travelmate: update to 2.0.6

* replaced pipe input for a while/read-loop with a here document/variable as input
  (fix various subshell related bugs and oddities)
* further improve abort and re-connection handling
* prevent alleged detected connection failures (false positives) with an additional gw check,
  to stabilize VPN connections in particular

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1c0fcbd28b01c0af2013fb4ef4ec5e0ad1c881fd)

travelmate: update to 2.0.5-3

* simplify the scan logic, to get rid of nifty IFS tricks
* limit the nearby scan results to process only the strongest uplinks, set 'trm_maxscan' accordingly (default '10')
* update the readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 58a3cf1f01f7d29a69f5e3aa82fe5aa060470c47)

https-dns-proxy: patch CMakeList.txt to use OpenWrt CFLAGS

This fixes compilation issues with ASLR PIE enabled

We were compiling with '-g -DDEBUG'

https-dns-proxy_2021-07-29-*_arm_cortex-a9_vfpv3-d16.ipk
shrink from 19514 to 19095

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 374e1dd56e1742273b261f25a69fd3d46741e357)

dnscrypt-proxy2: Upgrade to 2.1.0

Adjust build opts to force GOPATH mode by setting GO111MODULE off.
Ref: https://go.dev/blog/go116-module-changes

Signed-off-by: Ted Hess <thess@kitschensync.net>
(cherry picked from commit 6981009f4847b1f46ef69ae813f7154b7946e47e)

c-ares: update to version 1.17.2

Missing input validation of host names returned by Domain Name Servers
in the c-ares library can lead to output of wrong hostnames (leading to
Domain Hijacking).

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2021-3672 to this issue.

References: https://c-ares.haxx.se/adv_20210810.html
Signed-off-by: Petr Štetiar <ynezz@true.cz>

mc: add a missing Syntax file

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 312caff03b17241d2e383eb254b41d35e9225294)
Signed-off-by: Dirk Brenken <dev@brenken.org>

mblaze: new package

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 80f7a8ec8b5bb208503b89f19e689e372d2c7b5b)

hwdata: update to version 0.350

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 3d5bed38e8e554b39081496d44eed8befb9f1f5f)

tvheadend: update to v4.2.8, remove static ffmpeg

 - refresh patches
 - add missing dependency: libffi

Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
[edited commit message and the maintainer line]

(cherry picked from commit 326da3dbbc57b6c44bc0d0401529531c7d5dfb89)

tvheadend: fix compilation with GCC 9 and 10

Without this, compilation fails because of a fortify-source header.
There's something defining and undefining _GNU_SOURCE somewhere.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 57c6c5e73fd9a3e367364466ea1b7ec1ed8e69c4)

python3-setuptools: add _distutils_hack

I tried to install matplotlib by using pip and it failed with the following output:

2021-08-18T11:52:26,171 Collecting matplotlib
2021-08-18T11:52:26,173   Created temporary directory: /tmp/pip-unpack-wuth2u0e
2021-08-18T11:52:26,565   Using cached matplotlib-3.4.3.tar.gz (37.9 MB)
2021-08-18T11:52:38,659   Added matplotlib from https://files.pythonhosted.org/packages/21/37/           197e68df384ff694f78d687a49ad39f96c67b8d75718bc61503e1676b617/matplotlib-3.4.3.tar.                       gz#sha256=fc4f526dfdb31c9bd6b8ca06bf9fab663ca12f3ec9cdf4496fb44bc680140318 to build tracker '/tmp/pip-   req-tracker-u30x8pht'
2021-08-18T11:52:38,660     Running setup.py (path:/tmp/pip-install-afiyiers/                            matplotlib_8e717e38862f4976a3d6cb1832ba3261/setup.py) egg_info for package matplotlib
2021-08-18T11:52:38,661     Created temporary directory: /tmp/pip-pip-egg-info-kbtiezxq
2021-08-18T11:52:38,662     Running command python setup.py egg_info
2021-08-18T11:52:38,831     Traceback (most recent call last):
2021-08-18T11:52:38,832       File "<string>", line 1, in <module>
2021-08-18T11:52:38,832       File "/usr/lib/python3.9/site-packages/setuptools/__init__.py", line 8, in <module>
2021-08-18T11:52:38,833     ModuleNotFoundError: No module named '_distutils_hack'

More details about it:
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=968410

Once I applied the patch from the bug tracker, I got further to install
it.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit feaaacc10fff283505ff261ed6886a4936fbe7f5)

zabbix: Call killall with the -s

Some versions of killall do support the `killall -SIGNAL` syntax and
have only `-s SIGNAL` which should be supported everywhere.

