Merge pull request #20443 from commodo/stress-updates

stress/stress-ng: bump versions

Merge pull request #20451 from graysky2/htop

htop: update to 3.2.2

stress: bump to version 1.0.7

Signed-off-by: Alexandru Ardelean <redacted>

stress-ng: bump to version 0.15.03

Signed-off-by: Alexandru Ardelean <redacted>

Merge pull request #20442 from commodo/python-updates1

python-{chardet,evdev}: bump versions

Merge pull request #20444 from commodo/sudo

sudo: bump to version 1.9.12p2

xl2tpd: bump to version 1.3.18

Signed-off-by: Yousong Zhou <redacted>

htop: update to 3.2.2

Build-tested: x86/64
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <redacted>

bind: bump PKG_RELEASE

bind: add option to enable GSSAPI support

Samba4 running as Active Directory Domain Controller with the internal
DNS backend requires the nsupdate binary with GSSAPI support.

Signed-off-by: Stijn Tintel <redacted>

bind: bump release number

Signed-off-by: Rucke Teg <redacted>

bind: Fix ipv6 detection logic

Bug was introduced in a7b770eec4370087a5ccd27887386dac9266214e and
results in bind always stating with the `-4` flag.

Signed-off-by: Rucke Teg <redacted>

Merge pull request #20446 from stangri/master-simple-adblock

simple-adblock: update to 1.9.3-7

simple-adblock: update to 1.9.3-7

* add boot() function which waits for network.interface to come up
* switch oisd.nl hosts entry to domains
* remove erroneous oisd substitution from config-update file

Signed-off-by: Stan Grishin <redacted>

sudo: bump to version 1.9.12p2

Signed-off-by: Alexandru Ardelean <redacted>

python-evdev: bump to version 1.6.1

Signed-off-by: Alexandru Ardelean <redacted>

python-chardet: bump to version 5.1.0

Signed-off-by: Alexandru Ardelean <redacted>

tailscale: update to 1.36.0

 - Update tailscale to version 1.36.0
 - Patch iptables support

Tailscale does not (yet) support nftables.
Tailscale allows running with --netfilter=off allowing
end-user to create his own firewall rules, but this
affects only tailscale cli, not tailscaled daemon, so
connection cannot be made without error telling that
tailscaled was unable to determine execute iptables
for determining it's version.

There is a work-around for those who do not want
nft-iptables compatibility package; they can create
a script to /usr/bin/iptables which responds to
--version argument and echos fake version string
and on any other arguments or no arguments, just exits.

After this procedure and starting tailscale cli with
netfilter off- it works. Openwrt has moved on to
nftables, so iptables manipulation seems unnecessary.
Especially for other reasons, on Openwrt, firewall
should be configured on it's own, because firewall
rules made by other software, such as tailscale,
loose their firewalling rules when firewall restarts.

So I patched it to allow "fake" iptables pointing
to executable /bin/false and ignoring version
request. And I also set cli to default to
netfilter off setting.

If still end-user wants to use iptables, this
patch does not make it impossible; just install
iptables, or nft-iptables, and run tailscale
with argument --netfilter=on and it works out
as it did before, tailscaled daemon still
matches with iptables if it is found in $PATH.

Signed-off-by: Oskari Rauta <redacted>

pdns-recursor: update to 4.8.2

Signed-off-by: Peter van Dijk <redacted>

openssh: actually build openssh-server-pam with pam support

Signed-off-by: Sibren Vasse <redacted>

openssh: update to 9.2p1

Signed-off-by: Sibren Vasse <redacted>

crowdsec-firewall-bouncer: update to 0.0.25

Update crowdsec-firewall-bouncer to latest upstream release version 0.0.25

Signed-off-by: S. Brusch <redacted>
Maintainer: Kerma Gérald <redacted>
Run tested: ipq40xx/generic, Fritzbox 4040, Openwrt 22.03.3

Rework:
- now based on uci config file
- create nftables tables and chains in initd script

stunnel: update version to 5.67

Signed-off-by: Florian Eckert <redacted>

Merge pull request #20415 from champtar/mv88e6xxx_dump

mv88e6xxx_dump: add new packages to debug switch issues

mv88e6xxx_dump: add new packages to debug switch issues

Reviewed-by: Chris Healy cphealy@gmail.com
Reviewed-by: Robert Marko <redacted>
Reviewed-by: Andre Heider <redacted>
Tested-by: Petr Štetiar <redacted>
Signed-off-by: Etienne Champetier <redacted>

