haproxy: Update HAProxy to v1.8.21

- Update haproxy download URL and hash
- Add new patches (see https://www.haproxy.org/bugs/bugs-1.8.21.html)

Signed-off-by: Christian Lachner <gladiac@gmail.com>

python3: backport three security patches

Fixes: CVE-2019-16935
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 80def9e)

Merge pull request #9893 from BKPepe/bind-18.06

[OpenWrt 18.06] bind: update to version 9.11.10

Merge pull request #9798 from ja-pa/zmq-security-fix-18.06

[OpenWrt 18.06] zeromq: update to version 4.1.7 (security fix)

net/mosquitto: bump to 1.5.9 for CVE

Fixes CVE-2019-11779
Release notes at https://mosquitto.org/blog/2019/09/version-1-6-6-released/

Signed-off-by: Karl Palsson <karlp@etactica.com>

python-crypto: Fix two CVEs

CVE-2013-7459 and CVE-2018-6594. Both patches taken from Fedora.

Also took the liberty to update the PKG_SOURCE_URL to a standard one.

Updated the home URL as well.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 32b23e28ad892395a5575c09606cd07db175f7cc)

Merge pull request #10063 from stangri/18.06-simple-adblock

[18.06] simple-adblock: dnsmasq.ipset option support, better handling of IDNs, updated README

simple-adblock: dnsmasq.ipset option support, better handling of IDNs, updated README

Signed-off-by: Stan Grishin <stangri@melmac.net>

zmq: fix CVE-2019-13132

- Use HTTPS in their website
- Remove unnecessary space between PKG_SOURCE_URL

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Merge pull request #10041 from neheb/djj

[18.06]django: Update to 1.8.19

django: Update to 1.8.19

Fixes:

CVE-2018-7536
CVE-2018-7537

Switches to pypi, as in upstream. Updated maintainer as well.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

lighttpd: mark module configuration files

Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from 9cf412c0cba38f1251e9d8c1fd9afbb86caee88a)

dovecot: Update to version 2.2.36.4

- Fix CVE-2019-11500
- Download tarball from HTTPS instead of HTTP

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

wget: fix CVE-2018-20483

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

fastd: fix init script for multiple VPN instances

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit b7ff8b8087c6e948aba45b74c261cd7337433523)

haveged: update to 1.9.6

Update haveged to 1.9.6

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit c933ac5dcb85361baeb9ff9ec424533b67bb2578)

Merge pull request #9894 from BKPepe/keepalived-18.06

[OpenWrt 18.06] keepalived: Update to version 1.4.5

Merge pull request #9904 from RussellSenior/my-18.06

patch: cherry pick CVE fixes to 18.06 branch

patch: rename CVE-2019-13638 patch to mollify uscan

Signed-off-by: Russell Senior <russell@personaltelco.net>

patch: apply upstream patch for CVE-2019-13638

GNU patch through 2.7.6 is vulnerable to OS shell command injection that
can be exploited by opening a crafted patch file that contains an ed style
diff payload with shell metacharacters. The ed editor does not need to be
present on the vulnerable system. This is different from CVE-2018-1000156.

https://nvd.nist.gov/vuln/detail/CVE-2019-13638

Signed-off-by: Russell Senior <russell@personaltelco.net>

tools/patch: apply upstream patch for CVE-2019-13636

In GNU patch through 2.7.6, the following of symlinks is mishandled in
certain cases other than input files. This affects inp.c and util.c.

https://nvd.nist.gov/vuln/detail/CVE-2019-13636

Signed-off-by: Russell Senior <russell@personaltelco.net>

exfat-nofuse: drop BUILD_PATENTED

Microsoft has published technical specification for exFAT [1]
and the driver has been added to Linux staging tree [2].

It's now safe to drop BUILD_PATENTED label.

[1] https://docs.microsoft.com/windows/win32/fileio/exfat-specification
[2] http://lkml.iu.edu/hypermail/linux/kernel/1908.3/04254.html

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry-picked from commit 4c9d0c7b56365761fd1986ff954edf963feb2931)

keepalived: add patch for CVE-2018-19115

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

keepalived: Update to version 1.4.5

- Use HTTPS for PKG_SOURCE_URL and as well for URL in description

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

bind: Update to version 9.11.10

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

lighttpd: fix CVE-2018-19052

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #9841 from cshoredaniel/pr-18.06-nut-targetted

[18.06] Targeted fixes based on 19.07/master

Merge pull request #9703 from BKPepe/squid-18.06

[OpenWrt 18.06] squid: update to version 3.5.28

Merge pull request #9814 from guidosarducci/speedtest-18.06

[18.06] speedtest-netperf: backport stable package from 19.07 and master

Merge pull request #9777 from BKPepe/tar_1806

[OpenWrt 18.06] tar: update to version 1.3.2

Merge pull request #9821 from cotequeiroz/vim_host

[18.06] vim: Add host build to install xxd

nut: Bump PKG_RELEASE

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Handle FSD properly

Make sure we force shutdown of UPS only when we should, and when
we should that shutdown happens.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix init actions (server/driver)

The server and driver were not starting/restarting reliably. In
addition on interface changes NUT got very confused.  So we fix
handling of restarts and add a reload trigger for interface
changes.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix extra diver params config

Extra parameters for the UPS driver were not being handled correctly.
Fix that (was wrong variable name).

