screen: backport fix for CVE-2021-26937

Security reports:
- https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
This issue can be reproduced even on OpenWrt
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982435

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c250298fa3e60251dfbbb0df40b36c6d67bbea09)

Merge pull request #14834 from jefferyto/golang-1.16-openwrt-21.02

[openwrt-21.02] golang: Update to 1.16

Merge pull request #14851 from 1715173329/2102-yq-mter

[openwrt-21.02] yq: bump to 4.6.0, remove myself from maintainters

Merge pull request #14848 from jefferyto/python-config-macos-openwrt-21.02

[openwrt-21.02] python3: Fix target python-config when building on macOS

netdata: update to version 1.29.2

Release notes:
https://github.com/netdata/netdata/releases/tag/v1.29.2

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e8021bf14d591edfb3fe36dd194b8109d4f7ffd3)

yq: Update to 4.6.0

Signed-off-by: Tianling Shen <cnsztl@gmail.com>
(Backported from b8a2c86aa7e0d008ee896ddc10dd467d406f5499)

yq: remove myself from maintainters

Signed-off-by: Tianling Shen <cnsztl@gmail.com>
(Backported from f56d697985a8db193e744754757f5ac41b1ae229)

python3: Fix target python-config when building on macOS

The Python version of python-config is installed when building on macOS,
rather than the shell script version when building on Linux. When run on
macOS, the Python version of python-config will return values with
Mac-specific customizations.

This patches the python-config install recipe so that which version is
installed can be controlled by the package makefile. When building on
macOS, this installs the Python version for host Python and the shell
script version for target Python.

This also updates Host/Compile and Host/Install to use the default host
build recipes, so that the various HOST_* variables are taken into
account automatically.

Fixes https://github.com/openwrt/packages/issues/14652

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 18330902a0ca1b162e1ae938d8024cfb7e7c524d)

golang: Update to 1.16

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit dc587eccb7ad9f12ef4498ecb339a484299c39ba)

git-lfs: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 0bc2f89ae1d77de2f5a5ebb54b8e56f6d7e22b23)

perl-try-tiny: use relative include of perlmod.mk

The $(TOPDIR) seemed to cause Makefile parsing issues with CI.

Signed-off-by: Matt Merhar <mattmerhar@protonmail.com>
(cherry picked from commit 52668b1e9798719f5e7d956f981f2dd2663b2c09)

dnstap: update to version 0.4.0

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 5514fca2b7c39fc96cf2e0b15bfede1ffc902d04)

bind: bump to 9.17.10

Add build dependency on libnghttp2 for DNS-over-HTTPS support

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit f33ab760192c02f226dac67236f97a57209d5153)

tor: update to version 0.4.5.6

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 17056742ad3115cef0f7022530cbddff2ba0415f)

zerotier: bump to 1.6.4

Signed-off-by: Moritz Warning <moritzwarning@web.de>

banip: update to 0.7.3

* fix search string/pipe preparation for the background service
* fix IPSet maxelem limitation, made it more flexible
* fix potential error during resume action
* add Cisco Talos IP blacklist
* update readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit b65353b4f76f89c11a8e7f2c6307d461e0dce696)

rng-tools: fix init START

We should be using "00" to deal with alphabetical order.

Fixes: d9cea6747 ("rng-tools: start as early as possible")
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry-picked from 55b22d131)

rng-tools: start as early as possible

Raspberry Pi devices (bcm2708) need this to get from:
[  102.310494] random: crng init done
to:
[   12.539744] random: crng init done

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry-picked from commit e9a126c14)

Merge pull request #14805 from apple-etan/21-02/feature/ek/libnetfilter-queue/ipv6

libnetfilter-queue: fix IPv6 header handling

libnetfilter-queue: fix IPv6 header handling

Import 51f25df304aeaa6c1b02ef7456a61278ee70c102 from upstream.

Signed-off-by: Etan Kissling <etan_kissling@apple.com>
(cherry picked from commit a16faf72b19aba203a8185cba6eae45f62150840)
Signed-off-by: Etan Kissling <etan_kissling@apple.com>

Merge pull request #14803 from apple-etan/21-02/feature/ek/libnetfilter-queue/icmp

libnetfilter-queue: add pkt_buff function for ICMP

libnetfilter-queue: add pkt_buff function for ICMP

Import 662c8f44d53492d2e0ebd430dadef12d580ec330 from upstream.

