Merge pull request #5233 from wigyori/for-15.05-bind

CC: bind: bump to 9.11.2

bind: bring back PKG_MD5SUM for CC

Signed-off-by: Zoltan HERPAI <[email protected]>

bind: version update to 9.11.2

Also refresh patches and dependencies.

Signed-off-by: Philip Prindeville <[email protected]>

bind: Update to 9.10.5-P3

New upstream release includes fixes for the following security issues:

 * CVE-2017-3140: With certain RPZ configurations, a response with TTL 0 could
   cause named to go into an infinite query loop
 * CVE-2017-3142: An error in TSIG handling could permit unauthorized zone
   transfers or zone updates.
 * CVE-2017-3143: An error in TSIG handling could permit unauthorized zone
   transfers or zone updates.

Signed-off-by: Noah Meyerhans <[email protected]>

bind: Include dnssec-settime in bind-dnssec/tool

<net/bind>

Maintainer: @nmeyerhans
Compile tested: x86_64, OpenWRT 50107
Run tested: x86 / 64, OpenWRT 50107

Description:

Added dnssec-settime into bind-dnssec and bind-tools

Signed-off-by: Sami Olmari <[email protected]>

bind: Update to bind-9.10.5

This change includes fixes for several security issues:

  * CVE-2017-3138: rndc "" could trigger an assertion failure in named.
  * CVE-2017-3137: Some chaining (i.e., type CNAME or DNAME) responses to
    upstream queries could trigger assertion failures.
  * CVE-2017-3136: dns64 with break-dnssec yes; can result in an assertion
    failure.
  * CVE-2017-3135: If a server is configured with a response policy zone
    (RPZ) that rewrites an answer with local data, and is also configured
    for DNS64 address mapping, a NULL pointer can be read triggering a
    server crash.
  * CVE-2016-9444: named could mishandle authority sections with missing
    RRSIGs, triggering an assertion failure.
  * CVE-2016-9131: named mishandled some responses where covering RRSIG
    records were returned without the requested data, resulting in an
    assertion failure.
  * CVE-2016-9131: named incorrectly tried to cache TKEY records which could
    trigger an assertion failure when there was a class mismatch.
  * CVE-2016-8864: It was possible to trigger assertions when processing
    responses containing answers of type DNAME.
  * CVE-2016-6170: Added the ability to specify the maximum number of
    records permitted in a zone (max-records #;). This provides a mechanism
    to block overly large zone transfers, which is a potential risk with
    slave zones from other parties.
  * CVE-2016-2776: It was possible to trigger an assertion when rendering a
    message using a specially crafted request.
  * CVE-2016-2775: Calling getrrsetbyname() with a non absolute name could
    trigger an infinite recursion bug in lwresd or named with lwres
    configured if, when combined with a search list entry from resolv.conf,
    the resulting name is too long.

Signed-off-by: Noah Meyerhans <[email protected]>

bind: update to bind-9.10.4-P5

This change fixes multiple denial-of-service vulnerabilities:
 * CVE-2016-9131: A malformed response to an ANY query can cause an
   assertion failure during recursion
 * CVE-2016-9147: An error handling a query response containing
   inconsistent DNSSEC information could cause an assertion failure
 * CVE-2016-9444: An unusually-formed DS record response could cause
   an assertion failure
 * CVE-2016-9778: An error handling certain queries using the
   nxdomain-redirect feature could cause a REQUIRE assertion failure
   in db.c

Signed-off-by: Noah Meyerhans <[email protected]>

bind: disable libjson support

If libjson-c is detected during bind-libs configure phase, bind-libs
will be built with libjson support. This results in a missing dependency
error during install phase. Solve this by disabling libjson support.

bind: set sysconfdir to /etc/bind

Signed-off-by: Noah Meyerhans <[email protected]>

Merge pull request #5081 from wigyori/for-15.05-mxml3

CC: upgrade mxml, update download URL

Merge pull request #5103 from wigyori/for-15.05-wifidog

CC: wifidog: upgrade to 1.3.0 to fix build

Merge pull request #5086 from wigyori/for-15.05-fdm2

CC: mail/fdm: update download URL

Merge pull request #5099 from wigyori/for-15.05-taskwarrior

CC: utils/taskwarrior: upgrade to 2.4.4

Merge pull request #5095 from wigyori/for-15.05-perl

CC: upgrade a couple perl packages

Merge pull request #5101 from wigyori/for-15.05-tor

CC: net/tor: fix build and upgrade to 0.2.9.11

Merge pull request #5108 from wigyori/for-15.05-php

CC: php: upgrade to 5.6.32
LGTM2, thanks.