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix permissions with runas

Fix directory and conf file creation and owner/mode setting
for when running as non-root.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix statepath handling

The statepath was getting the wrong permission and/or not created
at the right time.  This commit includes fixes for handling the
statepath (typically /var/run/nut).

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix unset of runas user (ups server)

Running as non-root was failing due to misplace local keyword
causing runas to be unset from calling value.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix bad check for conf exists

We were `cat`ing the file instead of just checking for non-empty
existance.  Fix that.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix upsmon init actions

1) For upsmon start and stop were at wrong position in rc.d
2) Stop needs more than just killing the procd instead but rather
needs a  stop command to be issued.
3) Interface up/down was causing not to enter a crashloop (we fix this
with procd trigger on interface changes).

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Fix unset of runas user (upsmon)

Running as non-root was failing due to misplace local keyword
causing runas to be unset from calling value.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nut: Remove unecessary libwrap dependency

CONFIG_ARGS has --without-wrap so libwrap as a dependency is
extraneous as it is not actually used.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>

nano: update to 4.4

Update nano editor to 4.4

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit d9347059a80fc8977a1e148153693a2851b4e253)

ttyd: Add dependency for vim

Needed to avoid error in case xxd is not installed:

[ 16%] Generating html.h from index.html
/bin/sh: 1: CMAKE_XXD-NOTFOUND: not found
CMakeFiles/ttyd.dir/build.make:61: recipe for target 'html.h' failed
make[6]: *** [html.h] Error 127

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 773c19afad0723bc2ba49b36e8172776e2eaf207)

vim: Add host build to install xxd

Packages such as ttyd and device-observatory need this.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 8e93386b804f8029a1180755ce240fbc0f06b009)

speedtest-netperf: new package to measure network performance

The speedtest-netperf.sh script measures the network throughput while
monitoring latency under load and capturing key CPU usage and frequency
statistics. The script can emulate a web-based speed test by downloading
and then uploading from an internet server, or perform simultaneous
download and upload to mimic the stress of the FLENT test program.

It simplifies tasks such as validating ISP provisioned speeds or setting
up and fine-tuning SQM, directly on the router. The CPU usage details
can also help determine if the demands of SQM, routing and other tasks
such as the test itself are exhausting the device's CPUs.

This script leverages earlier scripts from the CeroWrt project used for
bufferbloat mitigation, betterspeedtest.sh and netperfrunner.sh. They are
used with the permission of the author, Rich Brown.

Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
(cherry-picked from 463590e2bcf94e09890f7ba98e910ff58090e29b)

Merge pull request #9789 from ja-pa/libarchive-security-fix-18.06

[OpenWrt 18.06] libarchive: update to version 3.4.0 (security fix)

apinger: Update to latest git revision

This project seems abandoned. Updated to latest version.

Also cleaned up the Makefile quite a bit.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from dff6d2639eabb93e2d3782bfc1262bb6f7dccc33)

node-serialport: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1ce1ca6e0622c6ad7fb61e44b7c96b028939186a)

node-hid: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1aa55f86b56766074677bcda23f19cd7e5b5601f)

libarchive: update to version 3.4.0 (security fix)

Fixes:
CVE-2019-1000019
CVE-2019-1000020
CVE-2018-1000880
CVE-2018-1000879
CVE-2018-1000878
CVE-2018-1000877

Changes:
add bsdtar libopenssl variant
switch to github codeload
polish tab/spaces

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Merge branch 'pr/9778' into openwrt-18.06

PR #9778

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

fastd: update URL and PKG_SOURCE_URL

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

libuecc: update URL and PKG_SOURCE_URL

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

Merge pull request #9754 from champtar/openwrt-18.06

[18.06] prometheus-node-exporter-lua: update to 2019.08.14

bind: update to 9.11.9

Fixes CVEs:
CVE-2018-5738
CVE-2018-5740
CVE-2018-5743
CVE-2018-5744
CVE-2018-5745
CVE-2019-6465
CVE-2019-6471

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[mention fixed CVEs;patches: refreshed and removed those which are in
upstream now]

tar: update to version 1.32

Fixes CVE-2019-9923

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
[mention CVE in commit message]

tar: Update to 1.31

Fixes CVE-2018-20482

Added PKG_BUILD_PARALLEL for faster compilation.

