nano: update version to 5.7

Upgrade nano editor to version 5.7.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 765e9868579e1da270b3c831ecf34949013cdf01)

icu: add ABI_VERSION

To prevent inconsistencies in the coming version (69.1).

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

haproxy: Update HAProxy to v2.2.14

- Update haproxy download URL and hash

Signed-off-by: Christian Lachner <gladiac@gmail.com>

nextdns: Update to version 1.32.1

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

adblock: update to 4.1.2

* preserve DNS cache after adblock processing (unbound & bind)
* fix redirect issue with oisd basic url
* cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit df8651255fc69a7adae4fa8e65a2d43cf97109d2)

Merge pull request #15526 from 1715173329/xray-2102

[openwrt-21.02] xray-core: remove PROVIDES

zerotier: update to 1.6.5

Minor ZeroTier update. Refreshed patches.

Signed-off-by: Moritz Warning <moritzwarning@web.de>

libupm: Disable node.js support

Library for node.js will be disabled temporarily due to difficulty in supporting the latest node.js.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Merge pull request #15508 from hswong3i/openwrt-21.02-SQUID_enable-ssl-crtd

[openwrt-21.02][cherry-pick] squid: Enable dynamic SSL certificate generation

squid: Enable dynamic SSL certificate generation

Maintainer: @neheb / @BKPepe / @zhanhb
Compile tested: ipq806x, generic, netgear_r7800, master
Run tested: ipq806x, generic, netgear_r7800, openwrt-19.07

Description:

Squid now only support HTTPS proxy in TCP tunnel mode (e.g. `ssl_bump splice all`):

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    ssl_bump splice all

In order to operate in SSL Bump mode, we need to compile with `--enable-ssl-crtd` for following configuration:

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    sslcrtd_program /usr/lib/squid/security_file_certgen -s /car/cache/squid/ssl_db -M 4MB
    ssl_bump stare all
    ssl_bump bump all

This PR switch the `SQUID_enable-ssl-crtd` into `default y`, therefore default enable SSL Bump mode.

Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
(cherry picked from commit dbda77686d5dccb3d3999ed2e7dec18aab11fff8)

libmraa: Disable node.js support

Library for node.js will be disabled temporarily due to difficulty in supporting the latest node.js.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Merge pull request #15518 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.7.1

xray-core: use `$(INSTALL_DATA)` to install configuration files

Using `$(INSTALL_CONF)` will cause the program has no access to
configurations file when someone enabled the selinux support.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from bbc6c62c2a029fd716b2bcad68ed3f99478da246)

xray-core: remove PROVIDES

Xray now is no longer planning to keep compatibility with original
v2ray. Remove PROVIDES before it is totally broken.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from 92efcc295648e9c16f3fb2d183019be9e275c3ea)

yq: Update to 4.7.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from 633d1dcf583646abd582e85e596463ac21e59235)

net/mosquitto: port is optional in root config

From mosquitto 2.x, port became optional and deprecated in the config,
and it was recommended that listeners be used instead.  Drop the hard
requirement in our config conversion script.

Reported in: https://github.com/openwrt/packages/issues/15506
Signed-off-by: <karlp@etactica.com>

net/mosquitto: fix log_type conversion in config

As reported in: https://github.com/openwrt/packages/issues/15506

Signed-off-by: Karl Palsson <karlp@etactica.com>

ksmbd: update to 3.3.9

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9c6fc23e01a2227770659d0060dbabb491fdff67)

ksmbd-tools: update to 3.3.9

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 2e7c403fff0d3c07bdd6e5d8f925ce154a473491)

lighttpd: patches from upstream

- ignore Content-Length from backend if 101 Switching Protocols
- close HTTP/2 connection after bad password
- skip cert chain build for self-issued certs
- meson zstd fix
- ls-hpack upstream update
- discard some HTTP/2 DATA frames received after response

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit 52f85a0e1fd885d5bf9cbb6de74a146aa0d6c843)

banip: fix housekeeping

* fix whitelist housekeeping if you switch between normal- and
  'whitelist only' mode

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7cfb0f4657dea6a7844df28268e7e8af6eb00db4)

Merge pull request #15502 from TDT-AG/pr/20210422-stunnel

stunnel: update version to 5.59

Merge pull request #15501 from mkrkn/openwrt-21.02

[21.02] openvpn: update to 2.5.2

openvpn: update to 2.5.2

Fixes two related security vulnerabilities (CVE-2020-15078) which
under very specific circumstances allow tricking a server using delayed
authentication (plugin or management) into returning a PUSH_REPLY before
the AUTH_FAILED message, which can possibly be used to gather
information about a VPN setup. In combination with "--auth-gen-token" or
a user-specific token auth solution it can be possible to get access to
a VPN with an otherwise-invalid account.

