python-openssl,python3-openssl: Add dependency on ca-bundle

The ssl module assumes OpenSSL can load the default trust anchors (root
CA certificates).

From https://github.com/openwrt/packages/issues/12209

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Python: Fix compile of host modules

Add -rpath linker option to host build, pointing to staging/hostpkh/lib.
It's needed to find the correct host libs during runtime, without it the
hosts libs may be used instaead, causing failures.

Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
(cherry picked from commit 0311e58bb645b8f5a2b96528d78edc90c811ed94)

Python3: Fix host build on OpenSUSE

The linker option -rpath is required to find libs in staging_dir. Now it
is included when building host modules. Without it the import test of
the _ctypes and _uuid modules would fail. The _ctypes module uses
libffi.so.6 from staging, but OpenSUSE LEAP 15 has libffi.so.7.
It will also fail on LEAP 42.x, Fedora28 and 29 and future or old
versions of Ubuntu.

Fix needed in master and 18.06 branches.

Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
(cherry picked from commit 6ade5a1e3adb189d062b707e2b8f731c9faab844)

Merge pull request #12207 from micmac1/mar-1806-10413

[18.06] mariadb: minor version bump with CVE fixes

mariadb: bump to 10.1.45

Fixes:

  CVE-2020-2752
  CVE-2020-2812
  CVE-2020-2814

This commit also moves mysql_upgrade to the client package and installs
the configuration files readable for all, so that the clients can read
them.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

php7: update to version 7.2.31

This fixes:
  - CVE-2019-11048

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2e6bd4cb86682b224803325127d3f777d40b3231)

Merge pull request #12142 from EricLuehrsen/unbound_1806_1100

[openwrt-18.06] unbound: update to 1.10.0

unbound: update to 1.10.0

cherry-pick: f779ef48cd21474acf72ee151588737273a509c2
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>

Merge pull request #12058 from stangri/18.06-vpnbypass

[18.06] vpnbypass: bugfix: remove non-ASCII from system log; update README

vpnbypass: bugfix: remove non-ASCII from system log; update README

Signed-off-by: Stan Grishin <stangri@melmac.net>

youtube-dl: update to version 2020.3.24

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11995 from jefferyto/python-2.7.18-openwrt-18.06

[openwrt-18.06] python: Update to 2.7.18, refresh patches

python: Update to 2.7.18, refresh patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

mwan3: Fix json_load fails with some data

Sometimes the return value of `ubus -S call network.interface.wan status`
cause `json_load` to return `Failed to parse message data` error.

To avoid this, the JSON data always should be quoted with double quotes.

Signed-off-by: Evren Yurtesen <eyurtese@abo.fi>
Removed quoatation marks from commit heading
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 94e0c78826b15c95c40bfa82bbf8bba35dc56961)

libarchive: update to 3.4.2

Switch to normal tarballs. Remove autoreconf as a result.

Several Makefile cleanups for consistency.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c22dd1bf74fa5836a88fa417b467767bcfe8a4ff)
(cherry picked from commit 2085b990ffc875a5157c02a9e2b5bd04c8eb35b3)

libarchive: update to version 3.4.1 (security fix)

Fixes CVE-2019-19221

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from df634dcc926650de22248b89620c649c0fef7602)
(cherry picked from commit ba43556aed90705bc04fd074d39ee6ea012a71f2)

php7: update to version 7.2.30

Fixes:
CVE-2020-7066
CVE-2020-7064

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 09738290a319cc2af74a0be9a52aa5a76b6ca98e)

php7: fix dependencies for mysqlnd (fixes #11113)

When during the build the openssl extension is also selected, then
the mysqlnd extension depends on it, too.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 50b1cd3757497a569538d751f4681a40df1b1202)

Merge pull request #11926 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix: start downloads on cold boot/fresh install

simple-adblock: bugfix: start downloads on cold boot

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #11907 from BKPepe/18.06-git

[18.06] git: update to version 2.20.4

git: update to version 2.20.4

Fixes CVE-2020-11008

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11857 from BKPepe/18.06-git

[18.06] git: update to version 2.20.3

Merge pull request #11883 from yousong/wget1806

[18.06] acme: depends on wget-ssl

acme: depends on wget-ssl

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit d917d662aedd9c133217b5c6d8c5a4f4a6bd3dea)

wget: make the ssl variant provides wget-ssl

This is to address the need for specifying dependency on a wget
implementation with ssl support.