Added PKG_CPE_ID for proper CVE tracking.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

lcdringer: Remove libcheck dependency to fix compilation

libcheck is some kind of testing framework. it is not only unnecessary, it
is not even used in the code.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #9765 from stangri/18.06-simple-adblock

[18.06] simple-adblock: support for varios DNS resolvers/options

dovecot: update to version 2.2.36.3

- Fixes CVE-2019-7524
- Refresh patch

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

[18.06] simple-adblock: support for varios DNS resolvers/options

Signed-off-by: Stan Grishin <stangri@melmac.net>

linknx: Fix compilation with libiconv

Based on ee94a1e9120e369666909de97ddf68966d61f8e2

Signed-off-by: Rosen Penev <rosenp@gmail.com>

rp-pppoe: redo glibc patch

Previous fix broke compilation with kernel < 4.8

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from e40d67a48f6dc82c5e52f07859251460d6064a09)

rp-pppoe: Fixed compilation with glibc

Do not inlcude <netinet/in.h> when using glibc to avoid various
redefinitions.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 0c995cabe7d1e8d6e695772848d1d54f0e978bf9)

ldbus: Add zip/host build dependency

Needed when zip is missing on the host (very rare).

Signed-off-by: Rosen Penev <rosenp@gmail.com>

gcc: Do not build on ARC

Not supported until GCC8.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

prometheus-node-exporter-lua: add target & system to OpenWrt collector

Before:
node_openwrt_info{revision="r10756+1-7546be6007",model="GL.iNet GL-AR150",id="OpenWrt",board_name="glinet,gl-ar150",release="SNAPSHOT"} 1

After:
node_openwrt_info{revision="r10756+1-7546be6007",target="ath79/generic",board_name="glinet,gl-ar150",id="OpenWrt",model="GL.iNet GL-AR150",release="SNAPSHOT",system="Atheros AR9330 rev 1"} 1

Fixes #9730, replace #9735

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit a14bed1bc959116617b0eb75d2d9a46551a480e6)

prometheus-node-exporter-lua: Add more wifi_station metrics and fix naming according to original wifi_linux.go node exporter

Signed-off-by: Kirill Lukonin <klukonin@gmail.com>
(cherry picked from commit 5eb8e47df282473aede488cad9ae40cad626c0bc)

prometheus-node-exporter-lua: Bump PKG_RELEASE

Signed-off-by: Alex Tomlins <alex@tomlins.org.uk>
(cherry picked from commit 4b6f76bfac7bd1969c8ca8829a7fe8f9fed43cd0)

prometheus-node-exporter-lua: Add wifi_station_count

To return the number of connected clients.

At present this can be partially inferred by using a count() over one of
the existing metrics, however this doesn't handle the case when there
are no connected clients. When that happens, the count() will return no
data instead of 0.

Signed-off-by: Alex Tomlins <alex@tomlins.org.uk>
(cherry picked from commit 1237e196b47dbbd7cac7cf7cabe4b8c86e09e0da)

prometheus-node-exporter-lua: wifi packets should be a counter

These output a count of the number of packets transmitted/received, so
should be tracked as a counter. As it stands, promtool is warning that
these shouldn't be named ending _total if they're a gauge.

Signed-off-by: Alex Tomlins <alex@tomlins.org.uk>
(cherry picked from commit a45c702baa1c5e913ac6561ef0e0465b8bd780ce)

prometheus-node-exporter-lua: Bump PKG_RELEASE

Signed-off-by: Alex Tomlins <alex@tomlins.org.uk>
(cherry picked from commit deab22044be7ea52fd0e3863516a07c5bee72d68)

prometheus-node-exporter-lua: fix missing conntrack values

If the /proc/sys/net/netfilter/nc_conntrack_* files are not present,
this exporter was outputting a blank value, which is invalid. These
files will not be present when using an image that doesn't include the
iptables and firewall packages (eg a minimal access-point type image).

This updates the collector to only output the metrics if the
corresponding /proc files are present.

Signed-off-by: Alex Tomlins <alex@tomlins.org.uk>
(cherry picked from commit 0100a2cb26c30ee091a259625b9496dd7805aaaa)

prometheus-node-exporter-lua: change network metric type to counter

Signed-off-by: Piotr Machała <pm7gt@933x.net>
(cherry picked from commit 626b197cc1b7f8cbb6937d7b6c1ed9982296feac)

prometheus-node-exporter-lua: add lantiq dsl modem collector

a.heider: Address PR comments and clean up.

Signed-off-by: Rene Treffer <treffer+github@measite.de>
Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit c751af86160f4467a2856ecceb2c8b599f517676)

openssh: fix pthread functions redefine with pam module

we should pass -DUNSUPPORTED_POSIX_THREADS_HACK to CFLAGS to openssh
to prevent function redefine, I don't know why pam module use
micro UNSUPPORTED_POSIX_THREADS_HACK to detect whether define
pthread functions, but not detect whether define
UNSUPPORTED_POSIX_THREADS_HACK.

