libwebsockets: fix recursive dependency

While running `make menuconfig`, it was discovered then there is a
recursive dependency like this:
tmp/.config-package.in:59138:error: recursive dependency detected!
tmp/.config-package.in:59138: symbol PACKAGE_libwebsockets-openssl is selected by PACKAGE_libwebsockets-mbedtls
tmp/.config-package.in:59122: symbol PACKAGE_libwebsockets-mbedtls depends on PACKAGE_libwebsockets-openssl

It is not possible with the recently added conflicts that two packages
(OpenSSL and full variant, which uses OpenSSL as well), which are almost the same
provides the same named package libwebsockets as their conflict - Mbed
TLS.

Fixes: 676c5c72b5eeb583da2603e399fac085fa442c59 ("libwebsockets: OpenSSL
and mbedTLS variants should conflict")

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit a4e8cbb89a48729b3c3ad615765549628d495b0f)

libwebsockets: OpenSSL and mbedTLS variants should conflict

They provide the same files, but they don't conflict to each other, this
means that users can install them side by side.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 676c5c72b5eeb583da2603e399fac085fa442c59)

libwebsockets: full variant provides OpenSSL

For some time, it is not possible to install ttyd and mosquitto-ssl at the
same time, so let's solve it that libwebsockets-full provides
libwebsockets-openssl. This allows to install ttyd and mosquitto at
the same time.

Also, we need to add conflict, because we should not have installed
libwebsockets-openssl and libwebsockets-full at the same time as they
provides the same files.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 77e682a11c53f4dcd0e76bdea5ee82de77eaacfe)

bind: update to 9.11.37

Fixes security issues:

 * CVE-2021-25220 -- The rules for acceptance of records into the cache
have been tightened to prevent the possibility of
poisoning if forwarders send records outside
the configured bailiwick.

 * CVE-2021-25219 -- The "lame-ttl" option is now forcibly set to 0. This
effectively disables the lame server cache, as it could
previously be abused by an attacker to significantly
degrade resolver performance.

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

htpdate: drop freebsd.org from default server list

The FreeBSD project stopped publishing HTTP date headers and seeks to
limit further resource taxing by distributed htpdate clients using the
www.freebsd.org host as default time source.

Fixes: #17924
Reported-by: Allan Jude <allanjude@freebsd.org>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit e8713180026e0cf1c9d1421e3b664fee3fa4df12)

bind: Bump to version 9.11.36

The following security issues are addressed with this change:

CVE-2020-8619
CVE-2020-8622
CVE-2020-8623
CVE-2020-8624
CVE-2020-8625
CVE-2021-25214
CVE-2021-25215
CVE-2021-25216
CVE-2021-25219

A complete description of the changes with this BIND release is
available in the release notes at
https://ftp.isc.org/isc/bind9/9.11.36/RELEASE-NOTES-bind-9.11.36.html

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

python3: Update to 3.6.15

Includes fix for CVE-2013-0340 ("Billion Laughs" vulnerability).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

perl: perlmod.mk: use 'install' for host binaries

When installing a host perl module, the host perl binary in the staging
dir is replaced by using 'cp'.  However, if the binary is running in a
parallel job, cp will fail with a text file busy error.  Use
$(INSTALL_BIN), which unliks the file first to avoid the error.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 19c7496648cb25500ca7007a7c1578a426c23a09)
(cherry picked from commit 67f403b5e6afba14cbf6742833426faad796bfd9)

Merge pull request #16086 from turris-cz/lxc-update-keyserver

lxc: add patch to switch GPG server

lxc: add patch to switch GPG server

By default, there was used sks-keyservers.net pool, which has invalid
SSL certificate and they also announced that their service is deprecate
and no longer maintained.