Signed-off-by: Etan Kissling <etan_kissling@apple.com>
(cherry picked from commit 73060f910443476f4f13b76d0f3c9b63473ebbaf)
Signed-off-by: Etan Kissling <etan_kissling@apple.com>

Merge pull request #14795 from apple-etan/21-02/feature/ek/libnetfilter-queue/fixup

libnetfilter-queue: re-add PKG_FIXUP to fix build

reptyr: Don't build for mipsel

The package does not support any mips archs, including mipsel.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit ac3beceb9614021d0de2b57c8d7aad716d824554)

libnetfilter-queue: re-add PKG_FIXUP to fix build

Currently when trying to build this package a build error is produced:

WARNING: 'automake-1.16' is missing on your system.
         You should only need it if you modified 'Makefile.am' or
         'configure.ac' or m4 files included by 'configure.ac'.
         The 'automake' program is part of the GNU Automake package:
         <https://www.gnu.org/software/automake>
         It also requires GNU Autoconf, GNU m4 and Perl in order to run:
         <https://www.gnu.org/software/autoconf>
         <https://www.gnu.org/software/m4/>
         <https://www.perl.org/>

This error is due to an attempt to use the native host tools instead of
the OpenWrt build system generated ones. By re-adding PKG_FIXUP it is
ensured that the correct version of the host tools are used.

Signed-off-by: Etan Kissling <etan_kissling@apple.com>
(cherry picked from commit cab73ac82606068ac081df7cd6a2100acc620c77)
Signed-off-by: Etan Kissling <etan_kissling@apple.com>

bcm27xx-eeprom: update to latest version

New eeprom firmwares support recently added RPi 400 and CM4.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry-picked from commit 7bbf6d1d0)

banip: update to 0.7.2

* add scanning for suspicious nginx events
* add a log counter to track the number of the failed requests
  or login repetitions of the same ip in the log before banning,
  defaults are: ssh (3), luci (3), nginx (5)
* optimize the background service handling
* add 'greensnow' as a new source
* update readme and LuCI frontend regarding the new log count options

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 55d663d291419731b1ff49600adc89ac389aee13)

Merge pull request #14756 from BKPepe/klish-add-nls

klish: add include for nls when BUILD_NLS is enabled

klish: add include for nls when BUILD_NLS is enabled

In recent commit for libxml2 [1], there was enabled support for iconv,
but it relieves issue with klish that it does not compile as it fails with
following output:

checking for xmlNewDoc in -lxml2... no
configure: error: cannot find libxml2 library
make[2]: *** [Makefile:73: /foo/build/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/klish-2.2.0/.configured_68b329da9893e34099c7d8ad5cb9c940] Error 1
make[2]: Leaving directory '/foo/build/feeds/packages/utils/klish'

[1] https://github.com/openwrt/packages/commit/d18692c92638cdc1e643554699cb21e893abf2e9

Suggested-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

prometheus-node-exporter-lua: fix wifi

The "get_wifi_interfaces" function is not returning the wifi interface
names. This causes the bug #14625.

Fix the "get_wifi_interfaces" function.

Signed-off-by: Nick Hainke <vincent@systemli.org>

Merge pull request #14743 from jefferyto/python-cffi-1.14.5

python-cffi: Update to 1.14.5

Merge pull request #14753 from commodo/python-updates1

python-pytz,numpy: bump versions

Merge pull request #14747 from neheb/o

open-vm-tools: update to 11.2.5

Merge pull request #14751 from neheb/rpcbind

rpcbind: clean up patches using quilt

owipcalc: separate in client and lib

Separate owipcalc in client and lib part. Owipcalc brings a lot of nice
functionality with it, e.g. parsing and calculating prefixes.

Signed-off-by: Nick Hainke <vincent@systemli.org>

Merge pull request #14693 from stangri/master-vpn-policy-routing

vpn-policy-routing: update to version 0.3

Merge pull request #14744 from jefferyto/python-cryptography-3.3.2

python-cryptography: Update to 3.3.2

numpy: bump to version 1.20.1

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

python-pytz: bump to version 2021.1

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

rpcbind: clean up patches using quilt

The second one was manually modified as quilt gets confused by the ***
and ends up removing the commit description.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

apk: update to 2.12.2

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #14748 from neheb/at

atftp: update to 0.7.4

atftp: update to 0.7.4

Remove upstreamed patches. Refresh others.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

open-vm-tools: update to 11.2.5

Work around a quilt bug where instead of showing a rename, it removes
and duplicates the file.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #14684 from rsa9000/atheepmgr-integration

atheepmgr: add new package

Merge pull request #14746 from snh/uhubctl-2.4.0

uhubctl: update to 2.4.0

uhubctl: update to 2.4.0

Signed-off-by: Steven Honson <steven@honson.id.au>

Merge pull request #14742 from jedisct1/dnscrypt-csv-update

net/dnscrypt-proxy: update the CSV list of resolvers

net/dnscrypt-proxy: update the CSV list of resolvers

The previous list was very out of date.