Signed-off-by: Guo Li <uxgood.org@gmail.com>

Merge pull request #9403 from BKPepe/yt-18.06

[18.06] youtube-dl: update to version 2019.8.2

Merge pull request #9513 from BKPepe/openwrt-18.06_python_shebang

[OpenWrt 18.06] python,python3: move shebang handle in install script

libinput: Add missing header to fix compilation

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 671f0363a438518e676517b4fb5ed9fd8d4d5f49)

libglog: fix removing libunwind dependency

ac_cv_header_libunwind_h needs to be set to 0, as ac_cv_have_libunwind_h
overwritten based on the former's value.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from ec317934b2317e0e0f1831c703a643028d1acaa6)

libseccomp: workaround a recursive dependency

DEPENDS:=@!arc is causing a recursive dependency because of the optional
selection of libseccomp by util/lxc.  The workaround hides the package
in Package/libseccomp/config instead.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from e29483d7e202b06c49b3ede7fbb63c2ba1879321)

lxc: Backport uClibc patch

Fixes compilation

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 189a1700383a9d6cb964f764344194e4a904ce12)

lxc: hide seccomp support for arc

libseccomp does not compile for arc, so we can't show that option for
arc.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 57b4d94d98a572c02b9b78e4bb1d3e9810a95db7)

lxc: Disable use of unwanted libraries explicity

Otherwise one gets a failure if the libraries (e.g. Python
header file) exist in the build system.  Worse in some cases
is host headers being found if one doesn't specifically
disable a library search in autotools.  It is especially
important that Python is disabled by default.

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
(cherry-picked from cc039d801e28cf2fdf6a1d1466865d142a4ef278)

boost: Fix compilation with uClibc-ng

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 053faa31e53122eb7efdc78f954e9563ed06116e)

iodine: Fix compilation with uClibc-ng

daemon is supported now.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 3226673a48f42fd9f9a66ec1578a6ea887a0ccf6)

mariadb: add dependency on libaio for arc as well

Now that libaio compiles on arc targets we need to add the dependency to
libaio on these targets as well.

resolves #9298

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry-picked from c571c37e5c7e68eb9c431869f09a83d2a7ffaea2)

libudev-fbsd: update to git source as of 2017-12-16

Remove patches 001-fix-unused.patch and 002-replace-nitems.patch,
similar fixes to make libudev-fbsd compile were applied upstream.
Refresh remaining patches.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry-picked from 58f1de60f87cc9d81934749d020aa69b83d3bee9)

Merge pull request #9710 from BKPepe/icu_fix

[OpenWrt 18.06] icu: fix patch, which adds big endian ARM support

icu: fix patch, which adds big endian ARM support

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

golang: update to version 1.10.8

Fixes CVEs

1.10.6
CVE-2018-16873
CVE-2018-16874
CVE-2018-16875

1.10.8
CVE-2019-6486

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

libgee: copy vapi files to versioned vala dir

The version is obtained via `valac --api-version`

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from fb4b5c57015bcae10c1ba11aa575ba6ec93dbf4f)

libgee: use unversioned vala dir, misc fixes

Copy vapi files to unversioned vala dir.
Added vala/host to PKG_BUILD_DEPENDS.
Removed TARGET_LDFLAGS
Removed copyright lines

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 2cf76d52780d352b2ecb4bf14cb5eb403ef5144d)

icu: Fix patch from faulty backport

Signed-off-by: Rosen Penev <rosenp@gmail.com>

squid: update to version 3.5.28

Fixes CVEs:
CVE-2018-1000024
CVE-2018-1000027
CVE-2018-1172

Add patches from Squid Proxy Cache Security Update Advisory:
http://www.squid-cache.org/Advisories/SQUID-2018_4.txt
http://www.squid-cache.org/Advisories/SQUID-2018_5.txt
http://www.squid-cache.org/Advisories/SQUID-2019_3.txt
http://www.squid-cache.org/Advisories/SQUID-2019_6.txt

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

protobuf-c: add build time dependency protobuf

Signed-off-by: Mislav Novakovic <mislav.novakovic@sartura.hr>
(cherry-picked from a35581902cf6c6d4b51fc44a4db4d8c5bc8b51a5)

jamvm: depends on supported architectures

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry-picked from 11f054474446a9984e828637e0a474011b3b16f6)

icu: Backport ARMEB support patch

This should fix php compilation on PPC.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from a958f49bd0947e3647a77fb16394ec035544f34d)

gammu: Really fix compilation under 64-bit

The InstallDev section needed the same treatment as the Install one.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 5fbc6c873e29dcde6d048ffbbea252411816f884)