Merge pull request #15776 from 1715173329/xray-2102

[openwrt-21.02] xray-core: bump geodata to latest version

xray-core: bump geodata to latest version

Also removed `fullcone` option as this is outdated.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 53bbfe4de590ff1dbb88d9b84bd7c507cd442338)

Merge pull request #15764 from jamesmacwhite/iperf-3.10.1-21.02

[21.02] iperf3: Update to version 3.10.1

iperf3: Update to version 3.10.1

Signed-off-by: James White <james@jmwhite.co.uk>

Merge pull request #15760 from stangri/21.02-miniupnpd

miniupnpd: disable ext_ip_reserved_ignore by default; fix grammar

ocserv: updated to 1.1.3

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Merge pull request #15727 from stangri/21.02-https-dns-proxy

[21.02] https-dns-proxy: 2021-05-14 bugfix: fallback to HTTP/1 by default

miniupnpd: disable ext_ip_reserved_ignore by default; fix grammar

Signed-off-by: Stan Grishin <stangri@melmac.net>

https-dns-proxy: 2021-05-14 bugfix: fallback to HTTP/1 by default

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #15658 from mattreeve/openwrt-21.02

[21.02] rsync: Add rrsync script

msmtp: update to version 1.8.15

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 110abfb9f6a1718d1817a27cab96c28db4ee6012)

hwinfo: fix compilation with ARC

Added a small patch to fix compilation.

Renamed patch files to have a .patch suffix. Makes them easier to read
with vim and probably IDEs.

Remove UCLIBC depend since it's no longer present.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 6af7fbbf016332acb7c0f3475e77724d3ffb5eae)

luajit: for powerpc, add FPU dependency

powerpc support as of 2.1 does not work with soft float.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit d23ca0010c7c67bd6883a00cf92e90e0bbd08c77)

nginx-util: do not use fallthrough attribute

fixes issue #15653

Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
(cherry picked from commit 49a84e9b226c617929e3ad30aad27ab35712f096)

Merge pull request #15638 from ErwanMAS/2102_tinc_allow_more_param_in_uci

[21.02] tinc: allow more parameter in uci

Merge pull request #15716 from stangri/21.02-https-dns-proxy

[21.02] https-dns-proxy: update to 2021-05-14-1; bugfixes for dhcp server backup

https-dns-proxy: update to 2021-05-14-1; bugfixes for dhcp server backup

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #15700 from nxhack/2102_reduce_npm_size

[21.02] node: Reduce node-npm package size

bind: bump to 9.17.13

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit 2e02d899ae99cd4af2ae286554fb16c8affcce37)

node: Reduce node-npm package size

Reduce package size by about 1MB.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

python-cryptodomex: update to version 3.10.1

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit d6cb4edb4ac16eefe697976708ea79d748f44cb1)

gitlab-runner: update to version 13.12.0

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit cbb572534c633e0a75eecf6251b4788984b23721)

curl: update to version 7.77.0 (security fix)

Fixes:
CVE-2021-22897
CVE-2021-22898
CVE-2021-22901

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit ff58fc3a9c4513e88211d5927d8470867cac7b01)

yq: Update to 4.9.3

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 499aba939d229f96c8e14a06bec244a23ff840d4)

Merge pull request #15655 from mhei/21.02-php7-update

[21.02] php7: backports updates and fixes

rsync: Add rrsync script

Rrsync is a perl script that is supplied as an extra with the rsync program.
It must be used in conjunction with openssh-server or openssh-server-pam
as it requires ~/.ssh/authorized_keys which is not supported by dropbear.

Rrsync allows selective access to subdirectories in either read-only, write-only or read-write mode,
depending on settings in authorized_keys. This allows for safer, restrictive access.
It's particularly useful for automated backup purposes.

An example usage would be this entry:

command="/usr/bin/rrsync -ro /home" <public key here>

This would allow a system connecting with this public key to be able to rsync FROM the
/home directory tree only. It could not write to this directory, nor read from any other directory.

Signed-off-by: Matt Reeve <matt@mreeve.com>
(cherry picked from commit 081229aa09e28435d3d8802ce053a5d4eee8978a)

php7: update to 7.4.19

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 4e39d9fc7c2a20f04005cdeadddbe1b01b1e57ec)

php7: update to 7.4.18

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit aaaeef8b6374ee1dda58f68e4d0626c3167ddc65)

php7-pecl-imagick: configure --with-imagick=...

Add --with-imagick=$(STAGING_DIR)/usr so that configure picks
MagickWand-config from there, before it finds an eventual host-installed
version.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit f434a33a13454d09fcc287477193b4626c387deb)

vnstat2: update to version 2.7

Signed-off-by: Jan Hoffmann <jan@3e8.eu>

yq: Update to 4.9.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 2a7114a1aa0abc40f5bf0cfd63c05d3972a50d97)

tinc: Add possibility to populate more config variables via uci

Signed-off-by: Erwan MAS <erwan@mas.nom.fr>

python3: bump version to 3.9.5

Refreshed Python patches.
Updated pip & setuptools version.

