php5: update to 5.6.17

Fixes CVE-2016-1903.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

bind: upgrade to 9.9.8-P3

Fixes:
 * CVE-2015-8704
 * CVE-2015-3193
 * CVE-2015-8000
 * CVE-2015-8461

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

mosquitto: properly separate the passwd utility

Building both variants improperly tried to include the passwd utility
for the non-ssl variant, as the variable was set for the ssl variant.

Use properly separated install tasks to install additional files, rather
than hacking around inside the single target.

Signed-off-by: Karl Palsson <karlp@remake.is>

mosquitto: fix old whitespace bug

Introduced back in 2014

Fixes: cd21cbb82eacf5c2dc60a8dd8dfa51f978b98193
Signed-off-by: Karl Palsson <karlp@tweak.net.au>

mosquitto: fix whitespace error introduced with 7a6a575887db81934369f38616d137005ed9ea96

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

tor: update to 0.2.7.6

Signed-off-by: Peter Wagner <tripolar@gmx.at>

ntpd: update to 4.2.8p5

Signed-off-by: Peter Wagner <tripolar@gmx.at>

Merge pull request #2270 from xypron/15.05-openssh

openssh: update to 7.1p2

net/openssh: version 7.1p2

Use version 7.1p2 due to several security bulletins.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

mosquitto: Bump to version 1.4.7

Minor changes mostly unrelated to OpenWRT.
Full changelog at http://mosquitto.org/2015/12/version-1-4-7-released/

Signed-off-by: Karl Palsson <karlp@remake.is>

mosquitto: optionally include mosquitto_passwd utility

Many users of the SSL build of mosquitto need the passwd utility for
managing keys.

Fixes github issue #1909

Signed-off-by: Karl Palsson <karlp@remake.is>

bridge-utils: copy from oldpackages

* update Makefile accoring to CONTRIBUTING.md, set maintainer
* fix file offset handling
* use https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/bridge-utils.git for source code

Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>

sane-backends: minor Makefile text typo

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

sane-backends: select all backends when CONFIG_ALL

sane-xxx backend packages are hidden packages with custom
config and CONFIG_ALL does not select them alone. Now
sane-backends depends on +ALL:sane-backends-all.

No existing ipk is affected as the changed package/sane-backends
does not exist as an ipk.

030-musl.patch was updated to be submitted upstream. However,
the added preprocessor #if are always true for OpenWRT and will
not change the resulting code.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

sane-backends: import from oldpackages and update

Changes since oldpackages:
- updated to 1.0.25
  * most of openwrt patches are upstreamed now
- cups dependency was completely removed
- small musl patch
- small uclibc patch
- removed link to extra libraries in libsane (used only
  for preload backends)
- sane-libs and sane-backends merged and exploded into
  individual packages for each backend:
  * libsane for sane library (which backends should dep on)
  * sane-daemon for saned daemon
  * sane-xxx for sane backend for xxx
  ** each backend has its own custom dep libraries
  * sane-backends-all (with no files) that deps on all backends
  * sane-qcam is only available for x86/x86_64
  ** other archs does not implement inb/outb (at least in musl)

Now it is possible to use SANE with much less FS space (KB
instead of MB).

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

squid: update to 3.5.12

Signed-off-by: Mislav Novakovic <mislav.novakovic@sartura.hr>

Merge pull request #2262 from clehner/for-15.05

ncdu: update to 1.11

ncdu: update to 1.11

- Add patch to get WEXITSTATUS and WIFEXITED defined
    The issue is fixed in upstream's development repo, so the patch won't be
    needed with ncdu's next release.
- Depend on more commonly used libncurses instead of libncursesw
- Enable parallel build
- Update copyright

Signed-off-by: Charles Lehner <cel@celehner.com>

ruby: bump to 2.2.4

This release includes a security fix for Fiddle extension.

* CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL

There are also some bugfixes.

In package, now LD_FLAGS is copied to DLD_FLAGS (used by ruby for libraries).
The missing values from LD_FLAGS cause build error when gcc does not implicitly
include staging/usr/lib.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Merge pull request #2258 from lbschenkel/cloudflare-rec_id-for-15.05

ddns-scripts: allow setting CloudFlare 'rec_id' in the config

ocserv: updated to 0.10.11

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls: updated to 3.4.8

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls: updated to 3.4.7

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge pull request #2230 from MikePetullo/for-15.05

For 15.05: Cherry pick a number of updates from maintainer into 15.05

libpng: update to 1.2.56

Fixes CVE-2015-8126 and CVE-2015-8540.

Signed-off-by: Oliver Middleton <olliemail27@gmail.com>

ddns-scripts: bump 2.4.3 to release 2

ddns-scripts: allow setting CloudFlare 'rec_id' in the config

This is necessary when there are multiple records for the same domain,
otherwise the script will overwrite the first one returned by the API.
It has the secondary benefit of allowing faster updates by performing
only one API call instead of two.