OpenVPN 2.5.2 also includes other bug fixes and improvements.

Add CI build test script.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
(cherry-picked from 6186fe732b058ef7f1ae43cce2184ba0c4d90184)

stunnel: update to 5.59

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 2d56dbfc27f3a954fd34b8b261d576716dbfbed5)

stunnel: update to 5.58

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 389c7f12cb197f3cef25db44d3787b7175c47776)

banip: update to 0.7.7

* add a "whitelist only" mode, this option allows to restrict Internet
  access from/to a small number of secure websites/IPs, and block access
  from/to the rest of the Internet.

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 515397b009155776e4fd15aaa723875373c75279)

node: Resolve ICU conflict

Resolve conflicts between OpenWrt's ICU package and the ICU shipped with node.js.

https://github.com/openwrt/packages/issues/15437

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

dockerd: Updated to 20.10.6

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

docker: Updated to 20.10.6

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

libnetwork: Updated to 2021-01-26 for docker 20.10.6

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

containerd: Updated to 1.4.4 for docker 20.10.6

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>

Merge pull request #15478 from rs/nextdns-1.32.0-openwrt-21.02

[21.02] nextdns: Update to version 1.32.0

python-psycopg2: Add new package

Psycopg is the most popular PostgreSQL adapter for the Python programming language
It's used by the python-sqlalchemy for postgresql

This package was removed by this commit for lacking python3 support:
c37b15e1c49cf27de8f34f43e93a7a5c184be9e0

Version 2.8.6 used in this package now supports pyhton3

Signed-off-by: Daniel Danzberger <daniel@dd-wrt.com>
(cherry picked from commit 7cfb9a04af856b3d09a9768bb104f77dbb1acb68)

atlas-sw-probe: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit c65a659e6d9e71a5d74927f40490ee40a16d84db)

atlas-probe: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit cb30c106c09f6e8b9a93e87c3de65f3b3a14db8e)

nextdns: Update to version 1.32.0

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

Merge pull request #15470 from rs/nextdns-1.12.5-openwrt-21.02

[21.02] nextdns: Update to version 1.12.5

nextdns: Update to version 1.12.5

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

Merge pull request #15462 from rs/nextdns-1.12.3-openwrt-21.02

[21.02] nextdns: Update to version 1.12.3

nextdns: Update to version 1.12.3

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

Merge pull request #15458 from rs/nextdns-1.31.3-openwrt-21.02

[21.02] nextdns: Update to version 1.31.3

nextdns: Update to version 1.31.3

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

collectd: update PKG_RELEASE

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 1e2ba94064c3b99bd8543df9283933d84fdc4707)

collectd: add percent calculation of bad block to ubi plugin

This patche adds the percent evaluation for the bad blocks.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit b4e24c12a6c187565e63b9365df6f88d954bf8c6)

collectd: prepare ubi plugin for percent calculation

This patche change prepares the ubi plugin to add the bad block evaluation in
percent.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 4927b53333652825a73bf0ecd53914636af6b6d3)

collectd: upate PKG_RELEASE number

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 6e41bf73ba3e80e206066cbcb8373a82efcbbf95)

collectd: make compile time debug option configurable

Enables the compiler option that collectd is compiled with
debugging support. This is used at development stages to get
more messages from the collectd during development.

This option is default disabled.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit a4f74eb11c1bfa6d708934b3885be589e39e8851)

collectd: fix COLLECTD_PLUGINS_SELECTED end of line

This removes the trailing back slash. This is not needed.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 416ba35d50e3381a23caf0ee0d0758a26e29a4f5)

collectd: fix smart disk detection

On my system the attribute DEVTYPE was not set. The plugin could not
read any data and the function call blocked forever on this function and did
not returned. By removing it, all block devices under `/sys/class/block`
were checked.

Block devices that do not support SMART were not evaluated. The
collected displays the following message.

smart plugin: checking SMART status of /dev/loop4.
smart plugin: unable to open /dev/loop4.