Merge pull request #5111 from wigyori/for-15.05-nginx

CC: nginx: upgrade to 1.12.1

Merge pull request #5080 from wigyori/for-15.05

CC: update download URLs for various packages

Merge pull request #5078 from wigyori/for-15.05-neon

CC: upgrade libs/neon

Merge pull request #5094 from wigyori/for-15.05-pianod

CC: fix pianod build

Merge pull request #5098 from wigyori/for-15.05-stunnel

CC: net/stunnel: fix download source and upgrade

Merge pull request #5093 from wigyori/for-15.05-libupnpp

CC: upmpdcli/libupnpp upgrade

Merge pull request #5112 from wigyori/for-15.05-sshfs

CC: sshfs: upgrade to 2.10

sshfs: upgrade to 2.10

Signed-off-by: Zoltan HERPAI <[email protected]>

nginx: update lua-nginx to cdd2ae921f67bf396c743406493127be496e57ce
 - fixes lua compilation issue

Signed-off-by: Thomas Heil <[email protected]>

nginx: update to 1.12.1
Fixes: CVE-2017-7529
remove PKG_MD5SUM as it is deprecated

Signed-off-by: Uwe Arnold <[email protected]>

nginx: update to 1.12.0, the latest stable version

This is a straightforward update to the latest stable version.

Signed-off-by: Val Kulkov <[email protected]>

nginx: update to 1.10.3, add new module options

Update nginx to version 1.10.3.

Add new configuration options to enable the following optional
modules (disabled by default):
   - http_auth_request_module
   - http_v2_module
   - http_realip_module
   - http_secure_link_module

Signed-off-by: Val Kulkov <[email protected]>

nginx: bump version to latest stable 1.10.2

Signed-off-by: heil <[email protected]>

nginx: Bumped nginx-naxsi to v0.54

Signed-off-by: Graham Fairweather <[email protected]>

nginx: Bumped to v1.10.1
fixes NULL pointer dereference while writing client request body vulnerability (CVE-2016-4450).

Signed-off-by: Graham Fairweather <[email protected]>

nginx: change start level to 80

Signed-off-by: Dirk Feytons <[email protected]>

nginx: correct f3c7cc6

Signed-off-by: Dirk Feytons <[email protected]>

nginx: correct errors from previous merge

Signed-off-by: heil <[email protected]>

nginx: upstep to 1.10.0, add Lua module, footprint optimizations

Signed-off-by: Dirk Feytons <[email protected]>

nginx: bump to version 1.9.13

Signed-off-by: heil <[email protected]>

nginx: add naxsi module

 - this brings back naxsi support aka WAF for nginx

Signed-off-by: heil <[email protected]>

nginx: upstep to 1.9.9

Signed-off-by: Dirk Feytons <[email protected]>

nginx: bump to 1.9.6

In this bump as agreed with Thomas we are dropping out all the nginx 3rd party
addons. In case you would like to see your 3rd party addon included please send
a pull request and make sure it works with newest version.

Signed-off-by: Luka Perkov <[email protected]>

nginx: add support for SPNEGO authentication

This adds a module suitable for Kerberos SSO, e.g. for integrating
into Active Directory domains.

Signed-off-by: Paul Fertser <[email protected]>

nginx: fix musl compatibility

 - include Patches according to issue #1129
 - refresh Makefile

Signed-off-by: heil <[email protected]>

rtklib: fix repository and bump version (fixes #3212)

Signed-off-by: Nuno Goncalves <[email protected]>

rtklib: bump version to 2.4.2 p11, close #1624

Signed-off-by: Nuno Goncalves <[email protected]>

php5: bump to 5.6.32

Fixes since 5.6.26:
 - ton of bugs
 - CVE-2016-9933
 - CVE-2016-9934
 - CVE-2016-9935
 - CVE-2016-10158
 - CVE-2016-10167
 - CVE-2016-10168
 - CVE-2016-10159
 - CVE-2016-10160
 - CVE-2016-10161
 - CVE-2017-7890
 - CVE-2017-9224
 - CVE-2017-9226
 - CVE-2017-9227
 - CVE-2017-9228
 - CVE-2017-9229
 - CVE-2016-1283

Signed-off-by: Zoltan HERPAI <[email protected]>

php5: update to 5.6.26

This fixes the following CVEs:
 - in intl: CVE-2016-7416
 - in mysqlnd: CVE-2016-7412
 - in phar: CVE-2016-7414
 - in spl: CVE-2016-7417
 - in standard: CVS-2016-7411
 - in wddx: CVE-2016-7413, CVE-2016-7418

