This makes it consistent with configuration for busybox in IOWRT and
is needed for compatibility with pam_unix which lacks bcrypt support.

Resolves: #22632

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>

(cherry picked from commit 3be58aa1d317877415c810bc8dc6a43030064a64)

Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
(cherry picked from commit ee47bf4a5202f610251c7192b219481ee2d84dfe)

Cryptsetup 2.6.1 Release Notes
==============================
Stable bug-fix release with minor extensions.

All users of cryptsetup 2.6.0 should upgrade to this version.

Changes since version 2.6.0
~~~~~~~~~~~~~~~~~~~~~~~~~~~

* bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  (found by new cryptsetup OSS-Fuzz fuzzers).
  - Fix a possible memory leak if the metadata contains more than
    one description field.
  - Harden parsing of metadata entries for key and description entries.
  - Fix broken metadata parsing that can cause a crash or out of memory.

* Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto backend.
  OpenSSL2 uses a signed integer for PBKDF2 iteration count.
  As cryptsetup uses an unsigned value, this can lead to overflow and
  a decrease in the actual iteration count.
  This situation can happen only if the user specifies
  --pbkdf-force-iterations option.
  OpenSSL3 (and other supported crypto backends) are not affected.

* Fix compilation for new ISO C standards (gcc with -std=c11 and higher).

* fvault2: Fix compilation with very old uuid.h.

* verity: Fix possible hash offset setting overflow.

* bitlk: Fix use of startup BEK key on big-endian platforms.

* Fix compilation with latest musl library.
  Recent musl no longer implements lseek64() in some configurations.
  Use lseek() as 64-bit offset is mandatory for cryptsetup.

* Do not initiate encryption (reencryption command) when the header and
  data devices are the same.
  If data device reduction is not requsted, this leads to data corruption
  since LUKS metadata was written over the data device.

* Fix possible memory leak if crypt_load() fails.

* Always use passphrases with a minimal 8 chars length for benchmarking.
  Some enterprise distributions decided to set an unconditional check
  for PBKDF2 password length when running in FIPS mode.
  This questionable change led to unexpected failures during LUKS format
  and keyslot operations, where short passwords were used for
  benchmarking PBKDF2 speed.
  PBKDF2 benchmark calculations should not be affected by this change.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 5c21b26a939470a44c25fec7a54416d052def1a9)

Remove downstream patch 004-missing-includes.patch which was merged
upstream in version 2.03.19

LVM2 changelog since version 2.03.17
version 2.03.22 - 02nd August 2023
==================================
  Fix pv_major/pv_minor report field types so they are integers, not strings.
  Add lvmdevices --delnotfound to delete entries for missing devices.
  Always use cachepool name for metadata backup LV for lvconvert --repair.
  Make metadata backup LVs read-only after pool's lvconvert --repair.
  Improve VDO and Thin support with lvmlockd.
  Handle 'lvextend --usepolicies' for pools for all activation variants.
  Fix memleak in vgchange autoactivation setup.
  Update py-compile building script.
  Support conversion from thick to fully provisioned thin LV.
  Cache/Thin-pool can use error and zero volumes for testing.
  Individual thin volume can be cached, but cannot take snapshot.
  Better internal support for handling error and zero target (for testing).
  Resize COW above trimmed maximal size is does not return error.
  Support parsing of vdo geometry format version 4.
  Add lvm.conf thin_restore and cache_restore settings.
  Handle multiple mounts while resizing volume with a FS.
  Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id.
  Enhance lvm_import_vdo and use snapshot when converting VDO volume.
  Fix parsing of VDO metadata.
  Fix failing -S|--select for non-reporting cmds if using LV info/status fields.
  Allow snapshots of raid+integrity LV.
  Fix multisegment RAID1 allocator to prevent using single disk for more legs.

version 2.03.21 - 21st April 2023
=================================