If you do not like this message, you could only enable device in the uci that
does support SMART.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 543a2a970c062c30ac33f49f67ea952eb0adbed3)

collectd: enable collectd-mod-smart

Switching on compilation for collectd smart plugin.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 092902a87ee14e3b4b0b37a4ddb81719ae27fcc8)

libatasmart: initial checkin

This library is required by the smart plugin of the collectd.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 87e52cf180921d1fb778298c1ee699e652639b79)

adblock: update to 4.1.1

* support the RPZ trigger 'RPZ-CLIENT-IP' to always allow/block certain
  clients based on their IP (currently only supported by bind!)
* avoid promiscuous mode in tcpdump setup for adblock reporting
* speed up dns report preparation
* support dns report mailing (/etc/init.d/adblock report mail)
* fix bind autodetection
* update LuCI-frontend (separate PR)
* update readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c531b6daea6962c32813b5815105343a76746147)

squid: update to 4.14

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 682aebbaea976bee8aa5cc6e2d5818364256b33f)

psmisc: move killall to /usr/libexec and add ALTERNATIVES

Currently, this package can not be installed while using standard path
of busybox, because binary killall wants to be installed on the same
location as busybox.

Collision:
• /usr/bin/killall: busybox (new-file), psmisc (existing-file)

Many of these binaries, which provides alternatives were moved to
folder /usr/libexec like wget, sed, findutils, less.
So I moved killall to /usr/libexec and others leave in touch and added
ALTERNATIVES for it, because preinstall script is no longer necessary.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d8969e0fd1db2b2cb544cea19179a05aec5a9c28)

irqbalance: upgrade to version 1.8.0

Upgrade irqbalance to version 1.8.0

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 6631cfaa61ff75d97ef1a41c6ec031198103c7df)

Merge pull request #15441 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.7.0

yq: Update to 4.7.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from c4d27271adbbed1c779e212bc79ed351ddde6553)

atheepmgr: avoid libpciaccess dependency

HAVE_LIBPCIACCESS that is currently passed through MAKE_VARS to disable
building with libpciaccess can't be set through the environment.
Instead, use CONFIG_CON_PCI, which can be passed through the environment
and will disable libpciaccess.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 52837117541f9a35d60a0e4befac1960ea8675fe)

clamav: add libiconv dependencies when build with NLS

NLS means Native Language Support and when you have it enabled (it is
not default), clamav can not be compiled as it shows following error:

Package clamav is missing dependencies for the following libraries:
libiconv.so.2

Also, it is required that package libiconv-full is compiled first/before
than clamav and then try to compile clamav.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 87be6ffe6076778336f7db752fee0ef5f3f923e8)

openvpn-easy-rsa: add missing configfile

/etc/profile.d/50-openvpn-easy-rsa.sh was not listed as configfile
and changes were lost during upgrades.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit b0663e2959ff9dc37d0273aa3240a2ef0ed3c611)

collectd: enable cpufreq for rockchip target

Enable collectd-mod-cpufreq  for rockchip

Signed-off-by: Tomas Lara <tl849670@gmail.com>
(cherry picked from commit 6bd8d29b70bf3081d9fe0efe38a36b8f4fed77de)

Merge pull request #15414 from luizluca/21.02/ruby-3.0.1

[21.02] ruby: update to 3.0.1

bonding: accept list of slaves in uci list notation

Rework the bonding.sh protocol handler to accept slave interface names
encoded in uci list notation. Also replace ifconfig up/down with ip
link calls while we're at it.

Fixes: #11455
Fixes: https://github.com/openwrt/luci/issues/4473
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 57a77386de7dda12f60bf3021efcde7f059833c8)

ruby: update to 3.0.1

Fixes two CVEs:

CVE-2021-28965: XML round-trip vulnerability in REXML
CVE-2021-28966: Path traversal in Tempfile on Windows

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

node: bump to v14.16.1

April 2021 Security Releases
- OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)
- OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)
- npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)

OpenSSL-related vulnerabilities do not affect the OpenWrt package. Because OpenWrt's OpenSSL shared library has been updated.

NODEJS_ICU_SMALL is default

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

safe-search: prevent duplicate cron job installation

This patch prevents multiple cron jobs from being created to run the
safe-search-maintenance script.

To reproduce this bug, perform the following:
  - Install safe-search
  - Perform an OpenWRT firmware upgrade (choose to preserve user settings)
  - Install safe-search again

Signed-off-by: Gregory L. Dietsche <gregory.dietsche@cuw.edu>
(cherry picked from commit 49535edffdd44e1db109f687a5f6e87b7fe0ea3c)

netdata: disable shared memory totals by default

Fix log spam:
daemon.err netdata[2090]: PROCFILE: Cannot open file '/proc/sysvipc/shm'
This is caused by a non existant /proc/sysvipc/shm because of the
CONFIG_PROC_STRIPPED option that is enabled by default in the kernel
generic target config

Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
(cherry picked from commit 5f65d87bb7727be85e7d3e02045302d6eb76ff7e)

https-dns-proxy: bugfix: race condition with dnsmasq

Signed-off-by: Stan Grishin <stangri@melmac.net>

simple-adblock: update to 1.8.7-3

Signed-off-by: Stan Grishin <stangri@melmac.net>

adblock: fix games_tracking source url

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ec20e9df96f74c29699aa2df8de63cb9a8c32a2a)

Merge pull request #15372 from farmergreg/21.02-safe-search

[21.02] safe-search: check for changed IP addresses weekly

Merge pull request #15371 from farmergreg/21.02-family-dns

[21.02] net/family-dns: Correct Reference to IPKG_INSTROOT

family-dns: Correct Reference to IPKG_INSTROOT

IPKG_INSTROOT was misspelled.