For pip, patch '001-pep517-pyc-fix.patch' was reworked.

Also, the current version of the bundled pip (21.1.1) no longer supports
Python2, so the 'py2.py3' suffix gets replaced with just py3.

For setuptools, there is no longer a script/module:
  https://github.com/pypa/setuptools/pull/2544

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit e312275dd9c25c4032b4d2d3623b042905c8bf16)

python3: introduce libpython3 with ABI_VERSION flag

Related to discussion:
  https://github.com/openwrt/packages/pull/14060

Every once in a while a version bump will occur that requires an ABI
change. Example: Python 3.8 to 3.9. When this happens some Python packages
would need to be rebuilt. In setups where everything gets rebuilt, this
isn't a problem.

It's usually a bigger problem when needing to upgrade something via
opkg.
To accommodate for this, we add a libpython with it's own ABI_VERSION
flag. If this ABI_VERSION changes, then this should propagate forward.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 27aee1fbf09a6230836d191d1138c9ed805373eb)

python3: bump to version 3.9.4

For some reason Python3 jumped from 3.9.2 to 3.9.4 in about a week.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit 156e2e354e0a4eaa576daa70785aeddaabca7636)

Bluez: Update to 5.56

Signed-off-by: Johnny Vogels <35307256+jmv2009@users.noreply.github.com>
(cherry picked from commit 7299ba0517bc0b8fedcf9bcaac687614b04cafa1)

Bluez: Update to 5.55

Signed-off-by: Johnny Vogels <35307256+jmv2009@users.noreply.github.com>
(cherry picked from commit d653862bd7e91e0b47b0f57e937f7344955df99f)

znc: update to 1.8.2

Switch to CMake + Ninja to fix parallel compilation.

Switched PKG_BUILD_DIR to use PKG_INSTALL_DIR for easier readability.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b92f2c2bee23c54cfc673af3bec4e614c1f95312)

Merge pull request #15631 from nxhack/2102_node_14170

[21.02] node: bump to v14.17.0

knot-resolver: update to version 5.3.2

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 112af34ff3c8b97bf7eb1dbb7fb26b055898e47b)

syslog-ng: update to 3.32.1

Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit f93ef647932aa05a7a4eab69ffd9f49441076f81)

knot: update to version 3.0.6

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit d578f60818b9dd53cc3285cc4deff32fb09f7a89)

knot: update to version 3.0.5

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit d92a2cd21bbc41ceba9ac2b7a8ccc96a0bd2a249)

atlas-sw-probe: fix missing link on sysupgrade

Recreate symbolic link if it's missing after a sysupgrade with a private and public key present in /etc/atlas/

Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 603133074920d845c10bedf02cb79c23e9115244)

hplip: bump to 3.21.2

Patches refreshed:
* 010-libusb_fix.patch
* 020-remove_cups_dep_on_scan.patch
* 060-fix-uclibc.patch renamed to 060-fix-glibc.patch

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit 2014f1fd0b5a746ed6e6b959739977f59c2bbc13)

libtalloc: add Python3/host dependency
Otherwise, Package/Configure won't find distutils module from python3/host

Signed-off-by: Alexander Ryzhov <github@ryzhov-al.ru>
(cherry picked from commit d9879cb20009268857b2f9b81fb948ae2e2e4a88)

chrony: update to 4.1

Signed-off-by: Miroslav Lichvar <mlichvar0@gmail.com>

node: bump to v14.17.0

Notable Changes:
Diagnostics channel (experimental module)
UUID support in the crypto module
Experimental support for AbortController and AbortSignal

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Merge pull request #15606 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.8.0

yq: Update to 4.8.0

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 915311c3dc2f5fcadd8b3d806fb03568116eaf39)

python-engineio: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 9e011b2fc814b63aae2a71ad8ee1351edb325a92)

python-bidict: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit ae0556e6a53f85948448f04d1bc22884906f727e)

python-greenlet: support MIPS architecture

Fixes: https://github.com/openwrt/packages/issues/15370
This is inspired from:
   https://github.com/wlanslovenija/firmware-packages-opkg/blob/330bc94dccd16a3e92ac2fdde08c81a598e12f94/lang/python-greenlet/Makefile

The `PKG_USE_MIPS16:=0` is not taken into consideration when building
Python modules. That's because the sysconfig is used.

This is only an issue with greenlet (on MIPS) so far.