Signed-off-by: Michael Heimpold <[email protected]>

php5: update to 5.6.25

Signed-off-by: Michael Heimpold <[email protected]>

php5: update to 5.6.23

This fixes the following CVEs:
 - in GD: CVE-2015-8874, CVE-2016-5766, CVE-2016-5767
 - in mbstring: CVE-2016-5768
 - in mcrypt: CVE-2016-5769
 - in SPL: CVE-2016-5770, CVE-2016-5771
 - in WDDX: CVE-2016-5772
 - in zip: CVE-2016-5773

Signed-off-by: Michael Heimpold <[email protected]>

php5: update to 5.6.21

This fixes the following CVEs:
 - in BCMath: CVE-2016-4537, CVE-2016-4538
 - in EXIF: CVE-2016-4542, CVE-2016-4543, CVE-2016-4544
 - in GD: CVE-2016-3074
 - in Intl: CVE-2016-4540, CVE-2016-4541
 - in XML: CVE-2016-4539

Signed-off-by: Michael Heimpold <[email protected]>

php5: add mod_intl (resolves #2620)

Signed-off-by: Michael Heimpold <[email protected]>

php5: update to 5.6.19

Signed-off-by: Michael Heimpold <[email protected]>

php5: update to 5.6.18

Note: Upstream tagged this as security release.

Signed-off-by: Michael Heimpold <[email protected]>

wifidog: Bump to 1.3.0

* Updates wifidog to latest upstream release.
* Removes patches/100-musl-compat.patch as that's included in 1.3.0

Signed-off-by: Michael Haas <[email protected]>

wifidog: fix musl compatibility

 - Fix missing `fcntl.h` in `protocol.c`
 - Replace nonstandard `sys/unistd.h` includes with `unistd.h` ones

Signed-off-by: Jo-Philipp Wich <[email protected]>

Merge pull request #5100 from wigyori/for-15.05-tracertools

CC: tracertools: use new git HEAD

tracertools: use new git HEAD

gitorious archive became available, so I could import the project
history from there into the new repo on github. Rebasing the changes
made since 2014 on top of the original git tree obviously caused
the commit hashes to differ.

Signed-off-by: Daniel Golle <[email protected]>

tracertools: update source, fixes bug on little-endian systems

and improves collectd support

Signed-off-by: Daniel Golle <[email protected]>

tracertools: update source

Signed-off-by: Daniel Golle <[email protected]>

tor: update to version 0.2.9.11

This fixes CVE-2017-0376

Signed-off-by: Hauke Mehrtens <[email protected]>

tor: update to version 0.2.9.10

Signed-off-by: Hauke Mehrtens <[email protected]>

tor: update to version 0.2.9.9

Signed-off-by: Hauke Mehrtens <[email protected]>

tor: log to syslog by default

Make tor log to syslog by default instead of stdout.

Signed-off-by: Hauke Mehrtens <[email protected]>

tor: add tor-gencert, tor-resolve and torify

These are some additional applications build by the tor package.

Signed-off-by: Hauke Mehrtens <[email protected]>

tor: add geoip6 to tor-geoip

This add the IPv6 addresses to the tor-geoip6 package.

Signed-off-by: Hauke Mehrtens <[email protected]>

tor: preserve tor keys over sysupgrade

Mark the directories containing the keys for hidden services as
conffiles to preserve them over sysupgrade.

Fixes: #2247
Signed-off-by: Hauke Mehrtens <[email protected]>

tor: update to version 0.2.9.8

In addition update some configure options and use EXTRA_CFLAGS.
Setting RunAsDaemon to 1 will be overwritten by the init script option
"--runasdaemon 0" anyway and we want it in foreground for procd.

Signed-off-by: Hauke Mehrtens <[email protected]>

tor: update to version 0.2.8.11

Signed-off-by: Hauke Mehrtens <[email protected]>

Tor: update to 0.2.8.9

    - update to 0.2.8.9
    - use sha256 instead of md5 for integrity check
    - add dependency: libcap

signed-off-by: Nima Fatemi <[email protected]>

tor: add missing zlib dependency

Signed-off-by: Felix Fietkau <[email protected]>

tor: correct URL for dist downloads

Original url was 404.
Fixes Github issue #2284

tor: remove tor-fw-helper

The "internal pure-C" tor-fw-helper was removed in 0.2.7.5. This removes
the tor-fw-helper package and references to its dependencies.