Use the same GPG server as LXC is using by default in the newer
releases.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #16056 from jefferyto/python3-3.6.14-openwrt-18.06

[openwrt-18.06] python3: Update to 3.6.14

python3: Update to 3.6.14

Includes fix for CVE-2021-3426 (Information disclosure via pydoc).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #15415 from luizluca/18.06/ruby-2.5.9

[18.06] ruby: update to 2.5.9

ruby: update to 2.5.9

Fixes two CVEs:

CVE-2020-25613: Potential HTTP Request Smuggling Vulnerability in WEBrick
CVE-2021-28965: XML round-trip vulnerability in REXML

After this release, Ruby 2.5 reaches EOL.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

Merge pull request #15166 from gladiac1337/haproxy-1.8.29-18.06

[openwrt-18.06] haproxy: Update HAProxy to v1.8.29

haproxy: Update HAProxy to v1.8.29

- Update haproxy download URL and hash

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #14843 from jefferyto/python-3.6.13-openwrt-18.06

[openwrt-18.06] python3: Update to 3.6.13

python3: Update to 3.6.13

Includes fixes for:
* CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr
* CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon
  as a query args separator

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #14502 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: bugfix: high CPU utilization

https-dns-proxy: bugfix: high CPU utilization

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #14428 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: update to 2020-11-25: add HTTP auth and DSCP support

https-dns-proxy: update to 2020-11-25: add HTTP auth and DSCP codepoint support

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #14272 from stangri/18.06-simple-adblock

[18.06] simple-adblock: config update

simple-adblock: config update

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #14214 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix - config update

simple-adblock: bugfix - config update

Signed-off-by: Stan Grishin <stangri@melmac.net>

https-dns-proxy: update binary to 2020-08-21

Signed-off-by: Stan Grishin <stangri@melmac.net>

python3: fix host compilation with clang

Matched rpath parameter with Makefile.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from commit b40c40151c2ac3dd11d908a0548ac97e6b5c8455)

Merge pull request #13918 from cartender/pr_stm32flash

stm32flash: Added patch to lock serial device

stm32flash: Added patch to lock serial device

Patch backported from upstream master

Signed-off-by: Giovanni Giacobbi <giovanni@giacobbi.net>

haproxy: Update HAProxy to v1.8.27

- Update haproxy download URL and hash
- Fix ssl compat patch offsets

Signed-off-by: Christian Lachner <gladiac@gmail.com>

php7: update to 7.2.34

This fixes:
  - CVE-2020-7069
  - CVE-2020-7070

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 5b3870890d9b55c51ed034bfbe7620654021c452)

fastd: fix buffer leak when receiving invalid packets

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>

Merge pull request #13685 from jefferyto/python-3.6.12-openwrt-18.06

[openwrt-18.06] python3: Update to 3.6.12, remove backported patches

python3: Update to 3.6.12, remove backported patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

simple-adblock: config update file fix

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 5.3

Update nano editor to version 5.3.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 4690a1f1c98c12f74a882eb2fc256c1f98957e55)

Merge pull request #13550 from gladiac1337/haproxy-1.8.26-openwrt-18.06

[openwrt-18.06] haproxy: Update HAProxy to v1.8.26

haproxy: Update HAProxy to v1.8.26

- Update haproxy download URL and hash

Signed-off-by: Christian Lachner <gladiac@gmail.com>

vpnbypass: README update, code cleanup

Signed-off-by: Stan Grishin <stangri@melmac.net>
update

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #13435 from stangri/18.06-simple-adblock

[18.06] simple-adblock: add config auto-update feature

simple-adblock: add config auto-update feature

Signed-off-by: Stan Grishin <stangri@melmac.net>

php7: update to 7.2.33

This fixes:
  - CVE-2020-7068

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 473ca554f5cdd6f3bbed44d563b041ac7edf4557)

nano: update to 5.2

Update nano editor to version 5.2.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 3ce75951360c675cec86548f2cb19cfca2ee1c89)

Merge pull request #13188 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix: update config; use command -v

simple-adblock: bugfix: update config; use command -v

Signed-off-by: Stan Grishin <stangri@melmac.net>

freeradius3: Fix proxy.conf file conflict.

It was provided by both the freeradius3 and freeradius3-mod-realm packages.
Now provided by the freeradius3 package only.

Signed-off-by: Robby K <robbyke@gmail.com>
Fixes: #13149
(cherry picked from commit c81d176e805122469216c8eac42081e91ca7304c)

Merge pull request #13123 from jjm2473/lvm2-fix-mac-sh-for-1806

lvm2: fix CE in mac (backport)

lvm2: fix CE in mac

command-count.h generated by makefile was wrong
when using default shell in mac,
set shell to bash to fix it.

