Merge pull request #13057 from odmdas/odmdas-freeradius3-Makefile-18.06

[18.06] freeradius3: add missing conffiles to Makefile

freeradius3: add missing conffiles to Makefile

Config files
/etc/freeradius3/policy.d/accounting
/etc/freeradius3/policy.d/filter
/etc/freeradius3/proxy.conf
/etc/freeradius3/sites-available/default
and link
/etc/freeradius3/sites-enabled/default
are in the freeradius3 package and are mentioned in the main config file
/etc/freeradius3/radiusd.conf
Thus, they must be explicitly specified in the Makefile.

File
/etc/freeradius3/sites/default
is not included in the package, is not created during installation,
is not mentioned in the main config file and should therefore be excluded
from the Makefile.

(backported from commit f6974b8)
Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com>

Merge pull request #13023 from stangri/18.06-simple-adblock

[18.06] simple-adblock: README and config update

simple-adblock: README and config update

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12999 from jjm2473/libtasn1-support-host-compile

libtasn1: add host build

libtasn1: add host-build

* samba4 complains that it cant find the libasn1 host bins

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry picked from commit 42e9057d41f9d59916daa9d716734f25a666b55a)

Merge pull request #12989 from jjm2473/netatalk-fix-CE-dtrace

netatalk: fix compile error in mac os

netatalk: fix compile error in mac os

fix compile error in mac os when dtrace installed.

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>

Merge pull request #12991 from jjm2473/libgpg-error-fix-gawk50-3

libgpg-error: Fix compilation with GAWK 5.0

libgpg-error: Fix compilation with GAWK 5.0

Patch from Upstream.

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>

Merge pull request #12882 from jefferyto/python3-backport-patches-openwrt-18.06

[openwrt-18.06] python3: Backport security fixes

python3: Backport security fixes

This backports fixes for security issues, including:
* CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface
* CVE-2019-20907: Infinite loop in the tarfile module

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

haveged: update to 1.9.13

Update haveged to version 1.9.13.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 28cf20129081f9c6b8778b243cc3df1f610544c4)

Merge pull request #12661 from jefferyto/python-3.6.11-openwrt-18.06

[openwrt-18.06] python3: Update to 3.6.11

python3: Update to 3.6.11

This contains a fix for CVE-2020-8492 (Denial of service in
urllib.request.AbstractBasicAuthHandler)[1].

[1]: https://docs.python.org/release/3.6.11/whatsnew/changelog.html#python-3-6-11-release-candidate-1

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #12615 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: re-add conffiles and add description to Makefile

https-dns-proxy: re-add conffiles and add description to Makefile

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12598 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: bugfix: remove eDNS support

https-dns-proxy: bugfix: remove eDNS support

Signed-off-by: Stan Grishin <stangri@melmac.net>

haveged: update to 1.9.12

Update haveged to version 1.9.12

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 6392d50c3180b5da7a4ba041decf7a229d0e1c53)

haveged: update to 1.9.11

Update haveged to version 1.9.11

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit ca30b0ff91846a407469f6a77d1cbaf6b150d06d)

haveged: move init script from 13 to 01

This is intended as a match with standard urngd. They serve same purpose
and urngd starts as first with 00. Starting haveged later can create
issues if you replace urngd with it. The example problem is if
uci-defaults script decides to generate certificate. Haveged can supply
entropy but it is started later and to mitigate this urngd would still
have to be installed. This means that haveget can't serve as replacement
without moving it to match start order of urngd.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit 1ef38f45d982beb46b2df6d3582ad0bc2b0007ca)

Merge pull request #12508 from stangri/18.06-simple-adblock

[18.06] simple-adblock: racially-neutral names

simple-adblock: racially-neutral names

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12455 from stangri/18.06-simple-adblock

[18.06] simple-adblock: remove obsolete dshield.org links from config

simple-adblock: remove obsolete dshield.org links from config

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12335 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix: proper error reporting on failed downloads; lists update script

simple-adblock: bugfix: proper error reporting on failed downloads; lists update script

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9.3

Update nano version to 4.9.3
Minor bugfix release.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 38be46a7ae496cf9f01dd2fd6fee74bc9f1b2673)

bind: update to version 9.11.19

Fixes:
CVE-2020-8616
CVE-2020-8617

Remove backported patch

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #12235 from jefferyto/python-openssl-ca-certs-openwrt-18.06

[openwrt-18.06] python-openssl,python3-openssl: Add dependency on ca-bundle

python-openssl,python3-openssl: Add dependency on ca-bundle

The ssl module assumes OpenSSL can load the default trust anchors (root
CA certificates).

