libreswan: various fixes

mariadb: minor verison bump with CVE fixes

Upstream added define INSTALL_PAMDATADIR, so hardcoded path is gone.

Fixes:

  CVE-2020-2752
  CVE-2020-2812
  CVE-2020-2814
  CVE-2020-2760

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

syslog-ng: restore service "reload" to actually working

netatop: update to version 3.1

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

libwebp: fix compilation under ARM without NEON

start if kernel has missing ipv6 support
add libcap-ng support
fix some errors displayed on syslog

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

The CMake logic seems broken. Luckily it's easy to work around.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

libcap-ng: add package libcap-ng

golang: Update to 1.14.3

This also removes a (useless) test for PKG_GO_ZBOOTSTRAP_MODS (it is
always non-empty).

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

apache: tighten log dir + suEXEC

nss: revert -flto change

it seems that it can lead to segfault in libfreebl3.so

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

When adding suEXEC to the apache package, Alpine's package [1] served as
a template. Not enough attention was paid to the details.

Alpine uses a different layout. So for OpenWrt to use /var/www as
DocumentRoot does not make sense. /var is also volatile on OpenWrt. This
commit removes the configure argument. The default is htdocsdir.

This also does away with uidmin/gidmin 99. The default is 100, which is
fine.

Finally, the suexec binary is moved from /usr/sbin to
/usr/lib/apache2/suexec_dir. Upstream recommends installing suexec with
"4750" (see [2]) and the group set to the user's group. While that would
be possible, it would cause a few headaches on OpenWrt. The group would
need to be changed first in a post-install script and a call to chmod
would need to be made afterward, to make the binary SUID again.

It's easier to hide the SUID binary away from others in a directory.
This way we don't need to use chmod in the post-install script.

[1] https://github.com/alpinelinux/aports/tree/master/main/apache2
[2] https://httpd.apache.org/docs/2.4/suexec.html

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

Hides away the contents of the log directory from others.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

This fixes:
  - CVE-2019-11048

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Shorewall: Bump to 5.2.4.5

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

nss: add -flto and makefile cleanup

nspr: nspr add -flto to compile

open-vm-tools: bump to version 11.1.0

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

libreswan: update to 3.32

nextdns: Update to version 1.5.8

npupnp updates

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

python-atomicwrites: update to version 1.4.0

faad2: update to 2.9.2

golang: Various improvements/tweaks

Signed-off-by: Kagurazaka Kotori <kagurazakakotori@gmail.com>

python3: Add script to help find standard library dependencies

This adds a script that searches a Python package's source code to find
imports for separately-packaged standard library modules.

The script can be run by calling make with the configure target and
"PY3=stdlib V=s" arguments, e.g.

    make package/python3-lxml/configure PY3=stdlib V=s

This also updates the readme on how to call this script, as well as more
information on Python package dependencies in general.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

also add -flto to compiler flags

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

Because the first stage for building target Go is actually a host build,
the default platform options (GO386, GOARM, etc.) are detected from the
host. These values are written to a source file and kept when building
the second stage.

This modifies this source file to set the appropriate values for the
target platform, and reset values for other platforms to their
cross-compiling / most compatible defaults.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

etesync-server: add package and configuration for running with uwsgi on nginx [RFC]

redis: update to version 6.0.1

gerbera: set config file to 600 permissions

Only gerbera needs to read the file.

Added config file to conffiles to fix opkg update support.

Added several extra options to the UCI config. Manual editing is still required.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Note:
add explicit -latomic on 32-bit MIPS because 32-bit MIPS is not able to perform 64-bit atomics in hardware

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>