Merge pull request #20387 from commodo/python3-venv-support

python3: add 'ensurepip' to python3-pip sub-package

Merge pull request #20366 from commodo/python-toml-support

python-build: add support for pyproject.toml files (reboot of #17130)

nghttp2: update to 1.51.0

Signed-off-by: An Phuc Nguyen <redacted>

v4l2loopback: upgrade to v0.12.7

Signed-off-by: Michel Promonet <redacted>

v4l2tools: upgrade to release 0.2.0

Signed-off-by: Michel Promonet <redacted>

shadowsocks-libev: ss-rules: Add 'auto-merge' flag to avoid conflicts

Link: https://github.com/openwrt/packages/pull/19872
Signed-off-by: Li Xin <redacted>
(squash commits)
Signed-off-by: Yousong Zhou <redacted>

haproxy: update to v2.6.8

- Update haproxy download URL and hash

Signed-off-by: Christian Lachner <redacted>

bind: update to 9.18.11

Fixes CVEs:
      - CVE-2022-3924: Fix serve-stale crash when recursive clients
      soft quota is reached.
      - CVE-2022-3736: Handle RRSIG lookups when serve-stale is
      active.
      - CVE-2022-3094: An UPDATE message flood could cause named to
      exhaust all available memory. This flaw was addressed by adding
      a new "update-quota" statement that controls the number of
      simultaneous UPDATE messages that can be processed or
      forwarded. The default is 100. A stats counter has been added to
      record events when the update quota is exceeded, and the XML and
      JSON statistics version numbers have been updated.

Signed-off-by: Noah Meyerhans <redacted>

snort3: update to 3.1.53.0

Upstream bump

Build system: x86_64
Build-tested: bcm2711/RPi4B
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <redacted>

nextdns: Update to version 1.39.4

Signed-off-by: Olivier Poitrey <redacted>

nextdns: Update to version 1.39.0

Signed-off-by: Olivier Poitrey <redacted>

python3: add 'ensurepip' to python3-pip sub-package

Fixes:
  https://github.com/openwrt/packages/issues/12707

Seems to work.
Looking into the 'venv' lib, it seems it's installing pip & setuptools
inside a virtual environment.

`python3-pip` is already ~6 MB.
This adds another ~3 MB.

But, this gives users the ability to run Python virtual environments, which
is a pretty common feature of Python in production cases (usually web
stuff).

Signed-off-by: Alexandru Ardelean <redacted>

uvol: add missing quote

Add missing quote which broke the autopart script.

Fixes: b1edbe349 ("uvol: fix regression in handling fractional megabytes free")
Signed-off-by: Daniel Golle <redacted>

snowflake: update to v2.5.1

Changes in version v2.4.3 - 2023-01-16
- Fix version number in version.go

(Changes for v2.5.1 are missing)

Signed-off-by: Nick Hainke <redacted>

delve: update to version 1.20.1

Signed-off-by: Glen Huang <redacted>

ncdu: update to 1.18

Upstream bump

Build system: x86_64
Build-tested: bcm2711/RPi4B
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <redacted>

clocate: update to latest HEAD

510cc94 main: remove duplicate import
bd84e09 log: add macro

Signed-off-by: David Bauer <redacted>

pdns-recursor: update to 4.8.1

Signed-off-by: Peter van Dijk <redacted>

treewide: bump PKG_RELEASE for libiwinfo dependant packages

Bump PKG_RELEASE for libiwinfo dependant packages.

Signed-off-by: Christian Marangi <redacted>

Merge pull request #20372 from stangri/master-pbr

pbr: bugfix: fix is_domain()

Merge pull request #20350 from turris-cz/bash

bash: update to version 5.2.15

uvol: fix regression in handling fractional megabytes free

Also, fix off-by-one issue when computing free size.

Signed-off-by: Philip Prindeville <redacted>

pbr: bugfix: fix is_domain()

* fixes https://github.com/openwrt/packages/issues/20352

Signed-off-by: Stan Grishin <redacted>

tcpreplay: bump to version 4.4.3

Signed-off-by: Alexandru Ardelean <redacted>

Merge pull request #20280 from oskarirauta/nasm

nasm: new package

libwebp: bump to version 1.3.0

Signed-off-by: Alexandru Ardelean <redacted>

nasm: new package

Signed-off-by: Oskari Rauta <redacted>

python-build: add support for pyproject.toml files

A new PEP 517 (https://www.python.org/dev/peps/pep-0517/) has defined that
Python packages can be shipped without any `setup.py` file, and that a
`pyproject.toml` file is sufficient.

