Commit Graph

5388 Commits

Author SHA1 Message Date
Jan Pavlinec
a0d4cc9170 treewide: add PKG_CPE_ID for cvescanner
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from ceadbcbb64)
2019-09-26 19:36:27 -07:00
Jan Pavlinec
937b19ebb7 treewide: add PKG_CPE_ID for better cvescanner coverage
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from bf2f1a0263)
2019-09-26 19:36:27 -07:00
Jan Pavlinec
fac472e28a samba4: update to version 4.9.13 (security fix)
Fixes CVE-2019-10197

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from ad16f2a851)
2019-09-26 19:36:26 -07:00
Oever González
8671765883 samba4: remove double quotes for renice
The double quote thells the shell that the list returned from `pidof` is a
single argument, therefore, `renice` will cry about a malformed input.
With this commit, `renice` will be applied correctly to all the returned PIDs
from `pidof`.

The output of `renice` for the quoted list is as follows:
`renice: invalid number '6592 6587 6586 6574'`
`renice` does not show and does apply the nice value if the list is unquoted.

Signed-off-by: Oever González <notengobattery@gmail.com>
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from c45974d0a3)
2019-09-26 19:36:26 -07:00
Andy Walsh
cd597524d1 samba4: add python2 host dependency
* add python2/host dependency

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry-picked from c02ef3ae7f)
2019-09-26 19:36:26 -07:00
Rosen Penev
d3db014eb1 samba4: Run init script through shellcheck
Some performance improvements by batching file writes.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from d03b88b5b0)
2019-09-26 19:36:26 -07:00
Andy Walsh
8a20820a9b samba4: revert to 4.9.11
* revert to 4.9.x series (4.10 needs too many unofficial patches and has weird waf bugs)
* cleanup patches
* enable AD_DC build option again

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry-picked from 2f2a4bccd9)
2019-09-26 19:36:25 -07:00
Sven Eckelmann
1142f52078 treewide: Change .*GPL.*+ licenses to SPDX compatible identifier
The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL
licenses. But a lot of packages did use a different, non-SPDX style with a
"+" at the end instead of "-or-later".

Signed-off-by: Sven Eckelmann <sven@narfation.org>
(cherry-picked from bbb1ea7345)
2019-09-26 19:36:25 -07:00
Florian Eckert
605383751e keepalived: update version to 2.0.18
Update version to 2.0.18

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from 333324f973)
2019-09-26 19:36:24 -07:00
Florian Eckert
05f4ae9250 keepalived: fix shellcheck warnings
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from 7a207f87af)
2019-09-26 19:36:24 -07:00
Nikos Mavrogiannopoulos
4b3ddb1382 ocserv: updated to 0.12.4
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
(cherry-picked from cefb2f03e2)
2019-09-26 19:36:24 -07:00
Florian Eckert
6154afb3cf stunnel: fix some shellcheck warnings
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from 6713d1d771)
2019-09-26 19:36:24 -07:00
Florian Eckert
1a93b5512f stunnel: update version to 5.55
Update version to 5.55

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from a17e90591c)
2019-09-26 19:36:23 -07:00
Rosen Penev
e02387b95e geth: Update to 1.9.1
Remove Upstreamed patch.

Minor cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 03b1d7c4d4)
2019-09-26 19:36:23 -07:00
Andreas Nilsen
1e48632e08 hcxtools: Update to v5.2.2
Signed-off-by: Andreas Nilsen <adde88@gmail.com>
2019-09-26 19:47:29 +02:00
Andreas Nilsen
80002c1b99 hcxdumptool: Update to v5.2.2
Signed-off-by: Andreas Nilsen <adde88@gmail.com>
2019-09-26 19:47:08 +02:00
Karl Palsson
1f1444ed2c net/mosquitto: bump to 1.6.7
Fixes compatibility with newer libwebsockets versions.
Fixes performance issues with websockets
Fixes potential crash on config reload
Fixes CVEs: CVE-2019-11778 and CVE-2019-11779
Various MQTTv5 fixes.
Skips releases with critical regressions

Changelog for 1.6.7:
https://mosquitto.org/blog/2019/09/version-1-6-7-released/

Changelog for 1.6.5:
https://mosquitto.org/blog/2019/09/version-1-6-5-released/

Changelog for 1.6.6:
https://mosquitto.org/blog/2019/09/version-1-6-6-released/

Signed-off-by: Karl Palsson <karlp@etactica.com>
2019-09-25 16:13:23 +00:00
Hannu Nyman
83e7e3af8d Merge pull request #10064 from stangri/19.07-simple-adblock
[19.07] simple-adblock: dnsmasq.ipset option support, better handling of IDNs, updated README
2019-09-25 19:13:00 +03:00
Christian Lachner
aacc401495 haproxy: Update HAProxy to v2.0.6
- Update haproxy download URL and hash
- Add new patches

