upmpdcli updates

sshfs: update to 3.7.1

lxc: update to 4.0.5

memcached: update to 1.6.8

dirmngr is needed to download keys from keyservers.
That being a useful thing, let's package dirmngr.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

canutils: update to 2020.11.0

snort: update to 2.9.16.1

Snort3 updates

Add missing header for musl.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Renamed j* tools to their new versions.

Remove upstreamed patches.

Add missing time.h header.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Refreshed patches.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Remove CMAKE_INSTALL. No need for it.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Remove unnecessary patch. The issue was with fuse3.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Fixes for status files not being written, seen on OpenWrt
Fixes for compiler warnings, seen on OpenWrt

Full changelog: https://github.com/pagekite/libpagekite/compare/v0.91.200718...v0.91.201110

Signed-off-by: Karl Palsson <karlp@tweak.net.au>

Four fixes tagged as security, full changelog at https://c-ares.haxx.se/changelog.html#1_17_0
Includes fix for CVE-2020-8277

Signed-off-by: Karl Palsson <karlp@tweak.net.au>

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

php7-pecl-krb5: update to 1.1.4

openldap: update to 2.4.56

GStreamer updates

nfdump: update to 1.6.21

dmapd: update 0.0.86

krb5: update to 1.18.3

vips: update to 8.10.2

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Signed-off-by: W. Michael Petullo <mike@flyn.org>

Ship podman with defaults more coherent with user expectations and
more likely to work out-of-the-box.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Deleting rules that docker has created is error-prone, because with
every update docker we have  to check if anything has changed.
Cleaning up the firewall rules is part of the docker and should and must be
cleaned up and handeled by them when the service is terminated.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

If docker-ce handles the firewall and fw3 is not envolved because the
rules get not proceed, then not only docker0 should be handled but also
other interfaces and therefore other docker networks.

This commit extends the handling and introduces a new uci option
`device` in the docker config firewall section. This can be used to specify
which device is allowed to access the container. Up to now only docker0
is covert.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

As the protocol is set to none, this makes no sense here, as it cannot
be controlled and thus processed by the netifd.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Set proto from `static` to `none`. This makes it clear that this
interface is not handled by the netifd.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

Openwrt has a own firewall service called fw3, that supports firewall zones.
Docker can bypass the handling of the zone rules in openwrt via custom
tables. These are "always" processed before the openwrt firewall.
Which is prone to errors!

Since not everyone is aware that the firewall of openwrt will
not be passed. And this is a security problem because a mapped port is
visible on all interfaces and so also on the WAN side.
If the firewall handling in docker is switched off, then the port in
fw3 must be explicitly released and it cannot happen that the
port is accidentally exported to the outside world via the interfaces on
the WAN zone.

So all rules for the containers should and so must be made in fw3.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>