unbound: update to 1.16.2, fix CVE-2022-30698, CVE-2022-30699

One of common use cases for SMB3 server in routers is sharing hotplugged
drives. Users make many attempts setting that up which often are not
optimal.

This script handles it in the cleanest way by using:
1. hotplug.d mount subsystem
2. runtime config in the /var/run/config/

It provides a working basic solution that can be later adjusted by
modifying provided hotplug script.

A pretty much idential solution was part of the samba36 package. It was
added in the OpenWrt commit ef1efa756e0d0 ("samba36: add package with
hotplug.d script for auto sharing") as an answer for feature required by
the Rosinson company.

Cc: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

Dynamically created shares shouldn't be stored in the /etc/config/
because of:
1. Flash wearing
2. Risk of inconsistent state on reboots

With this change all automation/hotplug.d scripts can store runtime in
the /var/run/config/samba. It's useful e.g. for USB drives that user
wants to be automatically shared.

Also: automated scripts should never call "uci [foo] commit" as that
could flush incomplete config. This problem also gets solved.

Identical feature was added to samba36 in the OpenWrt commit
5a59e2c059866 ("samba36: append config from /var/run/config/ for runtime
shares") but wasn't ported to ksmbd until now.

Cc: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

strongswan: bundle mgf1 with everything

Remove nft rules file generated by ss-rules if ss-rules was or should be
turned off for by configuration.  Use "fw4 restart" instead of "fw4
reload" to force the runtime rule reloading

Ref: https://github.com/openwrt/packages/pull/17937#issuecomment-1207357037

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

Supersedes: https://github.com/openwrt/packages/pull/18852
Fixes: https://github.com/openwrt/packages/issues/18850

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

strongswan: try to model kdf optional dependencies

Signed-off-by: Noel Kuntze <noel.kuntze@thermi.consulting>

901b0f0 main: fix two one-byte overreads in header_value()
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

strongswan: Update to 5.9.7

watchcat: fix broken ping invocation for no-address-family configuration

prometheus-node-exporter-lua: add realtek-poe exporter

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

php8: update to 8.1.9

exposes PoE metrics obtained from realtek-poe

 # HELP realtek_poe_switch_info information about the poe controller
 # TYPE realtek_poe_switch_info gauge
 realtek_poe_switch_info{mcu="ST Micro ST32F100 Microcontroller",firmware="v22.4"} 1

 # HELP realtek_poe_switch_budget_watts overall power budget
 # TYPE realtek_poe_switch_budget_watts gauge
 realtek_poe_switch_budget_watts 77

 # HELP realtek_poe_switch_consumption_watts overall power consumption
 # TYPE realtek_poe_switch_consumption_watts gauge
 realtek_poe_switch_consumption_watts 5

 # HELP realtek_poe_port_priority poe priority of port
 # TYPE realtek_poe_port_priority gauge
 realtek_poe_port_priority{device="lan1"} 1
 realtek_poe_port_priority{device="lan2"} 1
 [...]

 # HELP realtek_poe_port_consumption_watts per port power consumption
 # TYPE realtek_poe_port_consumption_watts gauge
 realtek_poe_port_consumption_watts{device="lan1"} 0
 realtek_poe_port_consumption_watts{device="lan2"} 0
 [...]

 # HELP realtek_poe_port_state per port poe state
 # TYPE realtek_poe_port_state gauge
 realtek_poe_port_state{device="lan1",state="Disabled"} 0
 realtek_poe_port_state{device="lan1",state="Searching"} 1
 [...]
 (states: Disabled, Searching, Delivering power, Fault, Other fault, Requesting power)

 # HELP realtek_poe_port_mode per port poe mode
 # TYPE realtek_poe_port_mode gauge
 realtek_poe_port_mode{device="lan1",mode="PoE"} 0
 realtek_poe_port_mode{device="lan1",mode="PoE+"} 1
 [...]
 (modes: PoE, Legacy, pre-PoE+, PoE+)
Signed-off-by: Gregor Michels <hirnpfirsich@brainpeach.de>

squashfs-tools: enable zstd compression by default

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

OpenConnect proxy support

We can only utilize statistics from interfaces having ubus interface.
Signed-off-by: Nick Hainke <vincent@systemli.org>

prometheus-node-exporter-lua: Added selinux.lua.

Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>

Allow connection via a proxy server (required on some sites where
direct outbound HTTP(S) access is not permitted).
Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>

gnutls: update to 3.7.7

- libgnutls: Fixed double free during verification of pkcs7 signatures.
  Reported by Jaak Ristioja (#1383). [GNUTLS-SA-2022-07-07, CVSS: medium]
  [CVE-2022-2509]

- libgnutls: gnutls_hkdf_expand now only accepts LENGTH argument less than or
  equal to 255 times hash digest size, to comply with RFC 5869 2.3.

- libgnutls: Length limit for TLS PSK usernames has been increased
  from 128 to 65535 characters (#1323).

- libgnutls: AES-GCM encryption function now limits plaintext
  length to 2^39-256 bits, according to SP800-38D 5.2.1.1.

- libgnutls: New block cipher functions have been added to transparently
  handle padding.  gnutls_cipher_encrypt3 and gnutls_cipher_decrypt3 can be
  used in combination of GNUTLS_CIPHER_PADDING_PKCS7 flag to automatically
  add/remove padding if the length of the original plaintext is not a multiple
  of the block size.

- libgnutls: New function for manual FIPS self-testing.

API and ABI modifications:
- gnutls_fips140_run_self_tests: New function
- gnutls_cipher_encrypt3: New function
- gnutls_cipher_decrypt3: New function
- gnutls_cipher_padding_flags_t: New enum
Signed-off-by: Nick Hainke <vincent@systemli.org>

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Signed-off-by: Espen Jürgensen <espenjurgensen+openwrt@gmail.com>

makes LuaJit builds for mpc85xx targets with SPE ISA extension
enabled possible

Quoting inner commit message:

This allows building LuaJit for systems with Power ISA SPE
extension[^1] support by using soft float on LuaJit side.

While e500 CPU cores support SPE instruction set extension
allowing them to perform floating point arithmetic natively,
this isn't required. They can function with software floating
point to integer arithmetic translation as well,
just like FPU-less PowerPC CPUs without SPE support.

Therefore I see no need to prevent them from running LuaJit
explicitly.

[^1]: https://www.nxp.com/docs/en/reference-manual/SPEPEM.pdf

Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>

Requested via:
  https://github.com/openwrt/packages/issues/19111



PKG_RELEASE is set to AUTORELEASE, so no need to bump.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>

python-paho-mqtt: add missing dependency

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

lcdproc: don't enable LPT support on non-x86 architectures

fail2ban: fix patch for python 3.10

Avoid building unused package dependencies

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

The uuid module has been split out into a separate package with the
update to Python 3.10.
Signed-off-by: Jan Hoffmann <jan@3e8.eu>

Signed-off-by: Clark Wang <dearvoid@gmail.com>

Signed-off-by: Javier Marcet <javier@marcet.info>

Signed-off-by: Javier Marcet <javier@marcet.info>