libedit: update to version 20210216-3.1

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit fd7f43ae4674b234a975ec67c604abf6e933a0b3)

libedit: update to version 20193112-3.1

Signed-off-by: Jan Hák <jhak@jhak.nic.cz>
(cherry picked from commit 58a5c548eb497552f53d42df677c70dbb36930f8)

adblock: update blocklist sources

* change adguard url
* remove malwaredomains (discontinued)

Signed-off-by: Dirk Brenken <dev@brenken.org>

Merge pull request #14869 from stangri/19.07-vpn-policy-routing

[19.07] vpn-policy-routing: update to version 0.3

knot: update to version 3.0.4

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 341fffb8ddd462cc41650b13e425e6e71efdfe4e)

knot: update to 3.0.3

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 5cd937865316f08144ebd8aaadfb2a1da19eeb10)

knot: disable embedded xdp

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit 1f9d6fbb26c20490dc58f84e5c86fa2c35012412)

knot: update to 3.0.2

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry picked from commit a54828926dc2aa731fbfefe87a7a9687837fc2be)

knot: disable libnghttp2 autodetection

Signed-off-by: Daniel Salzman <daniel.salzman@nic.cz>
(cherry picked from commit 67e3c594de15985b76871ea5c1ba2fd05427900d)

knot: update to version 3.0.1

definition of PSELECT_COMPAT could be removed many years ago, is no longer needed

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 4069bb1e727a00d68352ff6baefac9f5a94e156f)

screen: backport fix for CVE-2021-26937

Security reports:
- https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
This issue can be reproduced even on OpenWrt
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982435

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c250298fa3e60251dfbbb0df40b36c6d67bbea09)

openvswitch: update to version 2.11.6 (security fix)

Fixes CVEs:
- CVE-2020-35498
- In DPDK: CVE-2015-8011 and CVE-2020-27827
- In LLDP: CVE-2019-14818, CVE-2020-10722, CVE-2020-10723 and CVE-2020-10724

Removed patches:
- 0001-compat-Include-confirm_neigh-parameter-if-needed.patch because they
are included in this release as it was backported
- 0010-acinclude-Fix-build-with-kernels-with-prandom-moved-.patch
included in this release as it was backported

Other patches were refreshed.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

vpn-policy-routing: update to version 0.3

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #14710 from stangri/19.07-https-dns-proxy

[19.07] https-dns-proxy: support for force DNS/DNS hijacking

netdata: update to version 1.29.2

Release notes:
https://github.com/netdata/netdata/releases/tag/v1.29.2

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e8021bf14d591edfb3fe36dd194b8109d4f7ffd3)

netdata: update to version 1.29.1

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d0736d5e738cad74f81a99de0b039f75e7ca9768)

Merge pull request #14845 from jefferyto/python-3.7.10-openwrt-19.07

[openwrt-19.07] python3: Update to 3.7.10, refresh patches

python3: Update to 3.7.10, refresh patches

Includes fixes for:
* CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr
* CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon
  as a query args separator

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

zerotier: bump to 1.6.4

Signed-off-by: Moritz Warning <moritzwarning@web.de>

Merge pull request #14785 from nmeyerhans/openwrt-19.07+bind-9.16.12

bind: bump to 9.16.12

bind: bump to 9.16.12

Includes fix for security issues:

* CVE-2020-8625: BIND servers are vulnerable if they are running an
  affected version and are configured to use GSS-TSIG features.

Disable backtrace functionality, as it is unreliable across
architectures and generally only supported by upstream on amd64

Remove a patch that has been incorporated upstream

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

Merge pull request #14778 from BKPepe/ksmbd-19.07-drop-arc4-dependency

ksmbd: remove kmod-crypto-arc4 dependency

ksmbd: remove kmod-crypto-arc4 dependency

This kernel module is already set for target/linux/generic/config-4.14
in OpenWrt 19.07 branch. This solves a problem that this package can not
be installed on the router:

 * satisfy_dependencies_for: Cannot satisfy the following dependencies for kmod-fs-ksmbd:
 *  kmod-crypto-arc4
 * opkg_install_cmd: Cannot install package kmod-fs-ksmbd.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #14647 from neheb/k9

[19.07] ksmbd(-tools): update to 3.3.4

Merge pull request #14714 from 1715173329/ttyd-bp

[19.07] ttyd: force enable authentication for login

htop: update to 3.0.5-1

Signed-off-by: John Audia <graysky@archlinux.us>
(cherry picked from commit 476f70e9a04c9ba7f98b21adde8f9fe20801a455)

python-paho-mqtt: Update to version 1.5.0

Try to fix license according to SPDX.
Add PKG_LICENSE_FILES.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit f8e36f9fd6d5040f3ce69a1dd3f844872ea306b9)
[use pypi.mk for Python package]

Merge pull request #14715 from pprindeville/isc-dhcp-stable-fix-coredump

isc-dhcp: seeing crashes when attempting to update dynamic dns

isc-dhcp: seeing crashes when attempting to update dynamic dns

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

ttyd: force enable authentication for login

Currently, we called `/usr/libexec/login.sh` as login command, but unfortunately the auth
is disabled by default in it[1], and this is really serious as it could be a free "backdoor"
for any spoiler who has conntectd to the router via LAN or wireless.