An always up-to-date v1-compatible list is available at:
https://download.dnscrypt.info/dnscrypt-resolvers/v1/

Also use different default resolvers since the previous ones don't
exist any longer.

Signed-off-by: Frank Denis <github@pureftpd.org>

Merge pull request #14722 from BKPepe/sqlalchemy

python-sqlalchemy: update to version 1.3.23

Merge pull request #14676 from httpstorm/perl-5.28.1.fix-macos

perl: fix build errors on macOS

Merge pull request #14730 from BKPepe/nebula

Nebula: downloading tarball with name and its version instead of just version and cosmetic polishing of Makefile

Merge pull request #14732 from BKPepe/geth-fix-libiconv

geth: add libiconv-full dependency if build with NLS

Merge pull request #14724 from 1715173329/xr-bump

xray-core: Update to 1.3.0

python-cryptography: Update to 3.3.2

This fixes CVE-2020-36242 (buffer overflows caused by integer overflow
in OpenSSL).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-cffi: Update to 1.14.5

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

json-glib: update to 1.6.2

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

geth: update to version 1.9.25

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

geth: add libiconv-full dependency if build with NLS

Variable ICONV_DEPENDS is specified in nls.mk which can be found in
OpenWrt main repository.

This fixes issue:
/foo/build/staging_dir/toolchain-arm_cortex-a9+vfpv3-d16_gcc-8.4.0_musl_eabi/lib/gcc/arm-openwrt-linux-muslgnueabi/8.4.0/../../../../arm-openwrt-linux-muslgnueabi/bin/ld: cannot find -liconv

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nebula: cosmetic moving of PKG_MAINTAINER to different place

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nebula: use codeload instead of github source code

Previous code was downloading file v1.3.0, which is wrong, because in
the dl folder there might be some tarballs with that naming and they are
wrong as well.

This could lead to some issues like this:
Hash of the local file v1.3.0.tar.gz does not match (file: 87cf846b02dde6328b84832287d8725d91f12f41366eecb4d59eeda1d6c7efdf, requested: b94fba0251a4a436e25b127d0b9bc0181b991631f1dc8e344b1c8e895b55375d) - deleting download.

Even though, if you tried it on SDK or minimal build when there is a
small number of packages, you most likely don't encounter it.

The correct solution is to download files with their name and version.
E.g. nebula-version.tar.gz as it is in PKG_SOURCE variable now.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #14634 from neheb/a

alpine: try to make reproducible

xray-core: Update to 1.3.0

Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>

xray-core: add the test script for action checking

Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>

Merge pull request #14727 from nxhack/node_14155

node: update to v14.15.5

vpn-policy-routing: update to version 0.3

Signed-off-by: Stan Grishin <stangri@melmac.net>

banip: bugfix

* fix a stale pid file during package update

Signed-off-by: Dirk Brenken <dev@brenken.org>

xray-core: init: add option to control FullConeNAT setting

Latest version of xray-core made a change to support FullCone NAT,
which would break UDP connection from v2ray-core backend server.
So added the option for v2ray-core users, to make sure UDP works
as expected.

Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>

python-sqlalchemy: update to version 1.3.23

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

node: update to v14.15.5

Description:
Update to v14.15.5
upgrade npm to 6.14.11

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

atheepmgr: add new package

This utility is intended to analyze EEPROM/boarddata content of Atheros
based boards: load, dump, parse and perform quick edit. Mostly it is
used to work with binary dumps/blobs on a host, but sometime it is
useful to be able to run it on a board, e.g. to make an EEPROM content
dump or to quickly analyze ART/boarddata without copying it to a host.

Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>

xray-core: bump geodata to latest version

also adjusted GO_PKG_LDFLAGS_X which was suggested by Jeffery To.

Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>

youtube-dl: update to version 2021.2.10

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #14712 from ja-pa/ooniprobe-3.5.1

ooniprobe: update to version 3.5.1

ooniprobe: update to version 3.5.1

Changes:
Add test script

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Merge pull request #14713 from 1715173329/new-yq

yq: Update to 4.5.1

netdata: update to version 1.29.1

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

yq: Update to 4.5.1

added test script as well.

Changelog: https://github.com/mikefarah/yq/releases/tag/v4.5.1

Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>

dnscrypt-proxy2: sync blocked-names to upstream one

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #14707 from jclong83/dnscrypt-proxy2

dnscrypt-proxy2: upgrade to 2.0.45

Merge pull request #14705 from micmac1/iio-ico

libiio: allow access to iconv

Merge pull request #14668 from pprindeville/strongswan-create-swanctl.d-dir

strongswan: create /etc/swanctl/conf.d directory

dnscrypt-proxy2: upgrade to 2.0.45

Signed-off-by: James Long <james@jclong.net>

Merge pull request #14703 from micmac1/icecast-ico

icecast: allow access to iconv

Merge pull request #14704 from micmac1/ices-ico

ices: allow access to iconv

libiio: allow access to iconv

Since commit d18692c libxml2 is linked against iconv. Now libiio needs
access to iconv as well. Without it the build fails.

[ 32%] Building C object CMakeFiles/iio.dir/lock.c.o
[ 34%] Building C object CMakeFiles/iio.dir/iiod-client.c.o
[ 37%] Linking C shared library libiio.so
/builder/shared-workdir/build/sdk/staging_dir/toolchain-aarch64_generic_gcc-8.4.0_musl/bin/../lib/gcc/aarch64-openwrt-linux-musl/8.4.0/../../../../aarch64-openwrt-linux-musl/bin/ld: cannot find -liconv
collect2: error: ld returned 1 exit status

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

icecast: allow access to iconv

Since commit d18692c libxml2 (and by extension libxslt) is linked against
iconv. Now icecast needs access to iconv as well. Without it the build fails.

xslt.c: In function 'xsltSaveResultToString':
xslt.c:72:5: warning: this 'if' clause does not guard... [-Wmisleading-indentation]
     if (result->children == NULL)
     ^~
xslt.c:75:2: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
  buf = xmlAllocOutputBuffer(NULL);
  ^~~
xslt.c:81:27: error: dereferencing pointer to incomplete type 'xmlBuf' {aka 'struct _xmlBuf'}
   *doc_txt_len = buf->conv->use;
                           ^~
make[6]: *** [Makefile:545: xslt.o] Error 1
make[6]: Leaving directory '/openwrt/build_dir/target-mips_24kc_musl/icecast-2.4.4/src'

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Merge pull request #14702 from micmac1/xslt-ico

libxslt: allow access to iconv

Merge pull request #14701 from ja-pa/lmdb-update

lmdb: update to version 0.9.28

Merge pull request #14698 from lipnitsk/vpnc

vpnc: update to maintained github fork

Merge pull request #14689 from peter-stadler/django

django: update to 3.1.6 (fixing CVE-2021-3281)

ices: allow access to iconv

Since commit d18692c libxml2 is linked against iconv. Now ices needs
access to iconv as well. Without it the build fails.

checking for ftime... yes
checking for XML configuration
checking for xml2-config... /builder/shared-workdir/build/sdk/staging_dir/target-aarch64_generic_musl/host/bin/xml2-config
checking for xmlParseFile... no
configure: error: Unable to link with libxml

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

libxslt: allow access to iconv

Since commit d18692c libxml2 is linked against iconv. Now libxslt needs
access to iconv as well. Without it the build fails.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

lmdb: update to version 0.9.28

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Merge pull request #14700 from BKPepe/psmisc

psmisc: update to version 23.4

Merge pull request #14548 from stangri/master-nebula

nebula: initial commit

perl: fix build errors on macOS

Added a check for macOS 11 and newer to resolve a compile error:
*** Unexpected product version 11.2.

Added Internals::getcwd.
Fallback to the built-in getcwd to resolve compile errors on macOS:
Can't locate Errno.pm in @INC
/miniperl not found

Signed-off-by: Georgi Valkov <gvalkov@abv.bg>

django: update to 3.1.6

fix for CVE-2021-3281

Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>

Merge pull request #14694 from mhei/php7-update

php7: update to 7.4.15

strongswan: include /etc/swanctl/conf.d/ directory

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>