python-cryptography: fix CVE-2018-10903

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

python-cryptography: Add support for LibreSSL 2.7.x

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10324 from jefferyto/python-2.7.17-openwrt-18.06

[openwrt-18.06] python: Update to 2.7.17, refresh patches

python: Update to 2.7.17, refresh patches

Patches already merged and so removed:
* 019-bpo-36216-Add-check-for-characters-in-netloc-that-normalize-to-separators-GH-12216.patch
* 020-bpo-36216-Only-print-test-messages-when-verbose-GH-12291.patch
* 021-2.7-bpo-35121-prefix-dot-in-domain-for-proper-subdom.patch
* 027-bpo-38243-Escape-the-server-title-of-DocXMLRPCServer.patch
* 028-bpo-34155-Dont-parse-domains-containing-GH-13079.patch

Patches no longer necessary and so removed:
* 017_lib2to3_fix_pyc_search.patch

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from 83b300aa83f3cf663747998f4500a8592acf9959)

Merge pull request #10312 from stangri/18.06-vpnbypass

[18.06] vpnbypass: bugfix: PROCD command not found on stop

vpnbypass: bugfix: PROCD command not found on stop

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #10279 from BKPepe/sudo-18.06

[OpenWrt 18.06] sudo: Update to version 1.8.28p1

sudo: Update to version 1.8.28p1

- Use HTTPS for downloading tarball and for their website
- Add PKG_CPE_ID
- Remove inactive maintainer
- Refreshed patches
Fixes: CVE-2019-14287
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

irssi: update to version 1.2.2 (security fix)

Fixes CVE-2019-15717

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from commit b42159dea3ed38c3755c1b641d47209878247763)

Merge branch 'pr/10215' into openwrt-18.06

https://github.com/openwrt/packages/pull/10215

Merge pull request #9997 from flyn-org/openldap-18.06

openldap: update to 2.4.48

Merge pull request #10237 from jefferyto/gammu-fix-lib-symlinks-openwrt-18.06

[openwrt-18.06] gammu: Fix lib symlinks

gammu: Fix lib symlinks

This fixes the symlinks for libGammu.so and libgsmsd.so. Previously, the
symlinks were overwritten by $(INSTALL_BIN) with copies of their
sources.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

bind: Update to version 9.11.11

Change License to MPL-2.0 and add PKG_LICENSE_FILES.
For more details look at https://www.isc.org/blogs/bind9-adopts-the-mpl-2-0-license-with-bind-9-11-0/

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10108 from BKPepe/expat-1806

[OpenWrt 18.06] expat: Update to version 2.2.9

Merge pull request #10167 from BKPepe/unbound18.06

[OpenWrt 18.06] unbound: Update to version 1.9.4

python3-pip: fix install rule

This seems to have slipped for some time. No idea if it ever worked.
It could be that this worked at some point.

In any case, the shebang is properly updated now.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry-picked from commit 1b96dc01715f4f03f758ff1d087caf15726016af)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(bump PKG_RELEASE for python3-pip)

nano: update to 4.5

Update nano editor to version 4.5.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit bfd66f2d23483513f80e109df2e0e02de782e5b4)
(fix also license tag and add CVE)

Merge pull request #10164 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix: proper dnsmasq reload on stop, rework start/stop logic

unbound: Update to version 1.9.4

Fixes CVE-2019-16866

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

unbound: update to 1.9.3

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>

simple-adblock: bugfix: proper dnsmasq reload on stop, rework start/stop logic

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #10156 from gladiac1337/haproxy-1.8.21-openwrt-18.06

[openwrt-18.06] haproxy: Update HAProxy to v1.8.21

haproxy: Update HAProxy to v1.8.21

- Update haproxy download URL and hash
- Add new patches (see https://www.haproxy.org/bugs/bugs-1.8.21.html)

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #10155 from jefferyto/python-bpo-38243-34155-openwrt-18.06

[openwrt-18.06] python: Fix CVE-2019-16056, CVE-2019-16935

Merge pull request #10143 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix and improvements (check description)

python: Fix CVE-2019-16056, CVE-2019-16935

These patches address issues:
CVE-2019-16056: email.utils.parseaddr mistakenly parse an email
CVE-2019-16935: A reflected XSS in python/Lib/DocXMLRPCServer.py