A `setup.py` shim layer is suggested as a method for running the build.

For these cases, we will add a support in the OpenWrt build-system to
provide the default `setup.py` shim layer in case this file does not exist,
but there is a `pyproject.toml` file.

We also seem to need to tweak the shim layer with the PKG_VERSION,
otherwise the detected version is 0.0.0.
We will need to see if this will be fixed later in setuptools{-scm}.

Signed-off-by: Alexandru Ardelean <redacted>

xfrpc: update to version 2.1.606

Signed-off-by: Dengfeng Liu <redacted>

python-requests: bump to version 2.28.2

Signed-off-by: Alexandru Ardelean <redacted>

python-pytz: bump to version 2022.7.1

Signed-off-by: Alexandru Ardelean <redacted>

pillow: bump to version 9.4.0

Signed-off-by: Alexandru Ardelean <redacted>

Merge pull request #20363 from 1715173329/crun

crun: add libgcrypt dependency

crun: add libgcrypt dependency

Fixes: ad0aa1b2fc64e8 ("crun: update to 1.7.2")
Signed-off-by: Tianling Shen <redacted>

cloudflared: Update to 2023.1.0

Signed-off-by: Tianling Shen <redacted>

atlas-sw-probe: add more binaries

They were added in these commits [1] [2] and if they are not included,
the RIPE Atlas SW Probe does not work correctly.

This should also prevent this from happening in the future as it now. We include all
files with .sh extension file type.

[1] https://github.com/RIPE-NCC/ripe-atlas-software-probe/commit/70ced29fc3217dd8d61e2b78506b6103ded100aa
[2] https://github.com/RIPE-NCC/ripe-atlas-software-probe/commit/71a4ff0e68c55464f766ddb9f1dfe21b22e530db

Fixes: https://github.com/openwrt/packages/issues/20338
Signed-off-by: Josef Schlehofer <redacted>

snort3: update to 3.1.52.0

Upstream bump

Build system: x86_64
Build-tested: bcm2711/RPi4B
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <redacted>

snort3: update to 3.1.51.0

Upstream bump

Build system: x86_64
Build-tested: bcm2711/RPi4B
Run-tested: bcm2711/RPi4B

Signed-off-by: John Audia <redacted>

Merge pull request #20330 from dhewg/lrzsz

lrzsz: update to v0.12.21rc and fix a CVE

nano: update to 7.2

Update nano editor to version 7.2.

Signed-off-by: Hannu Nyman <redacted>

treewide: quote CC and CXX

When CC is set to e.g. "ccache mips-openwrt-linux-musl-gcc" it needs
to be quoted to avoid word splitting on substitution.

Signed-off-by: Paul Fertser <redacted>

openocd: select new libjaylink

Without the +select, openocd's internal autoselection between internal
libjaylink and external libjaylink can result in linking against
external, without the depends declaration, leading to missing
depdendencies errors.

Hard depend on the external libjaylink, as that's the future direction
anyway.

Reported-by: Paul Fertser <redacted>
Signed-off-by: Karl Palsson <redacted>

openocd: update to 0.12.0

Signed-off-by: Paul Fertser <redacted>

libjaylink: new package

libjaylink is a shared library written in C to access SEGGER J-Link
and compatible devices.

This is used by future OpenOCD versions to handle J-Link debug
adapters.

Signed-off-by: Paul Fertser <redacted>

bash: update to version 5.2.15

Refreshed patches

Signed-off-by: Josef Schlehofer <redacted>

udphp-client: bump to latest git HEAD

Fix build with gcc12.

Signed-off-by: Tianling Shen <redacted>

Merge pull request #20337 from bdrung/hosting.de

ddns-scripts: add hosting.de provider

git: update to 2.34.6

Fixes CVE-2022-23521
Fixes CVE-2022-41903
Fixes CVE-2022-39260
Fixes CVE-2022-39253
Fixes CVE-2022-29187

Signed-off-by: Michal Vasilek <redacted>

efibootmgr: new package

Co-authored-by: Tianling Shen <redacted>
Signed-off-by: Oskari Rauta <redacted>

efivar: new package

Co-authored-by: Tianling Shen <redacted>
Signed-off-by: Oskari Rauta <redacted>

v2ray-core: Update to 5.2.1

Signed-off-by: Tianling Shen <redacted>

Merge pull request #20256 from TDT-AG/pr/20230109-acpica-unix

acpica-unix: update version and fix gcc12 build

hiredis: update to version 1.1.0

See project release page[1] for more details.
Switch build to use CMake instead of autotools, allows removal of
local patch.

