Merge pull request #19214 from dibdot/travelmate

travelmate: update 2.1.0

travelmate: update 2.1.0

* vpn support can be disabled (enabled by default), fixes #19107 (see trm_vpn option)
* vpn support can be limited to certain interfaces (see trm_vpnifacelist list option)
* openvpn support works now per instance (same as wireguard today)
* add an auto-login script for tplink-omada hotspots provided by Sebastian Muszynski <basti@linkt.de>
* remove pipefail command, see #19043 for reference

Signed-off-by: Dirk Brenken <dev@brenken.org>

Merge pull request #19097 from TDT-AG/pr/20220803-zabbix

zabbix: add fping dependency

gerbera: remove

This was meant to be a less buggy replacement to minidlna.
Unfortunately, the opposite seems to have happened over time. In
addition, it currently doesn't build.

I don't see many people actually using this. Probably better to just
remove.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

mpd: update to 0.23.9

Fixes compilation with newer ffmpeg.

Remove upstreamed patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #19192 from turris-cz/cython-pip-requirements

host-pip-requirements: update Cython to version 0.29.28

miniflux: update to 2.0.38

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

yt-dlp: update to 2022.8.14

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

boost: bump to version 1.80.0

This commit updates boost to version 1.80.0

There are no new libraries in this version

The following patches were removed due to upstream update:
* 010-mips1.patch [1]
* 910-json-array-erase-relocate.patch [2]

More info about Boost 1.80.0 can be found at the usual place [3].

[1]: https://github.com/boostorg/config/pull/390
[2]: https://github.com/boostorg/json/pull/695
[3]: https://www.boost.org/users/history/version_1_80_0.html

Signed-off-by: Carlos Miguel Ferreira <carlosmf.pt@gmail.com>

usteer: update to latest HEAD

7d2b17c ubus: optimize connected_clients output format
8b10a4b policy: don't alter stats when remaining idle
3cc0f45 policy: count kick total
aadc562 policy: make steering ability evaluation uniform
17c558d ubus: include SSID in node dump
fc158e0 policy: only trigger roam-sm after client becomes roamable
837f144 usteer: add connected-since
9e6002d policy: improve readability

Build-tested: ath79-generic / ramips-mt76x8
Run-tested: ath79-generic / UniFi AC Lite

Signed-off-by: David Bauer <mail@david-bauer.net>

telegraf: Update to version 1.23.4

Signed-off-by: Jonathan Pagel <jonny_tischbein@systemli.org>

Merge pull request #19113 from bheesham/quick-typo

Fix typo in ddns-scripts: s/ganid/gandi/

ddns-scripts: Fix typo s/ganid/gandi/

Signed-off-by: Bheesham Persaud <me@bheesham.com>

host-pip-requirements: update Cython to version 0.29.28

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

usteer: bump to git HEAD

  041e884 local_node: query client MBO support from hostapd

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

telegraf: Add influxdb2 output plugin to package version small

Signed-off-by: Jonathan Pagel <jonny_tischbein@systemli.org>

python3-simplejson: drop package

Was only used by Bigclown.
The project (Bigclown) has accepted the switch from simplejson to it's
built-in json lib, and we can now drop this lib.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

bigclown-gateway: use Python's json lib

From:
  https://github.com/hardwario/bch-gateway/pull/17

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

bigclown-control-tool: use Python's json lib

From:
  https://github.com/hardwario/bch-control-tool/pull/5

This is a backport version 0.2.0

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

bluld: Do not include kernel headers into user space application

Remove the extra include for kernel headers from this user space
application. These extra includes are causing compile errors when
compiling with glibc. User space applications should not need such
headers.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

sslh: install sslh-select

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

mqttled: update to 0.1.2

Signed-off-by: Tom Grime <tom.grime@gmail.com>

zoneinfo: updated to the latest release

Signed-off-by: Vladimir Ulrich <admin@evl.su>

frp: update to 0.44.0

Changelog: https://github.com/fatedier/frp/release

Signed-off-by: Van Waholtz <vanwaholtz@gmail.com>

iperf: Updated to 2.1.8

Enabling fast sampling to support four digit (e.g., 1.0000) precision in reports' timestamps. Useful for sub-millisecond sampling.