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>
(cherry picked from commit 9bb0962d6e3a2d5faf28a9624da82a936d961f19)

nano: update to 5.1

Update nano to version 5.1.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 02f9ec4adc22a80e2adf57f868b080a2934af8bc)

nano: update to 5.0

Update nano editor to version 5.0.
http://git.savannah.gnu.org/cgit/nano.git/tree/NEWS

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 409633f0ddd4baefc85e89077a6e74fd2135884f)

Merge pull request #13057 from odmdas/odmdas-freeradius3-Makefile-18.06

[18.06] freeradius3: add missing conffiles to Makefile

freeradius3: add missing conffiles to Makefile

Config files
/etc/freeradius3/policy.d/accounting
/etc/freeradius3/policy.d/filter
/etc/freeradius3/proxy.conf
/etc/freeradius3/sites-available/default
and link
/etc/freeradius3/sites-enabled/default
are in the freeradius3 package and are mentioned in the main config file
/etc/freeradius3/radiusd.conf
Thus, they must be explicitly specified in the Makefile.

File
/etc/freeradius3/sites/default
is not included in the package, is not created during installation,
is not mentioned in the main config file and should therefore be excluded
from the Makefile.

(backported from commit f6974b8)
Signed-off-by: Alexey Dobrovolsky <dobrovolskiy.alexey@gmail.com>

Merge pull request #13023 from stangri/18.06-simple-adblock

[18.06] simple-adblock: README and config update

simple-adblock: README and config update

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12999 from jjm2473/libtasn1-support-host-compile

libtasn1: add host build

libtasn1: add host-build

* samba4 complains that it cant find the libasn1 host bins

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry picked from commit 42e9057d41f9d59916daa9d716734f25a666b55a)

Merge pull request #12989 from jjm2473/netatalk-fix-CE-dtrace

netatalk: fix compile error in mac os

netatalk: fix compile error in mac os

fix compile error in mac os when dtrace installed.

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>

Merge pull request #12991 from jjm2473/libgpg-error-fix-gawk50-3

libgpg-error: Fix compilation with GAWK 5.0

libgpg-error: Fix compilation with GAWK 5.0

Patch from Upstream.

Signed-off-by: Liangbin Lian <jjm2473@gmail.com>

Merge pull request #12882 from jefferyto/python3-backport-patches-openwrt-18.06

[openwrt-18.06] python3: Backport security fixes

python3: Backport security fixes

This backports fixes for security issues, including:
* CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface
* CVE-2019-20907: Infinite loop in the tarfile module

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

haveged: update to 1.9.13

Update haveged to version 1.9.13.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 28cf20129081f9c6b8778b243cc3df1f610544c4)

Merge pull request #12661 from jefferyto/python-3.6.11-openwrt-18.06

[openwrt-18.06] python3: Update to 3.6.11

python3: Update to 3.6.11

This contains a fix for CVE-2020-8492 (Denial of service in
urllib.request.AbstractBasicAuthHandler)[1].

[1]: https://docs.python.org/release/3.6.11/whatsnew/changelog.html#python-3-6-11-release-candidate-1

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Merge pull request #12615 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: re-add conffiles and add description to Makefile

https-dns-proxy: re-add conffiles and add description to Makefile

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12598 from stangri/18.06-https-dns-proxy

[18.06] https-dns-proxy: bugfix: remove eDNS support

https-dns-proxy: bugfix: remove eDNS support

Signed-off-by: Stan Grishin <stangri@melmac.net>

haveged: update to 1.9.12

Update haveged to version 1.9.12

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 6392d50c3180b5da7a4ba041decf7a229d0e1c53)

haveged: update to 1.9.11

Update haveged to version 1.9.11

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit ca30b0ff91846a407469f6a77d1cbaf6b150d06d)

haveged: move init script from 13 to 01

This is intended as a match with standard urngd. They serve same purpose
and urngd starts as first with 00. Starting haveged later can create
issues if you replace urngd with it. The example problem is if
uci-defaults script decides to generate certificate. Haveged can supply
entropy but it is started later and to mitigate this urngd would still
have to be installed. This means that haveget can't serve as replacement
without moving it to match start order of urngd.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit 1ef38f45d982beb46b2df6d3582ad0bc2b0007ca)

Merge pull request #12508 from stangri/18.06-simple-adblock

[18.06] simple-adblock: racially-neutral names

simple-adblock: racially-neutral names

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12455 from stangri/18.06-simple-adblock

[18.06] simple-adblock: remove obsolete dshield.org links from config

simple-adblock: remove obsolete dshield.org links from config

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #12335 from stangri/18.06-simple-adblock