Links to Python issues:
https://bugs.python.org/issue34155
https://bugs.python.org/issue38243

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

simple-adblock: bugfix and improvements (check description)

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #10120 from BKPepe/youtubedl-1806

[OpenWrt 18.06] youtube-dl: Update to version 2019.9.28

haveged: convert to procd

Convert haveged init script to use procd

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 4f717a6f65b5c495aec770b507913befa40b8997)

haveged: update to 1.9.8

Update haveged to 1.9.8

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit e5b308308b528b912ec1352b85bf2de13d94ce3f)

youtube-dl: Update to version 2019.9.28

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10118 from BKPepe/libgcrypt-1806

[OpenWrt 18.06] libgcrypt: backport fix for CVE-2019-13627

python3: fix CVE-2019-16056 and delete two patches

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

python3: backport three security patches

Fixes: CVE-2019-16935
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 80def9e)

expat: Update to version 2.2.9

Fixes CVE-2019-15903

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

expat: update to version 2.2.7 (security fix)

Fixes:
CVE-2018-20843

Changes:
add PKG_CPE_ID
switch to xz
remove maintainer

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

expat: fix host build issue with docbook

Additionally to the fix issued for #6923, we need to disable the docbook
usage also for the host build. This prevents the following error:

checking for docbook2man... docbook2man
configure: error: Your local docbook2man was found to work with SGML rather
  than XML. Please install docbook2X and use variable DOCBOOK_TO_MAN to point
  configure to command docbook2x-man of docbook2X.
  Or use DOCBOOK_TO_MAN="xmlto man --skip-validation" if you have xmlto around.
  You can also configure using --without-docbook if you can do without a man
  page for xmlwf.

Signed-off-by: Michael Heimpold <michael.heimpold@i2se.com>

expat: disable docbook

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

lib/expat: Update to 2.2.6

Update (lib)expat to 2.2.6

Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>

Merge pull request #9893 from BKPepe/bind-18.06

[OpenWrt 18.06] bind: update to version 9.11.10

Merge pull request #9798 from ja-pa/zmq-security-fix-18.06

[OpenWrt 18.06] zeromq: update to version 4.1.7 (security fix)

net/mosquitto: bump to 1.5.9 for CVE

Fixes CVE-2019-11779
Release notes at https://mosquitto.org/blog/2019/09/version-1-6-6-released/

Signed-off-by: Karl Palsson <karlp@etactica.com>

python-crypto: Fix two CVEs

CVE-2013-7459 and CVE-2018-6594. Both patches taken from Fedora.

Also took the liberty to update the PKG_SOURCE_URL to a standard one.

Updated the home URL as well.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 32b23e28ad892395a5575c09606cd07db175f7cc)

libgcrypt: backport fix for CVE-2019-13627

Refresh patches due to offsets

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10063 from stangri/18.06-simple-adblock

[18.06] simple-adblock: dnsmasq.ipset option support, better handling of IDNs, updated README

simple-adblock: dnsmasq.ipset option support, better handling of IDNs, updated README

Signed-off-by: Stan Grishin <stangri@melmac.net>

zmq: fix CVE-2019-13132

- Use HTTPS in their website
- Remove unnecessary space between PKG_SOURCE_URL

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Merge pull request #10041 from neheb/djj

[18.06]django: Update to 1.8.19

django: Update to 1.8.19

Fixes:

CVE-2018-7536
CVE-2018-7537

Switches to pypi, as in upstream. Updated maintainer as well.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

openldap: update to 2.4.48

Fixes CVE-2019-13565.

Signed-off-by: W. Michael Petullo <mike@flyn.org>

openldap: Add static function declaration

Fixes compilation with -Werror=implicit-function-declaration .

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: W. Michael Petullo <mike@flyn.org>

openldap: version update and new build parameters

This patch updates OpenLDAP to 2.4.47, introduces new build
parameters and places openldap-server, openldap-utils and
libopenldap under a separate menu item in Network.

OpenLDAP is difficult to find in menuconfig at present. Making
a separate menu item for OpenLDAP for selection of packages and
enabling or disabling build parameters makes better sense.

