* add the jail.local config to enable fail2ban on ssh to prevent
  brute force attack
* add datepattern for fail2ban to be able to function with syslog-ng
  generated /var/log/messages

Add support and set defaults for following in default sshd config:

* Ciphers:		aes256-ctr, aes192-ctr, aes128-ctr

* HostKeyAlgorithms:	ssh-dss, ssh-rsa, ecdsa-sha2-nistp521,
			ecdsa-sha2-nistp384,ecdsa-sha2-nistp256

* HostKeyFiles:		default is empty

* KexAlgorithms:	diffie-hellman-group-exchange-sha256,
			diffie-hellman-group14-sha1,
			ecdh-sha2-nistp521,ecdh-sha2-nistp384,
			ecdh-sha2-nistp256

* add uci-default script that will generate an sshd config from
  dropbear config, if present (to preserve settings from previous
  image which had dropbear), or with default values if sshd config
  is also not present

* the script will also check for dropbear key file and if found,
  place them where sshd expects them

the values read from uci will now be written to a config file
which will be passed to sshd, instead of passing the values
as command line arguments to sshd

nginx-ubus-module version was not updated since past 4 years.
It had many security and memory related fixes along with optimizations

This reverts commit 8b2c130b.

While 743f0c5b (perl: Run make depend to fix build race condition,
2024-03-05) fixed 98% of all parallel build failures there is still some
flakiness left in the perl build process. For now, give up instead of
digging deep into the perl build process to debug this.

We may later revert this commit to see whether the issue is fixed in a
later perl version in a later OpenWrt release.

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

Mohd Mehdi authored 11 months ago and Rahul Thakur committed 11 months ago

* openssh package is missing uci support in openwrt,
this commit implements the same. The init script
now reads from the uci and passes the arguments to
openssh.
* support for handling multiple instances is also
added.

note: the same has been up-streamed and has also got
1 approval already.

disable ftp by default so that the port is not open

The following init scripts have been modified to use procd:
* atftpd
* vsftpd

The following services are being advertised:

* atftpd: tftp
* nginx: http, https, http-alt, pcsync-https
* vsftpd: ftp
* xl2tpd: l2tp

Run make depend before building perl. This fixes parallel build failures
on machines with a high number of cores.

Example error 1:

    /bin/ln -s /build/staging_dir/hostpkg/usr/bin/generate_uudmap generate_uidmap
    make[5]: ./generate_uudmap: Command not found
    make[5]: *** [Makefile:321: bitcount.h] Error 127

Example error 2:

    /bin/ln -s /build/staging_dir/hostpkg/usr/bin/generate_uudmap generate_udmap
    ./generate_uudmap uudmap.h bitcount.h mg_data.h
    /bin/ln: failed to create symbolic link 'generate_uudmap': File exists
    make[5]: *** [Makefile:325: generate_uudmap] Error 1

Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996953
Link: https://salsa.debian.org/perl-team/interpreter/perl/-/commit/366bc98c916a3455f15c532aa33a5636d2fe2803
Closes: https://github.com/openwrt/packages/issues/8238


Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

libstrophe is dual-licensed as MIT OR GPL-3.0-only, which is also
reflected by the SPDX-License-Identifier lines in the source files.
Correct PKG_LICENSE in the Makefile accordingly.

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
(cherry picked from commit ccb4632c57d456289e79e6062b3349c8779bf8ce)

Instead of /sbin/ install logread to /usr/sbin/logread. This works
around a conflict with the logd package.

Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>

Amit Kumar authored 1 year ago and Rahul Thakur committed 1 year ago

child expect entry timeout value set handled
in the response message of PAUSE with condition
verification of cseq value.

This makes it consistent with configuration for busybox in IOWRT and
is needed for compatibility with pam_unix which lacks bcrypt support.

This reduces the memory footprint of LuCI firmware upgrades.

This reduces the memory footprint of LuCI firmware upgrades.

Merge commit 8e3a1824 as specified in
feeds.conf.default of OpenWrt tag v23.05.2.

[23.05] adblock-fast: bugfix: ensure downloaded block-lists end with newline

* ensure downloaded block-lists end with newline
* turn free/total RAM checks into functions calls

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 3787b4135584ad2a6510dbd883406d30575dce5c)

[23.05] perl: add support for riscv64

[23.05] adblock-fast: update to 1.0.1-1

* support backup/restore for remote allowlists
* report the used log variant in status message

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 2411bcffaf273b901e61193b18f1ca7355dc832f)

* the log file monitor now supports standard log files used by other log daemons like syslog-ng
  Set 'ban_logreadfile' accordingly, by default it points to /var/log/messages
* removed logd dependency, closes #21932

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit c4e814074003a1d45bb583e98cac435575e09ca4)

Resolves: #22632

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit eabb6b8a747acb2292b81ff59417310f12e319f7)

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 56e29ed7daf39b683be49f06cb4bc065b2bdfd35)

* update Makefile copyright info
* organize functions shared between the init script, uci-defaults and
  luci app in alphabetical order
* update error, warning and status messaging
* use single quotes instead double quotes for static text labels
* better warning for missing recommended packages
* rename dns function to resolver to better reflect its purpose
* improve resolver cleanup code
* move _resolver_config function inside resolver function to improve code readlibity
* rename _process_file_url to process_file_url_wrapper to better reflect its purpose
* add preflight check for available RAM vs total size of block lists
* move _config_add_url_size function inside adb_sizes function to improve code readlibity
* remove uci validation from status_service function to improve performance
* source init script from uci-defaults to include shared functions

Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 11df396a18733111a0801d3967142ec0014b564b)

[23.05] php8: update to 8.2.12