In case 'rec_id' is not set the script behaves exactly as before.

Signed-off-by: Leonardo Brondani Schenkel <leonardo@schenkel.net>
(grafted from 019ba13d01e93c18d0ed35b0aeb3399f28108e0e)

ocserv: prevent a crash if the per-user dir does not exist

Relates #2167

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge pull request #2195 from jow-/for-15.05

CC: freeradius2: completely disable runtime OpenSSL version checks

krb5: port removal of Prepare target from master

Signed-off-by: W. Michael Petullo <mike@flyn.org>

lighttpd: update to 1.4.38

Signed-off-by: W. Michael Petullo <mike@flyn.org>

krb5: update to 1.14

Signed-off-by: W. Michael Petullo <mike@flyn.org>

openldap: update to 2.4.43

Signed-off-by: W. Michael Petullo <mike@flyn.org>

libsoup: update to 2.53.2

Signed-off-by: W. Michael Petullo <mike@flyn.org>

luasec: update to 0.5.1

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Merge pull request #2169 from MikePetullo/php5

Cherry pick PHP5 updates into for-15.05.

freeradius2: completely disable runtime OpenSSL version checks

Whenever we ship fixed libopenssl binaries in CC, the Freeradius daemon fails
at startup because it detects a mismatch of the build time and runtime OpenSSL
version.

Since our OpenSSL updates for CC are ABI compatible we do not need or even want
this superflous check. Removing it saves us the effort to rebuild Freeradius
after every OpenSSL version bump.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

php5: update to 5.6.16

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: update to 5.6.15

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: update to 5.6.14

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: update to 5.6.13

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: fix the two different maintainer fields into one (fixes #1688)

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: update to 5.6.12

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: update to 5.6.10

This fixes the following CVEs:
 - in PCRE: CVE-2015-2325, CVE-2015-2326
 - in sqlite3: CVE-2015-3414, CVE-2015-3415, CVE-2015-3416

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: update to 5.6.9

This fixes CVE-2006-7243, a multipart/form-data remote dos vulnerability,
a heap buffer overflow in unpack and a integer overflow in ftp_genlist,
which also results in a heap overflow.
For more details, see http://php.net/ChangeLog-5.php#5.6.9

Also sync the timezone patch with latest version from Debian and
adopt this patch for the changes in this php release.

Refresh 950-Fix-dl-cross-compiling-issue.patch.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: add php5-mod-opcache (fixes #1010)

This patch adds build infrastructure for PHP's OPcache extension.
Compared with the other extension, this is a Zend module and it
need a little workaround during cross-compiling.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php5: pecl: move phpize into prepare stage

This allows pecl modules to rely on PKG_FIXUP:=autoreconf.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

vpnc-scripts: bumped version

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

vpnc-scripts: Fix handling of multiple VPN DNS servers

Fix for #2116 - $INTERNAL_IP{4,6}_DNS variables are not word-split correctly when containing more than one DNS server.

Signed-off-by: Aleksandar Radovanovic <biblbroks@sezampro.rs>

CONTRIBUTING.md: Add advice about pull requests

Add "best practices" advice about working with pull requests.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit df35777400041367e6696729a22e6e0295e930bf)

wget: bump version to 1.17.1

Backport from trunk the version update to 1.17.1.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #2122 from commodo/python-backports-15.05

python: backport some patches from trunk to 15.05

python: add missing host build dependency on expat/host

Since 94f87dc1, host build of Python depends on expat installed in host
staging directory. However, pyexpat extension fails to build if expat
was not built and installed to staging dir before - adding host build
dependency should fix this.

Signed-off-by: Jan Čermák <jan.cermak@nic.cz>

python: fix cross-compiling C++ modules.

Signed-off-by: Attila Lendvai <attila@lendvai.name>

python: add correct host expat

Signed-off-by: Steven Barth <steven@midlink.org>

python: fix patch removing multiarch support for host python

Patch removing multiarch paths from build should be applied only when
Python is built for target, but not for host. When the paths are removed
during host build, host python throws some ugly errors when importing
some hashlib modules. Also it reports that modules crypt and nis failed
to build (tested on Ubuntu 14.04 host).

Signed-off-by: Jan Čermák <jan.cermak@nic.cz>

sqm-scripts: Bump to v1.0.6.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

libradcli: updated to 1.2.5

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

postgresql: now visible with uclibc
Signed-off-by: Alexander Ryzhov <openwrt@ryzhov-al.ru>

Merge pull request #2072 from thess/for-15.05

dosfstools: [for-15.05] bump to 3.0.28, fix URLs - dev moved to github

dosfstools: bump to 3.0.28, fix URLs - dev moved to github

Signed-off-by: Ted Hess <thess@kitschensync.net>

haproxy: bump to version 1.5.15
 - integrate pending patches

Signed-off-by: heil <heil@terminal-consulting.de>

p11-kit: Version update

Just a regular version update
- Package gnutls requires the 0.23.1 to compile.