From https://github.com/openwrt/packages/issues/12209

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Python: Fix compile of host modules

Add -rpath linker option to host build, pointing to staging/hostpkh/lib.
It's needed to find the correct host libs during runtime, without it the
hosts libs may be used instaead, causing failures.

Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
(cherry picked from commit 0311e58bb645b8f5a2b96528d78edc90c811ed94)

Python3: Fix host build on OpenSUSE

The linker option -rpath is required to find libs in staging_dir. Now it
is included when building host modules. Without it the import test of
the _ctypes and _uuid modules would fail. The _ctypes module uses
libffi.so.6 from staging, but OpenSUSE LEAP 15 has libffi.so.7.
It will also fail on LEAP 42.x, Fedora28 and 29 and future or old
versions of Ubuntu.

Fix needed in master and 18.06 branches.

Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
(cherry picked from commit 6ade5a1e3adb189d062b707e2b8f731c9faab844)

unbound: update to version 1.10.1

Fixes:
CVE-2020-12662
CVE-2020-12663

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #12207 from micmac1/mar-1806-10413

[18.06] mariadb: minor version bump with CVE fixes

mariadb: bump to 10.1.45

Fixes:

  CVE-2020-2752
  CVE-2020-2812
  CVE-2020-2814

This commit also moves mysql_upgrade to the client package and installs
the configuration files readable for all, so that the clients can read
them.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

php7: update to version 7.2.31

This fixes:
  - CVE-2019-11048

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2e6bd4cb86682b224803325127d3f777d40b3231)

Merge pull request #12142 from EricLuehrsen/unbound_1806_1100

[openwrt-18.06] unbound: update to 1.10.0

unbound: update to 1.10.0

cherry-pick: f779ef48cd21474acf72ee151588737273a509c2
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>

Merge pull request #12058 from stangri/18.06-vpnbypass

[18.06] vpnbypass: bugfix: remove non-ASCII from system log; update README

vpnbypass: bugfix: remove non-ASCII from system log; update README

Signed-off-by: Stan Grishin <stangri@melmac.net>

youtube-dl: update to version 2020.3.24

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11995 from jefferyto/python-2.7.18-openwrt-18.06

[openwrt-18.06] python: Update to 2.7.18, refresh patches

python: Update to 2.7.18, refresh patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

mwan3: Fix json_load fails with some data

Sometimes the return value of `ubus -S call network.interface.wan status`
cause `json_load` to return `Failed to parse message data` error.

To avoid this, the JSON data always should be quoted with double quotes.

Signed-off-by: Evren Yurtesen <eyurtese@abo.fi>
Removed quoatation marks from commit heading
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 94e0c78826b15c95c40bfa82bbf8bba35dc56961)

libarchive: update to 3.4.2

Switch to normal tarballs. Remove autoreconf as a result.

Several Makefile cleanups for consistency.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c22dd1bf74fa5836a88fa417b467767bcfe8a4ff)
(cherry picked from commit 2085b990ffc875a5157c02a9e2b5bd04c8eb35b3)

libarchive: update to version 3.4.1 (security fix)

Fixes CVE-2019-19221

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from df634dcc926650de22248b89620c649c0fef7602)
(cherry picked from commit ba43556aed90705bc04fd074d39ee6ea012a71f2)

php7: update to version 7.2.30

Fixes:
CVE-2020-7066
CVE-2020-7064

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 09738290a319cc2af74a0be9a52aa5a76b6ca98e)

php7: fix dependencies for mysqlnd (fixes #11113)

When during the build the openssl extension is also selected, then
the mysqlnd extension depends on it, too.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 50b1cd3757497a569538d751f4681a40df1b1202)