In my option, it shouldn't be exposed to anyone without auth, so I set the default login
command to `/bin/login`. And for those who really want that, they can do it themselves.

1. `login.sh` adjusts whether use authentication or not from system config named ttylogin,
which is set to disabled by default. See package/base-files/files/bin/config_generate#L243.

Signed-off-by: Tianling Shen <cnsztl@project-openwrt.eu.org>
Backported from f45bb2981d41e1005a2658661da2475518835db8

https-dns-proxy: support for force DNS/DNS hijacking

Signed-off-by: Stan Grishin <stangri@melmac.net>

mosquitto: bump to 1.6.13

Includes various fixes: (2.0.7 + 1.6.13 dual release)
https://mosquitto.org/blog/2021/02/version-2-0-7-released/

Signed-off-by: Karl Palsson <karlp@etactica.com>

Merge pull request #14681 from jonathanunderwood/openwrt-19.07-getdns-no-static-linking

[19.07] getdns: disable static linking of getdns utilities

getdns: disable static linking of getdns utilities

This fixes issue #13361.

Signed-off-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>

Merge pull request #14670 from jonathanunderwood/openwrt-19.07-cherry-pick

[19.07] getdns: cherry pick recent fixes from master

Merge pull request #14677 from mwarning/zt2

zerotier: update to 1.6.3

zerotier: update to 1.6.3

Signed-off-by: Moritz Warning <moritzwarning@web.de>

getdns: Fix TLS V1.3 Ciphersuites option in Stubby

Description :
Fix typo in CMAKE getdns included files, so Stubby can use TLS v1.3 with chipersuites options ON.

This solve issue that's written in here :
https://github.com/getdnsapi/stubby/issues/240
https://github.com/getdnsapi/stubby/issues/257

Signed-off-by: Harris K Kusuma <igharris.kk@gmail.com>

getdns: fix compilation without deprecated OpenSSL APIs

Signed-off-by: Rosen Penev <rosenp@gmail.com>

ksmbd: update to 3.3.4

Manually added from master.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

ksmbd-tools: update to 3.3.4

Manually updated.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #14632 from stangri/19.07-simple-adblock

[19.07] simple-adblock: remove dependency on jsonfilter & old code

simple-adblock: remove dependency on jsonfilter & old code

Signed-off-by: Stan Grishin <stangri@melmac.net>

sudo: backport patches for CVE-2021-3156

This security vulnerability is known as Baron Samedit [1] and there is a
research by Qualys [2] and they discovered it. Unfortunately or
fortunately, there isn't present sudoedit on OpenWrt.

Two patches were applied cleanly and the other two required manual
intervention. Those were backported from version 1.9.5p2

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156
[2] https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #14575 from Andy2244/samba4-fix-#13758

[19.07] samba4: fix for #13758

samba4: fix for #13758

* fix for possible exploit #13758
* sanetize all external template/config inputs
* fix some shellcheck warnings

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>

Merge pull request #14565 from rs/nextdns-1.10.1-openwrt-19.07

[19.07] nextdns: Update to version 1.10.1

Merge pull request #14558 from cartender/pr/19_fix_php7_conf_ac

php7: Fix prepare target incorrectly referencing 'configure.in' instead of 'configure.ac'

nextdns: Update to version 1.10.1

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

php7: Fix prepare target incorrectly referencing 'configure.in' instead of 'configure.ac'

Package release version unchanged as it does not impact the build result in any way.

