Fixes CVE-2018-11233 and CVE-2018-11235

Signed-off-by: Peter Wagner <tripolar@gmx.at>

Add the possibility to use Unbound auto-zone: clause to
fetch complete root, arpa, in-addr.arpa, and ip6.arpa
zone files. This can speed up recursion when users
access many ccTLD or connection logging hits many PTR.

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>

Some resource options bundled many Unbound.conf options and
made customizing on top of UCI difficult. Make it easier to
use Unbound built defaults (blank conf sections).

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>

Fixes the following CVEs:
- CVE-2018-5388
- CVE-2018-10811

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

Signed-off-by: Peter Wagner <tripolar@gmx.at>

It's a python script and requires backtrace support when building
openvswitch which requires glibc.

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

The overlay and underlay driver, and ovs-docker utilities requires setup
and dependencies that are just not available in known maintained state.

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

Mainly a bugfix for XSS. Patches have been refreshed.

Added an upstream fix for TLS verification. Now enabled by default.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Moritz Warning <moritzwarning@web.de>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

Signed-off-by: Hsing-Wang Liao <kuoruan@gmail.com>

Signed-off-by: Moritz Warning <moritzwarning@web.de>

Signed-off-by: Moritz Warning <moritzwarning@web.de>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: Daniel Salzman <daniel.salzman@nic.cz>

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Only execute an ifup event with the command "mwan3 ifup <iface>" if the
l3_device is found in the ubus "network.interface.<iface>".

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Remove unnecessary logging if mwan3track pid is not found

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Add or remove local_source ip also if mwan3 is stopped or started

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

backend:
* add generic blocklist archive support
* add support for blacklist archive from Toulouse 1 University Capitole
* add support for urlhaus RPZ domains by abuse.ch
* small bugfixes & enhancements

luci:
* archive sub-categories (shalla & ut_capitole) are now configurable
  via LuCI CBI template
* small bugfixes & enhancements

Signed-off-by: Dirk Brenken <dev@brenken.org>

Signed-off-by: Peter Wagner <tripolar@gmx.at>

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

Update to new upstream version. Also changed to Cloudflare's DNS as default.

Signed-off-by: David Mora <iamperson347+public@gmail.com>

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

- Add valid responses "good|nochg" so that ddns-script could recognize "badauth"
   error that comes with http 200 code
 - Switch url to https scheme. "now-dns.com" always returns 302 redirect
   to https:// for all plain-text http requests. Since working via default
   plain-text http is not possible anyway, forcing url to https prevents
   curl sending unencrypted plain-text credentials via basic auth

Signed-off-by: Emil Muratov <gpm@hotplug.ru>

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

The normal situation should be to use ping without quality_check.
If quality_check option is not set in the default option then ping
quality_check is not performed during tracking. This is and should
be the default situation.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Unify logging output for tracking methode ping.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Fix indentation.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Replace legancy backticks syntax shell execution with braces.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Remove needless log output this will pollute the logging.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

1. Test link quality based on packet loss & latency w.r.t. pre-defined high and low watermark values.
2. Extended ubus support to provide packet loss & latency information per wan per track_ip

Signed-off-by: Nishant Sharma <codemarauder@gmail.com>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Move default leasefile location from /var to /var/run.
Also rename from upnp.leases to miniupnpd.leases

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

Building with --gc-sections & -flto drop ipk size from 72600 to 66345
on MIPS

No misbehaviour due to these optimisations observed.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

Update to new upstream stable version 1.4.4

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Bumping to latest release.  No (used) functional difference.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>