Merge pull request #11926 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix: start downloads on cold boot/fresh install

simple-adblock: bugfix: start downloads on cold boot

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #11907 from BKPepe/18.06-git

[18.06] git: update to version 2.20.4

git: update to version 2.20.4

Fixes CVE-2020-11008

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11857 from BKPepe/18.06-git

[18.06] git: update to version 2.20.3

Merge pull request #11883 from yousong/wget1806

[18.06] acme: depends on wget-ssl

acme: depends on wget-ssl

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit d917d662aedd9c133217b5c6d8c5a4f4a6bd3dea)

wget: make the ssl variant provides wget-ssl

This is to address the need for specifying dependency on a wget
implementation with ssl support.

Now we have a game of names for opkg

 1. uclient-fetch: minimal version by openwrt project
 2. wget-nossl: gnu wget w/o ssl support
 3. wget-ssl: for the moment since this commit, gnu wget w/ ssl support
 4. wget: uclient-fetch, wget-nossl, or wget-ssl
 5. gnu-wget: wget-nossl or wget-ssl

By the time we provide some dummy package like uclient-fetch-ssl and
make it also provide wget-ssl, I guess by then we will also need
gnu-wget-ssl...

Ref: https://github.com/openwrt/packages/issues/11534
Ref: https://github.com/openwrt/packages/pull/9941
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 585e4a38feca24c9650d4e762b44146ecd75d4d0 &
resolved conflict)

wget: do not provide itself

The package wget should not say that it provides itself.

This also make gnu-wget provide general so it is not written in Makefile
twice.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 75f2be7d509e802f2d946d732e7a7539c2b27d2e &
resolved conflict)

ruby: update to 2.5.8

This release includes security fixes, specially:

* CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix)
* CVE-2020-10933: Heap exposure vulnerability in the socket library

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

git: update to version 2.20.3

Fixes CVE-2020-5260

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nlbwmon: update to latest Git HEAD

34a1887 nfnetlink: disable sequence number checking

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 53c48fae1502e7f87fd93ff299db98cd119fa304)

Merge pull request #11821 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: bugfix: memory leak

https-dns-proxy: bugfix: memory leak

Signed-off-by: Stan Grishin <stangri@melmac.net>

nlbwmon: update to latest Git HEAD

e757e06 nfnetlink: allow specifying the socket buffer size
33c77cb nfnetlink: properly handle nl_recvmsgs() failures
95cced5 protocol: Include whitespace when reading names

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d81d777a0f009fe74d233de307a03f9951d6b960)

nlbwmon: bump to latest git

e921ca0a Add further commonly used protocols to the protocol file.

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry picked from commit 5e140462e42af3e5cb7680863794339f11ddda7d)

nlbwmon: add procd reload trigger for nlbwmon config

Signed-off-by: Richard Yu <yurichard3839@gmail.com>
(cherry picked from commit d5517583104c8521d978a911bff921588ba0e988)

nlbwmon: receive dhcp interface triggers

Not all interfaces may have been allocated address at nlbwmon startup so
it may not collect statistics as expected/configured.

Add interface triggers to catch dhcp events and restart as required.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit 662d3f16d2702fe55116c852f5d456e90891ee89)

net/nlbwmon: run with lower priority

Even on a powerful platform a nlbwmon process'
activities are sometimes affecting throoughput and
latency. This is a backgroud process, that should not
be running with default priority.
Even if it is a little deplayed, that is not a worry in
this case. The routing should be the main priority,
bandwidth stats collection can wait a bit.

Tested on Netgear R7800
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
(cherry picked from commit 9b3ecbd64a6328e13981165660d8930e8bb2446a)

Merge pull request #11803 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfixes: remove escape chars from log, restore from cache on boot

simple-adblock: bugfixes: remove escape chars from log, restore from cache on boot

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9.2

Update nano editor to version 4.9.2

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit f11833d46cf71be65439397e2a7e03643fc78af2)

Merge pull request #11773 from BKPepe/msmtp

[18.06] msmtp: update to version 1.8.7

msmtp: update to version 1.8.7

- It brings oauthbearer support
- It switches from OpenSSL to GnuTLS, which is fully compatible and
  brings more parameters