Changelog: https://sourceforge.net/p/iperf2/code/ci/2-1-8/tree/README

Signed-off-by: Alberto Martinez-Alvarez <amteza@gmail.com>
Maintainer: @nbd168
Compile tested: ath79, ramips, bcm27xx

gg: Update to 0.2.8

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

rclone: Update to 1.59.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

haproxy: Update HAProxy to v2.6.2

- Update haproxy download URL and hash

Signed-off-by: Christian Lachner <gladiac@gmail.com>

lighttpd: update to lighttpd 1.4.66 release hash

* update to lighttpd 1.4.66 release hash

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>

cloudflared: Update to 2022.8.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

libpqxx: fix makefile typo

Signed-off-by: Igor Bezzubchenko <garikello@gmail.com>

libpqxx: update to version 7.7.4

Signed-off-by: Igor Bezzubchenko <garikello@gmail.com>

ariang: update to 1.2.4

Changelog: https://github.com/mayswind/AriaNg/releases

Signed-off-by: Van Waholtz <vanwaholtz@gmail.com>

opendoas: fix build with PAM

When PAM is available, the build system will detect and use it, but the
package dependency was missing.

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

Revert "strongswan: add strongswan-mod-socket"

The original PR for this change is #16373, where it's cleary stated it
doesn't work. This should have never been merged. It causes the
following recursive dependency:

tmp/.config-package.in:122354:error: recursive dependency detected!
tmp/.config-package.in:122354:  symbol PACKAGE_strongswan-default depends on PACKAGE_strongswan-mod-socket-default
tmp/.config-package.in:123534:  symbol PACKAGE_strongswan-mod-socket-default is selected by PACKAGE_strongswan-default

This reverts commit 603f70e96b4dc1b9e442a38cb692de519c1cd54a.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

Merge pull request #19048 from guijan/update-stress_ng

stress-ng: update to 0.14.03

acme: use the hotplug system

Signed-off-by: Glen Huang <heyhgl@gmail.com>

Merge pull request #16367 from pprindeville/strongswan-mod-socket-dep

strongswan: Add dependency to virtual package strongswan-mod-socket

knot: update to 3.1.9

Signed-off-by: Jan Hák <jan.hak@nic.cz>

rsync: bump to 3.2.5

With the new OW release approaching, it might be better to get an officially
tagged upstream release in as PR#19087 just contained a fix for CVE-2022-29154
which itself introduced a few bugs.

Signed-off-by: John Audia <therealgraysky@proton.me>

uvol: fix autopart handling double/float number

Consider only integer part of free space in megabytes when
deciding the boundaries of the to be created partition.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

opendoas: add package

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

tree: update upstream source

Update Makefile to use github mirror of new source url since current one is
going to retire. "Notice this site is likely going to be shutdown after over
28 years. I will likely be moving all my code-bases to
https://gitlab.com/OldManProgrammer"[1]

1. http://mama.indstate.edu/users/ice/tree

Signed-off-by: John Audia <therealgraysky@proton.me>

rclone: fix init script on CIDR format ipaddr

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>

rsync: fix CVE-2022-29154

The rsync package is vulnerable to CVE-2022-29154[1], which is not yet in a
non-preview release. This commit applies the upstream commit to fix it and
several subsequent commits needed to fix bugs the initial fix introduced[2].