I see the problem with *killall (PSmisc) 23.3* on latest TurrisOS 5.2

Signed-off-by: Jan Baier <jan.baier@amagical.net>
(cherry picked from commit 641f75d98ac77139d44056d260395efea169abf7)

git: update to 2.33.0

* refresh patches

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit e684672916f3a8ca54ddd66ec09c2e87b32726d9)

Merge pull request #16397 from paper42/mc-21.02

[21.02] mc: update to 2.8.27

mc: update to 2.8.27

* fixes CVE-2021-36370
* refresh patches

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

Merge pull request #16358 from jamesmacwhite/21.02-stubby-0.4.0

[21.02] stubby: version 0.4.0

Merge pull request #16384 from stangri/openwrt-21.02

[21.02] curl: update to 7.78.0

curl: update to 7.78.0

* update to 7.78.0
* change maintainer
* remove obsolete mirror (curl.mirror.anstey.ca)
* update main curl URLs

Signed-off-by: Stan Grishin <stangri@melmac.net>
(cherry picked from commit 243c86ffc8fc77aa40237c037538a830cb307f8e)

auc: update to version 0.2.0

Cherry-picked from
9c491c6cb auc: update to version 0.1.9
4d789eac3 auc: handle root filesystem type
545c93d45 auc: improve branch selection logic
6c784dff2 auc: move function to right place
b1d38e7ab auc: update to version 0.2.0

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

unixodbc: use 'install' when copying host binaries

'cp' fails with a text file busy error if it tries to overwrite an
executable file that is running.  'install' unlinks the file first, so
it will not cause the problem.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 47f98d7030f1023e7b2ed118c7774c6100fc979b)

perl: perlmod.mk: use 'install' for host binaries

When installing a host perl module, the host perl binary in the staging
dir is replaced by using 'cp'.  However, if the binary is running in a
parallel job, cp will fail with a text file busy error.  Use
$(INSTALL_BIN), which unliks the file first to avoid the error.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 19c7496648cb25500ca7007a7c1578a426c23a09)

stubby: Add multi WAN support for procd trigger

Signed-off-by: James White <james@jmwhite.co.uk>
(cherry picked from commit 1ad5e3f88ccfed8979c95b461a3ba566270a49f8)

stubby: remove maintainer

Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>
(cherry picked from commit 791a8fb2bcfeabb238b4b1068ea48f18548e2c34)

stubby: remove libidn2 and libunwind dependencies

There's no good way to get rid of these, so just delete the cmake files.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4ebc8798555eb5c4628956ffec49dfc64453e898)

stubby: bump to 0.4.0

Remove obsolete patch.

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
(cherry picked from commit a01696890c80eb2add7eba6c9bd0f0edc8db1137)

Merge pull request #16355 from commodo/django-bump-21.02

[21.02] django: bump to version 3.2.6

sqm-scripts: bump to v1.5.1

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

travelmate: update to 2.0.5-2

* scan for open uplinks even if no other station has been added/configured

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit e6e3c9481d6b297127f491854739a37a5f399af8)

travelmate: update to 2.0.5

* support the new travelmate option 'macaddr' to use a pre-defined MAC address (per uplink)
* vpn connections are now handled separately for each uplink
* The autoadd-feature for adding open uplinks will now be limited by the 'trm_maxautoadd' option. The default is '5', '0' disables this limitation.
* more code cleanups und optimizations to reduce the repetitive connection handling workload
* bugfixes regarding multiple radio support
* refine cp detection (no longer write and parse an error file)

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c6328bad6c6e9f0f2747eebb1389c679bccc86ab)

django: bump to version 3.2.6

And switch to AUTORELEASE for PKG_RELEASE.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