Signed-off-by: Giovanni Giacobbi <giovanni@giacobbi.net>

msmtp: update to version 1.8.14

Release notes for 1.8.1.3:
https://marlam.de/msmtp/news/msmtp-1-8-13/

Release notes for 1.8.1.4:
https://marlam.de/msmtp/news/msmtp-1-8-13/

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ff76e24e5aa8e4e2dc38d0b9ac7f3f92059c7a39)

youtube-dl: update to version 2021.1.16

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 5d839fc06b48e43c3aa444469ac7d91b85519040)

youtube-dl: update to version 2020.12.7

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 87e15391cd50b4f72da686f76ed2a012694c2c3f)

Merge pull request #14501 from stangri/19.07-https-dns-proxy

[19.07] https-dns-proxy: bugfix: high CPU utilization

Merge pull request #14499 from nemesisdesign/openwrt-19.07

openwisp-config: update to version 0.5.0

https-dns-proxy: bugfix: high CPU utilization

Signed-off-by: Stan Grishin <stangri@melmac.net>

openwisp-config: update to version 0.5.0

Full changelog available at https://github.com/openwisp/openwisp-config/releases/tag/0.5.0

Signed-off-by: Federico Capoano <f.capoano@openwisp.io>
(cherry picked from commit 9f7b8088c374a5c8533c61baf56ae57343f6fb67)

# Conflicts:
# admin/openwisp-config/Makefile

Revert "libzip: update to 1.7.3"

This reverts commit d8f0ebaa3d2582628e34fa9d7d1d003cc94de24e.

Versions 1.7.2 and above mandate CMake 3.1.7, making this unsuitable
for backporting.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libzip: update to 1.7.3

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 1335121067561e3ddc9ca4e6e66244d04985c47b)

libzip: update to 1.7.1 (closes #12512)

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit fa566417cab7bd75702a82bc4532a204d6cfc0fb)

libzip: update to 1.6.1

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 5a6054d4777c5d403375deacea6ec15f58d1ceb9)

libzip: update to 1.6.0

Also remove upstreamed patch.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 3b622a612c53c6e9ebeed05ec188214f7912d839)

libzip: fix musl-fts failure

musl doesn't support fts. But with the extra package musl-fts installed,
libzip picks up the fts header and fails at the linking stage:

zipcmp.c:(.text.startup+0x130): undefined reference to `fts_open'
/home/sk/tmp/openwrt/staging_dir/toolchain-mips_24kc_gcc-8.3.0_musl/lib/gcc/mips-openwrt-linux-musl/8.3.0/../../../../mips-openwrt-linux-musl/bin/ld: zipcmp.c:(.text.startup+0x172): undefined reference to `fts_read'

So with musl-fts we need to link in libfts. To address that this commits
patches the cmake setup to check if fts is available in libc itself or
in any external libfts.

So when musl-fts is installed on the system the setup will be the
following:

musl: use libfts
uclibc: use fts from libc
glibc: like uclibc

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry picked from commit 0c381f7c7a6fbd6d62632fa67671a2dd2a5051a5)

libzip: add package

This introduces libzip which is e.g. a dependency for upcoming upgrade
of PHP to version 7.4.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit a4a98d5efedd413a2fd31bffb88f9f072b9805eb)

nano: update to 5.5

Update nano editor to version 5.5

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit be75f779737dc09328eb60896f477fde27a21e4f)

idevicerestore: update to 1.0.0

Switched to upstream tarballs as they are now available

Removed autoreconf as a result.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 18f3410ac4595b977139932e022d879ff64caa10)

idevicerestore: update to 2020-04-20

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b112de71e1efed6b66096a65b24ad0f9c1057bf9)

idevicerestore: update to 2020-02-17

Fix compilation under glibc.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 355d8b1388fa3cb238c1e2e4364470470805ea69)

idevicerestore: Update to 2019-12-26

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 905c7c62fbbb1309a459659ec55af00587e3cbe1)

idevicerestore: Add package

Allows to flash an iOS device without using iTunes.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9fbe1c247e6d705e24896de3050271ae0024a7b5)

libirecovery: update to official tarball

Removed autoreconf as a result.

Unfortunately, the two versions are not identical. Bumped PKG_RELEASE
to deal with it.

Disable static libraries as they're fairly useless.

Adjusted filepaths.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 4e203a1949ee43f114fa0373b165eb6cdada5e7f)

libirecovery: fix version

The hash was correct but not the source version. No idea how this happened

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7c7a922cb047176dc89efc713176862ee7cba82e)

libirecovery: Update to 1.0.0

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit bedf33b7e220b4f14a988440ced39b2a8ca578d2)

libirecovery: Add package

Needed for idevicerestore

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 0b51b4c46947b68e99f542541d916d382cd34a9c)

haproxy: Update HAProxy to v2.0.20

- Update haproxy download URL and hash

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #14457 from rs/nextdns-1.9.6-openwrt-19.07

[19.07] nextdns: Update to version 1.9.6

nextdns: Update to version 1.9.6

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

syslog-ng: update to version 3.30.1

Bump version also in config file

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e0f76cfa820c3287a3d38ade70a2a667159cc80d)

Merge pull request #14427 from stangri/19.07-https-dns-proxy

[19.07] https-dns-proxy: update to 2020-11-25: add HTTP auth and DSCP support

https-dns-proxy: update to 2020-11-25: add HTTP auth and DSCP codepoint support

Signed-off-by: Stan Grishin <stangri@melmac.net>

haveged: update to 1.9.14

Update haveged to version 1.9.14.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 6dac6bd886deed438a0daf66d4008468bc54b943)

usbmuxd: update to 1.1.1

Switched to upstream tarballs as they are now available.