[1]: https://github.com/redis/hiredis/releases
Signed-off-by: Daniel Golle <redacted>

ddns-scripts: add hosting.de provider

Add hosting.de provider. To use dynamic DNS you have to create a DDNS
host with a separate DDNS user.

Note: As of 2023-01-17 hosting.de does not work with wget which will
fail with `400: Bad Request` (it will work with `--auth-no-challenge`).
You should use curl instead. I have reported that to the provider.

Signed-off-by: Benjamin Drung <redacted>

libv4l: update to 1.22.1

Signed-off-by: Rosen Penev <redacted>

Merge pull request #20311 from ValdikSS/miredo

miredo: add miredo.conf conffile

Merge pull request #20313 from neheb/10

stress: update to 1.0.5

borgbackup: bump to 1.2.3

Signed-off-by: Julien Malik <redacted>

python-exceptiongroup: bump to 1.1.0

Signed-off-by: Julien Malik <redacted>

Merge pull request #20317 from stangri/master-simple-adblock

simple-adblock: update sed for allowing domains

Merge pull request #20335 from stangri/master-pbr

pbr: update to 1.0.1-14

pbr: update to 1.0.1-14

* improve install/uninstall messages
* fix ips add command
* add boot() to init file

Signed-off-by: Stan Grishin <redacted>

Merge pull request #20213 from stangri/master-pbr

pbr: update to 1.0.1-10

pbr: update to 1.0.1-10

Bugfixes:
* better error information for empty tid/mark and failure to resolve domains
* better handling of entries in /etc/iproute2/rt_tables
* update packages definitions and descriptions
* remove firewall4 from dependencies to prevent dependency recursion

Updates:
* introduce nft_user_set_policy and nft_user_set_counter to control options for
  user nft sets this service creares
* use counters in internal nft sets

Signed-off-by: Stan Grishin <redacted>

miredo: add miredo.conf conffile

Keep miredo.conf modified configuration upon upgrades

Signed-off-by: ValdikSS ValdikSS <redacted>

Merge pull request #20296 from neheb/1

libxml2: build with cmake

podman: update to 4.3.1

Signed-off-by: Oskari Rauta <redacted>

atlas-sw-probe: update to version 5080

Signed-off-by: Josef Schlehofer <redacted>

yq: Update to 4.30.8

Signed-off-by: Tianling Shen <redacted>

Merge pull request #20326 from neheb/14

xinetd: fix URL

libgd: update to 2.3.3

Refresh patches.

Signed-off-by: Rosen Penev <redacted>

snowflake: update to 2.4.2

Changes in version v2.4.2 - 2023-01-13
- Issue 40208: Enhance help info for capacity flag
- Issue 40232: Update README and fix help output
- Issue 40173: Increase clientIDAddrMapCapacity
- Issue 40177: Manually unlock mutex in ClientMap.SendQueue
- Issue 40177: Have SnowflakeClientConn implement io.WriterTo
- Issue 40179: Reduce turbotunnel queueSize from 2048 to 512
- Issue 40187/40199: Take ownership of buffer in QueuePacketConn QueueIncoming/WriteTo
- Add more tests for URL encoded IPs (safelog)
- Fix server flag name
- Issue 40200: Use multiple parallel KCP state machines in the server
- Add a num-turbotunnel server transport option
- Issue: 40241: Switch default proxy STUN server to stun.l.google.com

Signed-off-by: Nick Hainke <redacted>

lrzsz: update to v0.12.21rc and fix a CVE

This updates to v0.12.21rc from 1999 (sic), which was never officially
released. There're fixes in there, and it's what debian ships, so let's
use that too. While at it, use debian's autohell hack and package
description too.

Patch 1 fixes a hang with musl.
Patch 2 fixes CVE-2018-10195, add PKG_CPE_ID while at it.

Refesh the rest.

Fixes: CVE-2018-10195
Signed-off-by: Andre Heider <redacted>

python3-libselinux: fix URL

Signed-off-by: Rosen Penev <redacted>

python3-libsemanage: fix URL

Signed-off-by: Rosen Penev <redacted>