Merge pull request #16338 from G-M0N3Y-2503/docker-20.10.8-backport

Docker 20.10.8 backport

dockerd: Updated to 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

docker: Updated to 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

containerd: Updated to 1.4.9 for docker 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

runc: Updated to 1.0.1 for docker 20.10.8

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

whois: update to 5.5.9

* Updated the .ga TLD server.
* Removed the .cd and cf TLD servers.
* Removed 72 new gTLDs which are no longer active.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit d424d19b5a46c2a77b20d936880144e1cdeca5ba)

whois: update to 5.5.8

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a5278062111351c2e6d1ebf7ac24f94722bf2e8e)

gitlab-runner: update to 14.0.1

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit dd51f58b14fa50fb3a879d012da4e7f4c02ffbe4)

clamav: update to 0.103.3

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 2a685d665cd581405274d2b404f785dcf2508716)

irssi: add test.sh

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 21992344b54144dae1b73ad7145540328e7ed0bb)

irssi: update to 1.2.3

Switch to AUTORELEASE for simplicity.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 752656c6be242d266d689078cc3ed1d76cb0143f)

atlas-sw-probe: fix copypaste error and clean tmp dir on exit

- Fix copypaste error for PUB_KEY link creation
- Clean tmp dir on exit to clear any remaining data

Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 842a9d399f1e3eb96290f3f0df72e70a5cd4d5b7)

Flash: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 2abbf288ed5cabd024706ec8dad2dfb74ca4e620)

Jinja2: update to version 3.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 7b5b9b9d11ff222d45b11de3db92b91314cdacf2)

Werkzeug: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 65c12b3c2f40b1e2eb555d7e2d835912097a67c4)

MarkupSafe: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c30b80484238cd2d255fa75f856e470f2bd6161b)

click: update to version 8.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 01620b9cfb4a86c959c826edc22bf6626af9c684)

itsdangerous: update to version 2.0.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 6ab3b605cf91387cb69075f2c39cfd9e91ce28d3)

Merge pull request #16195 from miska/snort3-21.02

net/snort3: Include default configs and snort2lua

knot-resolver: update to version 5.4.0

* refresh patches
* disable kres_gen_test to fix cross

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit e7127d468490baeaa863b4ab817ac05ec74186fa)

knot: update to version 3.1.0

* refresh patches

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 81e0fcb76fd886dd0188d5da341e6fb7c38677c5)

Merge pull request #16309 from jefferyto/golang-1.16.7-openwrt-21.02

[openwrt-21.02] golang: Update to 1.16.7

Merge pull request #16307 from jefferyto/python-twisted-21.7.0-openwrt-21.02

[openwrt-21.02] python-twisted: Update to 21.7.0, refresh patches

golang: Update to 1.16.7

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4d7a71a7cbb144c098526282aee81a748259bd83)

python-twisted: Update to 21.7.0, refresh patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 4fa4cd832208e59ada0cb8cba9c99afe9467231a)

Merge pull request #16288 from Linaro1985/openwrt-21.02_fix_libxslt

[21.02] libxslt: fix compilation because of wrong libxml2 check in configure script

libxslt: fix compilation because of wrong libxml2 check in configure script

More details: https://github.com/GNOME/libxslt/commit/90c34c8bb90e095a8a8fe8b2ce368bd9ff1837cc

Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
(cherry picked from commit b5ac497d66e53dfe0e3408c57ff34a02e52c26e5)

Merge pull request #16258 from stangri/21.02-curl

[21.02] curl: enable HTTP/2 support by default

Merge pull request #16275 from stangri/21.02-simple-adblock

[21.02] simple-adblock: update to 1.8.7-6

simple-adblock: update to 1.8.7-6

* supports newer shellcheck
* restore EXTRA_COMMANDS compatibility with 19.07
* move status display from various functions to status_service
* bugfix: status_service line break after output
* minor arythmetic fix in status_service

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #16253 from stangri/21.02-https-dns-proxy