Signed-off-by: Carlos M. Ferreira <carlosmf.pt@gmail.com>

ocserv: corrected path for ocserv-fw

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: correct md5sum, install ocserv-fw, and eliminate ip dependency

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

vpnc-script: don't attempt to resolve domains which match the local domain

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

vpnc-script: create dnsmasq entries for connections where default domain is set

Relates to #1975

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: updated to 0.10.10

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: always advertise the local domain to peer

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: Added option to pass split-dns configuration to clients

Relates to #1975

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: when default-domain is set, enable split-dns

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: allow enabling proxy ARP

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: if ocserv.conf.local is present append it to ocserv.conf

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: simplify IPv6 network setting

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: removed unecessary instructions and script

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocserv: updated to 0.10.9

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge pull request #2018 from thomasp11/for-15.05

cshark: update to latest git HEAD

cshark: update to latest git HEAD

libpng: update to 1.2.54

Includes fixes for CVE-2015-7981 and CVE-2015-8126.

Signed-off-by: Oliver Middleton <olliemail27@gmail.com>

Merge pull request #1871 from dangowrt/update-postgresql-for-15.05

update PostgreSQL

Merge pull request #1941 from padre-lacroix/for-15.05

bandwidthd: Addition of 2 variants of the bandwidthd package.

sqm-scripts: Bump to v1.0.5.

pptpd: backport from trunk

Signed-off-by: Luka Perkov <luka@openwrt.org>

bandwidthd: Addition of 2 variants of the bandwidthd package.
Addition of the bandwithd package variant from the oldpackage
Addition of the bandwidthd-pgsql package variant that can save also
in a postgres database.
Compile tested on CC and trunk (ar71xx and mvebu in both cases)
run tested on CC (ar71xx) and trunk (r47397 on mvebu)

Signed-off-by: Jean-Michel Lacroix <lacroix@lepine-lacroix.info>

libmraa: board detection was broken after the name changed

Signed-off-by: John Crispin <blogic@openwrt.org>

unzip: patch CVE-2015-7696, CVE-2015-7697 and integer underflow

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>

madplay: some build variant related fixes

the 2 variants could not be built at the same time

Signed-off-by: John Crispin <blogic@openwrt.org>

node: disable MIPS16

Signed-off-by: John Crispin <blogic@openwrt.org>

python: fix two build depend issues

Build depends must refer to the source package name, not the binary one,
therefore we need to use `bzip2` in order to enforce a build of libbz2.so.

Also make the host python build depend on the bzip2 host build in order to
ensure that host python is built with bzip2 support. We don't need a build
dependency for the target python as this already depends on +libbz2 through
python-light. That package dependency in turn implies a build dependency.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

gnutls: update to 3.4.6

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

node-cylon: dont double build firmata and serialport

Signed-off-by: John Crispin <blogic@openwrt.org>

libupm: add fixes for 2 sensors

Signed-off-by: John Crispin <blogic@openwrt.org>

swig: make it compile even if pcre libs are not available

Signed-off-by: John Crispin <blogic@openwrt.org>

node: add a python/host dependency

Signed-off-by: John Crispin <blogic@openwrt.org>

zabbix: enable IPv6 support

compile tested on trunk, run tested on CC (ar71xx)

size before:
 96757 zabbix-agentd_2.4.6-1_ar71xx.ipk
 29180 zabbix-get_2.4.6-1_ar71xx.ipk
258979 zabbix-proxy_2.4.6-1_ar71xx.ipk
 35121 zabbix-sender_2.4.6-1_ar71xx.ipk
282885 zabbix-server_2.4.6-1_ar71xx.ipk

size after:
 97359 zabbix-agentd_2.4.6-2_ar71xx.ipk
 29841 zabbix-get_2.4.6-2_ar71xx.ipk
259948 zabbix-proxy_2.4.6-2_ar71xx.ipk
 35801 zabbix-sender_2.4.6-2_ar71xx.ipk
284019 zabbix-server_2.4.6-2_ar71xx.ipk

original PR by Thomas Bahn <thomas-bahn@gmx.net>

Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>

swig: add PKG_LICENSE_FILE

Signed-off-by: John Crispin <blogic@openwrt.org>

node-hid: set proper version and revision

* fix revision variables
* fix version variables

Signed-off-by: John Crispin <blogic@openwrt.org>

node-hid: set proper version and revision

* fix revision variables
* fix version variables

Signed-off-by: John Crispin <blogic@openwrt.org>

node-cylon: add proper download path and set version properly

* fix version
* fix download path
* fix version variables

Signed-off-by: John Crispin <blogic@openwrt.org>

node-arduino-firmata: set proper download path and set version properly

* fix download path
* fix version variables

Signed-off-by: John Crispin <blogic@openwrt.org>