1. https://rsync.samba.org/ftp/rsync/NEWS#SECURITY_FIXES-3.2.5
2. https://bugs.archlinux.org/task/75558

Signed-off-by: John Audia <therealgraysky@proton.me>

Merge pull request #19156 from turris-cz/websockets

python-websockets: update to version 10.3

python-websockets: update to version 10.3

- Update copyright

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

libwebp: bump to version 1.2.4

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

stress-ng: update to 0.14.03

Signed-off-by: Guilherme Janczak <guilherme.janczak@yandex.com>
Co-authored-by: Alexandru Ardelean <ardeleanalex@gmail.com>

Merge pull request #19085 from hardfalcon/unbound-1.16.2

unbound: update to 1.16.2, fix CVE-2022-30698, CVE-2022-30699

ksmbd-tools: add package with hotplug.d script for auto sharing

One of common use cases for SMB3 server in routers is sharing hotplugged
drives. Users make many attempts setting that up which often are not
optimal.

This script handles it in the cleanest way by using:
1. hotplug.d mount subsystem
2. runtime config in the /var/run/config/

It provides a working basic solution that can be later adjusted by
modifying provided hotplug script.

A pretty much idential solution was part of the samba36 package. It was
added in the OpenWrt commit ef1efa756e0d0 ("samba36: add package with
hotplug.d script for auto sharing") as an answer for feature required by
the Rosinson company.

Cc: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

ksmbd-tools: append config from /var/run/config/ for runtime shares

Dynamically created shares shouldn't be stored in the /etc/config/
because of:
1. Flash wearing
2. Risk of inconsistent state on reboots

With this change all automation/hotplug.d scripts can store runtime in
the /var/run/config/samba. It's useful e.g. for USB drives that user
wants to be automatically shared.

Also: automated scripts should never call "uci [foo] commit" as that
could flush incomplete config. This problem also gets solved.

Identical feature was added to samba36 in the OpenWrt commit
5a59e2c059866 ("samba36: append config from /var/run/config/ for runtime
shares") but wasn't ported to ksmbd until now.

Cc: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

Merge pull request #19146 from pprindeville/strongswan-include-mgf1

strongswan: bundle mgf1 with everything

shadowsocks-libev: ss-rules: nft rule cleanup on reload

Remove nft rules file generated by ss-rules if ss-rules was or should be
turned off for by configuration.  Use "fw4 restart" instead of "fw4
reload" to force the runtime rule reloading

Ref: https://github.com/openwrt/packages/pull/17937#issuecomment-1207357037
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

shadowsocks-libev: ss-rules: setup policy rules for udp/ip6

Supersedes: https://github.com/openwrt/packages/pull/18852
Fixes: https://github.com/openwrt/packages/issues/18850
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

strongswan: bundle mgf1 with everything

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

Merge pull request #19145 from Thermi/strongswan-5.9.7-model-kdf-dependencies

strongswan: try to model kdf optional dependencies

strongswan: try to model kdf optional dependencies

Signed-off-by: Noel Kuntze <noel.kuntze@thermi.consulting>

cgi-io: update to latest Git HEAD

901b0f0 main: fix two one-byte overreads in header_value()

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Merge pull request #19128 from pprindeville/strongswan-update-5.9.7

strongswan: Update to 5.9.7

Merge pull request #19084 from jtkohl/watchcat-ping-bugfix

watchcat: fix broken ping invocation for no-address-family configuration

Merge pull request #19125 from hirnpfirsich/master

prometheus-node-exporter-lua: add realtek-poe exporter

strongswan: Update to 5.9.7

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

Merge pull request #19130 from mhei/php8-update-8.1.9

php8: update to 8.1.9

prometheus-node-exporter-lua: add realtek-poe exporter

exposes PoE metrics obtained from realtek-poe

 # HELP realtek_poe_switch_info information about the poe controller
 # TYPE realtek_poe_switch_info gauge
 realtek_poe_switch_info{mcu="ST Micro ST32F100 Microcontroller",firmware="v22.4"} 1

 # HELP realtek_poe_switch_budget_watts overall power budget
 # TYPE realtek_poe_switch_budget_watts gauge
 realtek_poe_switch_budget_watts 77

 # HELP realtek_poe_switch_consumption_watts overall power consumption
 # TYPE realtek_poe_switch_consumption_watts gauge
 realtek_poe_switch_consumption_watts 5

 # HELP realtek_poe_port_priority poe priority of port
 # TYPE realtek_poe_port_priority gauge
 realtek_poe_port_priority{device="lan1"} 1
 realtek_poe_port_priority{device="lan2"} 1
 [...]