Signed-off-by: Gregory L. Dietsche <gregory.dietsche@cuw.edu>
(cherry picked from commit 1569131f952915eb12b91268bdf11df3a005fe75)

safe-search: check for changed IP addresses weekly

The current default of hourly is too fast. Some services such as
DuckDuckGo return IPs from a pool based on the user's location instead
of a fixed IP address. This change prevents unnecessary writes to the
flash memory by only updating once per week.

Signed-off-by: Gregory L. Dietsche <gregory.dietsche@cuw.edu>
(cherry picked from commit 7164ccf1553a990d8823bc545d970334fa0cd32e)

minisatip: add libdvbcsa support

Unconditionally enable with BUILD_PATENTED.

Simplify configure args.

Add missing PKG_CONFIG_DEPENDS

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 3d65773650e42c32a2c30d336f266f4fd8723d40)

openvpn: fix invoking user up & down commands from hotplug wrapper

This commit adds a number of fixes to the OpenVPN up/down hotplug command
wrapper which currently fails to actually invoke user defined up and down
commands for uci configurations not using external native configurations.

 - Use the `--setenv` to pass the user configured `up` and `down` commands
   as `user_up` and `user_down` environment variables respectively

 - Instead of attempting to scrape the `up` and `down` settings from the
   (possibly generated) native OpenVPN configuration in
   `/etc/hotplug.d/openvpn/01-user`, read them from the respective
   environment variables instead

 - Fix parsing of native configuration values in `get_openvpn_option()`;
   first try to parse a given setting as single quoted value, then as
   double quoted and finally as non-quoted, potentially white-space
   escaped one. This ensures that `up '/bin/foo'` is interpreted as
   `/bin/foo` and not `'/bin/foo'`

Ref: https://forum.openwrt.org/t/openvpn-up-down-configuration-ignored/91126
Supersedes: #15121, #15284
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry-picked from commit 7f065a94bb2663d32da7424c777a580d470728a0)

openvpn: add OpenVPN option server-poll-timeout

See https://www.mankier.com/8/openvpn#--server-poll-timeout

Signed-off-by: Alexander Egorenkov <egorenar-dev@posteo.net>
(cherry-picked from commit 5789faab67db9b2bde999d24a3dbc26c4a82981d)

openvpn: update to 2.5.1

Set myself as maintainer.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
(cherry-picked from commit 204c0901b83b20e34ed12e4ea41236e2261d4099)

curl: update to version 7.76.0

Fixes CVE-2021-22876 and CVE-2021-22890

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit b971310549ac145f88d0251f03ffaa294f51c1e2)

libdvbcsa: add new package

Libdvbcsa is a free implementation of the DVB Common Scrambling Algorithm DVB/CSA - with encryption and decryption capabilities.

OpenWrt packages like `tvheadend` and `minisatip` can benefit from it.

Signed-off-by: Rafał Dzięgiel <rafostar.github@gmail.com>
(cherry picked from commit 51c5a8b4bcb5ba4d7447bd6ce77ddc41a46570aa)

python-pytest: update to version 6.2.3

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 4e979ceb6b5b78c136a5981e85e53f27d31510e3)

knot-resolver: update to version 5.3.1

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 3e3025b1910b158ce35921b4b6fc22579cf4824b)

youtube-dl: update to version 2021.4.7

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 701ded952a2505d3c39184767d2d55d1e299ec0f)

zeroconf: update to version 0.29.0

Update copyright in Makefile

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 757b0ea64710c692579ca59b4afbd49d4c025728)

ksmbd: update to 3.3.8

Major changes are:
  clean-up codes using checkpatch --strict option.
  fix several warning and build failure from linux-next.
  change the minimum supported kernel version to v5.4.
  use xarray for tree connect list.
  fix reviews from lkml.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit fa6f182a21c597cd792bfe83fc68c9c5d0b196b3)

ksmbd-tools: update to 3.3.8

Major changes are:
  disable symlink by default.
  remove smack inherit leftovers.
  Enable guest access on IPC$ share by default.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c6fa2d5bfaf24f347efd7156b2ad5b1cf62bd9a9)

ksmbd-tools: Add a mDNS TXT record for the ksmbd service

MacOS ignores Bonjour services for which TXT records are not returned. This changes forces umdns service to return a TXT record (`daemon=ksmbd`) for the ksmbd service. The exact content is unimportant and to the best of my knowledge nothing reads the `daemon` tag.