[18.06] simple-adblock: bugfix: proper error reporting on failed downloads; lists update script

simple-adblock: bugfix: proper error reporting on failed downloads; lists update script

Signed-off-by: Stan Grishin <stangri@melmac.net>

nano: update to 4.9.3

Update nano version to 4.9.3
Minor bugfix release.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 38be46a7ae496cf9f01dd2fd6fee74bc9f1b2673)

bind: update to version 9.11.19

Fixes:
CVE-2020-8616
CVE-2020-8617

Remove backported patch

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #12235 from jefferyto/python-openssl-ca-certs-openwrt-18.06

[openwrt-18.06] python-openssl,python3-openssl: Add dependency on ca-bundle

python-openssl,python3-openssl: Add dependency on ca-bundle

The ssl module assumes OpenSSL can load the default trust anchors (root
CA certificates).

From https://github.com/openwrt/packages/issues/12209

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Python: Fix compile of host modules

Add -rpath linker option to host build, pointing to staging/hostpkh/lib.
It's needed to find the correct host libs during runtime, without it the
hosts libs may be used instaead, causing failures.

Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
(cherry picked from commit 0311e58bb645b8f5a2b96528d78edc90c811ed94)

Python3: Fix host build on OpenSUSE

The linker option -rpath is required to find libs in staging_dir. Now it
is included when building host modules. Without it the import test of
the _ctypes and _uuid modules would fail. The _ctypes module uses
libffi.so.6 from staging, but OpenSUSE LEAP 15 has libffi.so.7.
It will also fail on LEAP 42.x, Fedora28 and 29 and future or old
versions of Ubuntu.

Fix needed in master and 18.06 branches.

Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
(cherry picked from commit 6ade5a1e3adb189d062b707e2b8f731c9faab844)

unbound: update to version 1.10.1

Fixes:
CVE-2020-12662
CVE-2020-12663

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #12207 from micmac1/mar-1806-10413

[18.06] mariadb: minor version bump with CVE fixes

mariadb: bump to 10.1.45

Fixes:

  CVE-2020-2752
  CVE-2020-2812
  CVE-2020-2814

This commit also moves mysql_upgrade to the client package and installs
the configuration files readable for all, so that the clients can read
them.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

php7: update to version 7.2.31

This fixes:
  - CVE-2019-11048

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2e6bd4cb86682b224803325127d3f777d40b3231)

Merge pull request #12142 from EricLuehrsen/unbound_1806_1100

[openwrt-18.06] unbound: update to 1.10.0

unbound: update to 1.10.0

cherry-pick: f779ef48cd21474acf72ee151588737273a509c2
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>

Merge pull request #12058 from stangri/18.06-vpnbypass

[18.06] vpnbypass: bugfix: remove non-ASCII from system log; update README

vpnbypass: bugfix: remove non-ASCII from system log; update README

Signed-off-by: Stan Grishin <stangri@melmac.net>

youtube-dl: update to version 2020.3.24

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #11995 from jefferyto/python-2.7.18-openwrt-18.06

[openwrt-18.06] python: Update to 2.7.18, refresh patches

python: Update to 2.7.18, refresh patches

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

mwan3: Fix json_load fails with some data

Sometimes the return value of `ubus -S call network.interface.wan status`
cause `json_load` to return `Failed to parse message data` error.

To avoid this, the JSON data always should be quoted with double quotes.

Signed-off-by: Evren Yurtesen <eyurtese@abo.fi>
Removed quoatation marks from commit heading
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 94e0c78826b15c95c40bfa82bbf8bba35dc56961)

libarchive: update to 3.4.2

Switch to normal tarballs. Remove autoreconf as a result.

Several Makefile cleanups for consistency.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c22dd1bf74fa5836a88fa417b467767bcfe8a4ff)
(cherry picked from commit 2085b990ffc875a5157c02a9e2b5bd04c8eb35b3)

libarchive: update to version 3.4.1 (security fix)

Fixes CVE-2019-19221

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from df634dcc926650de22248b89620c649c0fef7602)
(cherry picked from commit ba43556aed90705bc04fd074d39ee6ea012a71f2)

php7: update to version 7.2.30

Fixes:
CVE-2020-7066
CVE-2020-7064

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 09738290a319cc2af74a0be9a52aa5a76b6ca98e)