[21.02] https-dns-proxy: update to 2021-07-29-1

Merge pull request #16266 from nxhack/2102_node_14174

[21.02] node: bump to 14.17.4

Merge pull request #16264 from mhei/21.02-php8-update

[21.02] php8 update to 8.0.9

Merge pull request #16267 from mhei/21.02-php7-update

[21.02] php7: update to 7.4.22

Merge pull request #16265 from mhei/libxml2-update

[21.02] libxml2: update to 2.9.12

php7: update to 7.4.22

This fixes:
    - CVE-2021-21704
    - CVE-2021-21705

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commits
  - 555d0c9a291cb9ffaefaa22da36095613857e10f
  - f15aba89f725f31d03edd95e03547670ca994e47
  - 741d6d6768e4d3d9a85d83fb7a6dce422cefde5a)

libxml2: update to 2.9.12

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 6b932d3ff77c63fe01080139c147c86da12f0c88)

php8: add CI runtime test

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2dad6524460a62f879e0df2786090d99e6c837fa)

php8: update to 8.0.9

Also update opcache makefile patch.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commits
 - 5e82e6be718186aab63b71f9396732cd341f924c
 - 0154157b6c6ef5f2907dca0aa3c14588cfc196d2
 - 961b7c5a25be907d9b89d3b18cd83618d8e38453
 - 7ddd5280d48609cad139e80774a57cc6c51921ee
 - 9080dce60f8c3013747058971b9af38867ba1073)

node: bump to 14.17.4

July 2021 Security Releases:

Use after free on close http2 on stream canceling (High) (CVE-2021-22930)
Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

curl: enable HTTP/2 support by default

Description: Lack of support of HTTP/2 by default starts to hurt,
for example with https-dns-proxy package, some DoH resolvers (like mullvad)
no longer support HTTP/1 and are not usable.

This enables HTTP/2 support by default (which would bring ~68Kb libnghttp).

Signed-off-by: Stan Grishin <stangri@melmac.net>

https-dns-proxy: update to 2021-07-29-01

* update binary to the latest commit (2021-07-29) to fix #16222 and #16239
* add hotplug.d/iface file and update Makefile to install it
* use Cloudflare's and Google's bootstrap DNS if bootstrap DNS is missing
* minor improvements in append_bool function
* add append_counter function for verbosity setting
* add append_bootstrap function (and supporting functions) to parse/sanitize bootstrap setting
* move firewall array from 'main' instance to the first proxy instance
* delete useless 'main' instace

Signed-off-by: Stan Grishin <stangri@melmac.net>

nextdns: Update to version 1.35.0

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

dawn: update to 2021-07-27

276ca16 msghandler: fix rrm array parsing
1e4871d datastorage: debug rrm capabilities

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 6582979678714d4c71276adf4caa6e09f8f3c76b)

travelmate: update to 2.0.4

* code cleanup
* add auto login script for Julianahoeve beach resort (NL)
* add auto login script for Vodafone hotspots (DE)
* add auto login script for telekom hotspots (DE)
* enhance captive portal detection to support html redirects as well
* change default captive portal detection url to
  'detectportal.firefox.com'

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 380a5110b4d8df56c2a66c78657ee84bbcd611d3)

Merge pull request #16145 from stangri/21.02-vpn-policy-routing

[21.02] vpn-policy-routing: update to 0.3.5-1

adblock: bugfix 4.1.3-3

* fix regex to prepare google safesearch domains

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 69a2a68c31b2abf93786c337db55088115c3aa42)

librouteros: don't build docs

Fixes compilation without host pod2man.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e41fd1794be2e8cc78c3df4bc4f4e05100eda959)

Merge pull request #16213 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.11.2

yq: Update to 4.11.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit d8fcfb062814fb6b5cee97f35373f864cf4dd00d)

net/snort3: Include default configs and snort2lua

Include default configuration files to have something to start from.
Also include snort2lua to help convert snort2 rules to snort3 to also
help with bootstrapping the configuration.

Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>

syslog-ng: update to version 3.33.2

Changelog:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.33.2

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 4b06f9ff4c3c5abe54ccd9248de9cf52f198d63d)

ddns-scripts: use https for google ipv6 ddns url

This matches an ipv4 change in 21f5cdd2fa and has the same rationale.
Google requires https for both ipv6 and ipv6.