To have access to the loglevel directive, OpenLDAP must be built
with debugging information. Having access to the loglevel directive
is essential during the initial configuration of OpenLDAP server.

International users may want to enable ICU support to have access
to international characters.

Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Signed-off-by: W. Michael Petullo <mike@flyn.org>

openldap: Switch tarball sources to https and http

Switch from ftp which can be broken on corp firewalls to https and http.
Mirrors taken from https://www.openldap.org/software/download/ and
https://www.openldap.org/software/download/OpenLDAP/MIRRORS
Place master site as last resort.

Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
Signed-off-by: W. Michael Petullo <mike@flyn.org>

lighttpd: mark module configuration files

Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from 9cf412c0cba38f1251e9d8c1fd9afbb86caee88a)

dovecot: Update to version 2.2.36.4

- Fix CVE-2019-11500
- Download tarball from HTTPS instead of HTTP

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

wget: fix CVE-2018-20483

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

fastd: fix init script for multiple VPN instances

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit b7ff8b8087c6e948aba45b74c261cd7337433523)

haveged: update to 1.9.6

Update haveged to 1.9.6

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit c933ac5dcb85361baeb9ff9ec424533b67bb2578)

Merge pull request #9894 from BKPepe/keepalived-18.06

[OpenWrt 18.06] keepalived: Update to version 1.4.5

Merge pull request #9904 from RussellSenior/my-18.06

patch: cherry pick CVE fixes to 18.06 branch

patch: rename CVE-2019-13638 patch to mollify uscan

Signed-off-by: Russell Senior <russell@personaltelco.net>

patch: apply upstream patch for CVE-2019-13638

GNU patch through 2.7.6 is vulnerable to OS shell command injection that
can be exploited by opening a crafted patch file that contains an ed style
diff payload with shell metacharacters. The ed editor does not need to be
present on the vulnerable system. This is different from CVE-2018-1000156.

https://nvd.nist.gov/vuln/detail/CVE-2019-13638

Signed-off-by: Russell Senior <russell@personaltelco.net>

tools/patch: apply upstream patch for CVE-2019-13636

In GNU patch through 2.7.6, the following of symlinks is mishandled in
certain cases other than input files. This affects inp.c and util.c.

https://nvd.nist.gov/vuln/detail/CVE-2019-13636

Signed-off-by: Russell Senior <russell@personaltelco.net>

exfat-nofuse: drop BUILD_PATENTED

Microsoft has published technical specification for exFAT [1]
and the driver has been added to Linux staging tree [2].

It's now safe to drop BUILD_PATENTED label.

[1] https://docs.microsoft.com/windows/win32/fileio/exfat-specification
[2] http://lkml.iu.edu/hypermail/linux/kernel/1908.3/04254.html

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry-picked from commit 4c9d0c7b56365761fd1986ff954edf963feb2931)

keepalived: add patch for CVE-2018-19115

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

keepalived: Update to version 1.4.5

- Use HTTPS for PKG_SOURCE_URL and as well for URL in description

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

bind: Update to version 9.11.10

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

lighttpd: fix CVE-2018-19052

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #9841 from cshoredaniel/pr-18.06-nut-targetted

[18.06] Targeted fixes based on 19.07/master

Merge pull request #9703 from BKPepe/squid-18.06

[OpenWrt 18.06] squid: update to version 3.5.28

Merge pull request #9814 from guidosarducci/speedtest-18.06

[18.06] speedtest-netperf: backport stable package from 19.07 and master

Merge pull request #9777 from BKPepe/tar_1806

[OpenWrt 18.06] tar: update to version 1.3.2

Merge pull request #9821 from cotequeiroz/vim_host

[18.06] vim: Add host build to install xxd

nut: Bump PKG_RELEASE

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Handle FSD properly

Make sure we force shutdown of UPS only when we should, and when
we should that shutdown happens.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix init actions (server/driver)

The server and driver were not starting/restarting reliably. In
addition on interface changes NUT got very confused.  So we fix
handling of restarts and add a reload trigger for interface
changes.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix extra diver params config

Extra parameters for the UPS driver were not being handled correctly.
Fix that (was wrong variable name).