 # HELP realtek_poe_port_consumption_watts per port power consumption
 # TYPE realtek_poe_port_consumption_watts gauge
 realtek_poe_port_consumption_watts{device="lan1"} 0
 realtek_poe_port_consumption_watts{device="lan2"} 0
 [...]

 # HELP realtek_poe_port_state per port poe state
 # TYPE realtek_poe_port_state gauge
 realtek_poe_port_state{device="lan1",state="Disabled"} 0
 realtek_poe_port_state{device="lan1",state="Searching"} 1
 [...]
 (states: Disabled, Searching, Delivering power, Fault, Other fault, Requesting power)

 # HELP realtek_poe_port_mode per port poe mode
 # TYPE realtek_poe_port_mode gauge
 realtek_poe_port_mode{device="lan1",mode="PoE"} 0
 realtek_poe_port_mode{device="lan1",mode="PoE+"} 1
 [...]
 (modes: PoE, Legacy, pre-PoE+, PoE+)

Signed-off-by: Gregor Michels <hirnpfirsich@brainpeach.de>

Merge pull request #19114 from commodo/squashfs-tools-zstd

squashfs-tools: enable zstd compression by default

php8: update to 8.1.9

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Merge pull request #18628 from mcb30/openconnect-proxy

OpenConnect proxy support

prometheus-node-exporter-lua: fix hostapd stations

We can only utilize statistics from interfaces having ubus interface.

Signed-off-by: Nick Hainke <vincent@systemli.org>

Merge pull request #18834 from jpds/prometheus-selinux-collector

prometheus-node-exporter-lua: Added selinux.lua.

openconnect: Allow reconnect timeout to be specified

Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>

openconnect: Support use of a proxy server

Allow connection via a proxy server (required on some sites where
direct outbound HTTP(S) access is not permitted).

Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>

Merge pull request #19126 from PolynomialDivision/update-gnutls

gnutls: update to 3.7.7

gnutls: update to 3.7.7

- libgnutls: Fixed double free during verification of pkcs7 signatures.
  Reported by Jaak Ristioja (#1383). [GNUTLS-SA-2022-07-07, CVSS: medium]
  [CVE-2022-2509]

- libgnutls: gnutls_hkdf_expand now only accepts LENGTH argument less than or
  equal to 255 times hash digest size, to comply with RFC 5869 2.3.

- libgnutls: Length limit for TLS PSK usernames has been increased
  from 128 to 65535 characters (#1323).

- libgnutls: AES-GCM encryption function now limits plaintext
  length to 2^39-256 bits, according to SP800-38D 5.2.1.1.

- libgnutls: New block cipher functions have been added to transparently
  handle padding.  gnutls_cipher_encrypt3 and gnutls_cipher_decrypt3 can be
  used in combination of GNUTLS_CIPHER_PADDING_PKCS7 flag to automatically
  add/remove padding if the length of the original plaintext is not a multiple
  of the block size.

- libgnutls: New function for manual FIPS self-testing.

API and ABI modifications:
- gnutls_fips140_run_self_tests: New function
- gnutls_cipher_encrypt3: New function
- gnutls_cipher_decrypt3: New function
- gnutls_cipher_padding_flags_t: New enum

Signed-off-by: Nick Hainke <vincent@systemli.org>

yq: Update to 4.27.2

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

mxml: update to 3.3.1

Signed-off-by: Espen Jürgensen <espenjurgensen+openwrt@gmail.com>

luajit: patch: PPC/e500 SPE: use soft float instead of failing

makes LuaJit builds for mpc85xx targets with SPE ISA extension
enabled possible

Quoting inner commit message:

This allows building LuaJit for systems with Power ISA SPE
extension[^1] support by using soft float on LuaJit side.