Signed-off-by: Scott Lamb <slamb@slamb.org>
(cherry picked from commit e5f45b94c0ecfd9548d2efa7bba04e014dc66bf3)

erlang: disable PIE

Fails to compile with it on.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5685d9226860a2a008bbcf8d8cf9aae212afa904)

yggdrasil: bump to 0.4.0

- Bump yggdrasil-go version to v0.4.0
- Update ygguci tool for compatibility with the new yggdrasil-go version
- Yggdrasil's config file is now generated in a separate command before running the daemon

Signed-off-by: George Iv <zhoreeq@users.noreply.github.com>
(cherry picked from commit e135c4c86764f84339bba44d87153ed7db14d396)

Merge pull request #16165 from stangri/21.02-vpnbypass

[21.02] vpnbypass: update to 1.3.2-1

vpnbypass: updates to 1.3.2-1

bugfix: domain names bypass
rename config file
update Makefile
updated README link
updated shellcheck compatibility
support for 21.02.0-rc2 and later
updated code for interface triggers
add newline to test.sh

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #16154 from nwidger/niels/delve-1.7.0-openwrt-21.02

[openwrt-21.02] delve: Update to 1.7.0

Merge pull request #16156 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.11.0

Revert "net/miniupnpd: ext_ip_reserved_ignore support"

This patch is causing several issues [1], which then were reported to
upstream [2] and it was not accepted by upstream [3]. This results that
nobody maintain this custom patch and it is not useful as it is changing
addr_is_reserved behavior.

[1] https://github.com/openwrt/packages/issues/15258
[2] https://github.com/miniupnp/miniupnp/issues/542
[3] https://github.com/miniupnp/miniupnp/pull/511

This reverts commit b76aa9919489f49b472a8f939f6d46ca33d05f64.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 107f3376b5114cd17c115e25026b031bd439e9be)

knot: update to version 3.0.8

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 5f374929cfdf59fd1b2ec558cd024f5b301d3169)

knot: update to version 3.0.7

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 8d66f49baef164e6c7a621dd7e72328f62f242f4)

yq: Update to 4.11.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit a5f657ecf791faca53ab85393a8fc0ddc4de8683)

delve: Update to 1.7.0

See
https://github.com/go-delve/delve/blob/master/CHANGELOG.md#170-2021-07-19
for changes.

Signed-off-by: Niels Widger <niels@qacafe.com>
(cherry picked from 098d61ca1)

Merge pull request #16150 from jefferyto/golang-1.16.6-openwrt-21.02

[openwrt-21.02] golang: Update to 1.16.6

golang: Update to 1.16.6

Includes fix for CVE-2021-34558 (crypto/tls: clients can panic when
provided a certificate of the wrong type for the negotiated parameters).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit c0c62227bd23e0ad9b3a0db1a907bc5bf18579c8)

Merge pull request #16147 from luizluca/21.02/sane-fix_backport

[21.02] sane-backends fix usbid generation (backport)

sane-backends: use macros (properly), remove chmod

- use $(INSTALL_DIR) instead of mkdir
- using $(INSTALL_CONF) and then running chmod is pointless, use
  $(INSTALL_DATA) directly
- /etc/xinetd.d/sane-port doesn't need read protection from non-root
  users, use $(INSTALL_DATA) as well

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry picked from commit f37006c2e641882dde01512f8a035bf42c6f46b8)

sane-backends: fix usbid file generation

On some build systems (build bots, Debian Buster for example) the
current mechanism in the Build/Install define doesn't run. Replace it
with shell fu that works.

Issue was reported, see [1].

[1] https://github.com/openwrt/packages/issues/16085

Fixes #16085

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry picked from commit 977109e28613820ff451908289ff6e4cc671ec32)

vpn-policy-routing: update to 0.3.5-1

support for 21.02.0-rc2 and up
support for reloading a single interface on ifup/ifupdate
rename config file
updated shellcheck compatibility
remove obsolete create/remove_lock
interface processing optimizations to speed up reloads
drop dependency on curl in user scripts
uniform styling of functions

Signed-off-by: Stan Grishin <stangri@melmac.net>