One option is to do `PKG_USE_MIPS16:=0` in the core Python package.
But, since we know that the `wlanslovenija` group has successfully used
greenlet on MIPS with this construct, we might as well adopt it until GCC10
becomes the main compiler.

As noted here:
  https://github.com/openwrt/packages/issues/15370#issuecomment-817015484
GCC10 doesn't have this problem.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
(cherry picked from commit bde027188ae122c1410569b1085a1a2520850e43)

python-greenlet: add new package

Notes:
Build is disabled for arc and mips because
greenlet isn't ported for these platforms

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 837f1b59248e3ee885fc142154c65eff3b4516c7)

python-socketio: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit decbd7b43a952dcce765ab6e5bbf8da4259453db)

python-eventlet: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit d303bd6aac986cf55b85b61fe4e4386a119e5332)

python-pysocks: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 780fc502d284976b3e9043586c29e41f79718384)

python-flask-socketio: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 8133922a029adbc0cec32cc64c4cbbb16cf82da5)

python-flask-httpauth: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 6c9627b45d9fcf3acac438466943015e1f0f837f)

gitlab-runner: update to version 13.11.0

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 2acbb04c77f6ca9b3bacbaa1b8cae3addd4395f3)

onionshare-cli: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit ae069fad3d0676e0bae534d2c0a6c76823840db1)

tailscale: add new package

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 229b34286db1a42731af45a53d2129943c64e4e9)

python-gnupg: update to version 0.4.7

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 7b32ab78c0bbef8a538bc61547df3a2de4234ebf)

libedit: update to version 20210419-3.1

Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit b0870d792b3fd013137d2071c150248e85262d66)

atlas-sw-probe: improve key creation

- Exit start if a probe_key is not present
- Add create_key command to generate a private_key based on the provided username in the atlas config.
- Add registration instruction in /etc/atlas
- Rework script to save probe_key on sysupgrade (the key are now adviced to be placed in the /etc/atlas dir and a link is used to make them accessible in the atlas-sw-scripts etc dir)

Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 0afe371babf851d1ce239c75525e99bcef3626d0)

debian-archive-keyring: update to 2021.1.1

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 640a6ba9bd9accf2e0d07e15b4694bc66cb30790)

Jinja2: update to version 2.11.3

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit e70965b1aaaec266d6a9fdeb9c815567da3a508f)

icu: add ABI_VERSION

To prevent inconsistencies in the coming version (69.1).

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 1eb29ddc956a857c887190315afa164161ba483a)

samba4: update to 4.13.8

* update to 4.13.8
* remove faulty io_uring kernel detection
* fixes CVE's: CVE-2020-27840, CVE-2021-20277, CVE-2020-27840, CVE-2021-20277, CVE-2020-27840, CVE-2021-20277, CVE-2021-20254
* resolves #15512

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry picked from commit 93b34d4ddad2768c27d03a78e723b5910964aaa0)

unbound: add cache-max-negative-ttl config option

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 9296409e886ebd937fd702057737add0d97e0dfa)

bind: bump to 9.17.12

Fixes the following security issues:

* CVE-2021-25215 - named crashed when a DNAME record placed in the ANSWER
                   section during DNAME chasing turned out to be the final
                   answer to a client query.
* CVE-2021-25214 - Insufficient IXFR checks could result in named serving a
                   zone without an SOA record at the apex, leading to a
                   RUNTIME_CHECK assertion failure when the zone was
                   subsequently refreshed. This has been fixed by adding an
                   owner name check for all SOA records which are included
                   in a zone transfer.

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit ccb1e8923e6e0269e2443c37362b2b27c121d956)

mwan3: allow interfaces with no tracking IPs

In the procd refactor, support for interfaces with no tracking IPs was
inadvertentiy removed. This commit restores the previous behavior

Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
(cherry picked from commit b7ea19bc96e444b6726218abc6db7cd558bbf343)

mwan3: update ubus status for not tracked interfaces

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit f1da872cd47b1602dc3014d6b4ee40cd5f9fe855)

mwna3: fix whitespace

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit cbc5f0916c3fc6c29ef76a3e0c6c6adf0c2ccb8e)

hwdata: update to version 0.347

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 22ae08919efc653cfb508be6e2dac90256557bed)

banip: update to 0.7.8

* fix pid file processing of the background monitor plus child
  processes (bug reported in the forum)
* made the enabled/disabled switch of the background monitor functional

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1402b3b56d3ccfcd36aa5331181d43dad59c31ff)

nano: update version to 5.7

Upgrade nano editor to version 5.7.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 765e9868579e1da270b3c831ecf34949013cdf01)

icu: add ABI_VERSION

To prevent inconsistencies in the coming version (69.1).