  Fix activation of vdo-pool for with 0 length headers (converted pools).
  Avoid printing internal init messages when creation integration devices.
  Allow (write)cache over raid+integrity LV.

version 2.03.20 - 21st March 2023
=================================
  Fix segfault if using -S|--select with log/report_command_log=1 setting.
  Configure now fails when requested lvmlockd dependencies are missing.
  Add some configure Gentoo enhancements for static builds.

version 2.03.19 - 21st February 2023
====================================
  Configure supports --with-systemd-run executed from udev rules.
  Enhancement for build with MuslC systemd and non-bash system shells (dash).
  Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices.
  Ensure udev is processing origin LV before its thick snapshots LVs.
  Fix and improve runtime memory size detection for VDO volumes.

version 2.03.18 - 22nd December 2022
====================================
  Fix issues reported by coverity scan.
  Fix warning for thin pool overprovisioning on lvextend (2.03.17).
  Add support for writecache metadata_only and pause_writeback settings.
  Fix missing error messages in lvmdbusd.

DM changelog since version 1.02.187:

Version 1.02.196 - 02nd August 2023
===================================

Version 1.02.195 - 21st April 2023
==================================

Version 1.02.193 - 21st March 2023
==================================

Version 1.02.191 - 21st February 2023
=====================================
  Improve parallel creation of /dev/mapper/control device node.
  Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev.
  Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings.

Version 1.02.189 - 22nd December 2022
=====================================
  Improve 'dmsetup create' without given table line with new kernels.

(Version 1.02.188 is missing)

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 4db53132ba66359e25fa6fd29aba87541551adf2)

Backport patch from:
   https://github.com/ColinIanKing/stress-ng/commit/cd84c46ce780242879e8aaa7d698b9cd87996dbd

With GCC 12 there is no issue.
With GCC 13, there is a compilation issue on x86_64.
Fixes https://github.com/openwrt/packages/issues/22373



Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 98bcb56eb3de7ae1ffc1ed66287168750a72a059)

Refreshed 001-disable-extra-stressors.patch
Dropped 002-disable-compiler-test.patch
  - no longer needed since commit https://github.com/ColinIanKing/stress-ng/commit/a24c7f2048548e6e9ded652b0d16a7da37e4edf0



Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit f4df9c1786354698a108b415799a61ac1af4e389)

Merged patches into a single one.
Disabling libmpfr (which got added recently).
To avoid potentially new build failures.

And disabling test-compiler check.

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 8168fc84df6521a33ef220f63dc65e7d01a196a5)

In preparation to PCRE2 fixup, use autoreconf PKG_FIXUP as a better
configure system instead of configure script. This is needed to reduce
upcoming patch to migrate to PCRE2 library.

To correctly use autoreconf it's needed to declare empty
PKG_REMOVE_FILES.

zsh include custom macro in the default aclocal.m4
When autoreconf PKG_FIXUP is used, if PKG_REMOVE_FILES is not defined,
it's set to remove the file aclocal.m4 by default resulting in problem
with the custom macro AC_PROG_LN.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
[ split to 2 commit, add PKG_REMOVE_FILES, reword commit description ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit a7f837c98b0ab3fde1b19283e13a21fdaf1b1ee2)

Backport PCRE2 patches from upstream and move package to PCRE2 library
as PCRE is EOL and won't receive any security update anymore.

Patch are backported with minimal change, only the Changelog change is
commented out as it would conflict and makes no sense to adapt for the
purpose of backport patches.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 5b929fde5f9b8bc2b6e85999c9eb08b5a4295c7f)

Release Notes:
https://github.com/kmod-project/kmod/blob/aff617ea871d0568cc491bd116c0be1e857463bb/NEWS#L1



Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit ca057f3e4e997aa8cd27ab03f97429309b18cbc1)

Bugfixes