While e500 CPU cores support SPE instruction set extension
allowing them to perform floating point arithmetic natively,
this isn't required. They can function with software floating
point to integer arithmetic translation as well,
just like FPU-less PowerPC CPUs without SPE support.

Therefore I see no need to prevent them from running LuaJit
explicitly.

[^1]: https://www.nxp.com/docs/en/reference-manual/SPEPEM.pdf

Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>

squashfs-tools: enable zstd compression by default

Requested via:
  https://github.com/openwrt/packages/issues/19111

PKG_RELEASE is set to AUTORELEASE, so no need to bump.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

Merge pull request #19104 from janh/python-paho-mqtt-depends-uuid

python-paho-mqtt: add missing dependency

kea: bump to 2.0.3

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

squeezelite: update to 1.9.9-1403

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #19083 from pprindeville/drop-parallel-support-non-x86

lcdproc: don't enable LPT support on non-x86 architectures

Merge pull request #18781 from paper42/fail2ban-py310

fail2ban: fix patch for python 3.10

Merge pull request #19021 from borkra/fix_dependencies

Avoid building unused package dependencies

lcdproc: don't enable LPT support on non-x86 architectures

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

python-paho-mqtt: add missing dependency

The uuid module has been split out into a separate package with the
update to Python 3.10.

Signed-off-by: Jan Hoffmann <jan@3e8.eu>

zabbix: add fping dependency

If fping is not installed on the system the following message is show if
hosts should be monitored via icmp.

Log-Message:
"At least one of '/usr/sbin/fping', '/usr/sbin/fping6' must exist. Both
are missing in the system."

To fix this also, add a dependency to 'fping' for 'zabbix-server' and
'zabbix-proxy' for installation to allow icmp hosts monitoring.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

sexpect: updated to 2.3.11

Signed-off-by: Clark Wang <dearvoid@gmail.com>

python-jsonschema: Update to 4.9.0

Signed-off-by: Javier Marcet <javier@marcet.info>

docker-compose: Update to version 2.9.0

Signed-off-by: Javier Marcet <javier@marcet.info>

unbound: update to 1.16.2, fix CVE-2022-30698, CVE-2022-30699

Maintainer: @EricLuehrsen
Compile tested: x86/64
Run tested: x86/64
Description: Update to 1.16.2, fix CVE-2022-30698 and CVE-2022-30699.

Signed-off-by: Pascal Ernster <git@hardfalcon.net>

nano: update to 6.4

Update nano editor to version 6.4.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

coremark: bump to 2022-07-27

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>

watchcat: fix broken ping invocation for no-address-family configuration

Fix for issue #19010

Signed-off-by: John Kohl <jtk.git@bostonpog.org>
Signed-off-by: Michal Kowalski <18610805+kofec@users.noreply.github.com>

gnutls: Avoid building unused gnutls dependency

Avoid building unused gnutls dependency

Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>

gensio: Avoid building unused python and libstdcpp dependecies

Avoid building unused python and libstdcpp dependecies

Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>

chrony: Avoid building unused gnutls and ca dependencies

Avoid building unused gnutls and ca dependencies

Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>

realtek-poe: Add package to control PoE for Realtek 838x devices

The realtek-poe package is used to configure the Power-over-Ethernet
controller found on Realtex 838x based switches. On many such
switches, the PoE doesn't work without this package.

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>

Merge pull request #19055 from pprindeville/issue#18975

lcdproc: don't detect parallel port on build host

lcdproc: don't detect parallel port on build host

Also, limit builds to x86 and x86_64.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>