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

haproxy: Update HAProxy to v2.2.14

- Update haproxy download URL and hash

Signed-off-by: Christian Lachner <gladiac@gmail.com>

nextdns: Update to version 1.32.1

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

adblock: update to 4.1.2

* preserve DNS cache after adblock processing (unbound & bind)
* fix redirect issue with oisd basic url
* cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit df8651255fc69a7adae4fa8e65a2d43cf97109d2)

Merge pull request #15526 from 1715173329/xray-2102

[openwrt-21.02] xray-core: remove PROVIDES

zerotier: update to 1.6.5

Minor ZeroTier update. Refreshed patches.

Signed-off-by: Moritz Warning <moritzwarning@web.de>

libupm: Disable node.js support

Library for node.js will be disabled temporarily due to difficulty in supporting the latest node.js.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Merge pull request #15508 from hswong3i/openwrt-21.02-SQUID_enable-ssl-crtd

[openwrt-21.02][cherry-pick] squid: Enable dynamic SSL certificate generation

squid: Enable dynamic SSL certificate generation

Maintainer: @neheb / @BKPepe / @zhanhb
Compile tested: ipq806x, generic, netgear_r7800, master
Run tested: ipq806x, generic, netgear_r7800, openwrt-19.07

Description:

Squid now only support HTTPS proxy in TCP tunnel mode (e.g. `ssl_bump splice all`):

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    ssl_bump splice all

In order to operate in SSL Bump mode, we need to compile with `--enable-ssl-crtd` for following configuration:

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    sslcrtd_program /usr/lib/squid/security_file_certgen -s /car/cache/squid/ssl_db -M 4MB
    ssl_bump stare all
    ssl_bump bump all

This PR switch the `SQUID_enable-ssl-crtd` into `default y`, therefore default enable SSL Bump mode.

Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
(cherry picked from commit dbda77686d5dccb3d3999ed2e7dec18aab11fff8)

libmraa: Disable node.js support

Library for node.js will be disabled temporarily due to difficulty in supporting the latest node.js.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

Merge pull request #15518 from 1715173329/yq-2102

[openwrt-21.02] yq: Update to 4.7.1

xray-core: use `$(INSTALL_DATA)` to install configuration files

Using `$(INSTALL_CONF)` will cause the program has no access to
configurations file when someone enabled the selinux support.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from bbc6c62c2a029fd716b2bcad68ed3f99478da246)

xray-core: remove PROVIDES

Xray now is no longer planning to keep compatibility with original
v2ray. Remove PROVIDES before it is totally broken.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from 92efcc295648e9c16f3fb2d183019be9e275c3ea)

yq: Update to 4.7.1

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(backported from 633d1dcf583646abd582e85e596463ac21e59235)

net/mosquitto: port is optional in root config

From mosquitto 2.x, port became optional and deprecated in the config,
and it was recommended that listeners be used instead.  Drop the hard
requirement in our config conversion script.

Reported in: https://github.com/openwrt/packages/issues/15506
Signed-off-by: <karlp@etactica.com>

net/mosquitto: fix log_type conversion in config

As reported in: https://github.com/openwrt/packages/issues/15506

Signed-off-by: Karl Palsson <karlp@etactica.com>

ksmbd: update to 3.3.9

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 9c6fc23e01a2227770659d0060dbabb491fdff67)

ksmbd-tools: update to 3.3.9

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 2e7c403fff0d3c07bdd6e5d8f925ce154a473491)

lighttpd: patches from upstream

- ignore Content-Length from backend if 101 Switching Protocols
- close HTTP/2 connection after bad password
- skip cert chain build for self-issued certs
- meson zstd fix
- ls-hpack upstream update
- discard some HTTP/2 DATA frames received after response

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
(cherry picked from commit 52f85a0e1fd885d5bf9cbb6de74a146aa0d6c843)

banip: fix housekeeping

* fix whitelist housekeeping if you switch between normal- and
  'whitelist only' mode

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 7cfb0f4657dea6a7844df28268e7e8af6eb00db4)

Merge pull request #15502 from TDT-AG/pr/20210422-stunnel

stunnel: update version to 5.59

Merge pull request #15501 from mkrkn/openwrt-21.02

[21.02] openvpn: update to 2.5.2

openvpn: update to 2.5.2

Fixes two related security vulnerabilities (CVE-2020-15078) which
under very specific circumstances allow tricking a server using delayed
authentication (plugin or management) into returning a PUSH_REPLY before
the AUTH_FAILED message, which can possibly be used to gather
information about a VPN setup. In combination with "--auth-gen-token" or
a user-specific token auth solution it can be possible to get access to
a VPN with an otherwise-invalid account.

OpenVPN 2.5.2 also includes other bug fixes and improvements.

Add CI build test script.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
(cherry-picked from 6186fe732b058ef7f1ae43cce2184ba0c4d90184)