Now we have a game of names for opkg

 1. uclient-fetch: minimal version by openwrt project
 2. wget-nossl: gnu wget w/o ssl support
 3. wget-ssl: for the moment since this commit, gnu wget w/ ssl support
 4. wget: uclient-fetch, wget-nossl, or wget-ssl
 5. gnu-wget: wget-nossl or wget-ssl

By the time we provide some dummy package like uclient-fetch-ssl and
make it also provide wget-ssl, I guess by then we will also need
gnu-wget-ssl...

Ref: https://github.com/openwrt/packages/issues/11534
Ref: https://github.com/openwrt/packages/pull/9941
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 585e4a38feca24c9650d4e762b44146ecd75d4d0 &
resolved conflict)

wget: do not provide itself

The package wget should not say that it provides itself.

This also make gnu-wget provide general so it is not written in Makefile
twice.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 75f2be7d509e802f2d946d732e7a7539c2b27d2e &
resolved conflict)

ruby: update to 2.5.8

This release includes security fixes, specially:

* CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix)
* CVE-2020-10933: Heap exposure vulnerability in the socket library

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

git: update to version 2.20.3

Fixes CVE-2020-5260

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nlbwmon: update to latest Git HEAD

34a1887 nfnetlink: disable sequence number checking

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 53c48fae1502e7f87fd93ff299db98cd119fa304)

Merge pull request #11821 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: bugfix: memory leak

https-dns-proxy: bugfix: memory leak

Signed-off-by: Stan Grishin <stangri@melmac.net>

nlbwmon: update to latest Git HEAD

e757e06 nfnetlink: allow specifying the socket buffer size
33c77cb nfnetlink: properly handle nl_recvmsgs() failures
95cced5 protocol: Include whitespace when reading names

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d81d777a0f009fe74d233de307a03f9951d6b960)

nlbwmon: bump to latest git

e921ca0a Add further commonly used protocols to the protocol file.

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry picked from commit 5e140462e42af3e5cb7680863794339f11ddda7d)

nlbwmon: add procd reload trigger for nlbwmon config

Signed-off-by: Richard Yu <yurichard3839@gmail.com>
(cherry picked from commit d5517583104c8521d978a911bff921588ba0e988)

nlbwmon: receive dhcp interface triggers

Not all interfaces may have been allocated address at nlbwmon startup so
it may not collect statistics as expected/configured.

Add interface triggers to catch dhcp events and restart as required.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
(cherry picked from commit 662d3f16d2702fe55116c852f5d456e90891ee89)

net/nlbwmon: run with lower priority

Even on a powerful platform a nlbwmon process'
activities are sometimes affecting throoughput and
latency. This is a backgroud process, that should not
be running with default priority.
Even if it is a little deplayed, that is not a worry in
this case. The routing should be the main priority,
bandwidth stats collection can wait a bit.

Tested on Netgear R7800
Signed-off-by: Marc Benoit <marcb62185@gmail.com>
(cherry picked from commit 9b3ecbd64a6328e13981165660d8930e8bb2446a)

Merge pull request #11803 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfixes: remove escape chars from log, restore from cache on boot

simple-adblock: bugfixes: remove escape chars from log, restore from cache on boot

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9.2

Update nano editor to version 4.9.2

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit f11833d46cf71be65439397e2a7e03643fc78af2)

Merge pull request #11773 from BKPepe/msmtp

[18.06] msmtp: update to version 1.8.7

msmtp: update to version 1.8.7

- It brings oauthbearer support
- It switches from OpenSSL to GnuTLS, which is fully compatible and
  brings more parameters

Makefile changes:
- Fix SPDX License Identifier
- Add PKG_CPE_ID
- The Project does not use sourceforce anymore.
- Uses GnuTLS instead of OpenSSL, which was discouraged

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nano: update to 4.9.1

Update nano editor to version 4.9.1

 2020.03.31 - GNU nano 4.9.1 "Sapperdeflap"
 Two bugs introduced in version 4.9 are fixed: the cursor
 getting misplaced when undoing line cuts, and filtering
 of the whole buffer to a new buffer not working.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit f5c47a2606cea00ef70ae696224cd201ca1aceb8)