Symptoms of the problem (which are also debugging steps):
* Finder refuses to open the OpenWRT "computer" in the Network list.
* Discovery.app (Bonjour Browser) lists the _ssh._tcp service, but the submenu for it doesn't unfold and no address is shown.
* `dns-sd -L OpenWrt _smb._tcp` doesn't return any address.

Signed-off-by: Kirill Nikolaev <cyril7@gmail.com>
(cherry picked from commit 272b0a5c1873a34f6609e7af38395cea3f02bda5)

xinetd: honor ${IPKG_INSTROOT} when sourcing /lib/functions.sh

Avoid "file not found"-error when embedding via Imagebuilder.

Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
(cherry picked from commit bdab7e6bfed9d29f51589ed4461dd927dc78eaf1)

strongswan: bump to 5.9.2

Retire weak algorithms like MD5 and 3DES.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit ae3d5aa73ee2bb608a97ce55742489780f07b779)

strongswan: force PIC on all builds

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit a72780a9c25eeff46319d6be1bc33e515deb703c)

strongswan: migrate to swanctl configs

Derived from the ipsec initd script, with the following changes:

(1) various code improvements, corrections (get rid of left/right
    updown scripts, since there's only one), etc;
(2) add reauth and fragmentation parameters;
(3) add x.509 certificate-based authentication;

and other minor changes.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit f9d91f1f470aaa6d3da5aab97bf5ece139d8c5bd)

strongswan: remove synthesized ipsec conf files

If you shutdown ipsec service, and it doesn't clean up
/var/ipsec/ipsec.conf, then when you start swanctl service it
might see an incompatible file on startup.  Remedy is to
remove unneeded files when shutting down the service.  They
can always be regenerated when the service starts again.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit baa38a14200d0549a0531be92f3ef89e526063ac)

strongswan: move ipsec conf files to subpackage

These config files are only used by the ipsec interface to charon,
and shouldn't be part of the base package.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit e626255b371b8bd7811ea870525b32c0a4b2f589)

strongswan: make the include's in the .conf files persistent

Having scripts diddle user written config files seems potentially
dangerous.  Plus there's really no downside to including some
empty files.  Best to just make the includes be permanent.

Additional feature suggested by Luiz: if a -opkg version of the
config file was created unnecessarily, remove it as part of the
upgrade process since changes won't be happening to that file
as an artifact of the service starting.  The include lines are
now permanent, which means that (1) additional configuration
synthesized by UCI won't be anywhere that opkg (or sysupgrade,
for that matter) cares about since it won't be persistent, and
(2) if changes are being made, then they're being done by a
person with an editor and they really should be distinguished.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit 643df01275798dc4a44d33ac1a8b630c91a80c8c)

strongswan: change maintainers

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit 0bd4410e304f6164a1e0766815a1ca080dbeaa17)

strongswan: fix local_gateway discovery

This has been observed by myself and @luizluca: ip route get is
appending uid0 to the output, as seen from:

root@OpenWrt2:~# ip route get 1.1.1.1
1.1.1.1 via 174.27.160.1 dev eth3 src 174.27.182.184 uid 0
    cache
root@OpenWrt2:~#

so the fix is an anchored match, discarding all else. Also, using
ip -o means never having to do multiline matches...

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit ec72d3a9e47954f0be844fb32abb5ca1e4dda667)

mtd-rw: fix build failure with kernel 5.10

When building mtd-rw for a target based on Kernel 5.10 which has
CONFIG_MTD disabled the build fails with

ERROR: "put_mtd_device" [../mtd-rw.ko] undefined!
ERROR: "get_mtd_device" [../mtd-rw.ko] undefined!

Omit building the package for such a target.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit c6b3d949295e687c54a6d87f60f49f7ccc4bdcdf)

clamav: update to 0.103.1

Convert to using CMake in order to speed up compilation and to fix
compilation under glibc.

Add extra dependencies since they're now needed.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7cd687cb7ea576dda2a54114eb4f90838aa13580)

python3-libsemanage: update to 3.2

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit acb72e74529a5f3c6ec067cfe6047b621407c29a)