz by default

squashfs-tools aren't of much use without xz compression support
on OpenWrt, as we build kernel with squashfs supporting only xz.
Enabled support for xz compression by default.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

uvol: try to be more shellcheck compliant, fix LVM vol-up

 * quotes around all variables
 * always use 'read -r' instead of 'read'
 * some more minor shellcheck fixes
 * reorder LVM ops for 'up' call to allow it to succeed

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

prometheus-node-export-lua: add my email

Add my email address to the copyright for the file.

Signed-off-by: Kevin Lyda <kevin@lyda.ie>

Merge pull request #15574 from AuthorReflex/ovpn-wolfssl

Enable using wolfSSL cryptographic API engine in OpenVPN

Merge pull request #15853 from jonathanunderwood/stubby-getdns-remove-maintainer

[stubby,getdns]: Remove maintainer from stubby and getdns packages

stubby: remove maintainer

Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>

getdns: remove maintainer

Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>

openvpn: enable using wolfSSL cryptographic API engine

Support for wolfSSL has been upstreamed to the master OpenVPN branch
in f6dca235ae560597a0763f0c98fcc9130b80ccf4 so we can use wolfSSL
directly in OpenVPN. So no more needed differnt SSL engine for OpenVPN
in systems based on wolfSSL library
Compiled && tested on ramips/mt7620, ramips/mt7621

Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>

Merge pull request #15845 from dibdot/banip

banip: update 0.7.9

banip: update 0.7.9

* add switch 'ban_fetchinsecure' to allow insecure downloads
  without certificate check (disabled by default)
* better explain 'ban_fetchparm' in readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

Merge pull request #15844 from dibdot/adblock

adblock: update 4.1.3

Merge pull request #15850 from neheb/ppbc

libprotobuf-c: update to 1.4.0

libprotobuf-c: update to 1.4.0

Remove patch. Upstream fixed it.

Add AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

protobuf: update to 3.17.2

Refreshed patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

ninja: remove ninja-cmake.mk

Useless now that stock cmake.mk uses ninja.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

treewide: back to cmake.mk

Ninja was merged to base and therefore we can now use normal cmake.mk

Signed-off-by: Rosen Penev <rosenp@gmail.com>

alsa-utils: update to 1.2.5

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

alsa-lib: update to 1.2.5

Refresh patches. Remove upstream one.

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

autossh: fix compilation without ssh installed

configure script looks for host ssh. Just pass the configure variable
directly. --with-ssh doesn't work.

Also get rid of custom Compile section. It's not needed.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #15846 from neheb/shr

shairport-sync: update to 3.3.8

shairport-sync: update to 3.3.8

Explicitly add libdaemon configure flag. It seems the default was
changed.

Add AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #15842 from oleg-derevenetz/bwping-2.3

bwping: update to version 2.3

Merge pull request #15839 from jefferyto/python-twisted-tls-conch

python-twisted: Add tls/conch dependencies

adblock: update 4.1.3

* fix a small json syntax issue in adblock.sources
* add easylist addon to reg_fr source
* add switch 'adb_fetchinsecure' to allow insecure downloads
  without certificate check (disabled by default)
* better explain 'adb_fetchparm' in readme

Signed-off-by: Dirk Brenken <dev@brenken.org>

Merge pull request #15837 from neheb/st

stubby: remove libidn2 and libunwind dependencies

bwping: update to version 2.3

Signed-off-by: Oleg Derevenetz <oleg-derevenetz@yandex.ru>

python-twisted: Add tls/conch dependencies

By adding these dependencies, it is much easier for users (both
applications that use Twisted and end users) to have secure
communications by default.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #15835 from jefferyto/python-twisted-21.2.0

python-twisted: Update to 21.2.0, redo patches

stubby: remove libidn2 and libunwind dependencies

There's no good way to get rid of these, so just delete the cmake files.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

python-twisted: Update to 21.2.0, redo patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #15808 from rsalvaterra/getdns

Bump getdns/stubby to 1.7.0 and 0.4.0 respectively

Merge pull request #15833 from jefferyto/python-incremental-21.3.0

python-incremental: Update to 21.3.0, refresh patch

Merge pull request #15830 from jefferyto/python-zope-interface-5.4.0

python-zope-interface: Update to 5.4.0

Merge pull request #15828 from jefferyto/python-attrs-21.2.0

python-attrs: Update to 21.2.0

python-incremental: Update to 21.3.0, refresh patch

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-zope-interface: Update to 5.4.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-attrs: Update to 21.2.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

stubby: bump to 0.4.0

Remove obsolete patch.

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>

getdns: bump to 1.7.0

Remove obsolete patches.

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>

net/mosquitto: Update to 2.0.11

This is a security and bugfix release.

Full release notes: https://mosquitto.org/blog/2021/06/version-2-0-11-released/

Fixes a remotely triggered memory leak
Fixes broker reconnections in certain failure situations
Fixes (non-standard) qos0 queuing

Signed-off-by: Karl Palsson <karlp@etactica.com>

Merge pull request #15789 from nickberry17/update_mm_and_libs

Update ModemManager and dependencies

Merge pull request #15810 from neheb/ke

kea: update to 1.8.2

Merge pull request #15814 from neheb/t1

tang: remove outdated key handling

Merge pull request #15823 from jefferyto/golang-1.16.5

golang: Update to 1.16.5

golang: Update to 1.16.5

1.16.1 included fixes for:

* CVE-2021-27918 - encoding/xml: infinite loop when using
  xml.NewTokenDecoder with a custom TokenReader
* CVE-2021-27919 - archive/zip: can panic when calling Reader.Open

1.16.4 included fixes for:

* CVE-2021-31525 - net/http: ReadRequest can stack overflow due to
  recursion with very large headers

1.16.5 includes fixes for:

* CVE-2021-33195 - net: Lookup functions may return invalid host names
* CVE-2021-33196 - archive/zip: malformed archive may cause panic or
  memory exhaustion
* CVE-2021-33197 - net/http/httputil: ReverseProxy forwards Connection
  headers if first one is empty

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

cni: update to 0.8.1

This is a security release that fixes a single bug:
 - tighten up plugin-finding logic (#811)

Users of libcni are strongly encouraged to update.

Added me to list of maintainers as requested by @dangowrt.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>