Signed-off-by: Christian Lachner <gladiac@gmail.com>
2019-09-25 11:53:08 +02:00
Jan Pavlinec
6bab28e8d7 usbip: disable ASLR PIE
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from commit ff216608a0)
2019-09-24 21:58:31 +02:00
Stan Grishin
17a58fa39d simple-adblock: dnsmasq.ipset option support, better handling of IDNs, updated README
Signed-off-by: Stan Grishin <stangri@melmac.net>
2019-09-24 09:12:08 -07:00
Rosen Penev
fd31ee0a93 atftp: Update to 0.7.2
Fixes issue where CFLAGS were not being passed. This was breaking ASLR
builds.

Added PKG_BUILD_PARALLEL for faster compilation.

Added PKG_INSTALL. Changed install paths based on PKG_INSTALL paths.

Added --disable-debug to make sure debug code is disabled.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 946dfed856)
2019-09-23 11:57:51 -07:00
Dirk Brenken
2c7118e1d7 adblock: update 3.8.6
* refine stop logic to prevent needless dns backend restarts
  and other oddities
* cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>
2019-09-17 13:59:08 +02:00
Rosen Penev
3875601317 Merge pull request #10000 from cshoredaniel/pr-19.07-p910nd-non-root-backport
[19.07] p910nd: Run as non-root by default
2019-09-15 07:16:27 -07:00
Daniel F. Dickinson
0e78a105c8 uwsgi-cgi: use python3 hostpkg not system python3
On a Debian system without python3-distutils install, uwsgi-cgi was
failing to build because it couldn't import sysconfig from distutils.
OpenWrt packages should be using the OpenWrt python not the system
python. In addition we need to use python3 not python2, even when
both are available.

(cherry-pick c387d0923c from master)

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
2019-09-14 16:46:05 -04:00
Daniel F. Dickinson
875eb10d11 p910nd: Run as non-root by default
We add the necessary Makefile, hotplug, config, and init bits
so that p910nd daemon runs as user:group p910nd:lp by default.
This eliminates an unnecessary root daemon.

The hotplug script sets the permissions of the USB lp
device(s) to read-write owner and group and no access to
anyone else, and sets owner root, group lp.

This is allows sufficient privileges to p910nd
to do it's job.

(cherry-pick 932c76fa74)

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
2019-09-14 16:44:08 -04:00
Dirk Brenken
3f89abbf0d banip: update 0.2.1
* remove 'http-only' mode, all sources are now fetched from https sites
* the backup mode is now mandatory ('/tmp' is the default backup
  directory), always create and re-use backups if available.
  To force a re-download take the 'reload' action.
* support 'sshd' in addition to 'dropbear' for logfile parsing
  to detect break-in events
* always update the black-/whitelist with logfile parsing results
  in 'refresh' mode (no new downloads)
* rework the return code handling
* tweak procd trigger
* various small fixes
* (s)hellsheck cosmetics
* Change .*GPL.*+ licenses to SPDX compatible identifier

Signed-off-by: Dirk Brenken <dev@brenken.org>
2019-09-11 06:21:20 +02:00
Dirk Brenken
1ad19c6bfa adblock: update 3.8.5
* use raw procd interface trigger as last resort, if the
  adblock config is not available during startup
* fix selective subdomain whitelisting for dnsmasq
* fix a kresd restart issue with 'DNS File Reset'
* fix a suspend/resume cornercase
* disable the tld compression, if the number of blocked domains
  is greater than 'adb_maxtld' (default: 100000)
* made the fw portlist configurable (default '53 853 5353')
* preliminary support for inotify-like autoload features
  of dns backends like kresd in future Turris OS. If 'adb_dnsinotify'
  is set to 'true', all adblock related restarts and the
  'DNS File Reset' will be disabled

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 45cb0e1023)
2019-09-09 14:57:14 +02:00
Josef Schlehofer
20bd9b78e1 lighttpd: Makefile polishing
- Correct SPDX License Identifier
- Move MAINTAINER, SUBMENU to more appropriate place
- Use HTTPS in URL

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit e06086c4c)
2019-09-07 13:31:02 +02:00
Josef Schlehofer
19039dc4ae lighttpd: Update to version 1.4.54
Fixes CVE-2019-11072

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 80c721c6a)
2019-09-07 13:30:44 +02:00
Jan Hák
52a2936597 knot: update to 2.8.3
Added lmdb dependency

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry-picked from 0b19979301)
2019-09-06 16:37:07 -07:00
Jan Hák
abb9ac3e9c knot: upgrade to vetsion 2.8.2
Upgrade of Knot DNS package to version 2.8.2