 - Fixed a bug involving non-English locales of Windows where machine installs using user-mode networking were rejected due to erroneous version detection (#20209).
 - Fixed a regression in --env-file handling (#19565).
 - Fixed a bug where podman inspect would fail when stat'ing a device failed.

API
 - The network list compat API endpoint is now much faster (#20035).

Openwrt updates: added patch to allow building with musl-1.2.4
Patch source is from gentoo https://github.com/vimproved/gentoo/blob/c4c349f11a4352be1965726eadfe3a8bd8a6fa9c/app-containers/podman/files/podman-4.5.0-fix-build-with-musl-1.2.4.patch



Issue was discussed by @jefferyto at mattn/go-sqlite3#1177

remarks:
removed musl-1.2.4 patch from commit, since that version of musl
is not available with openwrt-23.05

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit e25d417f1a3162bb2ecaad06a6b79ab6afb74659)

v1.2.2 changes:
 - Enabled reproducible builds

v1.2.1 changes:
 - sandbox: Add support for escaping resolv.conf symlinks. This fixes usage in WSL environments which symlinks /etc/resolv.conf under a shared location under /mnt.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 8b3bf5bb88ce00a78312ed2da7dea7efa54de197)

changelog 1.9.2:
 - cgroup: reset the inherited cpu affinity after moving to cgroup. Old kernels do that automatically, but new kernels remember the affinity that was set before the cgroup move, so we need to reset it in order to honor the cpuset configuration.

changelog 1.9.1:
 - utils: ignore ENOTSUP when chmod a symlink. It fixes a problem on Linux 6.6 that always refuses chmod on a symlink.
 - build: fix build on CentOS 7
 - linux: add new fallback when mount fails with EBUSY, so that there is not an additional tmpfs mount if not needed.
 - utils: improve error message when a directory cannot be created as a component of the path is already existing as a non directory.

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit bb3af8acb92e396f181d3f435dd2ca8ac1c9ec30)

Bug fixes:
 - stdio: ignore EIO for terminals
 - ensure console socket buffers are properly sized
 - conmon: drop return after pexit()
 - ctrl: make accept4 failures fatal
 - logging: avoid opening /dev/null for each write
 - oom: restore old OOM score
 - Use default umask 0022

Misc changes:
 - cli: log parsing errors to stderr
 - Changes to build conmon for riscv64
 - Changes to build conmon for ppc64le
 - Fix close_other_fds on FreeBSD

Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit 3d88d18ee2918840b9b05fb27e50587fc9f62b64)

This allows cargo to use make's jobserver when building packages, by
marking the cargo command as recursive (with the + prefix[1]) and
setting MAKEFLAGS.

This also:

* Give cargo/x.py the build directory instead of having to change the
  current directory (and opening subshells)

* Set PKG_BUILD_PARALLEL/HOST_BUILD_PARALLEL for Rust packages to enable
  the use of make's jobserver

[1]: https://www.gnu.org/software/make/manual/html_node/POSIX-Jobserver.html



Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0dfc1b508d5e5b361978ef9783cb63775176c305)
[omit changes to arp-whisper and procs]
Signed-off-by: Jeffery To <jeffery.to@gmail.com>

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit b46ff1fd8a877afc0f36cf7df5b9aae9d15fdb95)

In the OpenWrt routing feed, package bmx6 and luci-app-bmx6 were removed because the LuCI app was vulnerable to several CVEs, as found by dependabot. It has been reporting it for a few months and has even created an issue. These two packages are not maintained in OpenWrt as well in upstream.

Users should switch to the bmx7 package.

Fixes: 9fb9d9343ea27d6dbb5008ece10c0c843dd2c781 ("bmx6: drop package") in the routing feed

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9c2bf859005ada11c17835f74826b356cdb0fb7b)

This package can be built with Go 1.21 and QUIC can be enabled.

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 86522d77f1ccf7ed80ef556e0d6621efbd190275)

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 23113ceb97dbc1ad5d3caba83b72dbb1d0a69a37)

Signed-off-by: Van Waholtz <brvphoenix@gmail.com>
(cherry picked from commit 0449b0f3949e720c7484df5e0569b6ff518e5898)

Release notes:
https://github.com/kdave/btrfs-progs/releases/tag/v6.5.1



Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 16e484cad1d2e9686916c0cfcafd54cf3777378f)

Switch pcre to pcre2
https://github.com/openwrt/packages/issues/22006



Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 3d11e5c197e250f0a32ca813ff07d480b59311d0)

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from commit 0ea5e63b15065b79fc6d9fef799e3947750c8368)

We currently have more package architectures supporting
CPU frequency scaling than earlier, and the package architecture
vs. CPU target SDK matching does not fully reflect that.
(E.g. aarch64_cortex-a53 is currently using bcm27xx/bcm2710)

Simplify things by removing the target dependency and let the plugin
be built for all architectures.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 87a9305ddd5a61602c5f283996352e1122afaf1e)

Since February 2023, I decided to no longer work with Turris, I mean CZ.NIC company
due to some reasons how the development goes and since that day my work address is not
available and not sure if there is some redirect to someone else, but if anyone wants to
reach me, use my email address, where they can find me.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 1e1b2051db47a82513f4eb4e9da892207785b7e2)

This package is not maintained by upstream anymore as they replace it by Ntopng 3. [1]
Upstream repository is archived and read only since February 2022 [2]

[1] https://community.nethserver.org/t/bandwidthd-for-nethserver-7/4071/18
[2] https://github.com/NethServer/bandwidthd



Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit bb4c3b5a20807e6fdf23e0c66a6d13a6e368db92)

As of OpenWrt main branch commit e505873e65f72 ("armsr: armv8:
enable KVM host") [merged 2023-08-15], armsr/armv8 has
KVM host support. We can now enable QEMU host for this
target.

For example, you can run OpenWrt armsr/armv8 as a guest
like so:
qemu-system-aarch64 -nographic -M virt -cpu host --enable-kvm \
	-bios u-boot.bin -smp 1 -m 1024 \
	-drive file=openwrt-armsr-armv8-generic-ext4-combined.img,format=raw,index=0,media=disk

A compatible u-boot.bin can be obtained from u-boot-qemu_armv8/u-boot.bin
that is built with the armsr target and available from
downloads.openwrt.org.

Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 821bbcdf8bea7a864a038751908434578ec16339)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit b5463d16f1b962c36784ff92252db49b5b3791b9)

It seems that the Makefile has both CC and CFLAGS hardcoded and does not
allow overriding them by ones being passed by the buildsystem.

This works fine until CONFIG_PKG_ASLR_PIE_ALL is selected, then building
will fail with:
arm-openwrt-linux-muslgnueabi/bin/ld.bfd: mhz.o: relocation R_ARM_MOVW_ABS_NC against `a local symbol' can not be used when making a shared object; recompile with -fPIC
arm-openwrt-linux-muslgnueabi/bin/ld.bfd: mhz.o(.text+0x75c): unresolvable R_ARM_CALL relocation against symbol `__aeabi_l2d@@GCC_3.5

So, lets add a patch pending upstream that allows both CC and CFLAGS to be
overriden so that ones passed by the buildsystem are actually respected.

Fixes: 89123b308f98 ("mhz: add new package")
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 6c28f46f37d35dce06c320d9ac7f256c113aea22)

`/proc/net/netstat` `TcpExt:` line is 2064 chars long on linux 6.1

Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
[PKG_RELEASE bump added]
(cherry picked from commit b5bf5927f70231683262de36276ead1029f524e6)

Signed-off-by: Nuno Gonçalves <nunojpg@gmail.com>
(cherry picked from commit e95955f40b3731fa8df8bcc9b8b81218baa2b449)

Signed-off-by: Nuno Gonçalves <nunojpg@gmail.com>
(cherry picked from commit 9536d28384d0d924e8b03ce42dbc2d61ce4174d0)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 06e9fdfe00727d31a01e97c9946d4148687b8edb)

The package is terribly outdated and bundling it with the web UI is a
task I don't find myself willing to take. Dropping it.

FIX: #16008

Signed-off-by: Paul Spooren <paul.spooren@rhebo.com>

    Build system: x86_64
    Build-tested: bcm2711/RPi4B
    Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 58719c0aa4f33dc8eae83b98daff501835904662)

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Resolves: #15592

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>