Merge pull request #11756 from gladiac1337/haproxy-1.8.25-openwrt-18.06

[openwrt-18.06] haproxy: Update HAProxy to v1.8.25

haproxy: Update HAProxy to v1.8.25

- Update haproxy download URL and hash
- This fixes CVE-2020-11100 (http://git.haproxy.org/?p=haproxy-1.8.git;a=commit;h=525fbbe388ba033d638ff2a4efb83ae6526db5ab)

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #11700 from stangri/18.06-simple-adblock

[18.06] simple-adblock: support multiple dnsmasq instances + internal refactoring

simple-adblock: support multiple dnsmasq instances; rework communication between principal package and luci app

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9

Update nano editor to version 4.9

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 09fd4445b3f7c426212ed61b3989e1994255a8aa)

Merge pull request #11626 from nxhack/18_06_icu_fix_CVE-2020-10531

[openwrt-18.06] icu: fix CVE-2020-10531

Merge pull request #11616 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: support for dnsmasq noresolv option

icu: fix CVE-2020-10531

FIX CVE-2020-10531
 An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

https-dns-proxy: support for dnsmasq noresolv option

Signed-off-by: Stan Grishin <stangri@melmac.net>

openvswitch: fix PIE build against 4.14 kernel

Reported-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Ref: https://github.com/openwrt/packages/pull/11567
(cherry picked from commit e9d6414437d27803a16b5d96c48b45140e989e5e)

php7: update to 7.2.28

This fixes:
  - CVE-2020-7062
  - CVE-2020-7063

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 95c72d8abaa8a99471275ae0723e4d941f36d81a)

php7: update to 7.2.27

This fixes:
  - CVE-2020-7059
  - CVE-2020-7060

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 3cf0c61f2ee1b94c8b09adb8c1cbc79281cfc32d)

xl2tpd: fix building failure caused by pfc

Fixes openwrt/packages#10270

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 0412c20f1b2d2e1f8b8c7e101aae6f66be50690a)

xl2tpd: bump to version 1.3.15

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Ref: https://github.com/openwrt/packages/issues/11418
(cherry picked from commit 620ba386b4ffd38911e7ddf0c864979c0f834a11)

icu: bump proper variable.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

icu: backport upstream ARC patch

Signed-off-by: Rosen Penev <rosenp@gmail.com>

nano: update to 4.8

Update nano editor to version 4.8

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 7bc96280d31470b7dda75315154c8df72bde222a)

Merge pull request #11252 from neheb/i22p

i2pd: fix various issues in 18.06

i2pd: move chmod command

Similar change to upstream.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

i2pd: Move DATADIR to /var/lib/i2pd, fix #5693

Original author: dartraiden <wowemuh@gmail.com>

Signed-off-by: David Yang <mmyangfl@gmail.com>

Merge pull request #11227 from micmac1/sqlite3-18.06-2

[18.06] sqlite3: bump to 3.31.1

sqlite3: bump to 3.31.1

Upstreamed patch removed.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Merge pull request #11186 from micmac1/18.06-maria-10.1.44

[18.06] mariadb: security bump to 10.1.44

mariadb: security bump to 10.1.44

Addresses CVE-2020-2574. Patches refreshed.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

ddns-scripts: Change protocols of afraid.org urls to HTTPS.

- Use HTTPS protocol for updating urls for afraid.org to protect the password.
- Bump/align package version number.

Signed-off-by: Kwonjin Jeong <gram25gwh@gmail.com>
(cherry-picked from e25b55899927eb5638cc6a13a568ee4271eed2b2)

node-hid: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1aa55f86b56766074677bcda23f19cd7e5b5601f)

node-serialport: fix i386 build fail

more stability for parallel build

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 1ce1ca6e0622c6ad7fb61e44b7c96b028939186a)

Merge pull request #11124 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: fix deleting server items, configurable dnsmasq settings change

Merge pull request #11127 from micmac1/18.06-tiff

[18.06] tiff: update to 4.1.0

tiff: update version to 4.1.0

Signed-off-by: Jiri Slachta <jiri@slachta.eu>

tiff: patch security issues

Fixes
CVE-2019-7663
CVE-2019-6128

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

https-dns-proxy: fix deleting server items, configurable dnsmasq settings change

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #9795 from LoEE/jpc/git-macos-cross