Signed-off-by: Jeffery To <[email protected]>

taskwarrior: update to 2.4.4

Signed-off-by: Luka Perkov <[email protected]>

stunnel: use archive/ as download source

Anything below 5.43 is archived, update download source
to use paths accordingly.

Signed-off-by: Zoltan HERPAI <[email protected]>

stunnel: add missing zlib dependency

Signed-off-by: Felix Fietkau <[email protected]>

stunnel: Update from 5.14 to 5.20

* 010_fix_getnameinfo.patch is no longer needed
* 011-cron-without-pthread-fix.patch added, fixes incorrect
  ifdef when building without pthreads

Signed-off-by: Michael Haas <[email protected]>

stm32flash: move download source

code.google is not available anymore, move to use SF.

Signed-off-by: Zoltan HERPAI <[email protected]>

net/sslh: move download source

The old download source was pulled from the net, move to github.

Signed-off-by: Zoltan HERPAI <[email protected]>

snort: update download source

2.9.7.2 was moved into the archive section, update
source accordingly until someone upgrades it.

Signed-off-by: Zoltan HERPAI <[email protected]>

bind: update to 9.10.4-p4

Signed-off-by: Noah Meyerhans <[email protected]>

bind: Set PKG_USE_MIPS16:=0

bind: Update to 9.9.9-p3 for CVE-2016-2776

Signed-off-by: Noah Meyerhans <[email protected]>

net/bind: PKG_RELEASE increased

Signed-off-by: DonkZZ <[email protected]>

net/bind:  Update db.root

The contents of the file "db.root" is very old (12 years).
Here's a new version downloaded from ftp://ftp.internic.net/domain/

Signed-off-by: DonkZZ <[email protected]>

net/bind: Little cleaning in named.init

The variable "config_file" appears twice.

Signed-off-by: DonkZZ [email protected]

bind: Update to 9.9.8-P4 to resolve CVE-2016-1285 and CVE-2016-1286

Signed-off-by: Noah Meyerhans <[email protected]>

perl-dbi: bump to 1.634

As the previous sources were pulled from the net, bump to this
version.

Signed-off-by: Zoltan HERPAI <[email protected]>

perl-www-mechanize: bump to 1.75

As the previous sources were pulled from the net, bump to this
version.

Signed-off-by: Zoltan HERPAI <[email protected]>

perl-uri: bump to 1.71

As the previous sources were pulled from the net, bump to this
version.

Signed-off-by: Zoltan HERPAI <[email protected]>

pianod: Remove svn version check from builds

Signed-off-by: Ted Hess <[email protected]>

pianod: Fix build/download order

Signed-off-by: Ted Hess <[email protected]>

pianod: Update to latest version, refresh patches

Signed-off-by: Ted Hess <[email protected]>

oggfwd: update download source

upstream changed from git:// to https://

Signed-off-by: John Crispin <[email protected]>

netperf: move source to use github

With netperf.org's FTP gone, and the main site showing the source
has migrated to github, let's use it.

Signed-off-by: Zoltan HERPAI <[email protected]>

lua-sha2: switch to Github repository

The original Google Code repository is not available anymore, use the
equivalent Github repository instead.

Signed-off-by: Jo-Philipp Wich <[email protected]>

upmpdcli/libupnpp: Update to latest versions, refresh patch

upmpdcli: Version 1.1.3
libupnpp: Version 0.14

Signed-off-by: Ted Hess <[email protected]>

upmpdcli: Bump version to 0.11.0

upmpdcli 0.11 mainly improves on the Songcast support, in
complement with the changes in sc2mpd. Especially, it now
includes an utility (scctl) and web interface to set up
multi-room Songcast.

Signed-off-by: Petko Bordjukov <[email protected]>

libupnpp: Bump version to 0.11.0

This new version introduces improvements to the OpenHome support.

Signed-off-by: Petko Bordjukov <[email protected]>

libuv: move download URL to https

When using IPv6 and http://, the site redirects to https://nodejs.org
which doesn't have the dist sources. IPv4 does not have this problem.
Use https directly.

Signed-off-by: Zoltan HERPAI <[email protected]>

libesmtp: add ssl support, new upstream URL

Signed-off-by: Othmar Truniger <[email protected]>

libdnet: fix source URL
Signed-off-by: Alexander Ryzhov <[email protected]>

Merge pull request #5079 from wigyori/for-15.05-crtmpd

CC: multimedia/crtmpserver: fix build