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix permissions with runas

Fix directory and conf file creation and owner/mode setting
for when running as non-root.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix statepath handling

The statepath was getting the wrong permission and/or not created
at the right time.  This commit includes fixes for handling the
statepath (typically /var/run/nut).

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix unset of runas user (ups server)

Running as non-root was failing due to misplace local keyword
causing runas to be unset from calling value.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix bad check for conf exists

We were `cat`ing the file instead of just checking for non-empty
existance.  Fix that.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix upsmon init actions

1) For upsmon start and stop were at wrong position in rc.d
2) Stop needs more than just killing the procd instead but rather
needs a  stop command to be issued.
3) Interface up/down was causing not to enter a crashloop (we fix this
with procd trigger on interface changes).

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix unset of runas user (upsmon)

Running as non-root was failing due to misplace local keyword
causing runas to be unset from calling value.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Remove unecessary libwrap dependency

CONFIG_ARGS has --without-wrap so libwrap as a dependency is
extraneous as it is not actually used.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nano: update to 4.4

Update nano editor to 4.4

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit d9347059a80fc8977a1e148153693a2851b4e253)

ttyd: Add dependency for vim

Needed to avoid error in case xxd is not installed:

[ 16%] Generating html.h from index.html
/bin/sh: 1: CMAKE_XXD-NOTFOUND: not found
CMakeFiles/ttyd.dir/build.make:61: recipe for target 'html.h' failed
make[6]: *** [html.h] Error 127

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 773c19afad0723bc2ba49b36e8172776e2eaf207)

vim: Add host build to install xxd

Packages such as ttyd and device-observatory need this.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 8e93386b804f8029a1180755ce240fbc0f06b009)

speedtest-netperf: new package to measure network performance

The speedtest-netperf.sh script measures the network throughput while
monitoring latency under load and capturing key CPU usage and frequency
statistics. The script can emulate a web-based speed test by downloading
and then uploading from an internet server, or perform simultaneous
download and upload to mimic the stress of the FLENT test program.

It simplifies tasks such as validating ISP provisioned speeds or setting
up and fine-tuning SQM, directly on the router. The CPU usage details
can also help determine if the demands of SQM, routing and other tasks
such as the test itself are exhausting the device's CPUs.

This script leverages earlier scripts from the CeroWrt project used for
bufferbloat mitigation, betterspeedtest.sh and netperfrunner.sh. They are
used with the permission of the author, Rich Brown.

Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
(cherry-picked from 463590e2bcf94e09890f7ba98e910ff58090e29b)

Merge pull request #9789 from ja-pa/libarchive-security-fix-18.06

[OpenWrt 18.06] libarchive: update to version 3.4.0 (security fix)

apinger: Update to latest git revision

This project seems abandoned. Updated to latest version.

Also cleaned up the Makefile quite a bit.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from dff6d2639eabb93e2d3782bfc1262bb6f7dccc33)

node-serialport: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1ce1ca6e0622c6ad7fb61e44b7c96b028939186a)

node-hid: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1aa55f86b56766074677bcda23f19cd7e5b5601f)

libarchive: update to version 3.4.0 (security fix)

Fixes:
CVE-2019-1000019
CVE-2019-1000020
CVE-2018-1000880
CVE-2018-1000879
CVE-2018-1000878
CVE-2018-1000877

Changes:
add bsdtar libopenssl variant
switch to github codeload
polish tab/spaces

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Merge branch 'pr/9778' into openwrt-18.06

PR #9778

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

fastd: update URL and PKG_SOURCE_URL

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

libuecc: update URL and PKG_SOURCE_URL

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

Merge pull request #9754 from champtar/openwrt-18.06

[18.06] prometheus-node-exporter-lua: update to 2019.08.14

bind: update to 9.11.9

Fixes CVEs:
CVE-2018-5738
CVE-2018-5740
CVE-2018-5743
CVE-2018-5744
CVE-2018-5745
CVE-2019-6465
CVE-2019-6471

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[mention fixed CVEs;patches: refreshed and removed those which are in
upstream now]

tar: update to version 1.32

Fixes CVE-2019-9923

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[mention CVE in commit message]