[18.06]git: fix cross compilation on macOS

libsoup: fix intltool host dependency. Cleaup some build args

Signed-off-by: Ted Hess <thess@kitschensync.net>
(cherry-picked from 0daec55ce50d4dffae040645227a718ce528b978)

avrdude: Fix GPIO path building

%ud is a GNU extension. It's not really supported elsewhere.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 536c6b8be7cb620f6258cbcb7e85a50662976f2b)

zerotier: add /etc/config/zerotier as configuration file

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

libseccomp: add seccomp-syscalls.h to InstallDev

In the version 2.4.2, there was introduced a new header file.
Ship it to InstallDev

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11023 from jefferyto/golang-goarm-fix-openwrt-18.06

[openwrt-18.06] golang: Fix selection of GOARM value

golang: Fix selection of GOARM value

This fixes how GOARM is selected for arm platforms, based on support for
VFP/VFPv3 rather than CPU version.

Fixes #10967.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #10995 from BKPepe/libseccomp-18.06

[18.06] libseccomp: update to version 2.4.2

libseccomp: update to version 2.4.2

Fixes CVE-2019-9893

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

transmission: sync with master

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Merge pull request #10832 from BKPepe/git-18.06

[OpenWrt 18.06] git: Update to version 2.16.6 (security fix)

git: Update to version 2.16.6 (security fix)

Fixes CVEs:
CVE-2018-17456
CVE-2019-1348
CVE-2019-1349
CVE-2019-1350
CVE-2019-1351
CVE-2019-1352
CVE-2019-1353
CVE-2019-1354
CVE-2019-1387

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #10858 from BKPepe/wget-18.06

[OpenWrt 18.06] wget: fix CVE-2019-5953

lcdgrilo: Fix compilation with newer Vala

It seems semantics changed slightly.

Cleaned up Makefile for consistency between packages.

Added PKG_BUILD_PARALLEL for faster compilation.

Fixed license information.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 16fb706641222ac44f61aaee6161b2cb4596336d)

lcdgrilo: Depend on vala/host instead

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 5935670ba14ed575799e4df4e4227826e3fef682)

lcdgrilo: remove check dependency

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 2e8b7358c4c336a5a5845351db642e8f45aa61d2)

nano: update to 4.7

Update nano to version 4.7

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit c62f8962ba3cf4e044941e372a155a97e5438ebd)

Merge pull request #10889 from EricLuehrsen/unbound_196_1806

[18.06] unbound: update to 1.9.6

unbound: update to 1.9.6

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>

grilo: copy vapi files to versioned vala dir

The version is obtained via `valac --api-version`

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 8d0c849e561bd5a984ccd2e99c67a7f9c4ed68f1)

grilo: update vapi files, copy to unversioned dir

Updates vapigen-generated vapi files to vala-0.34.
Files are now copied to $(STAGING_DIR_HOSTPKG)/share/vala/vapi, without
the vala version being hardcoded.
Removed copyright line, and redundant PKG_BUILD_DEPENDS and
TARGET_LDFLAGS.

Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
(cherry-picked from 1b794e93e356c35b7c4d09019a0364e237efdbc6)

lcdproc: Fix non x86 platforms on musl

Musl only specifies in/outb for x86/x86. Use the fallback path in case
musl is used.

This should fail compilation during the linking stage but for some reason
does not. Will do if -Werror=implicit-function-declaration is specified.

Fixed up license information.

Other small cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from fa40b85f20f697e4c0b7b96b77b3a40902c72605)

Merge pull request #10763 from leonghui/wiki-link-update-18.06

[18.06] treewide: replace old wiki links

php7: update to 7.2.26

This fixes:
  - CVE-2019-11046
  - CVE-2019-11044
  - CVE-2019-11045
  - CVE-2019-11050
  - CVE-2019-11047

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit d5c18b1d5e7171a23e17ec9fd3604f794a336f1e)

bind: Update to version 9.11.14

Add patch to fix compile issue:
stats.c: In function 'setcounter':
stats.c:300:29: error: 'val' undeclared (first use in this function); did you mean 'value'?
  stats->counters[counter] = val;
                             ^~~
                             value

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>