Makefile changes:
- Fix SPDX License Identifier
- Add PKG_CPE_ID
- The Project does not use sourceforce anymore.
- Uses GnuTLS instead of OpenSSL, which was discouraged

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nano: update to 4.9.1

Update nano editor to version 4.9.1

 2020.03.31 - GNU nano 4.9.1 "Sapperdeflap"
 Two bugs introduced in version 4.9 are fixed: the cursor
 getting misplaced when undoing line cuts, and filtering
 of the whole buffer to a new buffer not working.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit f5c47a2606cea00ef70ae696224cd201ca1aceb8)

Merge pull request #11756 from gladiac1337/haproxy-1.8.25-openwrt-18.06

[openwrt-18.06] haproxy: Update HAProxy to v1.8.25

haproxy: Update HAProxy to v1.8.25

- Update haproxy download URL and hash
- This fixes CVE-2020-11100 (http://git.haproxy.org/?p=haproxy-1.8.git;a=commit;h=525fbbe388ba033d638ff2a4efb83ae6526db5ab)

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #11700 from stangri/18.06-simple-adblock

[18.06] simple-adblock: support multiple dnsmasq instances + internal refactoring

simple-adblock: support multiple dnsmasq instances; rework communication between principal package and luci app

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9

Update nano editor to version 4.9

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 09fd4445b3f7c426212ed61b3989e1994255a8aa)

Merge pull request #11626 from nxhack/18_06_icu_fix_CVE-2020-10531

[openwrt-18.06] icu: fix CVE-2020-10531

Merge pull request #11616 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: support for dnsmasq noresolv option

icu: fix CVE-2020-10531

FIX CVE-2020-10531
 An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

https-dns-proxy: support for dnsmasq noresolv option

Signed-off-by: Stan Grishin <stangri@melmac.net>

openvswitch: fix PIE build against 4.14 kernel

Reported-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Ref: https://github.com/openwrt/packages/pull/11567
(cherry picked from commit e9d6414437d27803a16b5d96c48b45140e989e5e)

php7: update to 7.2.28

This fixes:
  - CVE-2020-7062
  - CVE-2020-7063

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 95c72d8abaa8a99471275ae0723e4d941f36d81a)

php7: update to 7.2.27

This fixes:
  - CVE-2020-7059
  - CVE-2020-7060

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 3cf0c61f2ee1b94c8b09adb8c1cbc79281cfc32d)

xl2tpd: fix building failure caused by pfc

Fixes openwrt/packages#10270

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 0412c20f1b2d2e1f8b8c7e101aae6f66be50690a)

xl2tpd: bump to version 1.3.15

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Ref: https://github.com/openwrt/packages/issues/11418
(cherry picked from commit 620ba386b4ffd38911e7ddf0c864979c0f834a11)

icu: bump proper variable.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

icu: backport upstream ARC patch

Signed-off-by: Rosen Penev <rosenp@gmail.com>

nano: update to 4.8

Update nano editor to version 4.8

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 7bc96280d31470b7dda75315154c8df72bde222a)

Merge pull request #11252 from neheb/i22p

i2pd: fix various issues in 18.06

i2pd: move chmod command

Similar change to upstream.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

i2pd: Move DATADIR to /var/lib/i2pd, fix #5693

Original author: dartraiden <wowemuh@gmail.com>

Signed-off-by: David Yang <mmyangfl@gmail.com>

Merge pull request #11227 from micmac1/sqlite3-18.06-2

[18.06] sqlite3: bump to 3.31.1

sqlite3: bump to 3.31.1

Upstreamed patch removed.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Merge pull request #11186 from micmac1/18.06-maria-10.1.44

[18.06] mariadb: security bump to 10.1.44

mariadb: security bump to 10.1.44

Addresses CVE-2020-2574. Patches refreshed.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

ddns-scripts: Change protocols of afraid.org urls to HTTPS.

- Use HTTPS protocol for updating urls for afraid.org to protect the password.
- Bump/align package version number.

Signed-off-by: Kwonjin Jeong <gram25gwh@gmail.com>
(cherry-picked from e25b55899927eb5638cc6a13a568ee4271eed2b2)