Signed-off-by: Jan Hák <jan.hak@nic.cz>
(cherry-picked from 30627a9928)
2019-09-06 16:36:45 -07:00
Matthias Schiffer
421b922fde fastd: fix init script for multiple VPN instances
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit b7ff8b8087)
2019-09-04 22:50:12 +02:00
Eric Luehrsen
b69c271d0a unbound: update to 1.9.3
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
(cherry-picked from commit c36d8a49fd)
2019-09-01 18:24:05 +02:00
DENG Qingfang
81eb936054 bind: update to 9.14.4
Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry-picked from commit e7d35f6deb)
2019-09-01 18:23:10 +02:00
Rosen Penev
725777cc1f Merge pull request #9869 from gladiac1337/haproxy-2.0.5-openwrt-19.07
[openwrt-19.07] haproxy: Update HAProxy to v2.0.5
2019-08-30 10:11:55 -07:00
W. van den Akker
434407ab9a Shorewall6: Bump to version 5.2.3.4
Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>
2019-08-30 14:10:49 +02:00
W. van den Akker
86f301397d Shorewall: Bump to version 5.2.3.4
Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>
2019-08-30 14:10:21 +02:00
W. van den Akker
32171993b5 Shorewall6-lite: Bump to version 5.2.3.4
Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>
2019-08-30 14:09:40 +02:00
W. van den Akker
2ccf8bd731 Shorewall-lite: Bump to version 5.2.3.4
Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>
2019-08-30 14:09:15 +02:00
W. van den Akker
05f2522986 Shorewall-core: Bump to version 5.2.3.4
Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>
2019-08-30 14:08:48 +02:00
Christian Lachner
1741f2cff3 haproxy: Update HAProxy to v2.0.5
- Update haproxy download URL and hash
- Add new patches

Signed-off-by: Christian Lachner <gladiac@gmail.com>
2019-08-30 07:55:43 +02:00
Dirk Brenken
dc02cb3da5 travelmate: update 1.4.12
* automatically add open uplinks to your wireless config,
  e.g. hotel captive portals (disabled by default)
* shift net status check in a separate function
* (s)hellcheck cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1d90509b03)
2019-08-30 07:41:13 +02:00
Dirk Brenken
64e9596724 adblock: update 3.8.4
* fix the 'adb_sysver' output
* pass the adblock version information to the helper scripts correctly

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 161597f2fa)
2019-08-30 07:37:54 +02:00
Dirk Brenken
b74b5b1a3b adblock: update 3.8.3
* fix a dns restart issue if 'flush dns cache' is set
* fix a suspend/resume issue, the status wasn't properly updated
* fix a long standing query issue
* rework return code handling, mostly for debugging
* various cleanups & cosmetics

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 95189994e7)
2019-08-30 07:37:46 +02:00
Andreas Nilsen
749684cd25 hcxdumptool: fix missing directory
Signed-off-by: Andreas Nilsen <adde88@gmail.com>
2019-08-26 20:06:56 +02:00
Andreas Nilsen
c685d079ee hcxtools: Added both hcxtools and hcxdumptool to openwrt-19.07 branch.
Signed-off-by: Andreas Nilsen <adde88@gmail.com>
2019-08-25 18:32:29 +02:00
Dirk Brenken
3dc3f15d30 adblock: update 3.8.2
* background service: no longer miss "signal" events for the
  dns backend (to trigger adblock)
* fix a dns backend reload issue during switch between
  different blocking modes
* domain query: report found domains only once in
  "null" blocking mode with IPv4 & IPv6 list entries

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 806f5ca9d8)
2019-08-23 06:50:11 +02:00
Dirk Brenken
41a1b013fa adblock: update 3.8.1
* fix a possible race condition during DNS file reset on slow hardware
* optimize DNS restart behaviour in 'null' blocking mode
* mute useless warnings

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 866878aa78)
2019-08-23 06:49:06 +02:00
Dirk Brenken
641318d5c5 adblock: release 3.8.0
* add support for 'DNS File Reset', where the final DNS blockfile
  will be purged after DNS backend loading (save storage space).
  A small background service will be started to trace/handle
  dns backend reloads/restarts
* add support for the 'null' blocking variant in dnsmasq
  (via addn-hosts), which may provide better response times
  in dnsmasq
* enhance the report & search engine to support
  the new blocking variants. Search now includes
  backups & black-/whitelist as well
* compressed source list backups are now mandatory (default to '/tmp')
* speed up TLD compression
* E-Mail notification setup is now integrated in UCI/LuCI
* update the LuCI frontend to reflect all changes (separate PR)
* drop preliminary dnscrypt-proxy-support (use dnsmasq instead)
* drop additional 'dnsjail' blocklist support (not used by anyone)
* procd cleanups in init
* various shellcheck cleanups
* update readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 504412ccdb)
2019-08-23 06:46:51 +02:00