Removed autoreconf as a result.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e480fa8b335d49a6de1124ba5fbd4760bead1169)

usbmuxd: enable systemd support

This is needed as the options loop is totally broken and doesn't accept
both -f and -z together.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7ae3bac51608ba97dd3a2027d948d57257adbb92)

usbmuxd: Update to 2020-01-20

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a83e56eba35783c5c3dd89e6b7d672b9be28b68b)

usbmuxd: Update to latest master

usbmuxd must be ran for many of the idevice tools. Added an init
script to make this easier.

Added myself as maintainer.

Fix PKG_CVE_ID.

Added config directory.

Placed in a submenu for easier readability.

Add extra tool

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit fb7ed3d996b6a6c398aed1eec09efbf9f33b0372)

usbmuxd: Update to latest git version

Fixes compilation with libimobiledevice.

Small cleanups for consistency.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9b21f6940489244dfb4872c408d4b17cd044de15)

imobiledevice: backport iOS 14 backup patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 35baa6e96fa959dd5f9cc980ebba8521ba5a21a4)

libimobiledevice: update to 1.3.0

Upstream created proper tarballs. Switch to those.

Removed autoreconf as a result.

Adjusted filepaths.

Removed upstreamed patch.

Disabled static libraries as they're not useful.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 483193925585ec6af8898c5a36e148571a2b42ba)

libimobiledevice: update to 2020-02-19

Added config directory patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 7a1435e5f419409f9ef7256880787c4bdfb0bf6a)

libimobiledevice: Update to 2020-01-20

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 18b8c657747ef87e8e90bf8b5faf836b0be8ec6c)

libimobiledevice: Update to latest master

Added patch to fix Wformat warning.

Fixed license information.

Removed outdated iconv dependency

Placed in a submenu for readability.

Added myself as maintainer.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 517005ca51eff9cecac85ea4b505cb9ddb959e8b)

libimobiledevice: Update to 2019-11-29

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit ff321480a575e1c29c9b78ceca1d2e8c60ed6071)

libusbmuxd: update to 2.0.2

Upstream created proper tarballs. Switched to those.

Removed autoreconf as a result.

Adjusted filenames.

Got rid of static compiles as they're pretty useless.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 38ea3e84f8c127f38ed4a2cdb1ee0f5d0b3848f9)

libusbmuxd: Several fixes

Add myself as maintainer.

Add PKG_CPE_ID.

Add submenu for easier readability.

Install extra tool.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 09799e54c68f130cfa0e3e9cf1b828212d09e9af)

libusbmuxd: Update to 2.0.1

The release of checkra1n necessitated a new release.

Removed inactive maintainer.

Fixed license info.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 062cf276a2763bc67996bae5502fa04c188b68c7)

libplist: add missing pkgconfig files in libplist 2.2

Closes #12571.

Same fix as Debian, see:
https://github.com/libimobiledevice/libplist/commit/137716df3f197a7184c1fba88fcb30480dafd6e0#commitcomment-40099153

Signed-off-by: Espen Jürgensen <espenjurgensen+openwrt@gmail.com>
(cherry picked from commit ca1bbd228f15208e53455465dfd3487e9b7a5d4d)

libplist: update to 2.2.0

Upstream finally got a proper tarball. Switched to that.

Remove autoreconf as it's no longer needed.

Adjusted new filepaths.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit d082258c3eb6305dd11429f4d41e42ac2d91234f)

libplist: Several fixes

Add myself as maintainer.

Add PKG_CPE_ID.

Switch to submenu for easier readability.

Change libplist-utils name to the utility.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 130b770a8b5703d324faa67f948249895c826331)

libplist: Update to 2.1.0

The release of checkra1n necessitated a new release.

Removed inactive maintainer.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a856d6604b32dd412c4a6cb17c5d5dc2113d32cc)

libplist: Switch to normal releases

Also added the capability to use uclibcxx instead of libstdcpp.

Several size optimizations.

Fixed up Makefile to be up to standards.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5049588c46e36de41b569e52b5621bf6173c14c4)